SDARC public lifecycle check

Runs the SDARC engine with synthetic data.

Open /security/sdarc-check and select Run check. The Go SDARC engine runs
locally in a fresh worker. It encrypts synthetic data, processes two grants,
revokes one grant, revokes the Child, and restores the same Child with Parent
authorization. The individually revoked grant stays denied; the other resumes.
The run also tries copied data and altered grant/history proof material.

To run the same engine independently, download these five files together:
  lifecycle.mjs
  manifest.json
  lifecycle-worker.mjs
  wasm_exec.js
  sdarc-lifecycle.wasm

Also retain the matching Go-LICENSE.txt and THIRD_PARTY_NOTICES.txt notices.

With Node.js 22 or later, run:

  node lifecycle.mjs manifest.json

The command outputs the engine's JSON results and evidence. A failed or
incomplete run exits unsuccessfully. No npm packages, credentials, customer
account, database or network connection are needed after downloading.

For an externally recorded manifest SHA-256, run:

  node lifecycle.mjs manifest.json <the recorded manifest SHA-256>

The wrapper checks the WASM, matching Go runtime and worker hashes before
execution. The manifest also records the public wrapper/proof files and the
Go source paths and hashes used to build this engine. Retain the manifest
SHA-256 separately to identify the exact downloaded bundle.

This run uses fresh in-memory authority, encrypted data and software key
providers. It exercises the actual SDARC Go lifecycle and processing code
with synthetic values; it does not connect to a product account.

Optional signed-history inspection:
  Download verifier.mjs and fixture.json, then run:
  node verifier.mjs fixture.json <the fixture SHA-256 from manifest.json>
  This readable verifier checks the fixed signed-history proof and ordered
  grant-state subset.

Permission to download, inspect, modify and run the JavaScript wrappers for
testing and review is provided in their source headers. The matching Go
runtime retains its source license. Other repository and protocol licensing
is unchanged.