aere-quantum/proof-kinds

proof-kinds: one builder for every AIP-23 proof kind

A generic builder of AERE Proof Protocol envelopes (AIP-23) for the standard proof kinds: data, execution, identity, compliance, runtime, location, device, payment, ownership, time, block, authorization, settlement, provenance and, since 2026-10-18, secret-access. Every kind produces the same envelope (statement plus statementHash, the SHA-256 of the canonical statement text), so the same AIP-23 reference verifier checks all of them with no kind-specific verification code.

import { buildProof, KINDS } from './proof-kinds.mjs';
const envelope = buildProof('runtime', { host, artifactContent, attested, matches: true, createdAt });

A kind is a schema: its required fields, some of them digests, plus createdAt. Raw content given for a digest field is hashed (bytes as they are, strings as UTF-8, other values as their JSON text), and a value that is already a 32-byte digest is kept, so an envelope carries digests, never the raw content. A missing required field stops the build with an error instead of producing an incomplete envelope. Notarization and the post-quantum certificate over it come from AIP-23, not from this builder.

secret-access is the audit entry of the secrets service (pq-secrets/): the service (its audience), the secret name, the version, the operation, the verdict (allowed, refused, or since 2026-10-18 failed: allowed and entered, then the change could not be stored) with the rules that refused, the grant that allowed, the holder and the presenter (key-derived aere-id identities, verified), the digest of the presentation's signed binding (presentationHash) and of the grant's policy (policyHash). It never carries the secret value, nor a digest of it: a digest of a guessable value does not hide it. Since 2026-10-18 (the adversarial review of the secrets service) it may also carry requestHash (the digest of the request received, already a 32-byte hash), claimedHolder / claimedPresenter (ids a presentation claimed and nobody verified) and judged (on a refusal, each grant judged with the rules it refused on); envelopes without these fields are byte for byte what they were.

A kind may have a vocabulary (valori in its schema: per field, a predicate and what it says), judged by buildProof on every field present; secret-access is the only kind with one: verdict is allowed, refused or failed, operation one of the operations of the secrets service (SECRET_ACCESS.operations, which the service requires to be its own list), version an integer of at least 1 or null, rules a list of rule names, ids aere-id: + 40 hex or null, createdAt an RFC 3339 time. An envelope with the verdict banana is no longer built. The reference verifier does not judge vocabularies (it judges the form and the hash of any kind), so an envelope written by hand with such values stays VALID there: the vocabulary is the builder's promise, not the verifier's. KINDS.json of the published copy names the values of each field that has them.

Test: node proba-proof-kinds.mjs (28 checks: every kind built and found VALID by the reference verifier, seven negative controls such as content changed after hashing, a required field missing or a secret-access value outside its vocabulary, no raw content in any envelope, bytes hashed as bytes, the new secret-access fields, the vocabulary held by that kind alone). It needs the AIP-23 reference verifier: AERE_VERIFY_PROOF=<path to verify-proof.mjs> (as published at aere.network/tools, with verify-anchor.mjs, mpt.mjs, falcon512.mjs, registry-v3.mjs and package.json beside it and npm install done there); without it the test reports that it did not measure and exits with 2. Node.js 24.