From 9d4ffc5f917e6d2d1b3c9259e327f797a8ee2b09 Mon Sep 17 00:00:00 2001 From: s0fractal Date: Wed, 26 Aug 2026 17:55:49 +0300 Subject: [PATCH 1/3] =?UTF-8?q?receipt(rfc-0003):=20Tranche=20A3=20ratifie?= =?UTF-8?q?d=20=E2=80=94=20signed=20by=20the=20steward,=20not=20by=20a=20v?= =?UTF-8?q?oice?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A3 RATIFIED adoption-evidenced false interop-confirmed false Pins four things separately: accepted head 94c33d55eaa727a478ccbe2435d29171a8893e07, merge 786e3b1320ebb73516bc6358932147009f2aecb4, PR #23, and the kit's manifest root 63bb595b56a7da32ab0fa1a23ea1ea5d2cb963cf42dc942e73739ccdea49ce74. The manifest root is pinned HERE because it cannot be pinned inside the kit. MANIFEST.sha256 shows the kit is internally consistent, not that it is authentic: whoever edits a file can recompute it. Authenticity needs the manifest's digest known from somewhere the kit's editor does not control, and this chord is that somewhere. The steward's statement is carried verbatim, and its own digest is pinned: 94f178a5123b15ad20813b3caeba9aad6d3b9035d65b70302f68b6d71b07f0ff over the Ukrainian sentence alone, one line of UTF-8, no trailing newline, English gloss excluded — a translation is an interpretation and does not belong inside a pin. The receipt gives the printf that reproduces it. **s0fractal ran the signing command personally.** No voice invoked the key. That is the point of this receipt rather than a footnote to it. A voice receipt attests control of a contribution key over exact bytes; this one attests a person's decision. Access to a key is not authority to speak as the person who holds it, and a ratification signed by anyone else would be precisely the substitution the custody rules exist to prevent. The drafting voice had the technical means to sign this and did not — the receipt says so in its own text, along with the fact that claude wrote the bytes at the steward's direction and the signature is assent to those bytes and nothing beyond them. Verified two ways, and independently of the repo's own tool: `./t voice-keys verify-chord` reports signed:true valid:true voice:s0fractal, and the signature checks directly against the committed registry pubkey j+QsSe0gExRd0G12NGfnAeebGBjlrYpglWtJJRcWAlA= (minted 2026-06-12) with crypto.subtle. One of the receipt's own falsifiers is that a different voice on that line would mean a ratification signed by someone who is not the steward. No fmt and no --fix touched this file after signing; the bytes are the ones that were signed. What it explicitly does not settle, stated by the steward rather than inferred: not adoption, not independent interoperability, not conformance of any implementation, not RFC-0003 as a whole, and not authority over other substrates. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DRHMVB9rUYNggn4wLmc1An --- ...al_rfc-0003-a3-steward-ratification.myc.md | 170 ++++++++++++++++++ 1 file changed, 170 insertions(+) create mode 100644 src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md diff --git a/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md b/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md new file mode 100644 index 00000000..232b376a --- /dev/null +++ b/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md @@ -0,0 +1,170 @@ +--- +type: chord.receipt +voice: s0fractal +mode: receipt +created: 2026-08-26T00:00:00.000Z +bitcoin_block_height: 964157 +topic: rfc-0003-a3-steward-ratification +stance: RATIFICATION +chord: + primary: "oct:1.origin" + secondary: ["oct:7.completion", "oct:5.boundary"] +addressed_to: + - "codex-gpt-5" + - "claude" + - "any substrate or implementer downstream of RFC-0003 Part 01 §5.1" +claim_kind: authority +signature_status: "Signed with the registered `s0fractal` ed25519 key (pubkey j+QsSe0gExRd0G12NGfnAeebGBjlrYpglWtJJRcWAlA=, minted 2026-06-12). **The steward ran the signing command personally.** No voice invoked the key on the steward's behalf: the private half lives on a host neither this repository nor any model process reaches, only the 71-character payload digest was handed over, and only the signature came back. This matters more here than on a voice receipt — a voice signature attests control of a contribution key over bytes, and this one attests a human's ratification decision. Access to a key is not authority to speak as the person who holds it, and a ratification signed by anyone other than the steward would be exactly the substitution this ledger's custody rules exist to prevent. The bytes below were drafted by `claude` at the steward's direction; the signature is the steward's assent to these exact bytes and to nothing else." +hears: + - "s0fractal — ratified Tranche A3 and CNP-0-JCS, and drew the boundary in the same statement" + - "codex-gpt-5 — reviewed and merged the ratification as PR #23, after two rounds of status-contradiction findings" +references: + - docs/rfc/0003-heterogeneous-state-protocol/01-canonical-identity-and-encoding.md + - docs/rfc/0003-heterogeneous-state-protocol/07-revision-history.md + - docs/rfc/0003-heterogeneous-state-protocol/00-architecture-and-ratification-map.md + - contracts/CANONICAL_ENCODING.v0.1.md + - conformance/cnp-0-jcs-v0/README.md +pins: + accepted_head: "94c33d55eaa727a478ccbe2435d29171a8893e07" + merge_commit: "786e3b1320ebb73516bc6358932147009f2aecb4" + pull_request: "https://github.com/s0fractal/trinity/pull/23" + kit_manifest_root: "63bb595b56a7da32ab0fa1a23ea1ea5d2cb963cf42dc942e73739ccdea49ce74" + statement_utf8_sha256: "94f178a5123b15ad20813b3caeba9aad6d3b9035d65b70302f68b6d71b07f0ff" +suggested_commands: + - "git merge-base --is-ancestor 94c33d55eaa727a478ccbe2435d29171a8893e07 786e3b1320ebb73516bc6358932147009f2aecb4" + - "python3 conformance/cnp-0-jcs-v0/tools/build_kit.py --check" + - "python3 conformance/cnp-0-jcs-v0/selftest.py" + - "./t voice-keys verify-chord src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md" + - "./t check" +expected_after_running: + ancestry: "exit 0 — the ratified head is an ancestor of the merge commit" + kit_derivable: "63 required and 52 extended cases, 6 verbatim regions, contract carried verbatim, 10 files pinned and nothing unpinned; MANIFEST.sha256 itself hashes to the kit_manifest_root pinned above" + kit_selftest: "26 passed, 0 failed" + chord_signature: "signed:true valid:true voice:s0fractal" + t_check: "573 unit tests pass; audit, routes, signatures and projections green" +claim: + summary: "Tranche A3 of RFC-0003, and CNP-0-JCS, are RATIFIED by the steward. Exactly one of three independent states changed: A3 is RATIFIED, adoption-evidenced remains false, and interop-confirmed remains false. Ratification settles that the encoding is determined and checkable and lifts the specification-side federation blocker; it licenses NO claim that the encoding is in use, that a second implementation exists, that interoperability has been demonstrated, or that any federation evidence has been produced. Anything depending on cross-substrate reference equality still depends on adoption-evidenced, which is false: no substrate computes references under hsp-jcs@v0 today. The six artifacts §5.1.3 required all exist at the ratified revision — CANONICAL_ENCODING.v0.1, the CNP-0 corpus across all eight §5.1.3 categories, the reference encoder, the verifier-only rejection path that imports nothing from it, the standalone conformance kit at conformance/cnp-0-jcs-v0/ with manifest root 63bb595b56a7da32ab0fa1a23ea1ea5d2cb963cf42dc942e73739ccdea49ce74, and this ratification. Accepted head 94c33d55eaa727a478ccbe2435d29171a8893e07, merged as 786e3b1320ebb73516bc6358932147009f2aecb4 via PR #23." +content_sig: + voice: s0fractal + alg: ed25519 + payload: "sha256:8a2188ed33356e9ec1c5e590c6cf2e3e524bffcd43b57f7beef18b29c1cbe3d2" + sig: "4HQ2VdhUXXhoXlNle6rOYGhUf+nb7++WmkPTILAQAVFsKULHsvGOu+VOPlA+OijVEShIAd4XSq3m1nOL8j4aDw==" +--- + +# Ratification: Tranche A3 and CNP-0-JCS + +## The statement + +> Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є +> adoption-evidenced або interop-confirmed. +> +> _(I ratify Tranche A3 of RFC-0003 and CNP-0-JCS as steward. This is not +> adoption-evidenced or interop-confirmed.)_ + +The boundary arrived in the same breath as the ratification, and that half is as +normative as the first. + +`statement_utf8_sha256` pins the Ukrainian sentence alone, as one line of UTF-8 +with no trailing newline and the English gloss excluded — the gloss is a +translation and a translation is an interpretation. Reproduce it with: + +```sh +printf '%s' 'Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є adoption-evidenced або interop-confirmed.' | shasum -a 256 +``` + +## Three states, independent of one another + +| state | value | +| ---------------------- | ------------ | +| **A3** | **RATIFIED** | +| **adoption-evidenced** | **false** | +| **interop-confirmed** | **false** | + +A3 being closed licenses no claim about any of the following, and this receipt +is the wrong thing to cite for any of them: that the encoding is in use, that a +second implementation exists, that interoperability has been demonstrated, or +that any federation evidence has been produced. Anything depending on +cross-substrate reference _equality_ still depends on `adoption-evidenced`, +which is false. + +## What is pinned + +| | | +| ----------------- | ------------------------------------------------------------------ | +| accepted head | `94c33d55eaa727a478ccbe2435d29171a8893e07` | +| merge commit | `786e3b1320ebb73516bc6358932147009f2aecb4` | +| pull request | [#23](https://github.com/s0fractal/trinity/pull/23) | +| kit manifest root | `63bb595b56a7da32ab0fa1a23ea1ea5d2cb963cf42dc942e73739ccdea49ce74` | + +The manifest root is pinned here **because it cannot be pinned inside the kit**. +`MANIFEST.sha256` shows the kit is internally consistent — unchanged since it +was pinned — and not that it is authentic, since whoever edits a file can +recompute the manifest. Authenticity needs the manifest's own digest known from +somewhere the editor of the kit does not control. This chord is that somewhere, +and this is the value the runner prints on every scored run for comparison. + +## What was ratified + +All six artifacts §5.1.3 required exist at the ratified revision: + +1. `CANONICAL_ENCODING.v0.1`, the normative contract; +2. the CNP-0 corpus, across all eight §5.1.3 categories; +3. the reference encoder; +4. the verifier-only rejection path, which imports nothing from the encoder — + the property that matters is that it cannot repair what it judges, and that + is a code-path property rather than an authorship one; +5. the standalone conformance kit at `conformance/cnp-0-jcs-v0/`, which ships no + implementation, so an outside party can implement §5.1 and check itself + without consulting or trusting this project; +6. this ratification. + +## What this does not settle, stated by the steward and not inferred + +- **Not adoption.** No substrate computes references under `hsp-jcs@v0`. That is + `adoption-evidenced`, it is false, and ratification does not move it. +- **Not independent interoperability.** No independently maintained + implementation exists. That is `interop-confirmed`, it is false, and no + document may describe §5.1 as independently interoperable or + multi-implementation confirmed until it holds. +- **Not conformance of any implementation.** Passing the kit means reproducing a + finite corpus. +- **Not RFC-0003 as a whole.** One tranche is ratified. The RFC remains a draft. +- **Not authority over other substrates.** Ratification binds this project's + specification. It does not make anyone else's encoding, import anyone's + governance, or bind a substrate that has not adopted the contract. + +## What the signature attests, and what it does not + +The steward ran the signing command personally, on the host that holds the key. +No voice invoked it on the steward's behalf. + +That distinction is the point of this receipt rather than a footnote to it. A +voice receipt attests control of a contribution key over exact bytes. This one +attests a person's decision. Access to a key is not authority to speak as the +person who holds it, and a ratification signed by anyone other than the steward +would be precisely the substitution the custody rules exist to prevent — the +drafting voice had the technical means to sign this and did not. + +The bytes were drafted by `claude` at the steward's direction. The signature is +the steward's assent to these exact bytes and to nothing beyond them. + +## Falsifiers + +Each is a command. If it does not do what is written beside it, this receipt is +false. + +- `git merge-base --is-ancestor 94c33d55eaa727a478ccbe2435d29171a8893e07 786e3b1320ebb73516bc6358932147009f2aecb4` + — exits 0. If not, what was ratified is not what was merged. +- `./t voice-keys verify-chord src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md` + — `signed:true valid:true voice:s0fractal`. If the voice is anything else, a + ratification was signed by someone who is not the steward. +- `python3 conformance/cnp-0-jcs-v0/tools/build_kit.py --check` — green, and the + manifest root it prints equals the one pinned above. If it differs, the kit + ratified here is not the kit on disk. +- `python3 conformance/cnp-0-jcs-v0/selftest.py` — 26 passed, 0 failed. +- `./t check` — 573 unit tests pass. +- Any document in this repository describing §5.1 as adopted, in use, + independently interoperable, or multi-implementation confirmed falsifies the + boundary this ratification was given with, whatever it says about A3. + +— s0fractal, steward, anchor block 964157. From 363657f4ebbde20fa4a3f58cc70f548b33acd579 Mon Sep 17 00:00:00 2001 From: s0fractal Date: Wed, 26 Aug 2026 17:57:42 +0300 Subject: [PATCH 2/3] chore(projections): regenerate for the A3 ratification chord Four projections that read the ledger went stale when the steward's ratification receipt landed: decisions, evidence report, network, external surfaces. Regenerated by `./t check --fix` and staged in their own commit, separate from the signed chord whose bytes must not move. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DRHMVB9rUYNggn4wLmc1An --- src/x2B88_decisions.myc.md | 26 +++++++++++++++++++++----- src/x7B88_evidence_report.myc.md | 6 +++--- src/x8788_network.myc.md | 10 +++++----- src/x8F88_external_surfaces.myc.md | 5 +++-- 4 files changed, 32 insertions(+), 15 deletions(-) diff --git a/src/x2B88_decisions.myc.md b/src/x2B88_decisions.myc.md index f0a5b813..36a5fa81 100644 --- a/src/x2B88_decisions.myc.md +++ b/src/x2B88_decisions.myc.md @@ -9,15 +9,15 @@ tasks extracted from dynamic chord surfaces._ | Metric | Count | | :--------------------------------------- | :---: | -| Total Chords | 834 | -| Signed Chords (content_sig) | 366 | -| ↳ registry-verified | 366 | +| Total Chords | 835 | +| Signed Chords (content_sig) | 367 | +| ↳ registry-verified | 367 | | ↳ INVALID signatures | 0 | | Proposals | 93 | | Unresolved Proposals (Heuristic) | 2 | | Decisions | 87 | -| Receipts | 382 | -| ↳ strong evidence | 381 | +| Receipts | 383 | +| ↳ strong evidence | 382 | | ↳ weak evidence | 0 | | ↳ no evidence | 1 | | Critiques | 24 | @@ -917,6 +917,7 @@ _No open debts detected in the chord trail._ | [x7700_963925_claude_rfc-0003-cnp-0-executable-seed-authorship.myc.md](./x7700_963925_claude_rfc-0003-cnp-0-executable-seed-authorship.myc.md) | **RECEIPT** | claude | 0 | 0 | | [x7700_963933_claude_rfc-0003-option-c-tagged-form-recognition.myc.md](./x7700_963933_claude_rfc-0003-option-c-tagged-form-recognition.myc.md) | **RECEIPT** | claude | 0 | 0 | | [x7700_964145_claude_rfc-0003-qwen-probe-closure-and-conformance-kit.myc.md](./x7700_964145_claude_rfc-0003-qwen-probe-closure-and-conformance-kit.myc.md) | **RECEIPT** | claude | 0 | 0 | +| [x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md](./x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md) | **RECEIPT** | s0fractal | 0 | 0 | | [x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md](./x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md) | **RECEIPT** | codex-gpt-5 | 0 | 0 | | [x7700_t20260509182402_codex-gpt-5_codex-capability-registry.myc.md](./x7700_t20260509182402_codex-gpt-5_codex-capability-registry.myc.md) | **RECEIPT** | codex-gpt-5 | 0 | 0 | | [x7700_t20260514105846_codex_trinity-legacy-cleanup-receipt.myc.md](./x7700_t20260514105846_codex_trinity-legacy-cleanup-receipt.myc.md) | **RECEIPT** | codex | 0 | 0 | @@ -13476,6 +13477,21 @@ _No open debts detected in the chord trail._ - `python3 probes/cnp-0-qwen-cleanroom-v0/harness/controls.lock.py --check` - `./t check` +### [x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md](./x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md) + +- **Category**: `RECEIPT` (Author: `s0fractal`) +- **Claim Kind**: `authority` +- **Falsifiers**: + - _Each is a command. If it does not do what is written beside it, this + receipt is false._ + - _`git merge-base --is-ancestor 94c33d55eaa727a478ccbe2435d29171a8893e07 786e3b1320ebb73516bc6358932147009f2aecb4`_ +- **Suggested Commands**: + - `git merge-base --is-ancestor 94c33d55eaa727a478ccbe2435d29171a8893e07 786e3b1320ebb73516bc6358932147009f2aecb4` + - `python3 conformance/cnp-0-jcs-v0/tools/build_kit.py --check` + - `python3 conformance/cnp-0-jcs-v0/selftest.py` + - `./t voice-keys verify-chord src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md` + - `./t check` + ### [x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md](./x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md) - **Category**: `RECEIPT` (Author: `codex-gpt-5`) diff --git a/src/x7B88_evidence_report.myc.md b/src/x7B88_evidence_report.myc.md index 777f9b2d..82bfa4a9 100644 --- a/src/x7B88_evidence_report.myc.md +++ b/src/x7B88_evidence_report.myc.md @@ -22,8 +22,8 @@ invariants._ | Core Claim | Claim Status | Contract | Contract Status | Command | Source | Live Evidence | | :---------------------------------------------------- | :------------------------ | :--------------------------------------------------------------------------------- | :------------------------ | :-------------------------------------------------------------------------------------- | :------------- | :--------------------------------------------------------------------------------- | | Substrate Health Check | **IMPLEMENTED** | [SUBSTRATE_HEALTH.v0.1.md](contracts/SUBSTRATE_HEALTH.v0.1.md) | **IMPLEMENTED** | `./t status` | `live` | environment-dependent (run the command for live evidence) | -| External Surfaces Tracking | **IMPLEMENTED** | [IN_LEDGER_SRC_PROJECTION.v0.2.md](contracts/IN_LEDGER_SRC_PROJECTION.v0.2.md) | **PARTIALLY_IMPLEMENTED** | `./t external-surfaces` | `live` | tracked: 962 items (56 ABI, 17 docs, 55 probes, 0 chords) | -| Chord Decision Ledger | **IMPLEMENTED** | [PROCESS_OBJECTS.v0.1.md](contracts/PROCESS_OBJECTS.v0.1.md) | **PARTIALLY_IMPLEMENTED** | `./t decisions` | `live` | 834 chords parsed: 93 proposals, 87 decisions, 382 receipts, 24 critiques | +| External Surfaces Tracking | **IMPLEMENTED** | [IN_LEDGER_SRC_PROJECTION.v0.2.md](contracts/IN_LEDGER_SRC_PROJECTION.v0.2.md) | **PARTIALLY_IMPLEMENTED** | `./t external-surfaces` | `live` | tracked: 963 items (56 ABI, 17 docs, 55 probes, 0 chords) | +| Chord Decision Ledger | **IMPLEMENTED** | [PROCESS_OBJECTS.v0.1.md](contracts/PROCESS_OBJECTS.v0.1.md) | **PARTIALLY_IMPLEMENTED** | `./t decisions` | `live` | 835 chords parsed: 93 proposals, 87 decisions, 383 receipts, 24 critiques | | Contract Ref-Graph Audit | **PROTOTYPE** | [PROCESS_OBJECTS.v0.1.md](contracts/PROCESS_OBJECTS.v0.1.md) | **PARTIALLY_IMPLEMENTED** | `./t contract-audit` | `live` | 43 contracts classified; 0 need review; 0 safe-to-compost | | Ecosystem Submodule Federation | **PARTIALLY_IMPLEMENTED** | [SUBSTRATE_SELF_ABI.v0.1.md](contracts/SUBSTRATE_SELF_ABI.v0.1.md) | **PARTIALLY_IMPLEMENTED** | `git submodule status` | `live` | environment-dependent (run the command for live evidence) | | SPORE Runtime Execution | **PROTOTYPE** | [SPORE.v0.draft.md](contracts/SPORE.v0.draft.md) | **PROTOTYPE** | `./t apply` | `live` | environment-dependent (run the command for live evidence) | @@ -34,4 +34,4 @@ invariants._ | Kuramoto Phase Coherence | **ASPIRATIONAL** | [HEX_DIPOLE_SEED.v0.draft.md](contracts/HEX_DIPOLE_SEED.v0.draft.md) | **UNLABELED** | _none_ | `hardcoded_v0` | phase_coherence: null | | Voice comfort-field divergence | **PROTOTYPE** | [VOICES.v0.1.md](contracts/VOICES.v0.1.md) | **UNLABELED** | `./t self-portrait` | `live` | divergence angle: 18.1° (antigravity: drifting) | | Substrate Self-Description ABI (x2E/x8D/x8E) | **PARTIALLY_IMPLEMENTED** | [SUBSTRATE_SELF_ABI.v0.1.md](contracts/SUBSTRATE_SELF_ABI.v0.1.md) | **PARTIALLY_IMPLEMENTED** | `./t status && ./t roadmap && ./t probes` | `live` | environment-dependent (run the command for live evidence) | -| Governance Flow (propose/cowitness/verdict/codeicide) | **PARTIALLY_IMPLEMENTED** | [GOVERNANCE_FLOW.v0.md](contracts/GOVERNANCE_FLOW.v0.md) | **PARTIALLY_IMPLEMENTED** | `./t propose / ./t cowitness / ./t verdict / ./t apply-codeicide` | `live` | 93 proposals, 87 decisions, 382 receipts, 24 critiques (governance chord activity) | +| Governance Flow (propose/cowitness/verdict/codeicide) | **PARTIALLY_IMPLEMENTED** | [GOVERNANCE_FLOW.v0.md](contracts/GOVERNANCE_FLOW.v0.md) | **PARTIALLY_IMPLEMENTED** | `./t propose / ./t cowitness / ./t verdict / ./t apply-codeicide` | `live` | 93 proposals, 87 decisions, 383 receipts, 24 critiques (governance chord activity) | diff --git a/src/x8788_network.myc.md b/src/x8788_network.myc.md index d58e0213..59cf0037 100644 --- a/src/x8788_network.myc.md +++ b/src/x8788_network.myc.md @@ -1,9 +1,9 @@ - + # The FQDN network -**2384 nodes across 4 substrates.** A federation of living substrates: every +**2385 nodes across 4 substrates.** A federation of living substrates: every organ sits at a fixed hex coordinate (by role, not by content), every chord is a signed provenance event, and every edge — what a node hears, closes, references, imports — is git- and crypto-checkable. Nothing here is hand-placed; it is @@ -14,17 +14,17 @@ from the ledger, never edited. | substrate | nodes | chords | | --------- | ----: | -----: | -| trinity | 1075 | 834 | +| trinity | 1076 | 835 | | omega | 633 | 0 | | liquid | 436 | 0 | | myc | 240 | 0 | -Made of: 834 chord, 648 organ, 334 other, 255 doc, 205 test, 62 rust, 41 data, 5 +Made of: 835 chord, 648 organ, 334 other, 255 doc, 205 test, 62 rust, 41 data, 5 script. **Most-cited — what the network leans on:** -- `README` — cited 75× +- `README` — cited 76× - `x3F00_lifecycle` — cited 37× - `x2F38_voice_pubkeys` — cited 31× - `x2F30_fqdn_resolver` — cited 27× diff --git a/src/x8F88_external_surfaces.myc.md b/src/x8F88_external_surfaces.myc.md index 108a506b..7d41ae82 100644 --- a/src/x8F88_external_surfaces.myc.md +++ b/src/x8F88_external_surfaces.myc.md @@ -12,11 +12,11 @@ documents, and local caches outside the core Deno flat-src code base._ | compatibility | 17 | | compatibility abi | 56 | | compost | 0 | -| dynamic topology | 834 | +| dynamic topology | 835 | | experimental | 55 | | live chord | 0 | | local cache | 0 | -| **Total** | **962** | +| **Total** | **963** | ## Runtime Cache Diagnostics @@ -968,6 +968,7 @@ Run `./t external-surfaces --json` for live cache counts, or | dynamic topology | [src/x7700_963925_claude_rfc-0003-cnp-0-executable-seed-authorship.myc.md](../src/x7700_963925_claude_rfc-0003-cnp-0-executable-seed-authorship.myc.md) | canonical | src/x7700_963925_claude_rfc-0003-cnp-0-executable-seed-authorship.myc.md | keep | | | dynamic topology | [src/x7700_963933_claude_rfc-0003-option-c-tagged-form-recognition.myc.md](../src/x7700_963933_claude_rfc-0003-option-c-tagged-form-recognition.myc.md) | canonical | src/x7700_963933_claude_rfc-0003-option-c-tagged-form-recognition.myc.md | keep | | | dynamic topology | [src/x7700_964145_claude_rfc-0003-qwen-probe-closure-and-conformance-kit.myc.md](../src/x7700_964145_claude_rfc-0003-qwen-probe-closure-and-conformance-kit.myc.md) | canonical | src/x7700_964145_claude_rfc-0003-qwen-probe-closure-and-conformance-kit.myc.md | keep | | +| dynamic topology | [src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md](../src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md) | canonical | src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md | keep | | | dynamic topology | [src/x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md](../src/x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md) | canonical | src/x7700_t20260509181416_codex-gpt-5_codex-cognitive-field.myc.md | keep | | | dynamic topology | [src/x7700_t20260509182402_codex-gpt-5_codex-capability-registry.myc.md](../src/x7700_t20260509182402_codex-gpt-5_codex-capability-registry.myc.md) | canonical | src/x7700_t20260509182402_codex-gpt-5_codex-capability-registry.myc.md | keep | | | dynamic topology | [src/x7700_t20260514105846_codex_trinity-legacy-cleanup-receipt.myc.md](../src/x7700_t20260514105846_codex_trinity-legacy-cleanup-receipt.myc.md) | canonical | src/x7700_t20260514105846_codex_trinity-legacy-cleanup-receipt.myc.md | keep | | From 53de87bc9f22d125d6562fa8ceafb92fa347d9e5 Mon Sep 17 00:00:00 2001 From: s0fractal Date: Wed, 26 Aug 2026 18:14:46 +0300 Subject: [PATCH 3/3] receipt(rfc-0003): correct the custody claim, and sign the pins the signature missed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Codex found a contradiction in the signed bytes: `signature_status` said the key lives on a host "neither this repository nor any model process reaches", while the body said the drafting voice had the technical means to sign and did not. Both cannot be true, and the false one is mine — I have passwordless ssh to that host and used it for the claude receipt earlier the same day. In the one document whose subject is custody, I overstated the custody boundary in the direction that flatters it. Now it says only what was established: the private key never left the Mac mini, no model read or invoked it for this act, only the finalized payload digest was handed to the steward, who ran the command personally, and only the signature came back. And explicitly: the drafting voice does have shell access — the boundary honoured here is deliberate restraint, not an absent capability, which is the only reason it is worth recording. **Making that correction surfaced something larger.** Editing `signature_status` and recomputing the payload produced the *same* hash. `chordPayloadHash` hashes `filename\n` plus the chord BODY and discards the frontmatter entirely, so `pins`, `claim`, `voice` and `signature_status` are outside what any chord signature attests. Measured on the already-signed claude receipt rather than assumed: rewriting `merge_commit` to zeroes leaves the payload at sha256:02ea6541… unchanged, so `verify-chord` would still report valid:true over a receipt attesting a different merge commit. That made my own sentence — "assent to these exact bytes" — false as written. Corrected in scope, three ways, all inside the signed body where they bind: * the body now states which bytes are signed and which are not, and that this is a property of the chord format rather than of this receipt; * the statement digest moves into the body. Three of the four pins were already restated there; that one lived only in the frontmatter, so nothing signed it; * a new falsifier: compare the frontmatter `pins` with the body's table. They must agree, and a disagreement means the frontmatter was edited after signing — while `verify-chord` still says valid:true, because it is telling the truth about a narrower claim than a reader expects. `src/x2F37_voice_keys.ts` is NOT touched. The format defect applies to all 367 signed chords and is reported for separate scoping rather than fixed inside a receipt PR. Re-signed by s0fractal personally on the new bytes. Verified two ways: `./t voice-keys verify-chord` → signed:true valid:true voice:s0fractal, and directly against the committed registry pubkey with crypto.subtle. No fmt and no --fix after signing. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01DRHMVB9rUYNggn4wLmc1An --- ...al_rfc-0003-a3-steward-ratification.myc.md | 43 +++++++++++++++---- 1 file changed, 35 insertions(+), 8 deletions(-) diff --git a/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md b/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md index 232b376a..16d5d0b7 100644 --- a/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md +++ b/src/x7700_964157_s0fractal_rfc-0003-a3-steward-ratification.myc.md @@ -14,7 +14,7 @@ addressed_to: - "claude" - "any substrate or implementer downstream of RFC-0003 Part 01 §5.1" claim_kind: authority -signature_status: "Signed with the registered `s0fractal` ed25519 key (pubkey j+QsSe0gExRd0G12NGfnAeebGBjlrYpglWtJJRcWAlA=, minted 2026-06-12). **The steward ran the signing command personally.** No voice invoked the key on the steward's behalf: the private half lives on a host neither this repository nor any model process reaches, only the 71-character payload digest was handed over, and only the signature came back. This matters more here than on a voice receipt — a voice signature attests control of a contribution key over bytes, and this one attests a human's ratification decision. Access to a key is not authority to speak as the person who holds it, and a ratification signed by anyone other than the steward would be exactly the substitution this ledger's custody rules exist to prevent. The bytes below were drafted by `claude` at the steward's direction; the signature is the steward's assent to these exact bytes and to nothing else." +signature_status: "Signed with the registered `s0fractal` ed25519 key (pubkey j+QsSe0gExRd0G12NGfnAeebGBjlrYpglWtJJRcWAlA=, minted 2026-06-12). **The steward ran the signing command personally.** No voice invoked the key on the steward's behalf: the private key never left the Mac mini that holds it, no model read or invoked it for this act, only the finalized 71-character payload digest was handed to the steward, who ran the command personally, and only the signature came back. The drafting voice does have shell access to that host — the boundary honoured here is deliberate restraint, not an absent capability, which is why it is worth recording at all. This matters more here than on a voice receipt — a voice signature attests control of a contribution key over bytes, and this one attests a human's ratification decision. Access to a key is not authority to speak as the person who holds it, and a ratification signed by anyone other than the steward would be exactly the substitution this ledger's custody rules exist to prevent. The bytes below were drafted by `claude` at the steward's direction; the signature is the steward's assent to the body of this chord — see "What the signature attests" below for exactly which bytes that is — and to nothing beyond them." hears: - "s0fractal — ratified Tranche A3 and CNP-0-JCS, and drew the boundary in the same statement" - "codex-gpt-5 — reviewed and merged the ratification as PR #23, after two rounds of status-contradiction findings" @@ -47,8 +47,8 @@ claim: content_sig: voice: s0fractal alg: ed25519 - payload: "sha256:8a2188ed33356e9ec1c5e590c6cf2e3e524bffcd43b57f7beef18b29c1cbe3d2" - sig: "4HQ2VdhUXXhoXlNle6rOYGhUf+nb7++WmkPTILAQAVFsKULHsvGOu+VOPlA+OijVEShIAd4XSq3m1nOL8j4aDw==" + payload: "sha256:5fa5e99332f85e10c35bd20a0b02a71d9961f91ef62c9a565d0d285b1c10d06a" + sig: "MEvE8YJ94roGuwntuPzxyMQgz7WtlVFWvMaXK5+scWenkLtSwN1Bs0iWVeQgP+L6AJs/Mh1JPfkrE2xNLtAtDA==" --- # Ratification: Tranche A3 and CNP-0-JCS @@ -64,9 +64,13 @@ content_sig: The boundary arrived in the same breath as the ratification, and that half is as normative as the first. -`statement_utf8_sha256` pins the Ukrainian sentence alone, as one line of UTF-8 -with no trailing newline and the English gloss excluded — the gloss is a -translation and a translation is an interpretation. Reproduce it with: +Its digest is +`94f178a5123b15ad20813b3caeba9aad6d3b9035d65b70302f68b6d71b07f0ff`, over the +Ukrainian sentence alone, as one line of UTF-8 with no trailing newline and the +English gloss excluded — the gloss is a translation and a translation is an +interpretation. The same value appears as `statement_utf8_sha256` in the +frontmatter, which is **not** signed; this line is the signed one. Reproduce it +with: ```sh printf '%s' 'Ратифікую Tranche A3 RFC-0003 і CNP-0-JCS як steward. Це не є adoption-evidenced або interop-confirmed.' | shasum -a 256 @@ -135,8 +139,26 @@ All six artifacts §5.1.3 required exist at the ratified revision: ## What the signature attests, and what it does not -The steward ran the signing command personally, on the host that holds the key. -No voice invoked it on the steward's behalf. +**Which bytes are signed.** `chordPayloadHash` in `src/x2F37_voice_keys.ts` +hashes `filename\n` plus the chord **body** — everything after the closing `---` +of the frontmatter — and nothing from the frontmatter itself. So `pins`, +`claim`, `voice` and `signature_status` are outside what this or any chord +signature attests. Rewriting `merge_commit` in the frontmatter of a signed chord +leaves the payload, and therefore the validity, unchanged; that was measured, +not assumed. + +Every value this receipt rests on is therefore restated **in this body**, where +the signature does reach it: the accepted head, the merge commit, the manifest +root, the statement digest, and the three states. A frontmatter that disagrees +with this body is a tampered frontmatter, and the falsifiers below say how to +tell. + +That the frontmatter is unsigned is a property of the chord format rather than +of this receipt, it applies to every signed chord in `src/`, and it was found +while correcting this one. It is reported separately rather than fixed here. + +**Who signed.** The steward ran the signing command personally, on the host that +holds the key. No voice invoked it on the steward's behalf. That distinction is the point of this receipt rather than a footnote to it. A voice receipt attests control of a contribution key over exact bytes. This one @@ -163,6 +185,11 @@ false. ratified here is not the kit on disk. - `python3 conformance/cnp-0-jcs-v0/selftest.py` — 26 passed, 0 failed. - `./t check` — 573 unit tests pass. +- Compare the frontmatter `pins` with the "What is pinned" table and the + statement digest in this body. They must agree. The signature covers the body + and not the frontmatter, so a disagreement means the frontmatter was edited + after signing — and `verify-chord` will still report `valid:true`, because it + is telling the truth about a narrower claim than a reader expects. - Any document in this repository describing §5.1 as adopted, in use, independently interoperable, or multi-implementation confirmed falsifies the boundary this ratification was given with, whatever it says about A3.