Certification reshape · for ratification · 2026-07-12

Provenance‑First Certification

Stop certifying the site against a reconstruction of the capture. Certify against the genome — the living record of what the practice is. Your instinct, sharpened by three adversarial judges who each tried to kill the frame and returned adopt-with-named-amendments. Determinism proven. This is the decision, not the build.

RATIFIED by Robert · 2026-07-12 · all four calls approved as recommended · build executing (Phase 0 in flight)
01

The shape — what the reshape is

Your instinct, sharpened by three adversarial judges who each tried to kill it and couldn’t. Everything below is built to these.

The move
Certify against the genome, not a reconstruction
Stop rebuilding an expected copy of the site from the capture and diffing against it (the “output-first” machine — the source of the false reds). Certify against the genome: the living record of what the practice is. The website is one projection of it.
Proven
The projection is deterministic
Two clean rebuilds of fairfax produced 346 of 347 served files byte-identical. The one difference is a build-timestamp that never touches what a visitor sees — and we remove it. The projection premise holds.
Honesty
Say “attested,” not “signed,” until it’s true
One corner of the certificate claims a cryptographic signature it doesn’t yet make. That’s a false green — worse than none. Honest label now, real signature as a tracked follow-on.
02

Two questions, not one — and they’re different jobs

The deepest thing the judges caught. Keeping these two apart is the whole ballgame.

The seam rule (the constitution’s law, applied to our own new frame): nothing grades itself. Axis 1 is the projector checking its own work — so the fidelity verdict must rest on Axis 2, which is anchored to the outside world.
~90% built
Axis 1 · Projection integrity
“Did the shipped site come faithfully from the genome?” Re-project the genome, check the shipped bytes match. Proves no tampering + needs determinism. But it’s the projector grading its own output over its own input — so it is structurally blind to whether a transform is correct. A buggy strip corrupts bytes identically on both sides and passes.
↘ go deeper — the machinery
Claim: deploy_bytes ≡ produce(genome). Already on disk: the genome-only-write gate compares the shipped tree against a re-projection (produce() = projectPageWithFacts, produce.ts:774), per-edit via witness leaf/complement, per-unedited-file via verbatim-resource equality. Not an output-vs-source diff. Residual blind spot: corruption of un-anchored served bytes by an HTML transform (T1–T5, produce.ts:776). Determinism: sole non-identical file is witnessId (produce.ts:1273), a wall-clock build-id in a _-prefixed sidecar already excluded from the served digest by isInternalIlDeploySidecar (proof-lineage.ts:82).
↓ the fidelity verdict rests here ↓
the trust root
Axis 2 · Provenance fidelity
“Does the genome faithfully hold what the browser actually received at capture — plus edits we made on purpose?” Anchored to external reality: the actual bytes the site served at capture. This is the only leg that isn’t self-grading. Every fact resolves to exactly one of three receipts — capture, attributed-edit, or ratified-transform — or it fails closed.
↘ go deeper — the three-kind receipt
capture: atom fold.byte_ref + recorder, byte-anchored to the manifest-pinned captured page, re-hashable vs manifest.json sha256. edit: attributed (+ eventually signed) lineage entry (editId, actor, reason, before/after). transform: registered/ratified declaration or RAR id. noSelfCertification: consumers re-hash, never trust the stamp. This is why the SR7 blank-slider defect fails closed by construction — disposition:"synthesized" is none of the three kinds, so it has no receipt, so it’s red. No hand-written “check for synthesized” rule needed.
↓
keep, scoped
The world-facing eye · completeness
A genome-internal frame can’t see a fact that was never captured (the blank-slider defect: nothing tampered, something never there). So we keep one check that loads the shipped site and the still-live original and confirms we didn’t silently lose something real. Completeness, not byte-diff. This is the external judge the “nothing-grades-itself” law demands — and it’s your Call ②.
03

Why this is right — in one line

The genome is the truth; the website is one projection of it; so we certify against the truth, not against a guess at the truth reconstructed from a photograph of it. The elaborate reconstruction — which had to guess which reference to compare against and re-enumerate every legitimate strip we make — goes away. What replaces it is already ~90% built. The work is finishing the honest wiring, not inventing a new machine.

04

Where the genome stands today — measured, not guessed

Run live against the fairfax genome (9,166 facts, 260 pages), not reconstructed by hand.

Facts90.8% anchored
8,322 of 9,166 capture-anchored, 2 attributed-edit, 0 red. The gap is 842 unanchored — a duplicate-authority defect, not a shipping hole (right).
Resources94.5% receipted
831 of 879 resource-byte rows carry a receipt. 48 without — including the 2 fonts we already know about (fa-solid-900, awb-icons). That’s the close-the-gap list.
842 twinsEdit a phantom
The 842 “unanchored” facts are dead twin records (page-title, meta-description) shadowing an anchored generic sibling. An editor binding to them would edit nothing. This is the two-rooms disease inside the genome — and it drives Call ③.
Determinism346/347
Byte-identical across two clean-room rebuilds. The 1 is the build-timestamp we remove in the first, trivial increment.
05

The build — the amendments the judges named

Six increments, deduplicated across the three judges. Most are small; several fold in work we already did or already have on disk. Sequenced so a truthful certificate can mint now (Call ④).

Phase 0 · honest cert now
A1 determinism + A2 honest labels
Kill the build-timestamp in served bytes (one line) & pin the projector’s external inputs. Relabel “signed”→“attested” until the signing chain is wired. Unblocks a truthful fairfax certificate.
Phase 1 · fidelity depth
A3 projector-correctness + A6 full enrollment + the world-facing eye
Close the “strips cancel ≠ strips correct” gap; enroll the whole genome as a truth class so the three-kind receipt guards everything; retain the completeness judge. The trust root.
Phase 2 · editing authority
A4 canonicalize facts + A5 real accessor-derivation
One canonical record per fact (cures the 842); replace the accessor grep with a Plato-backed AST derivation before resolve-by-role scales to ~919 readers. Justified by editing, not by the cert.
↘ go deeper — all six amendments with file:line
A1 Determinism + input sandbox: hash-derive/omit witnessId (produce.ts:1273); run two-run byte-equality on the servingSurface-only path the CLI probe skipped; pin HAR (produce.ts:733) + CAS-authority/url-map/genesis-config so “≡ produce(genome)” isn’t secretly “≡ produce(genome + hidden external state).”
A2 Receipt-authentication honesty: until rarSignatureChain (il-certify.ts:1479) is wired + the zero-placeholder transform signature (il-certify.ts:1628) replaced, label transform/RAR provenance attested-only. Edit-receipt editId hash-recompute is tamper-evidence, not unforgeability; residual trust root = repo-write-access + the Ed25519 cert key (external, uncommitted, il-certify.ts:2339).
A3 Projector-correctness gap: extend transform-recompute to the HTML strip chain, OR prove-complete the delegation (genesis-fidelity catches over-strip of anchored facts; Lane E zero-external catches leaks; the world-facing eye catches the middle). Resource transforms already fail closed (BLOCKED_TRANSFORM_RECOMPUTE_MISMATCH, assert-resource-byte-integrity.ts:54) but 0 fairfax rows exercise it & it doesn’t cover the 757 WP + 354 UserWay HTML strips.
A4 Fact canonicalization: one canonical record per fact; retire/subordinate the 842 duplicate twins.
A5 Real derived-accessor derivation: replace deriveAccessors’ literal-token grep (char-scanner bug + hand-list carve-out) with Plato-backed AST/reach-graph derivation before enforcing resolve-by-role across ~919 readers.
A6 Complete enrollment: enroll the whole genome (today: ajax-captured-body only, 1 of N); the three receipt kinds are the discriminator; clear the 48 unreceipted resource rows.
06

What could go wrong — honest

The world-facing eye creeps back into output-diffing
Mitigation: scoped to completeness (did we lose a real thing), never byte-fidelity. If it starts flagging our own legitimate edits, that’s the smell.
We over-build the resolver to justify the cert
A judge caught this. Mitigation: the resolver is justified by editing (the 842 defect), not by certification. Stated in the spec so we don’t gold-plate.
“Attested” quietly gets read as “signed”
Mitigation: the label is mechanical and the real signing chain is a tracked follow-on, not a someday.
“Strips cancel” mistaken for “strips correct”
The exact structural blind spot of Axis 1. A3 exists specifically to own it — the frame is not adopted without a plan for this gap.
07

How we’ll know it works

Two clean rebuilds of fairfax produce byte-identical served trees (already true bar the timestamp we remove). A synthesized-with-no-receipt fact (the SR7 class) fails closed by construction — provable by feeding one in and watching it go red with no hand-written rule. fairfax mints a certificate whose every claim is capture-anchored, attributed-edit, or ratified-transform — nothing unattributed — under honest labels. And the reconstruct-and-diff machinery is gone from the certification path (kept, if at all, only as the scoped completeness eye).

08

Your calls — the red-pen targets

① ★
Adopt the reshape (as sharpened)?
The call: make provenance-first the certification architecture — the two-axis shape, built via the six amendments. If yes: we retire the reconstruct-and-diff machine, finish the honest wiring, and run 24 certifies against the truth. Fewer false reds; the greens mean more. If no: keep patching the output-first machine run by run. My recommendation: yes. Principled, mostly built, stress-tested hard.
② ★
Keep the world-facing eye?
The call: retain the shipped-vs-still-live-original completeness check as the external judge — even though it’s the last surviving piece of output-comparison. If yes: the frame can detect the thing it’s otherwise blind to (a fact never captured); costs one scoped browser pass. If no: cleaner internal frame, but it can grade itself — the exact failure the constitution forbids. My recommendation: yes, scoped tight. This is the SR7 lesson made permanent. I want your explicit word because it’s the one place we deliberately keep looking at output.
③ ★
How far do we build the “one authority” machinery now?
The call: the heavy fix (one canonical record per fact, one resolver door) cures the 842-fact defect and gives single-authority editing — but a judge flagged it earns its keep for editing, heavier than certification alone needs. If now: cures the defect + single-authority editing, but it’s the biggest piece. If deferred: certification still works (the three-kind receipt handles cert honesty). My recommendation: enroll the whole genome now, but justify the resolver by the editing story, not the cert story.
④ ★
Block run 24 on the full reshape, or ship the honest cert first?
The call: the two trivial fixes (kill timestamp, relabel signed→attested) are one-liners; the deeper work is the bulk. If honest-cert-first: fairfax mints a truthful certificate now (attested, not overclaiming), deeper work lands as a clean follow-on — this is how we stop doing everything sequentially. If block: one big landing, longer wait. My recommendation: ship the honest cert first. Directly answers your “why so sequential” frustration.