diff --git a/conformance/cnp-0-jcs-v0/CONTRACT.md b/conformance/cnp-0-jcs-v0/CONTRACT.md index 7e5dd324..6dfe6b87 100644 --- a/conformance/cnp-0-jcs-v0/CONTRACT.md +++ b/conformance/cnp-0-jcs-v0/CONTRACT.md @@ -1,4 +1,4 @@ - + The encoding MUST satisfy: @@ -43,7 +43,7 @@ The encoding MUST satisfy: ## §5.1.2 — Floating point - + In canonical form: @@ -72,7 +72,7 @@ In canonical form: ## §5.1.2 — Non-integer values inside an integers-only domain - + Two patterns are admissible. Both keep every number in the integer domain and both are exact. Each is a **tagged form**, carrying the reserved discriminator @@ -115,12 +115,14 @@ independent implementations will agree on. --- -## §5.1.2.1 — CNP-0-JCS +## §5.1.2.1 — CNP-0-JCS: the ratified selection - + -This draft selects **CNP-0-JCS** as the Tranche A3 candidate. The selection is -one package with two named layers: +##### 5.1.2.1 CNP-0-JCS: the ratified selection + +This document selects **CNP-0-JCS**, ratified as Tranche A3 on 2026-08-26 +(§5.1.3, Part 07 §17). The selection is one package with two named layers: - `hsp-jcs@v0` is the wire encoding: RFC 8785 JCS over strict I-JSON; - `cnp-0` is the numeric profile carried by that encoding. @@ -188,7 +190,7 @@ the path does not do and not what it is given. ## §5.1.2.2 — Fixed-point scale identity - + A fixed-point domain MUST bind one content-addressed scale descriptor of this shape: @@ -219,19 +221,58 @@ simplex, `Σ value_i` MUST equal `radix^places` exactly. --- -## §5.1.3 — What conformance requires - - - -**Design selected; conformance pending.** CNP-0-JCS resolves the draft's design -choice. It does not ratify Tranche A3 and does not lift the federation blocker. - -Two levels are separated here, because an earlier version of this paragraph -conflated them and thereby made the whole tranche wait on a party this project -cannot create. - -**A3 ratification** requires artifacts the project can produce and anyone can -check: +## §5.1.3 — Parity is proven, not assumed + + + +#### 5.1.3 Parity is proven, not assumed + +Every substrate implementing the encoding MUST verify against a shared fixture +set, in the manner `warrant/examples/canon-vectors.json` establishes for JCS. +The CNP-0 corpus MUST pin canonical bytes and full SHA-256 digests for: + +1. zero, one, minus one, and both CNP-0 integer bounds; +2. `1/3`, `-1/3`, canonical zero, and rejection of `2/4`, `0/2`, a negative + denominator, overflow, floats, exponent notation, and duplicate map names; +3. the same fixed integer under two scale descriptors producing different domain + references; +4. exact ratio and fixed-point simplexes, including invalid sums; largest- + remainder renormalization with a residual, a tie resolved by canonical + coordinate identifier, permutation of input presentation, zero-sum rejection, + and negative-weight rejection; +5. profile-identifier mutation and one-byte pinned-constant mutation changing + the full digest; +6. byte strings, normalization-distinct strings, key-order permutations, and + nested empty containers; +7. `circle256` index equality and rotation, with LUT mutation if a LUT is + implemented; +8. every quantization boundary named in §5.1.2.5–§5.1.2.6. + +Cross-substrate parity that has not been measured is a hope, and this document +does not accept hopes as evidence anywhere else. + +**Tranche A3 is RATIFIED (2026-08-26).** `s0fractal`, as steward, ratified +Tranche A3 and CNP-0-JCS. The statement, verbatim: + +> Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є +> adoption-evidenced або interop-confirmed. +> +> _(I ratify Tranche A3 of RFC-0003 and CNP-0-JCS as steward. This is not +> adoption-evidenced or interop-confirmed.)_ + +The steward drew the boundary in the same breath as the ratification, and that +half is as normative as the first. Ratification settles that the encoding is +determined and checkable, and lifts the specification-side federation blocker. +It licenses **no** claim that the encoding is in use, that a second +implementation exists, that interoperability has been demonstrated, or that any +federation evidence has been produced. + +Two levels were separated here on 2026-08-26, because an earlier version of this +paragraph conflated them and thereby made the whole tranche wait on a party this +project cannot create. + +**A3 ratification** required artifacts the project can produce and anyone can +check, and all six exist at the ratified revision: 1. `CANONICAL_ENCODING.v0.1` as a normative contract; 2. the normative corpus above; @@ -243,10 +284,10 @@ check: 5. a **reproducible conformance kit** — the contract, the corpus, the expected bytes and digests, and a runner — such that a party outside this project can implement §5.1 and check itself without consulting or trusting this project. - A candidate exists at `conformance/cnp-0-jcs-v0/`. It ships no - implementation: a kit that scored an implementer by agreement with this - project's encoder would be asking them to trust that encoder, which is the - thing the kit exists to make unnecessary; + It exists at `conformance/cnp-0-jcs-v0/`. It ships no implementation: a kit + that scored an implementer by agreement with this project's encoder would be + asking them to trust that encoder, which is the thing the kit exists to make + unnecessary; 6. steward ratification. That list is the whole of A3. Two further states sit outside it, and neither @@ -265,6 +306,17 @@ demonstrated implementation diversity. A single-implementation encoding that a second party _could_ verify is a different and weaker claim than one a second party _has_ verified, and the difference is exactly what this level names. +§5.1 is now specified **and** ratified as a conforming cross-substrate protocol. +That is a statement about the specification, not about the world it is meant to +run in. The honest status is: + +> **A3: RATIFIED. adoption-evidenced: false. interop-confirmed: false.** + +Anything depending on cross-substrate reference _equality_ still depends on +`adoption-evidenced`, which is false: no substrate computes references under +`hsp-jcs@v0` today. Ratification removed the specification-side blocker and +nothing else. + --- diff --git a/conformance/cnp-0-jcs-v0/tools/build_kit.py b/conformance/cnp-0-jcs-v0/tools/build_kit.py index bba8b5e3..a09b2bfd 100644 --- a/conformance/cnp-0-jcs-v0/tools/build_kit.py +++ b/conformance/cnp-0-jcs-v0/tools/build_kit.py @@ -61,6 +61,14 @@ """ # (clause, heading, start anchor, end anchor, why it ends there) +# +# Anchors are structural — headings — wherever a subsection is wanted whole. +# §5.1.3's region used to start at the prose "**Design selected; conformance +# pending.**", which is exactly the sentence a ratification rewrites: the anchor +# moved with the status it described and the extraction broke. A boundary that +# changes when the content changes is not a boundary. The two regions that still +# stop mid-section stop at a following heading or at a named sentence that is +# there to be excluded, and each says which below. REGIONS = [ ("§5.1.1", "Canonical encoding is normative, not an implementation detail", "The encoding MUST satisfy:", "Rule 5 reverses", @@ -71,14 +79,15 @@ ("§5.1.2", "Non-integer values inside an integers-only domain", "Two patterns are admissible.", "A string form such as", "stops before the string form, which the profile does not admit"), - ("§5.1.2.1", "CNP-0-JCS", - "This draft selects", "CNP-0-JCS reuses the already implemented", - "stops before the paragraph naming an existing implementation"), + ("§5.1.2.1", "CNP-0-JCS: the ratified selection", + "##### 5.1.2.1", "CNP-0-JCS reuses the already implemented", + "starts at the heading; stops before the paragraph naming an existing " + "implementation, which is a deliberate exclusion and not a section end"), ("§5.1.2.2", "Fixed-point scale identity", "A fixed-point domain MUST bind", "##### 5.1.2.3", "the whole subsection"), - ("§5.1.3", "What conformance requires", - "**Design selected; conformance pending.**", "Until the A3 artifacts exist", - "the two-level gate this kit is an artifact of"), + ("§5.1.3", "Parity is proven, not assumed", + "#### 5.1.3 Parity is proven, not assumed", "#### 5.1.4", + "heading to heading — the whole subsection"), ] EXTRACT_HEAD = """# CNP-0-JCS — normative extract diff --git a/contracts/CANONICAL_ENCODING.v0.1.md b/contracts/CANONICAL_ENCODING.v0.1.md index 3e9e1612..2c515e7d 100644 --- a/contracts/CANONICAL_ENCODING.v0.1.md +++ b/contracts/CANONICAL_ENCODING.v0.1.md @@ -2,28 +2,27 @@ type: "ContractDescriptor" version: "0.1" title: "CNP-0-JCS Canonical Encoding" -status: "draft" +status: "ratified" --- -# CNP-0-JCS Canonical Encoding — candidate +# CNP-0-JCS Canonical Encoding — ratified -> **Status: candidate / unratified / partial implementation.** This document -> restates the encoding RFC-0003 Part 01 §5.1 selects, in the form an -> implementer needs. It does **not** ratify Tranche A3, does not lift the -> federation blocker, and is not evidence that any substrate has adopted it. -> Part 01 §5.1.3 requires `CANONICAL_ENCODING.v0.1`, the corpus, a reference -> encoder, a verifier-only path sharing no code with it, a standalone -> conformance kit, and steward ratification before A3 is closed. Substrate -> adoption (`adoption-evidenced`) and independent maintenance -> (`interop-confirmed`) are separate states above it and do not block it. See -> "What is still missing" below. +> **Status: RATIFIED 2026-08-26.** This document restates the encoding RFC-0003 +> Part 01 §5.1 selects, in the form an implementer needs. Tranche A3 is ratified +> and the specification-side federation blocker is lifted. +> +> **It is not evidence that any substrate has adopted the encoding, and not +> evidence of independent interoperability.** Those are two separate states, +> both false: `adoption-evidenced: false`, `interop-confirmed: false`. A3 being +> closed moves neither. - **Normative source:** [RFC-0003 Part 01 §5.1.1–§5.1.3](../docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md). Where this document and Part 01 disagree, **Part 01 governs**; this file is a restatement, not an amendment, and adds no normative rule. -- **Executable candidate:** [`probes/cnp-0-seed-v0/`](../probes/cnp-0-seed-v0/) - — reference encoder, verifier-only rejection path, corpus, negative controls. +- **Reference implementation:** + [`probes/cnp-0-seed-v0/`](../probes/cnp-0-seed-v0/) — reference encoder, + verifier-only rejection path, corpus, negative controls. - **Conformance kit:** [`conformance/cnp-0-jcs-v0/`](../conformance/cnp-0-jcs-v0/) — implement §5.1 and score yourself, without running or trusting anything of ours. @@ -77,9 +76,9 @@ separate because only the first is shared with prior art: §5.1.3 requires a verifier-only path that "rejects non-canonical ratios and malformed raw input", and the corpus pins "a stable rejection class" per -negative case. The class names below are this candidate's vocabulary. **The -names are an implementation choice; the rejections they stand for are the -clauses above.** +negative case. The class names below are this contract's vocabulary. **The names +are an implementation choice; the rejections they stand for are the clauses +above.** `invalid-utf8`, `syntax`, `trailing-bytes`, `duplicate-member-name`, `malformed-escape`, `unpaired-surrogate`, `number-not-cnp0-integer`, @@ -124,7 +123,7 @@ normative rule here.** They are open questions for the steward. 1. ~~**How a tagged form is recognized.**~~ **Resolved normatively on 2026-08-25.** §5.1.2.1 now reserves the member name `cnp0` and makes - recognition a property of the bytes. The earlier candidate read any map with + recognition a property of the bytes. An earlier draft read any map with `kind` in `{bytes, ratio, fixed}` as a tagged form, which would have reserved three values of this document's universal discriminator — 39 values across at least twelve declared types. See Part 07 §14 and @@ -139,7 +138,7 @@ normative rule here.** They are open questions for the steward. ### Open 3. **The `-0` literal.** §5.1.2(2) bars IEEE `-0.0` from the object model. `-0` - is nevertheless an integer token in the JSON grammar, so this candidate + is nevertheless an integer token in the JSON grammar, so this contract rejects it as `signed-zero`. That is a derivation, not a quotation. 4. **What "canonical" means for a verifier.** The encoder canonicalizes member order and whitespace; the verifier is asked whether _these_ bytes are @@ -148,13 +147,13 @@ normative rule here.** They are open questions for the steward. literally. Both expectations are pinned per case in the corpus. 5. **The `circle256` LUT shape.** §5.1.2.4 requires a LUT to be fixed-point, content-addressed, and bound into the domain descriptor. Its member layout is - this candidate's. + this contract's. 6. **Quantizing signed zero.** `-0.0` maps to the integer `0`, following §5.1.2(2)'s "an exact integral result MAY be converted to the integer `0` before that boundary". 7. **How a full content digest is spelled.** §5.1.2.2 says `unit_ref` is "either `null` or a full content digest" without fixing the string form. This - candidate requires 64 lowercase hexadecimal characters and rejects an opaque + contract requires 64 lowercase hexadecimal characters and rejects an opaque handle, a truncated digest, or an uppercase one — fail-closed, and consistent with §5.1's refusal elsewhere to accept a truncated handle as a reference. A typed reference object would be the alternative, and choosing between them is @@ -189,16 +188,16 @@ independent encoders** for A3 itself, which conflated a technical gate this project can meet with an organisational precondition it cannot create — an outside maintainer — and so blocked the whole RFC on someone else's decision. -### A3 ratification — what this project must produce +### A3 ratification — what this project produced, and did -| Artifact | Status | -| ------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -| `CANONICAL_ENCODING.v0.1` | this file, **candidate** | -| The CNP-0 corpus | `probes/cnp-0-seed-v0/corpus/`, candidate, all eight §5.1.3 categories | -| A reference encoder | present as a candidate (`probes/cnp-0-seed-v0/ts/`) | -| A verifier-only rejection path sharing no code with it | present as a candidate; `ts/reject.ts` imports nothing from the encoder, which is the property that matters — it cannot repair what it judges | -| A reproducible conformance kit | **present as a candidate**, `conformance/cnp-0-jcs-v0/`. Normative extract quoted from Part 01 by byte range, 63 required cases with expected bytes and digests, a stdlib-only Python runner that scores an outside implementation, and `MANIFEST.sha256` pinning every file so an edited corpus is refused rather than quietly scored. It ships **no implementation**: scoring by agreement with our encoder would be asking an implementer to trust our encoder. | -| Steward ratification | **absent.** Nothing here is accepted, signed, or ratified. | +| Artifact | Status | +| ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | +| `CANONICAL_ENCODING.v0.1` | this file, **ratified** | +| The CNP-0 corpus | `probes/cnp-0-seed-v0/corpus/`, all eight §5.1.3 categories | +| A reference encoder | present (`probes/cnp-0-seed-v0/ts/`) | +| A verifier-only rejection path sharing no code with it | present; `ts/reject.ts` imports nothing from the encoder, which is the property that matters — it cannot repair what it judges | +| A reproducible conformance kit | **present**, `conformance/cnp-0-jcs-v0/`. Normative extract quoted from Part 01 by byte range, 63 required cases with expected bytes and digests, a stdlib-only Python runner that scores an outside implementation, and `MANIFEST.sha256` pinning every file so an edited corpus is refused rather than quietly scored. It ships **no implementation**: scoring by agreement with our encoder would be asking an implementer to trust our encoder. | +| Steward ratification | **present.** Ratified by `s0fractal` as steward on 2026-08-26; the statement is recorded verbatim in Part 07 §17. | The same-author caveat that used to disqualify the second code path still applies to what it actually bears on — it is not evidence of independent @@ -230,7 +229,5 @@ file may not be cited as showing implementation diversity. do not contain the `cnp-0` profile members, ratios, fixed-point domains, or the rejection corpus. -The honest status remains what Part 01 already records: **A3 ratification gate -defined; contract, corpus, reference encoder, verifier-only path and conformance -kit present as candidates; steward ratification pending; adoption not evidenced; -independent interoperability unconfirmed.** +The honest status remains what Part 01 already records: **A3: RATIFIED. +adoption-evidenced: false. interop-confirmed: false.** diff --git a/docs/rfc/0003-heterogeneous-state-protocol/00-architecture-and-ratification-map.md b/docs/rfc/0003-heterogeneous-state-protocol/00-architecture-and-ratification-map.md index 62c24883..ac558054 100644 --- a/docs/rfc/0003-heterogeneous-state-protocol/00-architecture-and-ratification-map.md +++ b/docs/rfc/0003-heterogeneous-state-protocol/00-architecture-and-ratification-map.md @@ -48,14 +48,25 @@ now lives in Part 03. This is deliberate — ledger chords and prior receipts ci these numbers, and a citation that silently changes referent is the failure the protocol exists to prevent. §22 maps every section range to its document. -**Part 01 is the blocker.** The draft now selects CNP-0-JCS, but selection text -is not interoperability evidence or federation ratification. Until the separate -contract, the CNP-0 corpus, a reference encoder, a verifier-only rejection path, -a standalone conformance kit, and steward ratification exist, anything depending -on cross-substrate reference equality is specified and not yet conformingly -implementable. - -**Substrate adoption is not a ratification condition.** It is its own state, +**Part 01 is no longer the blocker.** Tranche A3 was **ratified by the steward +on 2026-08-26** (Part 01 §5.1.3, Part 07 §17): the contract, the CNP-0 corpus, a +reference encoder, a verifier-only rejection path sharing no code with it, and a +standalone conformance kit all exist, and the steward closed the tranche. + +**Three independent states, and only the first has changed:** + +| state | value | what it licenses | +| ---------------------- | ------------ | ----------------------------------------------------------------------------------- | +| **A3** | **RATIFIED** | the encoding is determined and checkable | +| **adoption-evidenced** | **false** | nothing may claim the encoding is in use | +| **interop-confirmed** | **false** | nothing may claim independent interoperability or multi-implementation confirmation | + +Anything depending on cross-substrate reference _equality_ still depends on +`adoption-evidenced`, which is false: no substrate computes references under +`hsp-jcs@v0` today. Ratification removed the specification-side blocker and +nothing else, and A3 being closed moves neither of the other two. + +**Substrate adoption was never a ratification condition.** It is its own state, `adoption-evidenced`, for the same reason the second encoder stopped being one: ratifying a specification and running it are different acts, and folding the second into the first meant the document could not be finished until the @@ -63,12 +74,12 @@ substrates moved. A3 says the encoding is settled and checkable; adoption says somebody computes references with it. Both must be reported, and neither substitutes for the other. -A3 no longer waits on a second independently maintained encoder. That -requirement conflated a technical gate this project can meet with an -organisational precondition it cannot create, and so blocked the whole RFC on an -outside maintainer's decision. It moves to a higher level, **interop-confirmed** -(§5.1.3), which does not block A3 or anything downstream but which gates the -right to describe the encoding as independently interoperable. +A3 stopped waiting on a second independently maintained encoder on the day it +was restated. That requirement conflated a technical gate this project can meet +with an organisational precondition it cannot create, and so blocked the whole +RFC on an outside maintainer's decision. It sits at **interop-confirmed** +(§5.1.3), which gates the right to describe the encoding as independently +interoperable and blocks nothing. ## 0. Abstract @@ -683,22 +694,23 @@ python3 tests/federation_differential.py # FEDERATION-DIFFERENTIAL: ALL AGREE The Lean proofs were not rebuilt. The `sigma-glyph/proofs/` row says "Lean" rather than "proved" for that reason. -#### 17.1.1 Two decisions now have named candidates +#### 17.1.1 One decision is ratified, one has a named candidate -- **Tranche A3 (canonical encoding).** Part 01 §5.1.2.1 now selects - **CNP-0-JCS** in the draft: RFC 8785 JCS over strict I-JSON, integers bounded - to ±(2^53−1), IEEE floats forbidden, and exact ratio or domain-scoped - fixed-point selected per state domain. It also separates the wire identifier - `hsp-jcs@v0` from numeric profile `cnp-0`, with both inside digest input. +- **Tranche A3 (canonical encoding). RATIFIED 2026-08-26.** Part 01 §5.1.2.1 + selects **CNP-0-JCS**: RFC 8785 JCS over strict I-JSON, integers bounded to + ±(2^53−1), IEEE floats forbidden, and exact ratio or domain-scoped fixed-point + selected per state domain. It also separates the wire identifier `hsp-jcs@v0` + from numeric profile `cnp-0`, with both inside digest input. This resolves the design choice, not the tranche. Warrant's 47 canonical vectors and Python/Go/Rust agreement are prior evidence for the JCS layer; they do not exercise CNP-0 identifiers, ratios, fixed scales, constants, - circles, or quantization. A3 remains pending until `CANONICAL_ENCODING.v0.1`, - the CNP-0 corpus, a reference encoder, a verifier-only rejection path sharing - no code with it, a standalone conformance kit, and steward ratification exist. - Federation adoption is **not** among them; it is tracked separately as - `adoption-evidenced`. + circles, or quantization. A3 required `CANONICAL_ENCODING.v0.1`, the CNP-0 + corpus, a reference encoder, a verifier-only rejection path sharing no code + with it, a standalone conformance kit, and steward ratification. All six + exist, and **the steward ratified A3 on 2026-08-26** — see Part 07 §17 for the + statement. Federation adoption was **not** among them and remains tracked + separately as `adoption-evidenced`, which is false. **Restated 2026-08-26: two levels, not one.** This entry previously required **two independent encoders** for A3. That conflated four separable things — @@ -709,7 +721,7 @@ rather than "proved" for that reason. A3 now requires only what the project can produce and anyone can check, including a **conformance kit** that lets an outside party implement §5.1 and - verify itself without trusting this project. A candidate kit exists at + verify itself without trusting this project. That kit is at `conformance/cnp-0-jcs-v0/`. Two things move out of A3. **Substrate adoption** becomes `adoption-evidenced` @@ -765,7 +777,8 @@ rather than "proved" for that reason. #### 17.1.2 What this does not settle -Naming candidates is not ratifying them. Specifically: +A3 is ratified; G4's evaluator is not. And ratifying a specification settles the +specification, not the world it runs in. Specifically: 1. **The two stacks have separate key identities.** The `claude` voice key in `src/x2F38_voice_pubkeys.json` and the `claude-fable-5` key in the dyad's @@ -777,10 +790,12 @@ Naming candidates is not ratifying them. Specifically: pre-ratification identity gate, distinct from §20.17's still-open question of what an already-active compatibility contract does when its party later forks. -2. **Draft selection is not adoption authority.** Part 01 chooses CNP-0-JCS as - the text's candidate. That does not make Warrant the owner of federation - encoding, import its governance, or bind substrates that have not ratified - and implemented the contract. +2. **Ratification is not adoption authority.** Part 01 selects CNP-0-JCS and the + steward ratified it. That does not make Warrant the owner of federation + encoding, import its governance, or bind substrates that have not adopted and + implemented the contract. `adoption-evidenced` is **false**: no substrate + computes references under `hsp-jcs@v0` today, and A3 being closed does not + change that. 3. **Version pinning is mandatory if adopted.** `ski@v1` names Book I v0.5 specifically, and `GOV-ANCHORS` pins its dependencies by content hash for the stated reason that a STANDARD must not rest on a moving target. Any adoption @@ -1453,19 +1468,21 @@ where a reference resolves: irreversible boundary, admission, identity amendment, or trust computation. - **A2.** Require a single canonical encoding meeting §5.1.1, with the float policy of §5.1.2 and cross-substrate parity fixtures per §5.1.3. -- **A3.** Commission and ratify `CANONICAL_ENCODING.v0.1` for the draft-selected - CNP-0-JCS profile (§5.1.2.1), with its normative corpus (§5.1.3), a reference +- **A3. RATIFIED 2026-08-26.** `CANONICAL_ENCODING.v0.1` for the draft-selected + CNP-0-JCS profile (§5.1.2.1), its normative corpus (§5.1.3), a reference encoder, a verifier-only path sharing no code with it that rejects malformed - raw input and non-canonical ratios, and a reproducible conformance kit. The - text selects the design; this tranche is not satisfied until those artifacts - exist and the steward ratifies them. -- **Adoption-evidenced** (a state, not a tranche, and not a blocker on A3). At - least one substrate computing real references under `hsp-jcs@v0` on a path - that matters. Until it holds, no document may claim the encoding is in use. -- **Interop-confirmed** (a level above both, and not a blocker on either). Two - independently maintained implementations, or adoption by a party outside this - project, with parity evidence in both directions. Until it holds, no document - may claim independent interoperability or multi-implementation confirmation. + raw input and non-canonical ratios, and a reproducible conformance kit all + exist, and the steward ratified the tranche. This settles the specification; + it settles neither of the two states below. +- **Adoption-evidenced: false** (a state, not a tranche, and never a blocker on + A3). At least one substrate computing real references under `hsp-jcs@v0` on a + path that matters. Until it holds, no document may claim the encoding is in + use. +- **Interop-confirmed: false** (a level above both, and never a blocker on + either). Two independently maintained implementations, or adoption by a party + outside this project, with parity evidence in both directions. Until it holds, + no document may claim independent interoperability or multi-implementation + confirmation. - **A4.** Require stable, verifiable key identity at Level 0. - **A5.** Ratification counts principals rather than public keys: bind keys to content-addressed principal and custody records, and fail unresolved or shared diff --git a/docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md b/docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md index 4d975884..e9d24846 100644 --- a/docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md +++ b/docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md @@ -190,7 +190,7 @@ In canonical form: Rule 4 says what MUST NOT be used and leaves open how a non-integer value is actually written when the canonical encoding admits only integers — which is the -case for the leading Tranche A3 candidate (§17.1.1) and the one place §6.4's +case for the ratified Tranche A3 encoding (§17.1.1) and the one place §6.4's probability simplex collides with it. Two patterns are admissible. Both keep every number in the integer domain and @@ -237,10 +237,10 @@ implementation must parse identically, which is more surface for the second independent implementation to diverge on, and divergence there is exactly what canonical encoding exists to prevent. -##### 5.1.2.1 CNP-0-JCS: draft selection +##### 5.1.2.1 CNP-0-JCS: the ratified selection -This draft selects **CNP-0-JCS** as the Tranche A3 candidate. The selection is -one package with two named layers: +This document selects **CNP-0-JCS**, ratified as Tranche A3 on 2026-08-26 +(§5.1.3, Part 07 §17). The selection is one package with two named layers: - `hsp-jcs@v0` is the wire encoding: RFC 8785 JCS over strict I-JSON; - `cnp-0` is the numeric profile carried by that encoding. @@ -450,15 +450,28 @@ The CNP-0 corpus MUST pin canonical bytes and full SHA-256 digests for: Cross-substrate parity that has not been measured is a hope, and this document does not accept hopes as evidence anywhere else. -**Design selected; conformance pending.** CNP-0-JCS resolves the draft's design -choice. It does not ratify Tranche A3 and does not lift the federation blocker. +**Tranche A3 is RATIFIED (2026-08-26).** `s0fractal`, as steward, ratified +Tranche A3 and CNP-0-JCS. The statement, verbatim: -Two levels are separated here, because an earlier version of this paragraph -conflated them and thereby made the whole tranche wait on a party this project -cannot create. +> Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є +> adoption-evidenced або interop-confirmed. +> +> _(I ratify Tranche A3 of RFC-0003 and CNP-0-JCS as steward. This is not +> adoption-evidenced or interop-confirmed.)_ -**A3 ratification** requires artifacts the project can produce and anyone can -check: +The steward drew the boundary in the same breath as the ratification, and that +half is as normative as the first. Ratification settles that the encoding is +determined and checkable, and lifts the specification-side federation blocker. +It licenses **no** claim that the encoding is in use, that a second +implementation exists, that interoperability has been demonstrated, or that any +federation evidence has been produced. + +Two levels were separated here on 2026-08-26, because an earlier version of this +paragraph conflated them and thereby made the whole tranche wait on a party this +project cannot create. + +**A3 ratification** required artifacts the project can produce and anyone can +check, and all six exist at the ratified revision: 1. `CANONICAL_ENCODING.v0.1` as a normative contract; 2. the normative corpus above; @@ -470,10 +483,10 @@ check: 5. a **reproducible conformance kit** — the contract, the corpus, the expected bytes and digests, and a runner — such that a party outside this project can implement §5.1 and check itself without consulting or trusting this project. - A candidate exists at `conformance/cnp-0-jcs-v0/`. It ships no - implementation: a kit that scored an implementer by agreement with this - project's encoder would be asking them to trust that encoder, which is the - thing the kit exists to make unnecessary; + It exists at `conformance/cnp-0-jcs-v0/`. It ships no implementation: a kit + that scored an implementer by agreement with this project's encoder would be + asking them to trust that encoder, which is the thing the kit exists to make + unnecessary; 6. steward ratification. That list is the whole of A3. Two further states sit outside it, and neither @@ -492,14 +505,16 @@ demonstrated implementation diversity. A single-implementation encoding that a second party _could_ verify is a different and weaker claim than one a second party _has_ verified, and the difference is exactly what this level names. -Until the A3 artifacts exist and the steward ratifies them, §5.1 is specified -but not yet implementable as a conforming cross-substrate protocol. The honest -status is: +§5.1 is now specified **and** ratified as a conforming cross-substrate protocol. +That is a statement about the specification, not about the world it is meant to +run in. The honest status is: + +> **A3: RATIFIED. adoption-evidenced: false. interop-confirmed: false.** -> **A3 ratification gate defined; contract, corpus, reference encoder, -> verifier-only path and conformance kit present as candidates; steward -> ratification pending; adoption not evidenced; independent interoperability -> unconfirmed.** +Anything depending on cross-substrate reference _equality_ still depends on +`adoption-evidenced`, which is false: no substrate computes references under +`hsp-jcs@v0` today. Ratification removed the specification-side blocker and +nothing else. #### 5.1.4 The selection is narrower than it looks diff --git a/docs/rfc/0003-heterogeneous-state-protocol/07-revision-history.md b/docs/rfc/0003-heterogeneous-state-protocol/07-revision-history.md index 8955dad2..1c83f9ab 100644 --- a/docs/rfc/0003-heterogeneous-state-protocol/07-revision-history.md +++ b/docs/rfc/0003-heterogeneous-state-protocol/07-revision-history.md @@ -1100,3 +1100,78 @@ it was pinned. It does not show the kit is **authentic**: anyone who edits a file can recompute the manifest. Authenticity requires the manifest's own digest to be known from outside the kit, which is what a ratification record must pin. The runner prints that digest for exactly that purpose. + +## 17. Tranche A3 ratified (2026-08-26) + +`s0fractal`, as steward, ratified Tranche A3 of RFC-0003 and CNP-0-JCS. The +statement, verbatim: + +> Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є +> adoption-evidenced або interop-confirmed. +> +> _(I ratify Tranche A3 of RFC-0003 and CNP-0-JCS as steward. This is not +> adoption-evidenced or interop-confirmed.)_ + +The steward drew the boundary in the same breath as the ratification, and that +half is as normative as the first. + +### Three states, independent of one another + +| state | value | +| ---------------------- | ------------ | +| **A3** | **RATIFIED** | +| **adoption-evidenced** | **false** | +| **interop-confirmed** | **false** | + +A3 being closed licenses **no** claim that the encoding is in use, that a second +implementation exists, that interoperability has been demonstrated, or that any +federation evidence has been produced. Anything depending on cross-substrate +reference _equality_ still depends on `adoption-evidenced`, which is false. + +### What was ratified + +All six artifacts §5.1.3 required exist at the ratified revision: +`CANONICAL_ENCODING.v0.1`, the CNP-0 corpus across all eight §5.1.3 categories, +the reference encoder, the verifier-only rejection path that imports nothing +from it, the standalone conformance kit at `conformance/cnp-0-jcs-v0/`, and now +the steward's ratification. + +### Provenance of this statement, stated plainly + +The ratification reached the ledger **relayed**: the steward said it, and the +voices that received it carried it here. At the moment this edit was written no +`s0fractal`-signed chord existed for it, and none was manufactured — a key on +disk is not permission to act as the human, and neither is a relay. A signed +steward receipt pinning the accepted SHA, the merge SHA, the kit's manifest root +and this verbatim statement is the separate act that follows acceptance of this +change. Until that chord exists, this entry is the record and it says what it +is. + +### What is not rewritten + +§15 and §16 said there was no ratification. **That was true when they were +written**, and neither is edited. A ledger that revises its earlier entries to +agree with later news is the failure this history exists to prevent. The same +holds for the receipts in `src/`, for +`probes/cnp-0-qwen-cleanroom-v0/VERDICT.md`, and for every earlier statement +about the prior state: they are correct about their moment and superseded, not +wrong. + +Two of them are worth reading beside this entry rather than through it. The +restatement in §15 rests on an argument about what §5.1.3 was conflating and +**not** on the Qwen probe's failure — ratification does not retroactively make +that probe evidence of anything. + +And the Qwen `VERDICT.md`, read exactly: its **closing status**, in the +"Subsequent steward disposition" section, already carries the two-level +restatement and records the conformance kit and steward ratification as pending +and independent interoperability as unconfirmed. Both were true at closure and +are superseded by §16 and by this §17. Its earlier "recorded at closing" section +does say A3 still required two independent encoders — correctly, for the moment +that section names, and superseded inside the same document by the disposition +that follows it. An earlier draft of this paragraph attributed that earlier +sentence to the verdict's closing status, which misdescribed the document; the +correction is here rather than in the verdict, which stays untouched. + +None of this changes what the probe produced, which was nothing, or what it is +evidence of, which is nothing. diff --git a/probes/cnp-0-qwen-cleanroom-v0/README.md b/probes/cnp-0-qwen-cleanroom-v0/README.md index 0aa13075..8386c56a 100644 --- a/probes/cnp-0-qwen-cleanroom-v0/README.md +++ b/probes/cnp-0-qwen-cleanroom-v0/README.md @@ -1,7 +1,7 @@ --- status: closed owner_voice: claude -next_verification: none. Closed 2026-08-26 as protocol-deviated / curator-terminated / no encoder / no evidence about RFC determinacy — see VERDICT.md. A second independently maintained encoder is no longer an A3 blocker (Part 01 §5.1.3, restated 2026-08-26); it sits at the higher interop-confirmed level, and that restatement is not a consequence of this probe. If the bridge-for-outsiders goal is picked up again, the artifact to build is the conformance kit A3 now requires — most of it already exists in probes/cnp-0-seed-v0 +next_verification: none. Closed 2026-08-26 as protocol-deviated / curator-terminated / no encoder / no evidence about RFC determinacy — see VERDICT.md. A3 was ratified the same day without a second encoder (Part 07 §17); that rests on an argument about what §5.1.3 was conflating and NOT on this probe, which contributes nothing to A3, to adoption-evidenced, or to interop-confirmed graduation_target: null --- @@ -28,9 +28,11 @@ graduation_target: null RFC-0003 Part 01 §5.1.3 required **two independent encoders** before Tranche A3 could close — the requirement this probe was built to help meet. It was restated on 2026-08-26, after this probe closed: independent maintenance moved to a higher -`interop-confirmed` level that does not block A3. That restatement rests on an -argument about what A3 was conflating, **not** on this probe's failure, and this -probe contributes nothing to either level. The existing seed (`probes/cnp-0-seed-v0`) is one encoder plus +`interop-confirmed` level that does not block A3. A3 was then ratified the same +day without a second encoder (Part 07 §17). Both the restatement and the +ratification rest on an argument about what A3 was conflating, **not** on this +probe's failure, and this probe contributes nothing to A3, to +`adoption-evidenced`, or to `interop-confirmed`. The existing seed (`probes/cnp-0-seed-v0`) is one encoder plus same-author code paths, and no amount of further writing by the same author changes that. This probe asks a different question, which is answerable: diff --git a/probes/cnp-0-qwen-cleanroom-v0/harness/build_capsule.py b/probes/cnp-0-qwen-cleanroom-v0/harness/build_capsule.py index 65fdeddd..5b6351e0 100644 --- a/probes/cnp-0-qwen-cleanroom-v0/harness/build_capsule.py +++ b/probes/cnp-0-qwen-cleanroom-v0/harness/build_capsule.py @@ -179,12 +179,24 @@ def main() -> int: raw = open(SOURCE, "rb").read() source = raw.decode("utf-8") source_digest = sha(raw) + + check = "--check" in sys.argv + rec = json.load(open(VERBATIM)) if os.path.exists(VERBATIM) else {} + + # Ask whether the capsule is sealed BEFORE trying to re-derive it. An earlier + # version extracted first and checked the seal after, so when Tranche A3 was + # ratified and §5.1.2.1's opening sentence changed, an anchor into the live + # specification went missing and this crashed — while re-deriving is exactly + # what a sealed capsule must never do. Work performed ahead of the guard that + # makes it unnecessary is work that can fail for reasons the guard exists to + # rule out. + if check and rec.get("sealed"): + return check_sealed(rec, source_digest) + regions = extract(source) text = render(regions, source_digest) - check = "--check" in sys.argv if check: - rec = json.load(open(VERBATIM)) if os.path.exists(VERBATIM) else {} if rec.get("sealed"): # The probe is closed. The capsule quoted the specification as it # stood at the digest recorded here; the specification has since diff --git a/probes/cnp-0-seed-v0/README.md b/probes/cnp-0-seed-v0/README.md index e78c3539..792ecce4 100644 --- a/probes/cnp-0-seed-v0/README.md +++ b/probes/cnp-0-seed-v0/README.md @@ -1,17 +1,21 @@ --- status: active owner_voice: claude -next_verification: get the candidate conformance kit (conformance/cnp-0-jcs-v0/, projected from this corpus) ratified, and measure a substrate computing real references under hsp-jcs@v0. A second independently maintained encoder is no longer an A3 blocker — it sits at the higher interop-confirmed level, and until it holds this probe may not be cited as showing implementation diversity. One attempt at it (probes/cnp-0-qwen-cleanroom-v0) closed 2026-08-26 without an encoder +next_verification: move adoption-evidenced — get a substrate computing real references under hsp-jcs@v0 on a path that matters. A3 was ratified 2026-08-26 (Part 07 §17); adoption-evidenced and interop-confirmed are separate states and both are false, so this probe still may not be cited as showing the encoding is in use or independently interoperable graduation_target: null --- # cnp-0-seed-v0 -> **Status: active probe, non-authoritative.** This is the first executable -> candidate for RFC-0003 Part 01 §5.1.2–§5.1.3. It does **not** close Tranche -> A3, does not establish conformance, and is not evidence that any substrate has -> adopted CNP-0-JCS. Part 01 §5.1.3 requires two **independent** encoders; this -> probe contains one reference encoder plus code paths by the same author. +> **Status: the reference implementation for RFC-0003 Part 01 §5.1.2–§5.1.3.** +> Tranche A3 was ratified on 2026-08-26 and this encoder is one of the artifacts +> it required. +> +> That settles the specification and **nothing else**. `adoption-evidenced` is +> **false** — no substrate computes references under CNP-0-JCS today — and +> `interop-confirmed` is **false** — this probe contains one reference encoder +> plus code paths by the same author, which is not an independently maintained +> implementation. Neither state blocks A3, and A3 being closed moves neither. ## Question @@ -25,7 +29,8 @@ reports exactly which part it did not build. §5.1.3 was restated on 2026-08-26 into two levels. A3 now asks for the contract, the corpus, a reference encoder, a verifier-only path sharing no code with it, a -reproducible conformance kit, and steward ratification. Two independently +reproducible conformance kit, and steward ratification — **all six exist, and the +steward ratified A3 on 2026-08-26** (Part 07 §17). Two independently maintained encoders moved up to `interop-confirmed`, which does not block A3. For this probe that changes one thing: the missing item is now the **conformance kit**, which is packaging work over what is already here, rather than an outside @@ -253,8 +258,9 @@ Warrant's implementation as prior evidence — that evidence covers the ## What this probe does not establish -- **Not ratification of the conformance kit.** The kit A3 requires now exists - as a candidate at `conformance/cnp-0-jcs-v0/`, projected from this corpus. +- **Not adoption, and not independent interoperability.** A3 is ratified; both + of those are separate states and both are false. The kit A3 required is at + `conformance/cnp-0-jcs-v0/`, projected from this corpus. `ts/conformance_cli.ts` exposes this encoder behind the kit's interface and scores 126/126, which shows the corpus is satisfiable by a real program — but the encoder and the corpus were written by the same hand, so agreement there diff --git a/src/x8F88_external_surfaces.myc.md b/src/x8F88_external_surfaces.myc.md index af813ae6..108a506b 100644 --- a/src/x8F88_external_surfaces.myc.md +++ b/src/x8F88_external_surfaces.myc.md @@ -38,7 +38,7 @@ Run `./t external-surfaces --json` for live cache counts, or | compatibility abi | [README.md](../README.md) | compatibility | src/x88E0_readme_bootstrap.myc.md | keep | symlink shim | | compatibility abi | [SKILLS.md](../SKILLS.md) | compatibility | src/x8CF0_skills_bootstrap.myc.md | keep | symlink shim | | compatibility abi | [contracts/AUTONOMY_MANDATE.v1.md](../contracts/AUTONOMY_MANDATE.v1.md) | compatibility | | keep | draft status | -| compatibility abi | [contracts/CANONICAL_ENCODING.v0.1.md](../contracts/CANONICAL_ENCODING.v0.1.md) | compatibility | | keep | draft status | +| compatibility abi | [contracts/CANONICAL_ENCODING.v0.1.md](../contracts/CANONICAL_ENCODING.v0.1.md) | compatibility | | keep | active contract | | compatibility abi | [contracts/CANONICAL_HASH.v0.1.md](../contracts/CANONICAL_HASH.v0.1.md) | compatibility | | keep | active contract | | compatibility abi | [contracts/CHORD_CLAIM.v0.1.md](../contracts/CHORD_CLAIM.v0.1.md) | compatibility | | keep | active contract | | compatibility abi | [contracts/CODEICIDE_PROPOSAL.v0.1.md](../contracts/CODEICIDE_PROPOSAL.v0.1.md) | compatibility | | keep | draft status |