Independent implementation challenge: verify ĀML semantic release proofs without importing aml-core

[aruintelligence]

Independent implementation challenge

ĀML now has a complete in-repository semantic release chain. The next credibility threshold is external reproduction.

Challenge: implement verification of the published semantic release contracts without importing or calling the JavaScript reference implementation.

A useful independent implementation should target, at minimum:

1. strict canonical JSON behavior required by the referenced contracts;
2. Meaning Manifest root verification;
3. Ed25519 Meaning Manifest attestation verification;
4. append-only Semantic Lineage verification;
5. aml-semantic-release-proof/1 verification;
6. rejection of deliberately mutated/tampered artifacts.

Independence requirement

The implementation must be maintained outside aruintelligence/aml-core to count as an external witness. It may read the public specifications, schemas, vectors, and fixtures, but it must not import the reference implementation or merely wrap its CLI/API.

Python, Go, Rust, Java, C#, Swift, Kotlin, Zig, C/C++, or another language are all welcome.

Results we want

PASS, FAIL, and MIXED reports are all useful. If the contract is ambiguous or impossible to reproduce independently, report that. A failure is evidence we need to improve the protocol; it is not something to hide.

Please publish your implementation/results at a stable public URL and submit the repository's Independent replication or External verifier report issue form with:

• implementation language/runtime;
• public source URL;
• exact ĀML contract/version tested;
• PASS / FAIL / MIXED result;
• failing vectors or ambiguities;
• environment and reproduction command.

Accepted outside reports can be added to WITNESSES.json. The registry deliberately permits negative results and rejects aml-core-owned evidence as an external witness.

Evidence boundary

Passing this challenge demonstrates independent reproducibility of the tested software contracts. It does not imply certification, endorsement, standards-body approval, broad adoption, safety, ethics, legal compliance, or trademark authorization.

Created by Daniel Jacob Read IV. Steward: ĀRU Intelligence Inc.™.

[aruintelligence]

The independent implementation challenge now has a drop-in CI path.

Merged to main: da2b7ed84f5d68bbae127ee97399c4f990d5757e

Outside repositories can now run the project-defined black-box verifier challenge with:

- uses: actions/checkout@v4

- id: aml-conformance
  uses: aruintelligence/aml-core/actions/verifier-conformance@main
  with:
    verifier-command: ./verify.sh

The external verifier command is invoked as:

<verifier-command> --now <ISO-8601> <bundle.json>

It must emit JSON with boolean valid; valid input exits 0 and rejected input exits nonzero.

Machine-readable contract: conformance/verifier-challenge.json
Public guide: publications/EXTERNAL_VERIFIER_CHALLENGE.md

Current black-box cases:

• golden valid witness;
• tampered receipt purpose;
• tampered challenge nonce;
• expired challenge.

Important: passing this Action does not by itself create an external witness record or prove implementation independence. To count in WITNESSES.json, the implementation/result still has to be publicly maintained outside aruintelligence/aml-core. PASS, FAIL, and MIXED reports remain welcome.

[aruintelligence]

Fastest way to participate

If you arrived here from GitHub search and want the broader adoption path first, start with #81 — Adopt ĀML.

Then choose your lane:

• Independent verifier: stay on this issue (Independent implementation challenge: verify ĀML semantic release proofs without importing aml-core #56).
• Real application integration: External integration challenge: put ĀML in a real application without rewriting the UI #57.
• Security / break the semantic supply chain: Security challenge: break the ĀML semantic supply chain #58.
• Canonical package-distribution work: Package distribution blocker: publish and independently verify the canonical JavaScript package #59.

Developer-first adoption guide: ADOPT_AML.md once PR #82 lands.

External PASS, MIXED, and FAIL results are all welcome. Repo-owned implementations still do not count as independent external witnesses.