{ "schema_version": "1.0.0", "inventory_id": "hive.canon.service-operations", "revision": "2026-09-12.1", "title": "Hive Service Operation Readiness Inventory", "kind": "operation_readiness_inventory", "counts_as_receipt_contract": false, "schema_path": "./operations.schema.json", "catalog_path": "./surface-map.json", "architecture_path": "./ARCHITECTURE.md", "reference_guide_path": "./reference/README.txt", "acceptance_record": "./reference-acceptance.json", "path_base": "directory_containing_operations_json", "scope": { "purpose": "Address audit finding A08 with operation-level discovery: distinguish actual fixed reference mechanisms from richer architecture targets. This is a static inventory, not the proposed runtime manifest or a service API.", "capability_label": "Target capabilities. Not all implemented by this reference.", "runtime_claim": "local_reference_and_specification_only", "production_status": "not_accepted", "integration_status": "not_accepted", "canonical_verifiers_exercised": false, "separate_party_authentication": false, "external_effects": false, "boundary": [ "The reference consumes its own hive.reference.* application formats using Hive Canon JSON v1. Linking selected canon components does not exercise their canonical receipt verifiers, establish conformance, or increase the primitive inventory.", "The only rule is local.release revision 1, with inspection and custody slots for party.a and party.b. Those party labels and the expected population are synthetic assertions, not authenticated external observations.", "The single acceptance object is a joint assertion inside one outer signed package. evaluateCase establishes revision/digest binding, not authentication; package verification authenticates only the synthetic operator assertion, not separate party consent.", "Evidence support is structural reference checking plus one deterministic evaluator, not semantic assessment, general transformation execution, or exact affected-subgraph recomputation.", "The gate controls one private in-memory event array. A local effect precedes an unsigned local receipt. Nonce history disappears on a new gate instance or process restart; there is no external effect endpoint or durable replay ledger.", "Ed25519 verification and a caller-selected demonstration trust policy are local mechanisms. A supplied key, selected as-of time, file manifest, or detached checksum is not independent authority.", "All proposed production resource APIs remain specified, not installed by this release. No accepted host, deployment, production adapter, named hired team, commercial entitlement, or performance promise is created by this inventory." ] }, "governance": { "accountable_role": "Hive service owner", "role_boundary": "An accountable release role, not evidence of a staffed or hired team. The Hive service owner must obtain the applicable canon, security, source, party, evaluator, effect, and recipient approvals before claiming those authorities or relationships.", "readiness_definitions": { "bounded_reference": "Executable reference code and relevant real test definitions exist for the explicitly limited mechanism. Test acceptance is tracked separately: this inventory's author did not execute those tests. The label alone asserts neither a passing run nor integrated, operational, or independent acceptance; a separate scoped reference-acceptance record may establish a tested reference without promoting production.", "specified": "The versioned architecture describes the mechanism and its acceptance requirements. No executable for that target operation is credited here; executable is null and test_evidence is empty." }, "evidence_policy": { "evidence_kind": "inspected_test_definitions", "runtime_tests_run_for_inventory": false, "test_outcomes_claimed": false, "acceptance_mapping_meaning": "Criterion IDs are traceability to surface-map.json and ARCHITECTURE.md, not passed results. Bounded test definitions cover only their stated analogue. Unimplemented target requirements and known reporting gaps remain unresolved.", "source_pin_meaning": "SHA-256 values identify the inspected reference source, schema, guide, and test definitions. They do not authenticate a release, pin every exported artifact, establish tester independence, or certify that a suite passed.", "production_promotion_allowed": false }, "promotion_requirements": [ "For a reference promotion, retain operation/profile scope, exact implementation and fixture/package digests, supported environment, procedure, expected and actual results, observed time, tester relationship, findings, accountable approval, and review trigger.", "A local test may qualify only its own bounded operation. A separately retained reference-acceptance record may qualify catalog tested_bounded_reference status for its exact scope without changing bounded_reference into a production claim. Never promote integration or production status from a passed local analogue, a static example, an archive download, a canonical card, or a schema validation.", "Integration acceptance separately requires authenticated source and authority enrollment, tenant/object access enforcement, permitted retention/disclosure, exact adapter/profile conformance, and controlled effect-boundary tests where applicable.", "Operational acceptance separately requires an accepted deployed revision and environment, controlled load and recovery evidence, incident/support procedures, retention/exit evidence, and authorized acceptance. No numerical commitment is set here.", "Independent exercise requires a qualified separate operator, recipient-selected challenge, declared scope, independently acquired checker/trust basis, reproducible retained evidence, and unresolved findings.", "New readiness states or changed meanings require a reviewed schema revision. The current closed enum deliberately cannot encode integrated, operational, or independently exercised acceptance." ], "review_triggers": [ "Changed executable, reference format, signed bytes, result semantics, fixture, checker, schema, or test definition requires rechecking affected entries and refreshing source pins.", "Changed rule, profile, source contract, graph dependency, trust policy, key epoch, authority, revocation/clock policy, effect boundary, or downstream recovery contract requires scope-specific reacceptance.", "Changed catalog capabilities, outputs, acceptance IDs, or selected canon dependencies requires regenerating the traceability mapping without claiming new implementation.", "A reporting or security finding blocks the affected claim until its correction and negative vectors are retained; do not treat this inventory as closure of other audit findings." ], "shared_acceptance_criteria": ["SH-01", "SH-02", "SH-03", "SH-04", "SH-05", "SH-06", "SH-07", "SH-08", "SH-09", "SH-10", "SH-11", "SH-12", "SH-13", "SH-14", "AX-01", "AX-15", "AX-16", "AX-18", "AX-19"], "shared_acceptance_scope": "These are cross-service release and integration gates, not additional operations. Preserve identities and source bytes; align six separate dimensions across views/export; expose unavailable or stale dependencies and lookup-versus-verification; keep synthetic scope and metrics explicit; qualify production access, recovery, and recipient exercise separately. Operation mappings below provide narrower mechanisms, not proof that every shared gate is satisfied.", "publication_rules": [ "All data paths are relative to this inventory and resolve within the release tree. specification_section refers to ARCHITECTURE.md; criterion IDs resolve to the catalog or its additional AX criteria. No external audit file is required to consume this inventory.", "Publish capability and retained-output mappings beside their bounded/target limitations. A bounded_subset mapping never means the entire catalog phrase is implemented.", "The catalog's composition_anchors remain authoritative selections; architecture-only optional bindings are not installed dependencies. Canon categories and existing proof ceilings remain unchanged.", "Keep discovery separate from source enablement, engagement scope, external execution, production acceptance, pricing, quotas, and promised capacity. Do not add buyer names or outreach." ] }, "source_snapshot": [ {"path": "./reference/engine.mjs", "sha256": "2fb20ae31b6598a4a54dd7d3a5a7fb8eddb200ed7066433fc8447645c2a4010d"}, {"path": "./reference/encoding.mjs", "sha256": "c33b7495cb378a331430028d3a6db0a965023853a6a397dcfce904c1b6092745"}, {"path": "./reference/offline-checker.mjs", "sha256": "96b7d7a8f90075b5360da4e00b35ab06af6d6c4d1eeae328158e3392f8916617"}, {"path": "./reference/tests.mjs", "sha256": "14a08162378552c1c9b9dad2ce384fdc3d7b1625e81a321db5d98ecad9fa9ade"}, {"path": "./reference/reference.schema.json", "sha256": "dfd60e37915a81d6b2b99914c26f01d5c932808641a23ae680a2911e8b524d60"}, {"path": "./reference/README.txt", "sha256": "0ecc861312d84b27593f7a2bf67803cd71dd4f76f03c5cab8c25c3adaceceeeb"} ], "profiles": [ { "id": "reference-case-v1", "name": "hive.reference.case.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "CASE_FORMAT; validateCase; evaluateCase", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/case", "limitation": "Own synthetic application case, not an EvidenceProfile, general EvidenceGraph, separately signed PartyDecision, or canonical typed envelope." }, { "id": "reference-rule-1", "name": "local.release", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "validateCase rule.id and rule.revision dispatch", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/rule", "limitation": "Fixed inspection/custody requirements for party.a and party.b; only local.record.release actions. No authoring, dynamic compilation, or rule migration engine." }, { "id": "reference-bundle-v1", "name": "hive.reference.bundle.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "BUNDLE_FORMAT; packageSigningPayload; verifyPackage", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/bundle", "limitation": "Ed25519 over the reference canonical bundle with signature omitted, plus component SHA-256 and token checks; not the canonical typed receipt signing message." }, { "id": "reference-token-v1", "name": "hive.reference.token.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "TOKEN_FORMAT; tokenSigningPayload; createLocalGate", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/token", "limitation": "Ed25519 over canonical format/payload, bound to local case/action/rule and validity interval. No tenant, remote destination, executor audience, or production authority chain." }, { "id": "reference-trust-v1", "name": "hive.reference.trust.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "TRUST_FORMAT; validateTrust; trustStatus", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/trust", "limitation": "Purpose is explicit.demo.only; keys and asOf are caller-selected, with no authenticated distribution, real issuer enrollment, independent time, or current revocation service." }, { "id": "reference-receipt-v1", "name": "hive.reference.receipt.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "createLocalGate.execute receiptCore", "schema_path": null, "schema_pointer": null, "limitation": "Unsigned local observation created after the private effect event, with a digest; not a canonical receipt or independent external effect evidence." }, { "id": "reference-artifacts-v1", "name": "hive.reference.artifacts.v1", "version": "1", "status": "reference_application", "definition_path": "./reference/offline-checker.mjs", "definition_locator": "checkArtifactManifest; runOffline", "schema_path": null, "schema_pointer": null, "limitation": "Flat safe-basename manifest covers exact bytes of other files, not itself. A checksum is not release authentication or checker trust." }, { "id": "reference-encoding-v1", "name": "Hive Canon JSON v1", "version": "1", "status": "reference_application", "definition_path": "./reference/README.txt", "definition_locator": "Case encoding; encoding.mjs parseStrictJSON and canonicalize", "schema_path": null, "schema_pointer": null, "limitation": "Project-specific bounded UTF-8 encoding, JavaScript UTF-16 key order and nonnegative safe integers; explicitly not RFC 8785 or the existing typed-envelope encoder." }, { "id": "reference-verification-v2", "name": "hive.reference.verification.v2", "version": "2", "status": "reference_application", "definition_path": "./reference/engine.mjs", "definition_locator": "verifyPackage result format; offline-checker.mjs verifyOffline", "schema_path": "./reference/reference.schema.json", "schema_pointer": "#/$defs/verification", "limitation": "Derived verification report with explicit check-state and selected-time reporting. It does not change signed bundle/case v1 snapshots or provide general canonical profile agility." }, { "id": "architecture-1.0.2", "name": "Hive Five Canon Services architecture", "version": "1.0.2", "status": "specification_only", "definition_path": "./ARCHITECTURE.md", "definition_locator": "Versioned product architecture; named service and shared contracts", "schema_path": null, "schema_pointer": null, "limitation": "Exact target specification version, not a released wire profile for each proposed object or API. Operation-specific schemas, byte profiles, builds, and conformance remain to be approved; none are invented here." }, { "id": "proposed-party-decision-1", "name": "case-decision-signature/1", "version": "1", "status": "specification_only", "definition_path": "./ARCHITECTURE.md", "definition_locator": "Proposed application signing profile", "schema_path": null, "schema_pointer": null, "limitation": "Proposed application signature, not installed and not the reference acceptance object. Requires a pinned encoder, approved schema, signed tenant/audience binding, authority checks, and cross-tenant replay vectors." } ], "services": [ { "id": "evidence-contract", "name": "Evidence Contract Studio", "accountable_role": "Hive service owner", "production_status": "not_accepted", "advanced_capabilities": [ {"catalog_text": "Dependency-aware requirement compilation", "operation_ids": ["ec.compile-obligations"], "coverage": "specified", "limitation": "Fixed slot inspection is not an obligation compiler."}, {"catalog_text": "Evidence coverage distinct from legal compliance", "operation_ids": ["ec.inspect-requirements", "ec.evaluate-population"], "coverage": "bounded_subset", "limitation": "Synthetic required slots and declared population only; no legal-framework or real completeness claim."}, {"catalog_text": "Explicit schema and rule migration impact", "operation_ids": ["ec.release-and-migrate"], "coverage": "specified", "limitation": "Rejecting unsupported rule revisions is not migration or impact analysis."}, {"catalog_text": "Source authenticity requirements before capture", "operation_ids": ["ec.qualify-source-contracts"], "coverage": "specified", "limitation": "No source enrollment, authority validation, or authenticated capture denominator is installed."}, {"catalog_text": "Contract conformance packs for new adapters", "operation_ids": ["ec.qualify-source-contracts"], "coverage": "specified", "limitation": "Reference test vectors are not canonical or production adapter conformance packs."} ], "retained_outputs": [ {"catalog_text": "versioned evidence profile", "operation_ids": ["ec.compile-obligations", "ec.release-and-migrate"], "coverage": "specified", "limitation": "The fixed reference rule is not a released authored EvidenceProfile."}, {"catalog_text": "requirement-to-evidence map", "operation_ids": ["ec.inspect-requirements", "ec.compile-obligations"], "coverage": "bounded_subset", "limitation": "Only two fixed evidence kinds and two asserted party labels are mapped."}, {"catalog_text": "unmapped and untestable obligations", "operation_ids": ["ec.inspect-requirements", "ec.compile-obligations"], "coverage": "bounded_subset", "limitation": "Missing fixed slots are reported; arbitrary applicability and untestable obligations require the target compiler."}, {"catalog_text": "profile diff and affected-case report", "operation_ids": ["ec.release-and-migrate"], "coverage": "specified", "limitation": "No general released-profile comparison or affected-case index."}, {"catalog_text": "conformance vectors", "operation_ids": ["ec.qualify-source-contracts"], "coverage": "specified", "limitation": "Existing reference tests do not establish admission of a new production adapter."} ] }, { "id": "counterparty-reconciliation", "name": "Counterparty Reconciliation", "accountable_role": "Hive service owner", "production_status": "not_accepted", "advanced_capabilities": [ {"catalog_text": "Cross-party differential replay", "operation_ids": ["cr.recipient-differential-replay"], "coverage": "specified", "limitation": "One shared synthetic comparison is not replay in separately authorized recipient environments."}, {"catalog_text": "Explicit source precedence without overwriting source bytes", "operation_ids": ["cr.preserve-corrections", "cr.admit-observations"], "coverage": "bounded_subset", "limitation": "Nonforking in-case corrections retain history; production source precedence and original-byte admission remain specified."}, {"catalog_text": "Idempotent logical-event reconciliation", "operation_ids": ["cr.compare-logical-events", "cr.admit-observations"], "coverage": "bounded_subset", "limitation": "Attempts versus logical groups are counted locally; durable ingest idempotency is absent."}, {"catalog_text": "Acceptance invalidation on material change", "operation_ids": ["cr.bind-recorded-acceptance", "cr.authenticate-party-decisions"], "coverage": "bounded_subset", "limitation": "Digest/revision invalidation applies to one operator-recorded assertion, not authenticated individual party decisions."}, {"catalog_text": "Selective evidence exchange within party permissions", "operation_ids": ["cr.recipient-differential-replay"], "coverage": "specified", "limitation": "No party-specific access rules or authorized differential export."} ], "retained_outputs": [ {"catalog_text": "immutable reconciliation case", "operation_ids": ["cr.preserve-corrections", "cr.admit-observations"], "coverage": "bounded_subset", "limitation": "Retained signed fixtures bind case bytes; no durable append-only case service."}, {"catalog_text": "per-party count reproduction", "operation_ids": ["cr.compare-logical-events", "cr.recipient-differential-replay"], "coverage": "bounded_subset", "limitation": "The reference counts shared synthetic attempts/logical groups and compares party slots, not independently supplied per-party counts."}, {"catalog_text": "difference explanation with evidence references", "operation_ids": ["cr.compare-logical-events"], "coverage": "bounded_subset", "limitation": "Literal-value/duplicate-slot differences only, not source truth or root cause."}, {"catalog_text": "exception and correction history", "operation_ids": ["cr.preserve-corrections", "cr.admit-observations"], "coverage": "bounded_subset", "limitation": "History is inside fixed fixtures; authenticated late admission and durable event history remain target work."}, {"catalog_text": "version-bound accept, reject, or escalate decisions", "operation_ids": ["cr.bind-recorded-acceptance", "cr.authenticate-party-decisions"], "coverage": "bounded_subset", "limitation": "One synthetic accept/deny assertion exists; no separate party signatures, escalation, delegation, or quorum workflow."} ] }, { "id": "decision-evidence", "name": "Decision Evidence Graph", "accountable_role": "Hive service owner", "production_status": "not_accepted", "advanced_capabilities": [ {"catalog_text": "Typed graph validation with cycle and dangling-edge refusal", "operation_ids": ["de.inspect-structural-support", "de.build-typed-lineage"], "coverage": "bounded_subset", "limitation": "Current evidence references and correction-chain validation are bounded checks, not a general typed DAG validator."}, {"catalog_text": "Counterfactual evidence removal", "operation_ids": ["de.counterfactual-recompute"], "coverage": "specified", "limitation": "Mutating a synthetic input in tests is not an isolated counterfactual branch runner."}, {"catalog_text": "Content-addressed transformation lineage", "operation_ids": ["de.build-typed-lineage"], "coverage": "specified", "limitation": "A whole-case digest does not implement per-transformation typed lineage."}, {"catalog_text": "Separate evaluator methodology and uncertainty", "operation_ids": ["de.assess-semantics"], "coverage": "specified", "limitation": "Structural links do not create a semantic method, calibrated confidence, or qualified assessment."}, {"catalog_text": "Model and serving-state context when material", "operation_ids": ["de.build-typed-lineage"], "coverage": "specified", "limitation": "No model/serving source adapter or canonical serving-state checks are exercised."} ], "retained_outputs": [ {"catalog_text": "typed evidence graph", "operation_ids": ["de.inspect-structural-support", "de.build-typed-lineage"], "coverage": "bounded_subset", "limitation": "Small claim-to-evidence structure only; general node/edge vocabulary remains specified."}, {"catalog_text": "claim-to-source inspection path", "operation_ids": ["de.inspect-structural-support", "de.build-typed-lineage"], "coverage": "bounded_subset", "limitation": "References lead to synthetic evidence IDs, not authenticated document regions or model provenance."}, {"catalog_text": "missing and conflicting support register", "operation_ids": ["de.inspect-structural-support", "cr.compare-logical-events"], "coverage": "bounded_subset", "limitation": "Unresolved links and literal fixed-slot conflicts are not semantic contradictions."}, {"catalog_text": "evaluation record with uncertainty", "operation_ids": ["de.assess-semantics"], "coverage": "specified", "limitation": "The deterministic reference evaluation is not SemanticAssessment."}, {"catalog_text": "change-impact and replay report", "operation_ids": ["de.replay-fixed-rule", "de.counterfactual-recompute"], "coverage": "bounded_subset", "limitation": "Whole-case fixed replay exists; exact affected-subgraph and counterfactual reports do not."} ] }, { "id": "action-boundary", "name": "Action Boundary", "accountable_role": "Hive service owner", "production_status": "not_accepted", "advanced_capabilities": [ {"catalog_text": "Payload and destination-bound admission", "operation_ids": ["ab.check-local-admission", "ab.execute-durable-boundary"], "coverage": "bounded_subset", "limitation": "Local action digest is checked; remote destination, tenant, audience, and endpoint fencing are absent."}, {"catalog_text": "Atomic one-use authorization consumption", "operation_ids": ["ab.consume-local-effect", "ab.execute-durable-boundary"], "coverage": "bounded_subset", "limitation": "Atomic only inside one in-memory instance, not across processes or restart."}, {"catalog_text": "Revocation-aware failure handling", "operation_ids": ["ab.recheck-local-trust", "ab.execute-durable-boundary"], "coverage": "bounded_subset", "limitation": "Caller-selected key/nonce policy only; no authenticated real authority or current revocation distribution."}, {"catalog_text": "Time-of-check to time-of-effect controls", "operation_ids": ["ab.recheck-local-trust", "ab.execute-durable-boundary"], "coverage": "bounded_subset", "limitation": "Clock and policy rechecks occur before a local event; no controlled external commit fence."}, {"catalog_text": "Separate sidecar, shadow, and enforced operating modes", "operation_ids": ["ab.qualify-modes-and-bypass"], "coverage": "specified", "limitation": "The public reference is synthetic, not observe/shadow/enforce deployment."} ], "retained_outputs": [ {"catalog_text": "bound admission or refusal decision", "operation_ids": ["ab.check-local-admission"], "coverage": "bounded_subset", "limitation": "Local return value only; no production admission ledger or downstream authority."}, {"catalog_text": "consumed one-use authorization", "operation_ids": ["ab.consume-local-effect"], "coverage": "bounded_subset", "limitation": "Consumed nonce is private volatile state, not durable distributed authorization."}, {"catalog_text": "post-effect observation where available", "operation_ids": ["ab.consume-local-effect"], "coverage": "bounded_subset", "limitation": "Unsigned receipt follows a local event; no external effect observation."}, {"catalog_text": "recovery and partial-effect state", "operation_ids": ["ab.execute-durable-boundary"], "coverage": "specified", "limitation": "No downstream submission, timeout, uncertain effect, or restart recovery protocol is implemented."}, {"catalog_text": "bypass and refusal evidence", "operation_ids": ["ab.check-local-admission", "ab.qualify-modes-and-bypass"], "coverage": "bounded_subset", "limitation": "Local malformed/replayed requests are refused; no inventory or test of external bypass routes."} ] }, { "id": "portable-trust", "name": "Portable Trust", "accountable_role": "Hive service owner", "production_status": "not_accepted", "advanced_capabilities": [ {"catalog_text": "Profile-specific algorithm agility without downgrade", "operation_ids": ["pt.verify-reference-package", "pt.dispatch-canonical-profiles"], "coverage": "bounded_subset", "limitation": "Ed25519-only reference report v2 explicitly rejects unsupported algorithms; multi-profile and multi-algorithm agility remain specified."}, {"catalog_text": "Offline as-of trust and revocation semantics", "operation_ids": ["pt.evaluate-demo-trust", "pt.manage-trust-lifecycle"], "coverage": "bounded_subset", "limitation": "Selected integer asOf and demo key status are retained; authenticated chronology/current revocation semantics are not installed."}, {"catalog_text": "Independent trust bootstrap and key rotation", "operation_ids": ["pt.evaluate-demo-trust", "pt.manage-trust-lifecycle"], "coverage": "bounded_subset", "limitation": "Explicit caller selection prevents automatic package self-enrollment; the supplied demo key is not independently provisioned real trust, and rotation is target work."}, {"catalog_text": "Deterministic replay with selective disclosure boundaries", "operation_ids": ["pt.check-retained-archive", "pt.plan-permitted-export"], "coverage": "bounded_subset", "limitation": "Fixed full-fixture replay exists; recipient-specific authorized closure and withheld-input reporting remain specified."}, {"catalog_text": "Package and verifier supply-chain verification", "operation_ids": ["pt.check-retained-archive", "pt.qualify-recipient-and-retention"], "coverage": "bounded_subset", "limitation": "File manifest and native checker are present; independent release authentication, qualified recipient exercise, and lifecycle acceptance are not established."} ], "retained_outputs": [ {"catalog_text": "recipient-held evidence package", "operation_ids": ["pt.check-retained-archive", "pt.plan-permitted-export"], "coverage": "bounded_subset", "limitation": "Local synthetic all-scenarios archive only; not an accepted customer export or recipient exercise."}, {"catalog_text": "per-check verification results", "operation_ids": ["pt.verify-reference-package"], "coverage": "bounded_subset", "limitation": "Reference integrity/trust/replay output only; no selected canonical receipt verifier set."}, {"catalog_text": "offline replay report", "operation_ids": ["pt.check-retained-archive"], "coverage": "bounded_subset", "limitation": "Native signature path reuses the same evaluator; it is not an independent business-rule implementation."}, {"catalog_text": "trust as-of and unsupported-state report", "operation_ids": ["pt.evaluate-demo-trust", "pt.verify-reference-package", "pt.dispatch-canonical-profiles", "pt.manage-trust-lifecycle"], "coverage": "bounded_subset", "limitation": "Reference report v2 retains selected asOf and explicit unsupported, not_checked and unavailable check states; authenticated current trust and general canonical dispatch remain specified."}, {"catalog_text": "portable correction and revision history", "operation_ids": ["pt.check-retained-archive", "pt.plan-permitted-export"], "coverage": "bounded_subset", "limitation": "Correction/stale-acceptance fixtures are retained; no general authorized historical case export."} ] } ], "operations": [ { "id": "ec.inspect-requirements", "service_id": "evidence-contract", "name": "Inspect fixed evidence obligations", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1", "reference-encoding-v1"], "specification_section": "Evidence Contract Studio / Inputs and outputs; Reference implementation boundary", "mechanism": "Evaluate the fixed inspection/custody slots for each record and synthetic party label, reporting absent references and explicit denials without dropping obligations.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "requirements projection of one fixed local.release rule; no compiler or source access"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["fixture missing: native and browser crypto parity, snapshot, gate", "denial is not a missing evidence count or an inferred exception denominator", "strict rejection: removed required kind"], "coverage": "Synthetic missing/denial outcomes and refusal of unsupported requirement changes; fixture selectors are generated by the SCENARIOS loop."}], "acceptance_criteria": ["EC-02", "SH-03", "SH-07"], "acceptance_scope": "Bounded analogue of required-evidence gaps only; not legal compliance or a passed EC production criterion.", "unresolved_limits": ["No authored applicability states, arbitrary obligation dependencies, ruleset retrieval, review workflow, or legal interpretation.", "requirements.status alone is not overall coverage, package integrity, or authorization."] }, { "id": "ec.evaluate-population", "service_id": "evidence-contract", "name": "Evaluate the declared synthetic population", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1"], "specification_section": "Coverage and event identity; Evidence Contract Studio / Inputs and outputs", "mechanism": "Compare records with a separately declared synthetic eligibleRecordIds register; report missing records and a null eligible denominator for unknown population.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "coverage projection using supplied register fields, not independently verified population capture"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["independent register with an unobserved record blocks without inventing attempts", "unknown coverage has a null denominator and blocks", "retry does not inflate eligible population or logical decision counts"], "coverage": "Declared known/unknown population and attempt-count distinction, not arbitrary requirement applicability or an authenticated denominator."}], "acceptance_criteria": ["SH-03", "SH-10", "AX-02"], "acceptance_scope": "Known/unknown register handling is bounded. AX-02 remains a target gap: the case requires at least one record and an empty known register cannot yield the architecture's valid empty-population result.", "unresolved_limits": ["independent.synthetic.input means a separate field, not an independent population authority.", "No source windows, exclusions, late cutoff, freeze/amendment workflow, or valid empty-scope reporting.", "Unknown applicability in EC-01 is a different target mechanism, not proved by unknown population handling."] }, { "id": "ec.compile-obligations", "service_id": "evidence-contract", "name": "Author and compile dependency-aware evidence profiles", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Evidence Contract Studio / Technical differentiator; Inputs and outputs; State machine and failure semantics", "mechanism": "Author a closed declarative EvidenceProfile and compile requirements, applicability, proof-demand timing, source/check dependencies, population, decisions, retention, and export obligations into an explainable plan.", "executable": null, "test_evidence": [], "acceptance_criteria": ["EC-01", "EC-02", "SH-03", "SH-07"], "acceptance_scope": "Target criteria, not tested by the fixed rule. Unknown applicability and unsupported mandatory checks must stay explicit and block applicable release.", "unresolved_limits": ["Compiler grammar, operation-specific schema, encoder, version pin, dependency graph, adapter capability snapshot, and safety/conformance corpus remain to be implemented and approved.", "No installed authoring or compile resource API; no arbitrary code execution or compliance certificate is authorized."] }, { "id": "ec.release-and-migrate", "service_id": "evidence-contract", "name": "Approve immutable profile releases and assess migration impact", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Evidence Contract Studio / State machine and failure semantics; Version and migration policy", "mechanism": "Release an approved frozen profile with authenticated role separation, effective interval and digest; compare later versions, report affected obligations/cases, and preserve old rules and decisions.", "executable": null, "test_evidence": [], "acceptance_criteria": ["EC-03", "SH-02", "SH-06", "AX-20"], "acceptance_scope": "Target release/migration behavior. Reference rejection of rule revision 2 does not establish any of these workflows.", "unresolved_limits": ["No immutable profile registry, signed approvals, author/approver access control, retained ruleset lifecycle, or released-profile diff engine.", "No installed releases API, arbitrary rule migration, compatibility acceptance, or affected-case recomputation."] }, { "id": "ec.qualify-source-contracts", "service_id": "evidence-contract", "name": "Qualify source, population, and adapter conformance contracts", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Evidence Contract Studio / Authorization, privacy, and trust boundary; Adapter conformance manifest; Coverage and event identity", "mechanism": "Bind authenticated source ownership and pre-capture evidence requirements to a frozen population method and exact adapter profiles; retain positive/negative vectors before source admission.", "executable": null, "test_evidence": [], "acceptance_criteria": ["EC-04", "SH-05", "SH-08", "SH-13", "AX-02", "AX-17"], "acceptance_scope": "Target source and canonical adapter qualification; the demonstration test suite is not an admitted adapter conformance pack.", "unresolved_limits": ["Source authenticity, real expected-set authority, empty-population policy, retention rights, and authenticated profile release remain unresolved integration dependencies.", "Each selected canonical binding needs exact envelope/schema/check level and constituents; no canonical verifier is exercised by the reference."] }, { "id": "cr.compare-logical-events", "service_id": "counterparty-reconciliation", "name": "Compare literal slots and distinguish attempts from logical decisions", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1"], "specification_section": "Counterparty Reconciliation / Technical differentiator; Reference implementation boundary", "mechanism": "Count contiguous attempts separately from logical groups, retain retry/denial meaning, and report literal-value disagreements or multiple current attestations in a fixed party/kind slot.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "one synthetic case comparison; not separate party record systems or durable ingress idempotency"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["retry does not inflate eligible population or logical decision counts", "two current identical attestations are still ambiguous", "current acceptance does not override conflict", "fixture conflict: native and browser crypto parity, snapshot, gate", "denial cannot be erased by a retry"], "coverage": "Fixed counts, literal conflict, intact conflicting fixture checks, and retained denial semantics."}], "acceptance_criteria": ["CR-01", "CR-02", "SH-03", "SH-04"], "acceptance_scope": "Local deterministic analogues only. Intact conflicting synthetic packages do not demonstrate disagreement between independently authenticated parties.", "unresolved_limits": ["No independent per-party counts, tolerant matching, root-cause attribution, source authentication, or configurable precedence.", "No durable idempotency key, batch admission, source cursor, out-of-order ingestion, or multi-party matching service."] }, { "id": "cr.preserve-corrections", "service_id": "counterparty-reconciliation", "name": "Preserve bounded nonforking correction history", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1"], "specification_section": "Case and correction lifecycle; Counterparty Reconciliation / State machine and failure semantics", "mechanism": "Resolve supersedes references within one record/kind/party/logical-decision scope, enforce increasing attempt order and no forks, retain earlier evidence, and select current replacement slots.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "validation and projection of supplied history, not an append-only storage or correction-authoring service"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["correction keeps history and changes exact acceptance digest", "correction fork is rejected", "correction cycle is rejected", "denial correction can be renewed while historical denial remains counted"], "coverage": "Same-scope correction chains, retained denial history, and rejection of forks/cycles in supplied fixtures."}], "acceptance_criteria": ["CR-03", "SH-06", "SH-07"], "acceptance_scope": "Bounded supplied-history analogue. Full SH-06 correction reason/author/authority and durable prior exports are not implemented.", "unresolved_limits": ["The reference evidence row has supersedes but no authenticated correction reason, author, or effective-time policy.", "No automatic new case creation, durable event log, late-data admission, or original-file retention service; those belong to cr.admit-observations."] }, { "id": "cr.bind-recorded-acceptance", "service_id": "counterparty-reconciliation", "name": "Bind a synthetic recorded acceptance to exact case bytes", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-bundle-v1", "reference-encoding-v1"], "specification_section": "Counterparty Reconciliation / Inputs and outputs; Reference result adapter", "mechanism": "Compute the case digest with acceptance omitted and compare the joint accept/deny assertion's digest, revision, and required party labels; mark changed bytes/revisions stale and prevent local authorization from stale or denied assertions.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "caseDigest"}, {"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "binding only; authentication of the outer operator assertion requires separate verifyPackage checks"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["stale acceptance retains its decision but never authorizes", "same revision with different claim text invalidates acceptance", "revision alone invalidates acceptance", "explicit acceptance denial blocks complete evidence"], "coverage": "Exact version/content binding and retained recorded decision, not separately authenticated acceptance."}], "acceptance_criteria": ["CR-03", "SH-02", "SH-04", "SH-06", "AX-04"], "acceptance_scope": "A current binding is not an accepted party decision. AX-04's non-independence boundary is applicable, but this reference has one joint assertion rather than even two synthetic party signatures.", "unresolved_limits": ["No separate party signature, actor identity, authority chain, tenant binding, decision scope, expiry, quorum, withdrawal, or escalation.", "A02 result-state boundary: no-check, unknown-key, or failed outer authentication must not display authenticated acceptance. This inventory does not certify the UI adapter repair or its tests.", "A valid outer package establishes only synthetic operator-recorded acceptance, never independent party consent."] }, { "id": "cr.admit-observations", "service_id": "counterparty-reconciliation", "name": "Admit authenticated observations into durable case revisions", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Counterparty Reconciliation / Inputs and outputs; Durable admission and processing; Case and correction lifecycle", "mechanism": "Authenticate party/source batches, retain original bytes and source cursors, apply explicit normalized comparison/precedence rules, and append idempotent revisioned events including authorized late and corrected observations.", "executable": null, "test_evidence": [], "acceptance_criteria": ["CR-01", "CR-04", "SH-02", "SH-06", "SH-08", "SH-12", "AX-07", "AX-15"], "acceptance_scope": "Target durable admission and late-event behavior; no production source or immutable event API is credited.", "unresolved_limits": ["No authenticated source adapters, durable original/artifact transaction, outbox, tenant isolation, idempotent writes, revision conflicts, replayable projector, or authorized case/event endpoints.", "Event identity, normalization, precedence, late-window amendment, correction authority, source outage handling, and restoration require explicit profile acceptance."] }, { "id": "cr.authenticate-party-decisions", "service_id": "counterparty-reconciliation", "name": "Collect independently authorized party decisions", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2", "proposed-party-decision-1"], "specification_section": "Counterparty Reconciliation / Inputs and outputs; Authorization, privacy, and key independence; Proposed application signing profile", "mechanism": "Collect separate accept/reject/escalate decisions bound to tenant, party, actor, authority, exact case/calculation/profile, scope and nonce; preserve supersession and apply an approved required-party/quorum policy.", "executable": null, "test_evidence": [], "acceptance_criteria": ["CR-02", "CR-03", "SH-02", "SH-05", "SH-08", "AX-03", "AX-04", "AX-25", "AX-26", "AX-27"], "acceptance_scope": "Target party authentication and independence. No real PartyDecision conformance test or installed decision API exists in this inventory.", "unresolved_limits": ["case-decision-signature/1 needs approved schema, exact encoder/algorithm, independently provisioned authority, and negative vectors before use.", "Architecture 1.0.2 requires signed tenant_scope_id, decision_audience, decision_profile_id and decision_profile_version. Recipient-side cross-tenant and audience/profile mismatch refusal under AX-26 and AX-27 remain unimplemented target requirements.", "A01 boundary: current custody distinct-key-ID checking is not public-key fingerprint or organization independence checking; alias resolution and relationship qualification under AX-25 are separate service requirements.", "Additional parties, quorum, delegated decisions, dispute routing, withdrawal, and escalation are specified workflows, not reference features."] }, { "id": "cr.recipient-differential-replay", "service_id": "counterparty-reconciliation", "name": "Reproduce recipient-permitted views and explain differences", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Counterparty Reconciliation / Technical differentiator; Authorization, privacy, and key independence", "mechanism": "Produce separately authorized comparison views and evidence openings, replay each party's permitted count/rule closure, and retain differences, withheld dependencies, and not-reproduced-by-party outcomes.", "executable": null, "test_evidence": [], "acceptance_criteria": ["CR-02", "SH-08", "SH-09", "SH-14", "AX-12", "AX-22"], "acceptance_scope": "Target differential replay and selective exchange; one synthetic evaluator invocation is not recipient operation.", "unresolved_limits": ["No permission-scoped source openings, recipient-specific export planner, independently run counts, confidential difference controls, or qualified separate recipient.", "A matching count is not source truth, acceptance, settlement, or proof of organizational independence."] }, { "id": "de.inspect-structural-support", "service_id": "decision-evidence", "name": "Inspect current claim-to-evidence structural links", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1"], "specification_section": "Decision Evidence Graph / Technical differentiator; Reference result adapter", "mechanism": "Validate claim support IDs against evidence in the same record and report empty, denied, superseded, or linked support without interpreting the claim text.", "executable": {"mode": "pure_function", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}], "scope": "small structural reference projection only; no general typed transformation graph or semantic evaluator"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["structural links do not judge semantic truth", "empty support remains unresolved even when evidence is complete", "superseded support does not remain current", "strict rejection: dangling support", "correction cycle is rejected"], "coverage": "Unrelated claim text is not semantically assessed; missing/current support and correction-chain validation are bounded, not general DAG tests."}], "acceptance_criteria": ["DE-01", "DE-02", "SH-07"], "acceptance_scope": "Structural-only analogue. DE-02 general typed graph cycle handling and exact edge contracts remain target requirements.", "unresolved_limits": ["No per-node content commitments, closed transformation-edge vocabulary, source-region selectors, semantic entailment, causal assessment, or model identity.", "Correction-chain order rejection is not general graph-cycle detection; source permissions are not enforced by a synthetic evidence label."] }, { "id": "de.replay-fixed-rule", "service_id": "decision-evidence", "name": "Reproduce the fixed deterministic case evaluation", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1", "reference-bundle-v1", "reference-encoding-v1", "reference-verification-v2"], "specification_section": "Decision Evidence Graph / Technical differentiator; Reference implementation boundary", "mechanism": "Run the pure local.release evaluator over the same bounded case and compare its canonical result with the signed snapshot during package verification.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "evaluateCase"}, {"path": "./reference/engine.mjs", "symbol": "verifyPackage"}, {"path": "./reference/offline-checker.mjs", "symbol": "verifyOffline"}], "scope": "whole-case fixed calculation replay; the native signature path shares the same evaluator"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["pure evaluation preserves caller objects and key order is irrelevant", "package adversary: signed false snapshot", "same revision with different claim text invalidates acceptance", "fixture correction: native and browser crypto parity, snapshot, gate", "strict rejection: unsupported rule"], "coverage": "Pure deterministic evaluation, changed acceptance binding, replay mismatch, and unsupported fixed rule dispatch."}], "acceptance_criteria": ["DE-03", "SH-02", "SH-03", "SH-09", "AX-01"], "acceptance_scope": "Reproduction of one supplied rule, not independent implementation, general pipeline reexecution, or proof that all affected results were found.", "unresolved_limits": ["No arbitrary executable rule runner, sandboxed transformations, incremental cache, affected-node set, or isolated counterfactual branch.", "An altered claim changes its digest/binding but need not change every calculated field. Semantic truth and correctness of local.release remain outside scope."] }, { "id": "de.build-typed-lineage", "service_id": "decision-evidence", "name": "Build content-bound typed transformation and serving lineage", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Decision Evidence Graph / Inputs and outputs; Canon composition and proof ceiling; Authorization, privacy, and evaluator trust", "mechanism": "Build a versioned graph with typed nodes/edges, exact source selectors and transformation inputs/outputs, qualified source/model context adapters, dependency closure, and per-node access rules.", "executable": null, "test_evidence": [], "acceptance_criteria": ["DE-01", "DE-02", "SH-07", "SH-08", "SH-13", "AX-12", "AX-17"], "acceptance_scope": "Target typed graph and adapter conformance; canonical links do not qualify implementations.", "unresolved_limits": ["No general graph schema/validator, transformation lineage store, stable region selector, authorized closure traversal, or model/serving authenticity adapter.", "decision.provenance and stage.replay record links/digest comparisons rather than reexecuting transformations; capture.commitment is recording-specific.", "Use selected catalog dependencies and their exact categories/ceilings. Any additional proof.transition binding is a conditional design option unless selected explicitly."] }, { "id": "de.assess-semantics", "service_id": "decision-evidence", "name": "Run attributed semantic assessments with uncertainty", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Decision Evidence Graph / Inputs and outputs; Authorization, privacy, and evaluator trust", "mechanism": "Run an explicitly enabled qualified evaluator and retain method/version, input regions, rubric/configuration/model digests, operator relationship, uncertainty, abstention/error states, and competing assessment history.", "executable": null, "test_evidence": [], "acceptance_criteria": ["DE-01", "DE-04", "SH-04", "AX-15", "AX-21"], "acceptance_scope": "Target SemanticAssessment. Structural support tests do not establish method validity, uncertainty, or semantic correctness.", "unresolved_limits": ["No evaluator, qualification evidence, calibration, adversarial-content isolation, assessment storage, human review, or evaluation API is installed.", "Missing, insufficient, abstained, error, contradicted, and supported require distinct attributed outcomes; a signed link is never an evaluated-support result.", "Source instructions must remain untrusted data, not tool, trust, or rubric authority."] }, { "id": "de.counterfactual-recompute", "service_id": "decision-evidence", "name": "Recompute affected dependencies in isolated what-if branches", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Decision Evidence Graph / Technical differentiator; State machine and failure semantics", "mechanism": "Create a clearly synthetic replay branch when evidence is removed/replaced, invalidate the exact dependency closure, preserve original history, and recompute only supported affected transformations under pinned code and trust.", "executable": null, "test_evidence": [], "acceptance_criteria": ["DE-03", "SH-02", "SH-06", "SH-07", "AX-20"], "acceptance_scope": "Target isolated counterfactual and exact impact behavior; whole-case replay or hand-mutated test data is not this mechanism.", "unresolved_limits": ["No branch manager, full typed dependency closure, isolated runner, invalidation index, compatible cache, or affected-subgraph recomputation.", "Nondeterministic evaluator reruns cannot promise identical judgments; hypothetical output is not observed history or an automatic correction."] }, { "id": "ab.check-local-admission", "service_id": "action-boundary", "name": "Check signed local action prerequisites and exact bindings", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-case-v1", "reference-rule-1", "reference-bundle-v1", "reference-token-v1", "reference-trust-v1"], "specification_section": "Action Boundary / Inputs and outputs; Reference implementation boundary", "mechanism": "Verify package/token integrity and selected trust, require the fixed evaluator's eligibility, and match the included token to case ID/revision/digest, rule digest, and exact local action before admission.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "createLocalGate"}, {"path": "./reference/engine.mjs", "symbol": "createLocalGate.execute"}], "scope": "checks are inside execute, not a separate production authorization API; only local.record.release"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["gate rejects an unsigned bypass request", "gate rejects changed action payload", "gate rejects a token not included in the exact package", "gate binding: case ID", "gate binding: rule digest", "gate binding: action digest"], "coverage": "Signed local prerequisites and exact case/rule/action mismatch refusal."}], "acceptance_criteria": ["AB-01", "AB-03", "SH-02", "SH-03", "AX-08"], "acceptance_scope": "AB-01 local payload analogue only. AX-08 changed destination remains target: the current action has no external destination field.", "unresolved_limits": ["No tenant, executor audience, remote destination/resource, real delegation chain, or production permission model.", "evaluateCase.gate.eligible alone authorizes nothing; even a ready pure evaluation requires successful package/trust/token and commit-time checks.", "No general bearer authorization is obtained from a canonical authorization.decision or imprimatur.clearance link."] }, { "id": "ab.recheck-local-trust", "service_id": "action-boundary", "name": "Recheck the local clock and selected policy before the event", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-token-v1", "reference-trust-v1", "reference-bundle-v1"], "specification_section": "Action Boundary / Failure, bypass, time, and replay behavior; Reference implementation boundary", "mechanism": "Copy requests before awaiting cryptography, reject a policy-version change during verification, recheck clock/key/token interval and revoked nonce at local effect time, and install validated policy updates without clearing used nonces.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "createLocalGate.execute"}, {"path": "./reference/engine.mjs", "symbol": "createLocalGate.updateTrust"}], "scope": "caller-owned clock and policy within one gate instance; no external trust authority"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["trust change during verification fails closed", "trust updates do not reset used nonces", "key expiration during crypto is checked at effect time", "token expiration during crypto is checked at effect time", "clock rollback is rejected", "selected revoked nonce blocks an otherwise verified package", "request action mutation while awaiting does not change the effect"], "coverage": "Local time/policy race, expiry, revocation-list, input-copy, and rollback checks."}], "acceptance_criteria": ["AB-03", "SH-03", "SH-05", "AX-09"], "acceptance_scope": "Local analogue of a commit-time trust fence, not current real authority revocation or a qualified external fence.", "unresolved_limits": ["Trust and time are caller-configured demonstration inputs; no authenticated clock, freshness contract, delivered revocation evidence, or real delegated authority.", "Policy updates within one process are not distributed policy-epoch synchronization or an operational revocation service."] }, { "id": "ab.consume-local-effect", "service_id": "action-boundary", "name": "Consume a nonce and append one local effect followed by its receipt", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-token-v1", "reference-receipt-v1", "reference-trust-v1"], "specification_section": "Action Boundary / State machine; Reference implementation boundary", "mechanism": "Without an intervening await, consume a private nonce, append one private local effect event, then append its unsigned observation receipt; return copies and refuse reused nonces in the same instance.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "createLocalGate.execute"}, {"path": "./reference/engine.mjs", "symbol": "createLocalGate.snapshot"}], "scope": "one in-memory event store with effect-before-receipt ordering; no callbacks, external effects, or durable state"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["nonce is consumed once and receipt follows effect", "concurrent token uses cannot both record an effect", "snapshot and returned receipts cannot mutate gate state", "new gate resets nonce memory, an explicit documented boundary"], "coverage": "Single-instance ordering/replay/concurrency and the explicit reset limitation; not restart safety."}], "acceptance_criteria": ["AB-02", "SH-04", "SH-12", "AX-11"], "acceptance_scope": "AB-02 is bounded to one live instance. AX-11 is explicitly unmet by this mechanism; its test demonstrates that a new instance loses replay memory.", "unresolved_limits": ["Nonce history and observations are volatile and not shared across instances or processes.", "Local receipts are unsigned; digest and order do not prove any external action happened.", "No external endpoint, durable reservation, recovery state, distributed transaction, or global exactly-once guarantee."] }, { "id": "ab.execute-durable-boundary", "service_id": "action-boundary", "name": "Execute through a qualified durable effect fence and recover uncertainty", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Action Boundary / State machine; Failure, bypass, time, and replay behavior; Failure recovery", "mechanism": "Persist exact tenant/destination/audience-bound reservations, atomically consume durable replay state, fence mutable authority at commit, invoke a controlled downstream adapter with idempotency/status semantics, and preserve unknown/partial outcomes until safe reconciliation.", "executable": null, "test_evidence": [], "acceptance_criteria": ["AB-01", "AB-02", "AB-03", "SH-08", "SH-12", "AX-08", "AX-09", "AX-10", "AX-11"], "acceptance_scope": "Production target only. No local reference test is accepted as an external effect, multi-process replay, or recovery test.", "unresolved_limits": ["No controlled external endpoint, constrained downstream credential custody, durable replay store, fence token, or accepted host/method/schema/auth deployment.", "Downstream idempotency, timeout/status lookup, crash recovery, partial-effect handling, reversal evidence, and delayed closure remain unimplemented.", "Authenticated authority, trusted clock, revocation freshness, restart-safe retention, and measured recovery require separate scope-specific acceptance."] }, { "id": "ab.qualify-modes-and-bypass", "service_id": "action-boundary", "name": "Qualify operating modes and the effect-path bypass inventory", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Action Boundary / Operating modes; Failure, bypass, time, and replay behavior; Packaging and readiness", "mechanism": "Declare synthetic/observe/shadow/enforce mode in accepted configuration, enumerate alternate execution paths and break-glass authority, challenge bypass routes, and reconcile observed attempts with an independently defined effect population.", "executable": null, "test_evidence": [], "acceptance_criteria": ["AB-04", "SH-08", "SH-10", "SH-11", "SH-12", "AX-18"], "acceptance_scope": "Mode qualification and bypass prevention are target integration work. The local reference is synthetic and does not evidence sidecar/shadow/enforce behavior in a customer environment.", "unresolved_limits": ["No enforced mode deployment, alternate endpoint/console/job inventory, approved break-glass workflow, controlled rollout, or independent bypass observation.", "An observational gap must not become an action-blocked claim; a UI control cannot promote a deployment's mode.", "A refusal record alone does not prove a downstream action was prevented."] }, { "id": "pt.verify-reference-package", "service_id": "portable-trust", "name": "Strictly parse and verify the Ed25519 reference package", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-encoding-v1", "reference-bundle-v1", "reference-token-v1", "reference-trust-v1", "reference-verification-v2"], "specification_section": "Portable Trust / Verification pipeline; No universal reserialization; Reference implementation boundary", "mechanism": "Use bounded strict text parsing, closed reference shape validation, component SHA-256, Ed25519 package/token signatures, and deterministic snapshot replay with the separately supplied demo policy.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/encoding.mjs", "symbol": "parseStrictJSON"}, {"path": "./reference/encoding.mjs", "symbol": "canonicalize"}, {"path": "./reference/engine.mjs", "symbol": "verifyPackage"}, {"path": "./reference/offline-checker.mjs", "symbol": "verifyOffline"}], "scope": "WebCrypto or native Node signature path for hive.reference.* only; Node path shares reference validation/evaluation"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["strict text: duplicate keys", "strict text: unsafe integer", "strict text: depth bound", "package adversary: changed signature", "package adversary: changed token signature under valid envelope", "package adversary: signed false snapshot", "package adversary: wrong algorithm", "crypto unavailability fails closed", "schema projection cannot substitute for reference, integrity, or replay checks", "verification epistemic status: unknown key does not claim signature failure", "verification epistemic status: malformed envelope is not a failed crypto check", "verification epistemic status: report version does not alter signed case snapshots", "verification combined failure: known hash failure prevents an unusable WebCrypto call", "verification combined failure: native crypto failure cannot mask a known hash mismatch", "verification combined failure: hash failure takes precedence over an unexamined bad signature"], "coverage": "Strict parsing, integrity/replay checks, report-v2 epistemic states, known-failure precedence, and unchanged signed snapshots. These are inspected definitions, not test runs or canonical verifier conformance."}], "acceptance_criteria": ["PT-02", "PT-03", "SH-03", "SH-07", "SH-09", "SH-13", "AX-13", "AX-17"], "acceptance_scope": "Reference parsing/integrity/replay and report-v2 state mechanics only. PT-03 has a bounded unsupported-algorithm analogue; no passing run or UI acceptance is claimed by this inventory.", "unresolved_limits": ["Ed25519 only; no generic canonical envelope routing, full typed constituent checks, multi-algorithm agility, or accredited validation.", "Inspected report-v2 code distinguishes unsupported, not_checked and unavailable from actual failed checks. Known hash mismatch remains invalid without an unperformed signature claim. This describes the A05 code repair and test definitions, not certification of its runtime or outward UI behavior.", "Structural JSON Schema is a projection, not authorization; object input cannot recover duplicate keys erased by a prior ordinary parser."] }, { "id": "pt.evaluate-demo-trust", "service_id": "portable-trust", "name": "Evaluate explicitly selected demonstration trust at its as-of time", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-trust-v1", "reference-bundle-v1", "reference-verification-v2"], "specification_section": "Portable Trust / Authorization, privacy, and trust lifecycle; Offline as-of semantics", "mechanism": "Validate a caller-selected explicit.demo.only policy, resolve the claimed key ID, classify selected key validity/revocation, and retain the exact accepted integer asOf with independent false.", "executable": {"mode": "local_library", "entrypoints": [{"path": "./reference/engine.mjs", "symbol": "validateTrust"}, {"path": "./reference/engine.mjs", "symbol": "trustStatus"}, {"path": "./reference/engine.mjs", "symbol": "verifyPackage"}, {"path": "./reference/offline-checker.mjs", "symbol": "verifyOffline"}], "scope": "policy evaluation of supplied demonstration facts, not real issuer enrollment or independently attested time"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["package adversary: embedded authorizing key", "explicit trust policy: no selected key", "a different caller selected public key cannot verify the signature", "explicit trust policy: revoked key", "trust report distinguishes valid verification at different selected times", "trust report retains the precise selected time at key validity boundaries", "trust report never represents an invalid policy time as evaluated"], "coverage": "No automatic key self-enrollment, explicit selected key status, and precise selected-time reporting; not authenticated trust acquisition or live revocation."}], "acceptance_criteria": ["PT-02", "PT-04", "SH-05", "AX-04", "AX-14", "AX-23"], "acceptance_scope": "Bounded as-of reporting and caller choice. Current-trust freshness, real independent trust bootstrap, key epochs, and rotation remain target work.", "unresolved_limits": ["A separately downloaded copy of the same demo trust file is not independent authority or proof of external signer identity.", "No authenticated snapshot timestamp, current revocation distribution, accepted chronology, key-epoch migration, real purpose/tenant authority, or separate historical/current/integrity-only modes.", "No fingerprint alias/organization relationship assessment; multiple key IDs or keys alone cannot establish independence."] }, { "id": "pt.check-retained-archive", "service_id": "portable-trust", "name": "Check a retained reference manifest and run native offline replay", "readiness": "bounded_reference", "accountable_role": "Hive service owner", "profile_refs": ["reference-artifacts-v1", "reference-bundle-v1", "reference-trust-v1", "reference-encoding-v1", "reference-verification-v2"], "specification_section": "Portable Trust / Package contract; Verification pipeline; Checker and package supply chain", "mechanism": "Check the flat artifact manifest's exact file set, names, lengths and SHA-256, reject traversal/symlinks/extra or changed files, then check retained fixture/snapshot pairs with native Node Ed25519 and the shared fixed evaluator.", "executable": {"mode": "local_cli", "entrypoints": [{"path": "./reference/offline-checker.mjs", "symbol": "checkArtifactManifest"}, {"path": "./reference/offline-checker.mjs", "symbol": "runOffline"}], "scope": "existing all-scenarios offline_bundle and explicitly supplied trust path; no network request or local gate effect"}, "test_evidence": [{"path": "./reference/tests.mjs", "kind": "test_definition", "run_status": "not_run_for_this_inventory", "selectors": ["offline archive manifest and expected negative fixture outcomes", "offline command needs explicit caller selected trust", "offline command runs with restricted filesystem permission", "artifact boundary: traversal", "artifact boundary: extra", "artifact boundary: hash", "artifact manifest rejects symlink additions", "offline imports have no networking, process, or package dependency"], "coverage": "Actual native checker/manifest test definitions, including expected negative fixture outcomes and restricted filesystem invocation. No fresh independent recipient or permission-enforced network isolation is claimed here."}], "acceptance_criteria": ["PT-01", "SH-07", "SH-09", "AX-06", "AX-13", "AX-22"], "acceptance_scope": "Existing local package/checker analogue only. CLI success means expected positive and negative fixture outcomes matched, not that every package passed.", "unresolved_limits": ["Node 20.20 or newer is required by the guide. Trusted checker acquisition, fresh extraction, runtime compatibility, and recipient challenge must be separately evidenced.", "The manifest cannot authenticate itself or its checker; a detached archive checksum provides byte identity, not authority. Hostile writable-directory replacement races remain outside scope.", "This operation covers the static all-scenarios package and checker, not an asserted test of the browser's separate selected-snapshot ZIP generator.", "No arbitrary package dependency closure, signed release admission, private-source disclosure enforcement, or independent evaluator implementation."] }, { "id": "pt.dispatch-canonical-profiles", "service_id": "portable-trust", "name": "Dispatch exact canonical profiles and algorithms without downgrade", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "No universal reserialization; Adapter conformance manifest; Portable Trust / Verification pipeline", "mechanism": "Select exact retained envelope/schema/byte/algorithm profiles, preserve original signed bytes, run required typed and constituent checks, and report unsupported/unavailable separately from failed integrity without trying weaker alternatives.", "executable": null, "test_evidence": [], "acceptance_criteria": ["PT-03", "SH-01", "SH-03", "SH-13", "AX-05", "AX-17"], "acceptance_scope": "Target canonical adapter set and precise profile dispatch. Existing canonical source files or links are not credited as integration with the five-service reference.", "unresolved_limits": ["No accepted per-profile adapter/version/build manifest, cross-language edge vectors, algorithm agility, full constituent closure, or service error mapping.", "proof.transition.portable is a signed final-state assertion, not verification of omitted source-container/input signatures or full transition replay; those inputs must be supplied for that claim.", "control.replay is control-cycle replay, stage.replay is recorded stage/digest comparison, and replay.disclosurefree does not itself inspect forbidden fields. Their ceilings cannot be generalized.", "Future schema pins, algorithm retirement and result semantics require explicit version governance rather than reinterpretation of old signed snapshots. Reference report v2 is not canonical multi-profile support."] }, { "id": "pt.manage-trust-lifecycle", "service_id": "portable-trust", "name": "Manage authenticated trust enrollment, rotation, and current reliance", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Shared trust, authority, tenant, and privacy architecture / Trust is a policy decision; Key lifecycle; Offline as-of semantics", "mechanism": "Enroll independently established issuer/party authority and key fingerprints, version scoped trust/epoch policies, authenticate revocation distribution, retain compromise uncertainty, and distinguish historical_as_of, current, and integrity_only reliance.", "executable": null, "test_evidence": [], "acceptance_criteria": ["PT-02", "PT-04", "SH-05", "AX-03", "AX-04", "AX-14", "AX-23", "AX-25"], "acceptance_scope": "Target lifecycle and current-trust behavior, not a stronger reading of caller-selected demo trust.", "unresolved_limits": ["No real identity enrollment, independent custody assessment, authority resolver, signed trust snapshot, current revocation delivery, key-epoch rotation, retirement, or compromise-response implementation.", "Current reliance must remain unknown if required freshness is unavailable; offline as-of checking cannot establish later non-revocation.", "Authenticated trusted time and revocation of business authority are separate from cryptographic key validity."] }, { "id": "pt.plan-permitted-export", "service_id": "portable-trust", "name": "Plan purpose-specific authorized evidence closures and verification jobs", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Portable Trust / Technical differentiator; Package contract; Authorization, privacy, and trust lifecycle; Proposed resource API", "mechanism": "Plan each recipient's permitted original-byte, application-history, rule, checker and trust closure; report omitted/withheld dependencies and affected checks; assemble an authorized export or explicitly authorized hosted verification job without broadening disclosure.", "executable": null, "test_evidence": [], "acceptance_criteria": ["PT-01", "SH-02", "SH-08", "SH-09", "AX-05", "AX-12", "AX-16", "AX-24"], "acceptance_scope": "Target general export/verification service. The fixed synthetic archive is not a privacy-safe arbitrary input planner or hosted job implementation.", "unresolved_limits": ["No transitive closure planner, tenant/recipient authorization, permission-safe error disclosure, retained original-byte access service, revocable pre-download link, or purpose-specific production manifest.", "No hosted upload/verification job API is installed. Local checking remains the confidential-evidence default; upload, storage region and retention require explicit authorization.", "Redaction changes signed bytes and must remain a derived view. Signature completeness is distinct from replay completeness; a hash lookup is not verification."] }, { "id": "pt.qualify-recipient-and-retention", "service_id": "portable-trust", "name": "Qualify checker releases, recipient exercise, and evidence retention", "readiness": "specified", "accountable_role": "Hive service owner", "profile_refs": ["architecture-1.0.2"], "specification_section": "Checker and package supply chain; Test evidence protocol; Retention and evidence portability; Exact maturity ladder", "mechanism": "Authenticate reproducible checker releases and dependencies, retain negative vectors, obtain recipient-controlled offline challenge results, and qualify archival migration, restoration, hold/deletion consequences, and exit exports under approved retention policy.", "executable": null, "test_evidence": [], "acceptance_criteria": ["PT-01", "SH-09", "SH-12", "SH-13", "SH-14", "AX-06", "AX-22", "AX-24"], "acceptance_scope": "Target independent release/recipient and operational retention acceptance. Local manifest checks cannot self-certify checker trust or recipient independence.", "unresolved_limits": ["No independently accepted checker supply chain, recipient challenge report, multi-implementation conformance, release-authentication channel, or long-lived security notification/algorithm-retirement service is established.", "Retention durations, legal holds, restore tests, archive migration, exit drill and recipient rights require scoped approval and measured evidence; deletion cannot claw back recipient copies.", "A passed reference suite, self-manifest check, or schema validation cannot promote this target operation to production or independent exercise."] } ] }