fireweed-mcp 0.1.0__tar.gz

fireweed_mcp-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,67 @@
+# Publish fireweed-mcp to PyPI via Trusted Publishing (OIDC) — no API token stored anywhere.
+#
+# PyPI publisher configuration this must match EXACTLY:
+#   PyPI Project Name : fireweed-mcp
+#   Owner             : Starksood
+#   Repository name   : fireweed-mcp
+#   Workflow name     : publish.yml
+#   Environment name  : pypi
+#
+# Triggered by publishing a GitHub Release, so a push to main can never ship a version by accident.
+name: publish
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:        # manual re-run if a publish fails after the release is cut
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.9", "3.12"]   # 3.9 is the floor the engine actually runs on
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: pip install pytest
+      - run: PYTHONPATH=src python -m pytest -q tests/
+
+  build:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: pip install build
+      - run: python -m build
+      # Fail the release rather than ship a package that installs but cannot import — the exact
+      # failure this project shipped once already and caught only by installing the wheel.
+      - name: smoke-test the built wheel in a clean venv
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/python -c "import fireweed, fireweed_mcp.server as s; assert s.TOOLS; print('import-ok')"
+          printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{}}}' \
+            | /tmp/smoke/bin/fireweed-mcp | grep -q '"serverInfo"' && echo "protocol-ok"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi           # must match the Environment name in the PyPI publisher
+    permissions:
+      id-token: write           # required for Trusted Publishing; no token secret needed
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

fireweed_mcp-0.1.0/.gitignore

@@ -0,0 +1,7 @@
+__pycache__/
+*.py[cod]
+.pytest_cache/
+dist/
+build/
+*.egg-info/
+.venv/

fireweed_mcp-0.1.0/LICENSE.md

@@ -0,0 +1,105 @@
+# Functional Source License, Version 1.1, ALv2 Future License
+
+## Abbreviation
+
+FSL-1.1-ALv2
+
+## Notice
+
+Copyright 2026 Sanyam Sood
+
+## Terms and Conditions
+
+### Licensor ("We")
+
+The party offering the Software under these Terms and Conditions.
+
+### The Software
+
+The "Software" is each version of the software that we make available under
+these Terms and Conditions, as indicated by our inclusion of these Terms and
+Conditions with the Software.
+
+### License Grant
+
+Subject to your compliance with this License Grant and the Patents,
+Redistribution and Trademark clauses below, we hereby grant you the right to
+use, copy, modify, create derivative works, publicly perform, publicly display
+and redistribute the Software for any Permitted Purpose identified below.
+
+### Permitted Purpose
+
+A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+means making the Software available to others in a commercial product or
+service that:
+
+1. substitutes for the Software;
+
+2. substitutes for any other product or service we offer using the Software
+   that exists as of the date we make the Software available; or
+
+3. offers the same or substantially similar functionality as the Software.
+
+Permitted Purposes specifically include using the Software:
+
+1. for your internal use and access;
+
+2. for non-commercial education;
+
+3. for non-commercial research; and
+
+4. in connection with professional services that you provide to a licensee
+   using the Software in accordance with these Terms and Conditions.
+
+### Patents
+
+To the extent your use for a Permitted Purpose would necessarily infringe our
+patents, the license grant above includes a license under our patents. If you
+make a claim against any party that the Software infringes or contributes to
+the infringement of any patent, then your patent license to the Software ends
+immediately.
+
+### Redistribution
+
+The Terms and Conditions apply to all copies, modifications and derivatives of
+the Software.
+
+If you redistribute any copies, modifications or derivatives of the Software,
+you must include a copy of or a link to these Terms and Conditions and not
+remove any copyright notices provided in or with the Software.
+
+### Disclaimer
+
+THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+
+IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+
+### Trademarks
+
+Except for displaying the License Details and identifying us as the origin of
+the Software, you have no right under these Terms and Conditions to use our
+trademarks, trade names, service marks or product names.
+
+## Grant of Future License
+
+We hereby irrevocably grant you an additional license to use the Software under
+the Apache License, Version 2.0 that is effective on the second anniversary of
+the date we make the Software available. On or after that date, you may use the
+Software under the Apache License, Version 2.0, in which case the following
+will apply:
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License.
+
+You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

fireweed_mcp-0.1.0/PKG-INFO

@@ -0,0 +1,222 @@
+Metadata-Version: 2.5
+Name: fireweed-mcp
+Version: 0.1.0
+Summary: Agent memory where every fact carries a receipt — a deterministic gate decides what is remembered, and erasure issues a signed certificate.
+Project-URL: Homepage, https://github.com/Starksood/fireweed-mcp
+Project-URL: Source, https://github.com/Starksood/fireweed-mcp
+Author: Sanyam Sood
+License: # Functional Source License, Version 1.1, ALv2 Future License
+        
+        ## Abbreviation
+        
+        FSL-1.1-ALv2
+        
+        ## Notice
+        
+        Copyright 2026 Sanyam Sood
+        
+        ## Terms and Conditions
+        
+        ### Licensor ("We")
+        
+        The party offering the Software under these Terms and Conditions.
+        
+        ### The Software
+        
+        The "Software" is each version of the software that we make available under
+        these Terms and Conditions, as indicated by our inclusion of these Terms and
+        Conditions with the Software.
+        
+        ### License Grant
+        
+        Subject to your compliance with this License Grant and the Patents,
+        Redistribution and Trademark clauses below, we hereby grant you the right to
+        use, copy, modify, create derivative works, publicly perform, publicly display
+        and redistribute the Software for any Permitted Purpose identified below.
+        
+        ### Permitted Purpose
+        
+        A Permitted Purpose is any purpose other than a Competing Use. A Competing Use
+        means making the Software available to others in a commercial product or
+        service that:
+        
+        1. substitutes for the Software;
+        
+        2. substitutes for any other product or service we offer using the Software
+           that exists as of the date we make the Software available; or
+        
+        3. offers the same or substantially similar functionality as the Software.
+        
+        Permitted Purposes specifically include using the Software:
+        
+        1. for your internal use and access;
+        
+        2. for non-commercial education;
+        
+        3. for non-commercial research; and
+        
+        4. in connection with professional services that you provide to a licensee
+           using the Software in accordance with these Terms and Conditions.
+        
+        ### Patents
+        
+        To the extent your use for a Permitted Purpose would necessarily infringe our
+        patents, the license grant above includes a license under our patents. If you
+        make a claim against any party that the Software infringes or contributes to
+        the infringement of any patent, then your patent license to the Software ends
+        immediately.
+        
+        ### Redistribution
+        
+        The Terms and Conditions apply to all copies, modifications and derivatives of
+        the Software.
+        
+        If you redistribute any copies, modifications or derivatives of the Software,
+        you must include a copy of or a link to these Terms and Conditions and not
+        remove any copyright notices provided in or with the Software.
+        
+        ### Disclaimer
+        
+        THE SOFTWARE IS PROVIDED "AS IS" AND WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF FITNESS FOR A PARTICULAR
+        PURPOSE, MERCHANTABILITY, TITLE OR NON-INFRINGEMENT.
+        
+        IN NO EVENT WILL WE HAVE ANY LIABILITY TO YOU ARISING OUT OF OR RELATED TO THE
+        SOFTWARE, INCLUDING INDIRECT, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES,
+        EVEN IF WE HAVE BEEN INFORMED OF THEIR POSSIBILITY IN ADVANCE.
+        
+        ### Trademarks
+        
+        Except for displaying the License Details and identifying us as the origin of
+        the Software, you have no right under these Terms and Conditions to use our
+        trademarks, trade names, service marks or product names.
+        
+        ## Grant of Future License
+        
+        We hereby irrevocably grant you an additional license to use the Software under
+        the Apache License, Version 2.0 that is effective on the second anniversary of
+        the date we make the Software available. On or after that date, you may use the
+        Software under the Apache License, Version 2.0, in which case the following
+        will apply:
+        
+        Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+        this file except in compliance with the License.
+        
+        You may obtain a copy of the License at
+        
+        http://www.apache.org/licenses/LICENSE-2.0
+        
+        Unless required by applicable law or agreed to in writing, software distributed
+        under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+        CONDITIONS OF ANY KIND, either express or implied. See the License for the
+        specific language governing permissions and limitations under the License.
+License-File: LICENSE.md
+Keywords: agent-memory,audit,erasure,gdpr,llm,mcp,model-context-protocol,provenance
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Software Development :: Libraries
+Requires-Python: >=3.9
+Provides-Extra: semantic
+Requires-Dist: sentence-transformers>=3.0; extra == 'semantic'
+Description-Content-Type: text/markdown
+
+# fireweed-mcp
+
+Agent memory where every fact carries a receipt.
+
+```
+remember(claim    = "Priya joined Acme in 2019 under duress.",
+         evidence = "Priya Raman joined Acme in 2019 as a logistics analyst.")
+
+REFUSED (asserts_more_than_evidence) — the claim adds something the evidence does not say.
+  claim   : Priya joined Acme in 2019 under duress.
+  evidence: Priya Raman joined Acme in 2019 as a logistics analyst.
+```
+
+```
+recall("Priya's salary")
+
+ABSTAINED (unknown_predicate) — no claims ground "salary"; 1 claim about Priya Raman exists
+This is a refusal, not an empty result.
+```
+
+```
+forget("Priya")
+
+ERASED Priya Raman — certificate issued
+  signature            : hmac-sha256:f4d0768ef3b0fec624afec12f25bfd91…
+  nodes in closure     : 1
+  every probe abstains : True
+  bystanders surviving : 1
+```
+
+That last one is the artifact behind *"delete me from your agent's memory — and prove it."*
+
+## Install
+
+```bash
+uvx fireweed-mcp          # try it
+pip install fireweed-mcp  # keep it
+```
+
+```bash
+claude mcp add fireweed -- uvx fireweed-mcp
+```
+
+No dependencies. No API keys. No model — nothing in this server calls an LLM.
+
+## What it does
+
+| tool | |
+|---|---|
+| `remember` | admits a claim **only if the evidence you cite supports it**. Refusals are typed and say what to fix. |
+| `recall` | grounded claims **with the byte range they came from**; abstains and names the term it could not ground |
+| `verify_receipts` | re-hash every source, re-slice every range — **tamper-evident** |
+| `forget` | erasure with exact closure and a **signed certificate**; bystanders survive |
+| `export_memory` | the whole substrate as a portable open-format blob |
+
+## Why the refusals are the point
+
+Most memory servers store what the model says and return what's nearest. This one **adjudicates**.
+
+The rule is *the model proposes, deterministic code decides.* Across an RPC boundary that stops
+being a slogan: **your agent is the proposer**, and it cannot talk its way past the gate, because
+the gate is not a prompt. Pass a claim and the text you're quoting; pure functions check that the
+evidence names the subject, preserves the relation, invents no numbers, and asserts nothing the
+span doesn't say. What survives is stored with a byte range into the source.
+
+Then anyone can check it afterwards — including someone who trusts neither your agent nor this
+server. That is the whole product.
+
+## What it does NOT do
+
+Stated up front, because this project's last headline number turned out to be measuring nothing
+(see [the retraction](https://github.com/Starksood/Fireweed_Fabric/blob/main/RETRACTION.md), which
+ships with a script that proves it):
+
+- **It does not extract memories from free text.** You supply the claim and the evidence.
+  Automatic extraction needs a perceiver model; this server deliberately has none.
+- **It does not make an LLM truthful.** It governs what enters the *record* and what can be proven
+  about it. Your model can still say whatever it likes in its own prose.
+- **Conversational recall is weak, and measured.** On a 1,200-item adversarial corpus the retrieval
+  gate abstains on only **40%** of questions whose answer is genuinely absent — it checks that the
+  question's *topic* is grounded, not that the asked-for *value* exists. The write path, receipts
+  and erasure are unaffected and are the parts to rely on.
+
+## Your data
+
+`~/.fireweed/mcp/` (`FIREWEED_MCP_STORE` to change). The substrate is an open format — see
+[`open_format/SPEC.md`](open_format/SPEC.md) — and `open_format/reference_reader.py` reads it with
+the standard library alone. Your memory outlives this server, this engine, and any model. A test
+asserts that round trip.
+
+Optional: `pip install "fireweed-mcp[semantic]"` enables paraphrase matching in `recall`. Without
+it the gate refuses *more* — the safe direction — and `memory_stats` tells you which mode you're in.
+
+## License
+
+**FSL-1.1-ALv2** — source-available. Free for everything except building a competing product;
+converts to **Apache 2.0 on 2028-01-01**. Full text in [`LICENSE.md`](LICENSE.md).
+
+Want to use Fireweed in a commercial product or competing service? → **snymsood@icloud.com**

fireweed_mcp-0.1.0/README.md

@@ -0,0 +1,99 @@
+# fireweed-mcp
+
+Agent memory where every fact carries a receipt.
+
+```
+remember(claim    = "Priya joined Acme in 2019 under duress.",
+         evidence = "Priya Raman joined Acme in 2019 as a logistics analyst.")
+
+REFUSED (asserts_more_than_evidence) — the claim adds something the evidence does not say.
+  claim   : Priya joined Acme in 2019 under duress.
+  evidence: Priya Raman joined Acme in 2019 as a logistics analyst.
+```
+
+```
+recall("Priya's salary")
+
+ABSTAINED (unknown_predicate) — no claims ground "salary"; 1 claim about Priya Raman exists
+This is a refusal, not an empty result.
+```
+
+```
+forget("Priya")
+
+ERASED Priya Raman — certificate issued
+  signature            : hmac-sha256:f4d0768ef3b0fec624afec12f25bfd91…
+  nodes in closure     : 1
+  every probe abstains : True
+  bystanders surviving : 1
+```
+
+That last one is the artifact behind *"delete me from your agent's memory — and prove it."*
+
+## Install
+
+```bash
+uvx fireweed-mcp          # try it
+pip install fireweed-mcp  # keep it
+```
+
+```bash
+claude mcp add fireweed -- uvx fireweed-mcp
+```
+
+No dependencies. No API keys. No model — nothing in this server calls an LLM.
+
+## What it does
+
+| tool | |
+|---|---|
+| `remember` | admits a claim **only if the evidence you cite supports it**. Refusals are typed and say what to fix. |
+| `recall` | grounded claims **with the byte range they came from**; abstains and names the term it could not ground |
+| `verify_receipts` | re-hash every source, re-slice every range — **tamper-evident** |
+| `forget` | erasure with exact closure and a **signed certificate**; bystanders survive |
+| `export_memory` | the whole substrate as a portable open-format blob |
+
+## Why the refusals are the point
+
+Most memory servers store what the model says and return what's nearest. This one **adjudicates**.
+
+The rule is *the model proposes, deterministic code decides.* Across an RPC boundary that stops
+being a slogan: **your agent is the proposer**, and it cannot talk its way past the gate, because
+the gate is not a prompt. Pass a claim and the text you're quoting; pure functions check that the
+evidence names the subject, preserves the relation, invents no numbers, and asserts nothing the
+span doesn't say. What survives is stored with a byte range into the source.
+
+Then anyone can check it afterwards — including someone who trusts neither your agent nor this
+server. That is the whole product.
+
+## What it does NOT do
+
+Stated up front, because this project's last headline number turned out to be measuring nothing
+(see [the retraction](https://github.com/Starksood/Fireweed_Fabric/blob/main/RETRACTION.md), which
+ships with a script that proves it):
+
+- **It does not extract memories from free text.** You supply the claim and the evidence.
+  Automatic extraction needs a perceiver model; this server deliberately has none.
+- **It does not make an LLM truthful.** It governs what enters the *record* and what can be proven
+  about it. Your model can still say whatever it likes in its own prose.
+- **Conversational recall is weak, and measured.** On a 1,200-item adversarial corpus the retrieval
+  gate abstains on only **40%** of questions whose answer is genuinely absent — it checks that the
+  question's *topic* is grounded, not that the asked-for *value* exists. The write path, receipts
+  and erasure are unaffected and are the parts to rely on.
+
+## Your data
+
+`~/.fireweed/mcp/` (`FIREWEED_MCP_STORE` to change). The substrate is an open format — see
+[`open_format/SPEC.md`](open_format/SPEC.md) — and `open_format/reference_reader.py` reads it with
+the standard library alone. Your memory outlives this server, this engine, and any model. A test
+asserts that round trip.
+
+Optional: `pip install "fireweed-mcp[semantic]"` enables paraphrase matching in `recall`. Without
+it the gate refuses *more* — the safe direction — and `memory_stats` tells you which mode you're in.
+
+## License
+
+**FSL-1.1-ALv2** — source-available. Free for everything except building a competing product;
+converts to **Apache 2.0 on 2028-01-01**. Full text in [`LICENSE.md`](LICENSE.md).
+
+Want to use Fireweed in a commercial product or competing service? → **snymsood@icloud.com**

fireweed_mcp-0.1.0/open_format/SPEC.md

@@ -0,0 +1,114 @@
+# The Fireweed Memory Protocol (FMP) — normalization spec v1
+
+**Status:** the open half of the open-core boundary. This document, `reference_reader.py`,
+`conformance.py` and the trap corpus are permanently open; the engine that DECIDES what enters a
+substrate is not. The split is exact: **everything that describes is here, everything that
+adjudicates is private.**
+
+**Why it exists:** weights obsolesce in a decade. A record that can only be read by the vendor that
+wrote it is not a record, it is a rental. An FMP snapshot must stay readable with nothing but a JSON
+parser and this document — which is why the reference reader imports only the standard library, and
+why that constraint is a conformance check rather than a preference.
+
+---
+
+## 1. Container
+
+A snapshot is one UTF-8 JSON object. Top level:
+
+| field | type | meaning |
+|---|---|---|
+| `snapshot_version` | int | format version. **2** is current. A reader MUST refuse a version it does not know. |
+| `fireweed_version` | string | the writer's engine version. Informational; never load-bearing. |
+| `nodes` | array | the claims. §2 |
+| `entities` | array | the things claims are about. §3 |
+| `relations` | array | typed edges. §4 |
+| `sessions_seen`, `total_sessions`, `seen_domains`, `session_timestamp`, `session_anchor`, `ingested_session_ids` | — | writer bookkeeping. A reader MAY ignore all of it. |
+
+**Refusing is mandatory, not optional.** A reader that silently reads an unknown version is how a
+format rots: it will misinterpret fields that changed meaning and report the result as fact.
+
+## 2. Nodes (claims)
+
+Required: `node_id` (unique), `claim`. Load-bearing optional fields:
+
+| field | meaning |
+|---|---|
+| `normalized_claim` | canonical form used for matching. Derived; never authoritative over `claim`. |
+| `node_type` | `fact` \| `event` \| `state` \| `preference` \| `constraint` \| `inference` \| `reflection` \| `summary` |
+| `status.memory_state` | `active` \| `disputed` \| `superseded` \| `quarantined` \| `frozen` |
+| `entities[].entity_id` | references §3 |
+| `domains` | topical tags, unordered |
+| `provenance` | §5 |
+
+**The memory-state contract.**
+
+- `active` and `disputed` are both READABLE. A `disputed` node is held in standing contradiction,
+  not retired: both sides of an unresolved conflict stay answerable, because silently picking a
+  winner is a decision the format must not make on the reader's behalf.
+- `superseded` nodes are **retained in the file, never deleted.** A reader can always reconstruct
+  what was once believed and when it stopped being believed. Belief revision is part of the record.
+- Erasure is the one exception: erased content is genuinely gone, replaced by a tombstone. That is a
+  deliberate asymmetry — supersession is history, erasure is a promise.
+
+## 3. Entities
+
+`entity_id` (unique), `canonical_name`, `entity_type`
+(`person` \| `place` \| `organization` \| `object` \| `concept` \| `event`), `aliases`.
+
+> **Known defect, stated rather than hidden:** writers at time of writing emit `person` for nearly
+> every entity, including organizations and objects. `entity_type` is therefore NOT yet trustworthy
+> and a reader must not build behaviour on it. Tracked in `docs/DESIGN_read_gate.md` §5, where it is
+> the blocker for object typing.
+
+## 4. Relations
+
+`relation_id`, `relation_type`, `source_id`, `target_id`.
+
+**The list is heterogeneous, and the endpoint domain depends on the type.** This is the one place a
+naive reader will get it wrong — the first run of the conformance suite reported four "dangling"
+relations that were simply entity edges:
+
+| relation_type | `source_id` / `target_id` refer to |
+|---|---|
+| `supersedes`, `contradicts`, `supports`, `derived_from`, `causes`, `motivates`, `before` | **node** ids |
+| `co_occurs` | **entity** ids |
+
+A reader MUST resolve endpoints in the domain the type declares.
+
+## 5. Provenance and receipts
+
+| field | meaning |
+|---|---|
+| `source_turn_id` | the turn or document-derived id the claim came from |
+| `source_span` | the **verbatim** evidence the claim was admitted on |
+| `confidence` | the proposer's confidence. Never a gate; informational only. |
+| `grounding_class` | `grounded_verbatim` (subject named in the cited span) or `grounded_resolved` (subject resolved from outside it) |
+| `doc_hash`, `byte_start`, `byte_end` | the receipt coordinate, when the claim is document-bound |
+
+**A receipt exists only when `doc_hash`, `byte_start` and `byte_end` are ALL present.** A partial
+coordinate is not a weak receipt — it is no receipt. Reporting one would be exactly the fabrication
+the format exists to prevent, and the conformance suite checks it.
+
+**Verification** is two steps, and both must pass:
+
+1. `"sha256:" + sha256(document)` equals `doc_hash`
+2. `document[byte_start:byte_end]` decodes to `source_span`
+
+Change any byte of the source and one of the two fails. That is the whole provenance guarantee, and
+it is checkable by anyone holding the document — no engine, no network, no trust.
+
+## 6. Conformance
+
+    python open_format/conformance.py <snapshot.json>
+
+20 checks. It does not trust the reference reader: it states properties of the FORMAT and runs them
+against whatever reader it is handed, so passing with your own implementation means yours conforms.
+Three of the checks assert the reader REFUSES malformed input, and two assert receipts FAIL on a
+tampered source — a suite that can only pass is not evidence.
+
+## 7. Stability
+
+Within a major version: fields may be ADDED; existing field meanings never change. A reader must
+ignore fields it does not recognise. Removing or repurposing a field requires a version bump, which
+existing readers are required to refuse.