PiProof v0.17.0 — Offline Verification Gateway & Privacy Phase

PiProof v0.17.0 — Public Offline Verification Gateway & Privacy Phase

The killer-use gap closes: anyone can now verify a document with
cryptographic certainty and zero disclosure — the document never leaves
the verifier's browser.

Highlights

Pure-JS RFC 8032 crypto core (src/web-ed25519.js)

• Ed25519 verification + SHA-512, from scratch, BigInt JavaScript,
  browser-safe, verify-only by construction.
• Every magic constant is derived: SHA-512's H/K tables computed from
  fractional roots of primes; Ed25519's d, base point and √-1 derived
  from 2^255-19 alone.
• Strict decoding: non-canonical S ≥ L rejected; decompression failures
  are hard rejections.
• Exhaustively cross-checked against node:crypto in CI (random keys ×
  sizes, bit-flips of msg/R/S, wrong keys, malleable signatures).

In-browser G1–G9 pipeline (src/offline-verifier.js)

• Same canonical fixed-point rule, same error codes as the Node pipeline —
  run entirely locally against the public registry export.
• Honesty centerpiece: NONCE_REPLAY is gold-labeled UNVERIFIABLE offline,
  never green-washed; epoch binding likewise.

The gateway (/gateway)

• Strict CSP page (default-src 'none'; script-src 'self' — no inline
  script anywhere).
• Accepts paste / file / deep link for signed events, PiProof envelopes and
  Evidence Passports; gate-by-gate verdict table.
• Displays the SHA-256 fingerprint of the exact registry bytes every verdict
  was computed against.

Host hardening

• Global security headers on every response · GET /healthz · public
  GET /registry.json export · whitelist-only /gateway-src/ route
  (traversal-proof).

Normative privacy model — docs/PRIVACY_MODEL.md

Data inventory (who sees what), keyed-pseudonym rotation story (h1: →
h2:), the gateway's five-point honesty contract, and honest limits
(intra-deployment tag stability, mirror registries, ZK out of scope for
frozen PEP/1).

Verification

139/139 tests · layers clean (25 modules / 69 edges) · 20/20 attacks ·
16/16 canonical vectors ×3 languages · FUZZ OK · conformance 4/4 · TLC green
· all 13 CI checks passed on Node 18/20/22 + Python + Go + TLA+.

Full details:
CHANGELOG ·
docs/PRIVACY_MODEL.md