feat: add VTL v0.11 canonical signed envelope

[safal207]

Purpose

Stacked on #948 / agent/verified-transition-loop-v0.10. VTL v0.11 binds Ed25519 authenticity to the explicit v0.10 canonical-byte profile so the same signed statement can be verified independently in Python and Node.

Tracking: #949 (completed with exact-head evidence).

Core invariant

signature authority != serialization authority

The signed statement explicitly binds:

attestation_id
profile_id
schema_version
canonical_profile
payload_digest
issuer_id
signer_key_id
trust_root_id
issued_at_ms
not_before_ms
not_after_ms
signature_algorithm

Canonical profile: rfc8785-safe-integer/v0.10.

Cross-runtime proof

Independent implementations:

Python: src/verified_transition_loop/canonical_signed_envelope.py
Node:   reference/canonical-signed-envelope-v0.11.mjs

Both consume the same envelope, public key, canonical signed bytes, Ed25519 signature, trust-root fixture, and mutation vectors. CI requires complete Python result == Node result, not two independent PASS statuses.

Executable profile

12/12 shared vectors PASS:

• valid signature;
• payload tamper;
• canonical-profile substitution;
• attestation-ID tamper;
• signature tamper;
• trust-root mismatch;
• issuer mismatch;
• signer revocation;
• signer-key expiry;
• attestation expiry;
• algorithm substitution;
• wrong public key.

Direct regressions additionally cover ambiguous signer IDs, malformed public-key material, unsafe integers, floats, exact signed bytes, and signature/profile binding.

Claim separation

The verifier exposes independently:

payload_digest_matches
attestation_id_valid
canonical_profile_valid
signature_valid
trusted_current_authority

A payload mutation can leave signature_valid=true while the envelope fails PAYLOAD_DIGEST_MISMATCH, because the historical payload digest is what was signed. Revocation/expiry can leave the signature mathematically valid while trusted_current_authority=false. A canonical-profile substitution changes the signed statement itself and therefore invalidates both attestation identity and signature.

Compatibility

v0.11 is opt-in. It does not rewrite historical v0.8/v0.9 signature identities. v0.10 canonical conformance remains independently executable.

Package: verified-transition-loop==0.11.0
CLI: vtl-canonical-envelope-verify

Exact-head evidence

Final v0.11 head:

ff5331c4abbe6b625f4a4f9396a7c6c8ec30d64b

Exact stacked v0.10 parent:

897d9a1c3da71ef967d0a470e68e2153e11c9bdc

PR merge ref verified these exact parents:

913e13a4864f4ee16177009d042aee5415396233

Green on the final head:

• Verified Transition Loop v0.11 PR run 32039354770: SUCCESS;
  • package 0.11.0: PASS;
  • focused suite: 124/124 PASS;
  • v0.10 canonical Python↔Node parity: 18/18 PASS;
  • v0.11 Python canonical signed-envelope verifier: PASS;
  • v0.11 Node canonical signed-envelope verifier: PASS;
  • complete Python↔Node structured-result equality: PASS;
  • v0.11 shared signature profile: 12/12 PASS;
  • exact canonical signed bytes match fixture: PASS;
  • exact Ed25519 signature matches fixture: PASS;
  • valid case verifies signature and whole envelope in both runtimes: PASS;
  • use-time v0.4: 10/10 PASS;
  • detached dispatch v0.7: 11/11 PASS;
  • attested-dispatch v0.8: 14/14 PASS;
  • trust-root snapshot v0.9: 14/14 PASS;
  • side-effect-free deployment / rollback / TOCTOU demo: PASS.
• Phase 12.1 Regression Scan run 32039354773: SUCCESS;
  • DCP regression test: SUCCESS;
  • Semgrep all-severity scan: SUCCESS;
  • Semgrep BLOCKER enforcement: SUCCESS.

Review status

• mergeable: true;
• unresolved review threads: 0;
• content head frozen at ff5331c...;
• no merge requested or performed.

Safety / trust ceiling

This remains a reference verification protocol. It performs no tool execution, deploy, merge, payment, message send, credential issuance, KMS/HSM/IAM call, or production authority grant. It inherits v0.10's safe-integer JSON domain and does not claim full RFC 8785 floating-point coverage, Unicode normalization/confusable equivalence, a globally freshest trust-root oracle, transparency-log consensus, or hardware-backed key/checkpoint storage.

The load-bearing v0.11 claim is narrower and executable: within the declared canonical profile, independent Python and Node runtimes verify the same canonical signed bytes and the same Ed25519 signature into the same structured proof result.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 8ff98450-60e9-430a-a405-fdf94bcb9bee

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}