Independent asset client

The native Node implementation independently checks the complete asset_evidence_v1 derivation graph against Python-produced signatures and real HTTPS publication. It imports no Python validator, crypto code or subprocess. This is interoperability evidence within the project, with exact limits below. See current validation for current combined results and release status for this implementation candidate.

Components and trust

• asset-verifier.mjs validates closed manifests, representations, publication operations, native policy, signed authority and complete graph dependencies. It reuses independently written Node JSON, ES256, URL and authority-shape primitives. The authority-shape helper now permits explicit historical validation without weakening its default current-time checks.
• asset-client.mjs is a credential-free reference HTTPS client. Its configured origins and separately retained pins supply trust. It fetches the bundle, independently observes each configured origin, verifies the graph, retrieves the original signed publications from their version URLs, and verifies again under fresh origin observations. Optional byte probes compare explicitly configured public fixture resources.
• The private local journal retains exact origin documents, origin revisions, policy lineage and verified immutable version pins across fresh processes. It is an operator-local trust store, not a portable protocol evidence export. The client uses an exclusive lock, atomic replacement and file/directory synchronization. A crashed process can leave a lock: an operator must establish that no process still owns it before removing it. There is no automatic age-based takeover.

The pure verifier accepts trusted in-process currentSnapshots, pinnedDocuments and optional manifestPins. Snapshots must come from an independent trusted acquisition adapter; a caller must never construct them by promoting bundled documents. The HTTPS client creates these inputs itself from configured origins and its private journal. Its origin reads require verified TLS, exact routes and HTTP 200. Authority declares Cache-Control: no-store; both origin requests send explicit revalidation headers and reject Age/cache warnings. Observation time is captured before acquisition, and retrieval beyond five seconds fails before entering retained history. Redirects, ambiguous response metadata/framing, unexpected media/coding, unavailable endpoints, oversize bodies and expired acquisition freshness fail. All requests are GETs without Authorization or Cookie headers.

Authority observation occurs before and after public-version acquisition and again after optional byte comparison. A valid newly observed origin revision is retained even when the graph then fails, so a later old revision cannot hide an observed withdrawal or compromise. Previously pinned revoked public material remains disqualifying after the current origin removes the key or gives the same material another key ID. Historical active signatures can survive later retirement or current authority expiry, but their current publication authority is reported separately. This is historical consistency, not an independently witnessed signing timestamp.

Exactly what is checked

Every root and parent reference binds asset ID, immutable version ID, exact signed payload digest and representation UUID. Every publisher has separately observed current origin knowledge and independently pinned historical authority/policy bytes. The verifier checks publication capability, direct versus explicit delegated service, issuer, key role and lifecycle, endpoint, resource/action/purpose scope and asset/version prefixes at the asserted publication time.

The declared graph must close completely: missing or extra documents, missing or unreachable manifests, duplicate logical references, conflicting immutable versions, future parents, self-reference, cycles, absent representations and altered copy metadata/length/digest are rejected. All declared edges of every reached manifest are checked, including edges belonging to another representation of the same version. Limits match the native profile: 32 manifests, eight derivation levels, 64 documents, 64 roots and 8 MiB bundle bytes. Shared subgraphs are revisited only when reached at a greater depth; verification does not expand every duplicate path exponentially.

compareAssetBytes separately checks supplied decoded bytes, optional encoded bytes and observed representation metadata. The HTTPS adapter implements only identity and gzip decoding, with an 8 MiB decoded-body bound. A published gzip variant has its own encoded length/digest. An unlisted encoding variant remains unconfirmed even when supplied decoded bytes match. A range cannot match a complete representation merely by supplying a slice hash.

Successful results always preserve:

{
  "resource_permission_granted": false,
  "downstream_use_verified": false,
  "derivation_computation_verified": false
}

Local byte comparison does not prove remote receipt, downstream model use, that a transform was computed correctly, that all actual sources were disclosed, or that the source was licensed for that use. Publication authority does not turn a policy prohibition into access permission.

Run the client

Use Node 24 or a compatible runtime supporting the native APIs used here. No npm dependency is required. Run from this source checkout:

node verification/asset-client.mjs \
  --config /private/operator/asset-config.json \
  --state /private/operator/asset-journal.json

The journal’s parent directory must be owned by the operator with mode 0700; configuration and existing journal files must be owned regular files with mode 0600, one hard link and no symlink. The configured CA file is a separately supplied public trust anchor. The JSON configuration has these exact fields:

Field	Input
origins	Explicit allowlist of independently trusted publisher origins; at most 32
bundle_url	Operator-selected HTTPS URL for the asset bundle on one configured origin
expected_roots	Nonempty list of exact qualified root references expected by the caller
ca_file	Local path to the CA certificate used to authenticate these origins
document_pins	Object mapping exact digest to base64url original historical origin document bytes, independently provisioned; may be empty for current publication
manifest_pins	Previously trusted immutable version URL to payload digest mapping; may initially be empty
byte_probes	Optional list, or []; each entry has exactly url, reference and metadata (media_type, media_parameters, languages)

The journal’s origin set cannot silently change. Use a separate explicitly configured journal when changing the trust domain. Incoming bundles cannot add origins, keys or history pins to the configuration. Retained origin-document and version limits are 512 and 4,096 respectively; exceeding a limit fails rather than silently dropping compromise or version history.

The /asset-evidence.json and /asset-bytes/* routes used by tests are explicitly configured fixture routes, not new required protocol discovery paths. The client deliberately verifies live original version URLs; its availability requirement is additional to the pure offline graph verifier. It is an evidence-interoperability reference, not an Agent Core crawler, access-negotiation client, universal decoder, protected-content gateway or verifier of every agreement/archive envelope. Those capabilities retain their separate documented implementations and tests. Private journal ownership does not protect against a privileged local administrator replacing the journal.

Reproduce and inspect the evidence

node --test verification/test_asset_verifier.mjs
ODEXA_NODE="$(command -v node)" \
  ODEXA_ASSET_NODE_REPORT_DIR=verification/local-asset-node-run \
  python -m unittest discover -s tests -p test_asset_node.py -v

The earlier component evidence includes 51 native semantic cases cover independent signatures/trust, direct/delegated and cross-origin graphs, exact payload bytes, complete closure and representation comparison. That checkpoint’s seven-suite Node regression passes 191 tests, including the previous 140 free/paid/storage/duty checks.

The earlier component’s wire regression passes 21 Python harness methods: nine new asset methods, eight paid-client methods and four existing free/storage methods. The asset harness invokes 22 fresh native Node processes across nine saved scenario reports. All nine scenarios exercise real certificate-verified HTTPS; expected failures are deliberate hostile cases, not failed tests. The cross-origin case is also accepted independently by the Python graph verifier before Node verification. Reports retain outcomes, not client credentials or private keys. The older eight-method asset-node-wire-tests.txt is intermediate evidence before the immutable-version restart case and added same-revision mutation check; the 21-method run records that historical checkpoint. Overlapping counts are not additive.

The component compatibility inventory retains the exact source/evidence hashes and runtime/schema/wheel comparison for its earlier checkpoint. Its counts and identities are historical; current validation identifies the current candidate source and results. No historical result changes a wire version or publishes a release.

See the native asset contract, current validation and release status.

Acquisition boundary checks

The asset-client harness checks that observation time is captured before retrieval, acquisitions over five seconds are refused and cache warnings/age do not enter trusted history. These acquisition checks supplement the graph and original-publication checks above. Use current validation for the current complete-suite results; the preceding component reports describe their recorded checkpoints and overlap with the complete runs.