Provared 0.6.0

Version 0.6.0, a draft. Published as it is, by one author in their own time.

A new kind of record: the denial. The agent's own side states, signed with the agent's keys, that an action it was asked for was not taken, and who said no: the check before acting, the person, or a rule of the software around the agent. A checker shows it as that side's own word and never counts it against the agent. The stub writer writes one only where it is opened with denials: true, and at most denialsPerHour in any hour (format description, section 28).

Seals held elsewhere. A checker may be handed, beside a book, up to 64 seals that someone other than the recorder kept (seals, and --seal on the command line). A seal that counts shows a book cut short after it (book-cut-short), or a book that no longer holds it (seal-not-in-book). A seal held elsewhere can show a problem with a book, never excuse one (section 21.5).

Witnesses for seals. A witness keeps the latest seal it has signed for and signs a statement for a new seal only where a consistency proof (RFC 9162, section 2.1.4) shows that the new seal extends it, so a recorder cannot show one history to one reader and another to the next. A seal may give its book's number (book), so that all books of one recorder, person and agent are one sequence. A statement counts only from a witness the person named (witnesses, --witness), for a book that begins with a permission from a passkey the person named, sealed by a recorder the person named (sections 21.6 and 29).

A central sealer. openSealer: a sealer that one organisation runs for several recorders, which receives only the fingerprints of their lines and signs each seal with its own keys (section 21.7).

The fingerprint of a tool call's arguments is now named provared.arguments by default, where it was arguments. The fingerprint itself is the same, and every checker of 0.5.0 or later knows the name.

Stricter checks. A checker of 0.6.0 refuses some time-stamps and keys that 0.5.0 accepted: a time-stamp that is not strict DER, or that names its signing certificate twice in the same form, or that is signed with Ed25519 under a method other than SHA-512 or with parameters; an ES256 key that is not a point on its curve; an Ed25519 signature whose number S is not below the order L. A passkey and a time-stamp service that follow their standards produce none of these. A new shared test file, ed25519-signatures.json, gives the answer the format's rules give for each of twelve Ed25519 cases.

A checker of 0.5.0 or earlier refuses a book that holds a denial, a seal that gives book, or a seal that holds witnesses. A book made with any of these needs a checker of 0.6.0. Every book made by 0.5.0 or earlier reads as it did, apart from the stricter checks above.

The framework packages, on the Python Package Index: provared-langchain 0.2.0 and pydantic-ai-provared 0.2.0, each requiring provared 0.6.0. Their only change is the name of the arguments' fingerprint, which comes from the library; their READMEs say so.

In the repository, not in the npm package or on the Python Package Index: the gateway (gateway/), which writes the receipts for agents whose own software cannot be wrapped; the central sealer as a program (sealer/); the recorder beside Claude Code with its witness service (integrations/claude-code/); provared-agno and provared-hermes.

Every published version stays on npm and the Python Package Index.

Attached: provared-check.html, the checking page as one file, which opens from the disk and makes no request. SHA-256: ae48c425616d70849aa8d43b1d71ef7ee56736da3ba6a00eaa4375c428e60a25.

The full list of changes is in CHANGELOG.md. Evidence, not a verdict.