test: verify canonical Pinhere discovery bytes

README.md

@@ -6,9 +6,8 @@ canonical PontxSpec.
 This repository is generated from the MIT-licensed, product-owned contract in
 [`jasonHzq/pinhere`](https://github.com/jasonHzq/pinhere). The source and
 package are ready for public review, but npm publication remains fail-closed
-until `pinhere.dev` serves the production API and canonical
-`/.well-known/pontx.json` discovery resource. The current Vercel Preview is not
-the canonical production origin.
+until the canonical `https://pinhere.dev/.well-known/pontx.json` response is
+DNS-reachable and byte-for-byte matches the pinned canonical JSON contract.
 
 ## Safety boundary
 

package.json

@@ -57,8 +57,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@pontx/sdk": "1.0.0-beta.9",
-    "pontx": "1.0.0-beta.16"
+    "@pontx/sdk": "1.0.0-beta.11",
+    "pontx": "1.0.0-beta.18"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

scripts/lib/canonical-discovery.mjs

@@ -0,0 +1,56 @@
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+
+export function sha256(bytes) {
+  return createHash("sha256").update(bytes).digest("hex");
+}
+
+export function canonicalJsonBytes(bytes) {
+  return Buffer.from(JSON.stringify(JSON.parse(Buffer.from(bytes).toString("utf8"))), "utf8");
+}
+
+export async function verifyCanonicalDiscovery({
+  url,
+  sourceBytes,
+  expectedCanonicalJsonSha256,
+  fetchImpl = fetch,
+}) {
+  const source = JSON.parse(Buffer.from(sourceBytes).toString("utf8"));
+  const expected = canonicalJsonBytes(sourceBytes);
+  assert.equal(
+    sha256(expected),
+    expectedCanonicalJsonSha256,
+    "Release blocked: pinned canonical JSON hash does not match the source contract.",
+  );
+
+  let response;
+  try {
+    response = await fetchImpl(url, {
+      headers: { accept: "application/json" },
+      signal: AbortSignal.timeout(20_000),
+    });
+  } catch (error) {
+    throw new Error(`Release blocked: canonical discovery fetch failed (${error.message}).`);
+  }
+  assert(response.ok,
+    `Release blocked: canonical discovery returned HTTP ${response.status}.`);
+  assert.match(response.headers.get("content-type") ?? "", /^application\/json(?:;|$)/i,
+    "Release blocked: canonical discovery must return application/json.");
+
+  const actual = Buffer.from(await response.arrayBuffer());
+  assert.equal(
+    sha256(actual),
+    expectedCanonicalJsonSha256,
+    "Release blocked: canonical discovery bytes do not match the pinned canonical JSON contract.",
+  );
+  let parsed;
+  try {
+    parsed = JSON.parse(actual.toString("utf8"));
+  } catch (error) {
+    throw new Error(`Release blocked: canonical discovery is not valid JSON (${error.message}).`);
+  }
+  assert.deepEqual(parsed, source,
+    "Release blocked: canonical discovery JSON differs from the pinned source contract.");
+
+  return { sha256: sha256(actual), bytes: actual.length };
+}

scripts/verify-release-readiness.mjs

@@ -2,6 +2,7 @@ import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
 import { readFile } from "node:fs/promises";
 import { resolve } from "node:path";
+import { verifyCanonicalDiscovery } from "./lib/canonical-discovery.mjs";
 
 const packageJson = JSON.parse(await readFile(resolve("package.json"), "utf8"));
 const provenance = JSON.parse(await readFile(resolve("source.provenance.json"), "utf8"));
@@ -18,6 +19,12 @@ assert.equal(provenance.source.license, packageJson.license,
   "Release blocked: package and contract provenance licenses differ.");
 assert.equal(provenance.discovery.status, "verified",
   "Release blocked: canonical Pinhere discovery is not verified.");
+const sourceBytes = await readFile(resolve("pontx-spec.json"));
+await verifyCanonicalDiscovery({
+  url: provenance.discovery.url,
+  sourceBytes,
+  expectedCanonicalJsonSha256: provenance.discovery.canonicalJsonSha256,
+});
 assert(!/(?:^|\s)(?:link|file|workspace):|^\s*overrides\s*:/im.test(`${workspace}\n${lockfile}`),
   "Release blocked: local dependency links or workspace overrides remain.");
 

source.provenance.json

@@ -11,7 +11,8 @@
   },
   "discovery": {
     "url": "https://pinhere.dev/.well-known/pontx.json",
-    "status": "domain-unregistered",
+    "status": "pending-dns-verification",
+    "canonicalJsonSha256": "7a98a17ca28eca19325b0aaa5b02fd54a119c1e36adcf99ea40bf1896c777d3c",
     "verifiedAt": "2026-08-15"
   },
   "output": {
@@ -20,6 +21,6 @@
     "proxyDisabledOperations": 34
   },
   "releaseBlockedBy": [
-    "pinhere.dev is unregistered, so the canonical production API and discovery URL are unreachable"
+    "pinhere.dev is attached to the production deployment but its DNS and canonical discovery bytes are not yet verified"
   ]
 }

test/unit/canonical-discovery.test.ts

@@ -0,0 +1,36 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { resolve } from "node:path";
+import { expect, test } from "vitest";
+import {
+  canonicalJsonBytes,
+  verifyCanonicalDiscovery,
+} from "../../scripts/lib/canonical-discovery.mjs";
+
+const sourceBytes = await readFile(resolve("pontx-spec.json"));
+const canonicalBytes = canonicalJsonBytes(sourceBytes);
+const canonicalHash = createHash("sha256").update(canonicalBytes).digest("hex");
+
+test("verifies a canonical discovery response against the pinned source contract", async () => {
+  await expect(verifyCanonicalDiscovery({
+    url: "https://pinhere.dev/.well-known/pontx.json",
+    sourceBytes,
+    expectedCanonicalJsonSha256: canonicalHash,
+    fetchImpl: async () => new Response(canonicalBytes, {
+      status: 200,
+      headers: { "content-type": "application/json; charset=utf-8" },
+    }),
+  })).resolves.toMatchObject({ sha256: canonicalHash, bytes: canonicalBytes.length });
+});
+
+test("rejects a discovery response with noncanonical bytes", async () => {
+  await expect(verifyCanonicalDiscovery({
+    url: "https://pinhere.dev/.well-known/pontx.json",
+    sourceBytes,
+    expectedCanonicalJsonSha256: canonicalHash,
+    fetchImpl: async () => new Response("{}", {
+      status: 200,
+      headers: { "content-type": "application/json" },
+    }),
+  })).rejects.toThrow("canonical discovery bytes do not match");
+});