feat: zipped packages, target set, checklists, audit fixes and a stress test

Features for the next six months (accessible HTML export, paperpack and
Lode on packages, the personal bundle):

- Zipped packages: the oracle writes and reads `.sct.zip` archives under
  the rules of spec/12 §12.2; validate.py and load.py accept them; a
  byte-identical zip of the tiny package joins the fixtures, and two
  broken archives (traversal, symbolic link) join fixtures/invalid.
- The target set of targeted F3 (spec/08 §8.10) is computed by the
  oracle and pinned by vectors/targets.jsonl under each digit rule; the
  rule now covers cells as well as sentences and the leaves of anchored
  containers, and defines a node's section.
- scienting-checklist/1 (provisional): a conformance check of an export,
  covered by a receipt as ["checklist", id, hash] (spec/08 §8.11), with a
  WCAG 2.1 AA fixture and its receipt.
- QA reports are signed like receipts (spec/08 §8.9).
- A `description` annotation body with role alt or long, so an
  accessible export can find a confirmed figure description; the layer
  fixture carries one, and the store's body-kind constraint allows it.
- scienting-spot-check/1, the seed payload, is registered with a schema.
- exercise, submission and grade are provisional until a course has
  used them.

Audit fixes, each with a vector or a broken package where one was
missing:

- Folder packages: symbolic links are refused on validate and load,
  manifest paths must not collide under case folding, listed files are
  matched by exact name, files are hashed in chunks under a size limit.
- Files are compared byte for byte, so CR LF, a byte order mark, NaN,
  a lone surrogate or invalid UTF-8 is refused instead of translated;
  integers beyond 2^53 are read as doubles, as canonical JSON writes them.
- Receipts: signature.key must equal by and the key must be valid when
  signed; a qa receipt's nodes must be the sample at the original's
  hashes, its scope must name qa.of, its errors must be sampled nodes;
  statuses are computed once, iteratively, so chains of spot-checks
  hundreds deep settle; Base64 and manifest shape errors become refusals
  instead of tracebacks; counts and the fidelity of roster-less packages
  are recomputed.
- The gate enforces rule 11 of spec/11 §11.4: changed nodes are
  validated against the node schema and the references between nodes
  are checked, so a set to a bad value, an insert with unknown
  properties or a delete of a referenced header cell is refused; a
  relabel to null drops the label; a reclassify drops foreign
  attributes; a split strips whitespace across runs; ids.jsonl order
  follows spec/04 §4.4 in every state; a move after itself is refused.
- Anchors: the relabel rule requires that nothing else changed below the
  node; an alias chain ending in a deletion no longer crashes resolve.
- Notation: a script after an empty group applies to the previous atom
  ({}^{14}C); letters are defined by Unicode block in spec/05 §5.4 and
  the oracle; \left) is complex.
- Page fingerprints delete whitespace before folding, so "10 -20" and
  "10-20" fold alike (spec/07 §7.1).
- Grades are summed with exact decimals; the reviewer error bound is
  computed with integer arithmetic.
- receipts and revocations are keyed by (doc_key, id) in SQL, since one
  revocation may be carried by several packages.

Checking:

- tools/stress.py: seeded randomized property tests over canonical JSON,
  normalization, notation, random correction walks, anchor resolution,
  Merkle roots, spot-check samples, error bounds, fingerprints, mutated
  archives and packages, rights and spot-check chains; CI runs it.
- check.py verifies every count and version the prose states against
  the repository, the zipped fixture and crafted archives, the checklist
  coverage, and nine more broken packages.
- CONTRIBUTING.md gains a release checklist.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

tools/oracle/receipts.py

@@ -4,15 +4,17 @@ Non-normative; see spec/08-fidelity.md.
 """
 
 import base64
+import binascii
 import hashlib
 import math
 from fractions import Fraction
+from math import comb
 
 from . import crypto, jcs
 from .model import LEVELS
 from .text import record_id, sha256_hex
 
-SIGNED_FORMATS = ("scienting-receipt/1", "scienting-revocation/1", "scienting-policy/1")
+SIGNED_FORMATS = ("scienting-receipt/1", "scienting-revocation/1", "scienting-policy/1", "scienting-qa-report/1")
 
 
 def record_hash(rec):
@@ -37,13 +39,29 @@ def seal(rec, secret, key_id):
     return rec
 
 
+def _b64(s):
+    """Strict Base64 decoding; None for anything that is not Base64."""
+    try:
+        return base64.b64decode(s, validate=True)
+    except (binascii.Error, ValueError, TypeError):
+        return None
+
+
 def verify_signature(rec, roster):
+    """Whether the record's Ed25519 signature verifies under the roster key it names. Never raises."""
     sig = rec.get("signature") or {}
+    if not isinstance(sig, dict):
+        return False
     key = roster.get(sig.get("key"))
-    if not key or sig.get("scheme") != "ed25519" or key["scheme"] != "ed25519":
+    if not key or sig.get("scheme") != "ed25519" or key.get("scheme") != "ed25519":
+        return False
+    pub, value = _b64(key.get("public", "")), _b64(sig.get("value", ""))
+    if pub is None or value is None or len(pub) != 32 or len(value) != 64:
+        return False
+    try:
+        return crypto.ed25519_verify(pub, signing_payload(rec), value)
+    except (ValueError, TypeError):
         return False
-    pub = base64.b64decode(key["public"])
-    return crypto.ed25519_verify(pub, signing_payload(rec), base64.b64decode(sig["value"]))
 
 
 def key_valid_at(key, at):
@@ -103,10 +121,31 @@ def upper_bound(k, n, confidence="0.95"):
 
 
 def bound_string(k, n, confidence="0.95"):
-    """The bound as the spec reports it: six decimal places, rounded up."""
-    x = upper_bound(k, n, confidence)
-    v = math.ceil(x * 10**6 - 1e-9)
-    return "%d.%06d" % (v // 10**6, v % 10**6)
+    """The bound as the spec reports it: six decimal places, rounded up, computed exactly.
+
+    The reported value is the least multiple of 10^-6 at which the probability of at most k errors in n is
+    at most 1 - c, found by bisection with integer arithmetic, so no floating point enters the result.
+    """
+    if n <= 0:
+        raise ValueError("n must be positive")
+    if k >= n:
+        return "1.000000"
+    alpha = 1 - Fraction(confidence)
+    scale = 10**6
+
+    def tail_at_most(m):
+        # P[X <= k] at p = m / scale, compared with alpha, both scaled by scale**n and alpha's denominator.
+        total = sum(comb(n, i) * m**i * (scale - m)**(n - i) for i in range(k + 1))
+        return total * alpha.denominator <= alpha.numerator * scale**n
+
+    lo, hi = 0, scale  # the tail at 0 is 1 (above alpha); at 1 it is 0 (k < n)
+    while hi - lo > 1:
+        mid = (lo + hi) // 2
+        if tail_at_most(mid):
+            hi = mid
+        else:
+            lo = mid
+    return "%d.%06d" % (hi // scale, hi % scale)
 
 
 # --- levels -------------------------------------------------------------------
@@ -141,26 +180,57 @@ def valid_revocations(revocations, receipts_by_id, roster):
     return out
 
 
-def receipt_status(rec, records, roster):
-    """`valid`, `revoked`, `suspended`, or `invalid` for one receipt."""
-    receipts = [x for x in records if x["format"] == "scienting-receipt/1"]
-    revs = [x for x in records if x["format"] == "scienting-revocation/1"]
+def _base_status(rec, roster, valid_revs):
+    """`invalid`, `revoked` or `valid` for one receipt, before spot-checks are considered (spec/08 §8.6)."""
+    try:
+        if rec.get("root") != crypto.merkle_root(crypto.receipt_items(rec)):
+            return "invalid"
+        if rec["id"] != record_id(record_hash(rec)) or not verify_signature(rec, roster):
+            return "invalid"
+        key = roster.get(rec["by"])
+        if not key or not key_valid_at(key, rec["at"]) or rec["signature"]["key"] != rec["by"]:
+            return "invalid"
+    except (KeyError, TypeError, ValueError):
+        return "invalid"
+    return "revoked" if revoked(rec, valid_revs) else "valid"
+
+
+def statuses(records, roster):
+    """The status of every receipt in `records` (spec/08 §8.6), computed once.
+
+    A receipt is suspended when a valid spot-check of it found an error, and a spot-check's own validity may
+    depend on its own spot-check, so statuses are settled from the end of each chain of spot-checks; a chain
+    that loops back on itself settles nothing, and its receipts are invalid.
+    """
+    receipts = [x for x in records if x.get("format") == "scienting-receipt/1"]
+    revs = [x for x in records if x.get("format") == "scienting-revocation/1"]
     by_id = {x["id"]: x for x in receipts}
-    if rec.get("root") != crypto.merkle_root(crypto.receipt_items(rec)):
-        return "invalid"
-    if rec["id"] != record_id(record_hash(rec)) or not verify_signature(rec, roster):
-        return "invalid"
-    key = roster.get(rec["by"])
-    if not key or not key_valid_at(key, rec["at"]) or rec["signature"]["key"] != rec["by"]:
-        return "invalid"
-    if revoked(rec, valid_revocations(revs, by_id, roster)):
-        return "revoked"
+    valid_revs = valid_revocations(revs, by_id, roster)
+    base = {rec["id"]: _base_status(rec, roster, valid_revs) for rec in receipts}
+    checkers = {}
     for q in receipts:
         qa = q.get("qa")
-        if qa and qa.get("of") == rec["id"] and qa.get("errors"):
-            if receipt_status(q, records, roster) == "valid":
-                return "suspended"
-    return "valid"
+        if isinstance(qa, dict) and qa.get("errors") and base.get(q["id"]) == "valid" and qa.get("of") in by_id:
+            checkers.setdefault(qa["of"], []).append(q["id"])
+    final = {rid: s for rid, s in base.items() if s != "valid" or rid not in checkers}
+    pending = set(base) - set(final)
+    progress = True
+    while pending and progress:
+        progress = False
+        for rid in sorted(pending):
+            qs = checkers[rid]
+            if all(q in final for q in qs):
+                final[rid] = "suspended" if any(final[q] == "valid" for q in qs) else "valid"
+                pending.discard(rid)
+                progress = True
+    for rid in pending:
+        final[rid] = "invalid"
+    return final
+
+
+def receipt_status(rec, records, roster):
+    """`valid`, `revoked`, `suspended`, or `invalid` for one receipt among `records`."""
+    return statuses(records, roster).get(rec.get("id"), "invalid")
 
 
 def effective_levels(nodes, values, records, roster):
@@ -169,10 +239,11 @@ def effective_levels(nodes, values, records, roster):
     A spot-check's `qa:` receipt does not raise the nodes it found in error (spec/08 §8.2).
     """
     level = {n["id"]: n.get("fidelity") for n in nodes if "fidelity" in n}
+    status = statuses(records, roster)
     for rec in records:
         if rec["format"] != "scienting-receipt/1":
             continue
-        if receipt_status(rec, records, roster) != "valid":
+        if status.get(rec["id"]) != "valid":
             continue
         wrong = {e["node"] for e in (rec.get("qa") or {}).get("errors", [])}
         for nid, h in rec.get("nodes", []):