mrwulf
993cfb85d4
The estate doc audit scoped itself to *.md and missed the text a site visitor actually reads: the string constants in webdocs.py. Fixed here, verified by RENDERING the page from the live 19-leaf state and checking each block: - The SVG head label reads "Ed25519 + SLH-DSA" when the live head is dual-signed, "Ed25519" when it is not — computed, not asserted. - The trust-anchor card now carries BOTH keys the same way: full PEM, SHA-256 fingerprint, raw endpoint (/v1/log-slhdsa-public-key), mirror comparison link. The Ed25519 key stays the required anchor; the SLH-DSA key is the additive post-quantum one, and the card says whose proof subject its verify path is (leaf 18). - The registered homepage overclaim (register: homepage-stdlib-claim) is closed: "stdlib-only" wording replaced with the truth — stdlib hashing, signature checks shell out to the openssl binary, fails closed without. - "one signature and ~N hashes" became "one REQUIRED signature (Ed25519; heads from tree 14 add an additive post-quantum SLH-DSA signature)". - The paper card is reframed (frozen under review, describes the 16 July snapshot, "then-thirteen-leaf") and followed by a new reader-guidance card (operator-ordered): the paper-era prefix is unchanged inside the live history — leaves 0-12 byte-identical, the paper's head still head #5 of sth-history — verify.py --all checks both eras at once; the advances are additive (44-cert re-attestations, leaf 18, dual-signed heads, ABSENT on older heads by design); and the 3,867 divergence the paper honestly reports has since been CLOSED (sn==0 fix, 2026-07-23, pinned count now 0) — both the divergence and the fix are part of the retained record. Layout fact the render surfaced: the served log dir must contain the .pub files (that is what /v1/log-public-key reads); the SLH-DSA pub joins the Ed25519 one there. Suite 152/0/0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src/pacta_provider | ||
| pyproject.toml | ||
| README.md | ||
PACTA Proof Check Provider
This nested project is a prototype third-party proof-checking service. It reuses host Lean/Aeneas infrastructure, runs portable PACTA replay/audit checks, and emits signed attestation certificates.
It does not modify anything outside this repository. It may read configured toolchains such as /Users/oho/GitClone/ClaudeCodeProjects/your-lean-project/aeneas-toolchain/env.sh.
It can also maintain a local transparency log. The log is an RFC 9162-style Merkle accumulator over signed attestations. It emits Signed Tree Heads with Ed25519 today; heads are dual-sign capable with an additive SLH-DSA-SHA2-128s slot (proven verify path), and the ML-DSA/FIPS 204 slot stays honestly not_configured/unavailable — never silently filled. Agents that require both signatures must reject such receipts.
Commands
PYTHONPATH=src:provider/src python -m pacta_provider discover
PYTHONPATH=src:provider/src python -m pacta_provider init-key --key-dir provider/state/demo-provider
PYTHONPATH=src:provider/src python -m pacta_provider check \
--config examples/repos.yaml \
--repo-name dalek-ed25519-verified \
--repo repos/dalek-ed25519-verified \
--provider local-pacta-provider \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub \
--out provider/out/dalek.attestation.yaml
Transparency log:
PYTHONPATH=src:provider/src python -m pacta_provider log-init \
--log-dir provider/state/transparency-log \
--provider local-pacta-provider \
--public-key provider/state/demo-provider/provider.ed25519.pub
PYTHONPATH=src:provider/src python -m pacta_provider log-append \
--log-dir provider/state/transparency-log \
--attestation provider/out/dalek.attestation.yaml \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub \
--out provider/out/dalek.receipt.yaml
PYTHONPATH=src:provider/src python -m pacta_provider log-sth \
--log-dir provider/state/transparency-log \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub
The resulting certificate can be consumed by pacta with --attestation, --trust-attestation-provider, and --attestation-public-key.
The receipt can be consumed with --transparency-receipt, --transparency-log-public-key, and --require-transparency-receipt.
The private key must remain provider-side. Downstream agents only need the public key, the inclusion receipt, and a policy decision that the provider name/log key is trusted.