40 lines
3.7 KiB
Markdown
40 lines
3.7 KiB
Markdown
# proof-kinds: one builder for every AIP-23 proof kind
|
|
|
|
A generic builder of AERE Proof Protocol envelopes (AIP-23) for the standard proof kinds: `data`, `execution`, `identity`,
|
|
`compliance`, `runtime`, `location`, `device`, `payment`, `ownership`, `time`, `block`, `authorization`, `settlement`,
|
|
`provenance` and, since 2026-10-18, `secret-access`. Every kind produces the same envelope (`statement` plus `statementHash`, the
|
|
SHA-256 of the canonical statement text), so the same AIP-23 reference verifier checks all of them with no kind-specific
|
|
verification code.
|
|
|
|
```
|
|
import { buildProof, KINDS } from './proof-kinds.mjs';
|
|
const envelope = buildProof('runtime', { host, artifactContent, attested, matches: true, createdAt });
|
|
```
|
|
|
|
A kind is a schema: its required fields, some of them digests, plus `createdAt`. Raw content given for a digest field is hashed
|
|
(bytes as they are, strings as UTF-8, other values as their JSON text), and a value that is already a 32-byte digest is kept, so
|
|
an envelope carries digests, never the raw content. A missing required field stops the build with an error instead of producing
|
|
an incomplete envelope. Notarization and the post-quantum certificate over it come from AIP-23, not from this builder.
|
|
|
|
`secret-access` is the audit entry of the secrets service (`pq-secrets/`): the service (its audience), the secret name, the version,
|
|
the operation, the verdict (`allowed`, `refused`, or since 2026-10-18 `failed`: allowed and entered, then the change could not be
|
|
stored) with the rules that refused, the grant that allowed, the holder and the presenter (key-derived `aere-id` identities,
|
|
verified), the digest of the presentation's signed binding (`presentationHash`) and of the grant's policy (`policyHash`). It never
|
|
carries the secret value, nor a digest of it: a digest of a guessable value does not hide it. Since 2026-10-18 (the adversarial
|
|
review of the secrets service) it may also carry `requestHash` (the digest of the request received, already a 32-byte hash),
|
|
`claimedHolder` / `claimedPresenter` (ids a presentation claimed and nobody verified) and `judged` (on a refusal, each grant judged
|
|
with the rules it refused on); envelopes without these fields are byte for byte what they were.
|
|
|
|
**A kind may have a vocabulary** (`valori` in its schema: per field, a predicate and what it says), judged by `buildProof` on every
|
|
field present; `secret-access` is the only kind with one: `verdict` is `allowed`, `refused` or `failed`, `operation` one of the
|
|
operations of the secrets service (`SECRET_ACCESS.operations`, which the service requires to be its own list), `version` an integer of
|
|
at least 1 or `null`, `rules` a list of rule names, ids `aere-id:` + 40 hex or `null`, `createdAt` an RFC 3339 time. An envelope with
|
|
the verdict `banana` is no longer built. The reference verifier does not judge vocabularies (it judges the form and the hash of any
|
|
kind), so an envelope written by hand with such values stays `VALID` there: the vocabulary is the builder's promise, not the
|
|
verifier's. `KINDS.json` of the published copy names the values of each field that has them.
|
|
|
|
Test: `node proba-proof-kinds.mjs` (28 checks: every kind built and found `VALID` by the reference verifier, seven negative
|
|
controls such as content changed after hashing, a required field missing or a `secret-access` value outside its vocabulary, no raw
|
|
content in any envelope, bytes hashed as bytes, the new `secret-access` fields, the vocabulary held by that kind alone). It needs the AIP-23 reference verifier: `AERE_VERIFY_PROOF=<path to verify-proof.mjs>` (as published at
|
|
aere.network/tools, with `verify-anchor.mjs`, `mpt.mjs`, `falcon512.mjs`, `registry-v3.mjs` and `package.json` beside it and `npm install` done there); without it the test reports that it did not measure and exits with 2. Node.js 24.
|