# Changelog

All notable changes to `@coproduct_inc/verify`.

## 0.6.0

- **The `Workflow` flow check now CONSUMES the one proven IFC model** —
  `nucleus-ifc`'s `FlowDeclaration → IfcVerdict` decision, compiled into the
  package's wasm and exposed as `ifcDecide` (`./ifc-decide`). The DAG walk
  accumulates each node's declared inputs (`secret`, `web_content`, …) and asks
  the proven `decide()` whether they may reach a sink — the same decision
  nucleus's production gate runs, recomputed locally. No TS mirror in the
  decision path.
- New `FlowPolicy` axes `adversarialSources` + `actionSinks` enable **indirect
  prompt-injection** detection: web content (Adversarial integrity, NoAuthority)
  reaching an action sink is refused across the DAG; a declassifier breaks the
  path. Existing confidentiality policies are unchanged.
- **IFC lattice helpers** (`./ifc`) — a TS reflection of the same Denning lattice
  for direct in-process use, kept **parity-checked against `ifcDecide`** (and the
  Lean-proven laws via `ifcLatticeLaws()`).
- Build: `nucleus-wasm` now depends on `nucleus-ifc` (lattice-only, no `ring`) and
  exports `ifc_decide`; the `build:wasm` script preserves the wasm dir's
  `commonjs` marker so the CJS bindings load inside this ESM package.

## 0.5.0

- **`Workflow` — the DAG cage** (`./workflow`, re-exported from root). Compose a
  multi-agent run into ONE signed `WorkflowReceipt`: register nodes (each a
  `Cage`) with `after` edges, then `wf.attest(privateKey)`. `verifyWorkflowReceipt`
  checks it offline — signature + per-node in-bounds recompute + the DAG (acyclic,
  real edges) + a **cross-node information-flow policy** (`{ sources, sinks,
  declassifiers }`). The keystone: every node can be locally in-bounds yet the
  workflow refuses a run where a secret laundered source→…→sink across the DAG —
  the failure that only exists at multi-agent scale, caught at the orchestration
  layer. See `examples/workflow-leak.mjs`.

## 0.4.0

- **`Cage` — the 5-minute producer drop-in** (`./cage`, re-exported from root).
  A runtime cage wraps an agent's tool calls (`cage.tool(name, fn, { guard,
  subject })`): out-of-boundary calls are blocked, every call is recorded, and
  `cage.attest(privateKey)` emits a signed in-bounds receipt the existing
  `verifyReceipt` / CLI checks offline. Closes the loop — producers cage,
  consumers verify, nobody trusts the seller. See `examples/cage-quickstart.mjs`.

## 0.3.0

### Added
- **Offline Ed25519 license keys** (`./license` export + `nucleus-license` bin) —
  entitlement with no user database and no callback: the vendor signs a tiny
  claims payload; the Pro path verifies it against a pinned public key.
  `keygen` / `issue` / `verify`; expiry enforced; tamper-evident.
- **Converting demo** (`examples/converting-demo.sh`) — recordable 4-beat demo
  (clean attests · OpenClaw impersonation refused · forged verdict caught two
  ways · CI gate), runs against the published package or `LOCAL=1`.
- **`WHY-VERIFY.md`** — positioning one-pager (the independent-recompute
  differentiator + honest Microsoft-AGT contrast) and a static `site/` landing
  page (zero-JS, zero-backend) wired for a Merchant-of-Record checkout.

## 0.2.0

### Added
- **Producer-side instrumentation** — turn a nucleus-tool-proxy trace into a
  signed in-bounds attestation receipt.
  - `./toolproxy` export: `attestToolProxyRun`, `boundaryFromExport`,
    `traceEventsFromRecords`, `parseExport`. Maps the tool-proxy's verdict
    records (`actor`/`operation`/`verdict`/`subject`/`deny_reason`, mirroring
    the `verdict_sink` `tool_call` span) into the receipt schema and signs it.
    Includes a cross-check that the proxy's own allow/deny agrees with the
    receipt's independently recomputed verdict (surfaces boundary drift).
  - `nucleus-attest` bin: read a trace export (stdin or file), sign a receipt.
    With `--key <pkcs8.pem>` uses a real key; otherwise an ephemeral in-memory
    key (no custody), printing the public key to stderr.
- Release workflow: OIDC trusted publishing to npm (no stored token).

## 0.1.0

### Added
- **Capability-boundary in-bounds attestation** — the headline evidence layer.
  - `verifyReceipt` / `verifyReceiptJson`: offline, zero-trust verification of
    an Ed25519-signed, SHA-256-hash-chained receipt that an agent run stayed
    within a declared capability boundary, keyed on a cryptographic principal
    (SPIFFE id + permission fingerprint), never a mutable display name.
  - `signReceipt`, `recomputeVerdict` (the pure soundness floor), `makeBoundary`.
  - `nucleus-verify` CLI (exit 0 in-bounds / 1 refused / 2 usage) and a
    composite GitHub Action.
- **Auction receipts** (original use case): `verify`, `recomputeClearing`,
  `verifySignature` over the bundled `nucleus-wasm` core.