Proof Fixture Corpus

Every verifier claim in Chio is pinned by a signed scenario that must pass and a set of altered copies that must fail, each with the exact failure code it should produce. The corpus lives under fixtures/proof-room in the source tree.

Layout

Each directory is one scenario family. A family holds a valid fixture, its altered variants, and a negatives/ directory that names what each variant breaks.

fixtures/proof-room/catalog.json (schema chio.proof-room.fixture-root-catalog.v1) indexes the fixtures by id, kind, and path:

{
  "id": "single-call-authority",
  "kind": "proof-room",
  "path": "fixtures/proof-room/first-run/single-call-authority",
  "description": "Stage 0 first-run Proof Room bundle with allow and denial receipts"
}

Trust anchors

The fixtures are signed by checked-in keys that exist only for local verification. scripts/proof-room-quickstart-env.sh exports them as the trust variables the verifiers read; a verifier run without them stops on the first untrusted signer.

$ chio proof doctor --scenario swarm-authority

chio proof doctor swarm-authority
  [passed] swarm_recursive_delegation: transaction passport verified
  [passed] swarm_stale_continuation: transaction passport rejected
  [passed] swarm_budget_allocations_exceed_pool: transaction passport rejected
  [passed] swarm_graph_cycle: transaction passport rejected
  [passed] swarm_join_parent_set_mismatch: transaction passport rejected
  [passed] swarm_replayed_continuation_nonce: transaction passport rejected
  [passed] swarm_revoked_task: transaction passport rejected
  [passed] swarm_stale_route_plan: transaction passport rejected
  [passed] swarm_route_plan_mismatch: transaction passport rejected
  [passed] swarm_witness_child_scope_mismatch: transaction passport rejected
verdict: passed

chio proof doctor verifies the valid passport and confirms that each negative is rejected. The verdict is passed only when every case behaves as its fixture says.

Applications never need the checkout for this. The installed CLI carries the built-in fixtures, and chio proof fixture generate <id> --out DIR writes one with its negatives and a trust.toml that chio proof verify reads; Swarm verification runs that path.

Add a negative case

A negative case names the claim it attacks, the valid fixture it alters, the mutation, and the failure code the verifier must return:

{
  "schema": "chio.swarm-authority.negative-fixture.v1",
  "id": "budget-allocations-exceed-pool",
  "claim_ref": "claim.swarm.budget_pool_bound",
  "base_fixture": "fixtures/proof-room/swarm-authority/valid-recursive-delegation/budget-pool.json",
  "case": "BudgetAllocationsExceedPool",
  "expected_failure_code": "proof-room.negative.swarm-budget-allocations-exceed-pool-total"
}

1. Write the descriptor under the family's negatives/ directory with a claim_ref the verifier already checks.
2. Add the altered fixture directory beside the valid one, re-signed with the fixture keys so that only the intended property is wrong.
3. Register a new failure code in spec/errors/registry.yaml if no existing code describes the failure, and regenerate with cargo xtask gen errors.
4. Run the family's facet with cargo xtask check fixtures <facet> --negative-only, then the doctor scenario above.

The CLI's proof tests assert that the verifier reports each case's expected_failure_code, so a mutation that breaks a different property fails the suite. Run them with cargo test -p chio-cli --test proof_doctor.

Next