Every PHI/PII egress receipt (the record a governed LLM call emits, meant to
support SOC 2 and HIPAA audit) carries a real Ed25519 signature that a third
party is explicitly told they can check offline: "Third parties reproduce
this off-box using the published install pubkey -- same guarantee as the
airlock receipts." Following that documented path, a genuinely, correctly
signed receipt is reported unverified every single time.
primitives/egress_receipt.py's verify() calls:
ok = _RS.verify_against_install(canon, sig, expect_install_pubkey_hex)
railcall_signing.verify_against_install() takes exactly two positional
arguments, (integrity_value, sig_block) -- this call passes three. Every
invocation raises TypeError, which verify()'s own except-block silently
catches and records as "signature valid: False" -- so the function can never
return a passing verdict, for any receipt, correctly signed or not.
That is not the only problem with the call: even with the argument count
fixed, canon (the raw canonical JSON bytes of the receipt) is the wrong
value to pass. The actual signing path that produces every real egress
receipt's signature (station_llm.py's _sign_fn) hashes the canonical bytes
into a sha256 hex digest FIRST and signs that digest -- its own docstring
says so explicitly: "hash our canonical bytes first so the resulting
signature verifies via railcall_signing.verify_against_install(digest,
sig_block)". verify() needs to hash-then-verify to match what was actually
signed. The correct two-argument, hash-first recipe already exists twice
elsewhere in the same codebase -- primitives/witness_anchor.py's own
verify() and routes/receipts.py's separate inline reimplementation for the
live /api/receipts/verify endpoint both do it correctly -- egress_receipt.py's
own verify() was simply never brought in line with either.
Reproduction steps:
- Extract a clean station-v0.74 tarball, sys.path.insert(0, "workbench").
- Point railcall_signing at a fresh scratch workspace and call
ensure_keypair() to mint a real install keypair.
- Build an egress receipt with egress_receipt.build(), then sign it with
egress_receipt.finalize() using the REAL production sign_fn
(station_llm.py's _sign_fn -- sha256 the canonical bytes, then
railcall_signing.sign_block(digest)).
- Call egress_receipt.verify(receipt, install_pubkey_hex) on that
genuinely, correctly signed receipt.
Expected: verdict True, every check passing -- this is a receipt this same
install just signed with its own real key moments earlier.
Actual: verdict False. The "signature valid" check fails with
"TypeError: verify_against_install() takes 2 positional arguments but 3
were given" -- caught internally and reported as an ordinary failed check,
not surfaced as the broken function call it actually is.
Root cause: workbench/primitives/egress_receipt.py, verify() -- calls
railcall_signing.verify_against_install() with three positional arguments
against a two-argument function signature, and passes raw canonical bytes
instead of their sha256 hex digest (the value the real signing path
actually signs).
Suggested fix: `digest = hashlib.sha256(canon).hexdigest(); ok =
_RS.verify_against_install(digest, sig)` -- matching the recipe already
correct in primitives/witness_anchor.py's verify() and
routes/receipts.py's inline egress-receipt verification branch.