jep-runtime 0.1.1__tar.gz

jep_runtime-0.1.1/PKG-INFO

@@ -0,0 +1,150 @@
+Metadata-Version: 2.4
+Name: jep-runtime
+Version: 0.1.1
+Summary: Reference runtime for Judgment Event Protocol executable accountability semantics
+Author: JEP Runtime Contributors
+License: MIT
+Keywords: JEP,accountability,protocol,runtime,verification
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: filelock>=3.12
+
+# JEP Reference Runtime
+
+`jep-runtime` is a runnable reference implementation for the Judgment Event Protocol (JEP). It turns the current JEP Internet-Draft primitives — Judgment (`J`), Delegation (`D`), Termination (`T`), and Verification (`V`) — into executable accountability semantics: create an event, canonicalize it, hash it, chain it, archive it, replay it, and verify it across neutral profile adapters.
+
+This repository is intentionally **not** an agent framework, workflow orchestrator, blockchain, consensus layer, payment executor, or production security system. Mock signatures and mock credential references are provided so protocol semantics can be tested before deployment-specific cryptography is plugged in.
+
+## Architecture
+
+```text
++-------------------+      +------------------------+      +------------------+
+| Event Runtime     | ---> | Canonicalization       | ---> | SHA-256 Hashing  |
+| J / D / T / V     |      | UTF-8 sorted JSON      |      | event_hash       |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Delegation        | ---> | Append-only Archive    | ---> | Verification     |
+| scoped authority  |      | JSONL import/export    |      | chain/replay     |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Profile Adapters  | ---> | Replay Engine          | ---> | Conformance      |
+| OAuth/X509/DID/IAM|      | lineage graph/state    |      | vectors/report   |
++-------------------+      +------------------------+      +------------------+
+```
+
+## Runtime data flow
+
+1. A caller creates a `JEPEvent` with the required core fields.
+2. The event is canonicalized as normalized UTF-8 JSON with stable field ordering and no insignificant whitespace.
+3. `event_hash = SHA256(canonical_event_without_event_hash)` is assigned once; changing a hashed event requires creating a new event.
+4. New events reference `previous_event_hash`, producing an append-only event chain.
+5. Delegation events carry bounded `authority_scope` and `delegation_chain` entries so authority lineage can be replayed.
+6. JSONL archives append one canonical event record per line.
+7. Verification recomputes hashes, validates nonce uniqueness, checks hash continuity, validates delegation scope, and invokes the configured neutral profile adapter.
+
+## Replay flow
+
+```text
+archive.jsonl
+   |
+   v
+import events -> verify entire chain -> replay J/D/T/V semantics
+   |                  |                    |
+   |                  |                    +--> termination_state
+   |                  +--> tamper/nonce/profile/delegation errors
+   +--> lineage_graph: hash-chain edges + delegation edges
+```
+
+Run it with:
+
+```bash
+jep replay archive.jsonl
+```
+
+The replay output is a portable event lineage graph plus authority and termination state. It is evidence reconstruction, not workflow execution.
+
+## CLI
+
+```bash
+jep create-event --type J --actor human:alice --subject agent:planner \
+  --agent-id agent:planner \
+  --scope-json '{"actions":["read"],"resources":["repo:jep"]}' \
+  --intent-json '{"task":"summarize JEP"}' \
+  --archive archive.jsonl
+
+jep verify event.json
+jep archive-verify archive.jsonl
+jep replay archive.jsonl
+jep conformance-test
+```
+
+## Conformance matrix
+
+| Capability | Runtime check |
+| --- | --- |
+| Canonicalization | Stable UTF-8 JSON with sorted keys and normalized strings |
+| Deterministic hashing | SHA-256 over canonical event without `event_hash` |
+| Delegation semantics | Parent/child scope and expiration checks |
+| Verification semantics | Hash, nonce, timestamp, profile, and chain integrity checks |
+| Profile compatibility | Neutral `ProfileAdapter` contract with mock OAuth/OIDC, X509, DID/VC, Local IAM labels |
+| Replay correctness | Archive replay must re-verify the full chain and emit lineage graph/state |
+
+`jep conformance-test` emits test vectors, mock signed vectors, and a compatibility report.
+
+## Correspondence with the JEP draft
+
+| Draft primitive / concept | Runtime implementation |
+| --- | --- |
+| `J` Judgment | `EventType.JUDGMENT` and `create_event("J", ...)` |
+| `D` Delegation | `delegate_authority()`, scoped delegation events, `verify_delegation_chain()` |
+| `T` Termination | `EventType.TERMINATION`, replayed into `termination_state` |
+| `V` Verification | `verify_event()`, `verify_chain()`, `verify_replay()`, verification events |
+| Replay protection | Required `nonce` and duplicate nonce validation |
+| Signed/verifiable event format | Immutable hashed event model plus mock profile references |
+| Optional profiles | `ProfileAdapter` interface; provider-neutral mock adapter |
+| Append-only receipts | JSONL archive with chain verification on replay |
+
+## Repository structure
+
+```text
+jep_runtime/
+  core/                 # immutable event model and JSON schema generation
+  events/               # event factories
+  canonicalization/     # deterministic JSON + SHA-256 hashing
+  delegation/           # authority propagation and scope validation
+  verification/         # event, chain, replay, tamper, profile verification
+  profiles/             # provider-neutral profile adapter interface and mock adapter
+  archive/              # append-only JSONL archive runtime
+  replay/               # lineage graph and termination replay
+  conformance/          # conformance vectors and matrix
+  cli/                  # jep command line entry point
+  schemas/              # generated JSON schema
+examples/               # example event scenarios
+tests/                  # executable conformance/runtime tests
+```
+
+## Limitations
+
+- Signatures are mock/reference only.
+- Profile adapters do not verify real OAuth/OIDC, X509, DID/VC, or IAM credentials.
+- No blockchain, distributed consensus, real payment execution, or production key management is included.
+- The runtime enforces executable protocol invariants, not legal liability, governance policy, or workflow lifecycle orchestration.
+
+## Runtime governance extension points
+
+- Replace `MockProfileAdapter` with production credential adapters.
+- Add signature suites while preserving the canonicalization boundary.
+- Add draft-version-specific schema adapters without changing the pinned v06 J/D/T/V primitive meaning.
+- Add draft-version-specific schema adapters without changing J/D/T/V primitive meaning.
+- Publish conformance vectors for independent implementations.
+- Add governance-specific validation modules outside the core minimal runtime.
+
+## Runtime and verification notes
+
+See [HARDENING.md](HARDENING.md) for supported behavior, regression checks, and compatibility boundaries.

jep_runtime-0.1.1/README.md

@@ -0,0 +1,137 @@
+# JEP Reference Runtime
+
+`jep-runtime` is a runnable reference implementation for the Judgment Event Protocol (JEP). It turns the current JEP Internet-Draft primitives — Judgment (`J`), Delegation (`D`), Termination (`T`), and Verification (`V`) — into executable accountability semantics: create an event, canonicalize it, hash it, chain it, archive it, replay it, and verify it across neutral profile adapters.
+
+This repository is intentionally **not** an agent framework, workflow orchestrator, blockchain, consensus layer, payment executor, or production security system. Mock signatures and mock credential references are provided so protocol semantics can be tested before deployment-specific cryptography is plugged in.
+
+## Architecture
+
+```text
++-------------------+      +------------------------+      +------------------+
+| Event Runtime     | ---> | Canonicalization       | ---> | SHA-256 Hashing  |
+| J / D / T / V     |      | UTF-8 sorted JSON      |      | event_hash       |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Delegation        | ---> | Append-only Archive    | ---> | Verification     |
+| scoped authority  |      | JSONL import/export    |      | chain/replay     |
++---------+---------+      +-----------+------------+      +---------+--------+
+          |                            |                             |
+          v                            v                             v
++-------------------+      +------------------------+      +------------------+
+| Profile Adapters  | ---> | Replay Engine          | ---> | Conformance      |
+| OAuth/X509/DID/IAM|      | lineage graph/state    |      | vectors/report   |
++-------------------+      +------------------------+      +------------------+
+```
+
+## Runtime data flow
+
+1. A caller creates a `JEPEvent` with the required core fields.
+2. The event is canonicalized as normalized UTF-8 JSON with stable field ordering and no insignificant whitespace.
+3. `event_hash = SHA256(canonical_event_without_event_hash)` is assigned once; changing a hashed event requires creating a new event.
+4. New events reference `previous_event_hash`, producing an append-only event chain.
+5. Delegation events carry bounded `authority_scope` and `delegation_chain` entries so authority lineage can be replayed.
+6. JSONL archives append one canonical event record per line.
+7. Verification recomputes hashes, validates nonce uniqueness, checks hash continuity, validates delegation scope, and invokes the configured neutral profile adapter.
+
+## Replay flow
+
+```text
+archive.jsonl
+   |
+   v
+import events -> verify entire chain -> replay J/D/T/V semantics
+   |                  |                    |
+   |                  |                    +--> termination_state
+   |                  +--> tamper/nonce/profile/delegation errors
+   +--> lineage_graph: hash-chain edges + delegation edges
+```
+
+Run it with:
+
+```bash
+jep replay archive.jsonl
+```
+
+The replay output is a portable event lineage graph plus authority and termination state. It is evidence reconstruction, not workflow execution.
+
+## CLI
+
+```bash
+jep create-event --type J --actor human:alice --subject agent:planner \
+  --agent-id agent:planner \
+  --scope-json '{"actions":["read"],"resources":["repo:jep"]}' \
+  --intent-json '{"task":"summarize JEP"}' \
+  --archive archive.jsonl
+
+jep verify event.json
+jep archive-verify archive.jsonl
+jep replay archive.jsonl
+jep conformance-test
+```
+
+## Conformance matrix
+
+| Capability | Runtime check |
+| --- | --- |
+| Canonicalization | Stable UTF-8 JSON with sorted keys and normalized strings |
+| Deterministic hashing | SHA-256 over canonical event without `event_hash` |
+| Delegation semantics | Parent/child scope and expiration checks |
+| Verification semantics | Hash, nonce, timestamp, profile, and chain integrity checks |
+| Profile compatibility | Neutral `ProfileAdapter` contract with mock OAuth/OIDC, X509, DID/VC, Local IAM labels |
+| Replay correctness | Archive replay must re-verify the full chain and emit lineage graph/state |
+
+`jep conformance-test` emits test vectors, mock signed vectors, and a compatibility report.
+
+## Correspondence with the JEP draft
+
+| Draft primitive / concept | Runtime implementation |
+| --- | --- |
+| `J` Judgment | `EventType.JUDGMENT` and `create_event("J", ...)` |
+| `D` Delegation | `delegate_authority()`, scoped delegation events, `verify_delegation_chain()` |
+| `T` Termination | `EventType.TERMINATION`, replayed into `termination_state` |
+| `V` Verification | `verify_event()`, `verify_chain()`, `verify_replay()`, verification events |
+| Replay protection | Required `nonce` and duplicate nonce validation |
+| Signed/verifiable event format | Immutable hashed event model plus mock profile references |
+| Optional profiles | `ProfileAdapter` interface; provider-neutral mock adapter |
+| Append-only receipts | JSONL archive with chain verification on replay |
+
+## Repository structure
+
+```text
+jep_runtime/
+  core/                 # immutable event model and JSON schema generation
+  events/               # event factories
+  canonicalization/     # deterministic JSON + SHA-256 hashing
+  delegation/           # authority propagation and scope validation
+  verification/         # event, chain, replay, tamper, profile verification
+  profiles/             # provider-neutral profile adapter interface and mock adapter
+  archive/              # append-only JSONL archive runtime
+  replay/               # lineage graph and termination replay
+  conformance/          # conformance vectors and matrix
+  cli/                  # jep command line entry point
+  schemas/              # generated JSON schema
+examples/               # example event scenarios
+tests/                  # executable conformance/runtime tests
+```
+
+## Limitations
+
+- Signatures are mock/reference only.
+- Profile adapters do not verify real OAuth/OIDC, X509, DID/VC, or IAM credentials.
+- No blockchain, distributed consensus, real payment execution, or production key management is included.
+- The runtime enforces executable protocol invariants, not legal liability, governance policy, or workflow lifecycle orchestration.
+
+## Runtime governance extension points
+
+- Replace `MockProfileAdapter` with production credential adapters.
+- Add signature suites while preserving the canonicalization boundary.
+- Add draft-version-specific schema adapters without changing the pinned v06 J/D/T/V primitive meaning.
+- Add draft-version-specific schema adapters without changing J/D/T/V primitive meaning.
+- Publish conformance vectors for independent implementations.
+- Add governance-specific validation modules outside the core minimal runtime.
+
+## Runtime and verification notes
+
+See [HARDENING.md](HARDENING.md) for supported behavior, regression checks, and compatibility boundaries.

jep_runtime-0.1.1/jep_runtime/__init__.py

@@ -0,0 +1,21 @@
+"""JEP Reference Runtime.
+
+Executable, portable accountability runtime for Judgment, Delegation,
+Termination, and Verification events.
+"""
+
+from jep_runtime.core.event import EventType, JEPEvent
+from jep_runtime.events.factory import create_event
+from jep_runtime.canonicalization.json import canonicalize_event, compute_event_hash
+from jep_runtime.verification.runtime import verify_event, verify_chain, verify_replay
+
+__all__ = [
+    "EventType",
+    "JEPEvent",
+    "create_event",
+    "canonicalize_event",
+    "compute_event_hash",
+    "verify_event",
+    "verify_chain",
+    "verify_replay",
+]

jep_runtime-0.1.1/jep_runtime/archive/jsonl.py

@@ -0,0 +1,78 @@
+"""Append-only JSONL archive runtime."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from filelock import FileLock
+from jep_runtime.canonicalization.json import compute_event_hash
+from typing import Iterable
+
+from jep_runtime.core.event import JEPEvent
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import VerificationResult, verify_chain
+
+
+class JSONLArchive:
+    def __init__(self, path: str | Path):
+        self.path = Path(path).resolve()
+        self.path.parent.mkdir(parents=True, exist_ok=True)
+        self._lock = FileLock(str(self.path) + ".lock", timeout=10)
+
+    def append_event(self, event: JEPEvent) -> None:
+        with self._lock:
+            existing = self.import_archive()
+            previous = None
+            ids = set()
+            for candidate in [*existing, event]:
+                if candidate.event_hash != compute_event_hash(candidate) or candidate.previous_event_hash != previous:
+                    raise ValueError("archive hash mismatch or stale previous_event_hash")
+                if candidate.event_id in ids:
+                    raise ValueError("duplicate event identifier")
+                ids.add(candidate.event_id)
+                previous = candidate.event_hash
+            with self.path.open("a", encoding="utf-8") as handle:
+                handle.write(json.dumps(event.to_dict(), sort_keys=True, separators=(",", ":"), ensure_ascii=False, allow_nan=False) + "\n")
+
+    def import_archive(self) -> list[JEPEvent]:
+        with self._lock:
+            return self._read_archive()
+
+    def _read_archive(self) -> list[JEPEvent]:
+        if not self.path.exists():
+            return []
+        events: list[JEPEvent] = []
+        with self.path.open("r", encoding="utf-8") as handle:
+            for line in handle:
+                if line.strip():
+                    events.append(JEPEvent.from_dict(json.loads(line)))
+        return events
+
+    def export_archive(self) -> str:
+        return self.path.read_text(encoding="utf-8") if self.path.exists() else ""
+
+    def verify_archive(self) -> VerificationResult:
+        return verify_chain(self.import_archive())
+
+    def replay_archive(self) -> dict:
+        return replay_events(self.import_archive())
+
+
+def append_event(path: str | Path, event: JEPEvent) -> None:
+    JSONLArchive(path).append_event(event)
+
+
+def import_archive(path: str | Path) -> list[JEPEvent]:
+    return JSONLArchive(path).import_archive()
+
+
+def export_archive(path: str | Path) -> str:
+    return JSONLArchive(path).export_archive()
+
+
+def verify_archive(path: str | Path) -> VerificationResult:
+    return JSONLArchive(path).verify_archive()
+
+
+def replay_archive(path: str | Path) -> dict:
+    return JSONLArchive(path).replay_archive()

jep_runtime-0.1.1/jep_runtime/canonicalization/json.py

@@ -0,0 +1,39 @@
+"""Deterministic JSON canonicalization and SHA-256 event hashing."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import unicodedata
+from typing import Any, Mapping
+
+from jep_runtime.core.event import JEPEvent
+
+
+def _normalize(value: Any) -> Any:
+    if isinstance(value, str):
+        return unicodedata.normalize("NFC", value)
+    if isinstance(value, Mapping):
+        return {unicodedata.normalize("NFC", str(k)): _normalize(v) for k, v in value.items()}
+    if isinstance(value, list | tuple):
+        return [_normalize(v) for v in value]
+    return value
+
+
+def canonicalize_event(event: JEPEvent | Mapping[str, Any], *, include_hash: bool = False) -> bytes:
+    """Canonicalize an event as UTF-8 JSON with stable ordering and no whitespace."""
+
+    if isinstance(event, JEPEvent):
+        data = event.to_dict(include_hash=include_hash)
+    else:
+        data = dict(event)
+        if not include_hash:
+            data.pop("event_hash", None)
+    normalized = _normalize(data)
+    return json.dumps(normalized, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def compute_event_hash(event: JEPEvent | Mapping[str, Any]) -> str:
+    """Compute a platform-stable SHA-256 hash over canonical event JSON."""
+
+    return hashlib.sha256(canonicalize_event(event, include_hash=False)).hexdigest()

jep_runtime-0.1.1/jep_runtime/cli/main.py

@@ -0,0 +1,97 @@
+"""Command line interface for the JEP Reference Runtime."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+
+from jep_runtime.archive.jsonl import JSONLArchive
+from jep_runtime.conformance.runtime import run_conformance
+from jep_runtime.core.event import JEPEvent
+from jep_runtime.events.factory import create_event
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import verify_event
+
+
+def _load_event(path: str) -> JEPEvent:
+    with open(path, "r", encoding="utf-8") as handle:
+        return JEPEvent.from_dict(json.load(handle))
+
+
+def _print(data: object) -> None:
+    print(json.dumps(data, indent=2, sort_keys=True, ensure_ascii=False))
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="jep", description="JEP Reference Runtime CLI")
+    sub = parser.add_subparsers(dest="command", required=True)
+
+    create = sub.add_parser("create-event", help="Create and hash a J/D/T/V event")
+    create.add_argument("--type", required=True, choices=["J", "D", "T", "V"])
+    create.add_argument("--actor", required=True)
+    create.add_argument("--subject", required=True)
+    create.add_argument("--agent-id")
+    create.add_argument("--session-id")
+    create.add_argument("--scope-json", default="{}")
+    create.add_argument("--intent-json", default="{}")
+    create.add_argument("--justification", default="")
+    create.add_argument("--previous-event-hash")
+    create.add_argument("--profile", default="mock")
+    create.add_argument("--credential-reference")
+    create.add_argument("--archive", help="Append created event to JSONL archive")
+
+    verify = sub.add_parser("verify", help="Verify one event JSON file")
+    verify.add_argument("event")
+
+    replay = sub.add_parser("replay", help="Replay a JSONL archive")
+    replay.add_argument("archive")
+
+    archive_verify = sub.add_parser("archive-verify", help="Verify an append-only JSONL archive")
+    archive_verify.add_argument("archive")
+
+    sub.add_parser("conformance-test", help="Run conformance suite and emit vectors/report")
+    return parser
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = build_parser().parse_args(argv)
+    if args.command == "create-event":
+        event = create_event(
+            args.type,
+            actor=args.actor,
+            subject=args.subject,
+            agent_id=args.agent_id,
+            session_id=args.session_id,
+            authority_scope=json.loads(args.scope_json),
+            intent=json.loads(args.intent_json),
+            justification=args.justification,
+            previous_event_hash=args.previous_event_hash,
+            profile=args.profile,
+            credential_reference=args.credential_reference,
+        )
+        if args.archive:
+            JSONLArchive(args.archive).append_event(event)
+        _print(event.to_dict())
+        return 0
+    if args.command == "verify":
+        result = verify_event(_load_event(args.event))
+        _print({"valid": result.valid, "errors": list(result.errors)})
+        return 0 if result.valid else 1
+    if args.command == "replay":
+        archive = JSONLArchive(args.archive)
+        _print(archive.replay_archive())
+        return 0 if archive.verify_archive().valid else 1
+    if args.command == "archive-verify":
+        result = JSONLArchive(args.archive).verify_archive()
+        _print({"valid": result.valid, "errors": list(result.errors)})
+        return 0 if result.valid else 1
+    if args.command == "conformance-test":
+        report = run_conformance()
+        _print(report)
+        return 0 if report["passed"] else 1
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv[1:]))

jep_runtime-0.1.1/jep_runtime/conformance/runtime.py

@@ -0,0 +1,71 @@
+"""Conformance vectors and checks for interoperable JEP runtimes."""
+
+from __future__ import annotations
+
+from jep_runtime.canonicalization.json import canonicalize_event, compute_event_hash
+from jep_runtime.core.event import EventType
+from jep_runtime.delegation.runtime import delegate_authority, verify_delegation_chain
+from jep_runtime.events.factory import create_event
+from jep_runtime.profiles.adapter import MockProfileAdapter
+from jep_runtime.replay.engine import replay_events
+from jep_runtime.verification.runtime import verify_chain, verify_event
+
+
+def generate_test_vectors() -> dict:
+    adapter = MockProfileAdapter()
+    ref = adapter.issue_reference("human:alice", "mock")
+    root = create_event(
+        EventType.JUDGMENT,
+        actor="human:alice",
+        subject="agent:planner",
+        agent_id="agent:planner",
+        session_id="session:conformance",
+        authority_scope={"actions": ["read", "summarize"], "resources": ["repo:jep"], "valid_until": 4102444800},
+        intent={"task": "summarize current JEP draft"},
+        justification="human delegated bounded judgment authority",
+        timestamp=1700000000,
+        nonce="00000000-0000-4000-8000-000000000001",
+        profile="mock",
+        credential_reference=ref,
+    )
+    child = delegate_authority(root, delegatee="agent:worker", agent_id="agent:worker", scope={"actions": ["read"], "resources": ["repo:jep"], "valid_until": 4102444700})
+    verify = create_event(
+        EventType.VERIFICATION,
+        actor="verifier:local",
+        subject=child.subject,
+        agent_id=child.agent_id,
+        session_id=root.session_id,
+        delegation_chain=child.delegation_chain,
+        authority_scope=child.authority_scope,
+        intent={"target_event_hash": child.event_hash, "result": "VALID"},
+        previous_event_hash=child.event_hash,
+        timestamp=child.timestamp + 1,
+        nonce="00000000-0000-4000-8000-000000000003",
+        profile="mock",
+        credential_reference=ref,
+    )
+    return {
+        "events": [root.to_dict(), child.to_dict(), verify.to_dict()],
+        "canonical_root": canonicalize_event(root).decode("utf-8"),
+        "root_hash": root.event_hash,
+    }
+
+
+def run_conformance() -> dict:
+    vectors = generate_test_vectors()
+    reconstructed = [__import__("jep_runtime.core.event", fromlist=["JEPEvent"]).JEPEvent.from_dict(e) for e in vectors["events"]]
+    matrix = {
+        "canonicalization": canonicalize_event(reconstructed[0]).decode("utf-8") == vectors["canonical_root"],
+        "deterministic_hashing": compute_event_hash(reconstructed[0]) == vectors["root_hash"],
+        "delegation_semantics": verify_delegation_chain(reconstructed[:2])[0],
+        "verification_semantics": verify_event(reconstructed[2]).valid,
+        "profile_compatibility": verify_chain(reconstructed).valid,
+        "replay_correctness": replay_events(reconstructed)["valid"],
+    }
+    return {
+        "passed": all(matrix.values()),
+        "matrix": matrix,
+        "test_vectors": vectors,
+        "signed_vectors": {"mode": "mock", "signature": "mock-signature-over-canonical-vectors"},
+        "compatibility_report": "reference runtime uses stable UTF-8 sorted JSON, SHA-256, JSONL archives, and neutral mock profiles",
+    }