lineage-conformance-corpus iter10 (review candidate, 2026-07-25)

lineage-conformance-corpus candidate v0.1.0 iter10 (2026-07-23)

iter10 adds a RUN-CONTEXT SEAL binding a green 6/6 verdict to the candidate root it recomputes
and stamps (P06 value-binds it in run_context; anchoring that tree to the pinned ARCHIVE digest
is verify_candidate.py's job on the .tgz). It hardens the first-party conformance instruments
only; it does NOT touch the proofbundle receipt cryptography (0 core findings). This is a review
candidate: adoption pending (not occurred), no public push.

Digest chain (FINAL):

• tree-root db1de79e5203f7183c4cd2fa99485a5e91edd57a3bc59daa2e10a5687aeb1b7b (= sha256(MANIFEST.sha256))
• transport 7e74008cf6924e5330d93d74c50ffe5a0f74ae0f855ea34c7a6ad9a153160676 / 133831 B (deterministic PAX, reproduced)
• run-bundle 722fc46399f0f714ae428bbead2a105965bf2223ceb8f1bd15990772c897cb2e / 28404 B (pinned in CHECKSUMS, not tree-referenced: binds tree-root via run_context)
• seal spec dd18794ff52c86a77fdb4de168ebba266bbccc50c97034487e44e288bc45a8c5 (vectors/run_context_seal_v0_1.json, protected by MANIFEST tree.match)
• origin V0.1B fa89a9f095a1e5eac99b2cb5d8e3706de0c3e4f6b3180d66c3ded03dbd87b651 (unchanged)
• prior iter9-root ba24053f... (superseded, non-silent in the difference_record)

Adversarial deep gate verdict: WITHSTANDS_DEEPGATE[v4/sc1/DEEP-6L7I/FULL]@db1de79e5203f718
(14 rounds fix-to-class; the strength recomputes to FULL from a stored receipt over the run
evidence, not asserted).

Sealed seams (17, each with a must-trip negative in seal_negtests.py, all fail-closed): P01
relation swap, P02 wrong key, P02c key read-once, P03 check/use swap, P04 oracle override, P04
policy override, P04b offline oracle, P04c oracle read-once, P05 fake executable, P05b substituted
canonicalizer shim, P05c case-dir shim plant, P05d program read-once, P06 foreign result, P06b
run_context extra key, P07 anchor got:=want, P08 duplicate keys, P10 negtest-skip.

Verify:
python3 verify_candidate.py lineage-conformance-corpus_candidate_v0.1.0_iter10.tgz
python3 seal_negtests.py --tree --run-bundle --snapshot

Honest boundaries (No-Overclaim, disclosed):

1. executed_program_digest pins the proofbundle 3.6.2 SOURCE SNAPSHOT, not the official PyPI wheel.
2. executed_program_digest + canonicalizer_shim_digest bind ONLY the code the harness controls on
   the verdict path (proofbundle's own source + the injected JCS shim). proofbundle's third-party
   runtime dependencies (cryptography, cbor2, ecdsa, nacl, click) are environment-provided and are
   NOT covered by either digest; substituting one needs write access to the environment (~owning the
   harness). This is a disclosed boundary, parallel to wheel-vs-snapshot, not a claimed binding.
3. PROOF OF EXECUTION: the LIVE comparator run binds the verdict to the pinned identities (P01-P05
   fail-closed). A handed-over result.json checked OFFLINE by verify_result_provenance.py proves only
   internal consistency + a match to THIS seal identity (P06 rejects a foreign result); it does NOT
   prove the pinned program ran (raw + run_context can be minted offline from the public constants).
   Re-run the committed comparator, or sign the result, to establish execution.
4. The SEALED cases (C0-T4) inputs/keys are byte-pinned; the T3_DECOY case input/key bytes are NOT
   byte-pinned (only its policy_digest is checked); decoy byte-pinning is a parked follow-up.
5. run_context.commands + seal_version are recorded metadata (presence-floored), not value-bound.
6. P03 use-time input hashing catches a substitution BEFORE the run; a filesystem race between the
   harness read and the verifier's re-read is a bounded residual (same-verdict substitution only, cannot
   flip a byte-pinned verdict).
   The T1 exact bytes (7123a0c9), the Apache-2.0 grant and the V0.1B origin are unchanged. Deliberately
   parked (difference_record): REG-4 rest (P09/P11/P12), decoy byte-pinning.