@receiz/ai-skills 109.0.0 → 111.0.0

package/README.md

@@ -5,9 +5,9 @@ Receiz applications. Fourteen focused constitutional skills supply architecture,
 domain, law, command, authority, replay, offline, causal, artifact, migration,
 performance, observability, testing, and release contracts. The earlier nine
 domain skill names remain packaged for compatibility. Seven operation skill names first introduced in obsolete-versioned now
-describe current v109 outcomes for identity profiles, portable continuity, bearer ownership, offline transport,
+describe current v111 outcomes for identity profiles, portable continuity, bearer ownership, offline transport,
 proof media, cross-app state, and admission evidence. Their retired obsolete-versioned mechanisms are not active defaults.
-Every current manifest uses schema and version `v109` / `109.0.0`, requires SDK/MCP `>=109.0.0 <110.0.0`, and binds ruleset `109.0.0` to registry digest `17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70`.
+Every current manifest uses version `111.0.0`, requires SDK/MCP `>=111.0.0 <112.0.0`, and binds ruleset `111.0.0` to registry digest `cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a`.
 
 This package teaches AI agents how to understand, verify, build with, and operate Receiz from the existing repository surfaces.
 
@@ -27,9 +27,9 @@ Agents may acquire scoped delegated access through the official Receiz Connect/O
 
 ## How Agents Should Use This Package
 
-Start with `receiz-build-production-system` when work spans multiple constitutional domains. Its machine-readable manifest requires the exact active signed registry digest, command-only mutation, independent verification, MCP conformance, and a passing release lock. Use a focused operation skill for SDK/MCP implementation and a constitutional skill for broader system law. Stable obsolete-versioned wire schemas remain available only through the explicit historical `@receiz/sdk/obsolete-versioned` package entry; current skills never teach their key, head, receipt, reconcile, or signed-command mechanics as a v109 outcome.
+Start with `receiz-build-production-system` when work spans multiple constitutional domains. Its machine-readable manifest requires the exact active signed registry digest, command-only mutation, independent verification, MCP conformance, and a passing release lock. Use a focused operation skill for SDK/MCP implementation and a constitutional skill for broader system law. Stable obsolete-versioned wire schemas remain available only through the explicit historical `@receiz/sdk/obsolete-versioned` package entry; current skills never teach their key, head, receipt, reconcile, or signed-command mechanics as a v111 outcome.
 
-The v109 operation skills are executable contracts. Current profile work uses the neutral authenticated same-UID profile operation. Current bearer ownership accepts a complete verified artifact, derives prior ownership from carried proof, and returns a native Record -> Seal artifact. Proof media uses the same native artifact custody and projects only a verified URL beneath it. These outcomes have no active identity-key, caller-head, claim-key, or receipt prerequisite. MCP calls the same SDK outcomes and never creates a parallel authority.
+The v111 operation skills are executable contracts. Current profile work uses the neutral authenticated same-UID profile operation. Current bearer ownership accepts a complete verified artifact, derives prior ownership from carried proof, and returns a native Record -> Seal artifact. Proof media uses the same native artifact custody and projects only a verified URL beneath it. These outcomes have no active identity-key, caller-head, claim-key, or receipt prerequisite. MCP calls the same SDK outcomes and never creates a parallel authority.
 
 Stable obsolete-versioned schema names and their head/receipt mechanics remain explicitly historical compatibility, not the active/default profile, bearer, or proof-media contract.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@receiz/ai-skills",
-  "version": "109.0.0",
+  "version": "111.0.0",
   "description": "Authoritative Receiz AI operating skills for proof-native SDK and MCP agents.",
   "type": "module",
   "files": [

package/receiz-app-builder-skill/SKILL.md

@@ -8,7 +8,7 @@ description: Use when starting, integrating, upgrading, diagnosing, or repairing
 Build and upgrade Receiz applications from one typed contract. The compiler is
 integration tooling beneath Receiz proof truth; inspection is not verification.
 
-## Binding v109 artifact law
+## Binding v111 artifact law
 
 A Receiz artifact is the exact byte sequence returned by native Record -> Seal. The inner payload is never an acceptable substitute.
 
@@ -39,7 +39,7 @@ Independently hash the saved bytes and require equality with `sealedArtifact.art
 ## Twelve-step artifact workflow
 
 1. Label the input bytes as `payload`; never call them an artifact.
-2. Load the active signed v109 registry and `ARTIFACT-001` through `ARTIFACT-010`.
+2. Load the active signed v111 registry and `ARTIFACT-001` through `ARTIFACT-010`.
 3. Call `receiz.assets.createProofObject` so Receiz.com performs native Record -> Seal.
 4. Require an SDK-issued `receiz.native-record-seal`; failure returns no artifact and no payload fallback.
 5. Require complete enclosing-artifact verification, integrity, Signature V4, owner, claim, verify path, and payload binding.
@@ -201,3 +201,39 @@ Resources:
 - [Authority boundaries](resources/authority-boundaries.md)
 - [Generated-file repair](resources/generated-file-repair.md)
 - [Upgrade rules](resources/upgrade-rules.md)
+
+## v111 unified admission and recovery
+
+Use `receiz.artifacts.admit(file)` to verify the complete artifact before classification. Verdicts are exactly `canonical-identity`, `bearer-recovery`, `verified-legacy-read`, `foreign-owner`, or `invalid`. Every verified result must report `canRestore`, `canSign`, `canClaimOwnership`, `canPublish`, and `canSettle` without inferring stronger authority from possession.
+
+Use `receiz.artifacts.planRecovery(admission)` for an explicit read-only plan, or `receiz.artifacts.admitAndRecover(file)` for zero-network, read-only verification and recovery planning. Both perform zero writes. The standard proof history, parent links, ownership transitions, terminal events, unknown namespaces, plan digest, and explicit permitted actions must remain intact. Explanation is not authority; the underlying sealed proof object remains authority.
+
+Commit only through `receiz.artifacts.commitRecovery(plan, capability, idempotencyKey, store)`. Raw capability authority is forbidden. MCP JSON must never carry a capability or store object; use runtime-resolved verified capability and a caller-provided local atomic store. The SDK/MCP/AI operation identity must match.
+
+- Never admit a card-only payload as a Receiz artifact.
+- Never treat an explanation as proof authority.
+- Never accept raw capability JSON as recovery authority.
+- Never hide mutation inside `admitAndRecover` or a recovery plan.
+
+Current MCP parity: `receiz_artifact_admit`, `receiz_artifact_recovery_plan`, `receiz_artifact_admit_and_recover`, and `receiz_artifact_recovery_commit`.
+
+Required completion evidence:
+
+```md
+Admission verdict:
+Permitted actions:
+Proof history digest:
+Recovery plan digest:
+Operation identity:
+Atomic commit result:
+```
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-app-builder-skill/manifest.json

@@ -1,17 +1,146 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-app-builder-skill",
-  "version": "109.0.0",
-  "requires": { "sdk": ">=109.0.0 <110.0.0", "mcp": ">=109.0.0 <110.0.0", "ruleset": "109.0.0", "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70" },
-  "artifactLawVersion": "109.0.0",
-  "artifactLaws": ["ARTIFACT-001", "ARTIFACT-002", "ARTIFACT-003", "ARTIFACT-004", "ARTIFACT-005", "ARTIFACT-006", "ARTIFACT-007", "ARTIFACT-008", "ARTIFACT-009", "ARTIFACT-010", "ARTIFACT-011"],
-  "laws": ["receiz.artifact.sealed-truth", "receiz.compiler.beneath-proof", "receiz.artifact.verify-before-extract", "ownership.cross-platform-proof-object-continuity"],
-  "sdkOperations": ["assets.createProofObject", "artifacts.download", "artifacts.verifyAndOpen"],
-  "allowedTools": ["receiz_project_inspect", "receiz_app_plan", "receiz_app_apply", "receiz_app_check", "receiz_release_qualify"],
-  "forbiddenOperations": ["direct-state-write", "payload-fallback", "payload-relabel-as-artifact", "artifact-repack", "shape-only-verification", "history-rewrite", "authority-bypass"],
-  "requiredInputs": ["repository-root", "installed-sdk-version", "active-registry-digest", "artifact-law-version", "labeled-byte-domains", "cross-app-destination"],
-  "requiredEvidence": ["typecheck", "conformance", "exact-artifact-byte-identity", "artifact-digest-match", "payload-digest-binding", "signature-v4", "owner-claim-binding", "independent-artifact-verification", "cross-platform-round-trip", "legacy-read-compatibility", "release-lock-pass", "zero-network-verification", "local-verifier-result"],
-  "requiredCompletionFields": ["sdk-version", "registry-digest", "artifact-law-version", "artifact-carrier", "signature-version", "artifact-digest", "payload-digest", "owner-and-claim-binding", "independent-verification-result", "cross-platform-round-trip-result", "legacy-compatibility-result", "release-lock-result", "network-calls-during-verification", "local-verifier-result"],
-  "completionCriteria": ["all-required-evidence-pass", "release-lock-pass", "zero-network-verification", "local-verifier-result"],
+  "version": "111.0.0",
+  "requires": {
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
+  },
+  "artifactLawVersion": "111.0.0",
+  "artifactLaws": [
+    "ARTIFACT-001",
+    "ARTIFACT-002",
+    "ARTIFACT-003",
+    "ARTIFACT-004",
+    "ARTIFACT-005",
+    "ARTIFACT-006",
+    "ARTIFACT-007",
+    "ARTIFACT-008",
+    "ARTIFACT-009",
+    "ARTIFACT-010",
+    "ARTIFACT-011",
+    "ARTIFACT-012",
+    "ARTIFACT-013",
+    "ARTIFACT-014",
+    "ARTIFACT-015",
+    "ARTIFACT-016",
+    "ARTIFACT-017",
+    "ARTIFACT-018",
+    "ARTIFACT-019",
+    "ARTIFACT-020"
+  ],
+  "laws": [
+    "receiz.artifact.sealed-truth",
+    "receiz.compiler.beneath-proof",
+    "receiz.artifact.verify-before-extract",
+    "ownership.cross-platform-proof-object-continuity"
+  ],
+  "sdkOperations": [
+    "assets.createProofObject",
+    "artifacts.download",
+    "artifacts.verifyAndOpen",
+    "artifacts.admit",
+    "artifacts.planRecovery",
+    "artifacts.admitAndRecover",
+    "artifacts.commitRecovery"
+  ],
+  "allowedTools": [
+    "receiz_project_inspect",
+    "receiz_app_plan",
+    "receiz_app_apply",
+    "receiz_app_check",
+    "receiz_release_qualify",
+    "receiz_artifact_admit",
+    "receiz_artifact_recovery_plan",
+    "receiz_artifact_admit_and_recover",
+    "receiz_artifact_recovery_commit"
+  ],
+  "forbiddenOperations": [
+    "direct-state-write",
+    "payload-fallback",
+    "payload-relabel-as-artifact",
+    "artifact-repack",
+    "shape-only-verification",
+    "history-rewrite",
+    "authority-bypass",
+    "hidden-recovery-mutation",
+    "explanation-as-authority",
+    "raw-capability-authority",
+    "card-payload-admission",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
+  ],
+  "requiredInputs": [
+    "repository-root",
+    "installed-sdk-version",
+    "active-registry-digest",
+    "artifact-law-version",
+    "labeled-byte-domains",
+    "cross-app-destination"
+  ],
+  "requiredEvidence": [
+    "typecheck",
+    "conformance",
+    "exact-artifact-byte-identity",
+    "artifact-digest-match",
+    "payload-digest-binding",
+    "signature-v4",
+    "owner-claim-binding",
+    "independent-artifact-verification",
+    "cross-platform-round-trip",
+    "legacy-read-compatibility",
+    "release-lock-pass",
+    "zero-network-verification",
+    "local-verifier-result",
+    "unified-admission-verdicts",
+    "explicit-permitted-actions",
+    "verified-proof-history",
+    "zero-network-read-only-coordinator",
+    "atomic-recovery-commit",
+    "operation-identity-parity",
+    "multi-application-convergence",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
+  ],
+  "requiredCompletionFields": [
+    "sdk-version",
+    "registry-digest",
+    "artifact-law-version",
+    "artifact-carrier",
+    "signature-version",
+    "artifact-digest",
+    "payload-digest",
+    "owner-and-claim-binding",
+    "independent-verification-result",
+    "cross-platform-round-trip-result",
+    "legacy-compatibility-result",
+    "release-lock-result",
+    "network-calls-during-verification",
+    "local-verifier-result",
+    "admission-verdict",
+    "permitted-actions",
+    "proof-history-digest",
+    "recovery-plan-digest",
+    "operation-identity",
+    "atomic-commit-result"
+  ],
+  "completionCriteria": [
+    "all-required-evidence-pass",
+    "release-lock-pass",
+    "zero-network-verification",
+    "local-verifier-result",
+    "v111-artifact-authority-conformance",
+    "no-hidden-mutation",
+    "explanation-remains-non-authoritative"
+  ],
   "maximumAutonomousAuthority": "inspect-plan-scaffold-test"
 }

package/receiz-architecture/SKILL.md

@@ -51,3 +51,12 @@ Request: Map domains, sources of truth, state machines, dependency direction, an
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-architecture/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-architecture",
-  "version": "109.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=109.0.0 <110.0.0",
-    "mcp": ">=109.0.0 <110.0.0",
-    "ruleset": "109.0.0",
-    "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.truth.stronger-first",
@@ -22,7 +22,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -38,7 +43,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-authority-security/SKILL.md

@@ -51,3 +51,12 @@ Request: Audit actors, tenants, capabilities, proof domains, confused-deputy pat
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-authority-security/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-authority-security",
-  "version": "109.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=109.0.0 <110.0.0",
-    "mcp": ">=109.0.0 <110.0.0",
-    "ruleset": "109.0.0",
-    "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.authority.capability-bound",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-bearer-ownership/SKILL.md

@@ -67,3 +67,17 @@ The active MCP path calls `client.artifacts.verifyAndOpen(completeFile)`, then `
 ## Emulator fixture
 
 Run `generic-bearer-transfer` and `previous-owner-projection-invalidation` across qualifying artifact families. Require the prior ownership reference to come from carried verified proof and the output to be a native sealed artifact.
+
+## v111 recovery authority
+
+Call `artifacts.admit` before recovery planning. A `bearer-recovery` verdict may report `canRestore` or a capability-gated `canClaimOwnership`, but it must report `canSign: false`, `canPublish: false`, and `canSettle: false`. Possession never becomes canonical identity. Commit only an SDK-issued plan through a runtime-verified capability, stable idempotency key, expected head, and atomic local store.
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-bearer-ownership/manifest.json

@@ -1,14 +1,70 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-bearer-ownership",
-  "version": "109.0.0",
-  "requires": { "sdk": ">=109.0.0 <110.0.0", "mcp": ">=109.0.0 <110.0.0", "ruleset": "109.0.0", "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70" },
-  "laws": ["receiz.ownership.enclosing-proof", "receiz.ownership.carried-continuity", "receiz.artifact.native-record-seal", "ownership.cross-platform-proof-object-continuity"],
-  "sdkOperations": ["artifacts.verifyAndOpen", "ownership.claimBearerAsset", "artifacts.download"],
-  "allowedTools": ["receiz_bearer_asset_claim_plan", "receiz_bearer_asset_claim_execute"],
-  "requiredScopes": ["receiz:record", "receiz:seal"],
-  "emulatorFixtures": ["generic-bearer-transfer", "previous-owner-projection-invalidation"],
-  "forbiddenOperations": ["direct-state-write", "payload-as-claim-input", "caller-owner-substitution", "caller-proof-head-prerequisite", "claim-key-prerequisite", "receipt-authority", "origin-platform-lock", "authority-bypass"],
-  "requiredEvidence": ["complete-artifact-verification", "native-record-seal", "emulator-conformance", "release-lock-pass"],
+  "version": "111.0.0",
+  "requires": {
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
+  },
+  "laws": [
+    "receiz.ownership.enclosing-proof",
+    "receiz.ownership.carried-continuity",
+    "receiz.artifact.native-record-seal",
+    "ownership.cross-platform-proof-object-continuity"
+  ],
+  "sdkOperations": [
+    "artifacts.verifyAndOpen",
+    "artifacts.admit",
+    "artifacts.planRecovery",
+    "artifacts.commitRecovery",
+    "ownership.claimBearerAsset",
+    "artifacts.download"
+  ],
+  "allowedTools": [
+    "receiz_bearer_asset_claim_plan",
+    "receiz_bearer_asset_claim_execute",
+    "receiz_artifact_admit",
+    "receiz_artifact_recovery_plan",
+    "receiz_artifact_recovery_commit"
+  ],
+  "requiredScopes": [
+    "receiz:record",
+    "receiz:seal"
+  ],
+  "emulatorFixtures": [
+    "generic-bearer-transfer",
+    "previous-owner-projection-invalidation"
+  ],
+  "forbiddenOperations": [
+    "direct-state-write",
+    "payload-as-claim-input",
+    "caller-owner-substitution",
+    "caller-proof-head-prerequisite",
+    "claim-key-prerequisite",
+    "receipt-authority",
+    "origin-platform-lock",
+    "bearer-authority-escalation",
+    "raw-capability-authority",
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
+  ],
+  "requiredEvidence": [
+    "complete-artifact-verification",
+    "native-record-seal",
+    "emulator-conformance",
+    "release-lock-pass",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
+  ],
   "maximumAutonomousAuthority": "inspect-plan-simulate"
 }

package/receiz-build-production-system/SKILL.md

@@ -91,3 +91,13 @@ Refuse completion when any manifest input, law, test, conformance result, indepe
 Request: Build a production Receiz domain.
 
 Return the implementation contract and plan. Execute confirmed allowed commands, then report all evidence and the exact remaining boundary.
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-build-production-system/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-build-production-system",
-  "version": "109.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=109.0.0 <110.0.0",
-    "mcp": ">=109.0.0 <110.0.0",
-    "ruleset": "109.0.0",
-    "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.truth.stronger-first",
@@ -32,7 +32,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -48,7 +53,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-causal-sync/SKILL.md

@@ -51,3 +51,12 @@ Request: Carry causal parents and Kai ordering, simulate partitions, resolve dec
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-causal-sync/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v109",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-causal-sync",
-  "version": "109.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=109.0.0 <110.0.0",
-    "mcp": ">=109.0.0 <110.0.0",
-    "ruleset": "109.0.0",
-    "registryDigest": "17f76b37c9fcd46f710239b5c1660b03cc34ec64bed30d1cc45c18d5d40eab70"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.merge.causal",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-command-builder/SKILL.md

@@ -51,3 +51,12 @@ Request: Build validate-authorize-decide-append-project-receipt pipelines with s
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.