diff --git a/conformance/composition/ccs-v14-aeb-github-v0.1/JOINT-ASSESSMENT.md b/conformance/composition/ccs-v14-aeb-github-v0.1/JOINT-ASSESSMENT.md new file mode 100644 index 000000000..d460802ea --- /dev/null +++ b/conformance/composition/ccs-v14-aeb-github-v0.1/JOINT-ASSESSMENT.md @@ -0,0 +1,142 @@ +# Joint Interoperability Assessment — CCS v1.4 receipt as EMILIA pre-admission evidence + +**Status:** DRAFT v3 for joint review — not final and must not be merged or represented as jointly approved until both parties approve the exact bytes. +**Date:** 2026-08-30 +**Revision:** v3 supersedes v2 (2026-08-29): per joint review — (a) bundle-scope counts in section 3 reflect the full pinned bundle (489 manifest-covered files, 64 expected-outcome cases); (b) the Correctover checker is described as a standalone package-independent check that operates without importing the CCS verifier package; (c) wording aligned for the public repository. Vectors, the eight composition outcomes, artifact pins, and all product boundaries are unchanged. +**Parties:** +- **EMILIA Protocol, Inc.** — Iman Schrock (`team@emiliaprotocol.ai`) +- **Correctover** — Guigui Wang (`wangguigui@correctover.com`) + +--- + +## 1. Question + +In the EMILIA standalone composition harness at commit `995d803`, can the pinned +CCS v1.4 L1 conformance receipt (`upstream-01-allow`, 30 fields, Ed25519 over JCS) +be **independently verified by a party that imports none of the issuer's code**, then +**bound to one exact EMILIA action and one relying-party admission domain**, with the +current authority state in the harness and provider entry kept separate and closed +(fail-closed; at-most-one applies to the counting provider entry, not to a physical +effect)? + +**Answer: yes, for this fixture** — established from bytes each side ran independently. + +## 2. Pinned artifacts + +| Artifact | Pin | +|---|---| +| CCS conformance bundle | `https://github.com/DSHCorrectover/ccs-conformance-vectors` | +| Bundle commit | `a3503b2bc48922f92a28c372003885a0831da02b` | +| Bundle manifest sha256 | `3e77eae3045eb2bc824c52b8d022b75029beaf56623841ce7c035a99e65a2ddd` | +| EMILIA standalone harness | `https://github.com/emiliaprotocol/emilia-protocol` | +| Harness commit | `995d80367f99601bb16509c6c89a5f9e72c74885` | +| Harness dir | `conformance/composition/ccs-v14-aeb-github-v0.1/` | +| Standalone entrypoint sha256 | `c809c257348ab635819d1cffe33f7051d285b1ffe5d06903dc2989b033ca514a` | +| Upstream ALLOW receipt sha256 | `889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361` | +| Reference report sha256 | `a197793b835f00f1bd350f29101a47b234ea63240df29a6a372e350ad599c9d4` | +| Reference vectors sha256 | `3f61bc9eb2ce3d2d1e6a771aa94d2be1cfb964eac93babe3c5334f883ab72cd7` | +| Composition results digest | `sha256:ad2256f5c22f0c8c6a185f7ce5675955db8019789bd42b04bbd47ab5227166f6` | +| Receipt public-key fingerprint | `26a02d86f5d0a10f` (CCS public deterministic conformance seed key) | + +The standalone runner requires only Node.js >= 20.19 and imports only Node built-ins; +the six-file handoff has no `node_modules` and no repository parent at run time. + +## 3. EMILIA-side verification (performed by EMILIA) + +EMILIA pinned commit `a3503b2` and ran the published v1.4 bundle in a fresh environment: + +- The manifest covered all **489** non-manifest vector files in the pinned bundle. +- The standalone package-independent Python checker classified all **64** expected-outcome + conformance cases as expected. +- Regenerating the vectors reproduced the committed bundle **byte-for-byte**. +- EMILIA also pinned the published CCS v1.4 specification text used for comparison + (153,156 bytes, sha256 `fbac2a025f11baec104687ee04ba5c9fb0dad1b5bbb5ad38494965565a977cd3`). + That pin **anchors the specification version used for comparison**; the pin itself + does not validate the bundle, and it is not a claim of full specification conformance + or of completed composition. + +## 4. Correctover-side verification (performed by Correctover) + +Correctover ran the EMILIA handoff as an external verifier — fresh isolated directory, +no repository checkout, no `node_modules`, Node v22: + +- `node run.standalone.mjs --check`: **all eight cases passed, exit 0.** +- EMILIA's own Node test harness: **2/2**, including the audit that the runner imports + only Node built-ins. +- Hashes lined up: entrypoint `c809c257…` matches the manifest; upstream receipt + `889855dc…`; reference report `a197793b…` and vectors `3f61bc9e…` match the manifest + support files. +- The produced `results_digest` was + `sha256:ad2256f5c22f0c8c6a185f7ce5675955db8019789bd42b04bbd47ab5227166f6`, + **byte-identical to `report.reference.json`**. +- Correctover then re-verified the receipt with the **standalone package-independent** + Python check — standard library plus `cryptography` plus JCS (JSON Canonicalization + Scheme), operating **without importing the CCS verifier package** and with zero lines + of EMILIA code: 30 fields, 64-byte Ed25519 signature, + 32-byte key, 1221-byte JCS signing input → **valid**. +- Two negative controls — a flipped signature byte, and the verdict changed from + `allow` to `deny` — were **both correctly rejected**. +- The closing detail: the receipt's public-key fingerprint `26a02d86f5d0a10f` is the + CCS public deterministic conformance seed key. EMILIA's harness pins this key; + Correctover's verifier validated the same signed receipt bytes against it. **Both + parties independently verified the same bytes under the public deterministic + conformance key. That establishes fixture integrity, not a production identity + chain.** + +Correctover re-ran the same handoff on 2026-08-29 after fetching the six files +directly from harness commit `995d803`; all file sha256 values matched the manifest +and the eight cases produced the identical results digest. + +## 5. The eight composition outcomes + +| # | Case | Expected | Result | +|---|---|---|---| +| 1 | CCS-V1.4-PUBLIC-VECTOR-PIN | byte-pinned vector, valid Ed25519 + companion hashes | pass | +| 2 | CCS-ALLOW + EMILIA authority | counting provider entered exactly once | pass | +| 3 | Receipt tampering | refused, zero provider entries | pass | +| 4 | Wrong relying party | refused, zero provider entries | pass | +| 5 | Stale status | refused, zero provider entries | pass | +| 6 | Action substitution (issue 538 → 539) | refused, zero provider entries | pass | +| 7 | CCS ALLOW with absent EMILIA authority | refused, zero provider entries | pass | +| 8 | Lost provider response | `INDETERMINATE`, blind retry blocked, provider entered at most once | pass | + +The valid composition enters the provider exactly once; the five hostile/boundary +cases enter it zero times; `INDETERMINATE` blocks blind retry and still enters the +provider at most once. All provider references in this section are to the counting +test stub in the harness. + +## 6. Product boundaries (authoritative) + +1. **CCS supplies machine-policy evidence; it is never execution authority.** A + verified CCS ALLOW receipt does not by itself prove what the provider ultimately + executed. Provider entry additionally requires a current AEB evaluation for the + exact action and a separate relying-party authorization decision. +2. **The GitHub-shaped receipt in the fixture is EMILIA-authored and CCS-source- + compatible; it is not a Correctover certification or a Correctover-issued upstream + vector.** Both receipts use the public deterministic conformance key + (`26a02d86f5d0a10f`), which is test material and not a production trust root. The + provider in the harness is a counting test stub; no live GitHub issue or external + account is changed. At-most-one provider entry is not exactly-once physical effect; + an `INDETERMINATE` result requires authenticated reconciliation, and blind retry + remains prohibited. + +## 7. Verdict + +In this harness, the pinned CCS v1.4 L1 conformance receipt **can be independently +verified** by a party that imports none of the issuer's code, and **can be bound to +one exact EMILIA action** (`github.issue-update.1`, CAID +`caid:1:github.issue-update.1:jcs-sha256:hcpVY2uUgF1xTGcDoqhuSzYB2avddWtiPXEQVE6p-kk`) +**and one relying-party admission domain** (`rp:emilia-github-gate`), with the +current authority state in the harness and provider entry separate and closed +(at-most-one concerns the counting provider entry, not a physical effect). Both +sides reached this verdict from bytes they ran themselves. This is a fixture- +integrity result under the public deterministic conformance key, not a production +identity chain. + +## 8. Signatures + +This report is jointly authored. It is not final or jointly approved until both +parties approve the exact bytes. + +- Iman Schrock — EMILIA Protocol, Inc. — _________________ (date) +- Guigui Wang — Correctover — _________________ (date) diff --git a/examples/ccs/README.md b/examples/ccs/README.md new file mode 100644 index 000000000..44f3e26c5 --- /dev/null +++ b/examples/ccs/README.md @@ -0,0 +1,66 @@ +# EMILIA × CCS composition example + +This directory contains an **interoperability example contributed by the EMILIA +project** (Iman Schrock). It shows how a CCS v1.4 +conformance receipt is consumed as **pre-admission machine-policy evidence** by +an AEB-style gate, then bound to one executor-owned action and one relying-party +admission domain. + +## Provenance + +The two JSON files here are byte-identical copies from the EMILIA standalone +composition harness, commit +[`995d803`](https://github.com/emiliaprotocol/emilia-protocol/commit/995d80367f99601bb16509c6c89a5f9e72c74885), +directory `conformance/composition/ccs-v14-aeb-github-v0.1/`: + +| file | sha256 | role | +|---|---|---| +| `vectors.reference.json` | `3f61bc9eb2ce3d2d1e6a771aa94d2be1cfb964eac93babe3c5334f883ab72cd7` | The proposed examples fixture: the pinned CCS ALLOW receipt, the exact GitHub `issue-update` action, its CAID, relying party, and provider | +| `upstream-01-allow.receipt.json` | `889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361` | The upstream CCS v1.4 conformance `01-allow` receipt this composition pins | + +The harness itself (`run.standalone.mjs`, Node >= 20.19, Node built-ins only) +lives in the EMILIA repository at the commit above. It is not vendored here; +fetch it from the pinned commit to reproduce the eight composition cases. + +## What the fixture demonstrates + +The runner exercises eight deterministic cases: + +1. the pinned public vector verifies (valid Ed25519 over the JCS signing input); +2. the valid composition — CCS ALLOW plus a separate EMILIA authority decision — + enters the counting provider exactly once; +3. receipt tampering is refused; +4. the wrong relying party is refused; +5. a stale status is refused; +6. action substitution (issue 538 → 539) is refused; +7. a CCS ALLOW with no EMILIA authority is refused (zero provider entries); +8. a lost provider response returns `INDETERMINATE` and blocks blind retry. + +## Boundaries (authoritative) + +- **The GitHub-shaped receipt in `emilia_github_fixture` is an EMILIA-authored + compatible fixture, not a Correctover certification or a Correctover-issued + upstream vector.** It is source-compatible with the CCS v1.4 receipt shape. +- A CCS ALLOW receipt is **machine-policy evidence only**. It is not execution + authority and does not by itself prove what the provider ultimately executed. + Provider entry additionally requires a current AEB evaluation for the exact + action and a separate relying-party authorization decision. +- Both receipts use the **public deterministic conformance key** + (fingerprint `26a02d86f5d0a10f`). It is test material, not a production trust + root, and MUST NOT be trusted or reused outside conformance fixtures. +- The provider in the harness is a counting test stub; no live GitHub issue or + external account is changed. + +## Independent verification + +The upstream receipt is a 30-field CCS L1 receipt signed with Ed25519 over the +JCS (JSON Canonicalization Scheme) canonicalization of the 29 unsigned fields (1221-byte signing +input). Any standard-library + Ed25519 + JCS verifier can validate it without +importing CCS code. The Correctover check used here is a **standalone +package-independent** checker that operates **without importing the CCS +verifier package**. The standalone package-independent conformance checker +([`checkers/independent_checker.py`](https://github.com/DSHCorrectover/ccs-conformance-vectors/blob/a3503b2bc48922f92a28c372003885a0831da02b/checkers/independent_checker.py), +MIT license; Python standard library plus `cryptography` and `jcs` only, and +it operates **without importing the CCS verifier package**) lives +in the pinned CCS bundle repository at bundle commit [`a3503b2`](https://github.com/DSHCorrectover/ccs-conformance-vectors/commit/a3503b2bc48922f92a28c372003885a0831da02b), +not in this repository. It independently verifies the pinned bundle. diff --git a/examples/ccs/upstream-01-allow.receipt.json b/examples/ccs/upstream-01-allow.receipt.json new file mode 100644 index 000000000..e4b099648 --- /dev/null +++ b/examples/ccs/upstream-01-allow.receipt.json @@ -0,0 +1,32 @@ +{ + "trace_id": "conformance-v1.4.0-trace", + "receipt_version": "1.4", + "verdict": "allow", + "timestamp": 1750003200.0, + "tool": "lookup_customer", + "tool_call_id": "call-conformance-01", + "params_hash": "f516269c2104b2764cd6d4cab363c29e0a48c5c185d07a481eb226bf6f395ba2", + "args_digest": "f2e46a341a25d489c55ec109d41c0dae85a3477666b83321cbf0ba266ee8fd4a", + "rule_summary": "conformance-reference-policy", + "rule_version": "1.4.0-conformance", + "request_hash": "55a300ad27d7f65e05ba41bdb5361c08c103229e9ad8bdd1e1332aa7f340dd89", + "response_hash": "b810bf2ed31e7b2489e999c5a1770fe7c4f1a08ceefd3389726181c470a99793", + "runtime_context_hash": "497b261529f5a98e5b07cfa8419017872d5a73a1be069e964f0ebc245eb354d8", + "config_hash": "0abcb7ab76d5cb8ba879d6feba6199247c0c2622614451d8d03c16614a73bcfb", + "verifier_source_class": "ConformanceVectorGenerator", + "deployment_mode": "in-process", + "issuer": "ccs-conformance/v1.4.0", + "audience": "independent-verifier", + "nonce": "conformance-nonce-0000", + "sequence": 0, + "issued_at": 1750003200.0, + "expires_at": 1750089600.0, + "max_clock_skew": 30, + "action": "lookup_customer.execute", + "signature": "i6cDOARGniKQSc/sScpQw0X86LkIGT6kWECGHEgZzZ0Grxvasss8Pax1MnANqBE2p6guqwYzcWafUWK35elxDA==", + "signing_algorithm": "Ed25519", + "public_key_fingerprint": "26a02d86f5d0a10f", + "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=", + "verified_at": 1750003200.0, + "latency_us": 842.0 +} diff --git a/examples/ccs/vectors.reference.json b/examples/ccs/vectors.reference.json new file mode 100644 index 000000000..76bccf510 --- /dev/null +++ b/examples/ccs/vectors.reference.json @@ -0,0 +1,116 @@ +{ + "@version": "CCS-V1.4-AEB-GITHUB-REFERENCE-VECTORS-v1", + "source_lock": { + "repository": "https://github.com/DSHCorrectover/ccs-conformance-vectors", + "commit": "a3503b2bc48922f92a28c372003885a0831da02b", + "manifest_sha256": "3e77eae3045eb2bc824c52b8d022b75029beaf56623841ce7c035a99e65a2ddd", + "upstream_case": "vectors/v1.4.0-conformance/01-allow", + "upstream_receipt_sha256": "889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361" + }, + "upstream_allow_receipt": { + "trace_id": "conformance-v1.4.0-trace", + "receipt_version": "1.4", + "verdict": "allow", + "timestamp": 1750003200, + "tool": "lookup_customer", + "tool_call_id": "call-conformance-01", + "params_hash": "f516269c2104b2764cd6d4cab363c29e0a48c5c185d07a481eb226bf6f395ba2", + "args_digest": "f2e46a341a25d489c55ec109d41c0dae85a3477666b83321cbf0ba266ee8fd4a", + "rule_summary": "conformance-reference-policy", + "rule_version": "1.4.0-conformance", + "request_hash": "55a300ad27d7f65e05ba41bdb5361c08c103229e9ad8bdd1e1332aa7f340dd89", + "response_hash": "b810bf2ed31e7b2489e999c5a1770fe7c4f1a08ceefd3389726181c470a99793", + "runtime_context_hash": "497b261529f5a98e5b07cfa8419017872d5a73a1be069e964f0ebc245eb354d8", + "config_hash": "0abcb7ab76d5cb8ba879d6feba6199247c0c2622614451d8d03c16614a73bcfb", + "verifier_source_class": "ConformanceVectorGenerator", + "deployment_mode": "in-process", + "issuer": "ccs-conformance/v1.4.0", + "audience": "independent-verifier", + "nonce": "conformance-nonce-0000", + "sequence": 0, + "issued_at": 1750003200, + "expires_at": 1750089600, + "max_clock_skew": 30, + "action": "lookup_customer.execute", + "signature": "i6cDOARGniKQSc/sScpQw0X86LkIGT6kWECGHEgZzZ0Grxvasss8Pax1MnANqBE2p6guqwYzcWafUWK35elxDA==", + "signing_algorithm": "Ed25519", + "public_key_fingerprint": "26a02d86f5d0a10f", + "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=", + "verified_at": 1750003200, + "latency_us": 842 + }, + "emilia_github_fixture": { + "action": { + "action_type": "github.issue-update.1", + "parameters": { + "tool": "github_issue_update", + "arguments": { + "repository": "emiliaprotocol/emilia-protocol", + "issue_number": 538, + "title": "Record missing-evidence disposition", + "body": "Evidence unavailable; no execution authority inferred.", + "state": "open" + } + } + }, + "caid": "caid:1:github.issue-update.1:jcs-sha256:hcpVY2uUgF1xTGcDoqhuSzYB2avddWtiPXEQVE6p-kk", + "ccs_artifact": { + "receipt": { + "trace_id": "ccs-v14-emilia-github-trace", + "receipt_version": "1.4", + "verdict": "allow", + "timestamp": 1750003210, + "tool": "github_issue_update", + "tool_call_id": "call-ccs-v14-emilia-001", + "params_hash": "c511a941651d21d21a89af3123a027bac376523661dc1f5938778890be410b65", + "args_digest": "8efa8c4f9c636616618856e65f235b0b86cd34ea8f21bd4493fb2bebc1a82d6b", + "rule_summary": "github-issue-update-conformance", + "rule_version": "1.4.0-conformance", + "request_hash": "c511a941651d21d21a89af3123a027bac376523661dc1f5938778890be410b65", + "response_hash": "d410958ad3821ea861ae3f7196cd9f8a83fb9e7e457f8837d3d0983ecc96b628", + "runtime_context_hash": "d66c66cb0d4d8b37084e76e518b0625a35e5f4369096ff246ea43ed446d9c8ff", + "config_hash": "3edd8b7cae30c8df4cf034be4e33d2c869bd3401d105b7b57a02814239bf33d1", + "verifier_source_class": "EMILIAIndependentComposition", + "deployment_mode": "test-in-process", + "issuer": "ccs-conformance/v1.4.0", + "audience": "rp:emilia-github-gate", + "nonce": "ccs-v14-emilia-nonce-001", + "sequence": 0, + "issued_at": 1750003210, + "expires_at": 1750003290, + "max_clock_skew": 30, + "action": "github_issue_update.execute", + "signing_algorithm": "Ed25519", + "public_key_fingerprint": "26a02d86f5d0a10f", + "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=", + "verified_at": 1750003210, + "latency_us": 842, + "signature": "xWUqa2M9TdKH+y13ZLtdi5Y1YkmIqKfZL9+3Eonf9nHFpmeL5e14S8n+Tk4Ultzbbj8gZSQ7L3V+7B2oSm1FCA==" + }, + "tool_args": { + "repository": "emiliaprotocol/emilia-protocol", + "issue_number": 538, + "title": "Record missing-evidence disposition", + "body": "Evidence unavailable; no execution authority inferred.", + "state": "open" + }, + "response_body": { + "issue_url": "https://github.com/emiliaprotocol/emilia-protocol/issues/538", + "updated": true + } + }, + "relying_party": "rp:emilia-github-gate", + "provider": { + "tenant_id": "tenant:emilia-protocol", + "provider_id": "provider:github", + "provider_account_id": "account:futureenterprises", + "environment": "test-fixture" + } + }, + "limits": [ + "The upstream vector and local GitHub fixture use a public deterministic conformance key, not a production trust root.", + "The local GitHub fixture is EMILIA-authored and source-compatible; it is not represented as a Correctover-issued upstream vector.", + "CCS ALLOW is machine-policy evidence only. Separate relying-party authorization is required before provider entry.", + "The provider is a counting test stub; no GitHub issue is changed." + ] +}