@receiz/ai-skills 110.0.0 → 111.0.0

package/README.md

@@ -5,9 +5,9 @@ Receiz applications. Fourteen focused constitutional skills supply architecture,
 domain, law, command, authority, replay, offline, causal, artifact, migration,
 performance, observability, testing, and release contracts. The earlier nine
 domain skill names remain packaged for compatibility. Seven operation skill names first introduced in obsolete-versioned now
-describe current v110 outcomes for identity profiles, portable continuity, bearer ownership, offline transport,
+describe current v111 outcomes for identity profiles, portable continuity, bearer ownership, offline transport,
 proof media, cross-app state, and admission evidence. Their retired obsolete-versioned mechanisms are not active defaults.
-Every current manifest uses schema and version `v110` / `110.0.0`, requires SDK/MCP `>=110.0.0 <111.0.0`, and binds ruleset `110.0.0` to registry digest `824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4`.
+Every current manifest uses version `111.0.0`, requires SDK/MCP `>=111.0.0 <112.0.0`, and binds ruleset `111.0.0` to registry digest `cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a`.
 
 This package teaches AI agents how to understand, verify, build with, and operate Receiz from the existing repository surfaces.
 
@@ -27,9 +27,9 @@ Agents may acquire scoped delegated access through the official Receiz Connect/O
 
 ## How Agents Should Use This Package
 
-Start with `receiz-build-production-system` when work spans multiple constitutional domains. Its machine-readable manifest requires the exact active signed registry digest, command-only mutation, independent verification, MCP conformance, and a passing release lock. Use a focused operation skill for SDK/MCP implementation and a constitutional skill for broader system law. Stable obsolete-versioned wire schemas remain available only through the explicit historical `@receiz/sdk/obsolete-versioned` package entry; current skills never teach their key, head, receipt, reconcile, or signed-command mechanics as a v110 outcome.
+Start with `receiz-build-production-system` when work spans multiple constitutional domains. Its machine-readable manifest requires the exact active signed registry digest, command-only mutation, independent verification, MCP conformance, and a passing release lock. Use a focused operation skill for SDK/MCP implementation and a constitutional skill for broader system law. Stable obsolete-versioned wire schemas remain available only through the explicit historical `@receiz/sdk/obsolete-versioned` package entry; current skills never teach their key, head, receipt, reconcile, or signed-command mechanics as a v111 outcome.
 
-The v110 operation skills are executable contracts. Current profile work uses the neutral authenticated same-UID profile operation. Current bearer ownership accepts a complete verified artifact, derives prior ownership from carried proof, and returns a native Record -> Seal artifact. Proof media uses the same native artifact custody and projects only a verified URL beneath it. These outcomes have no active identity-key, caller-head, claim-key, or receipt prerequisite. MCP calls the same SDK outcomes and never creates a parallel authority.
+The v111 operation skills are executable contracts. Current profile work uses the neutral authenticated same-UID profile operation. Current bearer ownership accepts a complete verified artifact, derives prior ownership from carried proof, and returns a native Record -> Seal artifact. Proof media uses the same native artifact custody and projects only a verified URL beneath it. These outcomes have no active identity-key, caller-head, claim-key, or receipt prerequisite. MCP calls the same SDK outcomes and never creates a parallel authority.
 
 Stable obsolete-versioned schema names and their head/receipt mechanics remain explicitly historical compatibility, not the active/default profile, bearer, or proof-media contract.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@receiz/ai-skills",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "description": "Authoritative Receiz AI operating skills for proof-native SDK and MCP agents.",
   "type": "module",
   "files": [

package/receiz-app-builder-skill/SKILL.md

@@ -8,7 +8,7 @@ description: Use when starting, integrating, upgrading, diagnosing, or repairing
 Build and upgrade Receiz applications from one typed contract. The compiler is
 integration tooling beneath Receiz proof truth; inspection is not verification.
 
-## Binding v110 artifact law
+## Binding v111 artifact law
 
 A Receiz artifact is the exact byte sequence returned by native Record -> Seal. The inner payload is never an acceptable substitute.
 
@@ -39,7 +39,7 @@ Independently hash the saved bytes and require equality with `sealedArtifact.art
 ## Twelve-step artifact workflow
 
 1. Label the input bytes as `payload`; never call them an artifact.
-2. Load the active signed v110 registry and `ARTIFACT-001` through `ARTIFACT-010`.
+2. Load the active signed v111 registry and `ARTIFACT-001` through `ARTIFACT-010`.
 3. Call `receiz.assets.createProofObject` so Receiz.com performs native Record -> Seal.
 4. Require an SDK-issued `receiz.native-record-seal`; failure returns no artifact and no payload fallback.
 5. Require complete enclosing-artifact verification, integrity, Signature V4, owner, claim, verify path, and payload binding.
@@ -202,7 +202,7 @@ Resources:
 - [Generated-file repair](resources/generated-file-repair.md)
 - [Upgrade rules](resources/upgrade-rules.md)
 
-## v110 unified admission and recovery
+## v111 unified admission and recovery
 
 Use `receiz.artifacts.admit(file)` to verify the complete artifact before classification. Verdicts are exactly `canonical-identity`, `bearer-recovery`, `verified-legacy-read`, `foreign-owner`, or `invalid`. Every verified result must report `canRestore`, `canSign`, `canClaimOwnership`, `canPublish`, and `canSettle` without inferring stronger authority from possession.
 
@@ -227,3 +227,13 @@ Recovery plan digest:
 Operation identity:
 Atomic commit result:
 ```
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-app-builder-skill/manifest.json

@@ -1,14 +1,14 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-app-builder-skill",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
-  "artifactLawVersion": "110.0.0",
+  "artifactLawVersion": "111.0.0",
   "artifactLaws": [
     "ARTIFACT-001",
     "ARTIFACT-002",
@@ -24,7 +24,12 @@
     "ARTIFACT-012",
     "ARTIFACT-013",
     "ARTIFACT-014",
-    "ARTIFACT-015"
+    "ARTIFACT-015",
+    "ARTIFACT-016",
+    "ARTIFACT-017",
+    "ARTIFACT-018",
+    "ARTIFACT-019",
+    "ARTIFACT-020"
   ],
   "laws": [
     "receiz.artifact.sealed-truth",
@@ -63,7 +68,12 @@
     "hidden-recovery-mutation",
     "explanation-as-authority",
     "raw-capability-authority",
-    "card-payload-admission"
+    "card-payload-admission",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -93,7 +103,13 @@
     "zero-network-read-only-coordinator",
     "atomic-recovery-commit",
     "operation-identity-parity",
-    "multi-application-convergence"
+    "multi-application-convergence",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "requiredCompletionFields": [
     "sdk-version",
@@ -122,7 +138,7 @@
     "release-lock-pass",
     "zero-network-verification",
     "local-verifier-result",
-    "v110-admission-recovery-conformance",
+    "v111-artifact-authority-conformance",
     "no-hidden-mutation",
     "explanation-remains-non-authoritative"
   ],

package/receiz-architecture/SKILL.md

@@ -51,3 +51,12 @@ Request: Map domains, sources of truth, state machines, dependency direction, an
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-architecture/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-architecture",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.truth.stronger-first",
@@ -22,7 +22,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -38,7 +43,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-authority-security/SKILL.md

@@ -51,3 +51,12 @@ Request: Audit actors, tenants, capabilities, proof domains, confused-deputy pat
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-authority-security/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-authority-security",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.authority.capability-bound",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-bearer-ownership/SKILL.md

@@ -68,6 +68,16 @@ The active MCP path calls `client.artifacts.verifyAndOpen(completeFile)`, then `
 
 Run `generic-bearer-transfer` and `previous-owner-projection-invalidation` across qualifying artifact families. Require the prior ownership reference to come from carried verified proof and the output to be a native sealed artifact.
 
-## v110 recovery authority
+## v111 recovery authority
 
 Call `artifacts.admit` before recovery planning. A `bearer-recovery` verdict may report `canRestore` or a capability-gated `canClaimOwnership`, but it must report `canSign: false`, `canPublish: false`, and `canSettle: false`. Possession never becomes canonical identity. Commit only an SDK-issued plan through a runtime-verified capability, stable idempotency key, expected head, and atomic local store.
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-bearer-ownership/manifest.json

@@ -1,14 +1,70 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-bearer-ownership",
-  "version": "110.0.0",
-  "requires": { "sdk": ">=110.0.0 <111.0.0", "mcp": ">=110.0.0 <111.0.0", "ruleset": "110.0.0", "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4" },
-  "laws": ["receiz.ownership.enclosing-proof", "receiz.ownership.carried-continuity", "receiz.artifact.native-record-seal", "ownership.cross-platform-proof-object-continuity"],
-  "sdkOperations": ["artifacts.verifyAndOpen", "artifacts.admit", "artifacts.planRecovery", "artifacts.commitRecovery", "ownership.claimBearerAsset", "artifacts.download"],
-  "allowedTools": ["receiz_bearer_asset_claim_plan", "receiz_bearer_asset_claim_execute", "receiz_artifact_admit", "receiz_artifact_recovery_plan", "receiz_artifact_recovery_commit"],
-  "requiredScopes": ["receiz:record", "receiz:seal"],
-  "emulatorFixtures": ["generic-bearer-transfer", "previous-owner-projection-invalidation"],
-  "forbiddenOperations": ["direct-state-write", "payload-as-claim-input", "caller-owner-substitution", "caller-proof-head-prerequisite", "claim-key-prerequisite", "receipt-authority", "origin-platform-lock", "bearer-authority-escalation", "raw-capability-authority", "authority-bypass"],
-  "requiredEvidence": ["complete-artifact-verification", "native-record-seal", "emulator-conformance", "release-lock-pass"],
+  "version": "111.0.0",
+  "requires": {
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
+  },
+  "laws": [
+    "receiz.ownership.enclosing-proof",
+    "receiz.ownership.carried-continuity",
+    "receiz.artifact.native-record-seal",
+    "ownership.cross-platform-proof-object-continuity"
+  ],
+  "sdkOperations": [
+    "artifacts.verifyAndOpen",
+    "artifacts.admit",
+    "artifacts.planRecovery",
+    "artifacts.commitRecovery",
+    "ownership.claimBearerAsset",
+    "artifacts.download"
+  ],
+  "allowedTools": [
+    "receiz_bearer_asset_claim_plan",
+    "receiz_bearer_asset_claim_execute",
+    "receiz_artifact_admit",
+    "receiz_artifact_recovery_plan",
+    "receiz_artifact_recovery_commit"
+  ],
+  "requiredScopes": [
+    "receiz:record",
+    "receiz:seal"
+  ],
+  "emulatorFixtures": [
+    "generic-bearer-transfer",
+    "previous-owner-projection-invalidation"
+  ],
+  "forbiddenOperations": [
+    "direct-state-write",
+    "payload-as-claim-input",
+    "caller-owner-substitution",
+    "caller-proof-head-prerequisite",
+    "claim-key-prerequisite",
+    "receipt-authority",
+    "origin-platform-lock",
+    "bearer-authority-escalation",
+    "raw-capability-authority",
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
+  ],
+  "requiredEvidence": [
+    "complete-artifact-verification",
+    "native-record-seal",
+    "emulator-conformance",
+    "release-lock-pass",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
+  ],
   "maximumAutonomousAuthority": "inspect-plan-simulate"
 }

package/receiz-build-production-system/SKILL.md

@@ -91,3 +91,13 @@ Refuse completion when any manifest input, law, test, conformance result, indepe
 Request: Build a production Receiz domain.
 
 Return the implementation contract and plan. Execute confirmed allowed commands, then report all evidence and the exact remaining boundary.
+
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-build-production-system/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-build-production-system",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.truth.stronger-first",
@@ -32,7 +32,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -48,7 +53,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-causal-sync/SKILL.md

@@ -51,3 +51,12 @@ Request: Carry causal parents and Kai ordering, simulate partitions, resolve dec
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-causal-sync/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-causal-sync",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.merge.causal",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-command-builder/SKILL.md

@@ -51,3 +51,12 @@ Request: Build validate-authorize-decide-append-project-receipt pipelines with s
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-command-builder/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-command-builder",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.command-only-mutation",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",

package/receiz-constitutional-laws/SKILL.md

@@ -51,3 +51,12 @@ Request: Define deterministic predicates, stable denial codes, safe alternatives
 
 Return a written implementation contract and read-only plan first. Execute only allowed commands after exact confirmation, then report registry digest, laws, authority, tests, independent evidence, release-lock status, and the exact remaining boundary.
 
+## v111 artifact-derived authority
+
+Engineers remain free to build whatever they choose, but conforming Receiz receivers recognize authority only when every authority-bearing value is provably derived from independently verified artifact truth. Custom JavaScript objects, callbacks, normalized histories, local receipts, server rows, sessions, MCP memory, and AI explanations remain application data or inspection material; their shape never creates Receiz authority.
+
+Admission must retain and canonically reverify the exact enclosing artifact bytes under the complete frozen verifier context. Recovery-authoritative history requires explicit independently verified evidence roots and fails closed on divergent verified heads. Canonical identity and `canSign` require enclosing-owner binding, identity-owner binding, key identity, and a domain-separated private-key challenge. Recovery planning re-derives state from verified admission and verified history.
+
+Deterministic plan identity and unique execution-attempt identity are separate. MCP may reuse a confirmation digest only while the identical attempt is actively pending; committed and failed attempts are terminal and require a fresh confirmation. Expected authority failures are structured, immutable, machine-readable, and report zero writes.
+
+Historical sealed proof objects remain exact-byte verifiable evidence. Historical runtime admissions, histories, capabilities, plans, or confirmations cannot authorize a current v111 receiver; re-admit the historical artifact's exact bytes under the current verifier.

package/receiz-constitutional-laws/manifest.json

@@ -1,12 +1,12 @@
 {
-  "schema": "receiz.ai-skill-contract.v110",
+  "schema": "receiz.ai-skill-contract.v111",
   "name": "receiz-constitutional-laws",
-  "version": "110.0.0",
+  "version": "111.0.0",
   "requires": {
-    "sdk": ">=110.0.0 <111.0.0",
-    "mcp": ">=110.0.0 <111.0.0",
-    "ruleset": "110.0.0",
-    "registryDigest": "824aa4af849c4840ba94535798eab36e45d514703b6ae0cd30d4aa53f3c896e4"
+    "sdk": ">=111.0.0 <112.0.0",
+    "mcp": ">=111.0.0 <112.0.0",
+    "ruleset": "111.0.0",
+    "registryDigest": "cf02d0bce6ad1541cfe84e27bfb1036777b29616bf8a1e5aeafb899a945e359a"
   },
   "laws": [
     "receiz.registry.digest-alignment",
@@ -23,7 +23,12 @@
   "forbiddenOperations": [
     "direct-state-write",
     "history-rewrite",
-    "authority-bypass"
+    "authority-bypass",
+    "structural-object-as-authority",
+    "caller-verifier-as-history-authority",
+    "parseable-key-as-signing-authority",
+    "terminal-mcp-confirmation-reuse",
+    "historical-runtime-object-as-current-authority"
   ],
   "requiredInputs": [
     "repository-root",
@@ -39,7 +44,13 @@
     "replay-equivalence",
     "compatibility",
     "mcp-conformance",
-    "independent-verifier"
+    "independent-verifier",
+    "canonical-exact-byte-readmission",
+    "complete-verifier-context-digest",
+    "independent-proof-history-evidence-roots",
+    "domain-separated-signing-challenge",
+    "distinct-plan-and-attempt-identities",
+    "structured-zero-write-failures"
   ],
   "completionCriteria": [
     "written-implementation-contract",