RECEIPT VERIFIER — INDEPENDENT CROSS-REVIEW
2026-11-02
Scope: read-only review of concepts/labs-2026/refined/pages/reports/receipt-verifier.json, its cited local draft, README, verifier source, sample generator and fixtures, plus the primary references noted below. The only written output of this review is this file.

Verdict: a targeted independent synthetic check confirms that the exported inclusionRoot function rejects valid bottom-up Merkle inclusion paths at some positions in the tested eight-leaf tree. Do not claim every input is affected, that invalid proofs are accepted, a security failure rate, or that this constitutes a broad conformance/security assessment. This targeted artifact check and manual source audit are distinct from the proposed, unrun broader validation and event-observation experiments.

Independent test: Node v22.22.3; eight synthetic input strings "leaf-0" through "leaf-7" (UTF-8). Independently built binary-tree layers: leaf = SHA-256(0x00 || UTF8(input)); parent = SHA-256(0x01 || left || right). The proof for index i is the sibling hash at each layer from the leaf toward the root. This is consistent with RFC 6962 section 2.1.1's recursive PATH ordering and RFC 9162 section 2.1.3's bottom-up explanation. The test imports only the subject function; it does not use the sample generator or the subject function to build the expected tree or proof.

Expected root: ca6b7b3e674ac86c1027b59c87c064fc3bc27b313294c75f83bd05fdd13f0dcf
index 0: actual ca6b7b3e674ac86c1027b59c87c064fc3bc27b313294c75f83bd05fdd13f0dcf — match
index 1: actual b558b42262a4a7e1348457b362fc35ae1dc4ea6ebd44b1437186c4a872d5e834 — mismatch
index 2: actual ca6b7b3e674ac86c1027b59c87c064fc3bc27b313294c75f83bd05fdd13f0dcf — match
index 3: actual f706ace92c0eb88227123ee0e17a4a2a6e1e3ea7f1d158bc8c8da1c9c7f1799a — mismatch
index 4: actual 691379df6a0bc07f3647187ab91671264f07cddcceaef0f74046f646b806a6aa — mismatch
index 5: actual ca6b7b3e674ac86c1027b59c87c064fc3bc27b313294c75f83bd05fdd13f0dcf — match
index 6: actual a2986899571e080933b25d48ea30a3a2d4c32b2315b3910d1ded2539baf3cd85 — mismatch
index 7: actual ca6b7b3e674ac86c1027b59c87c064fc3bc27b313294c75f83bd05fdd13f0dcf — match

Reproduction, run from repository root; no source or sample files are modified:
node --input-type=module <<'JS'
import {createHash} from 'node:crypto';
import {inclusionRoot} from './concepts/labs-2026/refined/materials/verify/verify.mjs';
const hash=(...parts)=>createHash('sha256').update(Buffer.concat(parts)).digest();
const layers=[Array.from({length:8},(_,i)=>hash(Buffer.from([0]),Buffer.from(`leaf-${i}`)))];
while(layers.at(-1).length>1){const x=layers.at(-1),next=[]; for(let j=0;j<x.length;j+=2)next.push(hash(Buffer.from([1]),x[j],x[j+1])); layers.push(next)}
const expected=layers[3][0]; console.log('node',process.version,'expected',expected.toString('hex'));
for(let i=0;i<8;i++){const proof=layers.slice(0,3).map((layer,depth)=>layer[(i>>depth)^1]);const actual=inclusionRoot(layers[0][i],i,8,proof);console.log(i,actual.toString('hex'),actual.equals(expected));}
JS

The subject code starts with the outer subtree direction while consuming proof siblings from the bottom. For indexes whose top-to-bottom direction sequence differs from bottom-to-top, this test demonstrates the result can differ. Index 5, used by the checked-in sample, has a symmetric direction sequence; passing that fixture cannot establish general correctness. The tested paths are valid for this tree; this check does not exhaust other sizes, malformed input, acceptance of invalid paths or attacker models.

Additional local fixture checks on Node v22.22.3, read-only:
- receipt.json with trust.json and sth.json: exit 0, signature and inclusion PASS, VERIFIED, attestation root pending.
- receipt.json without trust: exit 3, UNVERIFIED.
- tampered.json with trust and head: exit 1, signature and inclusion FAIL.
- forged-root.json with trust and head: exit 1, signature FAIL while inclusion against signed head PASS. The fixture changes the signed body without resigning; it does not prove every forged-root construction is rejected.

Page cross-audit:
- The narrow trust-store, signed-head, field comparison, skipped attestation and no-runtime-observation boundaries match the source and README. The reference code calculates the body hash only for display and verifies canonical body bytes; the draft also contains a conflicting statement that body_hash is what the signature covers. Recommend the page explicitly acknowledge this discrepancy when describing draft canonicalization; do not suggest a resolved specification.
- The page correctly treats an inclusion proof as distinct from append-only consistency and monitoring; RFC 9162 is an experimental certificate-transparency protocol, not evidence that this verifier implements CT or that a log is deployed. RFC 8785 is an informational canonicalization specification; the local function says it implements a subset. RFC 9334 is an informational attestation architecture; it does not validate the prototype. W3C Verifiable Credentials Data Model v2.0 is a 2025 Recommendation; its verification-versus-truth distinction is analogous, not a receipt-specific result.
- Source and section references resolve within JSON; all seven source IDs have inline citations. The fixture-specific page claims could be better supported by citing the fixture files or this review, rather than only code and README, because the README does not itself report the forged-root result.
- The current page says independent vectors are proposed/not run. Update it to disclose this limited eight-leaf synthetic check and reserve "not run" for the broader validation matrix and synthetic observation study. Its specific code-reading explanation is supported and can be strengthened to the limited observed result above. Avoid making a population or real-run claim from it.
- Clarity caveat: result labels reflect program outcomes for supported, well-formed inputs, not exhaustive safe handling of arbitrary malformed JSON: some malformed inputs can throw outside the structured verdict flow. A generic statement that every malformed input yields FAIL or UNVERIFIED would overstate the implementation.

Primary sources checked: https://www.rfc-editor.org/rfc/rfc6962.html#section-2.1.1 ; https://www.rfc-editor.org/rfc/rfc9162.html#section-2.1.3 ; https://www.rfc-editor.org/rfc/rfc8785.html ; https://www.rfc-editor.org/rfc/rfc9334.html ; https://www.w3.org/TR/vc-data-model-2.0/ . No broader experiment, code change, UI build or deployment was performed.