# vloex-witness — run this in YOUR OWN repository (Vloex never touches it).
# Daily: fetch your org's public Vloex checkpoint, verify its signature
# against the pinned public JWKS, and commit it here. Your git history
# becomes an independent timestamped archive Vloex cannot rewrite — one
# honestly-archived checkpoint transitively pins all prior history
# (prev_root chain) and the device-key registry (keys line).
name: vloex-witness
on:
  schedule:
    - cron: "23 6 * * *"
  workflow_dispatch: {}
permissions:
  contents: write
jobs:
  witness:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Fetch, verify and archive today's checkpoint
        run: |
          pip install --quiet cryptography
          curl -fsS "https://api.vloex.com/.well-known/jwks.json" -o jwks.json
          curl -fsS "https://api.vloex.com/api/v1/logs/00000000-0000-0000-0000-000000000001/checkpoint/latest" -o checkpoint.note
          python - <<'PY'
          import base64, hashlib, json, sys
          from cryptography.hazmat.primitives.asymmetric import ed25519
          note = open("checkpoint.note", encoding="utf-8").read()
          body, _, sigs = note.partition("\n\n")
          body += "\n"
          keys = json.load(open("jwks.json"))["keys"]
          for line in [ln for ln in sigs.splitlines() if ln.strip()]:
              name, sig_b64 = line.split(" ")[-2:]
              blob = base64.b64decode(sig_b64)
              for k in keys:
                  raw = base64.urlsafe_b64decode(k["x"] + "=" * (-len(k["x"]) % 4))
                  if hashlib.sha256(name.encode() + b"\n\x01" + raw).digest()[:4] != blob[:4]:
                      continue
                  ed25519.Ed25519PublicKey.from_public_bytes(raw).verify(blob[4:], body.encode())
                  print("checkpoint signature OK")
                  sys.exit(0)
          sys.exit("checkpoint signature did NOT verify")
          PY
          mkdir -p vloex-checkpoints
          cp checkpoint.note "vloex-checkpoints/$(date -u +%F).note"
          git config user.name vloex-witness
          git config user.email vloex-witness@users.noreply.github.com
          git add vloex-checkpoints
          git commit -m "vloex witness $(date -u +%F)" || echo "checkpoint unchanged"
          git push