Dhanji R. Prasanna f9625f1a2d Add envelope verification token: keyed SipHash-2-4 MAC stamps envelope.yaml ...

- Key management: 32-byte random key at ~/.g3/verification.key (chmod 600)
- Token format: g3v1:<base64(SipHash-2-4 of canonical_facts + NUL + canonical_rulespec)>
- stamp_envelope() called only when all rulespec predicates pass
- verify_token() for cross-process validation
- ActionEnvelope.verified field (Option<String>, skip_serializing_if none)
- Token never shown to LLM, only written to envelope.yaml
- Zero new dependencies (uses std SipHasher, existing rand/base64)
- 12 unit tests covering determinism, tamper detection, backward compat

2026-02-07 17:09:37 +11:00

..

examples

Add Racket tree-sitter support, remove Kotlin

2026-01-13 18:44:59 +05:30

src

Add envelope verification token: keyed SipHash-2-4 MAC stamps envelope.yaml

2026-02-07 17:09:37 +11:00

tests

fix: extract_facts fallback for facts-prefixed selectors in datalog verification

2026-02-07 14:42:39 +11:00

Cargo.toml

refactor: Clean up Cargo dependencies - remove unused, update outdated

2026-02-06 14:22:59 +11:00