xoonya 3.1.0 → 3.1.1

package/RELEASE_NOTES.md

@@ -1,15 +1,18 @@
-`xoonya` 3.1.0 is the synchronized control-plane and evidence-line release for the live proof, verification, continuity, governance, replay, and public first-contact line.
-
-This release keeps the public proof line synchronized after the major cut by preserving the same frozen proof truth models, widened finish-line scope, and naxytra public contract, proof, release, and gate surfaces while tightening the installable package experience for outside agents and builders.
-
-Highlights:
-
-- keeps `/v1/proof-truth` and `/v1/proof-truth/summary` as the named proof object boundary
-- keeps `/v1/default-path` and `/v1/default-path/summary` as the named proof-side multi-surface entry boundary
-- keeps `/v1/followthrough-truth` and `/v1/followthrough-truth/summary` as the named bridge, governance, portability, and verification claim boundary
-- keeps verification services, trust-portability surfaces, governance/dispute visibility, signed-audit provenance, and reference-implementation posture aligned with the same synchronized public release line
-- promotes bounded native hybrid live verification for registered runtime-supported vector-covered suites instead of leaving PQ/hybrid as a design-only posture
-- preserves XNYA-compatible conformance, native reference implementation boundaries, external proof import boundaries, deterministic replay posture, and proof-side governance as one discoverable proof stack inside the final major line
-- keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes stay clean
-- keeps the canonical `https://naxytra.com/xoonya` public product URL and single naxytra website positioning intact
-- verifies the release candidate, full package verifier, umbrella pre-deploy gates, clean-consumer release smoke, and public evidence lane checks before the synchronized control-plane release
+## 3.1.1
+
+`xoonya` 3.1.1 is the verification-honesty and service-hardening patch on the synchronized control-plane and evidence-line release for the live proof, verification, continuity, governance, replay, and public first-contact line.
+
+This release keeps every frozen proof truth model, public contract, proof, release, and gate surface intact while making verify results say exactly what was checked, letting verifiers pin identities to keys, and hardening the HTTP service against oversized bodies, malformed paths, leaked error details, and private key material submitted over the wire.
+
+Highlights:
+
+- adds `verification_class` (`cryptographic`, `digest`, `anchored_binding`, `structural`), `cryptographically_verified`, `strict`, and `trust_root_applied` to every `verifyProofBundle` and `POST /v1/proof-bundles/verify` result without changing default `valid` semantics
+- adds strict verification (`options.strict`, `XOONYA_STRICT_VERIFY=1`) with the deterministic rejection codes `digest_only_not_cryptographically_verified` and `external_verification_required`
+- adds verifier-supplied trust roots (`trusted_public_key_refs`, `expected_public_key_ref`, `expected_pq_public_key_ref`, and related lane pins) with the deterministic rejection codes `native_public_key_not_trusted` and `native_hybrid_public_key_not_trusted`, and documents that native `public_key_ref` is self-bound to the carried key while identity binding requires a trust root
+- caches the native hybrid runtime-support probe per suite pair so sign and verify no longer regenerate classical and PQ key pairs on every call
+- hardens `server.js`: byte-counted 1 MiB body limit with a `content-length` precheck, `OPTIONS` and `HEAD` handling, `400 invalid_path_encoding` for malformed percent-encoding, generic `500 internal_error` with server-side stack logging, request and header timeouts, `x-content-type-options: nosniff`, `cache-control: no-store` on non-GET responses, and `uncaughtException` / `unhandledRejection` handlers
+- adds `XOONYA_ACCEPT_PRIVATE_KEY_MATERIAL`; when `false`, or unset on Render, emit, build, and proof-center run routes reject bodies carrying `/private_key/i` fields with `400 private_key_material_not_accepted` and point to local SDK/CLI signing
+- adds `npm run verify:forgery-resistance` (key substitution with and without a trust root, strict-mode rejection of digest and structural results, hybrid PQ tampering and wrong-pin rejection, result determinism) to `verify:all`, plus strict-mode, hardening, and private-key-policy checks in `verify:service`
+- marks the `dilithium`, `falcon`, and `sphincs-plus` registry entries as `deprecated_placeholder` aliases pointing at the implemented `ml-dsa-65` and `slh-dsa-sha2-128f` suites, and labels native identity prefixes `05`-`07` as legacy placeholders
+- keeps `RELEASE_NOTES.md` scoped to the current release so npm and GitHub release notes stay clean
+- keeps the canonical `https://naxytra.com/xoonya` public product URL and single naxytra website positioning intact

package/SERVICE_CONTRACT.md

@@ -1,207 +1,207 @@
-# xoonya Service Contract
-
-This file freezes the public service contract for `xoonya`.
-
-## Public Routes
-
-Primary proof-model routes:
-
-- `GET /health`
-- `GET /openapi.json`
-- `GET /v1/openapi`
-- `GET /v1/openapi/summary`
-- `GET /asyncapi.json`
-- `GET /v1/asyncapi`
-- `GET /v1/asyncapi/summary`
-- `GET /cloudevents.json`
-- `GET /v1/cloudevents`
-- `GET /v1/cloudevents/summary`
-- `GET /v1/auth-profiles`
-- `GET /v1/auth-profiles/summary`
-- `GET /v1/identity-interop`
-- `GET /v1/identity-interop/summary`
-- `GET /v1/providers`
-- `GET /v1/providers/summary`
-- `GET /v1/frameworks`
-- `GET /v1/frameworks/summary`
-- `GET /v1/integration-matrix`
-- `GET /v1/integration-matrix/summary`
-- `GET /v1/major-rails`
-- `GET /v1/major-rails/summary`
-- `GET /v1/treasury`
-- `GET /v1/treasury/summary`
-- `GET /v1/erc8004`
-- `GET /v1/erc8004/summary`
-- `GET /v1/proof-bridge`
-- `GET /v1/proof-bridge/summary`
-- `GET /v1/external-proof-import`
-- `GET /v1/external-proof-import/summary`
-- `GET /v1/result-package-trust`
-- `GET /v1/result-package-trust/summary`
-- `GET /v1/event-systems`
-- `GET /v1/event-systems/summary`
-- `GET /v1/telemetry`
-- `GET /v1/telemetry/summary`
-- `GET /v1/provenance`
-- `GET /v1/provenance/summary`
-- `GET /v1/artifact-distribution`
-- `GET /v1/artifact-distribution/summary`
-- `GET /v1/shared-signals`
-- `GET /v1/shared-signals/summary`
-- `GET /v1/feature-control`
-- `GET /v1/feature-control/summary`
-- `GET /v1/adapter-certification`
-- `GET /v1/adapter-certification/summary`
-- `GET /v1/adapter-certification/:front_id`
-- `GET /v1/trust-portability-boundary`
-- `GET /v1/trust-portability-boundary/summary`
-- `GET /v1/trust-portability-boundary/:axis_id`
-- `GET /v1/signed-audit-provenance`
-- `GET /v1/signed-audit-provenance/summary`
-- `GET /v1/signed-audit-provenance/:surface_id`
-- `GET /v1/integrations`
-- `GET /v1/integrations/summary`
-- `GET /v1/integrations/snapshot`
-- `GET /v1/integrations/promotion-readiness`
-- `GET /v1/integrations/promotion-workflow`
-- `GET /v1/proof-center`
-- `GET /v1/proof-center/summary`
-- `GET /v1/proof-center/native-standard`
-- `GET /v1/proof-center/native-standard/summary`
-- `GET /v1/proof-center/native-hybrid-readiness`
-- `GET /v1/proof-center/native-hybrid-readiness/summary`
-- `GET /v1/proof-center/native-standardization`
-- `GET /v1/proof-center/native-standardization/summary`
-- `GET /v1/proof-center/native-conformance-mark`
-- `GET /v1/proof-center/native-conformance-mark/summary`
-- `GET /v1/proof-center/native-reference-implementations`
-- `GET /v1/proof-center/native-reference-implementations/summary`
-- `GET /v1/proof-center/native-atom-spec`
-- `GET /v1/proof-center/native-atom-spec/summary`
-- `GET /v1/proof-center/native-atom-conformance`
-- `GET /v1/proof-center/native-atom-conformance/summary`
-- `GET /v1/proof-center/native-anchor-profile`
-- `GET /v1/proof-center/native-anchor-profile/summary`
-- `GET /v1/proof-center/native-payload-profile`
-- `GET /v1/proof-center/native-payload-profile/summary`
-- `GET /v1/proof-center/native-line-rate-frame`
-- `GET /v1/proof-center/native-line-rate-frame/summary`
-- `GET /v1/proof-center/import-adapter`
-- `GET /v1/proof-center/import-adapter/summary`
-- `POST /v1/proof-center/import-adapter/review`
-- `POST /v1/proof-center/import-adapter/review/summary`
-- `POST /v1/proof-center/import-adapter/run`
-- `GET /v1/proof-center/governance`
-- `GET /v1/proof-center/governance/summary`
-- `GET /v1/proof-center/bridge`
-- `GET /v1/proof-center/bridge/summary`
-- `GET /v1/proof-center/bridge/profile-support`
-- `POST /v1/proof-center/governance/interpretation-validate`
-- `POST /v1/proof-center/governance/coordination`
-- `POST /v1/proof-center/governance/dashboard`
-- `POST /v1/proof-center/governance/operator-view`
-- `POST /v1/proof-center/governance/admin-view`
-- `POST /v1/proof-center/governance/dashboard-pack`
-- `POST /v1/proof-center/governance/workflow-pack`
-- `POST /v1/proof-center/governance/signoff-pack`
-- `POST /v1/proof-center/governance/disputes/summary`
-- `POST /v1/proof-center/governance/disputes/case-review`
-- `POST /v1/proof-center/governance/disputes/action`
-- `POST /v1/proof-center/governance/disputes/case-bundle`
-- `POST /v1/proof-center/governance/disputes/resolution-pack`
-- `POST /v1/proof-center/governance/console-pack`
-- `POST /v1/proof-center/governance/handoff-bundle`
-- `POST /v1/proof-center/governance/review-link`
-- `POST /v1/proof-center/bridge/receipt-wrap`
-- `POST /v1/proof-center/bridge/validator-verify`
-- `POST /v1/proof-center/bridge/receipt-ledger-handoff`
-- `POST /v1/proof-center/bridge/economic-handoff`
-- `POST /v1/proof-center/bridge/economic-conformance-pack`
-- `POST /v1/proof-center/bridge/operator-review-pack`
-- `POST /v1/proof-center/bridge/compatibility-pack`
-- `POST /v1/proof-center/bridge/workflow-pack`
-- `POST /v1/proof-center/bridge/admin-pack`
-- `POST /v1/events/canonicalize`
-- `POST /v1/events/hash`
-- `POST /v1/receipts/emit`
-- `POST /v1/proof-bundles/build`
-- `POST /v1/proof-bundles/verify`
-
-Compatibility routes:
-
-- `POST /validate`
-- `POST /v1/receipts/verify`
-- `POST /v1/receipts/inspect`
-- `POST /v1/proofs/verify`
-- `POST /v1/profiles/economic/verify`
-- `POST /v1/profiles/registry/verify`
-
-## Error-Shape Expectations
-
-Primary error posture:
-
-- invalid request payloads return `400`
-- unknown routes return `404`
-- unexpected server failures return `500`
-
-Expected error shapes:
-
-- validation-style failures:
-  - `{ "valid": false, "reason": "<message>" }`
-- not found:
-  - `{ "status": "not_found", "path": "<path>" }`
-- server failure:
-  - `{ "status": "error", "reason": "<message>" }`
-
-Compatibility routes may return proof/profile-specific verification payloads, but the top-level shape should still remain predictable.
-
-Interop note:
-
-- `GET /v1/identity-interop` exposes how native proof, attestation, and bridge surfaces map to `JWT`, `DID/VC`, and `SD-JWT VC` interop lanes without replacing canonical proof truth inside `xoonya`
-- `GET /v1/major-rails` exposes the Solana and Antelope/Proton XPR/Metal proof family as one practical settlement-evidence lane
-- `GET /v1/treasury` exposes treasury destination/accounting evidence continuity while keeping DAI/USDC and Monero reserve doctrine clearly internal
-- `GET /v1/external-proof-import` exposes the result, receipt, and proof-bundle import family as one builder-trust lane
-- `GET /v1/result-package-trust` exposes the carried result-package trust continuity posture as a first-class proof-side lane
-- `GET /v1/providers` exposes the OpenAI Codex and Claude/MCP family as first-class provider-origin proof lanes
-- `GET /v1/frameworks` exposes LangGraph, LangChain, AutoGen, and Semantic Kernel as first-class framework followthrough lanes
-- `GET /v1/integration-matrix` exposes the canonical public view across providers, frameworks, proof lanes, and registry-backed proof integrations
-- `GET /v1/telemetry` exposes the OpenTelemetry-aligned proof observability posture across review, verification, bridge, and proof event signals
-- `GET /v1/provenance` exposes the SLSA-aligned provenance posture for proof artifacts, release trust, and bundle followthrough confidence
-- `GET /v1/artifact-distribution` exposes OCI-style artifact distribution posture for proof bundles, handoff bundles, snapshots, and release artifacts
-- `GET /v1/shared-signals` exposes OpenID Shared Signals and CAEP-aligned review, bridge, import, and trust event exchange posture
-- `GET /v1/feature-control` exposes OpenFeature/OFREP-aligned rollout and review portability posture around role freeze, bridge, trust, and release gates
-- `GET /v1/adapter-certification` exposes the front-specific adapter certification contract and its machine-readable compatibility states
-- `GET /v1/trust-portability-boundary` exposes the bounded trust portability contract for identity, delegation, delivery, and settlement-linked followthrough
-- `GET /v1/signed-audit-provenance` exposes the signed audit and provenance surface map for selected evidence-bearing proof and release lanes
-
-## Final-Loop Verification
-
-The constitutional proof loop for `xoonya` is:
-
-1. canonicalize event
-2. hash event
-3. emit receipt
-4. build proof bundle
-5. verify proof bundle
-
-Bridge-side economic carry should use:
-
-1. pass deterministic runtime economics through `POST /v1/proof-center/bridge/economic-handoff`
-2. prefer the canonical `handoff_bundle` wrapper emitted by `xytara`
-3. review the preserved usage-meter and credit-spend consequence through `POST /v1/proof-center/bridge/economic-conformance-pack`
-4. keep proof itself minimal while preserving the economic handoff as a bounded bridge/export surface
-
-Normal result-package handoff should also accept carried economics when present:
-
-1. send the normal result-package `handoff_bundle`
-2. include `handoff_bundle.economic_consequence_handoff_bundle` when the transaction-side path was credit-backed and metered
-3. expect `POST /v1/proof-center/result-package-handoff/run` and review-summary surfaces to expose compact economic-conformance review data automatically
-4. omit that bundle entirely on direct-pay or non-metered paths without changing proof intake behavior
-
-This loop is exercised through:
-
-- package verification
-- example verification
-- service verification
-- conformance/adversarial vector verification
-- public `xoonya conformance` and `xoonya conformance --json` commands
+# xoonya Service Contract
+
+This file freezes the public service contract for `xoonya`.
+
+## Public Routes
+
+Primary proof-model routes:
+
+- `GET /health`
+- `GET /openapi.json`
+- `GET /v1/openapi`
+- `GET /v1/openapi/summary`
+- `GET /asyncapi.json`
+- `GET /v1/asyncapi`
+- `GET /v1/asyncapi/summary`
+- `GET /cloudevents.json`
+- `GET /v1/cloudevents`
+- `GET /v1/cloudevents/summary`
+- `GET /v1/auth-profiles`
+- `GET /v1/auth-profiles/summary`
+- `GET /v1/identity-interop`
+- `GET /v1/identity-interop/summary`
+- `GET /v1/providers`
+- `GET /v1/providers/summary`
+- `GET /v1/frameworks`
+- `GET /v1/frameworks/summary`
+- `GET /v1/integration-matrix`
+- `GET /v1/integration-matrix/summary`
+- `GET /v1/major-rails`
+- `GET /v1/major-rails/summary`
+- `GET /v1/treasury`
+- `GET /v1/treasury/summary`
+- `GET /v1/erc8004`
+- `GET /v1/erc8004/summary`
+- `GET /v1/proof-bridge`
+- `GET /v1/proof-bridge/summary`
+- `GET /v1/external-proof-import`
+- `GET /v1/external-proof-import/summary`
+- `GET /v1/result-package-trust`
+- `GET /v1/result-package-trust/summary`
+- `GET /v1/event-systems`
+- `GET /v1/event-systems/summary`
+- `GET /v1/telemetry`
+- `GET /v1/telemetry/summary`
+- `GET /v1/provenance`
+- `GET /v1/provenance/summary`
+- `GET /v1/artifact-distribution`
+- `GET /v1/artifact-distribution/summary`
+- `GET /v1/shared-signals`
+- `GET /v1/shared-signals/summary`
+- `GET /v1/feature-control`
+- `GET /v1/feature-control/summary`
+- `GET /v1/adapter-certification`
+- `GET /v1/adapter-certification/summary`
+- `GET /v1/adapter-certification/:front_id`
+- `GET /v1/trust-portability-boundary`
+- `GET /v1/trust-portability-boundary/summary`
+- `GET /v1/trust-portability-boundary/:axis_id`
+- `GET /v1/signed-audit-provenance`
+- `GET /v1/signed-audit-provenance/summary`
+- `GET /v1/signed-audit-provenance/:surface_id`
+- `GET /v1/integrations`
+- `GET /v1/integrations/summary`
+- `GET /v1/integrations/snapshot`
+- `GET /v1/integrations/promotion-readiness`
+- `GET /v1/integrations/promotion-workflow`
+- `GET /v1/proof-center`
+- `GET /v1/proof-center/summary`
+- `GET /v1/proof-center/native-standard`
+- `GET /v1/proof-center/native-standard/summary`
+- `GET /v1/proof-center/native-hybrid-readiness`
+- `GET /v1/proof-center/native-hybrid-readiness/summary`
+- `GET /v1/proof-center/native-standardization`
+- `GET /v1/proof-center/native-standardization/summary`
+- `GET /v1/proof-center/native-conformance-mark`
+- `GET /v1/proof-center/native-conformance-mark/summary`
+- `GET /v1/proof-center/native-reference-implementations`
+- `GET /v1/proof-center/native-reference-implementations/summary`
+- `GET /v1/proof-center/native-atom-spec`
+- `GET /v1/proof-center/native-atom-spec/summary`
+- `GET /v1/proof-center/native-atom-conformance`
+- `GET /v1/proof-center/native-atom-conformance/summary`
+- `GET /v1/proof-center/native-anchor-profile`
+- `GET /v1/proof-center/native-anchor-profile/summary`
+- `GET /v1/proof-center/native-payload-profile`
+- `GET /v1/proof-center/native-payload-profile/summary`
+- `GET /v1/proof-center/native-line-rate-frame`
+- `GET /v1/proof-center/native-line-rate-frame/summary`
+- `GET /v1/proof-center/import-adapter`
+- `GET /v1/proof-center/import-adapter/summary`
+- `POST /v1/proof-center/import-adapter/review`
+- `POST /v1/proof-center/import-adapter/review/summary`
+- `POST /v1/proof-center/import-adapter/run`
+- `GET /v1/proof-center/governance`
+- `GET /v1/proof-center/governance/summary`
+- `GET /v1/proof-center/bridge`
+- `GET /v1/proof-center/bridge/summary`
+- `GET /v1/proof-center/bridge/profile-support`
+- `POST /v1/proof-center/governance/interpretation-validate`
+- `POST /v1/proof-center/governance/coordination`
+- `POST /v1/proof-center/governance/dashboard`
+- `POST /v1/proof-center/governance/operator-view`
+- `POST /v1/proof-center/governance/admin-view`
+- `POST /v1/proof-center/governance/dashboard-pack`
+- `POST /v1/proof-center/governance/workflow-pack`
+- `POST /v1/proof-center/governance/signoff-pack`
+- `POST /v1/proof-center/governance/disputes/summary`
+- `POST /v1/proof-center/governance/disputes/case-review`
+- `POST /v1/proof-center/governance/disputes/action`
+- `POST /v1/proof-center/governance/disputes/case-bundle`
+- `POST /v1/proof-center/governance/disputes/resolution-pack`
+- `POST /v1/proof-center/governance/console-pack`
+- `POST /v1/proof-center/governance/handoff-bundle`
+- `POST /v1/proof-center/governance/review-link`
+- `POST /v1/proof-center/bridge/receipt-wrap`
+- `POST /v1/proof-center/bridge/validator-verify`
+- `POST /v1/proof-center/bridge/receipt-ledger-handoff`
+- `POST /v1/proof-center/bridge/economic-handoff`
+- `POST /v1/proof-center/bridge/economic-conformance-pack`
+- `POST /v1/proof-center/bridge/operator-review-pack`
+- `POST /v1/proof-center/bridge/compatibility-pack`
+- `POST /v1/proof-center/bridge/workflow-pack`
+- `POST /v1/proof-center/bridge/admin-pack`
+- `POST /v1/events/canonicalize`
+- `POST /v1/events/hash`
+- `POST /v1/receipts/emit`
+- `POST /v1/proof-bundles/build`
+- `POST /v1/proof-bundles/verify`
+
+Compatibility routes:
+
+- `POST /validate`
+- `POST /v1/receipts/verify`
+- `POST /v1/receipts/inspect`
+- `POST /v1/proofs/verify`
+- `POST /v1/profiles/economic/verify`
+- `POST /v1/profiles/registry/verify`
+
+## Error-Shape Expectations
+
+Primary error posture:
+
+- invalid request payloads return `400`
+- unknown routes return `404`
+- unexpected server failures return `500`
+
+Expected error shapes:
+
+- validation-style failures:
+  - `{ "valid": false, "reason": "<message>" }`
+- not found:
+  - `{ "status": "not_found", "path": "<path>" }`
+- server failure:
+  - `{ "status": "error", "reason": "<message>" }`
+
+Compatibility routes may return proof/profile-specific verification payloads, but the top-level shape should still remain predictable.
+
+Interop note:
+
+- `GET /v1/identity-interop` exposes how native proof, attestation, and bridge surfaces map to `JWT`, `DID/VC`, and `SD-JWT VC` interop lanes without replacing canonical proof truth inside `xoonya`
+- `GET /v1/major-rails` exposes the Solana and Antelope/Proton XPR/Metal proof family as one practical settlement-evidence lane
+- `GET /v1/treasury` exposes treasury destination/accounting evidence continuity while keeping DAI/USDC and Monero reserve doctrine clearly internal
+- `GET /v1/external-proof-import` exposes the result, receipt, and proof-bundle import family as one builder-trust lane
+- `GET /v1/result-package-trust` exposes the carried result-package trust continuity posture as a first-class proof-side lane
+- `GET /v1/providers` exposes the OpenAI Codex and Claude/MCP family as first-class provider-origin proof lanes
+- `GET /v1/frameworks` exposes LangGraph, LangChain, AutoGen, and Semantic Kernel as first-class framework followthrough lanes
+- `GET /v1/integration-matrix` exposes the canonical public view across providers, frameworks, proof lanes, and registry-backed proof integrations
+- `GET /v1/telemetry` exposes the OpenTelemetry-aligned proof observability posture across review, verification, bridge, and proof event signals
+- `GET /v1/provenance` exposes the SLSA-aligned provenance posture for proof artifacts, release trust, and bundle followthrough confidence
+- `GET /v1/artifact-distribution` exposes OCI-style artifact distribution posture for proof bundles, handoff bundles, snapshots, and release artifacts
+- `GET /v1/shared-signals` exposes OpenID Shared Signals and CAEP-aligned review, bridge, import, and trust event exchange posture
+- `GET /v1/feature-control` exposes OpenFeature/OFREP-aligned rollout and review portability posture around role freeze, bridge, trust, and release gates
+- `GET /v1/adapter-certification` exposes the front-specific adapter certification contract and its machine-readable compatibility states
+- `GET /v1/trust-portability-boundary` exposes the bounded trust portability contract for identity, delegation, delivery, and settlement-linked followthrough
+- `GET /v1/signed-audit-provenance` exposes the signed audit and provenance surface map for selected evidence-bearing proof and release lanes
+
+## Final-Loop Verification
+
+The constitutional proof loop for `xoonya` is:
+
+1. canonicalize event
+2. hash event
+3. emit receipt
+4. build proof bundle
+5. verify proof bundle
+
+Bridge-side economic carry should use:
+
+1. pass deterministic runtime economics through `POST /v1/proof-center/bridge/economic-handoff`
+2. prefer the canonical `handoff_bundle` wrapper emitted by `xytara`
+3. review the preserved usage-meter and credit-spend consequence through `POST /v1/proof-center/bridge/economic-conformance-pack`
+4. keep proof itself minimal while preserving the economic handoff as a bounded bridge/export surface
+
+Normal result-package handoff should also accept carried economics when present:
+
+1. send the normal result-package `handoff_bundle`
+2. include `handoff_bundle.economic_consequence_handoff_bundle` when the transaction-side path was credit-backed and metered
+3. expect `POST /v1/proof-center/result-package-handoff/run` and review-summary surfaces to expose compact economic-conformance review data automatically
+4. omit that bundle entirely on direct-pay or non-metered paths without changing proof intake behavior
+
+This loop is exercised through:
+
+- package verification
+- example verification
+- service verification
+- conformance/adversarial vector verification
+- public `xoonya conformance` and `xoonya conformance --json` commands