Client-side key generation

Verifies

Requires an AI engine: Identity, pre-key and session keys of the messaging feature are generated on the device and private material is never uploaded or held by the server.

Inputs

Non-test code files of the checkout (JavaScript, TypeScript, Python, PHP). Messaging files are located by path or content; key-management files by protocol libraries, key-generation calls or private-key vocabulary, classified as device or server code with the runtime criterion below. The key-management files (at most 48, server-side first) are sent together in one assessment call to the chosen engine through the platform ai service; at most 160000 estimated tokens. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed. Every model call (rubric, repository context and files) stays under 120000 characters; a candidate set that does not fit is sent in parts, each part bounded by what the chosen engine serves in one call (the engine publishes that budget; a call is never filled up to the transport cap). Speed pass (1.0.9): each file goes to the model as the EXCERPT of the lines relevant to the requirement (key-generation calls, key material — private, secret, identity, pre-key, session, backup keys — and the protocol library), 12 lines around each of them (the whole file when that is most of it), omitted spans marked; every key-management file has such lines by construction, so none is dropped; at most 48 files, most relevant first; parts are cut by path with content-defined boundaries and a context that lists no files, so an unchanged file lands in an unchanged part the engine may answer from its verdict cache; up to the engine's concurrent-call limit, parts go in parallel and are aggregated in part order.

Decision rule

A file is judged SERVER only with proof of its own runtime or of the import graph: the language (Python, PHP), a `server-only` import or a `'use server'` directive, a location the framework declares as server (route.ts, middleware, pages/api, app/api, *.server.*, +server, wsgi/asgi), a Node built-in or server-only package, an HTTP response sink or a Lambda handler export, importing a module that is itself proven to run on a server, or a server folder by framework convention. It is judged BROWSER when it declares `'use client'` or imports `client-only`, when its code touches the DOM, a Web Worker scope, `new Worker(`, a React client hook or a browser-environment polyfill, when a client-declared file of the checkout imports it, when it sits in a browser folder by convention, or when it only uses a Web API the browser serves (`crypto.subtle`, `globalThis.crypto`, `CryptoKey`, `new Blob`, `atob`) with no server evidence at all. NEITHER is NOT server: the shared layer of a monorepo is never accused on a folder name, and the trace says the layer is unproven. `workers/` is not a server folder (a worker folder is a browser convention as often as a server one). This check judges MESSAGE keys. A key-generation site is not judged — named in the trace, never reported and never sent to the model — when it lives in a build or operations folder (scripts, tools, bin, ops, devops, infra, deploy, provision, ci, build, codegen) or when its file is not a messaging file, names no messaging protocol library and no message-key material (identity key, pre-key, signed pre-key, session, device, conversation, room, sender, chain, root or message key, ratchet, Olm/Megolm, end-to-end) while it does name the signing and service keys of the release (jose, jsonwebtoken, JWT, JWKS, RS256/ES256/PS256/EdDSA/HS256, signing key, access/id/refresh token, OAuth, OIDC, SAML, TLS, SSL, certificate, CSR, X.509, SSH, API key, KMS, database, session or webhook secret). An import, require, use or include line is a reference, never a generation site. Not applicable when the checkout has no messaging feature. FAIL (HIGH) when the messaging feature has no key generation or protocol library at all, when a key-generation call runs in server code (transport, API and database keys excluded), or when private or secret key material is placed in a request, socket message or serialised payload without encryption. The model must establish with confidence of at least 0.8 that keys are generated on the device and only public material is uploaded: an unsatisfied or undecided assessment is a FAIL, a HIGH finding is a FAIL, MEDIUM blocks only inside Extended suites, an unparseable answer is a FAIL. PASS only with a satisfied assessment and nothing blocking. When the candidate set goes in parts, a HIGH finding in any part is a FAIL and the assessment is unsatisfied when any part says so, satisfied only when a part establishes it and none denies it. A messaging feature exists only with a message or conversation model, a chat transport, a messaging protocol library, a chat UI or end-to-end keys in a messaging folder somewhere in the checkout: messaging vocabulary alone is not-applicable with the reason (1.0.2). Without an AI engine the check is not executed (requires an AI engine).

Type

ai-assisted · engine chosen by the organisation · medium

1.0.9: SPEED PASS: each file goes to the model as the EXCERPT around the lines the deterministic part marked relevant to THIS requirement (key-generation calls, private or secret key material, uploads that carry key material, the protocol library), 12 lines on each side (the whole file when that is most of it); the omitted spans are marked in place and a finding on a line that was not sent is dropped. Every key-management file has such lines by construction, so none is dropped. Up to 48 files, most relevant first, instead of 24 whole ones. STABLE PARTS: the files are packed by path with content-defined part boundaries (decided by the path, never by the content) and the repository context lists no files, so an unchanged file lands in a byte-identical part the engine may answer from its verdict cache (per organisation, declared in the trace and in the attestation). The parts are sent in parallel up to what the engine admits (ctx.ai.maxConcurrentCalls) and aggregated in part order, so the verdict never depends on which answer arrives first. The assessment reason is ONE sentence of at most 30 words (the platform GPU spends 46 ms per output token and the reason was most of every answer). Requirement, categories and decision rule unchanged. (1.0.8: the rubric did not say which keys a recognised protocol publishes by design: the public identity, signing and signed one-time keys of Olm/Signal stored by the server were reported as private keys leaving the device, and a backup encrypted on the device with the user recovery phrase as a leak. The rubric now names that public material, accepts a device-encrypted backup under a user-held secret, and a private-key finding must name the line where private material is generated by the server or placed in an upload; a "may/could" finding is speculative and not reported. (1.0.7: WHERE A FILE RUNS is decided from the FILE (and, when the file alone does not say, from the import graph of the checkout), never from a list of folder names of one particular repository, and a file whose server nature is UNPROVEN is never reported as server code. A monorepo has a SHARED layer — a package the browser bundle and the services both import — and the old rule read every ambiguous file as server: WebCrypto of the browser (`crypto.subtle` in a shared e2ee service that a client component imports) came out as "key generation in server code", once per product sharing the layer. The evidence is now, strongest first: the language (Python, PHP); a `server-only`/`client-only` import or a `'use server'`/`'use client'` directive; a location the framework declares as server (route.ts, middleware, pages/api, app/api, *.server.*, +server, wsgi/asgi); a browser runtime in the code (DOM member, Web Worker scope, `new Worker(`, a React client hook, a browser-environment polyfill such as fake-indexeddb or jsdom); a server runtime in the code (Node built-in, server-only package such as express/mongodb/winston/@aws-sdk, HTTP response sink, Lambda handler export); the IMPORT GRAPH (a module a client-declared file imports runs in the browser, a module that imports a server-proven module runs on a server); the folder convention (`workers/` is no longer one of them: a worker folder is a browser convention as often as a server one); a universal Web API of the browser with no server evidence at all; otherwise unproven, which is never server. Found by the attestation campaign of the platform (2026-09-25): 73 of the 252 high findings of every project were this one classification. (1.0.6: `assess` mode cuts the candidate set to what the chosen ENGINE serves in ONE call (`ctx.ai.maxInputChars`, published by the engine per its catalogue budget; `ENGINE_CALL_MAX_CHARS` = 32 000 when an older sandbox does not publish it), instead of filling the call up to the TRANSPORT cap of the proxy (`spec.promptMaxChars`, unchanged at 120 000). On a 1 319-file checkout the old packing produced single prompts of 17 672 / 26 709 / 29 351 tokens and the platform GPU answered "CUDA out of memory": the check ended in `error`. Every call of the same run under ~24 000 characters was answered normally. The part aggregation of 1.0.1 is unchanged: a HIGH in any part is a FAIL, an unsatisfied part is a FAIL, undecided never passes. (1.0.5: false positive of the attestation of platform/apps/auth (2026-09-24), fixed in the script: el check juzga claves de MENSAJERÍA: un sitio de generación no se juzga (motivo en la traza, nunca se manda al modelo) si vive en un script de build u operaciones (scripts/, tools/, bin/, ops/, infra/, deploy/, ci/, build/) o si su fichero no es de mensajería, no nombra librería de protocolo ni material de clave de mensaje y sí nombra las claves de firma y de servicio de la release (jose/JWT/JWKS, RS256/ES256, OAuth, TLS, certificados, API, KMS, base de datos); una línea de import/require/use no es un sitio de generación. (1.0.4: the browser asset folders of the server-rendered frameworks (static/, wwwroot/ and Laravel resources/js/) are classified as browser code, like public/ and assets/ already were: browser JavaScript of a Django, Flask or Go application was being analysed as server code (false positive found by the control bench of the audit scripts). 1.0.3: requires an AI engine (spec.requiresEngine: true): the check needs judgement and is executed only when the organisation provides an engine; the core catalogue runs without one.)))))

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.