Review the supported scope before choosing a fix.

1. Confirmed findinghigh confidencePotential impact · LOW

   01fixtures/generate.mjs derives its output directory from URL.pathname, which is percent-encoded and not a native path on Windows, so generation can target a wrong path.

   Impact scope: Support applies to this finding as stated. Additional consequences require a separate assessment.

   Support assessment & source receipts · 1

   URL.pathname returns a percent-encoded, slash-prefixed string rather than a filesystem path. If this value is used as a directory, checkouts under paths containing spaces or on Windows resolve incorrectly. The correct conversion is fileURLToPath.

   Counterevidence considered: This affects only the fixture generator, not verification. Paths on POSIX without special characters work. Where dir is used is not quoted, but the variable's name and purpose indicate filesystem use.

   A verified receipt authenticates quoted source or records a structural query. It does not independently establish the allegation.

   E2 · fixtures/generate.mjs:8

   const dir = new URL(".", import.meta.url).pathname;

5. Confirmed findinghigh confidencePotential impact · MEDIUM

   05The test suite exercises receipts signed by a throwaway key, not the three published POVV receipts that the claim's check requires.

   Impact scope: Support applies to this finding as stated. Additional consequences require a separate assessment.

   Support assessment & source receipts · 2

   The fixtures README states that fixtures were signed with an ephemeral key that existed only during generation. Passing tests therefore do not demonstrate acceptance of real published receipts under the povv.io key.

   Counterevidence considered: The fixtures do include adversarial cases, such as a stranger key claiming the same kid (E16), which bear on the tampered-copy half of the check. A separate published-receipt test may exist outside this evidence base.

   A verified receipt authenticates quoted source or records a structural query. It does not independently establish the allegation.

   E16 · fixtures/generate.mjs:10

   const trusted = generateKeyPairSync("ed25519");
   const stranger = generateKeyPairSync("ed25519"); // a different key claiming the same kid

   E18 · fixtures/README.md:3

   Signed with a throwaway Ed25519 key that existed only while `generate.mjs` ran.
   Only its public half is here (`test-jwks.json`, `test-key.pem`). `npm test` runs every

Inspect the missing evidence before proposing a patch.

2. Coverage gaplow confidencePotential impact · MEDIUM

   02index.mjs hashPair computes SHA-256 over a concatenation of a and b with no leaf/node domain prefix, so Merkle proofs lack domain separation.

   Inspect before changing code

   • leaf hashing implementation
   • how inclusion results affect ok

   No patch before verification.

   Impact scope: Impact remains unconfirmed until the missing source is inspected.

   Support assessment & source receipts · 1

   Internal nodes are hashed as a plain concatenation with no prefix. That permits leaf/node confusion only if leaves are hashed the same way, without a distinct prefix, and are 64-byte inputs.

   Counterevidence considered: Leaf hashing is not quoted. The README frames Merkle checking as a consistency check against a receipt-supplied root, and inclusion is outside the claim's pass condition.

   A verified receipt authenticates quoted source or records a structural query. It does not independently establish the allegation.

   E9 · index.mjs:53

   return createHash("sha256").update(Buffer.concat([a, b])).digest();

3. Coverage gaplow confidencePotential impact · MEDIUM

   03cli.mjs parseArgs routes unrecognized flags into positional args, so a mistyped --no-fetch leaves key fetching enabled without a usage error.

   Inspect before changing code

   • args.fetch default initialization
   • main() handling of extra positional arguments

   No patch before verification.

   Impact scope: Impact remains unconfirmed until the missing source is inspected.

   Support assessment & source receipts · 2

   E4 shows that every unmatched token is pushed into args._. E5 enables fetching whenever args.fetch is truthy and no local key is given. A typo therefore would not disable fetching.

   Counterevidence considered: The default value of args.fetch is not quoted. main() may also reject extra positional arguments, which would surface the typo.

   A verified receipt authenticates quoted source or records a structural query. It does not independently establish the allegation.

   E4 · cli.mjs

   else if (a === "--no-fetch") args.fetch = false;
       else args._.push(a);

   E5 · cli.mjs:53

   const options = { fetchKey: args.fetch && !args.pubkey && !args["jwks-file"] };

4. Coverage gaplow confidencePotential impact · HIGH

   04The claim's pass gate (exit success only when digest and signature both match) is not established by the audited evidence.

   Inspect before changing code

   • verifyReceipt body
   • cli.mjs exit-code mapping

   No patch before verification.

   Impact scope: Impact remains unconfirmed until the missing source is inspected.

   Support assessment & source receipts · 2

   E11 and E1 show the hash computation and Ed25519 verify call. However, how verifyReceipt combines these results into ok, and how the CLI maps ok to an exit code, is not in the register. Multiple agents report this code as truncated.

   Counterevidence considered: Agents report adversarial fixtures that are expected to be NOT VERIFIED. E13 documents gating on ok. Agent reports are not source evidence, though.

   A verified receipt authenticates quoted source or records a structural query. It does not independently establish the allegation.

   E1 · index.mjs:85

   return edVerify(null, Buffer.from(integrityHashHex, "hex"), publicKey, Buffer.from(signatureB64, "base64"));

   E11 · index.mjs

   export function computeIntegrityHash(sealedPayload) {
     return sha256Hex(canonicalize(sealedPayload));
   }