Update sovereign_core.py

sovereign_core.py

@@ -135,6 +135,7 @@ def verify_attestation(att: dict) -> bool:
 # ---------------------------------------------------------------------
 
 
+
 def build_lineage_record(
     engine: str,
     fingerprint: str,
@@ -142,25 +143,20 @@ def build_lineage_record(
     model_version: str = "1.0",
     data_tags: Optional[List[str]] = None,
     notes: Optional[str] = None,
-    provider: Optional[str] = None,  # OpenAI / Anthropic / DeepMind / Llama / Mistral / other
-    model_family: Optional[str] = None,  # narrow / frontier / embedding / classifier
+    provider: Optional[str] = None,
+    model_family: Optional[str] = None,
 ) -> Dict[str, Any]:
     """
-    Create a minimal, cryptographically-bound lineage record for a model.
-    This ties:
-      - engine
-      - fingerprint
-      - version
-      - provider (multi-model support)
-      - optional parent model
-      - optional dataset / domain tags
-    into a single signed lineage_id.
+    Create a cryptographically-bound lineage record for a model.
+
+    Hash formula (ثابت و قابل بازتولید):
+      payload = f"{engine}|{fingerprint}|{model_version}|{parent_model or ''}|{created_at}"
     """
+
     created_at = int(time.time())
-    payload = (
-        f"{engine}|{fingerprint}|{model_version}|{parent_model or ''}|"
-        f"{provider or ''}|{model_family or ''}|{created_at}"
-    )
+
+    core_parent = parent_model or ""
+    payload = f"{engine}|{fingerprint}|{model_version}|{core_parent}|{created_at}"
     lineage_hash = hashlib.sha256(payload.encode()).hexdigest()
 
     return {
@@ -178,6 +174,9 @@ def build_lineage_record(
     }
 
 
+
+
+
 # ---------------------------------------------------------------------
 # Simple risk profile (env + data tags)
 # ---------------------------------------------------------------------
@@ -598,37 +597,55 @@ def log_model_execution(
 
 def verify_certificate(cert: dict) -> bool:
     """
-    Validates the integrity certificate by checking:
-    - attestation validity
-    - lineage hash correctness
-    - non-empty fingerprint
+    Verification wrapper so that app.py can import it.
+
+    A valid certificate requires:
+      - attestation to verify successfully
+      - fingerprint / engine to be consistent across cert + lineage + attestation
+      - lineage_hash to match a recomputed hash from core fields
     """
     try:
-        # 1) Verify attestation is trustworthy
-        att = cert.get("attestation", {})
+        # 1) Attestation must be valid
+        att = cert.get("attestation") or {}
         if not verify_attestation(att):
             return False
 
-        # 2) Verify lineage hash reconstruction
-        lineage = cert.get("lineage", {})
-        payload = (
-            f"{lineage.get('engine','')}"
-            f"{lineage.get('fingerprint','')}"
-            f"{lineage.get('model_version','')}"
-            f"{lineage.get('parent_model','')}"
-            f"{lineage.get('created_at','')}"
-        )
+        # 2) Basic consistency checks
+        cert_fp = cert.get("fingerprint")
+        cert_engine = cert.get("engine")
 
-        expected_hash = hashlib.sha256(payload.encode()).hexdigest()
-        if lineage.get("lineage_hash") != expected_hash:
+        lineage = cert.get("lineage") or {}
+        line_fp = lineage.get("fingerprint")
+        line_engine = lineage.get("engine")
+
+        if not cert_fp:
+            return False
+
+        # fingerprint باید همه‌جا یکی باشد
+        if cert_fp != att.get("fingerprint"):
+            return False
+        if cert_fp != line_fp:
+            return False
+
+        # engine اگر در هر دو جا هست باید یکی باشد
+        if cert_engine and line_engine and cert_engine != line_engine:
             return False
 
-        # 3) Basic fingerprint check
-        if not cert.get("fingerprint"):
+        # 3) Recompute lineage_hash exactly like build_lineage_record
+        engine_val = line_engine or ""
+        fp_val = line_fp or ""
+        model_ver = (lineage.get("model_version") or "")
+        parent_val = (lineage.get("parent_model") or "")
+        created_val = lineage.get("created_at") or ""
+
+        payload = f"{engine_val}|{fp_val}|{model_ver}|{parent_val}|{created_val}"
+        expected_hash = hashlib.sha256(payload.encode()).hexdigest()
+
+        if lineage.get("lineage_hash") != expected_hash:
             return False
 
+        # اگر به اینجا برسیم، همه چیز ok است
         return True
 
     except Exception:
         return False
-