{
  "_doc": "One result, read from the codebase’s own files at the commit named here. Every value is that file’s own, copied verbatim; nothing here is written by hand. A value replaced by {withheld: true, sha256_of_value, bytes} is committed by its sha256 instead of published, for the reason it states, and is never edited. Each whole source file is committed by sha256 below, and its bytes are published only where its visibility says so. The codebase is named by the public subject its files are published under.",
  "lane": "packaging-extraction",
  "repository": "packaging-extraction",
  "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
  "portfolio_id": "packaging-extraction:platform-delivery-surface",
  "id": "platform-delivery-surface",
  "attestation_row": {
    "attested_at": "2026-09-19",
    "attestor": "07-genesis",
    "repository": "genesis",
    "source_doc": "CROWN_JEWELS_RESOLVED.md",
    "source_doc_sha256": "781bf515d77ef14469d543ce87b2a15d0420237f5a9bc9b1a7b4899d0f935cb7",
    "state": "attested",
    "top_n": 31,
    "note_sha256": "1218191deb85b45fe5d2ef07e47c7d4e6c09061b6b8386e86759a6105204cd17",
    "ids_in_row": 31,
    "file": "dataroom/TOP_N_ATTESTATION.jsonl",
    "line": 1
  },
  "claim_source": {
    "receipt": "packaging-extraction/top40.json",
    "sha256": "1dca1ae6d762bd584ae11aa353701b702e3378cf912d8d64ec065e74f589319e",
    "field": "entries[38].claim",
    "file": "top40.json"
  },
  "top40_entry": {
    "id": "platform-delivery-surface",
    "rank": 39,
    "title": "The platform delivery surface, including the parts that are red",
    "claim": "The estate is evaluable as a platform — API, MCP tool surface, buyer-verify script and a Dockerized appliance — and the three zero-dependency replay verifiers cited to buyers all pass; the wider buyer_verify.sh suite is a different object, carried as red and NOT re-run this pass.",
    "scope": "THE WEAKEST EVIDENCE SPINE IN THIS DOCUMENT, and ranked accordingly. The API asset has NO verify_*.py gate at all and the provenance linter has NO gate AND NO committed witness. `make verify-buyer` covers ONLY the three stdlib replay verifiers, NOT the full `bash scripts/audit/buyer_verify.sh` suite, which is a different and still-red object.",
    "limits": "CORRECTED 2026-08-27 by re-audit: this entry previously read run_status=BLOCKED with a hand-written 'Known RED and not re-run this pass', while its own documented command `make verify-buyer` runs and EXITS 0. A buyer running it got a green against an entry claiming red. The two objects were conflated: `make verify-buyer` runs three zero-dependency replay verifiers (gate-tally, physics-properties, inadequacy-reports) and all three pass; `bash scripts/audit/buyer_verify.sh` is the wider suite. UNVERIFIED THIS PASS: the re-audit did NOT run buyer_verify.sh (it drives the full gate suite, ~1 h, and would rewrite many committed witnesses), so its red is carried forward from the prior entry rather than re-measured on 2026-08-27. The written refusals behind it are the point: 'editing a pre-registration to accept the new sha converts tamper-evidence into a rubber stamp', and 'NOT re-baselined: 112 would make the gate green while 15 buyer docs still point at nothing'. G2-AST-051's only verify_gates.sh touchpoint is api_contract_drift_detector.py and its standing evidence is April-2026 openapi smoke files plus pytest. G2-AST-058, the stdlib provenance linter, has no gate and no committed witness anywhere in benchmarks/. docs/API_ENDPOINTS.md is separately exactly 100 routes stale.",
    "artifact_path": "benchmarks/impossibility/inadequacy_tight_cluster_N6_2026_07.json",
    "witness_command": "make verify-buyer",
    "witness_result": "exit=0 · EXIT0_NO_TOUCH · verify-buyer: all three buyer-cited replay verifiers PASS",
    "witness_class": "ASSERTING",
    "witness_class_basis": "measured",
    "third_party_axis": "-",
    "facts": {
      "ran_with_receipt": true,
      "third_party_graded": false,
      "negative_control_stated": true,
      "ip_class_known": false,
      "reproduce_command": true,
      "regenerates_not_verifies": false
    },
    "facts_count": 3,
    "repro_command": "make verify-buyer",
    "reproduce_command": "make verify-buyer",
    "repro_packet": null,
    "ip_class": "UNKNOWN",
    "evidence_tier": "SIMULATED",
    "run_status": "RAN",
    "output_excerpt": {
      "withheld": true,
      "why": "uses a word the published record keeps for its own process (S3.1-DIALECT)",
      "sha256_of_value": "2faf5e0e9712d93a27680dc0ec6014c51c74e44a4a6c1fda64ebef4cad46f390",
      "bytes": 180
    },
    "attestation_rank": 38,
    "negative_control": "replay verifiers' negative fixtures (5) rejected"
  },
  "witness_quality_entry": {
    "id": "platform-delivery-surface",
    "portfolio_id": "genesis:platform-delivery-surface",
    "class": "ASSERTING",
    "measured_class": "ASSERTING",
    "basis": "measured",
    "why": {
      "withheld": true,
      "why": "uses a word the published record keeps for its own process (S3.1-DIALECT)",
      "sha256_of_value": "602cc8d7eb02237741eb1201aa122afe28a209dd39b8c2022e112f125c36f50e",
      "bytes": 439
    },
    "witness_command": "make verify-buyer",
    "exit_clean": 0,
    "exit_mutated": 2,
    "asserts": "FAIL|| a report did not verify"
  },
  "packet": null,
  "measured": {
    "measured": true,
    "basis": "exit_mutated = 2 (basis == measured)",
    "exit": 2,
    "defect_rejected": true
  },
  "register": {
    "truth_state": "attested",
    "truth_line": 201,
    "measured_per_register": true,
    "witness_class_per_register": "ASSERTING",
    "ip_class_public": "not_public",
    "ip_class_sha256": "c2ab54a718ff5484fea4f59ecc2a446deef5412ea225434433529a34a9764660",
    "ip_class_source": "docs/audit/CHIPLETOS_CANON_FACTS_2026_09_17.json:34 @ e47033d4758e",
    "receipt": "register/CROWN_JEWELS_TRUTH.md",
    "receipt_sha256": "bde06cf0d3e99644522d18e79b6bd5d84ed4f5c86e315a48fef207e9e49c5022",
    "ip_class_receipt": "register/ip_class.jsonl",
    "ip_class_receipt_sha256": "b1e8f97aa6779e0fefed2f7a7726e1a03563b536b497392401b49bb8ef84d4ca"
  },
  "withheld_fields": [
    {
      "field": "top40.output_excerpt",
      "codes": [
        "PROCESS_NARRATION"
      ]
    },
    {
      "field": "witness_quality.why",
      "codes": [
        "PROCESS_NARRATION"
      ]
    }
  ],
  "sources": {
    "attestation": {
      "receipt": "packaging-extraction/dataroom/TOP_N_ATTESTATION.jsonl",
      "source": "dataroom/TOP_N_ATTESTATION.jsonl",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "73bf88d1ecd6c3299599f1929a6fda2e3b20dbe725d908375a1aec5038f199e8",
      "bytes": 3855,
      "visibility": "sealed"
    },
    "top40": {
      "receipt": "packaging-extraction/top40.json",
      "source": "top40.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "1dca1ae6d762bd584ae11aa353701b702e3378cf912d8d64ec065e74f589319e",
      "bytes": 245175,
      "visibility": "sealed"
    },
    "witness_quality": {
      "receipt": "packaging-extraction/dataroom/witness_quality.json",
      "source": "dataroom/witness_quality.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "a5b45f767596df7e20404884fd30f0975b1931cf08bb7f3b4e4bfc4b83073c51",
      "bytes": 161552,
      "visibility": "sealed"
    },
    "repro_index": {
      "receipt": "packaging-extraction/repro/INDEX.json",
      "source": "repro/INDEX.json",
      "commit": "b8d9325aea6d8ef103cb3d1dd1c4ba77bd80ee2f",
      "sha256": "3e1cdc5f09bf5c34a582d32529e944a4fe565211faccceb3dc5a7a1724f68635",
      "bytes": 28509,
      "visibility": "sealed"
    }
  }
}