Establish canonical byte authority and separate canon from consumers

[devin-ai-integration]

Summary

Establishes the canonical byte as the single source of truth in the repo and separates canon authority from consumer repos.

Core addition — CANONICAL-BYTE.md: One-page document making it impossible to confuse:

• canonical LogLine = byte (JCS canonical JSON stored in Postgres bytea)
• hash = content address of the byte
• JSON/markdown/hex = disposable views (render(byte))
• URL = envelope (not hashed, not canonical content)
• receipts compose by hash via confirmed_by

Verification — scripts/canon-verify.py: Deterministic script that reads source/logline.canon.json, canonicalizes, emits bytes, computes SHA-256, verifies against expected values and source/logline.canon.sha256.

Formal receipt — VERIFICATION-RECEIPT.md: Scoped evidence status separating what is verified from what is not.

Byte vector — conformance/byte-vectors/receipt.admission.vector.json: First conformance byte vector with all three hashes verified bit-by-bit across two independent implementations (Python + Rust).

Cleanup:

• Removed examples/logline.canon.{json,logline} — exact byte-for-byte duplicates of source/
• Removed proposals/ — content already absorbed into LIP-0002 and spec/if-doubt-simulation.md
• Added source/logline.canon.sha256 — constitution content address for downstream pinning
• Added lips/README.md — explains LIP process
• Added MOVE-MAP.md — classifies every file by repo boundary (canon/engine/trust/registry/minilab)
• Updated README.md — reflects new structure, adds verification command

Not touched: source/logline.canon.json, source/logline.canon.logline, spec/*, crates/*

Verification Receipt

command:
  python3 scripts/canon-verify.py

canonical byte reconstruction/hash:
  scope:   canonical byte reconstruction/hash only
  status:  VERIFIED
  bytes:   3851
  sha256:  sha256:7ca6dd1e1101ad4a9fef6570cc97751c831cd977be33b3e6669c543fe82dde1d

byte equivalence:
  scope:   stored bytes vs recomputed bytes
  status:  VERIFIED
  method:  diff logline.canon.stored.bytes <(recomputed)
  result:  identical (0 byte difference)

conformance byte vector (receipt.admission):
  scope:   receipt.admission triple hash verification
  status:  VERIFIED
  tuple_hash:   sha256:723dc708...6072fc
  result_hash:  sha256:f9adb161...2339ad
  receipt_hash: sha256:fff62e0c...9fa61
  method:  two independent implementations (Python, Rust)
  result:  all three hashes match bit-for-bit

repository CI health:
  scope:   GitHub Actions CI (rust + artifacts jobs)
  status:  UNVERIFIED
  classification:  preexisting billing lock
  detail:  "The job was not started because your account is locked due to a billing issue."
  evidence: all 5 workflow runs in repo history show same failure, including 4 on main
  consequence: does not verify repo health; does not contradict canonical byte hash

Review & Testing Checklist for Human

• Run python3 scripts/canon-verify.py locally — must print VERIFIED
• Review CANONICAL-BYTE.md — does byte/hash/view/envelope match your model?
• Review MOVE-MAP.md — do repo boundary assignments match your intent?
• Review VERIFICATION-RECEIPT.md — is the scoped evidence status adequate?
• Verify conformance/byte-vectors/receipt.admission.vector.json hashes match cargo test output

Recommended test plan: run python3 scripts/canon-verify.py and confirm VERIFIED. Then cargo test (if toolchain allows) and compare receipt hashes with byte vector.

Notes

CI failure is not a code issue — GitHub Actions is locked due to billing. All 5 historical workflow runs failed with the same billing lock error. Canon byte verification is independent of CI health and passes.

Link to Devin session: https://app.devin.ai/sessions/6db3830fe6654560a1b0767ad98b73b4
Requested by: danvoulez

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring