AAAP v0.5 — Hardened Post-Release Challenge
AAAP v0.3 at commit
e0fca96651b30c76d0a29bf867cdd14cdc38db00 is preserved as an immutable,
reproducibly vulnerable historical release. This repository is its
hardened successor.
The v0.4 packet preserves the v0.3 chain.jsonl, artifacts/, and
attestation.json byte-for-byte. It regenerates the human/verification layer
and signs manifest schema v2 with the same anchored production identity. The
chain head and public key therefore remain:
- head:
14d14281170d89f6f8b918daf6541f81e7e13549dd4c66f5b085304ff6a61724 - pubkey:
e7fb4aad8b0e0246eb6569f49d301ad88a0b54333e3de8bb57e02e118fd3716c
Start with CHALLENGE.md. The complete v0.3 reproducer and
machine results are under security/; the post-release finding ledger is
docs/AAAP_POST_RELEASE_SECURITY.md.
Verify
Requirements: Python 3.10+ and either the Python cryptography package or an
OpenSSL build with Ed25519 pkeyutl -rawin support.
cd packet python3 verify_packet.py . \ --expected-head 14d14281170d89f6f8b918daf6541f81e7e13549dd4c66f5b085304ff6a61724 \ --expected-pubkey e7fb4aad8b0e0246eb6569f49d301ad88a0b54333e3de8bb57e02e118fd3716c
For registry-policy verification, independently acquire both exact registry
snapshots and use --packet-name demo/packet. Both repositories are controlled
by github.com/cjchanh: they are two Git histories, not two administrative or
custodial trust origins.
Narrow claim
A PASS authenticates the checked bytes, canonical envelope semantics, ordering, manifest policy, and signatures under the supplied anchor. It does not prove world truth, signing time, Keychain custody, operator ownership, verifier/host benevolence, registry freshness, or independent origin.
Hardening source: local working commit in the operator's private
workspace; the published lineage is e0fca96 -> 8f5ba31f -> c06b163 ->
939b1e7 -> 9655a65 -> 06a3982 (current).
Where this fits
AAAP seals evidence. A heavier protocol — the Continuant — attaches mission authority, machine heterogeneity, and independent verification to that seal: a mission runs across a Mac, a cloud model, and a Raspberry Pi holding its own key, survives process death and the loss of its authority key, and the whole lineage seals into an AAAP-family packet a stranger re-verifies from receipts alone. Demonstrated (not yet a product) at https://centennialsystems.com/stack.