{ "counts": { "good": 6, "insider": 27, "malformed": 6, "tamper": 4, "total": 49, "undetectable": 6 }, "declared_undetectable": [ "undetectable-backdated-timestamps", "undetectable-fabricated-observation", "undetectable-offchannel-action", "undetectable-self-checkpointed-deletion", "undetectable-tail-truncation-no-checkpoint", "undetectable-vacuous-postcondition" ], "note": "An implementation is PCAR/1 conformant iff, for every vector, feeding the named bundle plus the reader inputs (keyring always; policy bodies iff with_policy_bodies; the in-bundle openings iff with_openings; the `anchor` object iff non-null) yields exactly `expected_verdict` and exactly the reason-code set `expected_reason_codes`. Verdicts are three-valued; INDETERMINATE must never be reported as a pass.", "pcar_vectors": "1.0", "policy_bodies": "policies.json", "reader_keyring": "keyring.json", "spec": "pcar/SPEC.md", "vectors": [ { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "arg_opening_absent" ], "expected_verdict": "INDETERMINATE", "family": "good", "file": "good/good-args-sealed.json", "id": "good-args-sealed", "note": "arguments committed but withheld: the binding holds, the values are unchecked — the privacy-preserving default, and it is honestly NOT a full pass", "policy_bodies_file": "policies.json", "with_openings": false, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "good", "file": "good/good-full.json", "id": "good-full", "note": "the reference bundle with policy bodies, argument openings and an independent anchor: every check the format defines actually runs. This is the ONLY configuration in which VERIFIED is reachable", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "completeness_unanchored" ], "expected_verdict": "INDETERMINATE", "family": "good", "file": "good/good-no-anchor.json", "id": "good-no-anchor", "note": "identical bundle, but the reader holds no independently obtained {count, head}. Sound receipts without a completeness anchor is INDETERMINATE, not VERIFIED — see undetectable/self-checkpointed-deletion for why the in-bundle checkpoint does not substitute", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "policy_unavailable" ], "expected_verdict": "INDETERMINATE", "family": "good", "file": "good/good-no-policy-body.json", "id": "good-no-policy-body", "note": "same bundle, but the reader was not given the policy body — the binding is asserted, not checked, so the verdict is INDETERMINATE and not a pass", "policy_bodies_file": null, "with_openings": true, "with_policy_bodies": false }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "good", "file": "good/good-selective-disclosure.json", "id": "good-selective-disclosure", "note": "receipt 0 opens ONE argument (`path`) via a Merkle path while `encoding` stays sealed; the auditor still checks it against the same signed root. This is the folder8 selective-disclosure case", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:a0fb40f720dae1dbaad7309e6c3b7d5ac873ec6b014ce862986a574d0de444df" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "good", "file": "good/good-witnessed-observation.json", "id": "good-witnessed-observation", "note": "receipt 0 carries a co-signature over its observed state by a party that is not the executor. This is the ONLY construction in the format that speaks to SPEC 7.1; a receipt without one gets no credit for it", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "signer_unknown" ], "expected_verdict": "INDETERMINATE", "family": "insider", "file": "insider/forged-selfsigned-keyring.json", "id": "forged-selfsigned-keyring", "note": "a forger re-signs everything with their OWN key and ships their own keyring; the bundle is internally perfect. Against the reader's keyring this is INDETERMINATE, never VERIFIED — a bundle does not get to nominate its own trust root", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:edffe72f36f024b6c5fc68fd315655367c1510d49f59c848b10b72a62b4c33c6" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_commitment_invalid", "arg_opening_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-arg-names-invisible-homograph.json", "id": "insider-arg-names-invisible-homograph", "note": "an argument name carrying a zero-width space is a second committed position for what a reader sees as one name; refused rather than rendered", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "checkpoint_log_id_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-attaches-foreign-checkpoint.json", "id": "insider-attaches-foreign-checkpoint", "note": "a checkpoint for a different log attached to this bundle", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b549fc2532b2f080a630c3ca90c666e0a067d893e29f71379be3c2a4c385217e" }, "anchor_mode": "self", "expected_reason_codes": [ "postcondition_claim_false" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-claims-postcondition-passed.json", "id": "insider-claims-postcondition-passed", "note": "THE CENTRAL CASE. The executor records postcondition_verdict='pass' while its own recorded post_state has delivered=false. The signature is genuine, the chain is intact and the anchor matches (the executor published the log it forged); ONLY re-evaluating the predicate catches it. This is what separates a receipt from a log line", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:97f9cbaac313bc4658243612bb448c4cd71db9c94af5018f8c5b8b3d8482b298" }, "anchor_mode": "self", "expected_reason_codes": [ "precondition_claim_false" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-claims-precondition-passed.json", "id": "insider-claims-precondition-passed", "note": "the recorded pre_state says the file did not exist, while the receipt records precondition_verdict='pass'. Preconditions are recomputed exactly as postconditions are — the check is not postcondition-only", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:3002d3da603159ffbbf27fca026242d2501d9cffdf754416b6c734b0186c6857" }, "anchor_mode": "self", "expected_reason_codes": [ "rollback_without_undo" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-claims-rollback-without-undo.json", "id": "insider-claims-rollback-without-undo", "note": "rollback='completed' with a side effect that has no undo reference — an unevidenced rollback claim", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:484680ae0635a25ad319e62b833bc2554b3ad9d396171a67b5d02e62a012b2cc" }, "anchor_mode": "self", "expected_reason_codes": [ "condition_malformed" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-condition-entry-not-an-object.json", "id": "insider-condition-entry-not-an-object", "note": "a condition entry is a bare string. This crashed the verifier with an untyped AttributeError instead of returning a verdict — a hostile receipt that denies service to the checker rather than failing its checks", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:a34d5244ec818ef50c82ec0726c1ba4c7222215243ea9a4b7b672fd18d76aa37" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_commitment_invalid", "arg_opening_absent" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-downgrades-alg-and-discloses-nothing.json", "id": "insider-downgrades-alg-and-discloses-nothing", "note": "withholding the opening must not buy an unsound commitment a pass. The alg and the arg_names shape are checked on every receipt, opening or no opening", "policy_bodies_file": "policies.json", "with_openings": false, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:a34d5244ec818ef50c82ec0726c1ba4c7222215243ea9a4b7b672fd18d76aa37" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_commitment_invalid", "arg_opening_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-downgrades-commitment-to-withdrawn-v1.json", "id": "insider-downgrades-commitment-to-withdrawn-v1", "note": "an unsupported alg must not be a soft failure. v1 is refused BY NAME as withdrawn, so an executor cannot downgrade to the equivocable construction and have a v2 verifier shrug. Two codes because the commitment is now judged twice over: once on its own (SPEC 5's MUSTs are unconditional) and once through the opening", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:efcc02e6eeb8fb2ce639d66b6cd6462a640ae576878a7169e71d78fc95e32429" }, "anchor_mode": "self", "expected_reason_codes": [ "irreversible_unapproved" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-drops-approval-for-irreversible.json", "id": "insider-drops-approval-for-irreversible", "note": "an irreversible db.insert under a bound policy that requires approval, with the approval reference removed — caught only because the policy body was supplied and re-read", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "anchor_count_mismatch", "anchor_head_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-drops-middle-receipt.json", "id": "insider-drops-middle-receipt", "note": "the inconvenient middle receipt is deleted, the chain fully re-linked and re-signed, and the checkpoint re-issued. Nothing INSIDE the bundle is wrong. It is caught here only because the reader independently knows the true {count, head} — and by nothing else", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:73ae042f8196cc8268372f4e65081f55de11966376204b076aa3766333b39b5b" }, "anchor_mode": "self", "expected_reason_codes": [ "condition_id_duplicate" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-duplicate-condition-id-masks-failure.json", "id": "insider-duplicate-condition-id-masks-failure", "note": "the executor appends a SECOND condition under the id of a failing one, with a tautological predicate. Last-write-wins in the verifier's per-id map overwrote the failure, so recomputation agreed with the recorded 'pass' and the bundle VERIFIED. Duplicate condition ids are now a refusal in their own right", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:65aaf9ed9462dbcf0380c1ff72edab095b17033112d630acd3cff20fd5a5928c" }, "anchor_mode": "self", "expected_reason_codes": [ "condition_results_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-forges-per-condition-result.json", "id": "insider-forges-per-condition-result", "note": "aggregate verdict left correct, one per-condition 'held' flipped — the itemised results are recomputed too, not just the summary", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:fe02da0c91ddfde2110f035a77142ec0486ac0be16f789f56e5d10e409b57a4a" }, "anchor_mode": "self", "expected_reason_codes": [ "witness_invalid" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-forges-witness.json", "id": "insider-forges-witness", "note": "a witness slot filled with a signature the named witness did not produce", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "checkpoint_count_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-inflates-checkpoint-count.json", "id": "insider-inflates-checkpoint-count", "note": "a validly signed checkpoint claiming more receipts than the bundle carries", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:90fd2bbaf9c1c4ecaa4fd339e359b15200b9f72bc3b943aa068a7742da634829" }, "anchor_mode": "self", "expected_reason_codes": [ "policy_unavailable" ], "expected_verdict": "INDETERMINATE", "family": "insider", "file": "insider/insider-misstates-policy-version.json", "id": "insider-misstates-policy-version", "note": "the executor keeps the genuine digest but claims it ran under policy version 1. The reader holds no v1, so the binding is UNCHECKED, not passed. A digest-keyed registry returned VERIFIED here — it found the body by digest and never read `version` at all, which is what made that field decorative", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:c4c677df0a6b35f6af57f15ceb9d74cfbeaa59a5f3fd9d2e992081f22a471197" }, "anchor_mode": "self", "expected_reason_codes": [ "policy_unavailable" ], "expected_verdict": "INDETERMINATE", "family": "insider", "file": "insider/insider-names-absent-policy.json", "id": "insider-names-absent-policy", "note": "binding to a policy name the reader does not hold does NOT let the receipt pass — the verifier reports that it could not check the binding rather than assuming the best. This is the honest floor of an unresolvable case, and it is why naming an unknown policy is an evasion of VERIFIED and never a route to it", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_opening_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-opens-different-argument.json", "id": "insider-opens-different-argument", "note": "disclosing an argument value that is not the one committed to — the whole point of the commitment is that this cannot be done after signing", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:0caa3d3c3ca926fe6bfc7440bf0716e48aa14b19f0d11dcf0d0d870350ade9f5" }, "anchor_mode": "self", "expected_reason_codes": [ "policy_digest_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-policy-digest-lies.json", "id": "insider-policy-digest-lies", "note": "the executor binds to the policy NAME the reader really holds but asserts a digest that is not that policy's — claiming it acted under a version of the rules that never existed. The reader looks the policy up by the name the receipt asserts, so the executor does not get to choose the body it is checked against. Under a digest-keyed registry this vector is unreachable: hash(store[d]) == d by construction", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "chain_link_broken", "chain_seq_gap" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-reorders-receipts.json", "id": "insider-reorders-receipts", "note": "reordering without re-linking: the sequence numbers and the prev links both disagree (the openings were moved with the receipts, so those still bind — the attacker is not given a gratuitous handicap)", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "checkpoint_head_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-repoints-checkpoint.json", "id": "insider-repoints-checkpoint", "note": "a validly signed checkpoint that commits to a head the chain does not end at", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:39ca442746d474bff73e9f2d43b44926c322f7e8bdb2551fe017d932aa9a0346" }, "anchor_mode": "self", "expected_reason_codes": [ "unrolled_failure" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-reports-ok-without-rollback.json", "id": "insider-reports-ok-without-rollback", "note": "result=ok while the postconditions honestly fail and nothing was rolled back: the receipt contradicts itself and is refused on coherence alone", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:4ef076b6b0f0e36ec1cbdfd7f4303e3dfffacc1e26baf84582722fdd16e8e238" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_opening_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-selective-opening-equivocates.json", "id": "insider-selective-opening-equivocates", "note": "THE DEFECT THAT WITHDREW ALG v1. The executor signs a root over two leaves for the same argument name and opens the one that suits this reader; another reader is shown the other value against the same signature. Under v1 both VERIFIED. Under v2 the required path shape is derived from the signed `arg_names` — one name means one leaf means an empty path — so the one-step path is refused before any hash is walked", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_opening_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-selective-opens-wrong-value.json", "id": "insider-selective-opens-wrong-value", "note": "a selective opening claiming a different value for the same argument name: the Merkle path no longer reaches the signed root", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:40a6d7dfe09fabb37f77536d846bd6656b7db666eb46021a3e5d43d78e47def4" }, "anchor_mode": "self", "expected_reason_codes": [ "chain_log_id_mismatch" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-splices-foreign-log.json", "id": "insider-splices-foreign-log", "note": "a receipt from a different log spliced into this one and fully re-linked: the log_id still gives it away", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:1ae7149cb0e9c0eb87bbb4a6588aeea13ff750d5064e61fffe2eefb68164b3f3" }, "anchor_mode": "self", "expected_reason_codes": [ "predicate_malformed" ], "expected_verdict": "REFUSED", "family": "insider", "file": "insider/insider-uses-unknown-op.json", "id": "insider-uses-unknown-op", "note": "an op outside the closed set. A malformed predicate is REFUSED, never silently treated as unsatisfied — 'broken' and 'false' are different verdicts", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b62bc19ce6ee37791f0dd6940b93e01ce76ef6f0c1a3f58a733491ab75546660" }, "anchor_mode": "self", "expected_reason_codes": [ "witness_unknown" ], "expected_verdict": "INDETERMINATE", "family": "insider", "file": "insider/insider-witness-unknown-key.json", "id": "insider-witness-unknown-key", "note": "a witness key the reader has never heard of: the attestation is neither accepted nor called forged — it is simply not decidable, so the bundle does not reach VERIFIED", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "noncanonical_body" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-float-in-body.json", "id": "malformed-float-in-body", "note": "a float in the signed body. There is no agreed canonical form for it, so no signature over it can port between implementations — the verifier refuses rather than picking a serialization and hoping", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "version_unsupported" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-future-version.json", "id": "malformed-future-version", "note": "a major version this implementation does not understand is REFUSED, not best-effort parsed. Silent forward-compatibility is how a v2 field with new meaning gets ignored", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "chain_link_broken", "completeness_unanchored", "receipt_malformed" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-missing-required-field.json", "id": "malformed-missing-required-field", "note": "rollback status removed: a receipt missing a mandated field is refused before any semantic check runs, and removing it also shifts the receipt id so the next link breaks", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "bundle_malformed" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-not-a-bundle.json", "id": "malformed-not-a-bundle", "note": "no receipts array at all", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "self", "expected_reason_codes": [ "arg_opening_malformed" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-opening-is-not-an-object.json", "id": "malformed-opening-is-not-an-object", "note": "the reader is handed a string where an opening object belongs. The answer is a REFUSAL with a reason code a consumer can branch on, never an exception — a verifier a stranger can crash is a verifier a stranger can deny", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "completeness_unanchored", "signature_absent" ], "expected_verdict": "REFUSED", "family": "malformed", "file": "malformed/malformed-unsigned-receipt.json", "id": "malformed-unsigned-receipt", "note": "an unsigned receipt is REFUSED. There is no 'unsigned but plausible' tier", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "chain_link_broken", "signature_invalid" ], "expected_verdict": "REFUSED", "family": "tamper", "file": "tamper/outsider-edits-intent.json", "id": "outsider-edits-intent", "note": "editing one word of the declared intent breaks the signature AND the downstream chain link", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "anchor_head_mismatch", "checkpoint_head_mismatch", "postcondition_claim_false", "signature_invalid" ], "expected_verdict": "REFUSED", "family": "tamper", "file": "tamper/outsider-flips-observation.json", "id": "outsider-flips-observation", "note": "flipping the observation to make the failure look like a success. Because it is the LAST receipt there is no successor link to break — the signature, the recomputed postcondition, the checkpoint and the independent anchor each catch it separately", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "signature_invalid" ], "expected_verdict": "REFUSED", "family": "tamper", "file": "tamper/outsider-mangles-signature.json", "id": "outsider-mangles-signature", "note": "a corrupted signature is REFUSED, not skipped", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:b4cca7376eee124af1013fe5e84de991ae68aded68490bb18b7ba108ac47e33c" }, "anchor_mode": "reference", "expected_reason_codes": [ "arg_opening_mismatch", "chain_link_broken", "chain_seq_gap", "signature_invalid" ], "expected_verdict": "REFUSED", "family": "tamper", "file": "tamper/outsider-swaps-bodies.json", "id": "outsider-swaps-bodies", "note": "swapping two bodies between envelopes breaks both signatures, the ordering, and the per-index argument openings", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:f2bc9803f5daae4f1dbc1f2f324cddfbf31d20f0f8bbbbfa3590125f69b93f4d" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "undetectable", "file": "undetectable/undetectable-backdated-timestamps.json", "id": "undetectable-backdated-timestamps", "note": "U4 — every timestamp moved six years back. PCAR has no trusted time source, so timestamps are executor claims like any other. Anchoring them needs an external timestamping authority or a transparency log, neither of which this format assumes", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:056d19f2626b72eb053260407fb4e82c7f28187aa3bfd0935a686400508eb466" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "undetectable", "file": "undetectable/undetectable-fabricated-observation.json", "id": "undetectable-fabricated-observation", "note": "U1 — the executor invents a post_state in which the webhook returned 200. Everything is internally consistent, so PCAR VERIFIES it. Re-evaluating a predicate proves the executor's arithmetic, never its honesty about what it saw. Closing this needs an independent witness co-signature (SPEC §6.4); the format carries the slot, and a witness-free receipt does not get credit for it", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 2, "head": "sha256:a97df6dd0f90270e20bc63c70db5d4216e27146d5049368766c79aa500511bd9" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "undetectable", "file": "undetectable/undetectable-offchannel-action.json", "id": "undetectable-offchannel-action", "note": "U5 — the db.write is not misreported, it is simply never receipted, and the log is re-linked around it with a matching checkpoint and anchor. A receipt log constrains the actions that flow THROUGH it; proving an agent took no other action is an enforcement property (F3-07/F3-10), not a receipt property, and PCAR must not be quoted as providing it", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 2, "head": "sha256:a97df6dd0f90270e20bc63c70db5d4216e27146d5049368766c79aa500511bd9" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "undetectable", "file": "undetectable/undetectable-self-checkpointed-deletion.json", "id": "undetectable-self-checkpointed-deletion", "note": "U2 — the SAME bundle as insider/insider-drops-middle-receipt, read by a party whose {count, head} came from the executor rather than from an independent source. It VERIFIES. The in-bundle checkpoint is signed by the executor and costs it nothing to re-issue, so it constrains outsiders only. This vector is why verify_bundle caps an unanchored read at INDETERMINATE, and it was found by building the corpus, not by designing it", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": null, "anchor_mode": null, "expected_reason_codes": [ "completeness_unanchored" ], "expected_verdict": "INDETERMINATE", "family": "undetectable", "file": "undetectable/undetectable-tail-truncation-no-checkpoint.json", "id": "undetectable-tail-truncation-no-checkpoint", "note": "U3 — drop the trailing receipt and the checkpoint. What remains is a shorter, perfectly valid chain; hash chaining makes INSERTION and REORDERING detectable and does nothing about a truncated tail. PCAR cannot resolve this, but it does not pass it either: the verdict is INDETERMINATE, which is the honest answer", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true }, { "anchor": { "count": 3, "head": "sha256:996a7d1aed98b5d1878dee3aa971bb88454d561959fcd782cc1e9271908981da" }, "anchor_mode": "self", "expected_reason_codes": [], "expected_verdict": "VERIFIED", "family": "undetectable", "file": "undetectable/undetectable-vacuous-postcondition.json", "id": "undetectable-vacuous-postcondition", "note": "U6 — the executor swaps its real postcondition for `eq(lit(1), lit(1))` and records 'pass'. Recomputation agrees, because the tautology is genuinely true, and the bundle VERIFIES. PCAR checks that a condition was evaluated honestly, NOT that it constrains anything; an empty postconditions[] with verdict='pass' verifies for the same reason. Non-vacuity is undecidable in general and this format does not attempt it — a consumer that needs it must pin the expected predicate via the policy body it already binds to", "policy_bodies_file": "policies.json", "with_openings": true, "with_policy_bodies": true } ] }