IC-EVIDENCE-IMPLEMENTATION-V5-20260911.md

IC-EVIDENCE-IMPLEMENTATION V5 — SERVER SNAPSHOT

Architect: Alexander Romaskevich / RomaskevicH Mission: IC-EVIDENCE-IMPLEMENTATION-WP-001 Package version: 5.0.0 Recorded: 2026-09-11 Europe/Kyiv

Reported package state

  • TSC_TYPECHECK_STATUS: NOT_EXECUTED_NO_RUNTIME_ENVIRONMENT
  • ACTUAL_TEST_STATUS: NOT_EXECUTED_NO_RUNTIME_ENVIRONMENT
  • REPRODUCIBLE_BUILD: FALSE
  • PACKAGE_HASH: NOT_COMPUTED_NO_FILESYSTEM_ACCESS
  • Lucas static verification: PARTIAL
  • E2/E3/E4/E5/E6: NOT VERIFIED

V5 structural improvements reported

  • JCS path introduced end-to-end in application hashing path.
  • Expected sequence/hash/version passed into trusted append function.
  • DB append function verifies caller hashes and event fields.
  • Dedicated imperial_evidence schema and SECURITY DEFINER append function.
  • pgcrypto migration added.
  • Idempotency reservation changed to ON CONFLICT DO NOTHING RETURNING.
  • Unified authorize-and-reserve action entrypoint added.
  • External-fact transition evidence table and transaction path added.
  • Payment amounts moved to integer minor units + currency exponent.
  • Passport signature metadata separated from agent identity key metadata.
  • Budget/external/financial missing-data checks changed toward fail-closed.
  • Placeholder DB tests converted to explicit test.skip markers.

Independent review — open blockers after V5

  1. Ed25519 implementation is still not validly proven and likely incorrect: Node Ed25519 should use crypto.sign/verify with algorithm null; createVerify('SHA512') is not the canonical Ed25519 API path.
  2. ledger-service compares DB errors using err.message exact equality. PostgreSQL RAISE EXCEPTION messages may carry wrappers/details; contention mapping needs robust SQLSTATE/custom code handling.
  3. Trusted append compares created_at JSON string to p_created_at::text. PostgreSQL timestamptz text formatting is not guaranteed to equal canonical ISO-8601 YYYY-MM-DDTHH:mm:ss.SSSZ, so valid events may fail integrity checks. Compare parsed timestamps or canonicalize inside DB.
  4. evidence_references are hashed after canonical unordered sorting, but p_evidence_references is passed from the original array order. DB JSONB array equality is order-sensitive; unsorted input can fail the field-binding check. Pass the same normalized array used for hashing.
  5. External-fact transition evidence stores from_state using a SELECT after the UPDATE, so from_state becomes the new state rather than the prior state. Capture old state before CAS or use UPDATE ... RETURNING old/new semantics via locked read.
  6. External-fact verifier proves presence of evidence records, not authenticity or cryptographic/provider verification. This remains evidence-presence verification, not source truth verification.
  7. Idempotency existing-row response still does not return executionId because idempotency_keys has no execution_id link. Existing executing/unknown/succeeded responses cannot identify the actual execution reliably.
  8. RETRY_ALLOWED path is not atomically claimed before creating a new action_execution_record. The UNIQUE(idempotency_scope,idempotency_key) constraint in action_execution_records can reject retries or race under concurrency.
  9. reserveIdempotencyKey returns NEW_RESERVATION if the existing row disappears between INSERT and SELECT. Under canonical no-delete semantics this should fail closed/retry transaction, not pretend a reservation exists.
  10. actionHash is computed from requestedAction with DEFAULT_PROFILE. Canonical action schema/profile must be explicitly defined so unordered fields cannot cause approval hash drift.
  11. Approval consumption and idempotency reservation are coordinated locally, but external side-effect execution remains outside the shown transaction/outbox protocol. Exactly-once external-effect semantics are not yet demonstrated.
  12. issuer trust store is empty, so all real passports fail ISSUER_UNTRUSTED until Architect-authorized bootstrap material exists.
  13. _privilegedRegisterTrustedIssuer being an exported throwing function is not a security boundary. Trust material must come from immutable deployment configuration or privileged storage unavailable to ordinary runtime code.
  14. payment_verifier role is declared in the report conceptually but V5 migration does not show a restricted verifier function/state-transition protocol that prevents other privileged application paths from setting RECONCILED.
  15. payment confirmation query does not compare currency_exponent between receipt and intent.
  16. ledger-verifier does not recompute payload_hash/event_hash, does not verify genesis anchoring, and returns postRepairChainOk=true unconditionally. It cannot satisfy canonical chain verification or repair semantics yet.
  17. Chain-repair checkpoint semantics from SPEC-003 are not implemented in the provided V5 source.
  18. package-lock.json absent; no reproducible build evidence.
  19. tsc --noEmit not executed; compile readiness remains UNVERIFIED.
  20. PostgreSQL integration/concurrency/permission tests remain skipped; E3/E4 cannot be raised.

Truth boundary

V5 is persisted as an implementation candidate only. This record does not assert IMPLEMENTED_LIVE, TESTED, RUNTIME_VERIFIED, PRODUCTION_VERIFIED, PAYMENT_CONFIRMED, or E6.

Next gate

ADRIAN V5.1/V6: close the open blockers above without changing canonical architecture. LUCAS: independent static verification against actual persisted source, then typecheck/runtime/integration verification when executable runtime is available.

NO-RECHECK: retest only changed components plus required regression dependencies after state change.