3.7 KiB
proof-kinds: one builder for every AIP-23 proof kind
A generic builder of AERE Proof Protocol envelopes (AIP-23) for the standard proof kinds: data, execution, identity,
compliance, runtime, location, device, payment, ownership, time, block, authorization, settlement,
provenance and, since 2026-10-18, secret-access. Every kind produces the same envelope (statement plus statementHash, the
SHA-256 of the canonical statement text), so the same AIP-23 reference verifier checks all of them with no kind-specific
verification code.
import { buildProof, KINDS } from './proof-kinds.mjs';
const envelope = buildProof('runtime', { host, artifactContent, attested, matches: true, createdAt });
A kind is a schema: its required fields, some of them digests, plus createdAt. Raw content given for a digest field is hashed
(bytes as they are, strings as UTF-8, other values as their JSON text), and a value that is already a 32-byte digest is kept, so
an envelope carries digests, never the raw content. A missing required field stops the build with an error instead of producing
an incomplete envelope. Notarization and the post-quantum certificate over it come from AIP-23, not from this builder.
secret-access is the audit entry of the secrets service (pq-secrets/): the service (its audience), the secret name, the version,
the operation, the verdict (allowed, refused, or since 2026-10-18 failed: allowed and entered, then the change could not be
stored) with the rules that refused, the grant that allowed, the holder and the presenter (key-derived aere-id identities,
verified), the digest of the presentation's signed binding (presentationHash) and of the grant's policy (policyHash). It never
carries the secret value, nor a digest of it: a digest of a guessable value does not hide it. Since 2026-10-18 (the adversarial
review of the secrets service) it may also carry requestHash (the digest of the request received, already a 32-byte hash),
claimedHolder / claimedPresenter (ids a presentation claimed and nobody verified) and judged (on a refusal, each grant judged
with the rules it refused on); envelopes without these fields are byte for byte what they were.
A kind may have a vocabulary (valori in its schema: per field, a predicate and what it says), judged by buildProof on every
field present; secret-access is the only kind with one: verdict is allowed, refused or failed, operation one of the
operations of the secrets service (SECRET_ACCESS.operations, which the service requires to be its own list), version an integer of
at least 1 or null, rules a list of rule names, ids aere-id: + 40 hex or null, createdAt an RFC 3339 time. An envelope with
the verdict banana is no longer built. The reference verifier does not judge vocabularies (it judges the form and the hash of any
kind), so an envelope written by hand with such values stays VALID there: the vocabulary is the builder's promise, not the
verifier's. KINDS.json of the published copy names the values of each field that has them.
Test: node proba-proof-kinds.mjs (28 checks: every kind built and found VALID by the reference verifier, seven negative
controls such as content changed after hashing, a required field missing or a secret-access value outside its vocabulary, no raw
content in any envelope, bytes hashed as bytes, the new secret-access fields, the vocabulary held by that kind alone). It needs the AIP-23 reference verifier: AERE_VERIFY_PROOF=<path to verify-proof.mjs> (as published at
aere.network/tools, with verify-anchor.mjs, mpt.mjs, falcon512.mjs, registry-v3.mjs and package.json beside it and npm install done there); without it the test reports that it did not measure and exits with 2. Node.js 24.