verifiable-delivery-packager

Verifiable Delivery Packager

Cryptographic delivery packaging, tamper-evident manifest generation, and verifiable review receipts for AI agent and CI/CD deliverables.

---

1. WHAT IS THIS?

The Verifiable Delivery Packager is a zero-dependency Node.js library for engineering teams, autonomous AI agent pipelines, and automated review platforms. It bundles software deliverables into deterministic, tamper-evident packages backed by canonical JSON manifests and cryptographically signs review decisions via verification receipts.

2. WHO IS IT FOR?

• AI Agent Framework Developers: Requiring strict boundaries, canonical manifests, and cryptographic certainty before committing agent changes.
• Security & Compliance Teams: Enforcing verifiable audit trails for automated code generation.
• CI/CD Pipeline Engineers: Ensuring artifact integrity between build, test, review, and deployment stages.

3. WHAT PROBLEM DOES IT SOLVE?

Autonomous agents produce files dynamically. Traditional tarballs or git commits do not provide deterministic canonicalization, leave vulnerabilities open to permission escalation (executable bits), and lack decoupled cryptographic review receipts that can prove an auditor approved the exact byte-for-byte deliverable without re-running the entire repository history.

4. WHY PAY FOR IT INSTEAD OF BUILDING IT?

• Deterministic Canonical Serialization: Recursively sorts object keys to guarantee identical JSON manifests produce identical SHA-256 digests across platforms.
• Strict Executable Bit Auditing: Verifies that no deliverable file possesses executable permissions (mode & 0o111 === 0), eliminating surprise script execution vectors.
• Path Traversal & Symlink Immunity: Automatically detects and rejects symlinks, absolute paths, null bytes, and traversal sequences (..).
• Decoupled Verification Receipts: Generates cryptographic review approval records (DELIVERY_RECEIPT.json) bound to package digests.
• Zero External Dependencies: Built entirely on Node.js built-in modules (node:crypto, node:fs, node:path).

5. WHAT IS VERIFIED?

• 7 / 7 Automated Unit Tests Passed: Canonical JSON sorting, end-to-end package generation and verification, unauthorized mutation detection, path traversal rejection, rogue extra file detection, executable bit set rejection, and symlink rejection.
• 100% Clean-Room Isolation: Verified passing inside clean temporary directory with zero network access and zero external npm packages.

6. HOW DO I RUN IT?

# 1. Run unit test suite
node --test tests/delivery.test.mjs

# 2. Run interactive delivery & receipt demo
node examples/package-demo.mjs