A portable verifier library (WebAssembly and native bindings) as an independent reader, built when a consumer needs verification outside Go and TypeScript

Open
  • Is something wrong?
#255 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
15/100
Issue type
Feature
Clarity
Clearly specified
Activity status
Active
Tech stack
node.js, python, rust, wasm
Domain
backend, cryptography, testing

Research direction

The proposal defers implementation until a consumer needs verification outside Go and TypeScript, and places the library in a new repository. Start by reviewing the reader-class definition, published conformance vectors, and RFC 0020 as it settles workflow outputs. Done means every claimed record kind passes all positive vectors and reports the expected findings for negative vectors in the WebAssembly build and each binding.

Written by the indexing model from the issue text.

Description

enhancement planning:deferred

Status

Deferred: recorded so the reasoning is kept; built when a consumer needs it (see When to build). No release commitment.

Problem

Verification is the part of the project every consumer wants close to their own data: receipts (the gateway's v3), decision records and the audit chain, dialect recordings, workflow outputs. Today it exists in the implementations' own languages: the Go runtime (audit verify), the gateway's Go and TypeScript verifiers, and this repository's Python and TypeScript readers. A consumer who verifies elsewhere (a data platform in Python or on the JVM, a browser page with no server, a partner's pipeline) has to run one of our programs or port the rules, and each port is another place for the rules to drift.

Proposal

A portable verifier library: one implementation of the verification side only, compiled to WebAssembly and to a native library with bindings (Python, JVM, Node), so the same code checks a record in a browser, in a customer's pipeline and on a command line.

  • Scope: verification, never evaluation. It reads records, the published keys and pins, and returns findings in the specification's terms. It computes no verdict; the runtime stays the only judge.
  • An independent reader, not a replacement. It is one more reader class implementation beside the Go runtime and the existing readers, sharing no code with them; its value is that a second, separately written implementation agrees on the conformance vectors.
  • Definition of done: the conformance vectors. It passes every published vector for the record kinds it claims (receipts v3, the decision record and audit chain, dialect recordings, workflow outputs as RFC 0020 settles them), and reports the same finding for every negative vector.
  • Language: Rust is the proposed choice for a WebAssembly and native target from one memory-safe source with no runtime; the choice is reviewed when the work starts.
  • Lives in a new repository under this organisation, created when someone commits to building it; this repository owns the reader-class definition and the vectors it is held to.

When to build

When a consumer needs verification outside Go and TypeScript: a browser-only check, verification inside a customer's data platform, or a partner integration. Until then the existing readers suffice.

Acceptance (when scheduled)

  • Every claimed vector passes in the WebAssembly build and in each binding, in CI.
  • A page in this repository's site verifies a record in the browser with no server call.
  • The reader-class text in the specification names it as a conforming reader for the kinds it covers.
Dominant language
Python
Stars
5
Forks
6
Avg merge
6h 15m
Merged PRs (30d)
98

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Judgment-Pack/judgment-pack-spec

All issues in Judgment-Pack/judgment-pack-spec

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.