lcert_verify

lcert-verify — a zero-trust verifier for LCERT-1 proof-carrying certificates.

The verifier re-derives a certificate's verdict from the primitive quantities the certificate carries, using only the Python standard library. It checks internal consistency and integrity; it does not re-run the physics. See SCOPE.

FORMAT = 'litholab-cert-bundle/1'

SCOPE = 'Zero-trust verifier: checks certificate INTERNAL consistency and integrity — (1) canonical-JSON round-trip + format version; (2) SHA-256 manifest + Merkle root over payload files (domain-separated, HMAC-salted leaves, duplicate-last-odd levels); (3) outputs-commitment over KPI rows + preregistration-SHA cross-binding; (4) per-locus interval-gate verdict re-derivation from shipped bounds under math.nextafter outward rounding, with the kappa/K reduction re-checked via math.erfc (no shipped transcendental is trusted). It does NOT re-derive the physics: the shipped I_lo/I_hi/ae0 bounds are trusted-as-committed inputs whose provenance is the bundle SHA-256 fingerprint, compared out of band. THREAT MODEL: the verdict re-derivation catches INCONSISTENT tampering (edited bounds vs recorded verdict); a SELF-CONSISTENT false-bounds tamper (bounds + verdict edited together) is caught ONLY by the out-of-band fingerprint, which is the load-bearing anchor. Shipped salts make commitments binding-only (not hiding) here. Simulator-relative; not silicon.'

def verify_bundle( bundle_dir, expected_sha256: str = '', *, require_certs: bool = True, require_anchor: bool = True):

Verify a bundle, abstaining rather than asserting when evidence is missing.

Returns a dict with verdict (see the taxonomy above), ok, trust_anchor ("fingerprint" or "NONE"), internally_consistent, n_certificates, n_gated_loci, errors and fingerprint.

Why an anchor is required by default. The re-derivation catches any tamper that leaves the recorded verdict inconsistent with the shipped bounds. It cannot catch a tamper that edits both consistently — that forgery is internally perfect, and only a fingerprint obtained out of band refutes it. Reporting such a bundle as verified would be asserting something this code did not establish, so it abstains.

def verify_gate_certs(bundle: dict) -> list:

def verify_kpis(bundle_dir: pathlib.Path, bundle: dict) -> list:

Recompute the outputs commitment, and bind the KPIs to the preregistration.

Defensive throughout, for the reason given on verify_manifest_and_root: a malformed bundle is a verdict, never an exception.

def verify_interval_bound_certs(bundle: dict) -> list:

Re-derive every LCERT-BOUND-1 certificate — the domain-agnostic kind.

A producer supplies, per locus, an outward-rounded interval [lo, hi] for some quantity, plus a threshold and which side of it is safe. This function recomputes the admission verdict from those numbers and rejects any recorded claim that is more favourable than the re-derivation.

It computes no physics, and that is deliberate. Where the intervals come from — a thermal solver, a timing engine, a model evaluation — is the producer's problem and its evidence. What is checked here is that the verdict written down follows from the numbers written down. That is the part a third party can do without trusting anyone, and it is the only part this file claims to do.

def interval_bound_cert( name: str, *, quantity: str, unit: str, threshold: float, direction: str, loci, evidence: str = '') -> dict:

Assemble a domain-agnostic LCERT-BOUND-1 certificate.

loci is an iterable of (lo, hi) pairs: your outward-rounded enclosure of the quantity at each locus. direction is "below" (safe means the upper bound stays under the threshold) or "above".

The verdict is derived here and re-derived by the verifier, never supplied. Nothing about this certificate is lithography-specific; where the intervals come from is your analysis and your evidence, and this file does not and cannot compute them.

def verify_manifest_and_root(bundle_dir: pathlib.Path, bundle: dict) -> list:

Check every payload file against the manifest, then recompute the root.

Every field is read defensively. A bundle missing seed, or carrying a manifest that is not a mapping of names to hex digests, is a REJECTION with a reason -- not a KeyError. A checker that raises on hostile input is a denial of service and tells the caller nothing.

def rederive_gate_verdict(cert: dict) -> dict:

Per-locus re-derivation of the interval-gate classification and verdict.

Frozen semantics of the reference interval gate: outward-rounded margin / i_noise intervals per the sub/super-threshold branch, K widened 2 ULP each way, certainly_safe = (m_lo > 0) and (down(m_lom_lo) >= Kin_hi), certainly_unsafe = (m_hi <= 0) or (up(m_him_hi) < Kin_lo), ADMIT iff no certainly-unsafe locus and no straddle (straddle -> safe-direction REJECT); zero loci -> trivially ADMIT + stable (the committed convention).

def check_kappa_K( budget: float, safety: float, n_photons: float, kappa: float, K: float) -> list:

Re-derive the transcendental constants instead of trusting them.

kappa must satisfy the erfc round-trip |0.5erfc(kappa) - budget| < 1e-12 (math.erfc, stdlib), and K must equal 2.0kappakappasafety*safety/n_photons recomputed in the committed operation order (bit-identical float64 — same ops, same order as the reference producer).

def derive_master_salt(seed: int) -> bytes:

def derive_tile_salts(master_salt: bytes, n: int) -> list:

def leaf_hash(index: int, salt: bytes, leaf_bytes: bytes) -> bytes:

def merkle_root(leaves: list) -> bytes:

def outputs_commitment(outputs_salt: bytes, outputs) -> bytes:

def make_bundle( bundle_dir, *, gate_certs=None, kpis=None, prereg=None, seed: int = 149, payload_files=None, image_bound_certs=None, resource_floor_certs=None, interval_bound_certs=None) -> pathlib.Path:

Write a canonical bundle directory; return the path to bundle.json.

prereg is any JSON-serializable object recording what was declared before measurement; it is always copied in and manifest-covered.

def gate_cert( name: str, *, budget: float, safety: float, n_photons: float, thr: float, delta_dose: float, loci) -> dict:

Assemble a stochastic gate certificate record in LCERT columnar form.

loci is an iterable of (I_lo, I_hi, ae0) triples. kappa and K are derived here and re-derived by the verifier; the verdict is likewise re-derived, never supplied -- which is the entire point of the format.

def kappa_for_budget(budget: float, lo: float = 0.0, hi: float = 40.0) -> float:

Invert 0.5*erfc(kappa) = budget by bisection, to the tolerance the verifier enforces.

The verifier does not trust a supplied kappa; it re-runs the erfc round-trip. This helper produces a kappa that survives that check.

def bundle_fingerprint(bundle_dir) -> str:

SHA-256 of bundle.json — the out-of-band trust anchor.

def explain_certificate(cert: dict, *, limit: int = 20) -> dict:

Per-locus breakdown of why a certificate reached its verdict.

Returns the same classification the verdict is derived from, plus the margin arithmetic for each locus, so a reader can see how close a locus was to the boundary rather than only which side of it fell.

def format_explanation(exp: dict, *, limit: int = 10) -> str:

Human-readable rendering, with the actionable part first.

def emit(res: dict, fmt: str, **kw) -> str:

def to_json(res: dict, *, indent: int = 2) -> str:

Full result as JSON. The canonical machine format.

def to_jsonl(res: dict, *, source: str = '') -> str:

One line per certificate — convenient for streaming into a log pipeline.

def to_sarif( res: dict, *, source: str = 'bundle.json', tool_version: str = '1.0.0') -> str:

SARIF 2.1.0 — renders in GitHub code scanning and most IDE problem panes.

An abstention is emitted at warning level with the reason, never suppressed: a reader scanning the Security tab must see that no assertion was made.

def to_junit(res: dict, *, source: str = 'bundle.json') -> str:

JUnit XML — appears in the test report of essentially every CI system.

JUnit has no 'abstained' state. An abstention is therefore a failure with the reason attached: reporting it as a pass would be exactly the confident wrong answer this project exists to avoid.

def to_html(res: Dict, bundle: Optional[Dict] = None, source: str = 'bundle') -> str:

Render a verification result as a single self-contained HTML document.

def diff_bundles(dir_a, dir_b, *, anchor_a: str = '', anchor_b: str = '') -> Dict:

Compare two bundle directories.

Anchors are optional here and their absence is reported rather than ignored: a diff between two unanchored bundles compares two documents of unknown provenance, which is worth knowing before acting on it.

def format_diff(d: Dict) -> str:

def verify_bundle_streaming( bundle_dir, expected_sha256: str = '', *, require_certs: bool = True, require_anchor: bool = True, progress=None) -> Dict:

Streaming counterpart of lcert_verify.verify_bundle().

Same result shape and same verdicts; streaming: True is added so a caller can tell which path produced it. progress(n_so_far) is called per certificate if supplied.

__version__ = '1.0.0'