f1ab0250dc
A jcp/1 receipt proved that a decision happened over a grant for an action at a cost — but NOT what it was over. Two decisions differing only in payload sealed to identical bytes, so a tool-call receipt did not commit its arguments and a payload substitution was undetectable in the audit. This adds `payload_hash` to the signed core and bumps the profile to `jcp/2`. The bump is honest rather than silent. Until now the `jcp_receipt` tag was WRITTEN BUT NEVER READ — decorative. It is now load-bearing: `verify` and `verify_chained` read the profile out of the signed core and recompute the preimage under THAT profile, so receipts sealed as `jcp/1` keep verifying, and an unrecognised tag is refused rather than assumed. `jcp/1` is no longer minted. Scope, verified rather than assumed. JCR-1 is a FAMILY OF SIBLING PROFILES that share the envelope (canonical det-CBOR + COSE_Sign1/EdDSA) and vocabulary, each signing its own core. jouleclaw-jcr1 is an independent implementation but signs its own receipt kinds (coding/stream windows, ui output) — zero grant_id/verdict — and sense/map/sandbox vectors carry their own cores (map tags its own "map/1"). So this changes ONE profile among siblings and does not touch theirs. SPEC §8 now says exactly that, instead of implying a single family-wide core. - to_jcr1_wire gains `payload_hash`; `_chained` and `_logged` inherit it (both already funnel through it — one insertion point, not three). - to_jcr1_wire_v1 retains the byte-exact legacy projection, for verification only. - ReceiptCore exposes `payload_hash: Option<String>` — Some on jcp/2, None on a legacy receipt, so callers can tell a payload-bound receipt from one that isn't. - New ReceiptError::UnknownProfile. Migration proven with REAL bytes, not a reconstruction: the allow receipt published in conformance/v1/vectors.json before this change is embedded in a test and MUST still verify. The v1 receipts are also preserved as conformance/v1/legacy_jcp1.json so cross-language verifiers can prove they honour the dispatch. Vectors regenerated to jcp/2 (both duplicate paths kept in sync). SPEC §8 rewritten (field list, the REQUIRED version-dispatch rule, the sibling-profile clarification) + conformance class C23, executable in the harness: payload committed, payload-swap forgery caught, jcp/1 still verifies. 40 workspace suites green, clippy clean, all conformance checks pass. Co-Authored-By: Claude Opus 4.8 <[email protected]>
84 lines
7.1 KiB
JSON
84 lines
7.1 KiB
JSON
{
|
|
"grant": {
|
|
"budget_funds": {
|
|
"currency": "USD",
|
|
"minor": 500
|
|
},
|
|
"budget_uj": 1000000,
|
|
"id_hex": "6029fa6238bf16b012276af6d63378dc23b7a582d2790e5750f9c335167637ae",
|
|
"issuer": "did:key:z6Mkon3Necd6NkkyfoGoHxid2znGc59LU3K7mubaRcFbLfLX",
|
|
"signature_hex": "b1a94961108cdcac11affb93f0407fe9a1c82c771cbd28f03ad98cd7f28de55963ea8f41415d25a08879efd9c5dab2e646a1a36dabcbb1ea18bea8815ed2ef07",
|
|
"subject": "did:key:z6Mko9hTggMwjSTEaJaPUfE6tqcy2xvU6BnNq3e3o8qVBiyH"
|
|
},
|
|
"receipts": [
|
|
{
|
|
"envelope_hex": "d284581fa201270458196469643a6578616d706c653a6a63702d7265666572656e6365a0590226af65747275737467636f6e74726f6c66616374696f6e64726561646669737375657278386469643a6b65793a7a364d6b6f6e334e656364364e6b6b79666f476f48786964327a6e476335394c55334b376d756261526346624c664c5867636f73745f756a0a677374657761726478196469643a6578616d706c653a6a63702d7265666572656e6365677375626a65637478386469643a6b65793a7a364d6b6f39685467674d776a535445614a615055664536747163793278765536426e4e713365336f38715642697948677665726469637465616c6c6f77686772616e745f6964784036303239666136323338626631366230313232373661663664363333373864633233623761353832643237393065353735306639633333353136373633376165687265736f75726365784030663766623535636565393361623937373738323936303865383531666133316536386531326462396466633061383032366164323938333134636633663932696275646765745f756a1a000f42406a6672616d655f6b696e6469746f6f6c2d63616c6c6b6a63705f72656365697074656a63702f326c7061796c6f61645f6861736878406630303364623363386664646333363131636437356364636230353130383630363932336530626331333765393966353361383362666464356338666436643671656e657267795f70726f76656e616e63656748775368756e74736275646765745f72656d61696e696e675f756a1a000f4236584069e269c8401641184d9dec4f289bc75a37b41c526d7d785303fe5d673c38e54fce6df59bf7b75ce6dde602b0b7bfd880946ce5f69dd23a4ee6d602e47ac00b00",
|
|
"verdict": "allow",
|
|
"wire": {
|
|
"action": "read",
|
|
"budget_remaining_uj": 999990,
|
|
"budget_uj": 1000000,
|
|
"cost_uj": 10,
|
|
"energy_provenance": "HwShunt",
|
|
"frame_kind": "tool-call",
|
|
"grant_id": "6029fa6238bf16b012276af6d63378dc23b7a582d2790e5750f9c335167637ae",
|
|
"issuer": "did:key:z6Mkon3Necd6NkkyfoGoHxid2znGc59LU3K7mubaRcFbLfLX",
|
|
"jcp_receipt": "jcp/2",
|
|
"payload_hash": "f003db3c8fddc3611cd75cdcb05108606923e0bc137e99f53a83bfdd5c8fd6d6",
|
|
"resource": "0f7fb55cee93ab9777829608e851fa31e68e12db9dfc0a8026ad298314cf3f92",
|
|
"steward": "did:example:jcp-reference",
|
|
"subject": "did:key:z6Mko9hTggMwjSTEaJaPUfE6tqcy2xvU6BnNq3e3o8qVBiyH",
|
|
"trust": "control",
|
|
"verdict": "allow"
|
|
}
|
|
},
|
|
{
|
|
"envelope_hex": "d284581fa201270458196469643a6578616d706c653a6a63702d7265666572656e6365a0590240b065747275737467636f6e74726f6c66616374696f6e64726561646669737375657278386469643a6b65793a7a364d6b6f6e334e656364364e6b6b79666f476f48786964327a6e476335394c55334b376d756261526346624c664c5867636f73745f756a0a677374657761726478196469643a6578616d706c653a6a63702d7265666572656e6365677375626a65637478386469643a6b65793a7a364d6b6f39685467674d776a535445614a615055664536747163793278765536426e4e713365336f3871564269794867766572646963746464656e79686772616e745f6964784036303239666136323338626631366230313232373661663664363333373864633233623761353832643237393065353735306639633333353136373633376165687265736f75726365784030663766623535636565393361623937373738323936303865383531666133316536386531326462396466633061383032366164323938333134636633663932696275646765745f756a1a000f42406a6672616d655f6b696e6469746f6f6c2d63616c6c6b64656e795f726561736f6e6e66756e64732d65786365656465646b6a63705f72656365697074656a63702f326c7061796c6f61645f6861736878406630303364623363386664646333363131636437356364636230353130383630363932336530626331333765393966353361383362666464356338666436643671656e657267795f70726f76656e616e63656748775368756e74736275646765745f72656d61696e696e675f756a1a000f42365840e7b6f8c47ddb7ac5e7466a730db4e1f56577b5e511ba5d0864d11d02188378f931571a1c02bed41f384dbd3cb53ab2f25da33cbb5604c112643b7f4a3fc2b003",
|
|
"verdict": "deny",
|
|
"wire": {
|
|
"action": "read",
|
|
"budget_remaining_uj": 999990,
|
|
"budget_uj": 1000000,
|
|
"cost_uj": 10,
|
|
"deny_reason": "funds-exceeded",
|
|
"energy_provenance": "HwShunt",
|
|
"frame_kind": "tool-call",
|
|
"grant_id": "6029fa6238bf16b012276af6d63378dc23b7a582d2790e5750f9c335167637ae",
|
|
"issuer": "did:key:z6Mkon3Necd6NkkyfoGoHxid2znGc59LU3K7mubaRcFbLfLX",
|
|
"jcp_receipt": "jcp/2",
|
|
"payload_hash": "f003db3c8fddc3611cd75cdcb05108606923e0bc137e99f53a83bfdd5c8fd6d6",
|
|
"resource": "0f7fb55cee93ab9777829608e851fa31e68e12db9dfc0a8026ad298314cf3f92",
|
|
"steward": "did:example:jcp-reference",
|
|
"subject": "did:key:z6Mko9hTggMwjSTEaJaPUfE6tqcy2xvU6BnNq3e3o8qVBiyH",
|
|
"trust": "control",
|
|
"verdict": "deny"
|
|
}
|
|
},
|
|
{
|
|
"envelope_hex": "d284581fa201270458196469643a6578616d706c653a6a63702d7265666572656e6365a0590243b065747275737467636f6e74726f6c66616374696f6e64726561646669737375657278386469643a6b65793a7a364d6b6f6e334e656364364e6b6b79666f476f48786964327a6e476335394c55334b376d756261526346624c664c5867636f73745f756a01677374657761726478196469643a6578616d706c653a6a63702d7265666572656e6365677375626a65637478386469643a6b65793a7a364d6b6f39685467674d776a535445614a615055664536747163793278765536426e4e713365336f3871564269794867766572646963746464656e79686772616e745f6964784036303239666136323338626631366230313232373661663664363333373864633233623761353832643237393065353735306639633333353136373633376165687265736f75726365784030663766623535636565393361623937373738323936303865383531666133316536386531326462396466633061383032366164323938333134636633663932696275646765745f756a1a000f42406a6672616d655f6b696e6469746f6f6c2d63616c6c6b64656e795f726561736f6e7163757272656e63792d6d69736d617463686b6a63705f72656365697074656a63702f326c7061796c6f61645f6861736878406630303364623363386664646333363131636437356364636230353130383630363932336530626331333765393966353361383362666464356338666436643671656e657267795f70726f76656e616e63656748775368756e74736275646765745f72656d61696e696e675f756a1a000f4236584065e1e5037b3575c22dbeef1f8d86d79f7d3f23f1786567a6f48ccb4b1ae3a04ea92b8e19b723f59c5e82288cb80559975fe4e88ef67dd8091c6e52b9f1c33609",
|
|
"verdict": "deny",
|
|
"wire": {
|
|
"action": "read",
|
|
"budget_remaining_uj": 999990,
|
|
"budget_uj": 1000000,
|
|
"cost_uj": 1,
|
|
"deny_reason": "currency-mismatch",
|
|
"energy_provenance": "HwShunt",
|
|
"frame_kind": "tool-call",
|
|
"grant_id": "6029fa6238bf16b012276af6d63378dc23b7a582d2790e5750f9c335167637ae",
|
|
"issuer": "did:key:z6Mkon3Necd6NkkyfoGoHxid2znGc59LU3K7mubaRcFbLfLX",
|
|
"jcp_receipt": "jcp/2",
|
|
"payload_hash": "f003db3c8fddc3611cd75cdcb05108606923e0bc137e99f53a83bfdd5c8fd6d6",
|
|
"resource": "0f7fb55cee93ab9777829608e851fa31e68e12db9dfc0a8026ad298314cf3f92",
|
|
"steward": "did:example:jcp-reference",
|
|
"subject": "did:key:z6Mko9hTggMwjSTEaJaPUfE6tqcy2xvU6BnNq3e3o8qVBiyH",
|
|
"trust": "control",
|
|
"verdict": "deny"
|
|
}
|
|
}
|
|
],
|
|
"spent_after": {
|
|
"minor": 300,
|
|
"uj": 10
|
|
}
|
|
}
|