{ "schema_version": "1.0.0", "map_id": "hive.canon.service-surfaces", "revision": "2026-09-12.1", "title": "Hive Service Surfaces", "thesis": "Make automated work checkable.", "description": "Five composed services connect the evidence required before an action to the records, decisions, and replay that follow it.", "kind": "service_composition_map", "counts_as_receipt_contract": false, "registry_path": "../registry/hive-canon-registry.json", "architecture_path": "./ARCHITECTURE.md", "publication": { "mode": "review_preview", "indexable": false, "changes_buyer_scope": false, "requires_production_acceptance": true, "note": "Discoverable through the canon. Service discovery never changes an existing engagement or authorizes a production integration." }, "maturity_model": [ { "id": "specified", "label": "Service contract specified", "requires": [ "versioned contract", "canonical dependency map", "failure semantics", "acceptance criteria" ] }, { "id": "reference", "label": "Reference implementation", "requires": [ "bounded working implementation", "adversarial tests", "reproducible package", "explicit reference boundary" ] }, { "id": "integrated", "label": "Authorized integration", "requires": [ "authenticated sources", "tenant isolation", "authorized owners", "trust and retention configuration", "effect-boundary tests where applicable" ] }, { "id": "operational", "label": "Operationally accepted", "requires": [ "deployed revision acceptance", "controlled load and recovery evidence", "support and incident process", "customer acceptance" ] }, { "id": "independently_exercised", "label": "Independently exercised", "requires": [ "qualified separate operator", "declared challenge and scope", "retained reproducible evidence", "documented unresolved findings" ] } ], "result_dimensions": [ { "id": "integrity", "question": "Do the signed bytes pass the supported profile checks?", "states": [ "pass", "fail", "unsupported", "unavailable", "not_checked" ] }, { "id": "trust", "question": "Does the separately configured trust policy authorize the signer for this purpose and time?", "states": [ "trusted_for_scope", "untrusted", "revoked", "unknown", "not_checked" ] }, { "id": "coverage", "question": "Which expected evidence is present under the agreed capture boundary?", "states": [ "complete", "incomplete", "unknown", "not_applicable" ] }, { "id": "calculation", "question": "What result follows from the pinned inputs and rule?", "states": [ "reproduced", "different", "blocked", "not_applicable" ] }, { "id": "acceptance", "question": "What did each participant decide for this exact case revision?", "states": [ "accepted", "rejected", "escalated", "pending", "stale", "not_applicable" ] }, { "id": "effect", "question": "What effect was authorized, attempted, observed, or confirmed within the declared boundary?", "states": [ "not_attempted", "refused", "authorized", "observed", "confirmed_in_scope", "unknown", "not_applicable" ] } ], "shared_architecture": [ { "id": "demand", "label": "Demand and scope", "anchors": [ "stipryn", "carnac", "imprimatur", "intent-affirmation" ], "boundary": "Demand defines the evidence required. Gateway arrival and downstream execution remain separate facts." }, { "id": "capture", "label": "Source and capture", "anchors": [ "hivebound-envelope", "capture-commitment", "afir-ocr-docproof", "corpus-commitment", "originproof" ], "boundary": "Commitments bind supplied bytes and declared source context, not source truth." }, { "id": "authority", "label": "Identity and authority", "anchors": [ "authority-qualification", "authority-delegation", "authority-carriage", "authority-revocation", "delegation-attenuation", "authorization-decision" ], "boundary": "Authority must be linked to the issuer, resource, operation, validity interval, and applicable trust policy." }, { "id": "execution", "label": "Serving and effect", "anchors": [ "sigr-mir", "sigr-manifest", "numeric-lineage", "cache-epoch", "entropy-custody", "s2s", "effect-closure", "effect-quiescence" ], "boundary": "A declared state is not a trusted measurement. Effect claims require observations at the actual controlled boundary." }, { "id": "evaluation", "label": "Support and evaluation", "anchors": [ "sigr-gca", "decision-provenance", "evar", "eval-administration", "bpa-budget", "bpa-attestation", "control-replay", "analysis-replay" ], "boundary": "Structural support links, semantic evaluation, technical calculation, and real-world correctness are distinct." }, { "id": "reconciliation", "label": "Handoff and reconciliation", "anchors": [ "custody-handoff", "ledger-parity", "multi-source-divergence", "supersession-receipt", "proof-transition", "sequence-attestation" ], "boundary": "A calculated agreement is not party acceptance. Corrections preserve previous evidence and decisions." }, { "id": "portability", "label": "Disclosure and continuity", "anchors": [ "disclosure-presentation", "proof-transition-portable", "transparency-checkpoint", "retention-policy", "retention-purge", "verdict-custody" ], "boundary": "Verification tools can be public while source evidence stays private. Offline decisions remain bounded by supplied trust information and its as-of time." } ], "shared_requirements": [ { "id": "SH-01", "priority": "P0", "title": "Stable signed identities", "acceptance": "Existing signed type strings, bytes, schemas, fixture fingerprints, and canonical anchors are unchanged." }, { "id": "SH-02", "priority": "P0", "title": "Immutable case revisions", "acceptance": "Every calculation, export, and party decision identifies the same case revision, input digest, rule digest, and checker profile." }, { "id": "SH-03", "priority": "P0", "title": "Explicit unknown evidence", "acceptance": "Unknown denominator, absent source, unsupported algorithm, stale trust, and unavailable dependency never become a passing result." }, { "id": "SH-04", "priority": "P0", "title": "Independent dimensions", "acceptance": "Integrity, trust, coverage, calculation, acceptance, and effect are displayed separately without a misleading aggregate success badge." }, { "id": "SH-05", "priority": "P0", "title": "Separate trust configuration", "acceptance": "A key supplied inside a package cannot authorize itself. Trust purpose, key epoch, validity interval, revocation state, and offline as-of limits are explicit." }, { "id": "SH-06", "priority": "P0", "title": "Preserved corrections", "acceptance": "Corrections reference the original record and reason. Earlier bytes remain inspectable and prior acceptance does not silently transfer to the new revision." }, { "id": "SH-07", "priority": "P0", "title": "Strict inputs and safe resources", "acceptance": "Schemas bound sizes, safe integer ranges, identifiers, timestamps, nesting, duplicate keys, unknown fields, graph cycles, and invalid references. Ambiguous input is rejected." }, { "id": "SH-08", "priority": "P0", "title": "Tenant and privacy boundary", "acceptance": "An integrated service enforces tenant scope and roles server-side; its public reference accepts synthetic fixtures only and makes no customer-source calls." }, { "id": "SH-09", "priority": "P0", "title": "Recipient portability", "acceptance": "A retained package, separate trust configuration, pinned checker, file manifest, and instructions reproduce the declared checks with Hive unavailable." }, { "id": "SH-10", "priority": "P0", "title": "Reproducible observability", "acceptance": "Every metric identifies its unit, numerator, denominator, interval, rule revision, and evidence references. Replay performance is never advertised as production capacity." }, { "id": "SH-11", "priority": "P0", "title": "No hidden scope expansion", "acceptance": "Discovery cannot alter a pilot, create an engagement, enable an adapter, or cause an external effect. Existing buyer files and shared assets remain byte-identical." }, { "id": "SH-12", "priority": "P0", "title": "Failure and recovery", "acceptance": "Production admission defines backpressure, retries, idempotency, out-of-order input, revocation, partial writes, disaster recovery, and retention behavior before operational acceptance." }, { "id": "SH-13", "priority": "P1", "title": "Interoperable export profiles", "acceptance": "A new adapter preserves original signed bytes and passes version-specific conformance vectors. Unsupported versions fail closed without silent downgrade." }, { "id": "SH-14", "priority": "P1", "title": "Recipient-controlled exercise", "acceptance": "An independent recipient can supply a challenge, run an accepted profile, and retain negative results without relying on the issuer's dashboard." } ], "surfaces": [ { "id": "evidence-contract", "name": "Evidence Contract Studio", "eyebrow": "Define the evidence before the event", "headline": "Make the requirement executable.", "promise": "Turn a workflow's evidence requirements into a versioned contract that the producer and recipient can inspect, test, and reuse.", "buyer_question": "What must be recorded, which sources count, and what will make the result incomplete?", "value": "Reduce repeated interpretation of evidence requests and make missing obligations visible before review starts.", "mechanism": "Compile a bounded declarative evidence profile into required fields, source constraints, applicability rules, coverage obligations, and deterministic acceptance checks.", "differentiator": "A versioned obligation graph links each declared requirement to its capture point and verifier, with change-impact analysis across affected evidence and decisions.", "composition_anchors": [ "stipryn", "imprimatur", "screening-attestation", "jurisdictional-clearance", "evar", "eval-administration", "submission-attestation", "retention-policy" ], "inputs": [ "workflow scope and purpose", "source and custodian inventory", "versioned requirements and applicability", "capture boundary and expected population", "retention and disclosure policy" ], "outputs": [ "versioned evidence profile", "requirement-to-evidence map", "unmapped and untestable obligations", "profile diff and affected-case report", "conformance vectors" ], "state_machine": [ "draft", "review_required", "approved_for_scope", "active_version", "superseded", "withdrawn" ], "advanced_capabilities": [ "Dependency-aware requirement compilation", "Evidence coverage distinct from legal compliance", "Explicit schema and rule migration impact", "Source authenticity requirements before capture", "Contract conformance packs for new adapters" ], "proof_ceiling": "The supplied evidence meets the checks encoded in this scoped profile. It does not establish legal compliance, completeness of the framework mapping, regulator approval, or correctness of the chosen rules.", "reference_scope": "Inspect declared requirements and missing evidence in a fixed neutral synthetic case. A general rules compiler and legal-framework review are separate production deliverables.", "production_status": "not_accepted", "reference_status": "tested_bounded_reference", "discovery_path": "/canon/surfaces/evidence-contract/index.html", "reference_scenarios": [ "normal", "missing", "unknown-coverage" ], "metrics": [ { "id": "requirement_coverage", "name": "Mapped requirements", "numerator": "applicable requirements with an evidence binding and check", "denominator": "all requirements declared applicable in the approved version", "unknown_when": "applicability is unresolved", "not": "percentage legal compliance" }, { "id": "capture_coverage", "name": "Evidence capture coverage", "numerator": "eligible logical events with required evidence complete", "denominator": "eligible logical events in the scoped expected population", "unknown_when": "expected population is not established", "not": "received receipts divided by received receipts" } ], "production_gates": [ "reviewed profile and source ownership", "bounded compiler with no arbitrary code execution", "schema version governance", "signed profile authorization", "capture denominator validation" ], "acceptance_tests": [ { "id": "EC-01", "priority": "P0", "given": "an unknown applicability decision", "when": "the profile is evaluated", "then": "the requirement remains unresolved and cannot increase the covered count" }, { "id": "EC-02", "priority": "P0", "given": "a referenced evidence source is missing", "when": "the case is evaluated", "then": "the obligation names the missing source and produces an incomplete result" }, { "id": "EC-03", "priority": "P0", "given": "a changed rule version", "when": "a previous case is inspected", "then": "the original rule remains pinned and a new result requires a new revision" }, { "id": "EC-04", "priority": "P1", "given": "a new source adapter", "when": "the profile conformance vectors run", "then": "all required positive and negative vectors pass before adapter admission" } ], "reference_evidence": { "owner": "Hive reference release owner", "operations_path": "./operations.json", "acceptance_path": "./reference-acceptance.json" } }, { "id": "counterparty-reconciliation", "name": "Counterparty Reconciliation", "eyebrow": "Resolve the discrepancy, preserve the record", "headline": "Give both sides a case they can reproduce.", "promise": "Join each party's permitted observations into a reproducible case without erasing disagreement or replacing their source systems.", "buyer_question": "Why do our records differ, and which result has each party actually accepted?", "value": "Make investigations less dependent on screenshots, repeated handoffs, and an undocumented choice of whose log to trust.", "mechanism": "Normalize only the comparison view while retaining original signed observations, then apply a pinned reconciliation rule and collect separately authorized decisions.", "differentiator": "The calculation and each participant's acceptance are different version-bound objects. Disputes and superseding evidence can coexist with valid cryptographic checks.", "composition_anchors": [ "custody-handoff", "ledger-parity", "multi-source-divergence", "mandate-crossacceptor", "authority-carriage", "supersession-receipt", "proof-transition", "disclosure-presentation" ], "inputs": [ "authenticated party observations", "logical-event identity and attempts", "rule version and precedence", "correction and late-arrival policy", "participant identity and decision authority" ], "outputs": [ "immutable reconciliation case", "per-party count reproduction", "difference explanation with evidence references", "exception and correction history", "version-bound accept, reject, or escalate decisions" ], "state_machine": [ "collecting", "ready_to_calculate", "calculated", "pending_acceptance", "accepted", "disputed", "superseded" ], "advanced_capabilities": [ "Cross-party differential replay", "Explicit source precedence without overwriting source bytes", "Idempotent logical-event reconciliation", "Acceptance invalidation on material change", "Selective evidence exchange within party permissions" ], "proof_ceiling": "The recorded inputs reproduce this rule result and these recorded party decisions. Agreement does not establish source truth, billing entitlement, legal settlement, or organizational independence.", "reference_scope": "Reproduce counts and explain retries, conflicts, corrections, and stale decisions from separately labeled synthetic observations. No real counterparty supplies or approves them.", "production_status": "not_accepted", "reference_status": "tested_bounded_reference", "discovery_path": "/canon/surfaces/counterparty-reconciliation/index.html", "reference_scenarios": [ "retry", "conflict", "correction", "stale-acceptance" ], "metrics": [ { "id": "count_delta", "name": "Count difference", "numerator": "producer logical count minus recipient reproduced logical count", "denominator": "not a ratio", "unknown_when": "one side lacks reproducible permitted inputs", "not": "automatic billing adjustment" }, { "id": "accepted_case_rate", "name": "Jointly accepted revisions", "numerator": "eligible current case revisions accepted by every required authorized party", "denominator": "eligible current calculated case revisions", "unknown_when": "required party set is not fixed", "not": "matching signatures" }, { "id": "investigation_effort", "name": "Investigation effort", "numerator": "measured handling minutes for closed comparable cases", "denominator": "closed comparable cases in the same cohort", "unknown_when": "baseline or case timestamps are unavailable", "not": "a synthetic time-saving claim" } ], "production_gates": [ "party-specific authenticated adapters", "authorized decision roles", "record-custody and source-precedence agreement", "replayable versioned reconciliation rule", "dispute ownership and escalation process" ], "acceptance_tests": [ { "id": "CR-01", "priority": "P0", "given": "two consistent attempts for one logical event", "when": "the agreed deduplication rule runs", "then": "attempt count rises while logical count stays one" }, { "id": "CR-02", "priority": "P0", "given": "conflicting records with valid signatures", "when": "the case is checked", "then": "integrity can pass while reconciliation remains disputed" }, { "id": "CR-03", "priority": "P0", "given": "acceptance of revision one", "when": "a material correction creates revision two", "then": "the earlier decision is retained and revision two awaits its own decision" }, { "id": "CR-04", "priority": "P1", "given": "a delayed authorized observation", "when": "the late-data rule admits it", "then": "a new case revision is created without changing previous exports" } ], "reference_evidence": { "owner": "Hive reference release owner", "operations_path": "./operations.json", "acceptance_path": "./reference-acceptance.json" } }, { "id": "decision-evidence", "name": "Decision Evidence Graph", "eyebrow": "Trace each result to its support", "headline": "Open the reasoning record behind the result.", "promise": "Trace a recorded result through source evidence, transformations, evaluation methods, and applicable rules without confusing a signed reference with a true claim.", "buyer_question": "Which evidence supported this result, and what changes if that evidence changes?", "value": "Give reviewers a precise investigation path and reveal unsupported steps instead of asking them to accept an unexplained confidence score.", "mechanism": "Build a typed directed evidence graph with content-bound nodes and explicit transformation, support, evaluation, and supersession edges.", "differentiator": "Counterfactual removal and version-diff replay show the affected claims and decisions. Structural coverage and semantic evaluation remain separately measured.", "composition_anchors": [ "sigr-gca", "afir-ocr-docproof", "decision-provenance", "hivebound-envelope", "capture-commitment", "sigr-mir", "sigr-manifest", "numeric-lineage", "cache-epoch", "entropy-custody", "s2s", "analysis-replay", "stage-replay" ], "inputs": [ "permitted source material or resolvable references", "extraction and transformation versions", "claim and rule references", "evaluator identity and methodology", "model and serving evidence when relevant" ], "outputs": [ "typed evidence graph", "claim-to-source inspection path", "missing and conflicting support register", "evaluation record with uncertainty", "change-impact and replay report" ], "state_machine": [ "captured", "linked", "structurally_checked", "evaluation_pending", "evaluated", "challenged", "superseded" ], "advanced_capabilities": [ "Typed graph validation with cycle and dangling-edge refusal", "Counterfactual evidence removal", "Content-addressed transformation lineage", "Separate evaluator methodology and uncertainty", "Model and serving-state context when material" ], "proof_ceiling": "The graph and recorded support references are bound and structurally checked. Semantic support, source truth, model identity, and rule correctness require their own valid evidence and qualified assessment.", "reference_scope": "Inspect a small graph, detect absent or conflicting required support, and reproduce a deterministic rule. It does not provide a general semantic entailment evaluator or clinical decision system.", "production_status": "not_accepted", "reference_status": "tested_bounded_reference", "discovery_path": "/canon/surfaces/decision-evidence/index.html", "reference_scenarios": [ "normal", "missing", "conflict", "correction" ], "metrics": [ { "id": "structural_support", "name": "Structurally linked claims", "numerator": "claims with all required resolvable evidence links", "denominator": "claims requiring support in the scoped version", "unknown_when": "claim inventory is incomplete", "not": "semantic correctness" }, { "id": "semantic_assessment", "name": "Assessed semantic support", "numerator": "claims meeting the disclosed evaluator's support test", "denominator": "claims assessed under that evaluator and version", "unknown_when": "qualified evaluation was not run", "not": "signature validity or source truth" }, { "id": "change_impact", "name": "Affected decisions", "numerator": "decisions reachable from changed evidence through typed dependency edges", "denominator": "not a ratio", "unknown_when": "dependency graph is incomplete", "not": "proof all downstream effects were captured" } ], "production_gates": [ "permitted source access and disclosure policy", "versioned graph and transformation schemas", "qualified semantic evaluator where claimed", "source and model authenticity adapters", "reviewer challenge and correction workflow" ], "acceptance_tests": [ { "id": "DE-01", "priority": "P0", "given": "a signed reference to an unrelated passage", "when": "only structural checking runs", "then": "no semantic-support or truth claim is emitted" }, { "id": "DE-02", "priority": "P0", "given": "a cycle or unresolved graph edge", "when": "the package is evaluated", "then": "the structural check fails with the offending identifiers" }, { "id": "DE-03", "priority": "P0", "given": "an altered required evidence node", "when": "replay runs", "then": "the input digest and affected result change and prior acceptance cannot carry over" }, { "id": "DE-04", "priority": "P1", "given": "a qualified evaluator result", "when": "a reviewer opens the claim", "then": "method, version, inputs, uncertainty, and assessment scope are visible separately from the signature" } ], "reference_evidence": { "owner": "Hive reference release owner", "operations_path": "./operations.json", "acceptance_path": "./reference-acceptance.json" } }, { "id": "action-boundary", "name": "Action Boundary", "eyebrow": "Put the control where the action happens", "headline": "Require the evidence before the effect.", "promise": "Authorize a bounded action only when its declared evidence and authority checks pass at an integration that actually controls that effect.", "buyer_question": "Can this action occur without the required evidence, through a retry, stale authority, or another route?", "value": "Prevent a specific unapproved effect while leaving permitted work moving, and retain a reviewable reason for each refusal.", "mechanism": "Bind the prerequisite evidence, approved payload, destination, tenant, validity interval, and one-use authorization to an effect adapter with atomic consumption.", "differentiator": "The admission decision is tied to the actual effect boundary and its replay state. Pre-effect authorization and post-effect observation are separate, linked artifacts.", "composition_anchors": [ "imprimatur", "stipryn", "authorization-decision", "authority-qualification", "authority-delegation", "authority-revocation", "authority-carriage", "delegation-attenuation", "proof-transition", "effect-closure", "effect-quiescence", "pbs", "refusal-ledger", "howler-sae", "perimeter-bond", "diurnal-bond", "egress-bond", "forensic-rail" ], "inputs": [ "bounded action and effect adapter", "prerequisite evidence and rule version", "authorized issuer and delegation scope", "freshness and revocation context", "idempotency and replay ledger" ], "outputs": [ "bound admission or refusal decision", "consumed one-use authorization", "post-effect observation where available", "recovery and partial-effect state", "bypass and refusal evidence" ], "state_machine": [ "requested", "evidence_pending", "authorized", "refused", "authorization_consumed", "effect_observed", "effect_unknown", "reconciled" ], "advanced_capabilities": [ "Payload and destination-bound admission", "Atomic one-use authorization consumption", "Revocation-aware failure handling", "Time-of-check to time-of-effect controls", "Separate sidecar, shadow, and enforced operating modes" ], "proof_ceiling": "Only the named, tested adapter boundary is controlled. A signed refusal alone does not prove a downstream action was blocked, and observed effect evidence does not establish global exactly-once execution.", "reference_scope": "A local in-memory effect store demonstrates one-use admission, refusal, and replay prevention. It controls no external system and is not durable across a restart.", "production_status": "not_accepted", "reference_status": "tested_bounded_reference", "discovery_path": "/canon/surfaces/action-boundary/index.html", "reference_scenarios": [ "normal", "denial", "revoked", "missing" ], "metrics": [ { "id": "gate_decisions", "name": "Admission outcomes", "numerator": "allowed, refused, error, and unresolved decisions separately", "denominator": "all eligible attempts at the named boundary", "unknown_when": "capture of attempts is incomplete", "not": "all actions in the customer's environment" }, { "id": "effect_confirmation", "name": "Confirmed effects in scope", "numerator": "consumed authorizations with valid matching effect evidence", "denominator": "consumed authorizations requiring effect evidence", "unknown_when": "effect observation is unavailable", "not": "global exactly-once assurance" }, { "id": "enforcement_latency", "name": "Admission latency", "numerator": "measured decision latency distribution", "denominator": "eligible measured decisions per profile and load regime", "unknown_when": "no controlled measurement exists", "not": "simulation replay throughput" } ], "production_gates": [ "effect adapter with no uncontrolled bypass", "durable atomic replay state", "authority and revocation SLA", "failure and partial-effect recovery protocol", "controlled bypass and load tests" ], "acceptance_tests": [ { "id": "AB-01", "priority": "P0", "given": "an authorization bound to payload A", "when": "payload B is submitted", "then": "the controlled effect is refused and the mismatch is recorded" }, { "id": "AB-02", "priority": "P0", "given": "a consumed authorization", "when": "the same or concurrent request is retried", "then": "no additional controlled effect occurs" }, { "id": "AB-03", "priority": "P0", "given": "revoked, expired, or unresolvable authority", "when": "enforced admission runs", "then": "the action is refused or blocked according to the explicit fail-closed policy" }, { "id": "AB-04", "priority": "P0", "given": "an observational sidecar", "when": "evidence collection fails", "then": "the result is an evidence gap, not a claim that the customer's action was blocked" } ], "reference_evidence": { "owner": "Hive reference release owner", "operations_path": "./operations.json", "acceptance_path": "./reference-acceptance.json" } }, { "id": "portable-trust", "name": "Portable Trust", "eyebrow": "Keep the ability to check", "headline": "The evidence still works when the website does not.", "promise": "Give recipients a bounded verification package they can retain and inspect using separately configured trust, without making their underlying evidence public.", "buyer_question": "What can be independently reproduced from this package, under which trust assumptions, and what is unavailable?", "value": "Reduce dependence on a vendor's availability and preserve a practical review path through disputes, system changes, and retention periods.", "mechanism": "Package original signed objects, permitted replay inputs, profile and checker versions, trust context, disclosure boundaries, and a content manifest with a fail-closed verifier.", "differentiator": "Algorithm-agile profile verification and as-of trust evaluation keep signature validity, trust status, source availability, replay, and checkpoint evidence separate.", "composition_anchors": [ "proof-transition-portable", "transparency-checkpoint", "sovereign-receipt-registry", "disclosure-presentation", "disclosure-free-replay", "viewkey", "retention-policy", "retention-purge", "verdict-custody", "control-replay" ], "inputs": [ "original signed artifacts", "permitted replay material", "expected keys from a separate trust channel", "algorithm and checker profile", "manifest, retention, and disclosure terms" ], "outputs": [ "recipient-held evidence package", "per-check verification results", "offline replay report", "trust as-of and unsupported-state report", "portable correction and revision history" ], "state_machine": [ "assembled", "manifest_checked", "trust_checked", "integrity_checked", "replayed", "partially_verifiable", "rejected" ], "advanced_capabilities": [ "Profile-specific algorithm agility without downgrade", "Offline as-of trust and revocation semantics", "Independent trust bootstrap and key rotation", "Deterministic replay with selective disclosure boundaries", "Package and verifier supply-chain verification" ], "proof_ceiling": "The supported checks reproduce from the supplied artifacts under the declared trust configuration. Offline replay cannot establish later revocation, missing source truth, universal log consistency, or independence of a Hive-operated signer.", "reference_scope": "Real Ed25519 signatures on neutral synthetic packages, an explicitly selected demo public key, and a Node offline checker. No accredited implementation validation, outside witness, or live trust authority is implied.", "production_status": "not_accepted", "reference_status": "tested_bounded_reference", "discovery_path": "/canon/surfaces/portable-trust/index.html", "reference_scenarios": [ "normal", "tampered", "unsupported", "revoked" ], "metrics": [ { "id": "portable_replay", "name": "Reproducible packages", "numerator": "eligible packages reproducing all required supported checks in a clean recipient environment", "denominator": "eligible packages tested under the stated profile", "unknown_when": "recipient-side test has not occurred", "not": "downloads or website visits" }, { "id": "trust_freshness", "name": "Trust information age", "numerator": "verification time minus trust snapshot time", "denominator": "not a ratio", "unknown_when": "no authenticated trust timestamp exists", "not": "proof no later revocation occurred" }, { "id": "retained_completeness", "name": "Required files retained", "numerator": "required manifest files present with matching digests", "denominator": "required files named by the pinned package profile", "unknown_when": "manifest or profile is untrusted", "not": "source completeness" } ], "production_gates": [ "reviewed trust distribution and rotation", "profile-conformance acceptance", "independent recipient replay", "retention and recovery tests", "verifier release and dependency integrity" ], "acceptance_tests": [ { "id": "PT-01", "priority": "P0", "given": "a complete retained supported package and separate trusted key", "when": "Hive is unavailable", "then": "the pinned checker reproduces supported checks without network access" }, { "id": "PT-02", "priority": "P0", "given": "a package that substitutes its own key", "when": "verification runs", "then": "the substituted key does not become trusted" }, { "id": "PT-03", "priority": "P0", "given": "an unsupported mandatory signature profile", "when": "the package is checked", "then": "unsupported is returned with no fallback to a weaker successful check" }, { "id": "PT-04", "priority": "P0", "given": "valid as-of trust but unavailable current revocation data", "when": "offline verification runs", "then": "the result states its as-of limit and does not assert current non-revocation" } ], "reference_evidence": { "owner": "Hive reference release owner", "operations_path": "./operations.json", "acceptance_path": "./reference-acceptance.json" } } ] }