examples: add CCS v1.4 composition fixture under examples/ccs/

conformance/composition/ccs-v14-aeb-github-v0.1/JOINT-ASSESSMENT.md

@@ -0,0 +1,142 @@
+# Joint Interoperability Assessment — CCS v1.4 receipt as EMILIA pre-admission evidence
+
+**Status:** DRAFT v3 for joint review — not final and must not be merged or represented as jointly approved until both parties approve the exact bytes.
+**Date:** 2026-08-29
+**Revision:** v3 supersedes v2 (2026-08-30): per joint review — (a) bundle-scope counts in section 3 reflect the full pinned bundle (489 manifest-covered files, 64 expected-outcome cases); (b) the Correctover checker is described as a standalone package-independent check that operates without importing the CCS verifier package; (c) wording aligned for the public repository. Vectors, the eight composition outcomes, artifact pins, and all product boundaries are unchanged.
+**Parties:**
+- **EMILIA Protocol, Inc.** — Iman Schrock (`team@emiliaprotocol.ai`)
+- **Correctover** — Guigui Wang (`wangguigui@correctover.com`)
+
+---
+
+## 1. Question
+
+In the EMILIA standalone composition harness at commit `995d803`, can the pinned
+CCS v1.4 L1 conformance receipt (`upstream-01-allow`, 30 fields, Ed25519 over JCS)
+be **independently verified by a party that imports none of the issuer's code**, then
+**bound to one exact EMILIA action and one relying-party admission domain**, with the
+current authority state in the harness and provider entry kept separate and closed
+(fail-closed; at-most-one applies to the counting provider entry, not to a physical
+effect)?
+
+**Answer: yes, for this fixture** — established from bytes each side ran independently.
+
+## 2. Pinned artifacts
+
+| Artifact | Pin |
+|---|---|
+| CCS conformance bundle | `https://github.com/DSHCorrectover/ccs-conformance-vectors` |
+| Bundle commit | `a3503b2bc48922f92a28c372003885a0831da02b` |
+| Bundle manifest sha256 | `3e77eae3045eb2bc824c52b8d022b75029beaf56623841ce7c035a99e65a2ddd` |
+| EMILIA standalone harness | `https://github.com/emiliaprotocol/emilia-protocol` |
+| Harness commit | `995d80367f99601bb16509c6c89a5f9e72c74885` |
+| Harness dir | `conformance/composition/ccs-v14-aeb-github-v0.1/` |
+| Standalone entrypoint sha256 | `c809c257348ab635819d1cffe33f7051d285b1ffe5d06903dc2989b033ca514a` |
+| Upstream ALLOW receipt sha256 | `889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361` |
+| Reference report sha256 | `a197793b835f00f1bd350f29101a47b234ea63240df29a6a372e350ad599c9d4` |
+| Reference vectors sha256 | `3f61bc9eb2ce3d2d1e6a771aa94d2be1cfb964eac93babe3c5334f883ab72cd7` |
+| Composition results digest | `sha256:ad2256f5c22f0c8c6a185f7ce5675955db8019789bd42b04bbd47ab5227166f6` |
+| Receipt public-key fingerprint | `26a02d86f5d0a10f` (CCS public deterministic conformance seed key) |
+
+The standalone runner requires only Node.js >= 20.19 and imports only Node built-ins;
+the six-file handoff has no `node_modules` and no repository parent at run time.
+
+## 3. EMILIA-side verification (performed by EMILIA)
+
+EMILIA pinned commit `a3503b2` and ran the published v1.4 bundle in a fresh environment:
+
+- The manifest covered all **489** non-manifest vector files in the pinned bundle.
+- The standalone package-independent Python checker classified all **64** expected-outcome
+  conformance cases as expected.
+- Regenerating the vectors reproduced the committed bundle **byte-for-byte**.
+- EMILIA also pinned the published CCS v1.4 specification text used for comparison
+  (153,156 bytes, sha256 `fbac2a025f11baec104687ee04ba5c9fb0dad1b5bbb5ad38494965565a977cd3`).
+  That pin **anchors the specification version used for comparison**; the pin itself
+  does not validate the bundle, and it is not a claim of full specification conformance
+  or of completed composition.
+
+## 4. Correctover-side verification (performed by Correctover)
+
+Correctover ran the EMILIA handoff as an external verifier — fresh isolated directory,
+no repository checkout, no `node_modules`, Node v22:
+
+- `node run.standalone.mjs --check`: **all eight cases passed, exit 0.**
+- EMILIA's own Node test harness: **2/2**, including the audit that the runner imports
+  only Node built-ins.
+- Hashes lined up: entrypoint `c809c257…` matches the manifest; upstream receipt
+  `889855dc…`; reference report `a197793b…` and vectors `3f61bc9e…` match the manifest
+  support files.
+- The produced `results_digest` was
+  `sha256:ad2256f5c22f0c8c6a185f7ce5675955db8019789bd42b04bbd47ab5227166f6`,
+  **byte-identical to `report.reference.json`**.
+- Correctover then re-verified the receipt with the **standalone package-independent**
+  Python check — standard library plus `cryptography` plus JCS (JSON Canonicalization
+  Scheme), operating **without importing the CCS verifier package** and with zero lines
+  of EMILIA code: 30 fields, 64-byte Ed25519 signature,
+  32-byte key, 1221-byte JCS signing input → **valid**.
+- Two negative controls — a flipped signature byte, and the verdict changed from
+  `allow` to `deny` — were **both correctly rejected**.
+- The closing detail: the receipt's public-key fingerprint `26a02d86f5d0a10f` is the
+  CCS public deterministic conformance seed key. EMILIA's harness pins this key;
+  Correctover's verifier validated the same signed receipt bytes against it. **Both
+  parties independently verified the same bytes under the public deterministic
+  conformance key. That establishes fixture integrity, not a production identity
+  chain.**
+
+Correctover re-ran the same handoff on 2026-08-29 after fetching the six files
+directly from harness commit `995d803`; all file sha256 values matched the manifest
+and the eight cases produced the identical results digest.
+
+## 5. The eight composition outcomes
+
+| # | Case | Expected | Result |
+|---|---|---|---|
+| 1 | CCS-V1.4-PUBLIC-VECTOR-PIN | byte-pinned vector, valid Ed25519 + companion hashes | pass |
+| 2 | CCS-ALLOW + EMILIA authority | counting provider entered exactly once | pass |
+| 3 | Receipt tampering | refused, zero provider entries | pass |
+| 4 | Wrong relying party | refused, zero provider entries | pass |
+| 5 | Stale status | refused, zero provider entries | pass |
+| 6 | Action substitution (issue 538 → 539) | refused, zero provider entries | pass |
+| 7 | CCS ALLOW with absent EMILIA authority | refused, zero provider entries | pass |
+| 8 | Lost provider response | `INDETERMINATE`, blind retry blocked, provider entered at most once | pass |
+
+The valid composition enters the provider exactly once; the five hostile/boundary
+cases enter it zero times; `INDETERMINATE` blocks blind retry and still enters the
+provider at most once. All provider references in this section are to the counting
+test stub in the harness.
+
+## 6. Product boundaries (authoritative)
+
+1. **CCS supplies machine-policy evidence; it is never execution authority.** A
+   verified CCS ALLOW receipt does not by itself prove what the provider ultimately
+   executed. Provider entry additionally requires a current AEB evaluation for the
+   exact action and a separate relying-party authorization decision.
+2. **The GitHub-shaped receipt in the fixture is EMILIA-authored and CCS-source-
+   compatible; it is not a Correctover certification or a Correctover-issued upstream
+   vector.** Both receipts use the public deterministic conformance key
+   (`26a02d86f5d0a10f`), which is test material and not a production trust root. The
+   provider in the harness is a counting test stub; no live GitHub issue or external
+   account is changed. At-most-one provider entry is not exactly-once physical effect;
+   an `INDETERMINATE` result requires authenticated reconciliation, and blind retry
+   remains prohibited.
+
+## 7. Verdict
+
+In this harness, the pinned CCS v1.4 L1 conformance receipt **can be independently
+verified** by a party that imports none of the issuer's code, and **can be bound to
+one exact EMILIA action** (`github.issue-update.1`, CAID
+`caid:1:github.issue-update.1:jcs-sha256:hcpVY2uUgF1xTGcDoqhuSzYB2avddWtiPXEQVE6p-kk`)
+**and one relying-party admission domain** (`rp:emilia-github-gate`), with the
+current authority state in the harness and provider entry separate and closed
+(at-most-one concerns the counting provider entry, not a physical effect). Both
+sides reached this verdict from bytes they ran themselves. This is a fixture-
+integrity result under the public deterministic conformance key, not a production
+identity chain.
+
+## 8. Signatures
+
+This report is jointly authored. It is not final or jointly approved until both
+parties approve the exact bytes.
+
+- Iman Schrock — EMILIA Protocol, Inc. — _________________ (date)
+- Guigui Wang — Correctover — _________________ (date)

examples/ccs/README.md

@@ -0,0 +1,66 @@
+# EMILIA × CCS composition example
+
+This directory contains an **interoperability example contributed by the EMILIA
+project** (Iman Schrock). It shows how a CCS v1.4
+conformance receipt is consumed as **pre-admission machine-policy evidence** by
+an AEB-style gate, then bound to one executor-owned action and one relying-party
+admission domain.
+
+## Provenance
+
+The two JSON files here are byte-identical copies from the EMILIA standalone
+composition harness, commit
+[`995d803`](https://github.com/emiliaprotocol/emilia-protocol/commit/995d80367f99601bb16509c6c89a5f9e72c74885),
+directory `conformance/composition/ccs-v14-aeb-github-v0.1/`:
+
+| file | sha256 | role |
+|---|---|---|
+| `vectors.reference.json` | `3f61bc9eb2ce3d2d1e6a771aa94d2be1cfb964eac93babe3c5334f883ab72cd7` | The proposed examples fixture: the pinned CCS ALLOW receipt, the exact GitHub `issue-update` action, its CAID, relying party, and provider |
+| `upstream-01-allow.receipt.json` | `889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361` | The upstream CCS v1.4 conformance `01-allow` receipt this composition pins |
+
+The harness itself (`run.standalone.mjs`, Node >= 20.19, Node built-ins only)
+lives in the EMILIA repository at the commit above. It is not vendored here;
+fetch it from the pinned commit to reproduce the eight composition cases.
+
+## What the fixture demonstrates
+
+The runner exercises eight deterministic cases:
+
+1. the pinned public vector verifies (valid Ed25519 over the JCS signing input);
+2. the valid composition — CCS ALLOW plus a separate EMILIA authority decision —
+   enters the counting provider exactly once;
+3. receipt tampering is refused;
+4. the wrong relying party is refused;
+5. a stale status is refused;
+6. action substitution (issue 538 → 539) is refused;
+7. a CCS ALLOW with no EMILIA authority is refused (zero provider entries);
+8. a lost provider response returns `INDETERMINATE` and blocks blind retry.
+
+## Boundaries (authoritative)
+
+- **The GitHub-shaped receipt in `emilia_github_fixture` is an EMILIA-authored
+  compatible fixture, not a Correctover certification or a Correctover-issued
+  upstream vector.** It is source-compatible with the CCS v1.4 receipt shape.
+- A CCS ALLOW receipt is **machine-policy evidence only**. It is not execution
+  authority and does not by itself prove what the provider ultimately executed.
+  Provider entry additionally requires a current AEB evaluation for the exact
+  action and a separate relying-party authorization decision.
+- Both receipts use the **public deterministic conformance key**
+  (fingerprint `26a02d86f5d0a10f`). It is test material, not a production trust
+  root, and MUST NOT be trusted or reused outside conformance fixtures.
+- The provider in the harness is a counting test stub; no live GitHub issue or
+  external account is changed.
+
+## Independent verification
+
+The upstream receipt is a 30-field CCS L1 receipt signed with Ed25519 over the
+JCS (JSON Canonicalization Scheme) canonicalization of the 29 unsigned fields (1221-byte signing
+input). Any standard-library + Ed25519 + JCS verifier can validate it without
+importing CCS code. The Correctover check used here is a **standalone
+package-independent** checker that operates **without importing the CCS
+verifier package**. The standalone package-independent conformance checker
+([`checkers/independent_checker.py`](https://github.com/DSHCorrectover/ccs-conformance-vectors/blob/a3503b2bc48922f92a28c372003885a0831da02b/checkers/independent_checker.py),
+MIT license; Python standard library plus `cryptography` and `jcs` only, and
+it operates **without importing the CCS verifier package**) lives
+in the pinned CCS bundle repository at bundle commit [`a3503b2`](https://github.com/DSHCorrectover/ccs-conformance-vectors/commit/a3503b2bc48922f92a28c372003885a0831da02b),
+not in this repository. It independently verifies the pinned bundle.

examples/ccs/upstream-01-allow.receipt.json

@@ -0,0 +1,32 @@
+{
+  "trace_id": "conformance-v1.4.0-trace",
+  "receipt_version": "1.4",
+  "verdict": "allow",
+  "timestamp": 1750003200.0,
+  "tool": "lookup_customer",
+  "tool_call_id": "call-conformance-01",
+  "params_hash": "f516269c2104b2764cd6d4cab363c29e0a48c5c185d07a481eb226bf6f395ba2",
+  "args_digest": "f2e46a341a25d489c55ec109d41c0dae85a3477666b83321cbf0ba266ee8fd4a",
+  "rule_summary": "conformance-reference-policy",
+  "rule_version": "1.4.0-conformance",
+  "request_hash": "55a300ad27d7f65e05ba41bdb5361c08c103229e9ad8bdd1e1332aa7f340dd89",
+  "response_hash": "b810bf2ed31e7b2489e999c5a1770fe7c4f1a08ceefd3389726181c470a99793",
+  "runtime_context_hash": "497b261529f5a98e5b07cfa8419017872d5a73a1be069e964f0ebc245eb354d8",
+  "config_hash": "0abcb7ab76d5cb8ba879d6feba6199247c0c2622614451d8d03c16614a73bcfb",
+  "verifier_source_class": "ConformanceVectorGenerator",
+  "deployment_mode": "in-process",
+  "issuer": "ccs-conformance/v1.4.0",
+  "audience": "independent-verifier",
+  "nonce": "conformance-nonce-0000",
+  "sequence": 0,
+  "issued_at": 1750003200.0,
+  "expires_at": 1750089600.0,
+  "max_clock_skew": 30,
+  "action": "lookup_customer.execute",
+  "signature": "i6cDOARGniKQSc/sScpQw0X86LkIGT6kWECGHEgZzZ0Grxvasss8Pax1MnANqBE2p6guqwYzcWafUWK35elxDA==",
+  "signing_algorithm": "Ed25519",
+  "public_key_fingerprint": "26a02d86f5d0a10f",
+  "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=",
+  "verified_at": 1750003200.0,
+  "latency_us": 842.0
+}

examples/ccs/vectors.reference.json

@@ -0,0 +1,116 @@
+{
+  "@version": "CCS-V1.4-AEB-GITHUB-REFERENCE-VECTORS-v1",
+  "source_lock": {
+    "repository": "https://github.com/DSHCorrectover/ccs-conformance-vectors",
+    "commit": "a3503b2bc48922f92a28c372003885a0831da02b",
+    "manifest_sha256": "3e77eae3045eb2bc824c52b8d022b75029beaf56623841ce7c035a99e65a2ddd",
+    "upstream_case": "vectors/v1.4.0-conformance/01-allow",
+    "upstream_receipt_sha256": "889855dc9fcebdb642bd7e0f369651015781b4c004227aef510feb1fb7cb4361"
+  },
+  "upstream_allow_receipt": {
+    "trace_id": "conformance-v1.4.0-trace",
+    "receipt_version": "1.4",
+    "verdict": "allow",
+    "timestamp": 1750003200,
+    "tool": "lookup_customer",
+    "tool_call_id": "call-conformance-01",
+    "params_hash": "f516269c2104b2764cd6d4cab363c29e0a48c5c185d07a481eb226bf6f395ba2",
+    "args_digest": "f2e46a341a25d489c55ec109d41c0dae85a3477666b83321cbf0ba266ee8fd4a",
+    "rule_summary": "conformance-reference-policy",
+    "rule_version": "1.4.0-conformance",
+    "request_hash": "55a300ad27d7f65e05ba41bdb5361c08c103229e9ad8bdd1e1332aa7f340dd89",
+    "response_hash": "b810bf2ed31e7b2489e999c5a1770fe7c4f1a08ceefd3389726181c470a99793",
+    "runtime_context_hash": "497b261529f5a98e5b07cfa8419017872d5a73a1be069e964f0ebc245eb354d8",
+    "config_hash": "0abcb7ab76d5cb8ba879d6feba6199247c0c2622614451d8d03c16614a73bcfb",
+    "verifier_source_class": "ConformanceVectorGenerator",
+    "deployment_mode": "in-process",
+    "issuer": "ccs-conformance/v1.4.0",
+    "audience": "independent-verifier",
+    "nonce": "conformance-nonce-0000",
+    "sequence": 0,
+    "issued_at": 1750003200,
+    "expires_at": 1750089600,
+    "max_clock_skew": 30,
+    "action": "lookup_customer.execute",
+    "signature": "i6cDOARGniKQSc/sScpQw0X86LkIGT6kWECGHEgZzZ0Grxvasss8Pax1MnANqBE2p6guqwYzcWafUWK35elxDA==",
+    "signing_algorithm": "Ed25519",
+    "public_key_fingerprint": "26a02d86f5d0a10f",
+    "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=",
+    "verified_at": 1750003200,
+    "latency_us": 842
+  },
+  "emilia_github_fixture": {
+    "action": {
+      "action_type": "github.issue-update.1",
+      "parameters": {
+        "tool": "github_issue_update",
+        "arguments": {
+          "repository": "emiliaprotocol/emilia-protocol",
+          "issue_number": 538,
+          "title": "Record missing-evidence disposition",
+          "body": "Evidence unavailable; no execution authority inferred.",
+          "state": "open"
+        }
+      }
+    },
+    "caid": "caid:1:github.issue-update.1:jcs-sha256:hcpVY2uUgF1xTGcDoqhuSzYB2avddWtiPXEQVE6p-kk",
+    "ccs_artifact": {
+      "receipt": {
+        "trace_id": "ccs-v14-emilia-github-trace",
+        "receipt_version": "1.4",
+        "verdict": "allow",
+        "timestamp": 1750003210,
+        "tool": "github_issue_update",
+        "tool_call_id": "call-ccs-v14-emilia-001",
+        "params_hash": "c511a941651d21d21a89af3123a027bac376523661dc1f5938778890be410b65",
+        "args_digest": "8efa8c4f9c636616618856e65f235b0b86cd34ea8f21bd4493fb2bebc1a82d6b",
+        "rule_summary": "github-issue-update-conformance",
+        "rule_version": "1.4.0-conformance",
+        "request_hash": "c511a941651d21d21a89af3123a027bac376523661dc1f5938778890be410b65",
+        "response_hash": "d410958ad3821ea861ae3f7196cd9f8a83fb9e7e457f8837d3d0983ecc96b628",
+        "runtime_context_hash": "d66c66cb0d4d8b37084e76e518b0625a35e5f4369096ff246ea43ed446d9c8ff",
+        "config_hash": "3edd8b7cae30c8df4cf034be4e33d2c869bd3401d105b7b57a02814239bf33d1",
+        "verifier_source_class": "EMILIAIndependentComposition",
+        "deployment_mode": "test-in-process",
+        "issuer": "ccs-conformance/v1.4.0",
+        "audience": "rp:emilia-github-gate",
+        "nonce": "ccs-v14-emilia-nonce-001",
+        "sequence": 0,
+        "issued_at": 1750003210,
+        "expires_at": 1750003290,
+        "max_clock_skew": 30,
+        "action": "github_issue_update.execute",
+        "signing_algorithm": "Ed25519",
+        "public_key_fingerprint": "26a02d86f5d0a10f",
+        "public_key": "ndAkiPndnKQ7hLAMOQBu4BE79y0BM3NA0diA0YDB2cI=",
+        "verified_at": 1750003210,
+        "latency_us": 842,
+        "signature": "xWUqa2M9TdKH+y13ZLtdi5Y1YkmIqKfZL9+3Eonf9nHFpmeL5e14S8n+Tk4Ultzbbj8gZSQ7L3V+7B2oSm1FCA=="
+      },
+      "tool_args": {
+        "repository": "emiliaprotocol/emilia-protocol",
+        "issue_number": 538,
+        "title": "Record missing-evidence disposition",
+        "body": "Evidence unavailable; no execution authority inferred.",
+        "state": "open"
+      },
+      "response_body": {
+        "issue_url": "https://github.com/emiliaprotocol/emilia-protocol/issues/538",
+        "updated": true
+      }
+    },
+    "relying_party": "rp:emilia-github-gate",
+    "provider": {
+      "tenant_id": "tenant:emilia-protocol",
+      "provider_id": "provider:github",
+      "provider_account_id": "account:futureenterprises",
+      "environment": "test-fixture"
+    }
+  },
+  "limits": [
+    "The upstream vector and local GitHub fixture use a public deterministic conformance key, not a production trust root.",
+    "The local GitHub fixture is EMILIA-authored and source-compatible; it is not represented as a Correctover-issued upstream vector.",
+    "CCS ALLOW is machine-policy evidence only. Separate relying-party authorization is required before provider entry.",
+    "The provider is a counting test stub; no GitHub issue is changed."
+  ]
+}