hachure 0.3.0 → 0.5.0

package/README.md

@@ -73,8 +73,16 @@ Resource Shape envelope. Product-specific records use product-scoped namespaces
 Pre-1.0: the format uses hard breaking changes rather than compatibility aliases.
 No forward or backward compatibility guarantees are made across versions. Version
 bumps are reflected in `schemaVersion` (an integer field in TrustBundle, currently
-`3`) and in the status function version (a string exported by the reference
-implementation as `statusFunctionVersion`, currently `"1"`).
+`4`) and in the status function version (a string exported by the reference
+implementation as `statusFunctionVersion`, currently `"2"`).
+
+Schema version `4` adds optional claim freshness fields (`expiresAt` /
+`ttlSeconds`) and an optional invalidation event vocabulary (event `status:
+"revoked"` and event `type: "invalidation"`). All additions are optional, so
+every bundle valid at `schemaVersion` `3` remains valid; only the deriver
+(`statusFunctionVersion` `2`) folds the new fields into a status. See
+`status-function.md` and the `sf-expired-window` / `sf-revoked-event` /
+`sf-no-freshness-fields` conformance vectors.
 
 ---
 

package/assurance.md

@@ -170,10 +170,48 @@ the authenticated identity, and that certificate signs the record.  The entire
 flow completes in the same session as the authorizing act; signing a record
 retroactively from a different session is not a conforming ceremony.
 
+**Recommended mechanism for highest-assurance human ceremonies:** WebAuthn /
+passkey with user-verification (UV=1).  A device-local authenticator satisfies
+three independent assurance legs simultaneously:
+
+- **Presence** — the passkey gesture (biometric or PIN) proves the enrolled
+  device is physically present; biometric data never leaves the device.
+- **Identity** — the hardware-backed assertion composes with the OIDC
+  certificate: the certificate binds the ephemeral key to the OIDC subject;
+  the passkey attests the device-local identity enrolled at registration time.
+- **Engagement** (non-normative) — oversight metrics such as session duration
+  or interaction events can accompany the record as non-normative evidence;
+  they are not part of the conformance criteria.
+
+Because the three legs are independent, losing one (e.g., no biometric sensor
+on the device) does not forfeit the others.  An OIDC-only ceremony without a
+passkey assertion is still a conforming L1 ceremony; the passkey upgrade is
+RECOMMENDED where the platform supports it.
+
 Design intent: friction lands only where authority is exercised.  Routine
 read-only operations, status queries, and bundle consumption carry no signing
 requirement.  The ceremony surfaces once, at the moment of consequence.
 
+## Collection channels and media evidence
+
+Any collection channel defined in the reference implementation (see ADR 0004 in
+the reference implementation) MAY attach media evidence — for example,
+capture-provenance imagery conforming to C2PA — as ordinary evidence entries
+with integrity anchors.  Three rules govern such attachments:
+
+1. **Channels do not replace admissible testimony kinds.**  A photo or video of
+   a signing gesture is attached evidence, not a substitute for an `exchange` or
+   `authorized-action` block.  The admissible testimony kinds in ADR 0004 remain
+   the authoritative record; media is corroborating context.
+2. **Capture provenance determines evidence grade.**  Media accompanied by a
+   valid C2PA manifest (or equivalent capture-provenance credential) is treated
+   as integrity-anchored evidence at the level its anchor supports.  Media
+   without capture provenance is ordinary L0 evidence: present, but carrying no
+   additional assurance weight beyond the transport channel.
+3. **Integrity anchors are required for non-L0 media claims.**  If a consumer
+   policy requires L1 or higher evidence grade for media, the media item MUST
+   carry an `IntegrityAnchor` referencing the capture-provenance credential.
+
 ---
 
 ## Non-goals

package/conformance/README.md

@@ -17,6 +17,9 @@ implementation derives the expected statuses.
 | `sf-disputed-blocking.json` | Verified event + blocking contradicting evidence → disputed | 2026-06-10T00:00:00.000Z |
 | `sf-authority-resolved.json` | Disputed claim resolved by authority-gated event | 2026-06-10T00:00:00.000Z |
 | `sf-reference-bundle-snapshot.json` | Full the reference bundle at fixed now — four claims | 2026-06-10T00:00:00.000Z |
+| `sf-expired-window.json` | Claim-intrinsic validity window — stale past `expiresAt` and past `ttlSeconds` (schema 4) | 2026-06-10T00:00:00.000Z |
+| `sf-revoked-event.json` | Explicit invalidation event (`status: revoked`, `type: invalidation`) → stale (schema 4) | 2026-06-10T00:00:00.000Z |
+| `sf-no-freshness-fields.json` | No freshness fields present → derives unchanged from `statusFunctionVersion` `1` | 2026-06-10T00:00:00.000Z |
 
 ## Test vector format
 

package/conformance/sf-expired-window.json

@@ -0,0 +1,102 @@
+{
+  "now": "2026-06-10T00:00:00.000Z",
+  "input": {
+    "schemaVersion": 4,
+    "source": "spec-conformance:expired-window",
+    "claims": [
+      {
+        "id": "claim.window.expires-at",
+        "subjectType": "data-field",
+        "subjectId": "dataset:session-token",
+        "surface": "public-data.status",
+        "claimType": "public-data-field",
+        "fieldOrBehavior": "tokenValid",
+        "value": true,
+        "createdAt": "2026-05-01T00:00:00.000Z",
+        "updatedAt": "2026-05-01T00:00:00.000Z",
+        "expiresAt": "2026-06-01T00:00:00.000Z",
+        "impactLevel": "high",
+        "verificationPolicyId": "policy.public-data-field.manual"
+      },
+      {
+        "id": "claim.window.ttl",
+        "subjectType": "data-field",
+        "subjectId": "dataset:cache-entry",
+        "surface": "public-data.status",
+        "claimType": "public-data-field",
+        "fieldOrBehavior": "cacheFresh",
+        "value": true,
+        "createdAt": "2026-06-09T00:00:00.000Z",
+        "updatedAt": "2026-06-09T00:00:00.000Z",
+        "ttlSeconds": 3600,
+        "impactLevel": "medium",
+        "verificationPolicyId": "policy.public-data-field.manual"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "evidence.window.expires-at",
+        "claimId": "claim.window.expires-at",
+        "evidenceType": "human_attestation",
+        "method": "attestation",
+        "sourceRef": "operator review",
+        "excerptOrSummary": "Token issued and attested valid until 2026-06-01.",
+        "observedAt": "2026-05-01T00:00:00.000Z",
+        "collectedBy": "operator"
+      },
+      {
+        "id": "evidence.window.ttl",
+        "claimId": "claim.window.ttl",
+        "evidenceType": "human_attestation",
+        "method": "attestation",
+        "sourceRef": "operator review",
+        "excerptOrSummary": "Cache entry attested fresh at refresh time.",
+        "observedAt": "2026-06-09T00:00:00.000Z",
+        "collectedBy": "operator"
+      }
+    ],
+    "policies": [
+      {
+        "id": "policy.public-data-field.manual",
+        "claimType": "public-data-field",
+        "requiredEvidence": ["human_attestation"],
+        "requiredMethods": ["attestation"],
+        "requiresCorroboration": false,
+        "acceptanceCriteria": ["operator attestation"],
+        "reviewAuthority": "operator",
+        "validityRule": { "kind": "manual" },
+        "stalenessTriggers": ["validity window expires"],
+        "conflictRules": [],
+        "impactLevel": "high"
+      }
+    ],
+    "events": [
+      {
+        "id": "event.window.expires-at.verified",
+        "claimId": "claim.window.expires-at",
+        "status": "verified",
+        "actor": "operator",
+        "method": "attestation",
+        "evidenceIds": ["evidence.window.expires-at"],
+        "createdAt": "2026-05-01T00:00:00.000Z",
+        "verifiedAt": "2026-05-01T00:00:00.000Z"
+      },
+      {
+        "id": "event.window.ttl.verified",
+        "claimId": "claim.window.ttl",
+        "status": "verified",
+        "actor": "operator",
+        "method": "attestation",
+        "evidenceIds": ["evidence.window.ttl"],
+        "createdAt": "2026-06-09T00:00:00.000Z",
+        "verifiedAt": "2026-06-09T00:00:00.000Z"
+      }
+    ]
+  },
+  "expect": {
+    "statusByClaimId": {
+      "claim.window.expires-at": "stale",
+      "claim.window.ttl": "stale"
+    }
+  }
+}

package/conformance/sf-no-freshness-fields.json

@@ -0,0 +1,68 @@
+{
+  "now": "2026-06-10T00:00:00.000Z",
+  "input": {
+    "schemaVersion": 4,
+    "source": "spec-conformance:no-freshness-fields",
+    "claims": [
+      {
+        "id": "claim.api.rate-limit",
+        "subjectType": "api",
+        "subjectId": "public-api",
+        "surface": "api.guarantees",
+        "claimType": "software-evidence",
+        "fieldOrBehavior": "rate limit is enforced",
+        "value": "100 requests/minute",
+        "createdAt": "2026-04-25T00:00:00.000Z",
+        "updatedAt": "2026-04-25T00:05:00.000Z",
+        "impactLevel": "high",
+        "currentIntegrityRef": "commit:abc123",
+        "verificationPolicyId": "policy.software-evidence.commit"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "evidence.api.rate-limit.test",
+        "claimId": "claim.api.rate-limit",
+        "evidenceType": "test_output",
+        "method": "validation",
+        "sourceRef": "ci:1847",
+        "excerptOrSummary": "Rate-limit tests passed.",
+        "observedAt": "2026-04-25T00:05:00.000Z",
+        "collectedBy": "ci",
+        "integrityRef": "commit:abc123"
+      }
+    ],
+    "policies": [
+      {
+        "id": "policy.software-evidence.commit",
+        "claimType": "software-evidence",
+        "requiredEvidence": ["test_output"],
+        "requiredMethods": ["validation"],
+        "requiresCorroboration": false,
+        "acceptanceCriteria": ["evidence check passes for the affected commit"],
+        "reviewAuthority": "repo policy",
+        "validityRule": { "kind": "commit" },
+        "stalenessTriggers": ["new commit touches the same surface"],
+        "conflictRules": [],
+        "impactLevel": "high"
+      }
+    ],
+    "events": [
+      {
+        "id": "event.api.rate-limit.verified",
+        "claimId": "claim.api.rate-limit",
+        "status": "verified",
+        "actor": "ci",
+        "method": "npm test",
+        "evidenceIds": ["evidence.api.rate-limit.test"],
+        "createdAt": "2026-04-25T00:05:00.000Z",
+        "verifiedAt": "2026-04-25T00:05:00.000Z"
+      }
+    ]
+  },
+  "expect": {
+    "statusByClaimId": {
+      "claim.api.rate-limit": "verified"
+    }
+  }
+}

package/conformance/sf-revoked-event.json

@@ -0,0 +1,76 @@
+{
+  "now": "2026-06-10T00:00:00.000Z",
+  "input": {
+    "schemaVersion": 4,
+    "source": "spec-conformance:revoked-event",
+    "claims": [
+      {
+        "id": "claim.access.grant",
+        "subjectType": "credential",
+        "subjectId": "access:deploy-key-7",
+        "surface": "access-control.grants",
+        "claimType": "software-evidence",
+        "fieldOrBehavior": "deployKeyValid",
+        "value": true,
+        "createdAt": "2026-05-01T00:00:00.000Z",
+        "updatedAt": "2026-06-05T00:00:00.000Z",
+        "impactLevel": "critical",
+        "verificationPolicyId": "policy.software-evidence.commit"
+      }
+    ],
+    "evidence": [
+      {
+        "id": "evidence.access.grant",
+        "claimId": "claim.access.grant",
+        "evidenceType": "test_output",
+        "method": "validation",
+        "sourceRef": "grant issuance log",
+        "excerptOrSummary": "Deploy key issued and validated.",
+        "observedAt": "2026-05-01T00:00:00.000Z",
+        "collectedBy": "access-service"
+      }
+    ],
+    "policies": [
+      {
+        "id": "policy.software-evidence.commit",
+        "claimType": "software-evidence",
+        "requiredEvidence": ["test_output"],
+        "requiredMethods": ["validation"],
+        "requiresCorroboration": false,
+        "acceptanceCriteria": ["evidence check passes"],
+        "reviewAuthority": "repo policy",
+        "validityRule": { "kind": "commit" },
+        "stalenessTriggers": ["revocation"],
+        "conflictRules": [],
+        "impactLevel": "critical"
+      }
+    ],
+    "events": [
+      {
+        "id": "event.access.grant.verified",
+        "claimId": "claim.access.grant",
+        "status": "verified",
+        "actor": "access-service",
+        "method": "validation",
+        "evidenceIds": ["evidence.access.grant"],
+        "createdAt": "2026-05-01T00:00:00.000Z",
+        "verifiedAt": "2026-05-01T00:00:00.000Z"
+      },
+      {
+        "id": "event.access.grant.revoked",
+        "claimId": "claim.access.grant",
+        "status": "revoked",
+        "type": "invalidation",
+        "actor": "security-officer",
+        "method": "manual-revocation",
+        "evidenceIds": [],
+        "createdAt": "2026-06-05T00:00:00.000Z"
+      }
+    ]
+  },
+  "expect": {
+    "statusByClaimId": {
+      "claim.access.grant": "stale"
+    }
+  }
+}

package/index.mjs

@@ -24,7 +24,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 // Any implementation claiming conformance at this version must produce the
 // same status outputs as the test vectors for all cases in conformance/.
 // ---------------------------------------------------------------------------
-export const statusFunctionVersion = '1';
+export const statusFunctionVersion = '2';
 
 // ---------------------------------------------------------------------------
 // Schemas — Map of record name (filename without .schema.json) → parsed JSON.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hachure",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "Hachure \u2014 canonical distribution of the open trust format: normative JSON schemas, conformance test vectors, and spec constants.",
   "type": "module",
   "main": "./index.mjs",

package/schemas/claim.schema.json

@@ -12,9 +12,19 @@
     "claimType": { "type": "string" },
     "fieldOrBehavior": { "type": "string" },
     "value": {},
-    "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected"] },
+    "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected", "revoked"] },
     "createdAt": { "type": "string", "format": "date-time" },
     "updatedAt": { "type": "string", "format": "date-time" },
+    "expiresAt": {
+      "description": "Optional absolute validity window: ISO-8601 instant after which the claim is no longer fresh. Canonical when both expiresAt and ttlSeconds are present (expiresAt wins). Behaviour is derived by Surface, not by this schema.",
+      "type": "string",
+      "format": "date-time"
+    },
+    "ttlSeconds": {
+      "description": "Optional relative validity window in seconds, resolved by the deriver against the governing verification event's verifiedAt (falling back to createdAt). If expiresAt is also present, expiresAt takes precedence. Behaviour is derived by Surface, not by this schema.",
+      "type": "integer",
+      "minimum": 0
+    },
     "impactLevel": { "enum": ["low", "medium", "high", "critical"] },
     "materiality": { "enum": ["low", "medium", "high"] },
     "currentIntegrityRef": { "type": "string" },

package/schemas/evidence.schema.json

@@ -24,9 +24,34 @@
     "collectedBy": { "type": "string" },
     "integrityRef": { "type": "string" },
     "integrityAnchor": { "$ref": "#/$defs/integrityAnchor" },
+    "passing": {
+      "type": "boolean",
+      "description": "Whether the check that produced this evidence passed. Omitted when the evidence is not the output of a pass/fail check."
+    },
+    "blocking": {
+      "type": "boolean",
+      "description": "Whether a non-passing result should block (e.g. trigger disputed status under a policy conflict rule)."
+    },
+    "execution": {
+      "$ref": "#/$defs/execution",
+      "description": "How the evidence was produced: the command or tool invocation, exit code, and duration — making artifacts self-describing without requiring the producer's adapter config."
+    },
     "metadata": { "type": "object" }
   },
   "$defs": {
+    "execution": {
+      "type": "object",
+      "required": ["runner", "label"],
+      "properties": {
+        "runner": { "enum": ["bash", "mcp"] },
+        "label": { "type": "string" },
+        "exitCode": { "type": "integer" },
+        "isError": { "type": "boolean" },
+        "durationMs": { "type": "number" },
+        "metadata": { "type": "object" }
+      },
+      "additionalProperties": false
+    },
     "integrityAnchor": {
       "type": "object",
       "required": ["id", "kind", "algorithm", "value", "sourceRef"],

package/schemas/inquiry-record.schema.json

@@ -26,7 +26,7 @@
       "additionalProperties": false,
       "properties": {
         "value": {},
-        "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected"] }
+        "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected", "revoked"] }
       }
     },
     "inputSnapshot": {
@@ -37,7 +37,7 @@
         "additionalProperties": false,
         "properties": {
           "claimId": { "type": "string" },
-          "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected"] }
+          "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected", "revoked"] }
         }
       }
     },

package/schemas/trust-bundle.schema.json

@@ -6,7 +6,7 @@
   "additionalProperties": false,
   "required": ["schemaVersion", "source", "claims", "evidence", "policies", "events"],
   "properties": {
-    "schemaVersion": { "enum": [2, 3] },
+    "schemaVersion": { "enum": [2, 3, 4] },
     "source": { "type": "string" },
     "claims": {
       "type": "array",

package/schemas/verification-event.schema.json

@@ -7,7 +7,11 @@
   "properties": {
     "id": { "type": "string" },
     "claimId": { "type": "string" },
-    "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected"] },
+    "status": { "enum": ["unknown", "proposed", "assumed", "verified", "stale", "disputed", "superseded", "rejected", "revoked"] },
+    "type": {
+      "description": "Optional event classifier. 'invalidation' marks a ledger line that explicitly revokes/stales a previously-good claim (use with status 'revoked' or 'stale'). 'verification' is the default assertion of a status. Surface treats an invalidation event as terminal for the claim.",
+      "enum": ["verification", "invalidation"]
+    },
     "actor": { "type": "string" },
     "method": { "type": "string" },
     "evidenceIds": { "type": "array", "items": { "type": "string" } },

package/status-function.md

@@ -1,7 +1,7 @@
 # Status Derivation — Specification
 
 **Function:** `status = f(claim, evidence, events, policy, authorityTrace, now)`
-**Version constant:** `statusFunctionVersion` (currently `"1"`)
+**Version constant:** `statusFunctionVersion` (currently `"2"`)
 **Source of truth:** `src/status.ts` in `@kontourai/surface`
 
 ---
@@ -110,8 +110,17 @@ Filter all events to those matching `claim.id`, sort most-recent-first by `creat
 Let `latestEvent` be the first (most recent) event.
 
 If `latestEvent` exists and its `status` is one of `"rejected"`, `"disputed"`,
-`"superseded"`, or `"stale"` — return that status. These are terminal: they are
-not overridden by evidence inspection.
+`"superseded"`, `"stale"`, or `"revoked"` — return that status. These are
+terminal: they are not overridden by evidence inspection. An event with
+`type: "invalidation"` is always terminal in this step regardless of its
+`status` (it asserts the claim is no longer good); `"revoked"` derives `stale`
+(treated as an explicit, event-driven staleness) unless a later verification
+event re-asserts the claim.
+
+> **Schema-version note (`statusFunctionVersion` `"2"`, `schemaVersion` `4`):**
+> the `"revoked"` event status and `type: "invalidation"` classifier are new.
+> Bundles that never use them derive identically to `statusFunctionVersion`
+> `"1"`.
 
 ### Step 3: Assumed from event
 
@@ -123,7 +132,21 @@ If `latestEvent` exists and `latestEvent.status === "verified"`:
 
 #### 4a. Staleness check
 
-If a policy is present, check whether the verification is stale based on
+**Claim-intrinsic validity window (`statusFunctionVersion` `"2"`, schema `4`).**
+Before consulting the policy validity rule, check the claim's own validity
+window, which overrides policy timing when present:
+
+- If `claim.expiresAt` is set, the claim is stale when `now > Date.parse(claim.expiresAt)`.
+- Else if `claim.ttlSeconds` is set, compute
+  `expiry = Date.parse(latestEvent.verifiedAt ?? latestEvent.createdAt) + claim.ttlSeconds * 1000`;
+  the claim is stale when `now > expiry`.
+- **Precedence:** `expiresAt` wins over `ttlSeconds` when both are present.
+  When neither is present, fall through to the policy validity rule below
+  (identical to `statusFunctionVersion` `"1"`).
+
+If the claim-intrinsic window marks the claim stale: return **`stale`**.
+
+Otherwise, if a policy is present, check whether the verification is stale based on
 `policy.validityRule.kind`:
 
 - **`"commit"`** — stale if `claim.currentIntegrityRef` is set AND none of the

package/verification-endpoint.md

@@ -30,7 +30,7 @@ Producers supporting this profile expose a verification endpoint at a well-known
 path on the same host that issued the bundle:
 
 ```
-GET https://<producer-host>/.well-known/hachure/verify?ref=<integrityRef>[&ref=...]
+GET https://<producer-host>/.well-known/hachure/verify?ref=<ref>[&ref=...]
 ```
 
 Multiple refs may be passed as repeated `ref` query parameters. For large sets,
@@ -40,17 +40,39 @@ a POST variant is also allowed:
 POST https://<producer-host>/.well-known/hachure/verify
 Content-Type: application/json
 
-{ "refs": ["<integrityRef>", ...] }
+{ "refs": ["<ref>", ...] }
 ```
 
-`integrityRef` is the integrity anchor value carried on a claim or bundle
-(`claim.integrityRef` or a bundle-level `integrityAnchor.value`).
-
 Producers MAY require authentication before serving a response. The response
 semantics defined in this profile are unchanged by the presence or absence of
 authentication; the receiver simply may not be able to reach the endpoint
 without valid credentials.
 
+### Ref resolution semantics
+
+A `ref` value in the request MAY be any of the following:
+
+- **(a) A claim `id`** — the stable identifier on a claim object (`claim.id`).
+- **(b) A claim's current integrity ref** — the `currentIntegrityRef` string field
+  on a claim (`claim.currentIntegrityRef`, per `schemas/claim.schema.json`).
+  Note: the analogous full anchor object is `claim.currentIntegrityAnchor`; when
+  resolving by integrity value, match against `currentIntegrityRef` or
+  `currentIntegrityAnchor.value`.
+- **(c) A bundle-level integrity anchor value** — the `.value` field of an
+  `integrityAnchor` object carried on an `authorityTrace` or `evidence` record
+  within a bundle (`schemas/trust-bundle.schema.json` `$defs/integrityAnchor`
+  → `value`).
+
+Producers MUST support lookup by (a) and (b). Producers MAY support lookup by (c).
+Receivers SHOULD prefer (a) for stability; (b) and (c) are useful when only an
+integrity value is available from a prior bundle snapshot.
+
+**Multi-match:** a single ref value MAY match more than one claim (for example,
+two claims that share the same `currentIntegrityRef`). When a ref matches multiple
+claims, the response includes ALL matching claims. A ref is reported as unknown
+(in `unknownRefs`) only when it matches nothing — zero claims, evidence records,
+or authority traces.
+
 ---
 
 ## Response shape
@@ -60,8 +82,9 @@ scoped to the records matching the requested refs, plus a `metadata` extension
 block. The bundle carries:
 
 - **`source`** — the producer identifier, matching `source` in the original bundle.
-- **`claims`** — all claims whose `integrityRef` was among the requested refs.
-  Each claim is returned in its current form as the producer knows it.
+- **`claims`** — all claims that matched the requested refs (by id, currentIntegrityRef,
+  or anchor value as described above). When a ref matched multiple claims, all are
+  included. Each claim is returned in its current form as the producer knows it.
 - **`evidence`** and **`events`** — the delta since issuance where the producer
   can supply it: new evidence items, new verification events, revocation events,
   dispute events. Producers that do not track a delta MAY return the full current
@@ -69,20 +92,35 @@ block. The bundle carries:
   means it was never present in the original bundle.
 - **`authorityTrace`** — current authority traces relevant to the matched claims,
   including any that have been revoked since the original bundle was issued.
-- **`metadata`** — a free-form object on the bundle. This profile defines four
+- **`metadata`** — a free-form object on the bundle. This profile defines five
   reserved keys within `metadata`:
 
   | Key | Type | Required | Meaning |
   |---|---|---|---|
   | `respondedAt` | ISO 8601 string | yes | The timestamp at which the producer assembled this response. |
-  | `statusFunctionVersion` | string | yes | The status function version active at the producer at response time. |
+  | `statusFunctionVersion` | string | yes | The status function version the producer's current evaluation pipeline uses — i.e. the value the implementation exports (e.g. `statusFunctionVersion` from the reference implementation), independent of any version values stored inside served bundles. |
   | `requestedRefs` | string[] | yes | The full list of refs from the request, in order. |
-  | `unknownRefs` | string[] | yes | Refs from the request that the producer does not recognise. Must be present even if empty. |
+  | `unknownRefs` | string[] | yes | Refs from the request that matched nothing. Must be present even if empty. |
+  | `evaluatedAt` | `"response"` \| `"generation"` | no | When omitted or `"response"`, the producer evaluated claims dynamically at response time. `"generation"` indicates the producer cannot evaluate dynamically (e.g. static file serving) and the `statusFunctionVersion` reflects the version recorded when the bundle was originally generated. |
 
 Unknown refs are reported in `unknownRefs` honestly. A producer MUST NOT silently
 omit a ref it does not recognise; it MUST include it in `unknownRefs` so the
 receiver can distinguish "no changes" from "not found."
 
+**`statusFunctionVersion` source:** producers report the version their current
+evaluation pipeline uses — the value their implementation exports at response time.
+This is independent of any `statusFunctionVersion` fields stored inside the claims
+or events within served bundles. Producers that serve static bundles without
+dynamic evaluation MUST report the version that was active at generation time and
+MUST set `evaluatedAt: "generation"` in metadata.
+
+**`integrityAnchor` shape:** integrity anchor objects in responses follow the
+`integrityAnchor` definition in `schemas/claim.schema.json` (`$defs/integrityAnchor`)
+and `schemas/trust-bundle.schema.json` (`$defs/integrityAnchor`). Required fields
+are `id`, `kind`, `algorithm`, `value`, and `sourceRef`. On claims the anchor is
+carried as `currentIntegrityAnchor`; on authority-trace and evidence records it
+is carried as `integrityAnchor`.
+
 ---
 
 ## Assurance levels
@@ -150,3 +188,19 @@ unsigned responses are valid.
   specified here.
 - **Key management.** Public-key distribution, rotation, and revocation are out
   of scope. See the ADR 0004 backlog note above.
+
+---
+
+## Changelog
+
+**Amended after first independent implementation — hachure.org site function.**
+Five ambiguities resolved: (1) corrected claim integrity field names to schema
+truth (`currentIntegrityRef`, `currentIntegrityAnchor`) and noted authority-trace
+and evidence fields (`integrityRef`, `integrityAnchor`); (2) defined ref resolution
+semantics — producers MUST support id and currentIntegrityRef lookups, MAY support
+anchor-value lookups; (3) clarified multi-match: a ref matching multiple claims
+returns all of them, unknown only when nothing matches; (4) clarified
+`statusFunctionVersion` source as the producer's current pipeline export, added
+optional `evaluatedAt` metadata key (`"response"` | `"generation"`) for static
+producers; (5) added normative cross-reference to `integrityAnchor` schema
+definition in `schemas/claim.schema.json` and `schemas/trust-bundle.schema.json`.