feat(evidence): verify capture packages offline

CHANGELOG.md

@@ -73,6 +73,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Security
 
+- Provenance source URLs now reject case-insensitive and percent-encoded credential query-field names, including recursively encoded nested query-like values, and percent-encoded controls before query-bearing URLs can be retained or serialized into WARC target metadata.
 - Explicit proxy server identifiers require ASCII decimal port tokens before numeric range parsing, preventing Rust-specific leading-plus spellings from widening proxy authority.
 - Raw page content cannot become a trusted instruction.
 - Raw secrets are rejected and secret-capable actions require an opaque broker handle.

crates/originweave-evidence/src/capture_manifest.rs

@@ -11,7 +11,7 @@ use sha2::{Digest, Sha256};
 
 use crate::{
     ExtractionCardinality, ExtractionNormalizationRule, ExtractionSchema, ExtractionSourceChannel,
-    ExtractionValueType, MAX_EXTRACTION_IDENTIFIER_BYTES, WarcProvBundle,
+    ExtractionValueType, MAX_EXTRACTION_IDENTIFIER_BYTES, WarcPayloadCompleteness, WarcProvBundle,
     WarcProvBundleVerificationError, WarcResourceRecord,
 };
 
@@ -45,6 +45,8 @@ pub enum CaptureManifestError {
     UnknownValueField,
     /// A structured value referenced a WARC record absent from the manifest.
     ValueSourceRecordMissing,
+    /// A structured value referenced a WARC record whose retained payload was truncated.
+    ValueSourceRecordTruncated,
     /// A structured value used WARC evidence for a field that did not admit network-response evidence.
     ValueSourceChannelMismatch,
     /// The same field, value digest, and source WARC record were supplied more than once.
@@ -83,6 +85,8 @@ impl fmt::Display for CaptureManifestError {
                 .write_str("capture manifest structured-value field is absent from the schema"),
             Self::ValueSourceRecordMissing => formatter
                 .write_str("capture manifest structured value references an absent WARC record"),
+            Self::ValueSourceRecordTruncated => formatter
+                .write_str("capture manifest structured value references a truncated WARC record"),
             Self::ValueSourceChannelMismatch => formatter.write_str(
                 "capture manifest structured value is not admitted by the field source channels",
             ),
@@ -112,6 +116,7 @@ impl std::error::Error for CaptureManifestError {
             | Self::InvalidValueDigest
             | Self::UnknownValueField
             | Self::ValueSourceRecordMissing
+            | Self::ValueSourceRecordTruncated
             | Self::ValueSourceChannelMismatch
             | Self::DuplicateValue
             | Self::ValueCardinalityExceeded
@@ -301,11 +306,11 @@ impl CaptureManifest {
     /// Construct a schema-conforming manifest with WARC-backed structured-value identities.
     ///
     /// Every value must name a declared schema field that admits network-response evidence and an
-    /// exact WARC record present in this manifest. Required fields must be present; `One` and
-    /// `ZeroOrOne` fields admit at most one value. Duplicate bindings and over-limit collections
-    /// fail closed. Values are canonicalized independently of caller order. No raw extracted value
-    /// is retained and no browser, network, persistence, secret, model, or authorization operation
-    /// is performed.
+    /// exact complete WARC record present in this manifest. Required fields must be present; `One`
+    /// and `ZeroOrOne` fields admit at most one value. Duplicate bindings, truncated source records,
+    /// and over-limit collections fail closed. Values are canonicalized independently of caller
+    /// order. No raw extracted value is retained and no browser, network, persistence, secret,
+    /// model, or authorization operation is performed.
     pub fn new_with_warc_values(
         schema: &ExtractionSchema,
         records: &[(&WarcResourceRecord, &WarcProvBundle)],
@@ -322,12 +327,14 @@ impl CaptureManifest {
             let Some(field) = schema.field(value.field_name()) else {
                 return Err(CaptureManifestError::UnknownValueField);
             };
-            if !manifest
-                .records
+            let Some((source_record, _)) = records
                 .iter()
-                .any(|record| record.warc_record_id() == value.source_warc_record_id())
-            {
+                .find(|(record, _)| record.record_id() == value.source_warc_record_id())
+            else {
                 return Err(CaptureManifestError::ValueSourceRecordMissing);
+            };
+            if source_record.completeness() != WarcPayloadCompleteness::Complete {
+                return Err(CaptureManifestError::ValueSourceRecordTruncated);
             }
             if !field
                 .source_channels()

crates/originweave-evidence/src/lib.rs

@@ -9,6 +9,7 @@
 
 mod capture_manifest;
 mod extraction_schema;
+mod offline_replay;
 mod sensitive_access;
 mod sensitive_handle_lifecycle;
 mod warc_prov_bundle;
@@ -24,6 +25,9 @@ pub use extraction_schema::{
     ExtractionSchemaError, ExtractionSourceChannel, ExtractionValueType,
     MAX_EXTRACTION_FIELD_COUNT, MAX_EXTRACTION_IDENTIFIER_BYTES,
 };
+pub use offline_replay::{
+    OfflineReplayVerification, OfflineReplayVerificationError, verify_offline_capture_package,
+};
 pub use sensitive_access::{
     MAX_SENSITIVE_FIELD_COUNT, MAX_SENSITIVE_IDENTIFIER_BYTES, SensitiveAccessClass,
     SensitiveAccessEvidence, SensitiveAccessEvidenceInput, SensitiveAccessOutcome,
@@ -306,7 +310,7 @@ fn redact_all_values(values: BTreeMap<String, String>) -> BTreeMap<String, Strin
 }
 
 /// A provenance pointer from an extracted assertion to its exact evidence.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Clone, PartialEq, Eq)]
 pub struct ProvenanceRecord {
     source_url: String,
     source_locator: String,
@@ -315,6 +319,18 @@ pub struct ProvenanceRecord {
     verification_result: VerificationResult,
 }
 
+impl std::fmt::Debug for ProvenanceRecord {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("ProvenanceRecord")
+            .field("source_url_byte_count", &self.source_url.len())
+            .field("source_locator_byte_count", &self.source_locator.len())
+            .field("source_kind", &self.source_kind)
+            .field("verification_result", &self.verification_result)
+            .finish()
+    }
+}
+
 impl ProvenanceRecord {
     /// Validate and create one provenance record.
     pub fn new(
@@ -383,21 +399,147 @@ fn valid_source_url(source_url: &str) -> bool {
         || source_url
             .chars()
             .any(|character| character.is_control() || character.is_whitespace())
-        || source_url.contains(['?', '#', '\\'])
+        || source_url.contains(['#', '\\'])
     {
         return false;
     }
     let Some((scheme, remainder)) = source_url.split_once("://") else {
         return false;
     };
-    let authority_end = remainder.find('/').unwrap_or(remainder.len());
-    let authority = &remainder[..authority_end];
+    let (hierarchical, query) = remainder
+        .split_once('?')
+        .map_or((remainder, None), |(hierarchical, query)| {
+            (hierarchical, Some(query))
+        });
+    let authority_end = hierarchical.find('/').unwrap_or(hierarchical.len());
+    let authority = &hierarchical[..authority_end];
     let origin_text = format!("{scheme}://{authority}");
     if Origin::parse(&origin_text).is_err() {
         return false;
     }
-    let path = &remainder[authority_end..];
-    path.is_empty() || validate_path(path).is_ok()
+    let path = &hierarchical[authority_end..];
+    if !path.is_empty() && validate_path(path).is_err() {
+        return false;
+    }
+    query.is_none_or(valid_query)
+}
+
+fn valid_query(query: &str) -> bool {
+    let bytes = query.as_bytes();
+    let mut index = 0;
+    while index < bytes.len() {
+        let byte = bytes[index];
+        if byte == b'%' {
+            let Some(high) = bytes
+                .get(index + 1)
+                .and_then(|byte| hexadecimal_value(*byte))
+            else {
+                return false;
+            };
+            let Some(low) = bytes
+                .get(index + 2)
+                .and_then(|byte| hexadecimal_value(*byte))
+            else {
+                return false;
+            };
+            if (high * 16 + low).is_ascii_control() {
+                return false;
+            }
+            index += 3;
+            continue;
+        }
+        if !is_rfc3986_pchar(byte) && !matches!(byte, b'/' | b'?') {
+            return false;
+        }
+        index += 1;
+    }
+    query.split('&').all(|field| {
+        let (name, value) = field
+            .split_once('=')
+            .map_or((field, ""), |(name, value)| (name, value));
+        !is_credential_query_name(name) && !nested_query_contains_credential(value)
+    })
+}
+
+fn nested_query_contains_credential(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = hexadecimal_value(bytes[index + 1]).unwrap_or(0);
+            let low = hexadecimal_value(bytes[index + 2]).unwrap_or(0);
+            decoded.push(high * 16 + low);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    decoded
+        .split(|byte| *byte == b'?')
+        .skip(1)
+        .any(|nested_query| {
+            nested_query.split(|byte| *byte == b'&').any(|field| {
+                let name_end = field
+                    .iter()
+                    .position(|byte| *byte == b'=')
+                    .unwrap_or(field.len());
+                let name = &field[..name_end];
+                name.contains(&b'%') || is_credential_query_name_bytes(name)
+            })
+        })
+}
+
+fn is_credential_query_name(name: &str) -> bool {
+    let bytes = name.as_bytes();
+    let mut decoded = Vec::with_capacity(bytes.len());
+    let mut index = 0;
+    while index < bytes.len() {
+        if bytes[index] == b'%' {
+            let high = hexadecimal_value(bytes[index + 1]).unwrap_or(0);
+            let low = hexadecimal_value(bytes[index + 2]).unwrap_or(0);
+            decoded.push(high * 16 + low);
+            index += 3;
+        } else {
+            decoded.push(bytes[index]);
+            index += 1;
+        }
+    }
+    decoded.contains(&b'%') || is_credential_query_name_bytes(&decoded)
+}
+
+fn is_credential_query_name_bytes(decoded: &[u8]) -> bool {
+    let mut decoded = decoded.to_owned();
+    decoded.make_ascii_lowercase();
+    decoded.iter_mut().for_each(|byte| {
+        if *byte == b'-' {
+            *byte = b'_';
+        }
+    });
+    matches!(
+        decoded.as_slice(),
+        b"access_token"
+            | b"api_key"
+            | b"auth"
+            | b"authorization"
+            | b"client_secret"
+            | b"credential"
+            | b"key"
+            | b"password"
+            | b"secret"
+            | b"secret_key"
+            | b"session"
+            | b"sig"
+            | b"signature"
+            | b"token"
+            | b"x_api_key"
+            | b"x_amz_credential"
+            | b"x_amz_security_token"
+            | b"x_amz_signature"
+            | b"x_goog_credential"
+            | b"x_goog_signature"
+    )
 }
 
 fn valid_sha256(source_hash: &str) -> bool {