{
  "tool_id": "art-502-bind-attested-subject",
  "note": "Vectors computed directly from the shipped kernel. pinned-derived-inputs and pinned-declared-inputs exercise the two routes to inputs_digest; unpinned-no-manifest-digest exercises the unpinned producer path; malformed-content-digest-hashed-verbatim proves a malformed digest is reported and hashed as declared rather than rewritten; extra-caller-keys-cannot-reach-the-preimage proves the three-member preimage is closed against a caller-supplied run identifier, host and timestamp -- its subject_hash is byte-identical to pinned-declared-inputs. All values are SYNTHETIC.",
  "vectors": [
    {
      "name": "pinned-derived-inputs",
      "description": "A fully pinned producer whose inputs are supplied, so inputs_digest is derived here through the one canonical JCS path. Binding complete.",
      "policy_parameters": {
        "tool_ref": {
          "tool_id": "acme-safeguarding-recon",
          "tool_version": "4.2.0",
          "entry": "buildClientMoneyRecon",
          "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        },
        "producer_inputs": {
          "as_of": "2026-06-30",
          "ledger_ref": "LEDGER-SYNTH-0001",
          "accounts": [
            "ACC-SYNTH-1",
            "ACC-SYNTH-2"
          ]
        },
        "artifact": {
          "content_type": "application/pdf",
          "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
        }
      },
      "output_payload": {
        "subject_hash": "sha256:a6b78068a516a9935b9d10d00d6ddc59dc8b70aa8ea203e9a3cde1eb32beaddb",
        "subject_preimage": {
          "tool_ref": {
            "tool_id": "acme-safeguarding-recon",
            "tool_version": "4.2.0",
            "entry": "buildClientMoneyRecon",
            "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "inputs_digest": "sha256:767474f741796be7a07d007c9bf60bcfcd5260a52f344c1fab11f01b8a8e56bd",
          "artifact": {
            "content_type": "application/pdf",
            "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
          }
        },
        "preimage_member_count": 3,
        "inputs_digest_source": "derived",
        "producer_pinned": true,
        "binding_complete": true,
        "findings": [],
        "rationale": [
          "The subject identifier is sha256 over the JCS canonicalisation of exactly three members: tool_ref, inputs_digest and artifact. No wall clock, no run identifier and no host or session state enters it, so a verifier that never executed the producer recomputes the same value offline from subject_preimage alone.",
          "The producer is pinned: tool_ref.manifest_digest is present and well formed, so a changed producer build yields a different subject identifier.",
          "inputs_digest was derived here from the supplied producer inputs through the one canonical JCS path.",
          "This is a subject-identification result only. It evidences producer pinning, input binding and content integrity. It does NOT evidence that the producer's arithmetic is correct, and it is not a claim that any regulator has accepted the artifact."
        ],
        "no_arithmetic_claim": "An attested-artifact subject carries no §18 compute proof and no §16/§17 re-execution claim. It evidences producer pinning, input binding and content integrity, never that the producer's arithmetic is correct. This artifact deliberately omits replay_verified rather than setting it false, because no replay was attempted.",
        "note": "Computes the SPEC.md §27.4 attested-artifact subject identifier for the sealed output of a pinned non-OCG producer, on the one canonical hash path: sha256(JCS({tool_ref, inputs_digest, artifact})), three members exhaustively. Digest strings are hashed verbatim as declared and are never rewritten, so a malformed digest is reported rather than silently normalised. This tool identifies a subject so that separately signed §27 approval records can name it; it neither signs anything itself nor asserts that any filing requirement is met."
      },
      "golden_hash": "54cac7c50db1243052c085db8feef134fbb6ad0047c3caee98272e2e7f596ee3"
    },
    {
      "name": "pinned-declared-inputs",
      "description": "Producer inputs are private, so only their digest is shareable and inputs_digest is declared rather than derived. Binding complete.",
      "policy_parameters": {
        "tool_ref": {
          "tool_id": "acme-safeguarding-recon",
          "tool_version": "4.2.0",
          "entry": "buildClientMoneyRecon",
          "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        },
        "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
        "artifact": {
          "content_type": "application/pdf",
          "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
        }
      },
      "output_payload": {
        "subject_hash": "sha256:e128cb9c5c41094374580d7a59140bcafd2bd334b8d03c80a272d309e9fea4fd",
        "subject_preimage": {
          "tool_ref": {
            "tool_id": "acme-safeguarding-recon",
            "tool_version": "4.2.0",
            "entry": "buildClientMoneyRecon",
            "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "artifact": {
            "content_type": "application/pdf",
            "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
          }
        },
        "preimage_member_count": 3,
        "inputs_digest_source": "declared",
        "producer_pinned": true,
        "binding_complete": true,
        "findings": [],
        "rationale": [
          "The subject identifier is sha256 over the JCS canonicalisation of exactly three members: tool_ref, inputs_digest and artifact. No wall clock, no run identifier and no host or session state enters it, so a verifier that never executed the producer recomputes the same value offline from subject_preimage alone.",
          "The producer is pinned: tool_ref.manifest_digest is present and well formed, so a changed producer build yields a different subject identifier.",
          "inputs_digest was declared by the caller rather than derived, which is the correct route when the producer inputs are private and only their digest is shareable.",
          "This is a subject-identification result only. It evidences producer pinning, input binding and content integrity. It does NOT evidence that the producer's arithmetic is correct, and it is not a claim that any regulator has accepted the artifact."
        ],
        "no_arithmetic_claim": "An attested-artifact subject carries no §18 compute proof and no §16/§17 re-execution claim. It evidences producer pinning, input binding and content integrity, never that the producer's arithmetic is correct. This artifact deliberately omits replay_verified rather than setting it false, because no replay was attempted.",
        "note": "Computes the SPEC.md §27.4 attested-artifact subject identifier for the sealed output of a pinned non-OCG producer, on the one canonical hash path: sha256(JCS({tool_ref, inputs_digest, artifact})), three members exhaustively. Digest strings are hashed verbatim as declared and are never rewritten, so a malformed digest is reported rather than silently normalised. This tool identifies a subject so that separately signed §27 approval records can name it; it neither signs anything itself nor asserts that any filing requirement is met."
      },
      "golden_hash": "7a266a9579341fa291b9ddeef70e9e9e4033200fd6720e2c78787038898399a8"
    },
    {
      "name": "unpinned-no-manifest-digest",
      "description": "The producer declares no manifest_digest, so the binding covers the output but not the thing that made it. producer_pinned is false and the defect is named.",
      "policy_parameters": {
        "tool_ref": {
          "tool_id": "spreadsheet-export",
          "tool_version": "1.0.0",
          "entry": "exportSheet"
        },
        "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
        "artifact": {
          "content_type": "text/csv",
          "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
        }
      },
      "output_payload": {
        "subject_hash": "sha256:8803319f05d044ae18f0ce5fdd1946b5e75853cbb8db69d280ab2e786a787075",
        "subject_preimage": {
          "tool_ref": {
            "tool_id": "spreadsheet-export",
            "tool_version": "1.0.0",
            "entry": "exportSheet",
            "manifest_digest": null
          },
          "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "artifact": {
            "content_type": "text/csv",
            "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
          }
        },
        "preimage_member_count": 3,
        "inputs_digest_source": "declared",
        "producer_pinned": false,
        "binding_complete": false,
        "findings": [
          {
            "code": "MANIFEST_DIGEST_ABSENT",
            "field": "tool_ref.manifest_digest",
            "detail": "The producer is NOT pinned: manifest_digest is the chainless analogue of the SPEC.md §17 kernel_digest and is what makes the producer tamper-evident, not merely its output."
          }
        ],
        "rationale": [
          "The subject identifier is sha256 over the JCS canonicalisation of exactly three members: tool_ref, inputs_digest and artifact. No wall clock, no run identifier and no host or session state enters it, so a verifier that never executed the producer recomputes the same value offline from subject_preimage alone.",
          "The producer is NOT pinned. Without a well-formed tool_ref.manifest_digest the binding covers the output but not the thing that made it.",
          "inputs_digest was declared by the caller rather than derived, which is the correct route when the producer inputs are private and only their digest is shareable.",
          "This is a subject-identification result only. It evidences producer pinning, input binding and content integrity. It does NOT evidence that the producer's arithmetic is correct, and it is not a claim that any regulator has accepted the artifact."
        ],
        "no_arithmetic_claim": "An attested-artifact subject carries no §18 compute proof and no §16/§17 re-execution claim. It evidences producer pinning, input binding and content integrity, never that the producer's arithmetic is correct. This artifact deliberately omits replay_verified rather than setting it false, because no replay was attempted.",
        "note": "Computes the SPEC.md §27.4 attested-artifact subject identifier for the sealed output of a pinned non-OCG producer, on the one canonical hash path: sha256(JCS({tool_ref, inputs_digest, artifact})), three members exhaustively. Digest strings are hashed verbatim as declared and are never rewritten, so a malformed digest is reported rather than silently normalised. This tool identifies a subject so that separately signed §27 approval records can name it; it neither signs anything itself nor asserts that any filing requirement is met."
      },
      "golden_hash": "8bb02b002d5cf1bc705725a94142fef0a3c3b484297ec8bd9aad3eb6c65ab415"
    },
    {
      "name": "malformed-content-digest-hashed-verbatim",
      "description": "A malformed content_digest is reported and still hashed verbatim as declared, never silently rewritten.",
      "policy_parameters": {
        "tool_ref": {
          "tool_id": "acme-safeguarding-recon",
          "tool_version": "4.2.0",
          "entry": "buildClientMoneyRecon",
          "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
        },
        "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
        "artifact": {
          "content_type": "application/pdf",
          "content_digest": "SHA256-BBBB"
        }
      },
      "output_payload": {
        "subject_hash": "sha256:5a78b871379834982df24ac8c2a85eb1cfaa2fd2ae0f6c50c9b9dbcbdfecfaeb",
        "subject_preimage": {
          "tool_ref": {
            "tool_id": "acme-safeguarding-recon",
            "tool_version": "4.2.0",
            "entry": "buildClientMoneyRecon",
            "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "artifact": {
            "content_type": "application/pdf",
            "content_digest": "SHA256-BBBB"
          }
        },
        "preimage_member_count": 3,
        "inputs_digest_source": "declared",
        "producer_pinned": true,
        "binding_complete": false,
        "findings": [
          {
            "code": "CONTENT_DIGEST_MALFORMED",
            "field": "artifact.content_digest",
            "detail": "Expected a \"sha256:\" prefix followed by 64 lowercase hex characters. The value was hashed verbatim as declared and was NOT rewritten."
          }
        ],
        "rationale": [
          "The subject identifier is sha256 over the JCS canonicalisation of exactly three members: tool_ref, inputs_digest and artifact. No wall clock, no run identifier and no host or session state enters it, so a verifier that never executed the producer recomputes the same value offline from subject_preimage alone.",
          "The producer is pinned: tool_ref.manifest_digest is present and well formed, so a changed producer build yields a different subject identifier.",
          "inputs_digest was declared by the caller rather than derived, which is the correct route when the producer inputs are private and only their digest is shareable.",
          "This is a subject-identification result only. It evidences producer pinning, input binding and content integrity. It does NOT evidence that the producer's arithmetic is correct, and it is not a claim that any regulator has accepted the artifact."
        ],
        "no_arithmetic_claim": "An attested-artifact subject carries no §18 compute proof and no §16/§17 re-execution claim. It evidences producer pinning, input binding and content integrity, never that the producer's arithmetic is correct. This artifact deliberately omits replay_verified rather than setting it false, because no replay was attempted.",
        "note": "Computes the SPEC.md §27.4 attested-artifact subject identifier for the sealed output of a pinned non-OCG producer, on the one canonical hash path: sha256(JCS({tool_ref, inputs_digest, artifact})), three members exhaustively. Digest strings are hashed verbatim as declared and are never rewritten, so a malformed digest is reported rather than silently normalised. This tool identifies a subject so that separately signed §27 approval records can name it; it neither signs anything itself nor asserts that any filing requirement is met."
      },
      "golden_hash": "23191291cd503d4de0e23835bac04c9ff7034ae6abcc65613ec08dc38f302b1b"
    },
    {
      "name": "extra-caller-keys-cannot-reach-the-preimage",
      "description": "The caller adds a run identifier and a timestamp at both the top level and inside tool_ref. The preimage is built from a fixed key list, so the subject_hash is byte-identical to pinned-declared-inputs.",
      "policy_parameters": {
        "tool_ref": {
          "tool_id": "acme-safeguarding-recon",
          "tool_version": "4.2.0",
          "entry": "buildClientMoneyRecon",
          "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
          "run_id": "RUN-SYNTH-9",
          "host": "synthetic-host"
        },
        "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
        "artifact": {
          "content_type": "application/pdf",
          "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
        },
        "generated_at": "2026-07-30T00:00:00Z",
        "run_id": "RUN-SYNTH-9"
      },
      "output_payload": {
        "subject_hash": "sha256:e128cb9c5c41094374580d7a59140bcafd2bd334b8d03c80a272d309e9fea4fd",
        "subject_preimage": {
          "tool_ref": {
            "tool_id": "acme-safeguarding-recon",
            "tool_version": "4.2.0",
            "entry": "buildClientMoneyRecon",
            "manifest_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
          },
          "inputs_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
          "artifact": {
            "content_type": "application/pdf",
            "content_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
          }
        },
        "preimage_member_count": 3,
        "inputs_digest_source": "declared",
        "producer_pinned": true,
        "binding_complete": true,
        "findings": [],
        "rationale": [
          "The subject identifier is sha256 over the JCS canonicalisation of exactly three members: tool_ref, inputs_digest and artifact. No wall clock, no run identifier and no host or session state enters it, so a verifier that never executed the producer recomputes the same value offline from subject_preimage alone.",
          "The producer is pinned: tool_ref.manifest_digest is present and well formed, so a changed producer build yields a different subject identifier.",
          "inputs_digest was declared by the caller rather than derived, which is the correct route when the producer inputs are private and only their digest is shareable.",
          "This is a subject-identification result only. It evidences producer pinning, input binding and content integrity. It does NOT evidence that the producer's arithmetic is correct, and it is not a claim that any regulator has accepted the artifact."
        ],
        "no_arithmetic_claim": "An attested-artifact subject carries no §18 compute proof and no §16/§17 re-execution claim. It evidences producer pinning, input binding and content integrity, never that the producer's arithmetic is correct. This artifact deliberately omits replay_verified rather than setting it false, because no replay was attempted.",
        "note": "Computes the SPEC.md §27.4 attested-artifact subject identifier for the sealed output of a pinned non-OCG producer, on the one canonical hash path: sha256(JCS({tool_ref, inputs_digest, artifact})), three members exhaustively. Digest strings are hashed verbatim as declared and are never rewritten, so a malformed digest is reported rather than silently normalised. This tool identifies a subject so that separately signed §27 approval records can name it; it neither signs anything itself nor asserts that any filing requirement is met."
      },
      "golden_hash": "0692e0982ab2ce4656ef878f7684578800ca388a7b8baac1f15dd29c341d1af8"
    }
  ]
}