aruintelligence · aruintelligence · Sep 14, 2026 · Sep 14, 2026
@@ -0,0 +1,17 @@
+{
+  "schema": "aml-verifier-challenge-cases/1",
+  "bundle_source": "independent/python/witness-vector.json",
+  "mutation_language": {
+    "schema": "aml-json-pointer-replace/1",
+    "operation": "replace",
+    "path_semantics": "RFC 6901 JSON Pointer",
+    "supported_operations": ["replace"]
+  },
+  "cases": [
+    {"id":"golden-valid","now":"2030-01-01T00:05:00Z","expected_valid":true,"mutations":[]},
+    {"id":"tampered-purpose","now":"2030-01-01T00:05:00Z","expected_valid":false,"mutations":[{"op":"replace","path":"/evidence/receipt/decisions/0/purpose","value":"tampered-by-conformance-harness"}]},
+    {"id":"tampered-challenge","now":"2030-01-01T00:05:00Z","expected_valid":false,"mutations":[{"op":"replace","path":"/challenge/nonce","value":"tampered-challenge-nonce-000000000000000000000"}]},
+    {"id":"expired-challenge","now":"2030-01-01T00:11:00Z","expected_valid":false,"mutations":[]}
+  ],
+  "evidence_boundary": "Project-defined challenge data for black-box interoperability testing. Matching expected outcomes is not certification or proof of implementation independence."
+}
@@ -4,6 +4,7 @@
   "canonical_repository": "https://github.com/aruintelligence/aml-core",
   "harness": "scripts/run-verifier-conformance.mjs",
   "witness_vector": "independent/python/witness-vector.json",
+  "cases_file": "conformance/verifier-challenge-cases.json",
   "command_contract": {
     "invocation": "<verifier-command> --now <ISO-8601> <bundle.json>",
     "stdout": "single JSON object",
@@ -18,30 +19,10 @@
     "verifier": "scripts/verify-verifier-conformance-result.mjs"
   },
   "cases": [
-    {
-      "id": "golden-valid",
-      "expected_valid": true,
-      "now": "2030-01-01T00:05:00Z",
-      "mutation": null
-    },
-    {
-      "id": "tampered-purpose",
-      "expected_valid": false,
-      "now": "2030-01-01T00:05:00Z",
-      "mutation": "evidence.receipt.decisions[0].purpose is changed"
-    },
-    {
-      "id": "tampered-challenge",
-      "expected_valid": false,
-      "now": "2030-01-01T00:05:00Z",
-      "mutation": "challenge.nonce is changed"
-    },
-    {
-      "id": "expired-challenge",
-      "expected_valid": false,
-      "now": "2030-01-01T00:11:00Z",
-      "mutation": null
-    }
+    {"id":"golden-valid","expected_valid":true,"now":"2030-01-01T00:05:00Z","mutation":null},
+    {"id":"tampered-purpose","expected_valid":false,"now":"2030-01-01T00:05:00Z","mutation":"evidence.receipt.decisions[0].purpose is changed"},
+    {"id":"tampered-challenge","expected_valid":false,"now":"2030-01-01T00:05:00Z","mutation":"challenge.nonce is changed"},
+    {"id":"expired-challenge","expected_valid":false,"now":"2030-01-01T00:11:00Z","mutation":null}
   ],
   "independence": {
     "required_for_external_witness_credit": true,

@@ -0,0 +1,36 @@
+{
+  "schema": "aml-verification-contract-migration/1",
+  "migration_id": "aml-verifier-contract-migration-2026-09-09-01-to-2026-09-14-01",
+  "from_snapshot": "aml-verifier-contract-2026-09-09-01",
+  "to_snapshot": "aml-verifier-contract-2026-09-14-01",
+  "classification": "breaking",
+  "changed_locked_paths": [
+    "conformance/verifier-challenge.json",
+    "scripts/run-verifier-conformance.mjs"
+  ],
+  "historical_artifacts": {
+    "old_snapshot_verification_required": true,
+    "new_snapshot_may_reinterpret_old_artifacts": false
+  },
+  "behavior_changes": [
+    {
+      "area": "verifier challenge case definition",
+      "before": "the four challenge mutations and evaluation times were represented in the challenge document and implemented directly by the reference harness",
+      "after": "the same four challenge cases are defined as language-neutral data in conformance/verifier-challenge-cases.json and consumed by the harness",
+      "compatibility": "incompatible"
+    },
+    {
+      "area": "black-box verifier outcomes",
+      "before": "golden valid, receipt-purpose tamper, challenge-nonce tamper, and expired challenge cases",
+      "after": "the same four verifier command cases and expected validity outcomes",
+      "compatibility": "compatible"
+    },
+    {
+      "area": "case corpus evidence binding",
+      "before": "the harness bound the exact challenge and witness-vector bytes",
+      "after": "the harness retains those bindings and additionally reports the SHA-256 of the exact language-neutral case corpus",
+      "compatibility": "conditionally-compatible"
+    }
+  ],
+  "notes": "Snapshot 2 remains the immutable target for Snapshot 2 artifacts. Snapshot 3 makes the challenge cases independently readable as data instead of requiring inspection of reference harness code. Passing remains project-defined black-box interoperability evidence, not certification or proof of implementation independence."
+}
@@ -1,7 +1,7 @@
 {
   "schema": "aml-verification-contract-catalog/1",
   "status": "SHIPPED prototype catalog",
-  "current_snapshot": "aml-verifier-contract-2026-09-09-01",
+  "current_snapshot": "aml-verifier-contract-2026-09-14-01",
   "snapshots": [
     {
       "snapshot_id": "aml-verifier-contract-2026-09-08-01",
@@ -13,11 +13,18 @@
       "snapshot_id": "aml-verifier-contract-2026-09-09-01",
       "manifest": "protocol/verification-contract-v2.json",
       "source_commit": "2dac9e2b4a6401af3718bc71a4b031bd57f358c5",
+      "superseded": true
+    },
+    {
+      "snapshot_id": "aml-verifier-contract-2026-09-14-01",
+      "manifest": "protocol/verification-contract-v3.json",
+      "source_commit": "8c991746a1eb68325d85edc430db06200cfef30d",
       "superseded": false
     }
   ],
   "migrations": [
-    "protocol/migrations/aml-verifier-contract-2026-09-08-01_to_2026-09-09-01.json"
+    "protocol/migrations/aml-verifier-contract-2026-09-08-01_to_2026-09-09-01.json",
+    "protocol/migrations/aml-verifier-contract-2026-09-09-01_to_2026-09-14-01.json"
   ],
   "rule": "A later snapshot must preserve every earlier snapshot as an immutable historical target and must add an explicit migration object from its predecessor."
 }
@@ -9,13 +9,22 @@
     {
       "snapshot_id": "aml-verifier-contract-2026-09-09-01",
       "source_commit": "2dac9e2b4a6401af3718bc71a4b031bd57f358c5"
+    },
+    {
+      "snapshot_id": "aml-verifier-contract-2026-09-14-01",
+      "source_commit": "8c991746a1eb68325d85edc430db06200cfef30d"
     }
   ],
   "edges": [
     {
       "from_snapshot": "aml-verifier-contract-2026-09-08-01",
       "to_snapshot": "aml-verifier-contract-2026-09-09-01",
       "migration": "protocol/migrations/aml-verifier-contract-2026-09-08-01_to_2026-09-09-01.json"
+    },
+    {
+      "from_snapshot": "aml-verifier-contract-2026-09-09-01",
+      "to_snapshot": "aml-verifier-contract-2026-09-14-01",
+      "migration": "protocol/migrations/aml-verifier-contract-2026-09-09-01_to_2026-09-14-01.json"
     }
   ],
   "invariants": [

@@ -0,0 +1,41 @@
+{
+  "schema": "aml-verification-contract-snapshot/1",
+  "status": "SHIPPED prototype contract snapshot",
+  "snapshot_id": "aml-verifier-contract-2026-09-14-01",
+  "source_repository": "https://github.com/aruintelligence/aml-core",
+  "source_commit": "8c991746a1eb68325d85edc430db06200cfef30d",
+  "canonicalization": "sorted-json-v1",
+  "witness_schema": "aml-witness-bundle/1",
+  "cli_contract": "protocol/aml-verifier-cli.md",
+  "golden_vector": "independent/python/witness-vector.json",
+  "locked_paths": [
+    "protocol/aml-verifier-cli.md",
+    "protocol/aml-witness-bundle.schema.json",
+    "protocol/aml-browser-evidence.schema.json",
+    "protocol/aml-session-attestation.schema.json",
+    "protocol/aml-verification-challenge.schema.json",
+    "protocol/aml-verification-report.schema.json",
+    "protocol/aml-verifier-manifest.schema.json",
+    "protocol/aml-verifier-conformance-result.schema.json",
+    "protocol/sorted-json-v1.md",
+    "protocol/browser-canonicalization-vectors.json",
+    "independent/python/witness-vector.json",
+    "conformance/verifier-challenge.json",
+    "conformance/verifier-challenge-cases.json",
+    "scripts/run-verifier-conformance.mjs",
+    "scripts/verify-verifier-conformance-result.mjs"
+  ],
+  "required_behavior": [
+    "golden witness bundle passes",
+    "receipt-bound mutation fails",
+    "challenge mutation fails",
+    "expired challenge fails",
+    "verifier challenge cases are defined in a language-neutral aml-verifier-challenge-cases/1 corpus",
+    "conformance harness consumes the published case corpus rather than hard-coded tamper objects",
+    "conformance result binds exact external verifier challenge bytes by SHA-256",
+    "conformance result binds exact golden witness-vector bytes by SHA-256",
+    "conformance output identifies exact verifier case-corpus bytes by SHA-256",
+    "archived conformance result rejects challenge, vector, case-order, verdict, or PASS-state rewriting"
+  ],
+  "claim_boundary": "This snapshot identifies an exact project-defined verifier and conformance-evidence contract by immutable Git commit and path set. It does not establish standards-body ratification, certification, implementation independence, trustworthiness, safety, ethics, legal compliance, or external adoption."
+}
@@ -7,16 +7,19 @@ import { execFileSync } from 'node:child_process';
 
 export const KIT_FILES = [
   'conformance/verifier-challenge.json',
+  'conformance/verifier-challenge-cases.json',
   'conformance/witness-record.example.json',
   'independent/python/witness-vector.json',
   'protocol/sorted-json-v1.md',
   'protocol/browser-canonicalization-vectors.json',
   'protocol/test-vectors.json',
   'protocol/verification-contract-v1.json',
   'protocol/verification-contract-v2.json',
+  'protocol/verification-contract-v3.json',
   'protocol/verification-contract-catalog.json',
   'protocol/verification-contract-lineage.json',
   'protocol/migrations/aml-verifier-contract-2026-09-08-01_to_2026-09-09-01.json',
+  'protocol/migrations/aml-verifier-contract-2026-09-09-01_to_2026-09-14-01.json',
   'protocol/aml-verification-contract-snapshot.schema.json',
   'protocol/aml-verification-contract-migration.schema.json',
   'protocol/verification-report-vectors.json',
@@ -67,6 +70,7 @@ export function buildExternalVerifierKit(outputDir = 'dist/external-verifier-kit
   if (!currentSnapshot?.manifest || !currentSnapshot?.source_commit) throw new Error('current verifier snapshot is not resolvable from catalog');
 
   const challengeBytes = fs.readFileSync('conformance/verifier-challenge.json');
+  const challengeCasesBytes = fs.readFileSync('conformance/verifier-challenge-cases.json');
   const witnessVectorBytes = fs.readFileSync('independent/python/witness-vector.json');
 
   fs.rmSync(outputDir, { recursive: true, force: true });
@@ -82,7 +86,7 @@ export function buildExternalVerifierKit(outputDir = 'dist/external-verifier-kit
   }
   entries.sort((a, b) => codeUnitCompare(a.path, b.path));
 
-  const readme = `# ĀML External Verifier Kit\n\nThis artifact is intentionally **reference-code-free**. It contains the current and historical verifier-contract snapshots, explicit migration lineage, public protocol text, JSON Schemas, canonicalization/test vectors, the black-box verifier challenge, one JSON witness fixture, and witness-submission material. It does not contain the JavaScript, Python, Go, or other reference verifier implementations from aml-core.\n\nCurrent verifier snapshot: **${catalog.current_snapshot}**\nMigration count: **${(catalog.migrations || []).length}**\n\nImplement the published contract in your own runtime, then run the External Verifier Challenge from your own repository. PASS, FAIL, and MIXED results are all useful.\n\nCommand contract:\n\n\`\`\`text\n<verifier-command> --now <ISO-8601> <bundle.json>\n\`\`\`\n\nA valid bundle must emit JSON with \`valid: true\` and exit 0. Invalid challenge cases must be rejected with a nonzero exit. Snapshot 2 conformance results identify the exact challenge and golden witness-vector bytes by SHA-256.\n\nThis kit reduces accidental dependence on reference implementation code. Possessing or using the kit does not itself prove an implementation is independent.\n`;
+  const readme = `# ĀML External Verifier Kit\n\nThis artifact is intentionally **reference-code-free**. It contains the current and historical verifier-contract snapshots, explicit migration lineage, public protocol text, JSON Schemas, canonicalization/test vectors, the black-box verifier challenge, a language-neutral exact case corpus, one JSON witness fixture, and witness-submission material. It does not contain the JavaScript, Python, Go, or other reference verifier implementations from aml-core.\n\nCurrent verifier snapshot: **${catalog.current_snapshot}**\nMigration count: **${(catalog.migrations || []).length}**\n\nImplement the published contract in your own runtime, then run the External Verifier Challenge from your own repository. PASS, FAIL, and MIXED results are all useful. The exact mutations and evaluation times are data-defined in \`conformance/verifier-challenge-cases.json\`.\n\nCommand contract:\n\n\`\`\`text\n<verifier-command> --now <ISO-8601> <bundle.json>\n\`\`\`\n\nA valid bundle must emit JSON with \`valid: true\` and exit 0. Invalid challenge cases must be rejected with a nonzero exit. Conformance results identify the exact challenge and golden witness-vector bytes by SHA-256, and the kit manifest also binds the exact case-corpus bytes.\n\nThis kit reduces accidental dependence on reference implementation code. Possessing or using the kit does not itself prove an implementation is independent.\n`;
   const readmeBytes = Buffer.from(readme, 'utf8');
   fs.writeFileSync(path.join(outputDir, 'README.md'), readmeBytes);
   entries.push({ path: 'README.md', bytes: readmeBytes.length, sha256: sha256(readmeBytes) });
@@ -99,6 +103,7 @@ export function buildExternalVerifierKit(outputDir = 'dist/external-verifier-kit
     contract_snapshot_count: (catalog.snapshots || []).length,
     contract_migration_count: (catalog.migrations || []).length,
     challenge_sha256: sha256(challengeBytes),
+    challenge_cases_sha256: sha256(challengeCasesBytes),
     witness_vector_sha256: sha256(witnessVectorBytes),
     file_count: entries.length,
     root_algorithm: 'SHA-256 over UTF-8 sorted SHA256SUMS material',