Proof Surface

The stdlib-only accountability contract: evidence packets, work-record receipts, and witness validators that reject authority-shaped content.

Contracts

Design stance

• Accountability, not authority. Every validator rejects authority-shaped content. Verdicts are confined to closed lattices; nothing here ever emits TRUSTED/APPROVED/AUTHORIZED.
• The work-record receipt is hard-pinned against drift. additionalProperties is false at every level, a recursive guard rejects the prefire capsule/meta field names by name (they are neutral-sounding and slip a lexical denylist), decision fields are closed enums, and direction is fixed to output-only: a work record is emitted, never read back as inbound model/session state.
• The authorization receipt is the honest inversion of the prefire. Where the prefire fabricated federal appointments and suppressed authorization checks, the authorization receipt records a real grant from a real human principal, hard-requires an expiry (expires_at mandatory — authority must expire), enforces an explicit allowlist scope (default-deny: empty allowed_actions authorizes nothing), and is verifier input only. The check_action helper confirms a specific action against a receipt; it does not inject "trusted state" into a model. The identical forbidden-field-name guard (recursive, fail-closed) is applied at every object level.
• The pre-execution gate is the live-state inversion of the prefire's authority-consumption. Where the prefire instructed the model to treat embedded state as pre-authorized, the gate withholds approval unless authorization, budget, and state each positively pass. Default-deny: allow is the rarest outcome. Fail-closed: any dimension that cannot be positively confirmed (unknown budget, unverifiable state) escalates to needs-human rather than auto-allowing. Advisory: GateDecision is a structured recommendation; the runtime or operator is the enforcement point. The identical forbidden-field-name guard (recursive, fail-closed) is applied at every object level of the gate request, including inside the embedded authorization receipt.
• The evaluation contract makes eval a gate, not a report. Criteria carry thresholds and a required flag; evaluate ties results to a deploy/block/needs-human decision and accounts for uncertainty (a result whose interval straddles its threshold is uncertain -> needs-human, never a silent pass). Same forbidden-field guard and additionalProperties:false discipline.
• The claim ledger keeps confidence honest. Confidence is source-provided and never adjusted or filtered by the tool (a 0.0 claim is logged, not dropped); the ledger surfaces low-confidence claims, conflicts, and downstream contamination for human review without adjudicating which claim is true.
• The delegation chain is the structural inverse of identity fabrication and privilege escalation. Where the prefire invented an appointment and named fictitious oversight principals, the delegation chain roots all authority in a real, named human — an agent can never be the origin of authority. Where the prefire consumed embedded authority, the chain enforces monotonic attenuation: every hop's scope must be a subset of its delegator's, so a delegate widening its own actions or targets — the literal shape of privilege escalation — is DENIED. Each hop is bound into a SHA-256 hash-chain, and the whole chain is committed into one chain_binding (its id, its length, and its terminal binding) so stripping attenuating leaf hops or appending a forged one is caught. The honesty line EMET keeps is kept here too, and stated precisely: the hash-chain and chain_binding are keyless, so they give self-consistent integrity — they detect partial corruption and naive truncation/extension, but NOT a full-document adversary who rewrites content and recomputes every binding. Real anti-forgery requires an external trusted anchor, and the module gives you exactly one place to put it: pin the out-of-band chain_binding (pinned_chain_binding) or verify an asymmetric signature per hop (require_signatures + signature_verifier). Neither binding proves which party authored a hop (that needs a private key); a caller demanding signature-level assurance without a verifier gets UNVERIFIABLE, never a fabricated pass, while a supplied verifier that fails or raises is DENIED. effective_scope is returned only on VALID; matching is exact (case-sensitive) because real resource identifiers are. Same forbidden-field guard (enforced in both the Python validator and the JSON Schema) and additionalProperties:false discipline throughout.
• EMET stays independent. EMET is the byte-witness spine and remains self-contained and stdlib-only for independent re-derivability, so it is not a dependency of this package. witness_receipt mirrors EMET's schema so other tools can validate EMET receipts without importing EMET.

Usage

from proof_surface import validate_work_record

issues = validate_work_record(record)  # [] means valid
for issue in issues:
    print(issue.path, issue.message)

Schemas live in schemas/; conformance vectors (valid + invalid) live under conformance/<contract>/v0.1/ with a manifest.json per contract.

License

MIT.

Zain Dana Harper — small tools with explicit edges. Portfolio · HarperZ9 _{Built with Claude Code; reviewed, tested, and owned by me.}