receipt binding: a certificate names the bytes it swore to, the audit finds them in history, and the corpus is measured as it is

[fathomlab]

Leg 3, item 1 of papers/PLAN_the_next_level_2026_09_02.md — the one ADVANCE AUDIT_the_whole_program_2026_09_01.md named: bind receipts by digest, not by filename. Stacked on #60 (charon), which is stacked on #59; base is feat/charon-v01, which also gains one fixup commit here (papers/index_check.json 48→49, left stale when the charon INDEX row landed).

What this is

An OATH certificate recorded each receipt's digest and then bound by basename, so a receipt regenerated in place silently invalidated every certificate citing it — twice in two days (2026-08-31 → 09-01) and once in June — and the audit could not tell the receipt moved from the certificate is wrong. Now the certificate says which bytes it meant and the audit looks for them, for the document as well as the receipts. No verdict moves. No certificate is re-issued. The pinned first line of the corpus audit in REPLICATIONS.md is byte-identical in every mode.

The ladder, as the lab does it:

1. SPEC_oath_receipt_binding_2026_09_04.md — frozen alone, before any code (69e0e23).
2. styxx/receipt_binding.py (new; subprocess-only git, no GitPython), styxx/certify.py (+receipt_binding block on every new certificate; --require-committed), styxx/corpus_audit.py (--history auto|on|off; five cells per citation — same / at_issue / elsewhere / unbacked / unrecoverable — a document cell, stands_over_sworn_bytes with a reason on every null, and a binding: line beneath the uncovered line), the census script and its result (c554ab2, 6b4af8d).
3. The adversarial pass — ATTACKS_receipt_binding_battery_2026_09_05.md: 52 constructions, 36 broke a sentence or a rule, 12 in code, all repaired; the frozen SPEC carries a dated ERRATA; the census re-run from repaired code (5b83cc4).
4. RESULT_oath_receipt_binding_2026_09_05.md, sworn, 27 spans HELD, every number bound to a leaf of the census (0533803; re-sworn against the third census after the document cell was repaired).
5. A follow-up the census itself demanded: edited_after_issue_census.py diffs every document that moved under its certificate against the sworn bytes and lays the census beside Charon's log, line by line; RESULT_edited_after_issue_2026_09_05.md is sworn to it (21 spans). The diff caught two staging copies the second census had over-read as edited; the document cell was repaired, the third census run from committed code, and the first RESULT re-sworn.

What the census says about the corpus (sworn)

213 tracked certificates, 631 citations: 630 same (every one also present at its issuing commit), 1 at_issue (CAPSTONE_universal_mind's mind_v0_validation.json, rewritten seventeen minutes after issue in June — the certificate stands over the bytes it swore to), 0 elsewhere / unbacked / unrecoverable. Documents: 205 same, 8 edited after their certificate issued (all eight stand over the sworn document), 0 moved. Of those eight, one document (SYNTHESIS_connection_of_minds, in two certificates) lost two VERIFIED tokens and gained 26 numbers the published certificate never examined; the live audit still reproduces its recorded class. Charon and the census agree on 207 of 213 lines; the census places all six the log could only flag. 211 certificates stand over their sworn bytes; 2 do not, with every byte in place — both already known (KNOWN_VERDICT_DRIFT and the read≠write submission source) and both the verifier having moved, not a binding defect.

What it does not say

That a certificate is immutable, tamper-proof or self-verifying. That any receipt's content is true — binding says which bytes were sworn to. That this ran outside this lab or on Linux. CI never runs the corpus audit; on a depth-1 clone it prints binding: history unavailable (shallow clone), pinned by a test on a clone the test builds. The code lens of the battery did not run (usage limit); the builder's own reading stands in and is disclosed.

Verification

• tests/test_certify_by_digest.py: 23 passed, 1 NTFS skip (temporary repositories; one test over the tracked corpus by the census's population rule).
• Regression sweep (certify, corpus-audit, charon, capsule tests): green. Full suite on the rebased, post-battery tree: 3849 passed, 12 skipped, 4 xfailed.
• python -m ruff check styxx: clean. tests/test_sworn_eol.py: 121 passed.

For the operator

• Merge order: sworn v0.2: attacked twelve ways, four rules paid, the coverage number withdrawn — and the plan it serves #59 → charon v0.1: the ferry log — every verdict re-derived from bytes, chained, and attacked before it was announced #60 → this PR.
• The one decision this measures and does not make: the read≠write submission source (arxiv/read_neq_write/source.md) re-certifies FAILED where it recorded HELD, with every byte in place. Charon found it; the census places it. It is still yours to decide before any further read≠write submission.
• Owed after this: a corpus re-issue under R1 (its own cycle — every Charon OATH line moves), a blob-id search for renamed receipts, the same binding for capsules.

🤖 Generated with Claude Code