nexart.iodocs

    Governed Execution Source Ledger

    Rule-by-rule sources for the Governed Execution docs: which Node 0.30.1 source file, executable test or SDK 0.4.2 declaration grounds each documented contract statement.

    Source priority

    1. Node production implementation.
    2. Executable Node tests.
    3. Governed SDK 0.4.2 package contract.
    4. Current schemas and release documentation.
    5. Historical documents, non-normative background only.

    Sources

    IDPathFunction, schema or testKind
    S1src/server.jsPOST /api/attest handler, cerLogicalExecutionId, cerSignedProtocolVersion, tryBuildIdempotentReplayProduction
    S2src/auth.jscreateAuthMiddleware: Bearer validation, fail-closed DB policyProduction
    S3src/attest.jscanonicalize bridge; verifyGovernedExecBundleProduction
    S4@nexart/governed-execution@0.4.2 dist/index.d.ts, dist/index.mjsCER types, profile, GraphTopology, status and code types, limitsSDK
    S5src/json-body-limit.js, src/sanitize.js, src/request-guards.jsBody limits, JSON structure limits, error middlewareProduction
    S6src/signing.jsselectSigningKey, key lifecycle, buildReceipt, signReceipt, getPublicKeyInfoProduction
    S7src/signing.jsSigned-field constants, family optional fields, deriveSignablePayload, buildVerificationEnvelopeV2, signVerificationEnvelopeV2Production
    S8src/attest.js; @nexart/ai-execution dist/index.mjstoCanonicalJson canonicalizer; anchor and timestamp helpersProduction / SDK
    S9src/server.jsgovernedVerificationMetadata, buildVerifyChecks, /v1/cer/verify response, verifyEnvelopeSignatureMultiKeyProduction
    S10Node TSA modulesRFC 3161 timestamp preparation and receipt timestamp fieldsProduction
    S11src/server.jsverificationUrl constructionProduction
    S12Node DB helpersinsertCerProofWithUsage, cer_proofs persistenceProduction
    S13Node migrationscer_proofs columns and visibility_stateProduction
    S14-S16Public read routes/v1/cer/public, /api/public-cer-proof, /v1/resolve/cer/:certificateHash, buildPublicCerSectionsProduction
    S17Proof management routesPOST /api/proofs/:certificateHash/unhide and /visibilityProduction
    S18Ingest clientExternal ingest skipped for governed CERsProduction
    S19Rate limiter registrationPublic limiter; no authenticated limiter on /api/attestProduction
    S20src/server.js/v1/cage/bundles, /api/stamp, /api/stamp-from-executionProduction
    T1Governed HTTP testsHappy path, replay, signatures, projection, visibility, unhideExecutable tests
    T2Governed fixtures and negative testsgoverned-static-mutual-cycle.json, malformed stateHashExecutable tests

    Each source and rule has a permanent link: #s1 to #t2 for sources, #r1 onward for rules. New rules are added at the end so existing links do not change. Paths are repository-relative to the audited Node source unless a package is named.

    Rules

    IDDocumented rulePageSources
    R1/api/attest body is the complete sealed CER, not { bundle }; Bearer key requiredattestation-contract#requestS1, S2, T1
    R2/v1/cer/verify body is { bundle: CER }; no API keyattestation-contract#statelessS9
    R3CER version is "0.1" or "0.2"; protocolVersion mirrors itattestation-contract#requestS1, S3, S4, T1
    R4Logical execution identity is evidence.bundle.bundleIdattestation-contract#requestS1, T1
    R5X-NexArt-Visibility accepts only public | private; default hiddenattestation-contract#requestS1
    R6X-NexArt-Readable-Fields rejected with READABLE_FIELDS_UNSUPPORTEDattestation-contract#requestS1
    R7Body, structure, SDK and CAGE limits (source defaults)attestation-contract#limitsS4, S5, S19
    R8Success response fields and absent fieldsattestation-contract#responseS1, S6-S9
    R9attestation.checks is ["governed_execution"]attestation-contract#responseS1
    R10Optional RFC 3161 timestamp fields; token outside signed perimetersattestation-contract#responseS10
    R11Exact replay returns X-Idempotent-Replay: true; mutation returns 409attestation-contract#replayS1, T1
    R12Failure status tableattestation-contract#failuresS1, S2, S5, S12
    R13Receipt fields; whole receipt signed; base64url Ed25519 over UTF-8 JCSattestation-contract#receipt-signatureS6, S8, T1
    R14Select key by receipt.attestorKeyId, not keys[0] or activeKidattestation-contract#receipt-signatureS6, T1
    R15Envelope v2 descriptor fields and valuesattestation-contract#envelope-signatureS7
    R16Envelope signs JCS({ attestation, bundle }) projection, not the descriptorattestation-contract#envelope-signatureS7, T1
    R17v0.1 optional: context, contextSummary; v0.2 optional: identity, confidentialityattestation-contract#envelope-signatureS7, T1
    R18Node-side envelope check reads bundle.meta.verificationEnvelope*attestation-contract#envelope-signatureS9, T1
    R19governedVerification has exactly nine keys; fixed not-performed / not-claimedattestation-contract#governed-verificationS4, S9, T1
    R20SDK reason codes and Node INVALID_STRUCTUREattestation-contract#governed-verificationS3, S4, S9
    R21/v1/cer/verify returns 200 for verified and failed; computedCertificateHash null on failureattestation-contract#statelessS9, T2
    R22status combines envelope signature; classification may differattestation-contract#statelessS9
    R23Persisted in cer_proofs, default hidden, no external ingest for governedattestation-contract#persistenceS1, S12, S13, S18
    R24Owner visibility routes: POST /api/proofs/:certificateHash/unhide and /visibility; authenticated owner onlyattestation-contract#persistenceS17, T1
    R25Visibility values: header public | private; stored visibility_state hidden | public | privateattestation-contract#requestS1, S13
    R26Visibility is row state outside the protected hash projectionattestation-contract#persistenceS4 (protectedFields), S13
    R27Visibility transition preserves certificateHash and CER; no new receipt or signatureattestation-contract#persistenceS17, T1
    R28verify.nexart.io resolution after a visibility change: NOT establishedattestation-contract#persistenceOutside audited repository (limitation 2)
    R29No governed public-reseal routeattestation-contract#persistenceS20, T1
    R30verificationUrl is formatted, not a publication checkattestation-contract#persistenceS11
    R31Route status tableattestation-contract#routesS1, S9, S14-S20
    R32Discovery response fields and key lifecycleattestation-contract#discoveryS6
    R33certificateHash = sha256 over JCS of the protected projectionschema#hashS3, S4
    R34Static topology may be cyclic; concrete lineage must be acyclictopologyS4, T2
    R35stateHash is opaque; stateHashAlg/Canon/Scope are optional CAGE producer conventionsstate-commitmentsS4 (absent from SDK schema)
    R36CAGE 19/19 over-the-wire resultcage#interopReported by the CAGE project; not part of the source audit

    Runtime evidence

    Production interoperability validation reported by the CAGE project: 19/19 over-the-wire checks passed against NexArt Node 0.30.1 and @nexart/governed-execution 0.4.2. See CAGE Integration for what this does and does not establish.