Lineage-Conformance-Corpus: review candidate iter8 (shared object under review with No Silent Landing)

lineage-conformance-corpus: BOUNDED CANDIDATE iter8 finalization (2026-07-22), for joint review before the
neutral public repo is stood up together. NOT the public corpus; staged for review only. Owner-GO required
before any upload/post.

iter8 supersedes iter7 (root 6751925f...) non-silently and closes the two corpus-layer seams Loek
confirmed in his iter7 review (his review bundle fcef2698... referenced by digest, not embedded):

1. Comparator decoy axis. The committed comparator now judges T3_DECOY on object_integrity + native
   lineage + overall + expected exit, version aware. Native lineage stays VERIFIED (the resolvable but
   wrong parent, known gap F1); the security verdict is the relying-party policy layer (overall FAIL,
   RELATION_TARGET_MISMATCH, exit 3). vectors/shared_expected_v0_1b.json states the same, and the
   oracle derives overall FAIL from a policy signal, not from ok alone. Result-provenance: result.json
   is the committed comparator's output and every label is reproducible offline from the recorded raw
   --json (harness/verify_result_provenance.py, 6/6), so there are no hand labels.
2. T1 harness key. The T1 case runs the embedded fixtures/t1-canonical-invalid-signature/receipt.json
   under its own key, not T1_presentation.json under the shared key.

Plus verify_candidate.py hardening (fail-closed manifest checks, silent on success so the six-PASS
contract holds: duplicate path, case-fold collision, NFC collision, directory-only entry, manifest.json
inner-map consistency, and member-type-independent top-level confinement; negative tests in
verify_candidate_negtests.py), an oracle fail-closed on a missing predicate/subject, an F17 finding-id
alias map (candidate PB-2026-0717-NN equals the signed register PB-2026-0718-NN), and the stale
attestation-pending markers corrected to complete (3.6.0/3.6.2). Origin V0.1B unchanged. Apache-2.0
unchanged (CC-BY still proposed). The T1 identity route (exact bytes vs faithful equivalent) stays OPEN.

iter8 finalization (2026-07-22): the strongest full adversarial deep gate over the finalized iter8 tree,
run as independent skeptic juries over multiple rounds, found internal-consistency and No-Overclaim items
the lighter delta gate had missed; this sweep closes them without a conformance re-run. Round 1 reconciled
manifest.json's inner files-map with the committed bytes (it had drifted for the three iter8-edited files
while MANIFEST.sha256 was already current), added a fifth silent manifest check (the two integrity records
can no longer disagree), tightened the result-provenance wording to its honest boundary, corrected a stale
SPEC.md attestation marker by content, and gave the two provenance records backing JSON Schemas. Rounds 2-5
then hardened the harness verifiers to the class, each round exposing the neighbour of the prior fix:
verify_result_provenance.py gained a summary + item completeness floor, a self-consistency cross-check, a
per-(case,axis) exact-key floor, a version-independent CLOSED-gap binding for the security decoy, and
grounding of EVERY per-case field (the axis-level metadata annotations, field_results_derived_from, the
recorded evidence, the decoy narrative fields, and T3's no-policy layer). A round-6 confirmation gate (6
lenses, model-diverse falsification-first jury) then found that three evidence-self-report containers were
still trusted at the aggregate level and closed that class: each byte_anchors item's want is now grounded
against the byte-anchored spec's pinned digest and its match recomputed, the mutation_self_tests checks are
RE-RUN against the committed oracle with each pass recomputed, and format_layer_no_policy gained an
exact-key floor plus note grounding, with a shipped verify_result_provenance_negtests.py proving each
container forgery fails closed. The same round made verify_candidate.py's top-level confinement
member-type-independent (a directory-typed member outside the tree no longer slips through) and completed
verify_candidate_negtests.py so it drives all 14 pre-iter8 fail-triggers end-to-end through main() (incl the
directory-confinement regression). A final confirmation round found the round-6 canonical-shape fix was
itself an instance fix and swept the exact-key floor to the sibling grounded dicts (exit_check,
honest_conformance, the mutation_self_tests wrapper) with a generic forcing-function sweep proving the class
stays closed, and closed a fourth derived-artifact-drift instance (a stale loose deliverables/MANIFEST.sha256)
by regenerating it as a byte-copy of the tree's and adding sha256sum -c CHECKSUMS.txt as a forcing function.
The committed comparator is left byte-identical to the attested 18-check oracle; an evaluated lineage-gating
hardening (R3) and a cosmetic self-test naming imprecision (R4) are disclosed as residuals rather than
applied without a conformance re-run. Origin V0.1B and Apache-2.0 unchanged; the T1 identity route stays
OPEN. See provenance/difference_record.json (iter8-finalization).

Root sha256(MANIFEST.sha256) = 9f827e25706479daa420bb4bcf680899e169ce52d813936452d47f2801651063
Transport lineage-conformance-corpus_candidate_v0.1.0_iter8.tgz 95051 bytes
sha256 bd36a163b849a1005d97d25e7f1e85d767e56e1c38a4c0766901fbb611eb85ab
Run bundle proofbundle_c0t4_review_bundle_iter8_20260721.zip 35560 bytes
sha256 8720841c44cfac9903a89d3177f203918f64f964958244778fd51d8498f734b9
Test-stand proofbundle 3.6.2 wheel 25fe62b5...fd22 / sdist 470d1166...4eb4 (digests pinned in the manifest;
the byte-exact-vs-PyPI equality is an out-of-band attestation-time check, not machine-grounded in
the run bundle, see difference_record R1)

Byte-verify with the included verify_candidate.py (stdlib only, no network): 6/6 PASS, exit 0; any
flipped byte fails closed at the transport layer. Run the committed comparator against 3.6.2 to
re-derive the six-case run, then verify_result_provenance.py to confirm no hand labels.
verify_candidate_negtests.py and verify_result_provenance_negtests.py are the fail-closed regression
suites for the two verifiers (each check trips on its crafted defect and is silent on the clean input).

iter8 went through a multi-round adversarial deep gate: independent skeptic juries repeatedly exposed a
fix as still instance-level and drove it to the class (per the fix-the-class discipline). Findings closed:
decoy named-code printed not asserted; provenance grounded only the derived side, then only the per-case
labels, then every per-case field, and finally three evidence-self-report containers that were still
trusted at the aggregate level (byte-anchor want ungrounded, mutation checks not re-run, no format-layer
key floor); the case-collision manifest check needed the correct filesystem fold model (validated on a real
case-insensitive APFS volume: full Unicode case folding, the union superset); a member-type-dependent
confinement gap; a legacy test-coverage gap; an inherited PB-03 reproducibility overclaim against the
corpus's own named authority. All fixed and re-gated. See provenance/difference_record.json.