kairos-chain 3.45.0 → 3.47.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea7401710d6467287e35146c84d731c08733f184fac36be13e76de11d7af5433
-  data.tar.gz: a823ba8bf1bb1157394ff04466cdcf96c0347eee50796816fe8c2fd1d188792c
+  metadata.gz: e43541279a3d104b85372574c94f6fdf2d96188fb7de83d5a4d84c3f470634d7
+  data.tar.gz: 21b58d11561dd6d4177a7aa3d3832bdfe4fbde80ff2da2af198662d655a6fc81
 SHA512:
-  metadata.gz: a11ba74c10eb1c56ef15b57992755083b6d36bd4fef1ea73bf1cae64afc1f07ad26f8774ee703c3c98eefa25c8a422441c5c5af032b9ae523d7518c7dc50193d
-  data.tar.gz: 26f95dd3245e9e39311349ef540954d200985a59bf9da38b3b08256d11ec50a445d60cc3f0c41538b6a0c0bfb2eb591ce742dc4523950d9ffe8f06471d22e50a
+  metadata.gz: 41bc6c95594567c2e80ed006ea2bd21e7926361bf3cfb14fdf5a6b0a4aac17b9dca3f65faf17be1a4e86b16ce3fb9285af121d747fcdeac66eca58857d4af0bd
+  data.tar.gz: 77a5ac53384830598e90b408b4c737eb8549c219dfdeb47c38feb5939c46829c2b53dc9744da1a9914033521ff1fdf126f8d941989fe62857316863a75790e5f

data/CHANGELOG.md

@@ -4,6 +4,84 @@ All notable changes to the `kairos-chain` gem will be documented in this file.
 
 This project follows [Semantic Versioning](https://semver.org/).
 
+## [3.47.0] - 2026-07-22
+
+### Synoptis — selective disclosure sdp-1 (AUD-L4 slice 1)
+
+Implements AUD-L4 design v0.3 (SDP-1..5, FROZEN, review-converged) slice 1
+in the synoptis SkillSet. All additive: sdp-1 builds on khab-1/map-1/rpr-1
+exactly as each prior slice built on its predecessors; no pre-existing file
+changed.
+
+- `conventions/sdp-1.md`: content-addressed selective-disclosure convention —
+  hash-based salted field-level disclosure (content-blinding: field values
+  hidden, record digest / field names / count public; the ZK membership
+  family is disclosed as out of scope for a later convention). Field
+  commitments (one salted digest per field, total coverage, `sdp-1/field`
+  domain separation), convention-determined disclosure profile (closed
+  schema; predicate + opened set + currency, `format` always opened),
+  presentation (closed schema per shape), three predicates
+  (typed-existence / claimed-verdict / conforming-verdict with foreignness,
+  anterior-tolerance assessment, and sibling-aware tolerance-target
+  coherence inside the checked predicate), extent-bounded currency scan
+  (issuer rule, residues disclosed unconditionally), computational
+  hiding/soundness base stated (no trusted setup).
+- `selective_disclosure.rb`: build/parse/verify for field commitments,
+  profile, presentation (refuse-not-coerce, canonical-serialization
+  equality everywhere); signature verification from the record DIGEST alone
+  via the unchanged map-1 §1.1 attestation signature — blinded verdicts
+  without record content; conforming-verdict refuses (never degrades) when
+  operator credential or rpr-1 §2.1 assessment material is missing;
+  currency scan with unestablished-vs-unretracted discipline.
+- `bin/sdp_verify.rb`: offline verifier (commit / binding / presentation /
+  profile / currency / convention), exit-code discipline (0/1/2), strict
+  intake (delete_suffix, canonical numerals).
+- `test/test_sdp_disclosure.rb`: 61 design-constraint assertions
+  (SDP-1..5), including crafted-record shape refusal, verdict-vocabulary
+  closure, sibling-target coherence (rpr-1 §2.1 pooling agreement),
+  hiding of withheld values across artifacts and error paths, and
+  khab/map/rpr non-interference (37/75/76/88 regression green).
+
+Implementation review: 3 rounds, R3 4/6 APPROVE + executable-probe
+personas 2/2, zero remaining P0/P1 (dispositions in docs/drafts/).
+
+## [3.46.0] - 2026-07-22
+
+### Synoptis — reproduction endorsement rpr-1 (AUD-L3 slice 1)
+
+Implements AUD-L3 design v0.4 (RPR-1..5, review-converged) slice 1 in the
+synoptis SkillSet. All additive: rpr-1 builds on map-1/khab-1 exactly as
+map-1 built on khab-1; no pre-existing file changed.
+
+- `conventions/rpr-1.md`: content-addressed reproduction-endorsement
+  convention — re-execution target (inputs/environment/pipeline/output
+  digests; the first three form the committed computation identification,
+  output excluded), target-bound result-free tolerance declaration
+  (bit-identity at rpr-1), reproduction endorsement carrying the adjudicated
+  verdict (reproduced / not-reproduced) and its adjudication mode
+  (hand / procedure), declaration-set assessment (order-independent, sibling
+  targets pooled by computation identification, residue disclosed), map-1 §3
+  retraction reused unchanged.
+- `reproduction.rb`: build/parse/digest for target, tolerance, endorsement
+  (closed schemas, canonical-serialization equality, refuse-not-coerce);
+  endorsement signing/verification via the unchanged map-1 §1.1 attestation
+  signature (ChainCredential); foreignness conformance check (RPR-4);
+  declaration-set assessment reporting invoked commitment (earliest
+  anterior), posterior commitments, digest-tiebroken rank, distinct-digest
+  multiplicity, and unresolved-equivalence residue.
+- `bin/rpr_verify.rb`: offline auditor verifier (target / tolerance /
+  endorsement / assess / convention). Strict intake (at most one trailing
+  LF via delete_suffix — CRLF refused), canonical base-10 numerals only,
+  exit-code discipline (0 verified/report, 1 rejected, 2 unresolvable),
+  RPR-1/RPR-4 condition disclosure in output.
+- `test/test_rpr_reproduction.rb`: 37 design-constraint assertions
+  (RPR-1..5), including presentation-order independence of the assessment
+  and rank, CRLF/padding refusal, and map-1 non-interference (75/75
+  regression green).
+
+Implementation review: 3 rounds, R3 5/5 APPROVE, zero remaining P0/P1
+(executable-probe personas; dispositions in docs/drafts/).
+
 ## [3.45.0] - 2026-07-21
 
 ### Synoptis — mutual anchoring protocol MAP-1..4 (map-1, AUD-L2)

data/lib/kairos_mcp/version.rb

@@ -1,4 +1,4 @@
 module KairosMcp
-  VERSION = "3.45.0"
+  VERSION = "3.47.0"
   CHANGELOG_URL = "https://github.com/masaomi/KairosChain_2026/blob/main/CHANGELOG.md"
 end

data/templates/skillsets/synoptis/bin/rpr_verify.rb

@@ -0,0 +1,171 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# rpr_verify — offline auditor verifier for rpr-1 reproduction-endorsement
+# artifacts (RPR-1..5, aud_l3_reproducibility_design v0.4).
+#
+# Verifies with EXACTLY the disclosed trust base: the artifacts named on the
+# command line plus the shipped rpr-1 and map-1 convention definitions. No
+# registry, no network, no operator cooperation. (Authentic chain views are
+# the caller's inputs; their integrity is the khab-1/map-1 surfaces' business.)
+#
+# Usage:
+#   rpr_verify.rb target      <target.json>
+#   rpr_verify.rb tolerance   <tolerance.json> [target.json]
+#       with target.json: additionally checks the binding matches that target.
+#   rpr_verify.rb endorsement <endorsement.json> <endorser_credential.json> <signature-hex> [operator_credential.json]
+#       with operator credential: additionally checks foreignness (RPR-4).
+#   rpr_verify.rb assess      <targets.json> <declarations.json> <invoked_tolerance_sha256> <endorsement_position>
+#       targets.json      = JSON array of target record STRINGS
+#       declarations.json = JSON array of {"tolerance": "<record string>", "position": <int>}
+#   rpr_verify.rb convention
+#       prints the shipped rpr-1 convention digest.
+#
+# Exit status: 0 = VERIFIED/REPORT, 1 = REJECTED, 2 = usage / unresolvable.
+
+require 'json'
+require 'digest'
+require_relative '../lib/synoptis/anchoring/entry'
+require_relative '../lib/synoptis/anchoring/chain_credential'
+require_relative '../lib/synoptis/anchoring/reproduction'
+
+CRED = Synoptis::Anchoring::ChainCredential
+REPRO = Synoptis::Anchoring::Reproduction
+
+def die(msg)
+  warn "rpr_verify: #{msg}"
+  exit 2
+end
+
+def reject(msg)
+  puts "REJECTED: #{msg}"
+  exit 1
+end
+
+# Read a record artifact: at most one trailing newline is tolerated (file
+# convenience); any other surrounding bytes stay in the string and fail the
+# canonical check downstream (refuse-not-coerce — a padded artifact is not
+# the canonical record).
+def read_file(path)
+  # delete_suffix, not chomp: chomp("\n") also swallows "\r\n" and a bare
+  # trailing "\r", which would coerce CRLF artifacts into canonical form.
+  File.read(path).delete_suffix("\n")
+rescue SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json(path)
+  JSON.parse(File.read(path))
+rescue JSON::ParserError, SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json_hash(path, label)
+  parsed = load_json(path)
+  die "#{path}: #{label} must be a JSON object, got #{parsed.class}" unless parsed.is_a?(Hash)
+  parsed
+end
+
+# Canonical base-10 numerals only: leading zeros are refused, not
+# reinterpreted (a non-canonical numeral is a malformed input, exit 2).
+def strict_int(value, label)
+  die "#{label} must be a canonical base-10 integer, got #{value.inspect}" unless value.is_a?(String) && value.match?(/\A(0|[1-9]\d*)\z/)
+  Integer(value, 10)
+end
+
+HEX64 = /\A[a-f0-9]{64}\z/
+
+mode = ARGV.shift
+
+case mode
+when 'target'
+  die 'usage: rpr_verify.rb target <target.json>' unless ARGV.size == 1
+  record = read_file(ARGV[0])
+  begin
+    REPRO.parse_target!(record)
+  rescue REPRO::ReproductionError => e
+    reject e.message
+  end
+  puts "VERIFIED: target digest #{REPRO.target_digest(record)}"
+  puts "  computation identification: #{REPRO.computation_id(record).split('|').map { |h| h[0, 12] }.join('… | ')}… (output excluded, rpr-1 §1)"
+  puts 'NOTE: binding fixes referents, never validates them (RPR-2, MPR-4).'
+
+when 'tolerance'
+  die 'usage: rpr_verify.rb tolerance <tolerance.json> [target.json]' unless (1..2).cover?(ARGV.size)
+  record = read_file(ARGV[0])
+  tol = begin
+    REPRO.parse_tolerance!(record)
+  rescue REPRO::ReproductionError => e
+    reject e.message
+  end
+  if ARGV[1]
+    target = read_file(ARGV[1])
+    begin
+      digest = REPRO.target_digest(target)
+    rescue REPRO::ReproductionError => e
+      reject e.message
+    end
+    reject "tolerance binds target #{tol['target_sha256'][0, 12]}…, not the supplied target #{digest[0, 12]}…" unless tol['target_sha256'] == digest
+  end
+  puts "VERIFIED: tolerance digest #{Digest::SHA256.hexdigest(record)} (kind #{tol['kind']}, target #{tol['target_sha256'][0, 12]}…)"
+  puts 'NOTE: anteriority to any endorsement is decided by committed order (MPR-8), not by this tool.'
+
+when 'endorsement'
+  die 'usage: rpr_verify.rb endorsement <endorsement.json> <endorser_credential.json> <signature-hex> [operator_credential.json]' unless (3..4).cover?(ARGV.size)
+  record = read_file(ARGV[0])
+  cred = load_json_hash(ARGV[1], 'endorser credential')
+  ok = begin
+    REPRO.verify_endorsement(record, cred, ARGV[2])
+  rescue REPRO::ReproductionError, CRED::CredentialError => e
+    reject e.message
+  end
+  reject 'endorsement signature does not verify under the endorser credential' unless ok
+  e = REPRO.parse_endorsement!(record)
+  if ARGV[3]
+    operator = load_json_hash(ARGV[3], 'operator credential')
+    begin
+      reject 'endorser credential equals operator credential — same-party, not a conforming rpr-1 endorsement (RPR-4)' unless REPRO.foreign?(cred, operator)
+    rescue CRED::CredentialError => err
+      # An unresolvable operator credential is a caller-input problem, not a
+      # verdict about the endorsement (exit-code discipline: 2, not 1).
+      die "operator credential unresolvable: #{err.message}"
+    end
+  end
+  puts "VERIFIED: #{e['verdict']} endorsement of target #{e['target_sha256'][0, 12]}… under tolerance #{e['tolerance_sha256'][0, 12]}…"
+  puts "  adjudication mode: #{e['adjudication_mode']}#{e['procedure_sha256'] ? " (procedure #{e['procedure_sha256'][0, 12]}…)" : ''}"
+  puts 'CONDITIONS (travel with every stronger reading, rpr-1 §3):'
+  puts '  - the verdict asserts reproduction or its failure, never correctness (RPR-1, MPR-6)'
+  puts '  - evidence of a committed claim, never proof a re-execution happened (RPR-4)'
+  puts '  - distinctness is not independence; a colluding pair can fabricate (RPR-4)'
+  puts '  - the named mode is a declaration, not a proof (map-1 §3 non-self-certifying)'
+  if ARGV[3]
+    puts '  - foreignness checked against the SUPPLIED operator credential only'
+  else
+    puts '  - foreignness (RPR-4 conformance condition) NOT assessed — no operator credential supplied'
+  end
+
+when 'assess'
+  die 'usage: rpr_verify.rb assess <targets.json> <declarations.json> <invoked_tolerance_sha256> <endorsement_position>' unless ARGV.size == 4
+  targets = load_json(ARGV[0])
+  die "#{ARGV[0]}: expected a JSON array of target record strings" unless targets.is_a?(Array) && targets.all? { |t| t.is_a?(String) }
+  declarations = load_json(ARGV[1])
+  die "#{ARGV[1]}: expected a JSON array of {tolerance, position} objects" unless declarations.is_a?(Array)
+  invoked = ARGV[2]
+  die 'invoked_tolerance_sha256 must be 64-char lowercase hex' unless invoked.match?(HEX64)
+  position = strict_int(ARGV[3], 'endorsement_position')
+  begin
+    report = REPRO.assess_declarations(targets: targets, declarations: declarations,
+                                       invoked_tolerance_sha256: invoked, endorsement_position: position)
+  rescue REPRO::ReproductionError => e
+    reject e.message
+  end
+  puts JSON.pretty_generate(report)
+  puts 'NOTE: the assessment reports, the reader prices (RPR-3: exposure, not prevention).'
+  puts 'NOTE: a produced report always exits 0; the conformance bit is invoked_conforming in the report.'
+
+when 'convention'
+  puts "rpr-1 convention sha256: #{REPRO.convention_sha256}"
+
+else
+  die 'usage: rpr_verify.rb target|tolerance|endorsement|assess|convention ... (see header)'
+end

data/templates/skillsets/synoptis/bin/sdp_verify.rb

@@ -0,0 +1,174 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# sdp_verify — offline verifier for sdp-1 selective-disclosure artifacts
+# (SDP-1..5, aud_l4_selective_disclosure_design v0.3).
+#
+# Verifies with EXACTLY the disclosed trust base: the artifacts named on the
+# command line plus the shipped sdp-1, rpr-1, and map-1 convention
+# definitions. No registry, no network, no producer cooperation. (Authentic
+# chain/log views are the caller's inputs; their integrity is the
+# khab-1/map-1 surfaces' business.)
+#
+# Usage:
+#   sdp_verify.rb commit  <record.json> [salts.json]
+#       builds the sdp-1 field-commitments auxiliary for a canonical record;
+#       prints the auxiliary record and (fresh or supplied) salts as JSON.
+#   sdp_verify.rb binding <aux.json> <record.json> <salts.json>
+#       checks the SDP-2 binding: every field digest and the record digest
+#       recompute from record + salts.
+#   sdp_verify.rb presentation <presentation.json> [operator_credential.json] [assessment.json]
+#       verifies a presentation. conforming-verdict REQUIRES both extras;
+#       assessment.json = {"targets":[...record strings...],
+#                          "declarations":[{"tolerance":"...","position":N}...],
+#                          "endorsement_position":N}.
+#   sdp_verify.rb profile <presentation.json>
+#       prints the disclosure profile and what it does/does not show.
+#   sdp_verify.rb currency <entries.json> <carrier_entry_hash> <extent>
+#       runs the sdp-1 §5 retraction scan over a supplied entry view.
+#   sdp_verify.rb convention
+#       prints the shipped sdp-1 convention digest.
+#
+# Exit status: 0 = VERIFIED/REPORT, 1 = REJECTED, 2 = usage / unresolvable.
+
+require 'json'
+require 'digest'
+require_relative '../lib/synoptis/anchoring/entry'
+require_relative '../lib/synoptis/anchoring/chain_credential'
+require_relative '../lib/synoptis/anchoring/reproduction'
+require_relative '../lib/synoptis/anchoring/selective_disclosure'
+
+SD = Synoptis::Anchoring::SelectiveDisclosure
+CRED = Synoptis::Anchoring::ChainCredential
+
+def die(msg)
+  warn "sdp_verify: #{msg}"
+  exit 2
+end
+
+def reject(msg)
+  puts "REJECTED: #{msg}"
+  exit 1
+end
+
+# Read a record artifact: at most one trailing newline is tolerated (file
+# convenience); any other surrounding bytes stay in the string and fail the
+# canonical check downstream (refuse-not-coerce). delete_suffix, not chomp:
+# chomp also swallows CRLF, which would coerce a non-canonical artifact.
+def read_file(path)
+  File.read(path).delete_suffix("\n")
+rescue SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json(path, label)
+  parsed = JSON.parse(File.read(path))
+  die "#{path}: #{label} must be a JSON object or array, got #{parsed.class}" unless parsed.is_a?(Hash) || parsed.is_a?(Array)
+  parsed
+rescue JSON::ParserError, SystemCallError => e
+  die "cannot read #{path}: #{e.message}"
+end
+
+def load_json_hash(path, label)
+  parsed = load_json(path, label)
+  die "#{path}: #{label} must be a JSON object, got #{parsed.class}" unless parsed.is_a?(Hash)
+  parsed
+end
+
+# Canonical base-10 numerals only: leading zeros are refused, not
+# reinterpreted (a non-canonical numeral is a malformed input, exit 2).
+def strict_int(value, label)
+  die "#{label} must be a canonical base-10 integer, got #{value.inspect}" unless value.is_a?(String) && value.match?(/\A(0|[1-9]\d*)\z/)
+  Integer(value, 10)
+end
+
+HEX64 = /\A[a-f0-9]{64}\z/
+
+mode = ARGV.shift
+
+case mode
+when 'commit'
+  die 'usage: sdp_verify.rb commit <record.json> [salts.json]' unless (1..2).cover?(ARGV.size)
+  record = read_file(ARGV[0])
+  salts = ARGV[1] ? load_json_hash(ARGV[1], 'salts') : nil
+  built = begin
+    SD.build_field_commitments(record, salts: salts)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  puts JSON.pretty_generate(built)
+  warn 'NOTE: keep the salts private; each opened salt discloses exactly its field (sdp-1 §6).'
+
+when 'binding'
+  die 'usage: sdp_verify.rb binding <aux.json> <record.json> <salts.json>' unless ARGV.size == 3
+  aux = read_file(ARGV[0])
+  record = read_file(ARGV[1])
+  salts = load_json_hash(ARGV[2], 'salts')
+  ok = begin
+    SD.verify_field_commitments(aux, record, salts)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  reject 'auxiliary is NOT checkably bound to the record (SDP-2: a bound-by-assertion auxiliary is a re-authoring)' unless ok
+  puts "VERIFIED: auxiliary is checkably bound to record #{Digest::SHA256.hexdigest(record)[0, 12]}… (total coverage, SDP-2)"
+
+when 'presentation'
+  die 'usage: sdp_verify.rb presentation <presentation.json> [operator_credential.json] [assessment.json]' unless (1..3).cover?(ARGV.size)
+  pres = read_file(ARGV[0])
+  operator = ARGV[1] ? load_json_hash(ARGV[1], 'operator credential') : nil
+  assessment = ARGV[2] ? load_json_hash(ARGV[2], 'assessment material') : nil
+  report = begin
+    SD.verify_presentation(pres, operator_credential: operator, assessment: assessment)
+  rescue SD::DisclosureError, CRED::CredentialError => e
+    reject e.message
+  end
+  unless report[:valid]
+    puts "REJECTED: presentation does not verify (predicate #{report[:predicate]})"
+    report[:failures].each { |f| puts "  - #{f}" }
+    exit 1
+  end
+  puts "VERIFIED: #{report[:predicate]} over committed record #{report[:record_sha256][0, 12]}…"
+  report[:opened].each { |n, v| puts "  opened #{n} = #{v.inspect}" }
+  report[:notes].each { |n| puts "  NOTE: #{n}" }
+  puts 'NOTE: soundness = sha256 collision resistance + Ed25519, no setup; hiding is computational, content-only (SDP-5, sdp-1 §6).'
+
+when 'profile'
+  die 'usage: sdp_verify.rb profile <presentation.json>' unless ARGV.size == 1
+  pres = read_file(ARGV[0])
+  p = begin
+    SD.parse_presentation!(pres)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  profile = p['profile']
+  puts "profile (meaning fixed by sdp-1 §2, never producer gloss — SDP-4):"
+  puts "  predicate: #{profile['predicate']}"
+  puts "  opened:    #{profile['opened'].join(', ')}"
+  puts "  withheld:  every other field of the referenced record (values only; names and count are public)"
+  puts "  currency:  #{profile['currency']}"
+  puts '  shows:     existence and the opened values of ONE committed record'
+  puts '  never:     non-existence, uniqueness, sibling records, contrary verdicts, producer selection (SDP-3)'
+
+when 'currency'
+  die 'usage: sdp_verify.rb currency <entries.json> <carrier_entry_hash> <extent>' unless ARGV.size == 3
+  entries = load_json(ARGV[0], 'entries')
+  die "#{ARGV[0]}: entries must be a JSON array" unless entries.is_a?(Array)
+  carrier = ARGV[1].to_s
+  die 'carrier_entry_hash must be 64-char lowercase hex' unless carrier.match?(HEX64)
+  extent = strict_int(ARGV[2], 'extent')
+  scan = begin
+    SD.scan_currency(entries: entries, carrier_entry_hash: carrier, extent: extent)
+  rescue SD::DisclosureError => e
+    reject e.message
+  end
+  puts "REPORT: #{scan[:status]} (scanned extent #{scan[:scanned_extent]})"
+  puts "  hits (positions): #{scan[:hits].join(', ')}" if scan[:hits]&.any?
+  puts "  NOTE: #{scan[:note]}"
+  exit(scan[:status] == 'retracted' ? 1 : 0)
+
+when 'convention'
+  puts "sdp-1 convention sha256: #{SD.convention_sha256}"
+
+else
+  die 'usage: sdp_verify.rb commit|binding|presentation|profile|currency|convention …'
+end

data/templates/skillsets/synoptis/lib/synoptis/anchoring/conventions/rpr-1.md

@@ -0,0 +1,141 @@
+# rpr-1 — KairosChain Reproduction Endorsement Convention, version 1
+
+Status: committed verification convention (RPR-1..5 of
+aud_l3_reproducibility_design v0.4). The SHA-256 over this file's raw bytes is
+the convention integrity digest; every artifact that names `rpr-1` commits it
+as its convention reference. A verifier holding a definition whose digest does
+not match the committed one MUST treat the artifact's convention as
+unresolvable and refuse to verify under it. Any change to this convention is a
+new identifier (`rpr-2`, ...); this file is never edited in place.
+rpr-1 builds on map-1 (credentials, attestation signatures, attestation types,
+retraction) and khab-1 (committed identity, committed order) and modifies
+neither: a map-1 artifact is valid with or without any rpr-1 artifact present.
+
+All record literals below are canonical JSON (keys sorted recursively,
+`JSON.generate` compact form). A record is valid only in its canonical
+serialization with exactly the fields shown — a non-canonical or extra-field
+record is not an rpr-1 artifact and is ignored as noise (map-1 §4 precedent).
+
+## 1. Re-execution target (RPR-2)
+
+    {"environment_sha256":"<64-hex>","format":"rpr-1/target",
+     "input_sha256":"<64-hex>","output_sha256":"<64-hex>",
+     "pipeline_sha256":"<64-hex>"}
+
+The target commits both halves of the verdict's referent: what is re-run
+(inputs, environment, pipeline version) and what the re-run output is judged
+against (the committed output). The first three digests — `input_sha256`,
+`environment_sha256`, `pipeline_sha256` — constitute the target's **committed
+computation identification** (design §3(b)): the identification of what is
+re-run, which two targets can share while naming different committed outputs.
+`output_sha256` completes the target but does not participate in that
+identification. The target digest is the SHA-256 of the target's canonical
+JSON. What the digests are digests OF (file formats, environment pinning,
+pipeline identity) is the referenced material's business; rpr-1 commits
+references, it does not validate referents (MPR-4 asymmetry, RPR-2 limit).
+
+## 2. Tolerance declaration (RPR-3)
+
+    {"format":"rpr-1/tolerance","kind":"bit-identity","target_sha256":"<64-hex>"}
+
+A tolerance declaration is bound to a named target and is result-free by
+construction: the schema is closed and `kind` is the only expressive field, so
+no outcome-referencing content can be expressed. At rpr-1 the only kind is
+`bit-identity` (re-run output matches the committed output byte for byte);
+richer tolerance grammars (numerical bounds, domain equivalence) are a new
+convention — this narrowness is disclosed, not hidden. The declaration is
+committed as an internal-chain record ahead of the endorsements it governs;
+committed position provides decidable anteriority (MPR-8). One declaration has
+exactly one digest (canonical serialization).
+
+### 2.1 Declaration-set assessment (RPR-3)
+
+Conformance of an endorsement's tolerance is assessed against the record, not
+the endorser's selection. Given target records, tolerance declarations with
+their committed positions, and the endorsement's committed position, the
+assessment reports:
+
+- every anterior declaration bound to the endorsement's target;
+- every anterior declaration bound to any sibling target sharing the same
+  committed computation identification (§1) — a menu spread across
+  near-duplicate targets is the same menu and is read as one set (at rpr-1,
+  sharing = equality of the three computation-identification digests);
+- the multiplicity of that pooled set and the invoked declaration's place in
+  it;
+- the unresolved residue: declarations whose `target_sha256` resolves to no
+  supplied target record (sharing undecidable there), disclosed rather than
+  silently dropped.
+
+The assessment reports; the reader prices. A verdict judged under one of many
+anterior declarations is conforming and wears the multiplicity openly; a
+tolerance chosen after the result is non-conforming (its posteriority is
+decidable from committed order). The assessment is a function of the committed
+record alone, never of presentation order: a declaration committed at several
+positions is one declaration (one digest) with several commitments; the
+invoked declaration conforms iff any of its commitments is anterior,
+represented by the earliest, with posterior commitments disclosed alongside;
+multiplicity counts distinct declarations, and the invoked declaration's
+place is reported as its rank in the pooled anterior set ordered by earliest
+anterior position, with equal positions ordered by declaration digest — so
+every reported quantity, ranks included, is decidable from the committed
+record alone.
+
+## 3. Reproduction endorsement (RPR-1, RPR-4)
+
+hand-adjudicated:
+
+    {"adjudication_mode":"hand","format":"rpr-1/endorsement",
+     "target_sha256":"<64-hex>","tolerance_sha256":"<64-hex>",
+     "verdict":"reproduced"}
+
+procedure-adjudicated:
+
+    {"adjudication_mode":"procedure","format":"rpr-1/endorsement",
+     "procedure_sha256":"<64-hex>","target_sha256":"<64-hex>",
+     "tolerance_sha256":"<64-hex>","verdict":"not-reproduced"}
+
+`verdict` is `reproduced` or `not-reproduced`: the affirmative and the
+negative verdict are the same kind of record under the same bindings, so the
+record has a conforming place for failure as well as success (RPR-1).
+`adjudication_mode` names the gate behind the verdict (RPR-4): `hand`, or
+`procedure` with `procedure_sha256` naming the committed adjudication
+procedure whose anterior adoption is the judgment act. `procedure_sha256` is
+present exactly when the mode is `procedure` (closed schema per mode). The
+named mode, like the attestation type itself, is a declaration and not a
+proof (map-1 §3 non-self-certifying).
+
+The endorsement is signed under the endorser's map-1 credential using the
+map-1 §1.1 attestation signature, with the payload being the endorsement
+record string. Verification needs only the credential, the record, and the
+signature. The endorsement is carried with `attestation_type` =
+`quality-endorsement` (map-1 §3, unchanged).
+
+Foreignness (RPR-4) is a conformance condition: an endorsement whose issuer
+credential digest equals the operator credential digest for the target's
+chain is not a conforming rpr-1 endorsement, whatever else it may be as an
+ordinary same-party claim. Distinctness is not independence: a colluding pair
+can fabricate an endorsement, affirmative or negative, without any run having
+occurred — the endorsement is evidence of a committed claim, never proof that
+a re-execution happened (RPR-4 disclosed limit).
+
+What a verified endorsement asserts is exactly: this endorser claimed, at a
+committed moment, that the target was re-run and its output did or did not
+match the target's committed output within the named tolerance — and nothing
+else. No claim of correctness, validity, fitness, or significance (RPR-1,
+MPR-6); absence of any endorsement proves nothing (MPR-9 non-production).
+
+## 4. Retraction (RPR-5)
+
+A mistaken endorsement is withdrawn by the map-1 §3 `retraction` unchanged:
+same issuer, unambiguous target, appended. A retracted endorsement still
+stands as a committed record that the verdict was once claimed and later
+taken back; nothing is unsaid by deletion and no anchored commitment's
+coverage is subtracted (AHM-4).
+
+## 5. Verification procedure and trust base
+
+All rpr-1 verification needs only: the artifacts named above, this
+definition, the map-1 definition (for credentials, signatures, types, and
+retraction), and authentic views of the logs/chains the artifacts reference.
+No registry, no network, no operator cooperation for verification —
+production of artifacts remains the endorser's act (MPR-4 asymmetry).