chio-proof-room 0.1.2

Focused Proof Room quickstart server
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83

# chio-proof-room

`chio-proof-room` is the standalone HTTP server and CLI behind the Chio
Docker quickstart: it verifies a Proof Room bundle (or a bare
transaction-passport fixture) by recomputing verifier reports from source
artifacts, then serves the verified dashboard, bundle assets, and fixture
catalog. Its verification and fixture machinery is `pub(crate)`; the public
surface is a handful of standalone-verification functions plus the axum
router/server constructors.

## Responsibilities

- Verify a Proof Room bundle manifest (`chio.proof-room.bundle.v1`) against
  `spec/schemas/chio-proof-room/v1/`: DSSE signature, claim-to-artifact
  binding, receipt-coverage matrix, and negative-case replay.
- Recompute the transaction passport's verifier report from source artifacts,
  routing evidence-graph subsets to the domain verifier crate(s) a policy's
  `required_claims` demand, rather than trusting the bundle's claimed report.
- Serve the verified bundle, a static dashboard UI, and a fixture catalog
  over HTTP, restricted to an allow-list computed from the manifest.
- Accept uploaded bundles at `/proof-room/upload/verify` and report the
  verification verdict.
- Ship the `chio-proof-room` binary used by the Docker quickstart image.

## Public API

Bundle verification (crate root):

- `verify_proof_room_bundle(manifest_path: &Path) -> Result<(), ProofRoomError>`
- `verify_proof_room_quickstart(bundle: &Path, doctor_report: Option<&Path>) -> Result<(), ProofRoomError>`
- `build_proof_room_source_verifier_report(bundle_root: &Path, transaction_passport_path: &Path) -> Result<serde_json::Value, String>`
- `validate_proof_room_bundle_relative_path(relative_path: &str) -> Result<(), String>`
- `ProofRoomError` - `Validation`, `Io`, `Json`, `ListenAddress`, `Serve`.

Serving (`server`, re-exported at the crate root):

- `serve_proof_room(config: ProofRoomServeConfig) -> Result<(), ProofRoomError>` - verify, then bind and serve.
- `proof_room_router`, `proof_room_router_with_fixture_root`, `proof_room_router_with_optional_ui_root` - construct the axum `Router` directly.
- `build_proof_room_fixture_catalog_json(_with_fixture_root)`, `proof_room_fixture_asset_response`, `proof_room_served_bundle_paths`, `resolve_proof_room_served_asset_path`, `proof_room_content_type`, `is_proof_room_bundle_namespace`, `parse_listen_addr`.

BBS crypto-context recomputation (`crypto_context`):

- `crypto_context_verified_report_bytes_with_bbs`, `crypto_context_rejected_report_bytes_with_bbs`.

Binary `chio-proof-room` (`src/main.rs`):

```
chio-proof-room --bundle <dir> --ui-dir <dir> [--fixture-root <dir>] [--listen <addr>] [--doctor-report <path>] [--verify-only]
```

## Usage

```bash
cargo run -p chio-proof-room -- \
  --bundle fixtures/proof-room/first-run/single-call-authority/proof-room-bundle \
  --verify-only \
  --doctor-report /tmp/chio-proof-room-doctor.json
```

## Testing

Unit tests live in `src/tests/` (`catalog`, `core`, `source`, `support`); the
integration test in `tests/cli.rs` spawns the built `chio-proof-room` binary
against the checked-in fixture bundle.

```bash
cargo test -p chio-proof-room
```

## See also

- `chio-transaction-passport` - root passport, evidence-graph, and
  runtime-security verification this crate recomputes reports from.
- `chio-swarm-authority` - `verify_swarm_authority_bundle`, called on this
  crate's public proof-verification path.
- `chio-runtime-proof-parity` - both validators
  (`validate_runtime_proof_parity_report`,
  `validate_runtime_proof_regeneration_artifacts`) are called here against a
  runtime evidence graph.
- `chio-cli` - the full Chio CLI; has a broader `proof` command surface built
  on the same dashboard.
- `chio-http-serve` - server hygiene (connection caps, graceful drain)
  wrapped around this crate's axum router.