Third-runtime challenge: verify the AML witness vector outside JavaScript and Python

[aruintelligence]

Status

OPEN INTEROPERABILITY / WITNESS CHALLENGE

ĀML now ships the same aml-witness-bundle/1 verification contract across:

• browser/WebCrypto;
• Node/WebCrypto tests;
• a dependency-free Python verifier;
• the reference HTTP service.

Golden vector:
https://github.com/aruintelligence/aml-core/blob/main/independent/python/witness-vector.json

Public contracts:

• https://github.com/aruintelligence/aml-core/blob/main/protocol/aml-browser-evidence.schema.json
• https://github.com/aruintelligence/aml-core/blob/main/protocol/aml-verification-challenge.schema.json
• https://github.com/aruintelligence/aml-core/blob/main/protocol/aml-session-attestation.schema.json
• https://github.com/aruintelligence/aml-core/blob/main/protocol/aml-witness-bundle.schema.json
• https://github.com/aruintelligence/aml-core/blob/main/protocol/sorted-json-v1.md

Challenge

Implement verification in a third language/runtime (for example Rust, Go, Java, Swift, C#, Ruby, PHP, Kotlin, or another independent JavaScript implementation) without importing AML verifier internals.

Your verifier should:

1. reproduce the published receipt SHA-256;
2. reproduce the browser-evidence SHA-256;
3. reproduce the public-JWK fingerprint;
4. verify the P-256 ECDSA/SHA-256 signature;
5. reproduce the whole witness-bundle SHA-256;
6. accept the golden vector at 2030-01-01T00:05:00Z;
7. reject a deliberately mutated purpose/decision;
8. report any ambiguity in canonicalization or signature encoding.

Acceptance evidence

Reply with:

• public repository URL;
• language/runtime and version;
• PASS transcript for the golden vector;
• FAIL transcript for a deliberate mutation;
• any mismatch or ambiguity found.

A disagreement is useful specification feedback.

Claim boundary

The in-repo Python verifier is not counted as an external witness. A third-party reproduction would be external evidence of interoperability with this project-defined prototype contract; it would not constitute official certification, standards-body approval, regulatory compliance, or proof that declared AML meaning/scores are truthful.