Auths Witness Network — protocol core + tier wiring + node/watcher/devops#394
Merged
Conversation
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Auths Commit Verification
Result: ✅ 1/1 commits verified |
Implement the Auths Witness Network per docs/plans/network/final_spec.md — the freshness layer that turns withholding into a signed contradiction and equivocation into a publishable duplicity proof, while authorization verification stays offline and free. - auths-anchor (Epic A): new pure Layer-1.5 protocol core modeled on auths-rp. §9.2 acceptance rule, offline-verifiable duplicity proofs, t-of-N finalization (threshold + inclusion, honesty ceiling over the shipped independence engine), fresh|stale|unanchored freshness, and the AnchorStore CAS port. Curve-tagged signatures, never length dispatch. 34 unit + invariant tests green; verification half is WASM-safe. - auths-evidence (Epic B): AnchorTier::Witness wired (witness_anchor + offline verify arm binding the anchor to the re-derived total); top-level freshness on receipts/v1 and audit/v1 beside the verdicts; duplicity-proof JSON schema. - auths-witness-node (Epic C): anchor-role service (accept -> sign -> CAS -> re-run-on-lost -> duplicity), in-memory AnchorStore reference adapter, and a sign-only Signer port. - auths-monitor (Epic D): spend-anchor duplicity scan + withholding-gap alerts. - xtask witness-conformance + deploy/witness compose/helm/terraform (Epic E). Phase boundaries left explicit (composed serve binary + crate consolidation, export-attestation submit leg, node/WASM freshness bindings) are noted in the PR. auths-site (Epics I-J) parked per the spec. Also fixes pre-existing CI failures in auths-storage's git adapter that were already red on main and block this branch: two unused DipEvent test imports, a clone-on-Copy on KeriSequence, and rustfmt formatting. Trivial + mechanical; bundled only to get this PR's CI green. Same for the Node SDK lint: format packages/auths-node/src/evidence.rs and pin that workflow's toolchain to 1.93 (it used an unpinned @stable that drifted ahead of the repo's pinned formatting and was red on main). Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 1/1 commits verified |
The declared witness set is now self-addressing: its SAID is recomputed from canonical content at verification and must equal what the party-signed anchor commits to, with an optional caller-resolved SAID for an independent expectation — a set can no longer be substituted or shown differently to different verifiers without detection. Inclusion proofs must be rooted in a checkpoint signed by the declared member key (LoggedInclusion); a cosigner without one does not count toward the threshold. Witness-tier anchors in evidence bundles are bound to the bundle they ride in (re-derived binding head, record count, settled total), so a genuine anchor cannot be transplanted across bundles — and this doubles as the extension check freshness needs. Bundles no longer label themselves fresh (anchored_index_of replaces the self-referential freshness stamp; fresh/stale is a relying party's judgment against an independently-known index). Anchor timestamps are whole-second on the wire and in-process so the signed bytes always commit to the compared value, and a post-dated timestamp beyond a small skew is refused so withholding gaps stay measurable. Witness sets validate uniqueness and threshold bounds. The invariant tests now construct these attacks and assert refusal. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 2/2 commits verified |
The node binary exists now: witness-node serve hosts the anchor role behind the same hardening posture as the KEL witness server (body cap, concurrency limit, timeout), resolves party keys from a local registry copy with the delegator check, and fails closed on roles it cannot yet serve. Every accepted anchor is CAS-stored durably (SQLite — a witness that forgets its per-seed state will co-sign a fork after a restart), appended to the witness's own signed log, and answered with the cosignature plus the member-signed logged inclusion the strict verifier demands — proven by a test that runs the service output back through verify_finalized unchanged. The producer leg lands too: export-attestation --anchor-to submits the aggregate to declared witnesses (--witness name=<key>, where the key is a CESR verkey or did:key so the curve tag is in-band from first ingestion — never a bare hex flag), collects cosignatures to the threshold, re-verifies the finalized anchor locally, and embeds it in activity.json outside the document signature. Attestation verification now also checks an embedded anchor: finalization, tuple equality with the document's aggregate, and that the party key is a current agent key. Witness-set members carry an explicit curve tag on the wire and in the SAID preimage; verification dispatches on the tag and refuses non-note curves as a routing error. The deploy artifacts stop describing fiction: a Dockerfile builds the real binary, compose uses a named volume (never tmpfs) and the real flags, and the node ships a dependency-free healthcheck subcommand the container manifests invoke. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 3/3 commits verified |
Both fit the existing confinement categories: the node joins the axum service-binary wrapper set beside the other witness servers, and the gateway joins the reqwest binary-layer client set for its witness submissions. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 4/4 commits verified |
Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 5/5 commits verified |
The KEL-receipt and checkpoint-cosign servers fold into witness-node serve as roles beside the anchor service — one identity seed, one durable data dir, one hardening envelope (the standalone binaries' own posture, applied once at the top). Role logic stays in the platform crates; the binary only composes their routers, with the shared health surface owned by exactly one role. The two standalone server binaries are gone; their crates remain as the libraries the node composes. Compose, Helm, and the image manifest now declare all three roles for real. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 6/6 commits verified |
The monitor's spend-anchor detection gets its missing input: a fetch loop pulling each watched seed's latest co-signed anchor from every watched witness (partial visibility tolerated), feeding the duplicity scan — a found fork is logged whole as the publishable proof — and the withholding-gap alerts, all inside the existing verification cycle behind three environment knobs. witness-conformance gains --url: a dependency-free driver that takes a live node through the black-box transport checks (health answers, malformed and unknown-party submissions refused fail-closed, unknown seed reads absent). Acceptance vectors still require the node's registry to hold the conformance identity; the emitted vector document is how an operator provisions that, and the tool says so instead of implying full coverage. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 7/7 commits verified |
added 2 commits
July 19, 2026 22:42
auths-witness and auths-checkpoint-cosigner are deleted, completing the consolidation the node started: the receipt server's hardening envelope lives in witness-node::hardening (over auths-core's router, as before) and the checkpoint-cosign protocol in witness-node::cosign_role, inline tests moved with them (the cosign config drops its bind address — the node owns binding). Workspace members, dependency entries, the deny wrapper lists, the honesty-surface test path, the CLI's install hint, and the deployment kit all now name the one artifact an operator runs. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
The folded crate's integration tests carried coverage the inline tests lack — cosignature verifiability under the pinned key, witness-name and pubkey binding, growth with a valid consistency proof, restart-restore with rollback still refused, and the signing-key rejection cases. They move into the node's own integration battery unchanged apart from the module path and the retired bind address. Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 8/8 commits verified |
Auths Commit Verification
Result: ✅ 9/9 commits verified |
Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 10/10 commits verified |
A bare -p auths-witness-node build only compiled when another workspace member happened to unify auths-core's witness-server feature in. Declare it on the dependency that uses it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Auths-Scope: sign_commit Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp Auths-Anchor-Seq: 13
The result gains anchor: null | {tier, threshold, witnesses, cosigners,
seedId, witnessSetSaid}, emitted only after verify_embedded_anchor
re-checked the finalization — so a relying party (the market's receipts
worker) derives the witness tier from proven facts, never from a seller
claim. Additive; older consumers unaffected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Auths-Scope: sign_commit
Auths-Id: did:keri:EB5cPHY0t-ejNC_rUzPS1dclTvd6kG-R9mQzjozCuGgd
Auths-Device: did:keri:EO1cBsYoV5izKvdIL6TstN5TOQl1hYN3WnhtAOh1lwAp
Auths-Anchor-Seq: 13
Auths Commit Verification
Result: ✅ 12/12 commits verified |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auths Witness Network — protocol core + tier wiring + node/watcher/cloud scaffold
Implements the Witness Network final spec.
AWN is the freshness layer that turns withholding and equivocation from free
attacks into a signed contradiction (rollback) and a publishable duplicity proof
(equivocation) — while authorization verification stays offline and free
(I-VERIFY-1).
What's here (by epic)
Epic A —
auths-anchor: the pure protocol core (COMPLETE)A new Layer-1.5 crate modeled on
auths-rp(D3), depending only onauths-crypto+auths-keri+auths-transparency. WASM-safe verification half.types— the anchor tuple unified withactivity/v1(D4), curve-taggedsignatures (in-band
CurveType, never length dispatch),SeedId=
H(root ‖ agent ‖ scope_seal_said),FinalizedAnchor.accept— the §9.2 acceptance rule (pure, clock-injected).duplicity— self-contained, offline-verifiable duplicity proofs (A6, I-DUP-2).finalize— t-of-N verification (I-FINAL-1/2) + honesty-ceiling over the shippedwitness::independenceengine (diversity math reused, not re-derived).freshness— thefresh | stale | unanchoredlabeled result (A5).store— theAnchorStoreport; CAS is the contract (D7).Epic B — evidence integration (
auths-evidence)AnchorTier::Witnesswired:witness_anchorconstructor +verify_anchorarm re-checks the embeddedFinalizedAnchoroffline and bindsits cumulative to the re-derived settled total. The tier ladder is now real.
freshnessresult onreceipts/v1andaudit/v1, reported besidethe verdicts (I-VERIFY-3), plus schema updates.
receipts-v1.json(A6).Epic C — the anchor role (
auths-witness-node)AnchorServiceengine: accept → sign → CAS → on-lost re-run (duplicity if theheads differ). The store, not the handler, is the serialization point.
InMemoryAnchorStore— the reference CAS adapter (D7; SQLite is the productionadapter).
Signerport —sign()only, never export (I-DEPLOY-3) +FileSigner.Epic D — watcher (
auths-monitor)detect_spend_anchor_duplicity— cross-log(seed_id, index)fork scan,emitting the
auths-anchorproof (D1).withholding_gap—now − τ_latest > thresholdalerts (D2).Epic E — build & devops
deploy/witness/— Compose, Helm chart, Terraform (aws complete; gcp/azureparity notes). One pinned digest; the same artifacts Auths runs (E1).
cargo xtask witness-conformance [--emit <dir>]— black-box accept-surfaceconformance suite + emittable vectors (E3).
auths-anchor).auths-witness-cloud(NEW closed-source repo, separate branch)Scaffolds Epics F–H:
awn-control-plane(quorum diversity acceptance test viathe same
spans_distinct),awn-sla,awn-pinning,awn-dashboards,awn-billing, anddeploy/. Consumes only publishedauthscrates; theopen-core boundary (D6) is documented and CI-enforceable.
Honest phase boundaries (deferred, not silently dropped)
witness-node serve --rolesaxum binary + fullauths-witness/auths-checkpoint-cosignerdeletion (D2 consolidation) — the anchor-rolelibrary core lands here; the HTTP surface + crate deletion is the next step.
export-attestationanchor submission leg) and B4 (Node/WASM freshnessbindings) — the verify side is wired; the producer/binding side is next.
auths-site(Epics I–J) intentionally parked per the spec.Not merged to main.