Normalize identity replay receipt paths

scripts/latticra-panel-signed-updater-manifest-fixture-contract.sh

@@ -34,6 +34,8 @@ UNAME_M=$(uname -m 2>/dev/null || printf 'unknown')
 FIXTURE_RELATIVE='fixtures/latticra-panel/signed-updater-manifest.fixture.toml'
 FIXTURE="$ROOT/$FIXTURE_RELATIVE"
 
+. "$ROOT/scripts/lib/latticra-portable-paths.sh"
+
 if [ -f "$FIXTURE" ]; then
   MANIFEST_FIXTURE_FILE_PRESENT=1
   CONTRACT_STATUS=ok

scripts/latticra-panel-signed-updater-manifest-fixture-validation.sh

@@ -42,6 +42,8 @@ UNAME_M=$(uname -m 2>/dev/null || printf 'unknown')
 FIXTURE_RELATIVE='fixtures/latticra-panel/signed-updater-manifest.fixture.toml'
 FIXTURE="$ROOT/$FIXTURE_RELATIVE"
 
+. "$ROOT/scripts/lib/latticra-portable-paths.sh"
+
 if [ ! -f "$FIXTURE" ]; then
   printf 'latticra panel signed updater manifest fixture validation: missing fixture: %s\n' "$FIXTURE_RELATIVE" >&2
   exit 1
@@ -99,7 +101,7 @@ signed_updater_delivery_gate_state=closed
 signed_updater_denial_transcript_present=1
 signed_updater_manifest_fixture_contract_present=1
 signed_updater_manifest_fixture_validation_present=1
-manifest_fixture_path=$FIXTURE_RELATIVE
+manifest_fixture_path=$(portable_path "$FIXTURE_RELATIVE")
 signed_updater_manifest_fixture_present=1
 signed_updater_manifest_fixture_file_present=1
 signed_updater_manifest_fixture_validated=1

scripts/latticra-panel-signed-updater-state-fixture-contract.sh

@@ -34,6 +34,8 @@ UNAME_M=$(uname -m 2>/dev/null || printf 'unknown')
 FIXTURE_RELATIVE='fixtures/latticra-panel/signed-updater-state.fixture.toml'
 FIXTURE="$ROOT/$FIXTURE_RELATIVE"
 
+. "$ROOT/scripts/lib/latticra-portable-paths.sh"
+
 if [ -f "$FIXTURE" ]; then
   STATE_FIXTURE_FILE_PRESENT=1
   CONTRACT_STATUS=ok
@@ -57,7 +59,7 @@ signed_updater_denial_transcript_present=1
 signed_updater_manifest_fixture_contract_present=1
 signed_updater_manifest_fixture_validation_present=1
 signed_updater_state_fixture_contract_present=1
-state_fixture_path=$FIXTURE_RELATIVE
+state_fixture_path=$(portable_path "$FIXTURE_RELATIVE")
 signed_updater_state_fixture_present=$STATE_FIXTURE_FILE_PRESENT
 signed_updater_state_fixture_file_present=$STATE_FIXTURE_FILE_PRESENT
 state_fixture_schema=latticra-panel-signed-updater-state-fixture-v0

scripts/latticra-panel-signed-updater-state-fixture-validation.sh

@@ -42,6 +42,8 @@ UNAME_M=$(uname -m 2>/dev/null || printf 'unknown')
 FIXTURE_RELATIVE='fixtures/latticra-panel/signed-updater-state.fixture.toml'
 FIXTURE="$ROOT/$FIXTURE_RELATIVE"
 
+. "$ROOT/scripts/lib/latticra-portable-paths.sh"
+
 if [ ! -f "$FIXTURE" ]; then
   printf 'latticra panel signed updater state fixture validation: missing fixture: %s\n' "$FIXTURE_RELATIVE" >&2
   exit 1
@@ -121,7 +123,7 @@ signed_updater_manifest_fixture_contract_present=1
 signed_updater_manifest_fixture_validation_present=1
 signed_updater_state_fixture_contract_present=1
 signed_updater_state_fixture_validation_present=1
-state_fixture_path=$FIXTURE_RELATIVE
+state_fixture_path=$(portable_path "$FIXTURE_RELATIVE")
 signed_updater_state_fixture_present=1
 signed_updater_state_fixture_file_present=1
 signed_updater_state_fixture_validated=1

scripts/test-latticra-panel-signed-updater-manifest-fixture-contract.sh

@@ -120,7 +120,7 @@ require_contains 'not signed update evidence' "$status"
 
 require_contains 'LATTICRA PANEL SIGNED UPDATER MANIFEST FIXTURE CONTRACT' "$script"
 require_contains 'signed_updater_manifest_fixture_contract_status=$CONTRACT_STATUS' "$script"
-require_contains 'manifest_fixture_path=$FIXTURE_RELATIVE' "$script"
+require_contains 'manifest_fixture_path=$(portable_path "$FIXTURE_RELATIVE")' "$script"
 require_contains 'signed_updater_manifest_fixture_contract_present=1' "$script"
 require_contains 'trusted_signed_manifest_present=0' "$script"
 require_contains 'signed_manifest_present=0' "$script"

scripts/test-latticra-panel-signed-updater-manifest-fixture-validation.sh

@@ -124,7 +124,7 @@ require_contains 'production_update_ready=0' "$status"
 require_contains 'LATTICRA PANEL SIGNED UPDATER MANIFEST FIXTURE VALIDATION' "$script"
 require_contains 'require_fixture_line' "$script"
 require_contains 'signed_updater_manifest_fixture_validation_status=ok' "$script"
-require_contains 'manifest_fixture_path=$FIXTURE_RELATIVE' "$script"
+require_contains 'manifest_fixture_path=$(portable_path "$FIXTURE_RELATIVE")' "$script"
 require_contains 'signed_updater_manifest_fixture_validation_present=1' "$script"
 require_contains 'signed_updater_manifest_fixture_validated=1' "$script"
 require_contains 'manifest_schema_validated=1' "$script"

scripts/test-latticra-panel-signed-updater-state-fixture-contract.sh

@@ -147,7 +147,7 @@ require_contains 'not update-state evidence' "$status"
 
 require_contains 'LATTICRA PANEL SIGNED UPDATER STATE FIXTURE CONTRACT' "$script"
 require_contains 'signed_updater_state_fixture_contract_status=$CONTRACT_STATUS' "$script"
-require_contains 'state_fixture_path=$FIXTURE_RELATIVE' "$script"
+require_contains 'state_fixture_path=$(portable_path "$FIXTURE_RELATIVE")' "$script"
 require_contains 'signed_updater_state_fixture_contract_present=1' "$script"
 require_contains 'state_catalog_present=1' "$script"
 require_contains 'current_update_state=blocked' "$script"

scripts/test-latticra-panel-signed-updater-state-fixture-validation.sh

@@ -167,7 +167,7 @@ require_contains 'production_update_ready=0' "$status"
 require_contains 'LATTICRA PANEL SIGNED UPDATER STATE FIXTURE VALIDATION' "$script"
 require_contains 'require_fixture_line' "$script"
 require_contains 'signed_updater_state_fixture_validation_status=ok' "$script"
-require_contains 'state_fixture_path=$FIXTURE_RELATIVE' "$script"
+require_contains 'state_fixture_path=$(portable_path "$FIXTURE_RELATIVE")' "$script"
 require_contains 'signed_updater_state_fixture_validation_present=1' "$script"
 require_contains 'signed_updater_state_fixture_validated=1' "$script"
 require_contains 'state_schema_validated=1' "$script"

src/seal_signed_receipt_proof_path.c

@@ -38,10 +38,7 @@ static int text_field_valid(const char *value, size_t max_len) {
 }
 
 static int text_field_terminated(const char *value, size_t max_len) {
-    int terminated = 0;
-
-    (void)bounded_string_len(value, max_len, &terminated);
-    return terminated == 1;
+    return text_field_valid(value, max_len);
 }
 
 static int bounded_string_is(const char *value, size_t max_len, const char *expected) {

tests/seal_signed_receipt_proof_path_invariants.c

@@ -245,6 +245,9 @@ static int proof_path_allows_verification_only_summary(void) {
     EXPECT_TRUE(strstr(rendered, "network_performed=0") != NULL, "render network");
     EXPECT_TRUE(strstr(rendered, "status=signed-receipt-proof-path-verification-only") != NULL,
                 "render status field");
+    proof_path.signer_invocation_profile[0] = '\0';
+    EXPECT_TRUE(latticra_seal_signed_receipt_proof_path_is_verification_only(&proof_path) == 0,
+                "empty proof path metadata rejected");
     return 0;
 }
 

tools/latticra_identity_replay_model1_range_falsifier.py

@@ -5,13 +5,13 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from pathlib import Path
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text, parse_target_table
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text, path_reference
+from latticra_identity_replay_model1_evaluate import parse_target_table
 from latticra_identity_replay_model1_substrate import (
     EPSILON_IDENTITY_TOLERANCE,
     MAX_CELL_ABS,
@@ -27,8 +27,7 @@
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def target_ratio_summary(

tools/latticra_identity_replay_model2_preregistration.py

@@ -5,12 +5,11 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text
 from latticra_identity_replay_model1_substrate import (
     EPSILON_IDENTITY_TOLERANCE,
     MAX_CELL_ABS,
@@ -33,8 +32,7 @@
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def model1_max_kappa_per_step() -> Decimal:

tools/latticra_identity_replay_model2_range_capacity.py

@@ -5,29 +5,35 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from pathlib import Path
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text, parse_target_table
+from latticra_receipt_utils import (
+    canonical_receipt_hash,
+    decimal_to_text,
+    path_reference,
+    receipt_hash as _make_receipt_hash_with_exclude,
+)
+from latticra_identity_replay_model1_evaluate import parse_target_table
 
 
 getcontext().prec = 80
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def pre_registration_hash(payload: dict[str, object]) -> str:
-    canonical_payload = dict(payload)
-    canonical_payload.pop("model2_pre_registration_receipt_hash", None)
-    canonical_payload.pop("model2_pre_registration_receipt_hash_generated", None)
-    canonical = json.dumps(canonical_payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return _make_receipt_hash_with_exclude(
+        payload,
+        exclude_keys=(
+            "model2_pre_registration_receipt_hash",
+            "model2_pre_registration_receipt_hash_generated",
+        ),
+    )
 
 
 def load_pre_registration(path: Path) -> dict[str, object]:

tools/latticra_identity_replay_model3_capacity_gate.py

@@ -5,29 +5,30 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from pathlib import Path
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text, parse_target_table
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text, path_reference, receipt_hash as _make_receipt_hash_with_exclude
+from latticra_identity_replay_model1_evaluate import parse_target_table
 
 
 getcontext().prec = 80
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def pre_registration_hash(payload: dict[str, object]) -> str:
-    canonical_payload = dict(payload)
-    canonical_payload.pop("model3_pre_registration_receipt_hash", None)
-    canonical_payload.pop("model3_pre_registration_receipt_hash_generated", None)
-    canonical = json.dumps(canonical_payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return _make_receipt_hash_with_exclude(
+        payload,
+        exclude_keys=(
+            "model3_pre_registration_receipt_hash",
+            "model3_pre_registration_receipt_hash_generated",
+        ),
+    )
 
 
 def load_pre_registration(path: Path) -> dict[str, object]:

tools/latticra_identity_replay_model3_preregistration.py

@@ -5,12 +5,11 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text
 from latticra_identity_replay_model2_preregistration import (
     SCALE_LEVELS,
     build_receipt as build_model2_pre_registration,
@@ -27,8 +26,7 @@
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def amplification_multiplier() -> Decimal:

tools/latticra_identity_replay_model3_refined_preregistration.py

@@ -5,13 +5,12 @@
 from __future__ import annotations
 
 import argparse
-import hashlib
 import json
 from decimal import Decimal, getcontext
 from pathlib import Path
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text, path_reference
 from latticra_identity_replay_model3_preregistration import (
     build_receipt as build_model3_pre_registration,
 )
@@ -32,11 +31,9 @@
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical_payload = dict(payload)
-    canonical_payload.pop("refined_model3_pre_registration_receipt_hash", None)
-    canonical_payload.pop("refined_model3_pre_registration_receipt_hash_generated", None)
-    canonical = json.dumps(canonical_payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(
+        {k: v for k, v in payload.items() if k not in ("refined_model3_pre_registration_receipt_hash", "refined_model3_pre_registration_receipt_hash_generated")}
+    )
 
 
 def load_gate(path: Path) -> dict[str, object]:

tools/latticra_identity_replay_model3_runner.py

@@ -10,7 +10,7 @@
 from decimal import Decimal, getcontext
 from typing import Iterable
 
-from latticra_identity_replay_model1_evaluate import decimal_to_text
+from latticra_receipt_utils import canonical_receipt_hash, decimal_to_text
 from latticra_identity_replay_model1_substrate import (
     EPSILON_IDENTITY_TOLERANCE,
     MASSIVE_IDENTITY_CLASSES,
@@ -34,8 +34,7 @@
 
 
 def receipt_hash(payload: dict[str, object]) -> str:
-    canonical = json.dumps(payload, sort_keys=True, separators=(",", ":"))
-    return "sha256:" + hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+    return canonical_receipt_hash(payload)
 
 
 def topology_trace(identity: str) -> dict[str, object]: