JuliusBrussee/caveman · error

bundle completeness cannot be attested by unsigned export me

Error message

bundle completeness cannot be attested by unsigned export metadata

What it means

A receipt bundle is unsigned export metadata, so it cannot carry a trustworthy completeness claim; completeness is attested by a separately trusted head manifest. A bundle with completeness_attested === true is treated as a forged attestation and rejected outright.

Source

Thrown at packages/cli/src/index.ts:17413

  const raw = Buffer.from(info.key, "base64");
  if (raw.length !== 32 || raw.toString("base64") !== info.key) throw new Error(`${label} must be a canonical base64 Ed25519 public key`);
  return { info, raw, key: ed25519PublicKey(raw) };
}

function decodeUniqueKeyring(infos: ReceiptPublicKey[], label: string): Map<string, DecodedReceiptKey> {
  const keys = new Map<string, DecodedReceiptKey>();
  for (const [index, info] of infos.entries()) {
    const decoded = decodeReceiptKey(info, `${label}[${index}]`);
    if (keys.has(decoded.info.key_id)) throw new Error(`${label} contains duplicate key_id ${decoded.info.key_id}`);
    keys.set(decoded.info.key_id, decoded);
  }
  return keys;
}

function embeddedReceiptKeys(bundle: ReceiptBundle): { current: DecodedReceiptKey; keys: Map<string, DecodedReceiptKey> } {
  if (bundle.schema !== RECEIPT_BUNDLE_V1 && bundle.schema !== RECEIPT_BUNDLE_V2) throw new Error(`unsupported bundle schema ${String(bundle.schema)}`);
  if (bundle.verification_coverage !== undefined && bundle.verification_coverage !== INCLUDED_RECEIPTS_ONLY) throw new Error(`unsupported unsigned verification coverage ${String(bundle.verification_coverage)}`);
  if (bundle.completeness_attested === true) throw new Error("bundle completeness cannot be attested by unsigned export metadata");
  const current = decodeReceiptKey(bundle.public_key, "public_key");
  if (bundle.public_keys !== undefined && !Array.isArray(bundle.public_keys)) throw new Error("public_keys must be an array");
  if (bundle.schema === RECEIPT_BUNDLE_V2 && (!Array.isArray(bundle.public_keys) || bundle.public_keys.length === 0)) throw new Error("v2 bundle requires public_keys");
  const keys = decodeUniqueKeyring(bundle.public_keys ?? [], "public_keys");
  const currentInRing = keys.get(current.info.key_id);
  if (currentInRing && !currentInRing.raw.equals(current.raw)) throw new Error(`public_key conflicts with public_keys entry ${current.info.key_id}`);
  if (bundle.schema === RECEIPT_BUNDLE_V2 && !currentInRing) throw new Error("v2 public_keys must include public_key");
  if (!currentInRing) keys.set(current.info.key_id, current);
  return { current, keys };
}

async function pinnedReceiptKeys(file: string, current: DecodedReceiptKey): Promise<{ keys: Map<string, DecodedReceiptKey>; trust: string }> {
  const source = (await readFile(file, "utf8")).trim();
  if (!source.startsWith("{")) {
    const pinned = decodeReceiptKey({ ...current.info, key: source }, "--pubkey");
    if (!pinned.raw.equals(current.raw)) throw new Error("bundle public key does not match the published --pubkey");
    return { keys: new Map([[current.info.key_id, pinned]]), trust: "pinned_public_key" };
  }

View on GitHub (pinned to 5184b3d11a)

Solutions

1. Remove completeness_attested (or set it to false) in the exported bundle
2. Rely on the separately trusted head manifest for completeness statements, as the design intends
3. Fix the producer so it never writes this flag into unsigned export metadata

Example fix

// before
{ "completeness_attested": true, ... }

// after
{ "completeness_attested": false, ... }

if (bundle.completeness_attested === true) {
  throw new Error("refusing bundle: unsigned export metadata claims completeness");
}

function makesNoCompletenessClaim(b: { completeness_attested?: unknown }): boolean {
  return b.completeness_attested !== true;
}

try { execSync(`caveman receipts verify ${bundle}`); }
catch (e) {
  if (/completeness cannot be attested/.test(String((e as Error).message))) {
    fail("strip completeness_attested; use the trusted head manifest instead");
  }
  throw e;
}

When it happens

Trigger: Any bundle JSON with "completeness_attested": true reaching embeddedReceiptKeys, typically a hand-edited bundle or a producer bug that copied the field from the signed head manifest into the export.

Common situations: Downstream tooling tries to mark bundles as complete for audit purposes; producer refactors move signed-manifest fields into the unsigned export; test fixtures reuse signed-manifest JSON.

Related errors

• caveman agent: file source escapes project root
• cave_provider_raw_path_not_allowed
• ${label} key_id is required
• ${label} key is required
• ${label} contains duplicate key_id ${decoded.info.key_id}

AI-assisted analysis of JuliusBrussee/caveman@5184b3d11a (2026-08-18). Data as JSON: /api/errors/433b018d6181f6ad. Report an issue: GitHub.