Project Brain Work Auth Canary

This is candidate-only and grants no Brain authority.

Continue authenticated canary

${JSON.stringify({\n    schema: WORK_AUTH_SCHEMA,\n    challenge_sha256: challengeHash,\n    expires_at_ms: expiresAt,\n    authority: \"CANDIDATE_NONAUTHORITY\",\n    p_real_increment: 0,\n  }, null, 2)}

`;\n return new Response(body, {\n status: 200,\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n}\n\nasync function attestWorkAuth(req: Request) {\n await ensureWorkAuthTable();\n const u = new URL(req.url);\n const challenge = u.searchParams.get(\"challenge\") ?? \"\";\n if (!/^[A-Za-z0-9_-]{40,128}$/.test(challenge)) {\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: \"REJECT_MALFORMED_CHALLENGE\",\n production_admission: false,\n p_real_increment: 0,\n }, 400);\n }\n\n let auth: any;\n try {\n auth = await verifyChatGPTWorkRequest(req);\n } catch (e) {\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: \"REJECT_WEB_BOT_AUTH\",\n reason: e instanceof Error ? e.message : String(e),\n production_admission: false,\n p_real_increment: 0,\n }, 401);\n }\n\n if (!auth.challengeCryptographicallyBound) {\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: \"REJECT_CHALLENGE_NOT_CRYPTOGRAPHICALLY_BOUND\",\n signed_components: auth.componentNames,\n host_origin_authenticated: true,\n host_path_authenticated: auth.pathCryptographicallyBound,\n production_admission: false,\n p_real_increment: 0,\n }, 401);\n }\n\n const challengeHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`,\n );\n const now = Date.now();\n\n let update: any;\n try {\n update = await sqlite.execute({\n sql: `UPDATE pb_work_webbot_auth_canary_v2\n SET consumed_at_ms=?,signature_hash=?,keyid=?\n WHERE challenge_hash=?\n AND consumed_at_ms IS NULL\n AND issued_at_ms<=?\n AND expires_at_ms>=?\n RETURNING issued_at_ms,expires_at_ms,consumed_at_ms`,\n args: [\n now,\n auth.signatureHash,\n auth.verified.keyid,\n challengeHash,\n now,\n now,\n ],\n });\n } catch (e) {\n const msg = e instanceof Error ? e.message : String(e);\n const replay = /UNIQUE|signature_hash/i.test(msg);\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification: replay ? \"REJECT_SIGNATURE_REPLAY\" : \"REJECT_CANARY_STATE_ERROR\",\n production_admission: false,\n p_real_increment: 0,\n }, replay ? 409 : 500);\n }\n\n if ((update?.rows ?? []).length !== 1) {\n const q: any = await sqlite.execute({\n sql: `SELECT issued_at_ms,expires_at_ms,consumed_at_ms\n FROM pb_work_webbot_auth_canary_v2 WHERE challenge_hash=?`,\n args: [challengeHash],\n });\n const row = q?.rows?.[0] ?? null;\n const classification = !row\n ? \"REJECT_UNKNOWN_CHALLENGE\"\n : row.consumed_at_ms != null\n ? \"REJECT_CHALLENGE_REPLAY\"\n : Number(row.expires_at_ms) < now\n ? \"REJECT_EXPIRED_CHALLENGE\"\n : Number(row.issued_at_ms) > now\n ? \"REJECT_FUTURE_CHALLENGE\"\n : \"REJECT_CHALLENGE_STATE_AMBIGUOUS\";\n return jsonResponse({\n schema: WORK_AUTH_SCHEMA,\n ok: false,\n classification,\n production_admission: false,\n p_real_increment: 0,\n }, 409);\n }\n\n const receipt = {\n schema: WORK_AUTH_SCHEMA,\n ok: true,\n classification: \"AUTHENTICATED_CHATGPT_WORK_CHALLENGE_BOUND_INGRESS_CANDIDATE\",\n project: PROJECT,\n observed_at_ms: now,\n challenge_sha256: challengeHash,\n signature_sha256: auth.signatureHash,\n signature_agent: OPENAI_SIGNATURE_AGENT,\n keyid: auth.verified.keyid,\n algorithm: auth.verified.algorithm,\n signed_created: auth.verified.created?.toISOString?.() ?? null,\n signed_expires: auth.verified.expires?.toISOString?.() ?? null,\n signed_components: auth.componentNames,\n host_origin_authenticated: true,\n host_path_authenticated: auth.pathCryptographicallyBound,\n one_time_challenge_consumed: true,\n challenge_cryptographically_bound_in_http_signature: auth.challengeCryptographicallyBound,\n raw_signature_persisted: false,\n raw_challenge_persisted: false,\n execution_provenance_scope: \"CHATGPT_WORK_BROWSER_ORIGIN_LIVENESS_ONLY\",\n distinct_physical_chatgpt_execution_proven: false,\n independent_review_eligible: false,\n production_admission: false,\n authority_promotion: false,\n p_real_increment: 0,\n human_authority_approval: false,\n direct_sprites_calls: 0,\n };\n\n await sqlite.execute({\n sql: `UPDATE pb_work_webbot_auth_canary_v2\n SET receipt_json=? WHERE challenge_hash=? AND signature_hash=?`,\n args: [JSON.stringify(receipt), challengeHash, auth.signatureHash],\n });\n\n return jsonResponse(receipt, 200);\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer({\n name: \"ew-session-attestation-probe\",\n version: \"1.0.0-candidate\",\n });\n\n server.registerTool(\"issue-session-attestation-challenge\", {\n description:\n \"Candidate-only: issue a fresh one-time challenge for testing ChatGPT session metadata. Does not grant authority.\",\n inputSchema: z.object({}),\n annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },\n }, async () => {\n await ensureTable();\n const raw = new Uint8Array(32);\n crypto.getRandomValues(raw);\n const challenge = b64url(raw);\n const challengeHash = await sha256(`${SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`);\n const issued = Date.now();\n const expires = issued + CHALLENGE_TTL_MS;\n await sqlite.execute({\n sql: `INSERT INTO ew_session_attestation_probe_v1\n (challenge_hash,issued_at_ms,expires_at_ms,classification)\n VALUES(?,?,?,?)`,\n args: [challengeHash, issued, expires, \"ISSUED_CANDIDATE_NONAUTHORITY\"],\n });\n return result({\n schema: SCHEMA,\n project: PROJECT,\n challenge,\n challenge_sha256: challengeHash,\n issued_at_ms: issued,\n expires_at_ms: expires,\n one_time: true,\n authority: \"CANDIDATE_NONAUTHORITY\",\n physical_execution_provenance: false,\n });\n });\n\n server.registerTool(\"attest-current-chatgpt-session\", {\n description:\n \"Candidate-only: consume a fresh challenge and hash host-provided openai/session + openai/subject request metadata server-side. Raw metadata is never returned. Metadata observation alone is NOT authenticated ChatGPT-host proof.\",\n inputSchema: z.object({\n challenge: z.string().min(40).max(128).regex(/^[A-Za-z0-9_-]+$/),\n }),\n annotations: { readOnlyHint: false, destructiveHint: false, openWorldHint: false },\n }, async ({ challenge }, extra: any) => {\n await ensureTable();\n const meta = extra?.mcpReq?._meta ?? extra?._meta ?? null;\n const session = safeMetaString(meta?.[\"openai/session\"]);\n const subject = safeMetaString(meta?.[\"openai/subject\"]);\n const organization = safeMetaString(meta?.[\"openai/organization\"]);\n\n if (!session || !subject) {\n return result({\n schema: SCHEMA,\n ok: false,\n classification: \"REJECT_MISSING_OR_MALFORMED_REQUIRED_HOST_METADATA\",\n observed_openai_session: !!session,\n observed_openai_subject: !!subject,\n raw_metadata_returned: false,\n physical_execution_provenance: false,\n promotion_safe: false,\n }, true);\n }\n\n const challengeHash = await sha256(`${SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`);\n const now = Date.now();\n const sessionHash = await sha256(`${SCHEMA}\\0session\\0${PROJECT}\\0${session}`);\n const subjectHash = await sha256(`${SCHEMA}\\0subject\\0${PROJECT}\\0${subject}`);\n const organizationHash = organization\n ? await sha256(`${SCHEMA}\\0organization\\0${PROJECT}\\0${organization}`)\n : null;\n\n const receipt = {\n schema: SCHEMA,\n project: PROJECT,\n challenge_sha256: challengeHash,\n session_sha256: sessionHash,\n subject_sha256: subjectHash,\n organization_sha256: organizationHash,\n observed_from_request_meta: true,\n raw_metadata_returned: false,\n host_path_authenticated: false,\n generic_mcp_client_can_supply_meta: true,\n classification: \"HOST_METADATA_OBSERVED_NOT_AUTHENTICATED_HOST_PROOF\",\n physical_execution_provenance: false,\n promotion_safe: false,\n note:\n \"Different session hashes can be useful experimental evidence only after the caller path is independently proven to be ChatGPT-host-controlled and non-spoofable. This candidate does not make that claim.\",\n };\n const receiptJson = JSON.stringify(receipt);\n\n const u: any = await sqlite.execute({\n sql: `UPDATE ew_session_attestation_probe_v1\n SET consumed_at_ms=?,session_hash=?,subject_hash=?,organization_hash=?,\n classification=?,receipt_json=?\n WHERE challenge_hash=?\n AND consumed_at_ms IS NULL\n AND issued_at_ms<=?\n AND expires_at_ms>=?\n RETURNING issued_at_ms,expires_at_ms,consumed_at_ms`,\n args: [\n now, sessionHash, subjectHash, organizationHash,\n receipt.classification, receiptJson, challengeHash, now, now,\n ],\n });\n\n if ((u.rows ?? []).length !== 1) {\n const q: any = await sqlite.execute({\n sql: `SELECT issued_at_ms,expires_at_ms,consumed_at_ms\n FROM ew_session_attestation_probe_v1 WHERE challenge_hash=?`,\n args: [challengeHash],\n });\n const row = q.rows?.[0] ?? null;\n const classification = !row\n ? \"REJECT_UNKNOWN_CHALLENGE\"\n : row.consumed_at_ms != null\n ? \"REJECT_REPLAY_ALREADY_CONSUMED\"\n : Number(row.expires_at_ms) < now\n ? \"REJECT_EXPIRED_CHALLENGE\"\n : Number(row.issued_at_ms) > now\n ? \"REJECT_FUTURE_CHALLENGE\"\n : \"REJECT_CHALLENGE_STATE_AMBIGUOUS\";\n return result({\n schema: SCHEMA,\n ok: false,\n classification,\n challenge_sha256: challengeHash,\n raw_metadata_returned: false,\n physical_execution_provenance: false,\n promotion_safe: false,\n }, true);\n }\n\n return result({ ok: true, ...receipt });\n });\n\n return server;\n});\n\nexport default async function fetch(req: Request) {\n const u = new URL(req.url);\n if (req.method === \"GET\" && u.pathname === \"/work-auth-canary/v1/challenge\") {\n return await issueWorkAuthChallenge(req);\n }\n if (req.method === \"GET\" && u.pathname === \"/work-auth-canary/v1/attest\") {\n return await attestWorkAuth(req);\n }\n return await handler.fetch(req);\n}\n",[],[183],"2cfa3191-a500-4b35-96f6-7b26a8ae0d7a","webbot_api_probe.ts","5b5f56e2-abbd-11f1-b85c-1607ee4eb77e",["D",1788897870631],11,"import { sqlite as rootSqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nconst ctx=new AsyncLocalStorage();\nconst db:any={execute:(...a:any[])=>{const tx=ctx.getStore();return (tx??rootSqlite).execute(...a)}};\nasync function tx(fn:()=>Promise):Promise{const t:any=await (rootSqlite as any).transaction(\"write\");try{const out=await ctx.run(t,fn);await t.commit();return out}catch(e){try{await t.rollback()}catch{}throw e}}\nconst enc=new TextEncoder();\nconst hex=(b:ArrayBuffer)=>[...new Uint8Array(b)].map(x=>x.toString(16).padStart(2,\"0\")).join(\"\");\nconst H=async(s:string)=>hex(await crypto.subtle.digest(\"SHA-256\",enc.encode(s)));\nconst canon=(x:any):string=>x===null||typeof x!==\"object\"?JSON.stringify(x):Array.isArray(x)?\"[\"+x.map(canon).join(\",\")+\"]\":\"{\"+Object.keys(x).sort().map(k=>JSON.stringify(k)+\":\"+canon(x[k])).join(\",\")+\"}\";\nconst P=\"tmp_extimp_v1_\";\nawait rootSqlite.execute(`DROP TABLE IF EXISTS ${P}imports`);\nawait rootSqlite.execute(`DROP TABLE IF EXISTS ${P}artifacts`);\nawait rootSqlite.execute(`DROP TABLE IF EXISTS ${P}events`);\nawait rootSqlite.execute(`DROP TABLE IF EXISTS ${P}meta`);\nawait rootSqlite.execute(`CREATE TABLE ${P}imports(\n nonce TEXT PRIMARY KEY, binding_hash TEXT NOT NULL UNIQUE, lease_id TEXT NOT NULL, task_id TEXT NOT NULL,\n result_key TEXT NOT NULL, capsule_sha256 TEXT NOT NULL, result_sha256 TEXT NOT NULL,\n validator_sha256 TEXT NOT NULL, receipt_json TEXT NOT NULL, committed_generation INTEGER NOT NULL\n)`);\nawait rootSqlite.execute(`CREATE TABLE ${P}artifacts(sha256 TEXT PRIMARY KEY, logical_key TEXT NOT NULL UNIQUE)`);\nawait rootSqlite.execute(`CREATE TABLE ${P}events(seq INTEGER PRIMARY KEY AUTOINCREMENT,type TEXT NOT NULL,payload_json TEXT NOT NULL)`);\nawait rootSqlite.execute(`CREATE TABLE ${P}meta(id INTEGER PRIMARY KEY CHECK(id=1),generation INTEGER NOT NULL,event_count INTEGER NOT NULL)`);\nawait rootSqlite.execute(`INSERT INTO ${P}meta(id,generation,event_count) VALUES(1,0,0)`);\n\nconst VALIDATOR_SHA=\"1556a970220a146fdf7e1fba74e75f4af600b3545131d8993011d4fd778150b1\";\ntype C={nonce:string,lease_id:string,task_id:string,result_key:string,capsule_sha256:string,result_sha256:string,validator_sha256:string,validation_ok:boolean};\nfunction shape(c:C){return !!c&&/^[a-zA-Z0-9._:-]+$/.test(c.nonce)&&c.nonce.length<=256&&!!c.lease_id&&!!c.task_id&&!!c.result_key&&/^[0-9a-f]{64}$/.test(c.capsule_sha256)&&/^[0-9a-f]{64}$/.test(c.result_sha256)&&c.validator_sha256===VALIDATOR_SHA&&c.validation_ok===true}\nasync function atomicImport(c:C,injectFailureAt:string|null=null){\n if(!shape(c))return{ok:false,reason:\"PREVALIDATION_OR_SHAPE_REJECT\"};\n const binding={nonce:c.nonce,lease_id:c.lease_id,task_id:c.task_id,result_key:c.result_key,capsule_sha256:c.capsule_sha256,result_sha256:c.result_sha256,validator_sha256:c.validator_sha256};\n const bh=await H(canon(binding));\n return await tx(async()=>{\n const ex:any=(await db.execute({sql:`SELECT * FROM ${P}imports WHERE nonce=?`,args:[c.nonce]})).rows?.[0];\n if(ex){\n if(String(ex.binding_hash)!==bh)return{ok:false,reason:\"NONCE_BINDING_CONFLICT\"};\n return{...JSON.parse(String(ex.receipt_json)),semantic_replay:true};\n }\n const other:any=(await db.execute({sql:`SELECT nonce FROM ${P}imports WHERE binding_hash=?`,args:[bh]})).rows?.[0];\n if(other)return{ok:false,reason:\"BINDING_ALREADY_IMPORTED_UNDER_DIFFERENT_NONCE\"};\n await db.execute({sql:`INSERT INTO ${P}artifacts(sha256,logical_key) VALUES(?,?) ON CONFLICT(sha256) DO NOTHING`,args:[c.result_sha256,c.result_key]});\n const ar:any=(await db.execute({sql:`SELECT sha256,logical_key FROM ${P}artifacts WHERE sha256=?`,args:[c.result_sha256]})).rows?.[0];\n if(!ar||String(ar.logical_key)!==c.result_key)throw new Error(\"ARTIFACT_BINDING_CONFLICT\");\n if(injectFailureAt===\"after_artifact\")throw new Error(\"INJECTED_AFTER_ARTIFACT\");\n const ev:any=await db.execute({sql:`INSERT INTO ${P}events(type,payload_json) VALUES('EXTERNAL_WORKER_RESULT_IMPORTED',?) RETURNING seq`,args:[canon(binding)]});\n if(injectFailureAt===\"after_event\")throw new Error(\"INJECTED_AFTER_EVENT\");\n const m:any=await db.execute(`UPDATE ${P}meta SET generation=generation+1,event_count=event_count+1 WHERE id=1 RETURNING generation,event_count`);\n const generation=Number(m.rows[0].generation),event_id=Number(ev.rows[0].seq);\n const receipt={ok:true,semantic_replay:false,nonce:c.nonce,binding_hash:bh,generation,event_id,result_sha256:c.result_sha256};\n await db.execute({sql:`INSERT INTO ${P}imports(nonce,binding_hash,lease_id,task_id,result_key,capsule_sha256,result_sha256,validator_sha256,receipt_json,committed_generation) VALUES(?,?,?,?,?,?,?,?,?,?)`,args:[c.nonce,bh,c.lease_id,c.task_id,c.result_key,c.capsule_sha256,c.result_sha256,c.validator_sha256,canon(receipt),generation]});\n if(injectFailureAt===\"after_receipt\")throw new Error(\"INJECTED_AFTER_RECEIPT\");\n return receipt;\n });\n}\nasync function counts(){const [m,i,a,e]:any=await Promise.all([rootSqlite.execute(`SELECT * FROM ${P}meta`),rootSqlite.execute(`SELECT count(*) n FROM ${P}imports`),rootSqlite.execute(`SELECT count(*) n FROM ${P}artifacts`),rootSqlite.execute(`SELECT count(*) n FROM ${P}events`)]);return{generation:Number(m.rows[0].generation),event_count:Number(m.rows[0].event_count),imports:Number(i.rows[0].n),artifacts:Number(a.rows[0].n),events:Number(e.rows[0].n)}}\nconst A:C={nonce:\"nonce-A\",lease_id:\"lease-1\",task_id:\"task-1\",result_key:\"results/r1\",capsule_sha256:\"a\".repeat(64),result_sha256:\"b\".repeat(64),validator_sha256:VALIDATOR_SHA,validation_ok:true};\nconst before=await counts();\nconst concurrent=await Promise.all([atomicImport(A),atomicImport(A)]);\nconst afterConcurrent=await counts();\nconst replay=await atomicImport(A); const afterReplay=await counts();\nconst conflict=await atomicImport({...A,result_sha256:\"c\".repeat(64)});\nconst differentNonceSameBinding=await atomicImport({...A,nonce:\"nonce-B\"});\nconst invalid=await atomicImport({...A,nonce:\"nonce-invalid\",validation_ok:false});\nconst beforeCrash=await counts();\nlet crash1=\"\";try{await atomicImport({...A,nonce:\"nonce-C\",lease_id:\"lease-C\",task_id:\"task-C\",result_key:\"results/c\",result_sha256:\"d\".repeat(64)},\"after_event\")}catch(e){crash1=String((e as Error).message)}\nconst afterCrash=await counts();\nconst crashRecovery=await atomicImport({...A,nonce:\"nonce-C\",lease_id:\"lease-C\",task_id:\"task-C\",result_key:\"results/c\",result_sha256:\"d\".repeat(64)});\nconst afterRecovery=await counts();\nlet crash2=\"\";try{await atomicImport({...A,nonce:\"nonce-D\",lease_id:\"lease-D\",task_id:\"task-D\",result_key:\"results/d\",result_sha256:\"e\".repeat(64)},\"after_receipt\")}catch(e){crash2=String((e as Error).message)}\nconst afterCrash2=await counts();\nconst recover2=await atomicImport({...A,nonce:\"nonce-D\",lease_id:\"lease-D\",task_id:\"task-D\",result_key:\"results/d\",result_sha256:\"e\".repeat(64)});\nconst final=await counts();\nconst tests=[\n [\"concurrent_exact_one_semantic_commit\",afterConcurrent.generation-before.generation===1&&afterConcurrent.events-before.events===1&&concurrent.filter((x:any)=>x.ok).length===2&&concurrent.filter((x:any)=>x.semantic_replay===false).length===1&&concurrent.filter((x:any)=>x.semantic_replay===true).length===1],\n [\"exact_replay_no_generation\",replay.ok===true&&replay.semantic_replay===true&&afterReplay.generation===afterConcurrent.generation],\n [\"nonce_conflict_reject\",conflict.ok===false&&conflict.reason===\"NONCE_BINDING_CONFLICT\"],\n [\"same_binding_other_nonce_reject\",differentNonceSameBinding.ok===false&&differentNonceSameBinding.reason===\"BINDING_ALREADY_IMPORTED_UNDER_DIFFERENT_NONCE\"],\n [\"invalid_prevalidation_no_import\",invalid.ok===false],\n [\"rollback_after_event\",crash1===\"INJECTED_AFTER_EVENT\"&&JSON.stringify(afterCrash)===JSON.stringify(beforeCrash)],\n [\"retry_after_rollback_commits_once\",crashRecovery.ok===true&&crashRecovery.semantic_replay===false&&afterRecovery.generation===beforeCrash.generation+1],\n [\"rollback_after_receipt\",crash2===\"INJECTED_AFTER_RECEIPT\"&&JSON.stringify(afterCrash2)===JSON.stringify(afterRecovery)],\n [\"retry_after_receipt_rollback_commits_once\",recover2.ok===true&&recover2.semantic_replay===false&&final.generation===afterRecovery.generation+1],\n [\"meta_event_consistency\",final.generation===final.event_count&&final.event_count===final.events&&final.imports===final.events]\n].map(([name,pass])=>({name,pass}));\nconsole.log(JSON.stringify({schema:\"EXTERNAL_WORKER_ATOMIC_IMPORT_REFERENCE_V1\",total:tests.length,passed:tests.filter(x=>x.pass).length,failed:tests.filter(x=>!x.pass).map(x=>x.name),tests,observations:{concurrent,replay,conflict,differentNonceSameBinding,invalid,beforeCrash,afterCrash,crashRecovery,afterRecovery,afterCrash2,recover2,final},properties:{semantic_nonce_key:true,binding_hash_unique:true,write_transaction:true,event_and_generation_atomic:true,exact_replay_returns_original_receipt:true,conflict_fails_closed:true,unknown_outcome_recoverable_by_exact_replay:true},canonical_brain_mutation:false,p_real_increment:0,human_authority_approval:false,direct_sprites_calls:0},null,2));",[],[193],"00f43aa6-0e88-4f60-a8a8-6d4fb4c2a354","main.ts",12,["D",1788896819634],5,"import {\n createMcpHandler,\n McpServer,\n} from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { verify as verifyWebBot } from \"npm:web-bot-auth@0.2.0\";\nimport { verifierFromJWK } from \"npm:web-bot-auth@0.2.0/crypto\";\n\nconst PROJECT = \"mosadek/project-brain-live-v1-durable\";\nconst SCHEMA = \"EW_CHATGPT_SESSION_ATTESTATION_PROBE_V1\";\nconst CHALLENGE_TTL_MS = 120_000;\nconst META_MAX = 1024;\nconst enc = new TextEncoder();\n\nasync function sha256(s: string) {\n const d = await crypto.subtle.digest(\"SHA-256\", enc.encode(s));\n return [...new Uint8Array(d)].map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nfunction b64url(bytes: Uint8Array) {\n let s = \"\";\n for (const b of bytes) s += String.fromCharCode(b);\n return btoa(s).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/g, \"\");\n}\n\nfunction safeMetaString(v: unknown): string | null {\n if (typeof v !== \"string\" || v.length < 1 || v.length > META_MAX) return null;\n if (/[\\u0000-\\u001f\\u007f]/.test(v)) return null;\n return v;\n}\n\nasync function ensureTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ew_session_attestation_probe_v1(\n challenge_hash TEXT PRIMARY KEY,\n issued_at_ms INTEGER NOT NULL,\n expires_at_ms INTEGER NOT NULL,\n consumed_at_ms INTEGER,\n session_hash TEXT,\n subject_hash TEXT,\n organization_hash TEXT,\n classification TEXT,\n receipt_json TEXT\n )`);\n}\n\nfunction result(obj: unknown, isError = false) {\n return {\n isError,\n content: [{ type: \"text\" as const, text: JSON.stringify(obj) }],\n };\n}\n\n\nconst WORK_AUTH_SCHEMA = \"PROJECT_BRAIN_CHATGPT_WORK_WEBBOT_AUTH_CANARY_V1\";\nconst OPENAI_SIGNATURE_AGENT = \"https://chatgpt.com\";\nconst OPENAI_SIGNATURE_DIRECTORY =\n \"https://chatgpt.com/.well-known/http-message-signatures-directory\";\nconst WORK_CHALLENGE_TTL_MS = 120_000;\n\nfunction jsonResponse(obj: unknown, status = 200, headers: Record = {}) {\n return new Response(JSON.stringify(obj, null, 2), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\", ...headers },\n });\n}\n\nasync function ensureWorkAuthTable() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS pb_work_webbot_auth_canary_v1(\n challenge_hash TEXT PRIMARY KEY,\n issued_at_ms INTEGER NOT NULL,\n expires_at_ms INTEGER NOT NULL,\n consumed_at_ms INTEGER,\n signature_hash TEXT UNIQUE,\n keyid TEXT,\n receipt_json TEXT\n )`);\n}\n\nasync function resolveOpenAIVerifier(profile: any) {\n if (\n profile?.signatureAgent?.uri !== OPENAI_SIGNATURE_AGENT ||\n profile?.signatureAgent?.type !== \"directory\" ||\n profile?.algorithm !== \"ed25519\"\n ) {\n throw new Error(\"REJECT_SIGNATURE_AGENT_PROFILE\");\n }\n\n const r = await fetch(OPENAI_SIGNATURE_DIRECTORY, {\n headers: { accept: \"application/http-message-signatures-directory+json\" },\n signal: AbortSignal.timeout(10_000),\n });\n if (!r.ok) throw new Error(\"REJECT_OPENAI_KEY_DIRECTORY_UNAVAILABLE\");\n\n const directory: any = await r.json();\n if (\n directory?.signature_agent !== OPENAI_SIGNATURE_AGENT ||\n directory?.purpose !== \"ai\" ||\n !Array.isArray(directory?.keys)\n ) {\n throw new Error(\"REJECT_OPENAI_KEY_DIRECTORY_SCHEMA\");\n }\n\n const nowSec = Math.floor(Date.now() / 1000);\n for (const key of directory.keys) {\n if (\n key?.kty !== \"OKP\" ||\n key?.crv !== \"Ed25519\" ||\n key?.use !== \"sig\" ||\n (typeof key?.nbf === \"number\" && key.nbf > nowSec) ||\n (typeof key?.exp === \"number\" && key.exp < nowSec)\n ) continue;\n\n const verifier = await verifierFromJWK(key);\n if (verifier.keyid === profile.keyid) return verifier;\n }\n throw new Error(\"REJECT_OPENAI_KEYID_NOT_CURRENT\");\n}\n\nasync function verifyChatGPTWorkRequest(req: Request) {\n const signature = req.headers.get(\"signature\");\n const signatureInput = req.headers.get(\"signature-input\");\n const signatureAgent = req.headers.get(\"signature-agent\");\n if (!signature || !signatureInput || !signatureAgent) {\n throw new Error(\"REJECT_MISSING_WEB_BOT_AUTH_HEADERS\");\n }\n\n const signatureHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0signature\\0${signature}\\0${signatureInput}\\0${signatureAgent}`,\n );\n\n const verified: any = await verifyWebBot(req, {\n maxAge: 180,\n clockSkew: 30,\n resolver: resolveOpenAIVerifier,\n validate: async (v: any) => {\n const names = new Set((v?.components ?? []).map((x: any) => x?.name));\n return (\n v?.signatureAgent?.uri === OPENAI_SIGNATURE_AGENT &&\n v?.signatureAgent?.type === \"directory\" &&\n v?.algorithm === \"ed25519\" &&\n names.has(\"@authority\") &&\n names.has(\"signature-agent\")\n );\n },\n });\n\n const componentNames = (verified?.components ?? []).map((x: any) => x?.name);\n return {\n verified,\n signatureHash,\n componentNames,\n challengeCryptographicallyBound:\n componentNames.includes(\"@query\") ||\n componentNames.includes(\"@query-param\") ||\n componentNames.includes(\"@path\") ||\n componentNames.includes(\"@request-target\") ||\n componentNames.includes(\"@target-uri\"),\n };\n}\n\nasync function issueWorkAuthChallenge(req: Request) {\n await ensureWorkAuthTable();\n const raw = new Uint8Array(32);\n crypto.getRandomValues(raw);\n const challenge = b64url(raw);\n const challengeHash = await sha256(\n `${WORK_AUTH_SCHEMA}\\0challenge\\0${PROJECT}\\0${challenge}`,\n );\n const issuedAt = Date.now();\n const expiresAt = issuedAt + WORK_CHALLENGE_TTL_MS;\n await sqlite.execute({\n sql: `INSERT INTO pb_work_webbot_auth_canary_v1\n (challenge_hash,issued_at_ms,expires_at_ms)\n VALUES(?,?,?)`,\n args: [challengeHash, issuedAt, expiresAt],\n });\n\n const attest = new URL(\"/work-auth-canary/v1/attest\", req.url);\n attest.searchParams.set(\"challenge\", challenge);\n const body = `\n Project Brain Work Auth Canary\n

Project Brain Work Auth Canary

This is candidate-only and grants no Brain authority.

Continue authenticated canary

${JSON.stringify({\n    schema: WORK_AUTH_SCHEMA,\n    challenge_sha256: challengeHash,\n    expires_at_ms: expiresAt,\n    authority: \"CANDIDATE_NONAUTHORITY\",\n    p_real_increment: 0,\n  }, null, 2)}

History · README.md