From 9d65044eddc2230ef3a3ef8be78d3ab188e7c24b Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:36:40 +0530 Subject: [PATCH 1/2] docs: clarify authority runner execution provenance boundary Signed-off-by: Srinivasa Dinakar Jainti --- integrations/alakris-authority-comparison/README.md | 8 ++++++++ .../alakris-authority-comparison/comparison-contract.json | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/integrations/alakris-authority-comparison/README.md b/integrations/alakris-authority-comparison/README.md index d6302b0c..1c71563d 100644 --- a/integrations/alakris-authority-comparison/README.md +++ b/integrations/alakris-authority-comparison/README.md @@ -44,6 +44,14 @@ Four cases: binding veto; revoked authority with stale evidence and valid contro The evidence basis is separate (`author_record`, `synthetic_fixture`; actual native execution provenance is kept separately). A publisher's `SUPPORTED` result is retained as `publisher_claim`; it is not promoted to independent validation. Reference fixtures exercise a synthetic counter, not an Alakris production deployment or a completed matched scientific experiment. +### Independent execution reporting boundary + +`independent_live_reproduction` is a reporting assertion supplied by the report producer. `validate_report()` checks required case fields and evidence states and rejects a true flag unless `basis="independent_run"`; it does not authenticate the producer, resolve native execution artifacts, or verify their binding to the reported cases. A report with `basis="independent_run"` and a true flag can therefore pass this validator without supporting execution provenance. Validator acceptance alone does not establish independent execution. + +The current MintID and Proofable adapters emit `basis="author_record"` and `independent_live_reproduction=false`. Offline signature appraisal of their published bytes does not change that execution status. Consumers must not infer an independently reproduced run from the flag or from successful case validation alone. + +An evidence-backed execution status would require a separately reviewed provenance-appraisal layer that binds operator identity and independence, exact implementation revision, invocation and environment, and retained artifacts to the reported cases, with positive and negative controls. This package does not implement that layer. Its schema and verification policy remain future work for maintainer review; the reporting flag cannot substitute for it. + MintID root epoch/height, root age, freshness limits, t0 definition, observed refusal and bound remain distinct. First-refusal observations are single-run measurements, not an end-to-end revocation SLA. Emergency bounds remain block-based and are never interpreted as a zero-second deadline. Original source revision, published evidence commit and live service build are separate pins. Old `public-v2026-10-05.5` outage evidence is not a result for the current `public-v2026-10-06.2` verifier. Refusal of a presentation does not establish that an external executor suppresses an effect. A post-dispatch accepted decision is not retroactively revoked by MintID; the relying party owns that boundary. The synthetic executor rechecks expiry and revocation at commit, binds issued dispatch tokens to the action digest, refuses a veto, and deduplicates committed effects. Late recovery cannot reopen the original expired request. Its valid-control test must commit exactly once. diff --git a/integrations/alakris-authority-comparison/comparison-contract.json b/integrations/alakris-authority-comparison/comparison-contract.json index da3f0946..fd218113 100644 --- a/integrations/alakris-authority-comparison/comparison-contract.json +++ b/integrations/alakris-authority-comparison/comparison-contract.json @@ -38,7 +38,7 @@ "retry_count", "duplicate_count" ], - "native_provenance": "Recorded separately; an importer flag cannot establish independent execution", + "native_provenance": "Recorded separately; an importer flag cannot establish independent execution. independent_live_reproduction is a producer-supplied reporting assertion: validate_report checks basis consistency but does not verify execution provenance. Acceptance is not evidence of independent execution; a separately reviewed provenance-appraisal layer is not implemented here.", "fixture_source_policy": "Fetch immutable vendor URLs, keep original bytes and declared hashes", "record_scope": "Case-level appraisal only; per-attempt native records and the upstream authority/effect/terminal contract remain separate." } From b0a10723d3d4b25e155fc65851efaf307e4db517 Mon Sep 17 00:00:00 2001 From: Srinivasa Consultants <78673153+dinakarjs@users.noreply.github.com> Date: Tue, 13 Oct 2026 23:42:08 +0530 Subject: [PATCH 2/2] fix: regenerate merged Marketplace catalog count Signed-off-by: Srinivasa Dinakar Jainti --- marketplace/catalog.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/marketplace/catalog.json b/marketplace/catalog.json index 2b252240..98744779 100644 --- a/marketplace/catalog.json +++ b/marketplace/catalog.json @@ -1,6 +1,6 @@ { "catalog_version": 1, - "count": 46, + "count": 47, "integrations": [ { "name": "Claude Code",