@oxdeai/conformance 1.3.1 → 2.0.0

package/dist/evidence-metadata.json

@@ -0,0 +1,3489 @@
+{
+  "registry": {
+    "version": 2,
+    "claims": [
+      {
+        "id": "CANON-001",
+        "title": "Canonical object key ordering",
+        "source": {
+          "path": "docs/spec/core/canonicalization-v1.md",
+          "section": "## 6. Serialization Rules (normative)",
+          "quote": "- Object keys: NFC-normalize, reject duplicates after normalization, then sort keys by byte-wise UTF-8 order.",
+          "role": "normative"
+        },
+        "strength": "normative-statement",
+        "category": "ARTIFACT",
+        "implementation": [
+          {
+            "path": "packages/core/src/crypto/hashes.ts",
+            "symbol": "canonicalizeToJson"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/core/src/test/canonicalization.property.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "C-P2: canonical output is invariant to object key insertion order at every nesting level"
+            },
+            "kind": "unit",
+            "negative": false,
+            "portable": false,
+            "runner": {
+              "path": "packages/core/package.json",
+              "contains": "dist/test/*.test.js",
+              "command": "pnpm -C packages/core test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Core canonicalization property test for the selected serialization rule."
+          },
+          {
+            "path": "docs/spec/test-vectors/canonicalization-v1.json",
+            "selector": {
+              "type": "vector",
+              "id": "v1-object-key-ordering"
+            },
+            "kind": "cross-runtime",
+            "negative": false,
+            "portable": true,
+            "runner": {
+              "path": "python-harness/verify_canonicalization_vectors.py",
+              "contains": "canonicalization-v1.json",
+              "command": "pnpm test:vectors:py",
+              "runtime": "Python"
+            },
+            "supports": "Exact sorted canonical JSON and SHA-256; Python independent implementation."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "CONFORMANCE_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "portable",
+        "portableRequired": true,
+        "notes": "Only object ordering is claimed; NFC normalization and collision rejection need separate claims. Negative cases are not required for this ordering-only claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "CANON-002",
+        "title": "Reject floating point numbers",
+        "source": {
+          "path": "docs/spec/core/canonicalization-v1.md",
+          "section": "## 6. Serialization Rules (normative)",
+          "quote": "- Numbers: only integers in the safe IEEE-754 range **[-9007199254740991, 9007199254740991]** are allowed as JSON numbers. Floating-point values and `NaN`/`±Inf` MUST be rejected.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ARTIFACT",
+        "implementation": [
+          {
+            "path": "packages/core/src/crypto/hashes.ts",
+            "symbol": "canonicalizeToJson"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/core/src/test/canonicalization.property.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "C-P6: floats, NaN, and ±Infinity are always rejected with FLOAT_NOT_ALLOWED"
+            },
+            "kind": "unit",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/core/package.json",
+              "contains": "dist/test/*.test.js",
+              "command": "pnpm -C packages/core test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Core canonicalization property test for the selected serialization rule."
+          },
+          {
+            "path": "docs/spec/test-vectors/canonicalization-v1.json",
+            "selector": {
+              "type": "vector",
+              "id": "i1-float-rejected"
+            },
+            "kind": "cross-runtime",
+            "negative": true,
+            "portable": true,
+            "runner": {
+              "path": "python-harness/verify_canonicalization_vectors.py",
+              "contains": "canonicalization-v1.json",
+              "command": "pnpm test:vectors:py",
+              "runtime": "Python"
+            },
+            "supports": "Float rejection and expected error code."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED",
+          "CONFORMANCE_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": true,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "CANON-003",
+        "title": "Reject duplicate keys at raw input parsing",
+        "source": {
+          "path": "docs/spec/core/canonicalization-v1.md",
+          "section": "## 5. Input Parsing Requirements",
+          "quote": "- duplicate keys MUST be detected during parsing",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ARTIFACT",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Core canonicalJson receives objects, after raw duplicate keys may be lost. NFC collision detection is not evidence of duplicate-key-aware raw JSON parsing.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "gap",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "AUTH-ARTIFACT-001",
+        "title": "Reject decisions other than ALLOW",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "## 4. Canonical Semantic Model",
+          "quote": "The `decision` field **MUST** be `\"ALLOW\"`. Any other value **MUST** be rejected.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ARTIFACT",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/authorization-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "authorization-verify-004"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "authorization-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Non-ALLOW decision rejected with AUTH_DECISION_INVALID."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-VERIFY-001",
+        "title": "Reject invalid Ed25519 signatures",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "## 8. Signature Requirements",
+          "quote": "* Verify the Ed25519 signature over the preimage",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "VERIFY",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/authorization-signature-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "authorization-sig-002"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "authorization-signature-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Corrupted signature fails verification."
+          },
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-1 tampered signature: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Guard blocks execute on corrupted signature."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-VERIFY-002",
+        "title": "Issuer-scoped trusted key resolution",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "## 8. Signature Requirements",
+          "quote": "* Resolve `kid` to a trusted public key for the artifact's issuer",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TRUST",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/authorization-signature-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "authorization-sig-004"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "authorization-signature-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Wrong issuer yields issuer mismatch and unknown key."
+          },
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-2 unknown issuer: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Unknown issuer signed with separate key cannot execute."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "expectedIssuer is meaningful when independently established. Scalar expectations are not inherently defective; this claim does not prove provenance of configuration.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-VERIFY-003",
+        "title": "Audience matches execution boundary",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "### audience",
+          "quote": "* **MUST** match the execution boundary",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "VERIFY",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          },
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/authorization-signature-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "authorization-sig-005"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "authorization-signature-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Wrong expected audience rejects."
+          },
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-3 wrong audience: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Wrong audience blocks callback execution."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-BIND-001",
+        "title": "Intent hash exactly matches requested action",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "### intent_hash",
+          "quote": "* **MUST** exactly match the requested action",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ENFORCEMENT",
+        "implementation": [
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          },
+          {
+            "path": "packages/core/src/crypto/hashes.ts",
+            "symbol": "intentHash"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/guard.intent-binding.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "IB-2 wrong intent_hash in auth: OxDeAIAuthorizationError thrown, execute blocked"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.intent-binding.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Authorization for action A cannot execute action B."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "Guard integration checks normalized action binding. Pure verifyAuthorization does not recompute the requested action; no portable vector is asserted here.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-TIME-001",
+        "title": "Strict expiry at now greater than or equal to expiry",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "### expiry / expires_at",
+          "quote": "* **MUST** be strictly enforced: valid iff `now < expiry`; `now >= expiry` → `AUTH_EXPIRED`",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TIME",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/authorization-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "authorization-verify-002"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "authorization-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "now equals expiry returns AUTH_EXPIRED."
+          },
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-4 expired auth: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Expired signed authorization cannot execute."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-TRUST-001",
+        "title": "Missing strict trust configuration fails closed",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "### Strict mode",
+          "quote": "* Missing trust configuration **MUST** fail closed",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TRUST",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          },
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-5 missing trustedKeySets: OxDeAIGuardConfigurationError thrown at construction"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Guard construction rejects missing trustedKeySets."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "Evidence is guard configuration enforcement. It does not establish honesty of supplied keys or policy premises.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-AUTHORITY-001",
+        "title": "Externally supplied authorizations require trusted issuer-policy authority",
+        "source": {
+          "path": "docs/spec/interoperability/external-provider-profile.md",
+          "section": "### Profile A: Core-native",
+          "quote": "implementations **MUST** configure issuer-policy authority",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TRUST",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/authorizationAuthority.ts",
+            "symbol": "isTrustedAuthorizationAuthority"
+          },
+          {
+            "path": "packages/core/src/verification/verifyAuthorization.ts",
+            "symbol": "verifyAuthorization"
+          },
+          {
+            "path": "packages/guard/src/gateway.ts",
+            "symbol": "createPepGatewayExecutor"
+          },
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/gateway.authority.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "#301 gateway ANTI-CARTESIAN: trusted issuer A signing unauthorized policy P2 is rejected; upstream never called"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/gateway.authority.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "A valid signature from a trusted issuer does not authorize an unconfigured issuer-policy pair, and upstream execution remains blocked."
+          },
+          {
+            "path": "packages/guard/src/test/guard.delegation.authority.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "#301 delegation ANTI-CARTESIAN: validly signed parent A/P2 is rejected; execute never called"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.delegation.authority.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "An externally supplied delegation parent cannot establish a delegation root unless its exact issuer-policy pair is independently trusted."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "Applies to implemented boundaries that accept externally supplied AuthorizationV1 artifacts. Trusted signing keys authenticate the claimed issuer but do not independently grant policy authority. Evidence does not establish arbitrary deployment non-bypassability.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "SIGNATURE_VALID",
+            "to": "ISSUER_POLICY_AUTHORIZED",
+            "reason": "A valid signature authenticates the claimed issuer key but does not establish authority to issue for the claimed policy."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "AUTH-REPLAY-001",
+        "title": "Reused auth_id cannot execute",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "## 11. Replay Protection",
+          "quote": "* `auth_id` **MUST** be single-use",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "REPLAY",
+        "implementation": [
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          },
+          {
+            "path": "packages/guard/src/replayStore.ts",
+            "symbol": "createInMemoryReplayStore"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/guard.replay-store.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "RS-1 default store: auth_id replay blocked on second call to same guard instance"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.replay-store.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Second use blocked; exactly one execution."
+          },
+          {
+            "path": "packages/guard/src/test/guard.replay-store.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "RS-3 shared store: auth_id replay blocked across two distinct guard instances"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.replay-store.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Shared store blocks replay across guard instances."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "In-memory/shared-store integration scope only; not proof of distributed durable replay storage.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "TRUSTED-TIME-001",
+        "title": "Issuance uses trusted evaluation time",
+        "source": {
+          "path": "docs/spec/core/trusted-time-v1.md",
+          "section": "## 4. Consistency Invariants",
+          "quote": "   `issued_at = evaluation_time`.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TIME",
+        "implementation": [
+          {
+            "path": "packages/core/src/policy/PolicyEngine.ts",
+            "symbol": "PolicyEngine"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/core/src/test/trusted-time-integration.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "issuance tripwire: issued_at and expiry derive from evaluationTime, not intent.timestamp"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/core/package.json",
+              "contains": "dist/test/*.test.js",
+              "command": "pnpm -C packages/core test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Future-side freshness-valid intent does not drive issuance or expiry."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "TRUSTED-TIME-002",
+        "title": "Reject future freshness violations",
+        "source": {
+          "path": "docs/spec/core/trusted-time-v1.md",
+          "section": "## 6. Freshness Semantics (Future and Stale)",
+          "quote": "- **Future-dated.** `Δ > maxClockSkewSeconds` → `DENY`, no authorization minted.",
+          "role": "normative"
+        },
+        "strength": "normative-statement",
+        "category": "TIME",
+        "implementation": [
+          {
+            "path": "packages/core/src/policy/verifyTrustedTime.ts",
+            "symbol": "verifyTrustedTime"
+          },
+          {
+            "path": "packages/core/src/policy/PolicyEngine.ts",
+            "symbol": "PolicyEngine"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/core/src/test/trusted-time-integration.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "future-dated intent → exactly DENY/INTENT_FRESHNESS_FUTURE"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/core/package.json",
+              "contains": "dist/test/*.test.js",
+              "command": "pnpm -C packages/core test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Future timestamp yields exactly DENY/INTENT_FRESHNESS_FUTURE."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "DELEGATION-001",
+        "title": "Child tools cannot widen supplied parentScope",
+        "source": {
+          "path": "docs/spec/artifacts/delegation-v1.md",
+          "section": "### 4.1 Scope Narrowing",
+          "quote": "| `scope.tools` | Effective child tools MUST be a subset of `parentScope.tools` when defined. Omitted child tools inherit that constraint unchanged; an explicitly supplied child list is compared against it as given. Equal sets are valid. |",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "DELEGATION",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyDelegation.ts",
+            "symbol": "verifyDelegation"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/delegation-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "delegation-verify-005"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "delegation-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Tool outside caller-supplied parent scope rejected."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Narrowing is relative to caller-supplied parentScope; no evidence that the scope originated from an authoritative external grant.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "DELEGATION-002",
+        "title": "Reject delegation as parent (single hop)",
+        "source": {
+          "path": "docs/spec/artifacts/delegation-v1.md",
+          "section": "### 4.4 Single-Hop Enforcement",
+          "quote": "A `DelegationV1` artifact MUST NOT be used as the parent of another `DelegationV1`. The PEP MUST reject any chain where the parent artifact is itself a delegation.",
+          "role": "normative"
+        },
+        "strength": "MUST NOT",
+        "category": "DELEGATION",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyDelegation.ts",
+            "symbol": "verifyDelegationChain"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/delegation-chain-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "delegation-chain-006"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "delegation-chain-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Delegation parent rejected as multihop."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "DELEGATION-003",
+        "title": "Delegation policy equals parent policy",
+        "source": {
+          "path": "docs/spec/artifacts/delegation-v1.md",
+          "section": "### 4.1 Scope Narrowing",
+          "quote": "| `policy_id` | MUST equal parent `policy_id` |",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "DELEGATION",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifyDelegation.ts",
+            "symbol": "verifyDelegationChain"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/delegation-chain-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "delegation-chain-007"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "delegation-chain-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Child-parent policy mismatch rejected."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "This binds two artifacts. It does not prove that an issuer is independently authorized for that policy. Generic expectedPolicyId remains valid when independently configured.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "SIGNED-KRL-001",
+        "title": "Duplicate revoked kids rejected",
+        "source": {
+          "path": "docs/spec/artifacts/signed-krl-v1.md",
+          "section": "## 9. `revoked_kids` deduplication",
+          "quote": "Verifiers MUST reject any artifact containing duplicate entries.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TRUST",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifySignedKrl.ts",
+            "symbol": "verifySignedKrl"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/signed-krl-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "krl-005"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "signed-krl-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Duplicate revoked kid entries rejected."
+          },
+          {
+            "path": "docs/spec/test-vectors/signed-krl-v1.json",
+            "selector": {
+              "type": "vector",
+              "id": "KRL_DUPLICATE_REVOKED_KIDS"
+            },
+            "kind": "cross-runtime",
+            "negative": true,
+            "portable": true,
+            "runner": {
+              "path": "python-harness/verify_signed_krl_vectors.py",
+              "contains": "signed-krl-v1.json",
+              "command": "pnpm test:vectors:py",
+              "runtime": "Python"
+            },
+            "supports": "Independent Python duplicate-entry rejection."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED",
+          "CONFORMANCE_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": true,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [
+          {
+            "id": "RT-TRUST-2",
+            "relation": "conditional-mitigation",
+            "reason": "Artifact verification alone does not close the deployment KRL residual."
+          }
+        ],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "KRL_SIGNATURE_VALID",
+            "to": "KRL_DEPLOYMENT_RESIDUAL_CLOSED",
+            "reason": "Required deployment configuration and persistent stores are not established by artifact vectors."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "SIGNED-KRL-002",
+        "title": "Invalid KRL signature rejected",
+        "source": {
+          "path": "docs/spec/artifacts/signed-krl-v1.md",
+          "section": "## 11. Reason codes",
+          "quote": "| `KRL_SIG_INVALID` | Ed25519 signature verification fails. |",
+          "role": "normative"
+        },
+        "strength": "normative-statement",
+        "category": "VERIFY",
+        "implementation": [
+          {
+            "path": "packages/core/src/verification/verifySignedKrl.ts",
+            "symbol": "verifySignedKrl"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/conformance/vectors/signed-krl-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "krl-002"
+            },
+            "kind": "vector",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/conformance/src/validate.ts",
+              "contains": "signed-krl-verification.json",
+              "command": "pnpm -C packages/conformance validate",
+              "runtime": "TypeScript"
+            },
+            "supports": "Tampered signature rejected."
+          },
+          {
+            "path": "docs/spec/test-vectors/signed-krl-v1.json",
+            "selector": {
+              "type": "vector",
+              "id": "KRL_SIGNED_INVALID_SIG"
+            },
+            "kind": "cross-runtime",
+            "negative": true,
+            "portable": true,
+            "runner": {
+              "path": "python-harness/verify_signed_krl_vectors.py",
+              "contains": "signed-krl-v1.json",
+              "command": "pnpm test:vectors:py",
+              "runtime": "Python"
+            },
+            "supports": "Independent Python Ed25519 verification rejects tampering."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "ADVERSARIAL_TESTED",
+          "CONFORMANCE_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": true,
+        "notes": "Evidence demonstrates the selected cases only; review semantic adequacy when changing this claim.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [
+          {
+            "id": "RT-TRUST-2",
+            "relation": "conditional-mitigation",
+            "reason": "Artifact verification alone does not close the deployment KRL residual."
+          }
+        ],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "KRL_SIGNATURE_VALID",
+            "to": "KRL_DEPLOYMENT_RESIDUAL_CLOSED",
+            "reason": "Required deployment configuration and persistent stores are not established by artifact vectors."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "PROFILE-C-001",
+        "title": "Live-state hash must match committed state hash",
+        "source": {
+          "path": "docs/spec/interoperability/external-provider-profile.md",
+          "section": "#### 2.3.2 Additional Verifier Requirements (beyond Profile B)",
+          "quote": "| Live-state hash match | `computeStateHash(state)` == `authorization.state_hash` | `OxDeAIAuthorizationError` |",
+          "role": "normative"
+        },
+        "strength": "normative-statement",
+        "category": "STATE",
+        "implementation": [
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/guard.state-binding.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "SB-2 mismatched state_hash: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.state-binding.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Mismatched state hash blocks execute."
+          },
+          {
+            "path": "docs/spec/test-vectors/profile-c-state-verification.json",
+            "selector": {
+              "type": "vector",
+              "id": "profile-c-002"
+            },
+            "kind": "cross-runtime",
+            "negative": true,
+            "portable": true,
+            "runner": {
+              "path": "python-harness/verify_profile_c_vectors.py",
+              "contains": "profile-c-state-verification.json",
+              "command": "pnpm test:vectors:py",
+              "runtime": "Python"
+            },
+            "supports": "Portable hash comparison mismatch, not execution or provider honesty."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED",
+          "CONFORMANCE_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "portable",
+        "portableRequired": true,
+        "notes": "Portable evidence covers hash comparison only. Guard integration covers callback blocking separately. Neither establishes current or honest state. The docs Profile-C corpus is authoritative; its package representation is a deterministic projection of the same cases, not independent corpus evidence. Authority and actual consumer mappings are recorded in docs/conformance/corpus-authority.json.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [
+          {
+            "id": "RT-TRUST-1",
+            "relation": "trust-premise",
+            "reason": "State-hash consistency does not establish state-provider integrity."
+          }
+        ],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "STATE_HASH_MATCH",
+            "to": "STATE_SOURCE_TRUSTED",
+            "reason": "Honest, current, authoritative state is a deployment premise."
+          },
+          {
+            "from": "PROFILE_C_PROJECTION_MATCH",
+            "to": "INDEPENDENT_CORPUS_EVIDENCE",
+            "reason": "Generated package vectors represent the same docs-authoritative cases; structural equality does not add evidence or prove semantic conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "PEP-ENFORCE-001",
+        "title": "Invalid authorization prevents execution",
+        "source": {
+          "path": "docs/spec/artifacts/authorization-v1.md",
+          "section": "## 1. Purpose",
+          "quote": "> If no valid `AuthorizationV1` is present, execution **MUST NOT** occur.",
+          "role": "normative"
+        },
+        "strength": "MUST NOT",
+        "category": "ENFORCEMENT",
+        "implementation": [
+          {
+            "path": "packages/guard/src/guard.ts",
+            "symbol": "OxDeAIGuard"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/guard/src/test/guard.authorization.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "A-1 tampered signature: execute is blocked and OxDeAIAuthorizationError is thrown"
+            },
+            "kind": "integration",
+            "negative": true,
+            "portable": false,
+            "runner": {
+              "path": "packages/guard/package.json",
+              "contains": "dist/test/guard.authorization.test.js",
+              "command": "pnpm -C packages/guard test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Invalid signature prevents execute callback."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED",
+          "ADVERSARIAL_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": true,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "Selected guard rejection case only. Does not prove every possible execution path is non-bypassable.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "PEP-DEPLOY-001",
+        "title": "Gateway is sole execution boundary",
+        "source": {
+          "path": "docs/spec/enforcement/pep-gateway-v1.md",
+          "section": "### 4.1 Execution Boundary",
+          "quote": "The PEP Gateway **MUST** act as the **sole execution boundary** for protected actions.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "TRUST",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "deployment-assumption",
+        "portableRequired": false,
+        "notes": "Deployment topology and upstream access control must be independently evidenced. Gateway tests cannot prove arbitrary deployment non-bypassability.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "gap",
+        "scopeDisposition": "deployment",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "STATE-TRUST-001",
+        "title": "State provider serves coherent view",
+        "source": {
+          "path": "docs/spec/state-provider-requirements.md",
+          "section": "### 2.1 Requirement",
+          "quote": "A compliant state provider MUST serve a coherent state view to `getState()`.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "STATE",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "deployment-assumption",
+        "portableRequired": false,
+        "notes": "Provider honesty/coherence is an external deployment obligation. Hash equality and CAS tests do not demonstrate it for a deployed provider.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "gap",
+        "scopeDisposition": "deployment",
+        "appliesWhen": [],
+        "dependsOn": [
+          {
+            "id": "RT-TRUST-1",
+            "relation": "trust-premise",
+            "reason": "State-hash consistency does not establish state-provider integrity."
+          }
+        ],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "STATE_HASH_MATCH",
+            "to": "STATE_SOURCE_TRUSTED",
+            "reason": "Honest, current, authoritative state is a deployment premise."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "VERIFY-ORDER-001",
+        "title": "Normative verification ordering",
+        "source": {
+          "path": "docs/spec/verification/verification-v1.md",
+          "section": "## 9. Determinism and Ordering",
+          "quote": "- Check ordering **MUST** follow the sequences in §§5–6 to ensure deterministic results across implementations.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "VERIFY",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Verification §5 puts signature before expiry; AuthorizationV1 §10 puts expiry before signature. Core collects/sorts violations. No claim of satisfying both incompatible sequences. #320 is adjacent but does NOT resolve this claim: it constrains the ordering of a durable side effect relative to authentication (verification-v1 §4.2), whereas this claim concerns the ordering of checks within verification and its ambiguity is between two spec sections. #320 does add a constraint any eventual resolution must respect: whichever check sequence is chosen, no durable write may precede authentication.",
+        "recordType": "requirement",
+        "normativeState": "ambiguous",
+        "evidenceState": "gap",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "DELEGATION-AUDIT-001",
+        "title": "PEP delegation events included in hash-chained audit log",
+        "source": {
+          "path": "docs/spec/artifacts/delegation-v1.md",
+          "section": "## 7. Audit Event",
+          "quote": "Both events MUST be included in the hash-chained audit log.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "AUDIT",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": false,
+        "negativeRequired": false,
+        "classification": "implementation-specific",
+        "portableRequired": false,
+        "notes": "No direct mapping found for required DELEGATION_EXECUTION/DELEGATION_DENIED hash-chained events. Guard boundary event callbacks alone are not evidence of this contract. #320 changes what a denied delegation leaves behind: previously a rejected forgery left a replay entry and no audit event; it now leaves neither. Closing this claim must account for that — #320 removes a side effect, it does not add a denial record, and must not be read as narrowing what a denial is required to record.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "gap",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "ETA-SIGNING-001",
+        "title": "ETA signing payload excludes entire signature field",
+        "source": {
+          "path": "docs/spec/core/eta-core-v1.md",
+          "section": "## 5. Authorization Artifact (AuthorizationV1)",
+          "quote": "- The signature preimage MUST be the canonical JSON bytes of the AuthorizationV1 object, **excluding the `signature` field**, using the canonicalization rules in `canonicalization-v1.md`.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ARTIFACT",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "ETA excludes entire signature field; AuthorizationV1 §5 retains nested alg/kid and defines encoding-specific prefix. Normative docs vectors use another verifier/preimage; do not equate corpora.",
+        "recordType": "requirement",
+        "normativeState": "ambiguous",
+        "evidenceState": "gap",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "ETA-DETERMINISM-001",
+        "title": "Identical trusted inputs produce deterministic signed authorizations",
+        "source": {
+          "path": "docs/spec/core/eta-core-v1.md",
+          "section": "### Requirements",
+          "quote": "- Identical inputs MUST produce identical outputs.",
+          "role": "normative"
+        },
+        "strength": "MUST",
+        "category": "ARTIFACT",
+        "implementation": [
+          {
+            "path": "packages/core/src/policy/PolicyEngine.ts",
+            "symbol": "PolicyEngine"
+          }
+        ],
+        "evidence": [
+          {
+            "path": "packages/core/src/test/authorization.trusted-time-issuance.test.ts",
+            "selector": {
+              "type": "test",
+              "id": "identical trusted inputs produce deterministic Ed25519 authorizations"
+            },
+            "kind": "integration",
+            "negative": false,
+            "portable": false,
+            "runner": {
+              "path": "packages/core/package.json",
+              "contains": "dist/test/*.test.js",
+              "command": "pnpm -C packages/core test",
+              "runtime": "TypeScript"
+            },
+            "supports": "Repeated trusted inputs produce identical Ed25519 authorization objects."
+          }
+        ],
+        "requiredLevels": [
+          "TRACEABLE",
+          "TESTED",
+          "INTEGRATION_TESTED"
+        ],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "portable",
+        "portableRequired": false,
+        "notes": "Inputs include trusted evaluationTime and fixed configuration per trusted-time profile. This selected test does not prove all decision modules deterministic.",
+        "recordType": "requirement",
+        "normativeState": "specified",
+        "evidenceState": "mapped",
+        "scopeDisposition": "in-scope",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          }
+        ],
+        "maintainerDecisionRequired": false
+      },
+      {
+        "id": "CANON-ESC-001",
+        "title": "Unresolved canonicalization corpus lock (maintainer-supplied identifier)",
+        "source": {
+          "path": "docs/spec/core/canonicalization-v1.md",
+          "section": "## 6. Serialization Rules (normative)",
+          "quote": "- Strings: normalize to Unicode NFC and encode as JSON strings.",
+          "role": "context"
+        },
+        "strength": "not-applicable",
+        "category": "ARTIFACT",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "documentation-only",
+        "portableRequired": false,
+        "notes": "CANON-ESC-001 was requested for registration by the maintainer; no existing repository definition of this identifier was found. This source is context only. Exact escaping/corpus-lock meaning and disposition require a maintainer decision; no new serialization rule is asserted. Issue #290 preserves all current Profile-C state and signed-payload values, which use plain printable ASCII without disputed escaping; PEM formatting is outside signing payloads. Projection therefore does not require resolving this lock for the current eight cases. It remains unresolved/deferred; future escape-sensitive inputs require separate review.",
+        "recordType": "corpus-lock",
+        "normativeState": "unresolved",
+        "evidenceState": "unassessed",
+        "scopeDisposition": "deferred",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "SELECTED_CANONICALIZATION_VECTORS_PASS",
+            "to": "CANON_ESC_LOCK_RESOLVED",
+            "reason": "Existing vectors do not resolve an undefined corpus lock."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "RT-TRUST-1",
+        "title": "State provider integrity residual",
+        "source": {
+          "path": "docs/audits/protocol-audit-post-interoperability.md",
+          "section": "### 5.3 Residual Trust Risks",
+          "quote": "**RT-TRUST-1: State provider integrity** *(SPECIFIED WITH RESIDUAL)*",
+          "role": "context"
+        },
+        "strength": "not-applicable",
+        "category": "TRUST",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "documentation-only",
+        "portableRequired": false,
+        "notes": "The residual is not closed. Minimum state-provider requirements exist, but provider compliance and integrity remain deployment responsibilities. This lock is an audit observation, not another executable protocol requirement.",
+        "recordType": "corpus-lock",
+        "normativeState": "non-normative",
+        "evidenceState": "unassessed",
+        "scopeDisposition": "deployment",
+        "appliesWhen": [],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "STATE_HASH_MATCH",
+            "to": "STATE_SOURCE_TRUSTED",
+            "reason": "Matching state can be manufactured by a compromised provider."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      },
+      {
+        "id": "RT-TRUST-2",
+        "title": "Conditional KRL transport-integrity residual",
+        "source": {
+          "path": "docs/spec/interoperability/external-provider-profile.md",
+          "section": "#### 2.2.5 KRL Integrity at Profile B",
+          "quote": "Full RT-TRUST-2 closure requires `signed_required` + `verifyKrl` + `KrlWatermarkStore` + `SignedKrlCache`; compatibility modes retain residual transport-trust risk.",
+          "role": "context"
+        },
+        "strength": "not-applicable",
+        "category": "TRUST",
+        "implementation": [],
+        "evidence": [],
+        "requiredLevels": [],
+        "securityCritical": true,
+        "negativeRequired": false,
+        "classification": "documentation-only",
+        "portableRequired": false,
+        "notes": "Conditional closure is documented for configured deployments, not established here. Compatibility modes retain residual risk. Applicability conditions describe the documented closure context; the checker never evaluates a deployment or declares this lock closed.",
+        "recordType": "corpus-lock",
+        "normativeState": "non-normative",
+        "evidenceState": "unassessed",
+        "scopeDisposition": "conditional",
+        "appliesWhen": [
+          {
+            "setting": "krlMode",
+            "equals": "signed_required"
+          },
+          {
+            "setting": "verifyKrl",
+            "equals": "configured"
+          },
+          {
+            "setting": "KrlWatermarkStore",
+            "equals": "configured"
+          },
+          {
+            "setting": "SignedKrlCache",
+            "equals": "configured"
+          }
+        ],
+        "dependsOn": [],
+        "inferenceGuard": [
+          {
+            "from": "STRUCTURAL_PASS",
+            "to": "SEMANTIC_PROOF",
+            "reason": "Reference consistency does not prove the claimed semantics."
+          },
+          {
+            "from": "TESTED",
+            "to": "WHOLE_PROTOCOL_CONFORMANCE",
+            "reason": "Selected executable cases do not establish whole-protocol conformance."
+          },
+          {
+            "from": "KRL_SIGNATURE_VALID",
+            "to": "KRL_DEPLOYMENT_RESIDUAL_CLOSED",
+            "reason": "Signature verification does not establish integrity mode, callback, durable watermark or signed cache configuration."
+          }
+        ],
+        "maintainerDecisionRequired": true
+      }
+    ]
+  },
+  "manifest": {
+    "version": 1,
+    "corpora": [
+      {
+        "id": "docs-canonicalization-v1",
+        "authority": "docs/spec/test-vectors/canonicalization-v1.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/canonicalization-v1.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "Canonical bytes, SHA-256 and selected invalid inputs.",
+        "spec": "docs/spec/core/canonicalization-v1.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/canonicalization-v1.json",
+            "path": "scripts/verify-canonicalization-vectors.ts",
+            "binding": "canonicalization-v1.json",
+            "command": "pnpm test:vectors:ts",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/canonicalization-v1.json",
+            "path": "go-harness/canonicalization_verify.go",
+            "binding": "canonicalization-v1.json",
+            "command": "pnpm test:vectors:go",
+            "runtime": "Go",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/canonicalization-v1.json",
+            "path": "python-harness/verify_canonicalization_vectors.py",
+            "binding": "canonicalization-v1.json",
+            "command": "pnpm test:vectors:py",
+            "runtime": "Python",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/canonicalization-v1.json",
+            "path": "packages/guard/src/test/gateway.vectors.test.ts",
+            "binding": "canonicalization-v1.json",
+            "command": "pnpm --filter @oxdeai/guard test",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Default guard test consumer; verifies all 11 canonicalization vectors."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "docs-authorization-v1",
+        "authority": "docs/spec/test-vectors/authorization-v1.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/authorization-v1.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "Locked AuthorizationV1 standalone verification cases; distinct from package verifier corpora.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/authorization-v1.json",
+            "path": "scripts/verify-authorization-vectors.mjs",
+            "binding": "authorization-v1.json",
+            "command": "pnpm test:vectors:auth",
+            "runtime": "JavaScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/authorization-v1.json",
+            "path": "packages/guard/src/test/gateway.vectors.test.ts",
+            "binding": "authorization-v1.json",
+            "command": "pnpm --filter @oxdeai/guard test",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Default guard test consumer; 12 authorization corpus cases combine strict Core verification with fixture action/state-context checks. Static fixture comparisons are not live-state gateway verification or Profile C evidence."
+          },
+          {
+            "representation": "docs/spec/test-vectors/authorization-v1.json",
+            "path": "scripts/verify-pep-vectors.mjs",
+            "binding": "authorization-v1.json",
+            "command": "pnpm test:vectors:pep",
+            "runtime": "JavaScript",
+            "execution": "default-ci",
+            "role": "input-fixture",
+            "notes": "Loads referenced authorization fixtures to evaluate PEP cases."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "docs-pep-vectors-v1",
+        "authority": "docs/spec/test-vectors/pep-vectors-v1.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/pep-vectors-v1.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "Standalone gateway decisions and upstream behavior; not all guard integration semantics.",
+        "spec": "docs/spec/enforcement/pep-gateway-v1.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/pep-vectors-v1.json",
+            "path": "scripts/verify-pep-vectors.mjs",
+            "binding": "pep-vectors-v1.json",
+            "command": "pnpm test:vectors:pep",
+            "runtime": "JavaScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Standalone fixture evaluator exercises all 9 cases, including static snapshot comparisons. This does not establish live-state verification by createPepGatewayExecutor or Profile C conformance."
+          },
+          {
+            "representation": "docs/spec/test-vectors/pep-vectors-v1.json",
+            "path": "packages/guard/src/test/gateway.vectors.test.ts",
+            "binding": "pep-vectors-v1.json",
+            "command": "pnpm --filter @oxdeai/guard test",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Default guard test consumer; 7 of 9 PEP cases exercise the common A/B gateway surface. pep-sb-state-mismatch and pep-sb-missing-state-snapshot are explicitly deferred pending profile/surface assignment, not counted as conformance passes. No live-state reader or Profile C claim; zero-upstream assertions cover applicable denials."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "docs-delegation-vectors-v1",
+        "authority": "docs/spec/test-vectors/delegation-vectors-v1.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/delegation-vectors-v1.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Existing delegation harness cases; conformance spec §8 still describes complete locked portable delegation corpus as pending.",
+        "spec": "docs/spec/artifacts/delegation-v1.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/delegation-vectors-v1.json",
+            "path": "scripts/verify-delegation-vectors.mjs",
+            "binding": "delegation-vectors-v1.json",
+            "command": "pnpm test:vectors:delegation",
+            "runtime": "JavaScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "profile-c",
+        "authority": "docs/spec/test-vectors/profile-c-state-verification.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/profile-c-state-verification.json",
+            "format": "vectors",
+            "generated": false
+          },
+          {
+            "path": "packages/conformance/vectors/profile-c-state-verification.json",
+            "format": "vectors",
+            "generated": true
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "State hash comparison, strategy mismatch, compute error and selected Encoding B signatures; not provider honesty or full PEP behavior.",
+        "spec": "docs/spec/interoperability/external-provider-profile.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/profile-c-state-verification.json",
+            "path": "go-harness/profile_c_verify.go",
+            "binding": "profile-c-state-verification.json",
+            "command": "pnpm test:vectors:go",
+            "runtime": "Go",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/profile-c-state-verification.json",
+            "path": "python-harness/verify_profile_c_vectors.py",
+            "binding": "profile-c-state-verification.json",
+            "command": "pnpm test:vectors:py",
+            "runtime": "Python",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/profile-c-state-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "profile-c-state-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Consumes the generated representation of the SAME eight cases; not independent corpus evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "docs-signed-krl-v1",
+        "authority": "docs/spec/test-vectors/signed-krl-v1.json",
+        "representations": [
+          {
+            "path": "docs/spec/test-vectors/signed-krl-v1.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "Portable committed SignedKRL verification artifacts; distinct IDs and fixtures from package KRL corpus.",
+        "spec": "docs/spec/artifacts/signed-krl-v1.md",
+        "consumers": [
+          {
+            "representation": "docs/spec/test-vectors/signed-krl-v1.json",
+            "path": "go-harness/signed_krl_verify.go",
+            "binding": "signed-krl-v1.json",
+            "command": "pnpm test:vectors:go",
+            "runtime": "Go",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "docs/spec/test-vectors/signed-krl-v1.json",
+            "path": "python-harness/verify_signed_krl_vectors.py",
+            "binding": "signed-krl-v1.json",
+            "command": "pnpm test:vectors:py",
+            "runtime": "Python",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-audit-chain",
+        "authority": "packages/conformance/vectors/audit-chain.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/audit-chain.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Audit chain hashing and mutation examples.",
+        "spec": "docs/spec/verification/verification-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/audit-chain.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "audit-chain.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/audit-chain.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "audit-chain.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-audit-verification",
+        "authority": "packages/conformance/vectors/audit-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/audit-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Audit verifier status/violation cases; not PEP delegation audit event compliance.",
+        "spec": "docs/spec/verification/verification-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/audit-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "audit-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/audit-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "audit-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/audit-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "audit-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-authorization-payload",
+        "authority": "packages/conformance/vectors/authorization-payload.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/authorization-payload.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "implementation-specific",
+        "semanticScope": "Reference engine authorization payload fixtures, not all portable AuthorizationV1 wire requirements.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/authorization-payload.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "authorization-payload.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/authorization-payload.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "authorization-payload.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/authorization-payload.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "authorization-payload.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-authorization-signature-verification",
+        "authority": "packages/conformance/vectors/authorization-signature-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/authorization-signature-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core verifier Encoding A/B Ed25519 paths and rejection cases.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/authorization-signature-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "authorization-signature-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/authorization-signature-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "authorization-signature-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/authorization-signature-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "authorization-signature-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-authorization-verification",
+        "authority": "packages/conformance/vectors/authorization-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/authorization-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core structural verifier checks and expected comparisons, selected signature-free cases.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/authorization-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "authorization-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/authorization-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "authorization-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-clock-semantics-verification",
+        "authority": "packages/conformance/vectors/clock-semantics-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/clock-semantics-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Verifier expiry and issued_at selected clock cases.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/clock-semantics-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "clock-semantics-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-delegation-chain-verification",
+        "authority": "packages/conformance/vectors/delegation-chain-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/delegation-chain-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core chain binding, parent, expiry and policy checks.",
+        "spec": "docs/spec/artifacts/delegation-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/delegation-chain-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "delegation-chain-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-chain-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "delegation-chain-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-chain-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "delegation-chain-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-chain-verification.json",
+            "path": "packages/conformance/scripts/extract-vectors.ts",
+            "binding": "delegation-chain-verification.json",
+            "command": "pnpm -C packages/conformance extract",
+            "runtime": "TypeScript",
+            "execution": "manual",
+            "role": "maintenance",
+            "notes": "Reads then rewrites these frozen baselines for deliberate version changes; not executed for #290 and never establishes a second authority."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-delegation-parent-hash",
+        "authority": "packages/conformance/vectors/delegation-parent-hash.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/delegation-parent-hash.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "SHA-256 of canonical parent and insertion-order invariance.",
+        "spec": "docs/spec/artifacts/delegation-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/delegation-parent-hash.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "delegation-parent-hash.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-parent-hash.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "delegation-parent-hash.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-delegation-signature-verification",
+        "authority": "packages/conformance/vectors/delegation-signature-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/delegation-signature-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core delegation signature verification cases.",
+        "spec": "docs/spec/artifacts/delegation-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/delegation-signature-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "delegation-signature-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-signature-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "delegation-signature-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-signature-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "delegation-signature-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-signature-verification.json",
+            "path": "packages/conformance/scripts/extract-vectors.ts",
+            "binding": "delegation-signature-verification.json",
+            "command": "pnpm -C packages/conformance extract",
+            "runtime": "TypeScript",
+            "execution": "manual",
+            "role": "maintenance",
+            "notes": "Reads then rewrites these frozen baselines for deliberate version changes; not executed for #290 and never establishes a second authority."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-delegation-verification",
+        "authority": "packages/conformance/vectors/delegation-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/delegation-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core delegation structural/scope/replay checks; supplied parentScope is a premise.",
+        "spec": "docs/spec/artifacts/delegation-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/delegation-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "delegation-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/delegation-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "delegation-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-envelope-signature-verification",
+        "authority": "packages/conformance/vectors/envelope-signature-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/envelope-signature-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Supplemental envelope signatures; dedicated complete envelope specification pending.",
+        "spec": "docs/spec/verification/verification-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/envelope-signature-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "envelope-signature-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/envelope-signature-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "envelope-signature-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/envelope-signature-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "envelope-signature-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-envelope-verification",
+        "authority": "packages/conformance/vectors/envelope-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/envelope-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Supplemental envelope statuses; not execution authorization.",
+        "spec": "docs/spec/verification/verification-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/envelope-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "envelope-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/envelope-verification.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "envelope-verification.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/envelope-verification.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "envelope-verification.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-intent-hash",
+        "authority": "packages/conformance/vectors/intent-hash.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/intent-hash.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core intent binding-field projection and hash cases.",
+        "spec": "docs/spec/core/canonicalization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/intent-hash.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "intent-hash.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/intent-hash.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "intent-hash.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-key-lifecycle-verification",
+        "authority": "packages/conformance/vectors/key-lifecycle-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/key-lifecycle-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core key activity, revocation and kid resolution cases.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/key-lifecycle-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "key-lifecycle-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-signed-krl-verification",
+        "authority": "packages/conformance/vectors/signed-krl-verification.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/signed-krl-verification.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core SignedKRL verifier fixtures; distinct from docs SignedKRL artifact corpus.",
+        "spec": "docs/spec/artifacts/signed-krl-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/signed-krl-verification.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "signed-krl-verification.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-snapshot-hash",
+        "authority": "packages/conformance/vectors/snapshot-hash.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/snapshot-hash.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Core canonical state codec/hash fixtures; supplemental snapshot evidence.",
+        "spec": "docs/spec/verification/verification-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/snapshot-hash.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "snapshot-hash.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/snapshot-hash.json",
+            "path": "packages/conformance/go-harness/main.go",
+            "binding": "snapshot-hash.json",
+            "command": "cd packages/conformance/go-harness && go run ./main.go --adapter-bin python3 --adapter-arg ./adapter_python.py --vectors ../vectors",
+            "runtime": "Go",
+            "execution": "blocked",
+            "role": "driver",
+            "notes": "Manual generic adapter driver, absent from root vector CI; Python adapter import fails (#306). Not independent Go verification evidence."
+          },
+          {
+            "representation": "packages/conformance/vectors/snapshot-hash.json",
+            "path": "packages/conformance/go-harness/adapter_python.py",
+            "binding": "snapshot-hash.json",
+            "command": "python3 packages/conformance/go-harness/adapter_python.py",
+            "runtime": "Python",
+            "execution": "blocked",
+            "role": "verifier",
+            "notes": "Import fails at authorization-payload input.intent_id (#306); later loads unreachable. Some operations are frozen lookups, not independent verification."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "package-trusted-time",
+        "authority": "packages/conformance/vectors/trusted-time.json",
+        "representations": [
+          {
+            "path": "packages/conformance/vectors/trusted-time.json",
+            "format": "vectors",
+            "generated": false
+          }
+        ],
+        "status": "normative",
+        "semanticScope": "Active trusted-time issuance/freshness/replay/velocity/tool-window plus TypeScript-domain validation cases; no Go/Python engine parity. Official source designated by docs/spec/conformance/conformance-v1.md §4; TypeScript-specific input-domain cases do not confer cross-runtime support.",
+        "spec": "docs/spec/core/trusted-time-v1.md",
+        "consumers": [
+          {
+            "representation": "packages/conformance/vectors/trusted-time.json",
+            "path": "packages/conformance/src/validate.ts",
+            "binding": "trusted-time.json",
+            "command": "pnpm -C packages/conformance validate",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          },
+          {
+            "representation": "packages/conformance/vectors/trusted-time.json",
+            "path": "packages/conformance/src/validate-trusted-time.ts",
+            "binding": "trusted-time.json",
+            "command": "pnpm test:vectors:trusted-time",
+            "runtime": "TypeScript",
+            "execution": "manual",
+            "role": "verifier",
+            "notes": "Dedicated root script; default CI covers the same trusted-time corpus through validate.ts and package tests."
+          },
+          {
+            "representation": "packages/conformance/vectors/trusted-time.json",
+            "path": "packages/conformance/src/trustedTimeConformance.test.ts",
+            "binding": "trusted-time.json",
+            "command": "pnpm -C packages/conformance test",
+            "runtime": "TypeScript",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": []
+      },
+      {
+        "id": "rust-authorization-example",
+        "authority": "examples/rust-verifier/auth_case.json",
+        "representations": [
+          {
+            "path": "examples/rust-verifier/auth_case.json",
+            "format": "fixture",
+            "generated": false
+          }
+        ],
+        "status": "supplemental",
+        "semanticScope": "Bundled single authorization fixture and four verifier tests; consumes neither vector tree.",
+        "spec": "docs/spec/artifacts/authorization-v1.md",
+        "consumers": [
+          {
+            "representation": "examples/rust-verifier/auth_case.json",
+            "path": "examples/rust-verifier/tests/verify_authorization.rs",
+            "binding": "auth_case.json",
+            "command": "pnpm test:rust",
+            "runtime": "Rust",
+            "execution": "default-ci",
+            "role": "verifier",
+            "notes": "Selected corpus cases only; existence is not execution proof."
+          }
+        ],
+        "supportFiles": [
+          "examples/rust-verifier/keyset.json"
+        ]
+      }
+    ]
+  },
+  "provenance": {
+    "docs-canonicalization-v1": "mixed",
+    "docs-authorization-v1": "reference-generated",
+    "docs-pep-vectors-v1": "reference-generated",
+    "docs-delegation-vectors-v1": "reference-generated",
+    "profile-c": "reference-generated",
+    "docs-signed-krl-v1": "reference-generated",
+    "package-audit-chain": "reference-generated",
+    "package-audit-verification": "reference-generated",
+    "package-authorization-payload": "reference-generated",
+    "package-authorization-signature-verification": "reference-generated",
+    "package-authorization-verification": "reference-generated",
+    "package-clock-semantics-verification": "reference-generated",
+    "package-delegation-chain-verification": "reference-generated",
+    "package-delegation-parent-hash": "reference-generated",
+    "package-delegation-signature-verification": "reference-generated",
+    "package-delegation-verification": "reference-generated",
+    "package-envelope-signature-verification": "reference-generated",
+    "package-envelope-verification": "reference-generated",
+    "package-intent-hash": "reference-generated",
+    "package-key-lifecycle-verification": "reference-generated",
+    "package-signed-krl-verification": "reference-generated",
+    "package-snapshot-hash": "reference-generated",
+    "package-trusted-time": "reference-generated",
+    "rust-authorization-example": "reference-generated"
+  },
+  "representations": {
+    "docs/spec/test-vectors/canonicalization-v1.json": {
+      "digest": "b0c7f9f28abd5783f86ebee43d58f99e6620184ce1b8de35199f58a65e866c17",
+      "cases": {
+        "v1-object-key-ordering": "4e6d3771bb940a87c827cabc83dae30be4ef33c26c3f363f0a30519fe3aff7ce",
+        "v2-nested-ordering": "e34b7d5879ae3749536e358f83d1982a6f84c99dfc9fba057fb55dba241ad937",
+        "v3-array-order-preserved": "c8ff0fdb77a7b572076280dc4078645adaa8a2650105f4ad03c713c8e995cc44",
+        "v4-unicode-nfc": "533ed6d7ccedafb1be0e716ee4b69d7a72d719cff954b874916883873525dcd5",
+        "v5-safe-integer": "7353e325aa3c5a133fbf72ce43cecb58a07c318e72a56b247017fce12965c8e0",
+        "v6-bigint-as-string": "4b7d66692c65c22b830f79cb7fc2402606504f52e2f5c990f65170bb71b4ff7c",
+        "v7-boolean-null": "5ac238455328bcfbbb65c701edf09229e501f4ef37dc521670ee50180f9a88ab",
+        "v8-intent-example": "3520de74b7e98d1c39cf867dad75b0760b9aa5ba2bb28fa8529c62bd39c1ea2b",
+        "i1-float-rejected": "3b2da5b55ffdb2d8ba63dceb76ed6c750a5707784a40240c9640acf35373c074",
+        "i3-string-timestamp-rejected": "e32acf958e66f9269a6eaee280e2f299f62719487ad9066749b395f19d7498cc",
+        "i4-float-timestamp-rejected": "2fd2b099b0362f62a2ebc22e7579b87900eee66996822967a2539b8599167b2b"
+      }
+    },
+    "docs/spec/test-vectors/authorization-v1.json": {
+      "digest": "f931c8f345e84cc47403ddae081fbb26e7d3b5efcfbcbd280250a21d83e81123",
+      "cases": {
+        "auth-allow-valid": "0b2519667e77db5cec23a7f2ec097565f1cbff7fbb99612f6e28732dbcee5148",
+        "auth-expired": "6aabbfbe20c9dc7ad3302f1cc3af0e1b2e4f53e21ffd6bfbba942a55adaa9260",
+        "auth-intent-mismatch": "ab2398c660d2813f097ce0fe1dc10f9f64df7b53f852942ca525ecace8216754",
+        "auth-intent-action-match-1": "d3fa84214ee80fb8a9baf3f8d0e1745c4364c805a302aa108c5711b970b90bee",
+        "auth-expiry-wins-over-expires-at": "3bc430acc26fcb254da9f582585c03cec8dcb191f14c582cbbb204812930ed8f",
+        "pb-trust-oxdeai-key-allow": "fc2e004508070f43ca4dea09be408e5bd5bc55329c1db661ac88e3c6dc3ddb2b",
+        "pb-trust-provider-key-rejected": "8c5a05dc060a4c9753b35b9c105c939a7408b5fa56ee70e1965cd060981bfc44",
+        "auth-invalid-signature": "e2e52328fbf92f00acbf3b6846c0ec090968efb98c3c3a222209ad3d2a940951",
+        "sb-auth-allow-valid": "dc685763053d098906aca6b80e6d7f955eab7c81a1896d44cf2d159492166d95",
+        "sb-auth-state-mismatch": "25d0dd9fbf9e551ad25a3ec21dd38b18dfbe55783881b11b57337b7c908aedb4",
+        "pep-auth-forged": "e1a382323798571c55f9349ad380c7e8978d9e63f069149092c9bd6bf869c115",
+        "sb-auth-missing-state-hash": "2562623218f0db4539d6a7d4f8b6e78610ae59e940560f87caa99bdad26695e1"
+      }
+    },
+    "docs/spec/test-vectors/pep-vectors-v1.json": {
+      "digest": "4358d6267e41e99ad15b955c821188f45d2127e2160d8210d7dca2bd8e53ae59",
+      "cases": {
+        "pep-allow-upstream-success": "4c3986e31273ba6a72b652c973648ec5ae6d41bc5114661e9d535fd7c88eaaaa",
+        "pep-auth-invalid-signature": "a64f9991f297847ea9b954809f97b9474d0a31b8e6855f86b1c2e68a47ba5abc",
+        "pep-auth-intent-mismatch": "ee9282a53ca94c5d5a254dd45231816370e12ebbb1f0d0a5ee1e7101b047623e",
+        "pep-upstream-error": "33f2a00deebaad3a93d31b0bd4d6984f9554c1af4e6555e423615dacdb8c3282",
+        "pep-upstream-timeout": "21b07ec19d097a49bed1a256b7672e66c4c9e878b1d7c2fc1ed8f2fb5baba837",
+        "pep-sb-state-mismatch": "765b718043054284249e01472a105d68eb4156521c3c91944ff874c7dc464968",
+        "pep-sb-missing-state-snapshot": "7e5a6f3b343adc8a433200e9058b1e03a299719f3b4a0ec6eb26f41ba552399e",
+        "pep-auth-forged-valid-hashes": "c1302ab4fdbaa4238f4a3109388d4ed10574df6842f89e948ac50aa41fc6e2d5",
+        "pep-sb-missing-auth-state-hash": "67777e5b26e26115dfd5bc14f6f53e221a26ccf4fd9186313c8d07a73c618276"
+      }
+    },
+    "docs/spec/test-vectors/delegation-vectors-v1.json": {
+      "digest": "2dde68d468bee35a00d927b89ff4fd39a1f662024bc51c443b259d7e4cf17681",
+      "cases": {
+        "delegation-valid": "4d3a716d36f10e89a177100f2732dcd9f84d393d705003a4968baf9774ac5c88",
+        "delegation-valid-narrowed-tool": "32bdf395e605fc4414bca3fd51fae9fad19b3ab4c1c37fafc14f43834f8a087b",
+        "delegation-parent-hash-mismatch": "d01653b670939e0ee2557d4394b031db36d308879f64cdadb6a7673cc654d50a",
+        "delegation-signature-invalid": "0c3a70da6584d9b74371628fdcc057e2729fe3f5ffe43b43dceba0790bccb89c",
+        "delegation-expired": "8b73b8383d9e2958e436afd0795630d6f01f1997dfbd2d3f91bf039c571bf0a3",
+        "delegation-parent-expired": "71c7beb6a8f12875d65537c021d337c5bfe05ecc5b45cc374b5c5ab7e1a0f7e6",
+        "delegation-delegatee-mismatch": "7a8adfc486f5ba4e4e44d6ddb763418fb345bdcec5f641ea269090fe8ba930d3",
+        "delegation-scope-widening-tool": "1668bfe83d5b2b248ab6ffd0888166ee17a9b3ba093b1ac15d798c671b8c12bc",
+        "delegation-scope-widening-amount": "5a87e66d0b4e6ab587391528d0b3df993d673cb84c281b556c2a189515df9083",
+        "delegation-action-out-of-scope": "f398ef439d802089dd13ab3753283f7cd77cdf3b4391a04b86120d68a7d8cdf5",
+        "delegation-multihop-denied": "bd35cb7efcb19fe70e5634df1abf866f70a2fb99f2bc4862c36117422a10cae6",
+        "delegation-replay": "97ef03a591191ab3586092f42d893963805d5f733cab68715028e5e35a1d1819"
+      }
+    },
+    "docs/spec/test-vectors/profile-c-state-verification.json": {
+      "digest": "09650e45209b53d6ce391cbabaf21c2761d4e282fe6e32363e015e8d3409b89b",
+      "cases": {
+        "profile-c-001": "bac96376701b5ff5ec0e8b18a86732802d41d4feb7a694c5c9cc497de4a61a9e",
+        "profile-c-002": "ba8e27afb18b471c21fd8fa52b061ec02451d457129120ba31597d7a098b02fe",
+        "profile-c-003": "de24f0601aec9e009f172836fe2d30424cf66cd59e680461e891016906574aa7",
+        "profile-c-004": "1ed8195b68964095413d17a16d6ba78560ea5bf756e47ee97f905b4f6034e330",
+        "profile-c-005": "47d17da378093a7e642d83c60c22e3db510b12ebec36ead24a9fc59ecc55371a",
+        "profile-c-006": "657b936606d6163ee431d409445960b2bccc46c91af79594b098304e5f16d530",
+        "profile-c-007": "d953106c6459713d35aa538750cd0b55a601809f9ad9fcad4cfcbb1d09a5759f",
+        "profile-c-008": "bf75e08eaad31877b5a030d3268b0c6144593ac57e31410f1f6bcd4b8254b20d"
+      }
+    },
+    "packages/conformance/vectors/profile-c-state-verification.json": {
+      "digest": "b3a03446d66903eca82aa58986f4e89273f01eda101649b4a18c47fdb5e52de4",
+      "cases": {
+        "profile-c-001": "294ebb22179e00d81e3af7d92632e65b7de6c202708ea44b6c50867224990dbc",
+        "profile-c-002": "14f9fe2c7f7cbff5e58691cf9cd154795fac320837188b6e425925b4424c8f45",
+        "profile-c-003": "289193dd5fb25353aa6b8bc13be8fd69f747654dd03264aa4bba1cff7789206b",
+        "profile-c-004": "b094f3a5cf7fbabffd45fdb54f9b3b7e3aab66e629535fb64a3fafde121f5d52",
+        "profile-c-005": "c87eebed901563443f75ad11151fe4bc952005313f77ed49532da161e147064b",
+        "profile-c-006": "cdc557cab1ef62e677d988e000dd2d3e547b6eed771cf1ea38deb42657922872",
+        "profile-c-007": "1f1d95c68fe0af7605c68385ebd2ed2e028e22a74f135bc916aa04165bee27b9",
+        "profile-c-008": "c6feda6169ebe7fcd4d6500386dd10c1183a5f83a13a69816902c13fc6fc4555"
+      }
+    },
+    "docs/spec/test-vectors/signed-krl-v1.json": {
+      "digest": "f14a1b97b1a3ef2df3e2c6be8c28d732cb5b3151b05b15691027b5e6c975d15f",
+      "cases": {
+        "KRL_SIGNED_VALID": "d91219bb5dc4fb2352d954e4738cc6056b5e08b785d5b371693ad2622b8e6acf",
+        "KRL_SIGNED_INVALID_SIG": "2ae5badb10f800c432a3aa5485cf90eba487f00256b49ccd5832a3b085c8e665",
+        "KRL_SIGNED_EXPIRED": "9fc3bb9dd8f6e46b12367592569d8a26b665da9fec673c310655fc8e660dfd17",
+        "KRL_MALFORMED_REVOKED_KIDS": "506b72384e5dc5c6b52e00690b1048578b25f21a1b6f6d1d729fa02f0c8c92e8",
+        "KRL_DUPLICATE_REVOKED_KIDS": "7d798ad921fdb6d00c2fd7f9ad4ba7b1361bad9833cbe65ea76d36226fe2ce6e",
+        "KRL_UNKNOWN_SIGNING_KID": "4105f02e60d354f71d2867c4532e21e15ccb12d726b930ccfe028c2dbbb3d982",
+        "KRL_SIGNING_KEY_INACTIVE": "6b3cfd0d299c9c3a2b997153c8e70d132e0ee2cab0aac5d278d4b7570d7b90f9",
+        "KRL_UNSUPPORTED_ALG": "fe22bc82de7c4a689a4067335ea46dc5e7d79731b9bfe884d3269410598a3be2",
+        "KRL_VERSION_REGRESSION": "534fe4ba32067a0761eb974eb63f0a86751f988d85e8171eeb7faa3ee4011e90"
+      }
+    },
+    "packages/conformance/vectors/audit-chain.json": {
+      "digest": "4b4089a59e236201d9e8ee3428cdce446ee24db8060be5b293f0e6845d19aeb1",
+      "cases": {
+        "audit-chain-001": "0ba73830543acf1b20e4c9716f5a51634b8503732c406055f2d6ef865d4dba60",
+        "audit-chain-002": "96d4bc045fdf9284014db5d04f6cc368116e38b960ed03668ca35010d47025e1",
+        "audit-chain-003": "37511af34f4a546f83bea3f2ebd4268aed4b239bc520e35b2e1a619ccc6a0499",
+        "audit-chain-004": "6e250556d478c81eb3673bd8a9ea85c4412b4145ae8d6761a654811035e93e10"
+      }
+    },
+    "packages/conformance/vectors/audit-verification.json": {
+      "digest": "c2e79c994275897b9f2964657cfa40a28c3dddbf31c1ef4fdf56523b39729b10",
+      "cases": {
+        "audit-001": "f9c7646f6b0134ae2f0187e41e9ff62346c46c714514b2552a0568ebb8b01f08",
+        "audit-002": "b690abffa3754fa30d098701ceae231cf94add97e87eeb0dc9f51923f4773a16",
+        "audit-003": "70dd6dd90445db8bf318ddbcd9ebc792268ca478045fea2db76404e89391e66c",
+        "audit-004": "a6ead00716c879d881b276626af25cd7cec57cab8296674631c4a9845074cd73",
+        "audit-005": "490644cc459fc104bd8675306ecae92c29ee8505bd2c2fb948b3feadbfe05e7f"
+      }
+    },
+    "packages/conformance/vectors/authorization-payload.json": {
+      "digest": "4da351e843feba3e8b8469370202b653c98114a1418168abc6f08250b2a13a54",
+      "cases": {
+        "auth-payload-001": "a81ba144b9b9d19f12e75cd6620a295730654400096a4f20cbba7684ed871920",
+        "auth-payload-002": "47470663491ffe0775fecaa4e77dfedf9c7748030c312d4c00fc2a7880f5bb37"
+      }
+    },
+    "packages/conformance/vectors/authorization-signature-verification.json": {
+      "digest": "47a8b57b11924895c289573579f5bb2c32fadc423cf5fc98a9d7152ebc3263a2",
+      "cases": {
+        "authorization-sig-001": "c2a64bbfccc17e04ce45343af718e97b91a19331fdda485005ca85d32e869a26",
+        "authorization-sig-002": "0b8c80f4c2588a27aca69f105c19cb3443ce25a99e943c7d6fa641703c96c598",
+        "authorization-sig-003": "20b29b58f9f92c2612439c2fcaa3d103af88c9d70fd9e67b0e4649fba973da0e",
+        "authorization-sig-004": "6df836ac005c90087882982918e3d21e749ec5ebf41222c9c4cd600a91344fce",
+        "authorization-sig-005": "3be3e54a8da50e9523ee749a25b1d0a52c997664cae986bb78a44af169a142d8",
+        "authorization-sig-006": "9dc2f0309ed0c7111e16acca250e7446e4a5912d117660668bea27acbc20c3fb",
+        "authorization-sig-007": "664afcf5b3ec1174c5db29c8f80e124291f70c62436aae9c2c16f5efb679bb2c",
+        "authorization-sig-008": "337ec9807c8b700ee696d031e9ac3207902a6c3932b4b9ce18d0677fefb2cb50",
+        "authorization-sig-009": "723a3449195dba0adcf98d701bfd4a4933e291307d023a40afe3ea15df0eb4b2",
+        "authorization-sig-010": "8912aed2eaa8e15783c9f3f3e107162db8ef0cb5ee26d81241c7689c3b0608aa",
+        "authorization-sig-011": "3d8e6eb79d8e151363408d6aba88b7f196fe7844ba5fafbc029d545dd69e7ab3",
+        "authorization-sig-012": "3ddc7a9617b0c041f34d72b45479f6222dfd26f514408e4b86a48d9ad3ea5655"
+      }
+    },
+    "packages/conformance/vectors/authorization-verification.json": {
+      "digest": "c1f965992c75223187d61b02bf78c9a8720963f07b04325cfc5761dadd69a353",
+      "cases": {
+        "authorization-verify-001": "63b0fdbeebd0707b18eebee633ba3fcd14cb2296e24fcb11d88825432de6efb2",
+        "authorization-verify-002": "d8e34c854e75261d04c61b0c7d0623fff685d636cd96d81bb0a728dea994cdb4",
+        "authorization-verify-003": "79381f059a6aff224dd194816a0a5c2cd13bf2768cd181b00d5c0a302e004e0c",
+        "authorization-verify-004": "d74d2722c8297dda61245fdbf48b8c5d073ca356570ffeec1a3ca9f58a00f6ef",
+        "authorization-verify-005": "74b0aeace4f149d01c56217ff33d1a5c1b7bcb5e4423aba7f05067b6dd6b4a1b",
+        "authorization-verify-006": "7db8e175f9c838a802500345f612315fe696ff1955cd0bd96ccc698c5cf743d6",
+        "authorization-verify-007": "e88190ae620d8b9817cfc5f8eaf5a0e85faa506c243a82bd0e3fe234eb8115fa",
+        "authorization-verify-008": "4c1ca3c70331a54e02e72a1459bb53fcf1c92742b1eba7bc2e5568b8c93429ca",
+        "authorization-verify-009": "f36939ff5347e6e30f47f87a11136633458bef4d0e34d0a7aa6c9e5a73231636",
+        "authorization-verify-010": "9198fea5467792125ab1b31c3b2d4e58d58d9ca2b5aba331e8158e0c8e1bac66"
+      }
+    },
+    "packages/conformance/vectors/clock-semantics-verification.json": {
+      "digest": "4e91125700673d6cd3496a3954c20f43f6a5e5c08bd3a58857a1a3186cf6f274",
+      "cases": {
+        "clock-001": "6448c63cae7fe507b730e3e47df6da901893641ffb8fbdd9f585fc7ca3225567",
+        "clock-002": "912db59f5c0755fef77a88cd73745894cad224505eae45372136e86b1595c592",
+        "clock-003": "8c7b35ec9eefd52be5533c7d764f3544b0b16702a9d22f7ba6e4ff560fdcb870",
+        "clock-004": "d7bc04b7e1a8c5fb1da760482626fbc77f77eb9f743977f6423f7f5389ef37fc",
+        "clock-005": "a93d58b4b636e306f4db6e7113c9915c720accf2f7f96b059ae0b14af47e8aae"
+      }
+    },
+    "packages/conformance/vectors/delegation-chain-verification.json": {
+      "digest": "554f18eb857d7e057a96aca9ed5ff68d7323ab6932a40b4f1ed5ef71a2e62a9f",
+      "cases": {
+        "delegation-chain-001": "8f0f59989adff2236d5f7aa1a60142d480d41c270630fb1348b6a024b20ff0d3",
+        "delegation-chain-002": "436222c41e2f9e716bb0cbc1f9d33a76f3b8e0a96f2b9d7de3c7ec8d94cbeddd",
+        "delegation-chain-003": "187d5e56d5b339b2d7284b9bcc21ebbabf76df07491b321afd295e30cbd86314",
+        "delegation-chain-004": "3be1203de63f55267e22dddd71534206888b7a754924106f85158c734e41b9f8",
+        "delegation-chain-005": "f0008946c39cd55e9c273e207a54670f7cec40d956644144c86086b9bf5d22ae",
+        "delegation-chain-006": "ee4a586f8c80ca51f9cffec59eed94b3bd7da13f8e720000105599f74c530c2d",
+        "delegation-chain-007": "c321ee3fbe92a26122041af6c04f703e9658dca68d3bffa1317f8666604aa6a1"
+      }
+    },
+    "packages/conformance/vectors/delegation-parent-hash.json": {
+      "digest": "51507f6fe917e5583024cea4c417829df38132631e8c1a7ff97777e7a6846e57",
+      "cases": {
+        "delegation-ph-001": "da20b14c4e9b67ef7bec30d41e4dcfa5fde055da3dd3fabbe71a016c1bae7081",
+        "delegation-ph-002": "e2776ba15e6a8324a9cd50559a0ff603893c50e75380ee1eb793d24bc4a49f10"
+      }
+    },
+    "packages/conformance/vectors/delegation-signature-verification.json": {
+      "digest": "ae92c64cb4f538afbdc71a9fde0f86f03acae3da201bfe6fcd7e3c9d0a6392f1",
+      "cases": {
+        "delegation-sig-001": "69788786cf198b04b2c95acb4d2bcc6ceca2605a36473c4fa349fefbb12cc5bd",
+        "delegation-sig-002": "e3ef298d63cf80b3656e6908c074acd785cba613550875ff3005bf7b77d1cf8c",
+        "delegation-sig-003": "2f917e71ff5040ebf81e899d5bfdce48b20e3865da00450898c2633107fe9a86",
+        "delegation-sig-004": "38043810921f1108a72dd64ecbd14dfb813eb16e4219204a0839ae21d853f4e7",
+        "delegation-sig-005": "8df9befcebf5fec2387813cf33ddc713f7b57af0ebce9db2929cddbd8cb3a615"
+      }
+    },
+    "packages/conformance/vectors/delegation-verification.json": {
+      "digest": "38f853f8b4a7f15f5acf1150cdf646377b1be3339a89b7ad5d48e7a868b794ee",
+      "cases": {
+        "delegation-verify-001": "ec59d6acd21baf8f2f49f59bc65b09971a2b108eff351fae48095990284865b4",
+        "delegation-verify-002": "5a7f78423f1965cd285b7f32c2d45334ea1f2352e9b14ad227aff2ccc0199800",
+        "delegation-verify-003": "590738eadda54f18bfc9bd1d4e99c94977dc4b2d07e8226184caeb2ef779c742",
+        "delegation-verify-004": "0bc72ed5093242f0e647cff0d0770ab35225372fde0758e0ba7aa532742b906f",
+        "delegation-verify-005": "bf63f0aecb52f904dc39e5e769f24e69f4b61938134020778d2367b3b25443b1",
+        "delegation-verify-006": "dba458866f4d25347383b8030ac3fa08283d8738c1194b4bb53711c576dd82ec",
+        "delegation-verify-007": "5974acbb6da27897ea3ce73b7a900dd27f626168aad9e1829b5c29906f1a1f72",
+        "delegation-verify-008": "28ce2f685884e88b32e153f75a4bcaae40b747e53464f25fe65cb8c37cad95ff",
+        "delegation-verify-009": "4a219efc5596c72a8ac430f2fc264b783fc76a3f3877a1a2dd172f95b89578e8"
+      }
+    },
+    "packages/conformance/vectors/envelope-signature-verification.json": {
+      "digest": "e50862e48137198d631034967e960d93e6dce51f96f26c4e172a305c6166adcf",
+      "cases": {
+        "envelope-sig-001": "9a0eaf111640b1829171faa3bbb8497113593a5b00f455a54442dbe99a497ef3",
+        "envelope-sig-002": "48a685687eb9d7234a7597a377c84957d8b07f22bb6542908a67806375567418",
+        "envelope-sig-003": "8bf38ea75be79bb306fb608adcacffd715b8d717c33d03fbb620480a3b1e4da6",
+        "envelope-sig-004": "1f994b370854a3bd5974544735011c00ab7775f6d5598c14d275e60fc58029fd",
+        "envelope-sig-005": "9b06b5505bfb724cf5187f29de223855c16a03da01daceca872f9cafbe78d41c"
+      }
+    },
+    "packages/conformance/vectors/envelope-verification.json": {
+      "digest": "975e803038b23d443ee13361c641daf9826889c51953c71cbd1c52ac7f094191",
+      "cases": {
+        "envelope-001": "e2ccdb41ac2d8b2ecec821db0e4ee431cb2deaad13ca32c7c5bfb548c15bebbf",
+        "envelope-002": "e23ef0314f361d9ebc628a2060e8d8da24c083cde071d93a788d9bb6447b24c5",
+        "envelope-003": "49b0773c3d2777d08852f7723bdded97252adcaaba0e5a917b1b5d7071f38d2c",
+        "envelope-004": "01f4835db32b65b94eb921014e021fbfd2a5384d71afe39e6877ae869d612860",
+        "envelope-005": "7b35da938743978c826918f6c69214084266757e9ed4b58594fe391d34c7b7c4"
+      }
+    },
+    "packages/conformance/vectors/intent-hash.json": {
+      "digest": "f9684f244ff4499d1466ca27181afcccf39fa6cade9a8616d2d2ea2d4e8eefa3",
+      "cases": {
+        "intent-hash-001": "b9ec029dfe742e0a6a70f8bcc5e1b38a56d1f6ec2aa0a4d2695130076477ecf3",
+        "intent-hash-002": "0db97aed09397a89f845038fbe8e5c0c6cb977960b27ff6c4592523b7ad7c8ff",
+        "intent-hash-003": "f750bf8f534dc032fb3db7cbeada4fd00091a5eb69cde1daf0eecb13d6a3abb9"
+      }
+    },
+    "packages/conformance/vectors/key-lifecycle-verification.json": {
+      "digest": "bad6ae98ddf78ab65fab8e212ba91b41121b4e497fa3574b52107a4e55c02e2f",
+      "cases": {
+        "key-lifecycle-001": "9deded231debee4b508d78f0c8a5e5a543ca76bfb2e67d97b3aa41c7ee2ea438",
+        "key-lifecycle-002": "7af676a403e7bbfbd97b505a1dde35b587a75dd289b6be606aead61a141fb2d4",
+        "key-lifecycle-003": "2512b8655f10af168214e604e5ee493e4031449f18e002b058e11b1a7a905775",
+        "key-lifecycle-004": "e2d84a5c5fc1087f43b64b39b5690e96a806bb2172f9ccd34c9791c3618f3bff",
+        "key-lifecycle-005": "d2d9392c978796b61da574b6e5105466c5e0bc54ba027a72a573e145503f2db5",
+        "key-lifecycle-006": "f26abe9d24e7599edf4b211f7ef3b70190f5ab2ea07b056394487d378a708f1b",
+        "key-lifecycle-007": "a081d30de6ba425e00944a545ffad78e8514711c52dc8e4009c18954be726238",
+        "key-lifecycle-008": "fe1b4a77bfb82057a38206c2fe73e44bf4091f91b9ea9bdfbe0ec6b1d905fd6f",
+        "key-lifecycle-009": "20b58c49959a3389ac04094c26150260acbbc3f94985523da7e3ccbcdf104faf",
+        "key-lifecycle-010": "1bbb3ba98a86096e0101d6b5bdeca64f7cc97e34d865dd6bace870f71b51b14b"
+      }
+    },
+    "packages/conformance/vectors/signed-krl-verification.json": {
+      "digest": "f7e4ede7f747e7e911622160c23edc63bd5a80a41e59f389c9e08fffc6f98f4d",
+      "cases": {
+        "krl-001": "efae62bbc85cd2dc2d6e55fd740e5ffe9e3bc912ed437afbe57c3704537a96a9",
+        "krl-002": "ce4b3902d46c790eee6cd6d22a80a6c24c9caf82d05f459f562124c619de88f4",
+        "krl-003": "4ee67e87aca3d77abc566615671e49161c7f495005eb800f3b2db52e791a16c3",
+        "krl-004": "3b27de34995bba96a5911bac9556ef06b2343c6e5bcbd345324219c13dfce608",
+        "krl-005": "f16f93f54283b8ed38cf3b7a89d79550401d28c1015b07928b4000da46431bd5",
+        "krl-006": "e53fc6c2dd83ed6bc1858cc547d35ed3e9df9aede24cc5376613b70558d672fc",
+        "krl-007": "d58d72a969e614e7a6c902765883d97fe2a17d039fab288af1f258f3dc7e50fe",
+        "krl-008": "67bae99d688acdf02d40e9370f4bdd57decdc9f0aa38bdf53eff4284532d315d",
+        "krl-009": "0f48b582a88ed28e8761bc79c8cb6703100f798f8990567e6d11db428a8bc78a"
+      }
+    },
+    "packages/conformance/vectors/snapshot-hash.json": {
+      "digest": "6a8861d1265568604a5059eda588c5cf5bc7f00767718f8af8f4114b5e1273a8",
+      "cases": {
+        "snapshot-hash-001": "5e44532dd07442af706fb057123d4ea13bbdf8bdfc06cec255b8a46c337322dc",
+        "snapshot-hash-002": "17e3cfbf08ea05f21f5eb6128fa54ddda2c7fb8d8f330a6288f3969a1a17359c",
+        "snapshot-hash-003": "7ab231328fece9570575c19a56765c343ec87e14065616edb3761a90682ee3f1"
+      }
+    },
+    "packages/conformance/vectors/trusted-time.json": {
+      "digest": "7006b5d41eee1ba7c1e386873a1a08b4aa348831857fd3c2467b9540b5d7f8ef",
+      "cases": {
+        "tt-issuance-before": "282c1ad5fba256a62d7087359277efb85454eb50e226c1df59249cceff5d9b88",
+        "tt-issuance-equal": "d1749319dc6ec1dfda83f2cf6490dfedc400227c3fbacad3d97eb9167505c13e",
+        "tt-issuance-after": "526f26d7d8c81fdf25ccd3e21552f7fdba31132c0497448647f9a12860cd20ce",
+        "tt-noninterference-earlier": "b979f8ea70142172195c8f8933c5939d5a3e29eb7cffee6f7153f6ffb90b6ff9",
+        "tt-noninterference-later": "222bd2c35ed989ced681bfc4a1d5f7276ca554de484b378e94e515f8a82adf4b",
+        "tt-evaluation-sensitivity-first": "a9c7121a98b6293a0d02bcb683149d508c6bc3f29724c85f064f841a0be0ac54",
+        "tt-evaluation-sensitivity-second": "df091ae62a6e990cc6742bbad644d2554b13fc19d8f9f9dc435054c359851925",
+        "tt-release-issuance": "7ac41f0f5a86d6db147ea9bb34bc1d543951664e3d3aa11696eee062f3596005",
+        "tt-freshness-denial": "6dd9a2d2ab7c7883a8e64054c3d56e8c82ce9a6ec0069b446b3f5eb1be516b98",
+        "tt-deterministic": "52d8941b204945440b6f8b639c1987271b784af96e663e16897b4099528e19ec",
+        "tt-invalid-ttl-zero": "f4133c46a3c747e9a6101bad1e85ab2936d7628200ee15d06a8d5a17a8b767af",
+        "tt-invalid-verifier-skew-fraction": "7b87ea994db7d91b1dd0083aaf04b38bf6d09ebb2ff91dd8d738a8739e81f022",
+        "tt-expiry-overflow": "e5ca3d1eefe62c7889b1310cd44d71db236e69623deb8ba975acbc8c662535e0",
+        "tt-protocol-negative-intent": "b8b1f186e6bbdeca777d04fa5234aebcb68aaab51cd00f2770e4c3ea9905b2d0",
+        "tt-protocol-fractional-intent": "5edb9c1ba471f854bdd4766075df8dded4932ab5eeaee44dafd7e388ab8b3bf0",
+        "tt-protocol-negative-evaluation": "4fd697c7a524b12a042774caa11ce1b6eac0332ed0c6ffe3e9542d29e2e2968f",
+        "tt-neg-001": "b418ca675576578d7a9709e2bcd79460d7f91834e7dab002515a55b113c6ed35",
+        "tt-neg-005": "1e389a9f2735578c26a43a32ca0c096696b4bb07a2e381b31de9fc7eec2d0d33",
+        "tt-pos-001": "c5e7070c84c4f439d23627b4932bda3649c40d6aa973f21d895a35974e9bfcc8",
+        "tt-pos-004": "df83ac691f359381fca57b25913584f59b11961f403c77f60c69b168b6451c68",
+        "tt-neg-002": "e8720278e1e56d96a2cf60a1abb91ef36e8d3ee932244d089c426b309df5db3b",
+        "tt-pos-002": "5e021603a6634f334bf7e005f15cf4e259ac2bb93b53ee48396809c2356f821f",
+        "tt-neg-004": "8833c505b450107e7c51446f6f69281879a5d1cff57de98c44d4b521482b14ef",
+        "tt-neg-006": "a96f71c572727053b6a1161ca79125fa8a8168ee45bf7ec85319b3419f99e37e",
+        "tt-replay-future-within-band": "3cf39429369b0d2f0ce217f4bf02b7e7b9d9f0a316303b4cadc4c0d8044a7b25",
+        "tt-velocity-first": "4b0d40ddcbcec091e56dc4e26d272527ed9c9222330c5cb3dc701867c9f6f0c8",
+        "tt-velocity-limit-active": "aa406c213c24dcbac5742455c26e574bf63269e9436a8ede59827adbb7838644",
+        "tt-velocity-future-intent-active": "f4c0cb3c655457721440f35ce8a90a22a17859a5b271870e8bf1873223e0d5d2",
+        "tt-velocity-stale-boundary-active": "e4b79af7bd5cc97c2957184bee998e0c931481c182b88e53899e78ba350eca74",
+        "tt-velocity-before-boundary": "b57e0c8abfbb763fe74b7dad00bfdb606fae5f670401b921f2be4cbd604736eb",
+        "tt-velocity-exact-boundary": "bdb292186c699f09302cce6d41fc580fb9724e64454757dec8089103eac213be",
+        "tt-velocity-after-boundary": "a90b171df9949688191068cdd76518dce18dcbc1ac507e4a4c6862e4fca0f71d",
+        "tt-velocity-backward-evaluation": "b7ad825103e0945029cf9a78aa5a31e1805d9191eb0f9ea72af0f7520a454d46",
+        "tt-velocity-malformed-window-start": "711edbf8fa7eabdf3add24f84a9f64706afc5ab9342a66f642178dd48c58d7fc",
+        "tt-velocity-deterministic": "a6b493e16d4d8f1b3b7dd8ee0777359f8199c2ae398c2511b12aa9ab832aaadc",
+        "tt-neg-003": "a427964e4cab04b28156728391be02c6537bc97053578d15d10a980c748aeef3",
+        "tt-pos-003": "6a7d4a59ba458f6d7f61d6e16af22edc0005e3ca5d10ad5185f1ba98f5ddf263",
+        "tt-auth-verify-future-boundary": "8f91ee2c15f04cee827104134d0329d48e55f8ec4318b14dc6cc6d656fe3b5ca",
+        "tt-auth-verify-future-implausible": "310683c279ffecca2be2898fb02be5297a3e72618f42101bf3597586a26c5b4a",
+        "tt-auth-verify-expiry-boundary": "41dee8fe8d5c91bfdac2bfc35561851cf61dda8039f1f27135266af80663ada1",
+        "tt-tool-window-trusted-time": "eb169085e04fdcb34bc19f371c76fd850b720e6cc751c6083111114d113c43b1",
+        "tt-tool-window-after-boundary": "b64c77ededa9f3daadd256c03932c11c99b553826fa23d3fcead973048a9a0be",
+        "tt-tool-window-backward-evaluation": "fabb12de4e117d239600e22db825ad345c37d91b59e7408f2a53a2bac6fcc68b",
+        "tt-tool-window-malformed-state": "a52d2a3bf3898b77e10784fec92b0858aeea7dd8688026b9f3ac6a1a523d4d77"
+      }
+    },
+    "examples/rust-verifier/auth_case.json": {
+      "digest": "6b8066fe936b16d5cd89363d94d5bdabb501c0e1567e9cde3c70f294839617a3",
+      "cases": {
+        "auth-demo-1": "46626a52a790f7163c829e49c359fee2d3c0b9d2003a52fd4d62f6d2ae7dd7d7"
+      }
+    }
+  },
+  "source": {
+    "revision": "4069abf337d060b8b52861acf9f67edc67225815",
+    "workingTreeDirty": false,
+    "artifacts": {
+      "docs/conformance/corpus-authority.json": "0983a4a57d9883b9da64ceaa5ef6df326beecc498dc07cdee6a49502bbe3da0f",
+      "docs/conformance/corpus-provenance-audit.md": "6ffe9b44d0ecc68175848743a66a24287655da8f77ae0cc8164371653121d387",
+      "docs/spec/artifacts/authorization-v1.md": "a1a7b82c141746f7ecd4fe2d32ea0845a6cd7f69f9562b00e41c384b754926c7",
+      "docs/spec/artifacts/delegation-v1.md": "6d2ed0f750bdc25915bedd3f5eee3c21859fd368527ad6b5bac2fa4daa352f51",
+      "docs/spec/artifacts/signed-krl-v1.md": "c0d7f4a1e0d57d85dbdab6d3655aa2288e093722b3da924ad5b6bceea7f923f7",
+      "docs/spec/core/canonicalization-v1.md": "0ab7b1afad65194d6faedf4c140dcd892214606e855b30b28f4e0e83e5b6ec75",
+      "docs/spec/core/trusted-time-v1.md": "baf145043de06aadcf4ba0fa22784a6decac179048c5931cf13d4c5c7fda9973",
+      "docs/spec/enforcement/pep-gateway-v1.md": "c718f18ab7dba45cfeaaf3d727c99224a539d85ad8bf49f066b9bc233297bbaf",
+      "docs/spec/interoperability/external-provider-profile.md": "1119b6e41b9ef2851174413591205d937d864fbbcfc89963e98b6dc4060f8567",
+      "docs/spec/test-vectors/authorization-v1.json": "65428c5b757c53cbadcf513238bd52ea82cec3232635a09013bb9e583ee387c5",
+      "docs/spec/test-vectors/canonicalization-v1.json": "0483ce636f97f69b19a854700535d8fab6bfd8c9ec1f9d3a56423a4fa29cbe82",
+      "docs/spec/test-vectors/delegation-vectors-v1.json": "4a2228c43aeee31b5d2f99358628b62f6d3aa5f93f61402bb47cf8192929955b",
+      "docs/spec/test-vectors/pep-vectors-v1.json": "59934cb1744828b0a781ef276d0159b803a65758e3a73e6803f460626c11b096",
+      "docs/spec/test-vectors/profile-c-state-verification.json": "9b9440fba8526d08f08df963fccbfbe8b915228768c9b80b41d2e013d6f52dab",
+      "docs/spec/test-vectors/signed-krl-v1.json": "fe08302c95a5813b8e00246d176d0f2fd952ea74e67370f3f77a9ba693f47f50",
+      "docs/spec/verification/verification-v1.md": "173ab1e244b934d53965d1aa3398bb11c155f41b0d6fe19147597fba65f48db3",
+      "docs/verification/spec-claims/claims.json": "e76ead62c3cec0915f4b309241cb2f0007907a7027c9ccbbe81cc849998b2481",
+      "examples/rust-verifier/auth_case.json": "de3c829635583b948128e609a18f55973c5f3b7d6f52b7e7efec463af7659dcf",
+      "examples/rust-verifier/keyset.json": "9d7b13e81ed94ed357c7a161ce7512e74a41f75c815125ed66717f7805f0ef70",
+      "examples/rust-verifier/tests/verify_authorization.rs": "02f5325b139d53c9d77897d1ab09eb2f1041a55b092cd3e70921027b1a51a43f",
+      "go-harness/canonicalization_verify.go": "cbc7b24a092cca86bfb4fa894ed78054599182a1f9f178104de71e261894276b",
+      "go-harness/profile_c_verify.go": "dcc10403ae5103c5a390186c3aa355488d536b67cb79ea702ab79ae70979c68c",
+      "go-harness/signed_krl_verify.go": "0dcf27d12ab37348fbe0c554ad875136d068254ed89b45d393c341e6cab775a3",
+      "packages/conformance/go-harness/adapter_python.py": "a665d2c8e5ea93464429f27b576f1d7182bf7e250c1d191663979bdc8a1ca552",
+      "packages/conformance/go-harness/main.go": "175ffd3314dca071b6fe23d215af0fd0ecb7f7fa666776b12b987b48f8a3730d",
+      "packages/conformance/scripts/extract-vectors.ts": "ec93d48f9b21d314ffbcd72cb542300014e6ba3aad3ac3757871cce49fbc2317",
+      "packages/conformance/src/trustedTimeConformance.test.ts": "9dd9ecad2d725dd4a22ef4990b0f758767c54a1d65b89ec3d686c15fba2b3a16",
+      "packages/conformance/src/validate-trusted-time.ts": "a89e65c483f557835b2db3645a15c08ca10d54998e762ebe6384883d88d67e15",
+      "packages/conformance/src/validate.ts": "a275011cae5090c8c405b6e05edf1c6c6da8a28643331b111f9b0a8ef187ac77",
+      "packages/conformance/vectors/audit-chain.json": "f38d41585d0693ca14157164df65cbbdd6bd7e5578d212ae8f8792787831a27b",
+      "packages/conformance/vectors/audit-verification.json": "10c60df5f5e3ade9ec2fcf18803a5d32fe4a562b39b6ca9eb35120b3df19ee3c",
+      "packages/conformance/vectors/authorization-payload.json": "fa98e2e8ce998142e968cdaae8a09262285fb18bbc66b863a6435f939da22089",
+      "packages/conformance/vectors/authorization-signature-verification.json": "c536cffd87b6b92c35de78f33ea506eb1d4edbbf6d4175c1d915a6e948905f50",
+      "packages/conformance/vectors/authorization-verification.json": "ec5eda91ed791f8a45d47afcd190ea0365fa97fe02a50d0dabd6bac688eabf51",
+      "packages/conformance/vectors/clock-semantics-verification.json": "8f7e405c711f92270783723b6613ae54a53f662d5ee55c8cfd02a0d301e68f5c",
+      "packages/conformance/vectors/delegation-chain-verification.json": "ed27d4931e409e1d744b6bcf1e6897ec44ebd8390f29b6b96949b400aec46b19",
+      "packages/conformance/vectors/delegation-parent-hash.json": "0ced49289925c6ccd764bd95039e8daed1acb40e2eebb6b79be55f9d93584537",
+      "packages/conformance/vectors/delegation-signature-verification.json": "abfa8ba58b640bb21e3dfbd9910abe4cc2d61628a285ae9838f9f59b94db0874",
+      "packages/conformance/vectors/delegation-verification.json": "badeb515b72a9a440913612b1629dd6ba7b2d006cb8d1a6491e481b14140b616",
+      "packages/conformance/vectors/envelope-signature-verification.json": "4c7101a9ed8a2ad884cbc4b07895c8a22c7379c5303bc30ec95c0c8449c95030",
+      "packages/conformance/vectors/envelope-verification.json": "ad1f2fa8ec6831ba3c3e78c59d22141dcef892fa194339541d7c0e1a3f1a118c",
+      "packages/conformance/vectors/intent-hash.json": "51dec9bdc73e70ef79eb6a810886967e3e8c571a4d184b6d5e4fa062879d58dc",
+      "packages/conformance/vectors/key-lifecycle-verification.json": "5f6d680c3ca05426ada4690b251252254459072b74d759051dad4b2287912e3b",
+      "packages/conformance/vectors/profile-c-state-verification.json": "d5bd1ab99a7ee319b2fa85e9bc7a658b7637e48b56be6e1b146774598cd5b76d",
+      "packages/conformance/vectors/signed-krl-verification.json": "017c4d6774bf009d2603ebaa9a3f955f0e69c8277d1550dff358510dfdf754dc",
+      "packages/conformance/vectors/snapshot-hash.json": "be6f8bd9dd2c017eb9feca7f758c6696fc868d38a93cb77706a7b0d152458bda",
+      "packages/conformance/vectors/trusted-time.json": "748ed3208e10b8105837950e0a15896be402d1a0ca86541bdc66621d285b7abd",
+      "packages/guard/src/test/gateway.vectors.test.ts": "b3665a611482df5a432133285ba40e0bf9b2e32f9fc41980cd65d6c05f3d2ccc",
+      "python-harness/verify_canonicalization_vectors.py": "514c16aac8586cfd346b6cf9f32a3dde546ca1aca593b7d22dc793dfbebb4e4b",
+      "python-harness/verify_profile_c_vectors.py": "221a967504edc9bc5102f5872ffd53412bc7613ce182e7b949a0f66ec9384583",
+      "python-harness/verify_signed_krl_vectors.py": "57d3e04a16bf5f0962ad0ca424bacfbd6598432178477c0fc9020641e733dc6c",
+      "scripts/verify-authorization-vectors.mjs": "02d67c8112f03de8d60311e947a2d2e05f3adb42242060ec261cb145a09d3202",
+      "scripts/verify-canonicalization-vectors.ts": "125b3b966ab3a4ab10c886fdd7ffe26ff8042af0fca5cf49e2394d35c5ad5447",
+      "scripts/verify-delegation-vectors.mjs": "fa31d3cd5e50d478f90f269cacc039b1a0a86305c8032ad66adf8de185adbdc1",
+      "scripts/verify-pep-vectors.mjs": "f226f40273b51c17109a01e721038ed2f14cceca87273d8cb4e82d35911d7f16"
+    }
+  }
+}