mrwulf
f54e47778b
Operator-found (and root-caused): the v0.11 card replace had silently no-opped on an invisible NBSP in 'vs.\xa0today' — the page said 23 pages and still carried the July-snapshot card one paragraph under the 'New in v0.11' sentence. Fixed by byte-anchored replace with post-assert; a source regression test now forbids the stale markers outright and check-paper.sh binds the page-count claim to pdfinfo. Executability (tested by actually running them): the printed curl had no scheme and returned empty through the redirect -> https form; the zero-install one-liner was missing its cd -> added; 'Standard-library Python only' contradicted the openssl requirement stated 20 lines earlier -> made honest; 'table above' pointed at a table that is below -> below; '~25 lines of Python' vs the 346-line fail-closed verify.py -> 'one-page core (paper Appendix C), shipped verify.py wraps it'. Comprehensibility (fresh-eyes audit, 28 findings triaged): first-use glosses for STH, axiom cones, certificates, pinning, split view, pins.json, trusted base, residual-risk list, R0-R5, signature tiers; Lean 4 linked; Merkle accumulator glossed; operator=provider declared; the ✗-leaves explained as the failed round 1 vs clean re-attest; the flagship self-reference gets a plain lead sentence; TOFU named and bounded; pacta install source at the first pacta command; coined verb 'machine-re-check' uncoined; pitch parenthetical trimmed (SLH detail lives in its own block). Suite 153 green (new: webdocs stale-claim regression test). |
||
|---|---|---|
| .. | ||
| src/pacta_provider | ||
| pyproject.toml | ||
| README.md | ||
PACTA Proof Check Provider
This nested project is a prototype third-party proof-checking service. It reuses host Lean/Aeneas infrastructure, runs portable PACTA replay/audit checks, and emits signed attestation certificates.
It does not modify anything outside this repository. It may read configured toolchains such as /Users/oho/GitClone/ClaudeCodeProjects/your-lean-project/aeneas-toolchain/env.sh.
It can also maintain a local transparency log. The log is an RFC 9162-style Merkle accumulator over signed attestations. It emits Signed Tree Heads with Ed25519 today; heads are dual-sign capable with an additive SLH-DSA-SHA2-128s slot (proven verify path), and the ML-DSA/FIPS 204 slot stays honestly not_configured/unavailable — never silently filled. Agents that require both signatures must reject such receipts.
Commands
PYTHONPATH=src:provider/src python -m pacta_provider discover
PYTHONPATH=src:provider/src python -m pacta_provider init-key --key-dir provider/state/demo-provider
PYTHONPATH=src:provider/src python -m pacta_provider check \
--config examples/repos.yaml \
--repo-name dalek-ed25519-verified \
--repo repos/dalek-ed25519-verified \
--provider local-pacta-provider \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub \
--out provider/out/dalek.attestation.yaml
Transparency log:
PYTHONPATH=src:provider/src python -m pacta_provider log-init \
--log-dir provider/state/transparency-log \
--provider local-pacta-provider \
--public-key provider/state/demo-provider/provider.ed25519.pub
PYTHONPATH=src:provider/src python -m pacta_provider log-append \
--log-dir provider/state/transparency-log \
--attestation provider/out/dalek.attestation.yaml \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub \
--out provider/out/dalek.receipt.yaml
PYTHONPATH=src:provider/src python -m pacta_provider log-sth \
--log-dir provider/state/transparency-log \
--private-key provider/state/demo-provider/provider.ed25519.key \
--public-key provider/state/demo-provider/provider.ed25519.pub
The resulting certificate can be consumed by pacta with --attestation, --trust-attestation-provider, and --attestation-public-key.
The receipt can be consumed with --transparency-receipt, --transparency-log-public-key, and --require-transparency-receipt.
The private key must remain provider-side. Downstream agents only need the public key, the inclusion receipt, and a policy decision that the provider name/log key is trusted.