{ "tool_id": "art-503-build-dual-control-certification", "note": "Vectors computed directly from the shipped kernel. They prove, in order: the N=2 dual control case; repeated-identity collapse; key-rotation collapse; that an under-threshold gate does not auto-pass; that an approval declaring signed true with no proof is rejected; section 27.8 parity with and without a delegating mandate, plus the wrong-role and lapsed-window mandate paths; that an agent preparer can never approve its own output; that a read-only examiner role cannot satisfy a threshold; the rejection, override and foreign-subject non-count paths; and the finite gate on empty input. All values are SYNTHETIC.", "vectors": [ { "name": "dual-control-two-distinct-humans-satisfied", "description": "The N=2 case SPEC.md section 27.3 names: two distinct human identities each file a signed approval in the required role over the same subject. The threshold is satisfied and nothing is collapsed.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefFinanceSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct attestor identities is required over this subject." }, "threshold_satisfied": true, "distinct_identities_counted": 2, "threshold_shortfall": 0, "counted_identities": [ "did:key:zChiefExecSynth", "did:key:zChiefFinanceSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" }, { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "actor_type": "human", "verification_method": "did:key:zChiefFinanceSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 2, "counted_record_count": 2, "distinct_identities_counted": 2, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "2 distinct attestor identities each filed a signed approval record over this subject, which meets the required threshold of 2.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "2 distinct attestor identities each filed a signed approval record over this subject, which meets the required threshold of 2.", "2 records supplied: 2 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_SATISFIED", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "db6f33e5a2296b7354b46dad7bca984d9ded2b0e9178a224f970c7391e454e07" }, { "name": "repeated-identity-collapses-to-one", "description": "One human signs twice with the SAME key. Distinctness is by identity, so two records collapse to one approver and the dual control threshold is UNSATISFIED. This is the repeated-identity proof.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 1, "threshold_shortfall": 1, "counted_identities": [ "did:key:zChiefExecSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" }, { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa02", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" } ], "duplicate_identities_collapsed": [ { "identity_id": "did:key:zChiefExecSynth", "records_supplied": 2, "counted_as": 1, "record_refs": [ "sha256:aa01", "sha256:aa02" ], "distinct_verification_methods": [ "did:key:zChiefExecSynth#key-1" ], "key_rotation_observed": false, "finding": "This identity filed 2 approval records over this subject. One human signing twice is still one approver, so the identity counts once toward the threshold." } ], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 2, "counted_record_count": 2, "distinct_identities_counted": 1, "duplicate_identity_count": 1, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "2 records supplied: 2 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "1 identity filed more than one approval and was collapsed to a single approver each. Counting is by distinct identity, never by record and never by key.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_DUPLICATE_IDENTITY_COLLAPSED", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "bd77cb70553fc7d1081751b74e3dafdbcdbefbdc1b900af5775a81a2c7f69c7c" }, { "name": "key-rotation-collapses-to-one", "description": "One human signs twice under two DIFFERENT verification methods. Different keys are still one person, so the identity counts once and the threshold is UNSATISFIED. This is the key-rotation proof.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-2", "proofValue": "zSYNTHETICKEY-2" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 1, "threshold_shortfall": 1, "counted_identities": [ "did:key:zChiefExecSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" }, { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa02", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-2" } ], "duplicate_identities_collapsed": [ { "identity_id": "did:key:zChiefExecSynth", "records_supplied": 2, "counted_as": 1, "record_refs": [ "sha256:aa01", "sha256:aa02" ], "distinct_verification_methods": [ "did:key:zChiefExecSynth#key-1", "did:key:zChiefExecSynth#key-2" ], "key_rotation_observed": true, "finding": "This identity signed 2 times using 2 different verification methods. Different keys are still one person, so the identity counts once toward the threshold." } ], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 2, "counted_record_count": 2, "distinct_identities_counted": 1, "duplicate_identity_count": 1, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "2 records supplied: 2 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "1 identity filed more than one approval and was collapsed to a single approver each, including 1 that signed under more than one verification method. Counting is by distinct identity, never by record and never by key.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_DUPLICATE_IDENTITY_COLLAPSED", "HA_KEY_ROTATION_COLLAPSED_TO_ONE_IDENTITY", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "3e3f2ab43eb790d6c7869c5511fbd64300368664fe20ed743805782a511f8bed" }, { "name": "under-threshold-does-not-auto-pass", "description": "A single distinct approver against a threshold of two. The gate is UNSATISFIED with a stated shortfall and never falls through to a default pass.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 1, "threshold_shortfall": 1, "counted_identities": [ "did:key:zChiefExecSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 1, "counted_record_count": 1, "distinct_identities_counted": 1, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "1 record supplied: 1 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "a883c1c412abde0ece44f0e80c97ea8c892809281b326fa91ee3823342abeacd" }, { "name": "unsigned-approval-rejected-despite-declaration", "description": "Two records: one signed, one that declares signed true and carries no section 16 proof. The declaration is not the evidence, so the record is rejected into unsigned_records_rejected and the threshold is UNSATISFIED.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333" } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 1, "threshold_shortfall": 1, "counted_identities": [ "did:key:zChiefExecSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [ { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefFinanceSynth", "role": "attestor", "declared_signed": true, "reason": "The record declares signed true but carries no section 16 eddsa-jcs-2022 proof bound to the named identity. The declaration is not the evidence, so the record is rejected and the disagreement is reported here." } ], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 2, "counted_record_count": 1, "distinct_identities_counted": 1, "duplicate_identity_count": 0, "unsigned_rejected_count": 1, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 1 distinct attestor identity can be counted against a required threshold of 2. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "2 records supplied: 1 counted, 1 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "An unsigned approval record is not conformant section 27 evidence. Rejected records are listed with their reason rather than dropped, because a firm needs to know which signature it thought it had.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_UNSIGNED_RECORD_REJECTED", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "d40f9a5ce61f1b691daec5341d3a8dcc6fbdd2d236e8d24b34c296fe85cc94e3" }, { "name": "agent-without-delegating-mandate-not-counted", "description": "Section 27.8 with NO mandate: an agent-signed approval is carried and not counted, so a threshold of one is UNSATISFIED and the gate still requires a named human.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "signed": true, "actor_type": "agent", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zAgentFilerSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 0, "threshold_shortfall": 1, "counted_identities": [], "counted_records": [], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [ { "code": "HA_AGENT_WITHOUT_HUMAN_ROLE_MANDATE", "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "mandate_hash": null, "detail": "An agent identity filed this approval and carries no section 22 delegation mandate. Under SPEC.md section 27.8 the gate requires a named human, so the record is carried and is not counted." } ], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 1, "counted_record_count": 0, "distinct_identities_counted": 0, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 1 }, "verdict_reason": "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "1 record supplied: 0 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "Section 27.8 parity was applied to every agent-filed record. An agent counts toward a threshold only under a signed human-principal mandate delegating this exact role inside a validity window, and an agent that prepared the subject can never approve it.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_AGENT_WITHOUT_HUMAN_ROLE_MANDATE" ], "golden_hash": "b772f2111e60d025e1aa39faaa08ec5a4b8fda460eaee1bac81218183a72aea1" }, { "name": "agent-with-delegating-mandate-counted", "description": "Section 27.8 WITH a mandate: a human principal delegated this exact role in a signed mandate whose window contains the as-of date, so the agent record counts and the threshold of one is SATISFIED. Paired with the vector above, this is the with-and-without proof.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "signed": true, "actor_type": "agent", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zAgentFilerSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } }, "delegation_mandate": { "mandate_hash": "sha256:m001", "granted_role": "attestor", "principal_identity_id": "did:key:zBoardPrincipalSynth", "principal_actor_type": "human", "valid_from": "2027-01-01", "valid_until": "2027-12-31", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zBoardPrincipalSynth#key-p1", "proofValue": "zSYNTHETICKEY-P1" } } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": true, "distinct_identities_counted": 1, "threshold_shortfall": 0, "counted_identities": [ "did:key:zAgentFilerSynth" ], "counted_records": [ { "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "actor_type": "agent", "verification_method": "did:key:zAgentFilerSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [ { "code": "HA_AGENT_COUNTED_UNDER_HUMAN_MANDATE", "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "mandate_hash": "sha256:m001", "detail": "A human principal delegated the role attestor to this agent in a signed mandate valid from 2027-01-01 to 2027-12-31, and the as-of date 2027-02-15 falls inside it, so the record counts toward the threshold." } ], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 1, "counted_record_count": 1, "distinct_identities_counted": 1, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 1 }, "verdict_reason": "1 distinct attestor identities each filed a signed approval record over this subject, which meets the required threshold of 1.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "1 distinct attestor identities each filed a signed approval record over this subject, which meets the required threshold of 1.", "1 record supplied: 1 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "Section 27.8 parity was applied to every agent-filed record. An agent counts toward a threshold only under a signed human-principal mandate delegating this exact role inside a validity window, and an agent that prepared the subject can never approve it.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_SATISFIED", "HA_AGENT_COUNTED_UNDER_HUMAN_MANDATE" ], "golden_hash": "83c10ecbb8d0841ffda0c16a573f8e8791813487873088be627b6a91f73cfd11" }, { "name": "agent-mandate-for-another-role-not-counted", "description": "The mandate is signed and in window but delegates a different role. Section 27.8 requires that exact role, so the record is not counted and the threshold is UNSATISFIED.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "signed": true, "actor_type": "agent", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zAgentFilerSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } }, "delegation_mandate": { "mandate_hash": "sha256:m001", "granted_role": "reviewer", "principal_identity_id": "did:key:zBoardPrincipalSynth", "principal_actor_type": "human", "valid_from": "2027-01-01", "valid_until": "2027-12-31", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zBoardPrincipalSynth#key-p1", "proofValue": "zSYNTHETICKEY-P1" } } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 0, "threshold_shortfall": 1, "counted_identities": [], "counted_records": [], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [ { "code": "HA_AGENT_MANDATE_ROLE_MISMATCH", "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "mandate_hash": "sha256:m001", "detail": "The delegation mandate grants the role reviewer, which is not the role attestor this threshold requires. Section 27.8 requires that exact role, so the record is not counted." } ], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 1, "counted_record_count": 0, "distinct_identities_counted": 0, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 1 }, "verdict_reason": "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "1 record supplied: 0 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "Section 27.8 parity was applied to every agent-filed record. An agent counts toward a threshold only under a signed human-principal mandate delegating this exact role inside a validity window, and an agent that prepared the subject can never approve it.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_AGENT_MANDATE_ROLE_MISMATCH" ], "golden_hash": "02019924b753df7461301ff9af21d8966d1841916f023309e6833a619d8963dc" }, { "name": "agent-mandate-outside-validity-window-not-counted", "description": "The mandate delegates the right role but the caller-supplied as-of date falls after it lapsed. A lapsed delegation carries no role, so the record is not counted. The window is compared as ISO date strings and no clock is read.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "signed": true, "actor_type": "agent", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zAgentFilerSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } }, "delegation_mandate": { "mandate_hash": "sha256:m001", "granted_role": "attestor", "principal_identity_id": "did:key:zBoardPrincipalSynth", "principal_actor_type": "human", "valid_from": "2026-01-01", "valid_until": "2026-12-31", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zBoardPrincipalSynth#key-p1", "proofValue": "zSYNTHETICKEY-P1" } } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 0, "threshold_shortfall": 1, "counted_identities": [], "counted_records": [], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [ { "code": "HA_AGENT_MANDATE_EXPIRED_OR_NOT_YET_VALID", "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "mandate_hash": "sha256:m001", "detail": "The as-of date 2027-02-15 falls outside the mandate validity window 2026-01-01 to 2026-12-31. A delegation that has lapsed or has not begun cannot carry a role, so the record is not counted." } ], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 1, "counted_record_count": 0, "distinct_identities_counted": 0, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 1 }, "verdict_reason": "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "1 record supplied: 0 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "Section 27.8 parity was applied to every agent-filed record. An agent counts toward a threshold only under a signed human-principal mandate delegating this exact role inside a validity window, and an agent that prepared the subject can never approve it.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_AGENT_MANDATE_EXPIRED_OR_NOT_YET_VALID" ], "golden_hash": "38dc0bd72bc5cbcac74fa2def94088b77fe90deee454fc25cc412a51e8548d67" }, { "name": "agent-preparer-cannot-approve-own-output", "description": "The agent that prepared the subject also approved it, holding an otherwise valid mandate. An autonomous agent must never be both preparer and approver of its own output, so the record is not counted and no mandate cures it.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "prepared_by": { "identity_id": "did:key:zAgentFilerSynth", "actor_type": "agent" }, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zAgentFilerSynth", "record_hash": "sha256:ab01", "signed": true, "actor_type": "agent", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zAgentFilerSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } }, "delegation_mandate": { "mandate_hash": "sha256:m001", "granted_role": "attestor", "principal_identity_id": "did:key:zBoardPrincipalSynth", "principal_actor_type": "human", "valid_from": "2027-01-01", "valid_until": "2027-12-31", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zBoardPrincipalSynth#key-p1", "proofValue": "zSYNTHETICKEY-P1" } } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 0, "threshold_shortfall": 1, "counted_identities": [], "counted_records": [], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [ { "code": "HA_AGENT_PREPARER_CANNOT_APPROVE", "record_ref": "sha256:ab01", "identity_id": "did:key:zAgentFilerSynth", "detail": "This agent identity prepared the subject and also filed an approval over it. An autonomous agent must never be both preparer and approver of its own output (SPEC.md section 27.8), so the record is carried and is not counted. No mandate can cure this." } ], "prepared_by": { "identity_id": "did:key:zAgentFilerSynth", "actor_type": "agent" }, "records_summary": { "supplied_count": 1, "counted_record_count": 0, "distinct_identities_counted": 0, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 1 }, "verdict_reason": "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "Only 0 distinct attestor identities can be counted against a required threshold of 1. A threshold over fewer than N distinct approvers is unsatisfied and does not auto-pass.", "1 record supplied: 0 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "Section 27.8 parity was applied to every agent-filed record. An agent counts toward a threshold only under a signed human-principal mandate delegating this exact role inside a validity window, and an agent that prepared the subject can never approve it.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_AGENT_PREPARER_CANNOT_APPROVE" ], "golden_hash": "7281cec9918a1cdcd2852a8850432980df62092d150bd418d6dfe944b5646d91" }, { "name": "examiner-role-cannot-satisfy-a-threshold", "description": "Section 27.1 makes examiner a read-only role that grants inspection and never approval authority, so even two distinct signed examiner approvals leave the gate UNSATISFIED.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "examiner", "as_of_date": "2027-02-15", "threshold_n": 2, "signatory_records": [ { "record_type": "approval", "role": "examiner", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "examiner", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefFinanceSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "examiner", "role_known": true, "role_read_only": true, "role_eligible": false, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "A read-only role grants inspection and never approval authority (SPEC.md section 27.1), so it cannot satisfy a threshold. The gate is unsatisfied." }, "threshold_policy": { "threshold_n": 2, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": true, "reason": "A threshold of 2 distinct examiner identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 2, "threshold_shortfall": 0, "counted_identities": [ "did:key:zChiefExecSynth", "did:key:zChiefFinanceSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" }, { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "actor_type": "human", "verification_method": "did:key:zChiefFinanceSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 2, "counted_record_count": 2, "distinct_identities_counted": 2, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "A read-only role grants inspection and never approval authority (SPEC.md section 27.1), so it cannot satisfy a threshold. The gate is unsatisfied.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "A read-only role grants inspection and never approval authority (SPEC.md section 27.1), so it cannot satisfy a threshold. The gate is unsatisfied.", "2 records supplied: 2 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_ROLE_IS_READ_ONLY", "HA_DUAL_CONTROL_APPLIED" ], "golden_hash": "1788782738139c6a01872dc3264c41658a50f9b35eb0f1179397d0e07d64a1e6" }, { "name": "rejection-and-override-and-foreign-subject", "description": "One rejection blocks the gate outright, an override is carried and never counted, and a record naming another subject is rejected rather than silently skipped. Three separate non-count paths in one vector.", "policy_parameters": { "regime_label": "Payment stablecoin monthly reserve report certification", "certification_ref": "CERT-SYNTH-0007", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_class": "attested_artifact", "required_role": "attestor", "as_of_date": "2027-02-15", "threshold_n": 1, "signatory_records": [ { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefExecSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "rejection", "role": "attestor", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa02", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefFinanceSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "override", "role": "attestor", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa03", "signed": true, "actor_type": "human", "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefFinanceSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } }, { "record_type": "approval", "role": "attestor", "identity_id": "did:key:zChiefFinanceSynth", "record_hash": "sha256:aa04", "signed": true, "actor_type": "human", "subject_hash": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "audit_signature": { "proof": { "type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022", "proofPurpose": "assertionMethod", "verificationMethod": "did:key:zChiefFinanceSynth#key-1", "proofValue": "zSYNTHETICKEY-1" } } } ] }, "output_payload": { "regime": { "regime_label": "Payment stablecoin monthly reserve report certification", "regime_label_is_free_text": true, "certification_ref": "CERT-SYNTH-0007", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": "2027-02-15", "subject": { "subject_hash": "sha256:3333333333333333333333333333333333333333333333333333333333333333", "subject_present": true, "subject_class": "attested_artifact", "subject_recomputed_here": false, "subject_binding_source": "art-502-bind-attested-subject", "subject_limit": "This subject is a section 27.4 attested artifact. It evidences producer pinning, input binding and content integrity, and it carries no section 18 compute proof and no section 16 or 17 re-execution claim. It never evidences that the arithmetic inside the producer output is correct." }, "role_policy": { "required_role": "attestor", "role_known": true, "role_read_only": false, "role_eligible": true, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is one of the closed section 27.1 roles and can carry approval authority." }, "threshold_policy": { "threshold_n": 1, "threshold_valid": true, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "A threshold of 1 distinct attestor identities is required over this subject." }, "threshold_satisfied": false, "distinct_identities_counted": 1, "threshold_shortfall": 0, "counted_identities": [ "did:key:zChiefExecSynth" ], "counted_records": [ { "record_ref": "sha256:aa01", "identity_id": "did:key:zChiefExecSynth", "record_hash": "sha256:aa01", "actor_type": "human", "verification_method": "did:key:zChiefExecSynth#key-1" } ], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [ { "record_ref": "sha256:aa04", "identity_id": "did:key:zChiefFinanceSynth", "role": "attestor", "record_type": "approval", "stated_subject_hash": "sha256:9999999999999999999999999999999999999999999999999999999999999999", "reason": "This record names a different subject from the one being certified, so it is rejected rather than counted. A record about another artifact is not evidence about this one." } ], "off_role_records_ignored": [], "rejection_records": [ { "record_ref": "sha256:aa02", "identity_id": "did:key:zChiefFinanceSynth", "reason": "A rejection record is present for this role over this subject, which blocks the gate outright (SPEC.md section 27.2)." } ], "override_records": [ { "record_ref": "sha256:aa03", "identity_id": "did:key:zChiefFinanceSynth", "reason": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass." } ], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 4, "counted_record_count": 1, "distinct_identities_counted": 1, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 1, "off_role_ignored_count": 0, "rejection_record_count": 1, "override_record_count": 1, "agent_finding_count": 0 }, "verdict_reason": "A rejection record is present for the role attestor over this subject. A rejection blocks the gate outright regardless of how many approvals were filed.", "rationale": [ "Dual control evidence assembled for certification reference CERT-SYNTH-0007 under the caller-supplied regime label Payment stablecoin monthly reserve report certification. The label is free text and nothing in this computation branches on it.", "The certification is bound to subject sha256:3333333333333333333333333333333333333333333333333333333333333333, carried as a attested_artifact and not recomputed here.", "A rejection record is present for the role attestor over this subject. A rejection blocks the gate outright regardless of how many approvals were filed.", "4 records supplied: 1 counted, 0 rejected as unsigned, 1 rejected for naming another subject, 0 not relevant to this role, 1 rejection, 1 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_RECORDS_FOR_OTHER_SUBJECTS_REJECTED", "HA_REJECTION_RECORD_BLOCKS_GATE", "HA_OVERRIDE_PRESENT_NOT_COUNTED" ], "golden_hash": "d97aabf3f099433d52b3d16cd08fe1c72c42ea294f3aef3cd642c49ec4d3d478" }, { "name": "empty-input-resolves-defined", "description": "The finite gate: no subject, no role, no threshold, no records and no as-of date. Every branch resolves to a defined UNSATISFIED verdict with a stated reason, and no member is NaN, Infinity or undefined.", "policy_parameters": {}, "output_payload": { "regime": { "regime_label": "UNSTATED", "regime_label_is_free_text": true, "certification_ref": "UNSTATED", "basis": "regime_label is free text supplied by the caller and is never interpreted. Nothing in this computation branches on it, no statute is matched against it, and no citation is emitted for it. It records which certification the evidence was assembled for so a reader is not left guessing." }, "as_of_date": null, "subject": { "subject_hash": null, "subject_present": false, "subject_class": "unstated", "subject_recomputed_here": false, "subject_binding_source": "the producing node", "subject_limit": "The subject identifier is taken as supplied and is not recomputed here. Whether the subject artifact itself verifies is decided where it was sealed, not on this surface." }, "role_policy": { "required_role": "UNSTATED", "role_known": false, "role_read_only": false, "role_eligible": false, "permitted_roles": [ "preparer", "reviewer", "approver", "attestor", "submitter", "model_owner", "compliance_officer", "examiner" ], "read_only_roles": [ "examiner" ], "reason": "The required role is outside the closed section 27.1 role vocabulary. An unrecognised role holds the gate rather than falling through to a pass." }, "threshold_policy": { "threshold_n": null, "threshold_valid": false, "threshold_construction": "in-toto integer threshold, applied per SPEC.md section 27.3: satisfied when at least N distinct identities have each filed a signed approval record naming this role and this subject.", "dual_control": false, "reason": "No usable integer threshold of one or more was supplied. A threshold that cannot be read is unsatisfied; it never falls through to a pass." }, "threshold_satisfied": false, "distinct_identities_counted": 0, "threshold_shortfall": null, "counted_identities": [], "counted_records": [], "duplicate_identities_collapsed": [], "unsigned_records_rejected": [], "foreign_subject_records_rejected": [], "off_role_records_ignored": [], "rejection_records": [], "override_records": [], "override_handling": "A section 27.5 override changes which gate policy applies. It does not produce a distinct human approver, so it never satisfies a threshold here. Override records are carried and counted separately and are never folded into the distinct-identity count, which is what stops a time-boxed record resolving to a silent permanent pass.", "distinctness_basis": "Counting is by distinct identity_id (SPEC.md section 27.3), never by record and never by signing key. One human rotating keys counts once, and one human signing twice counts once. Every collapse is reported rather than applied silently.", "agent_parity_findings": [], "prepared_by": { "identity_id": null, "actor_type": "unstated" }, "records_summary": { "supplied_count": 0, "counted_record_count": 0, "distinct_identities_counted": 0, "duplicate_identity_count": 0, "unsigned_rejected_count": 0, "foreign_subject_rejected_count": 0, "off_role_ignored_count": 0, "rejection_record_count": 0, "override_record_count": 0, "agent_finding_count": 0 }, "verdict_reason": "No subject hash was supplied, so there is nothing for an approval record to be about. The gate is unsatisfied.", "rationale": [ "Dual control evidence assembled for certification reference UNSTATED under the caller-supplied regime label UNSTATED. The label is free text and nothing in this computation branches on it.", "No subject was supplied, so no approval record can be tied to a sealed artifact and the gate is held.", "No subject hash was supplied, so there is nothing for an approval record to be about. The gate is unsatisfied.", "0 records supplied: 0 counted, 0 rejected as unsigned, 0 rejected for naming another subject, 0 not relevant to this role, 0 rejection, 0 override.", "No identity filed more than one counted approval, so no collapse was required. Counting remains by distinct identity rather than by record.", "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here." ], "boundary": "This evidences that named humans took responsibility for the subject named here. It carries no claim that a regulator has accepted anything, it does not serve as a filing, and it makes no assertion that the certified numbers are correct. A satisfied threshold means the stated number of distinct identities each filed a signed approval record over this subject in this role, and it means nothing beyond that.", "no_arithmetic_claim": "This surface counts approvals. It computes nothing about what was certified: no reserve composition, no eligible-asset determination, no outstanding-balance reconciliation and no ratio. Whether the certified figures are right is decided by the people who signed and by whoever examines their work, never here.", "note": "Deterministic dual control certification evidence. Single-run and stateless: it holds no records, runs on no schedule, and retains nothing. It decides one thing, whether N distinct named identities each filed a signed approval record over a sealed subject in a required role, and it reports every record it could not count and why. It is regime agnostic: the regime label is free text and no statute is interpreted. It computes nothing about what was certified. It is not a filing and not legal advice." }, "compliance_flags": [ "HA_THRESHOLD_UNSATISFIED", "HA_SUBJECT_ABSENT", "HA_ROLE_NOT_RECOGNISED", "HA_THRESHOLD_NOT_STATED", "HA_AS_OF_DATE_ABSENT" ], "golden_hash": "2a906a8c7d59c79f024dc147806aad78655300d2388abe54f65a467ac1a9590b" } ] }