Appendix G. Exact wire, digest, append, event, and query reference vectors
These compact vectors make the prose testable. The maintained conformance repository must provide byte files, expected digests, detached proofs, SQL setup/teardown and multi-language runners. Ellipses in explanatory panels are not fixtures; executable…
Concept & directionLNK
These compact vectors make the prose testable. The maintained conformance repository must provide byte files, expected digests, detached proofs, SQL setup/teardown and multi-language runners. Ellipses in explanatory panels are not fixtures; executable vectors contain complete 64-hex digests and complete IDs.
#G1. Canonical JSON rejection and acceptance matrix
| Input difference | Canonical disposition | Reason |
|---|---|---|
| object members arrive in another order | accept; canonical bytes sort members | member order has no semantic meaning under the JSON profile |
| set-valued subjects arrive in another order | accept; schema total-key sorts | the schema—not the field name—declares set semantics |
| ordinary array arrives reordered | different record or invalid | sequence semantics are preserved |
| duplicate JSON member | reject before object construction | parsers must not choose first/last value differently |
| internal canonical text is decomposed Unicode | reject | signed internal lexical form must already be canonical |
| external serial uses variant spacing/case | preserve sourceValue; optional attributed normalized derivation | source evidence is not silently rewritten |
| open interval includes end:null | reject | absence means open; JSON null is not a canonical union member |
| number is 1e3, +1, 01, -0 or NaN | reject | numeric lexical forms are closed and deterministic |
| unknown body field outside extension point | reject | closed schemas prevent accidental semantic drift |
| unknown namespaced extension with valid lock | accept and round-trip | extension preservation supports open-world growth |
Reference verifier order
# byte-level verifier outline
raw = read_exact_bytes(limit=8_MiB)
obj = strict_parse(raw, reject_duplicate_keys=True, reject_invalid_utf8=True)
locks = registry.resolve_local(obj.schemaLock, obj.vocabularyLocks)
schema.validate_closed(obj)
lexical.validate_without_mutation(obj)
canonical = jcs_profile_1.serialize(obj, schema_set_sort_keys=locks.setKeys)
assert jcs_profile_1.serialize(strict_parse(canonical)) == canonical
recordDigest = sha256(b"RTRACER\x00RECORDCORE\x00v1.3\x00" + canonical)
verify_detached_proofs(recordDigest, current_trust_snapshot)
# never hash parsed dictionaries, ORM objects, protobuf messages, pretty JSON,
# database text, decompressed guesses or a projection as RecordCore bytes.#G2. Admission race oracle
| Concurrent request pair | Permitted committed result | Client outcome |
|---|---|---|
| same scoped idempotency key + same request digest | one record, one receipt, one outbox event | both receive original receipt; later response may be replay |
| same scoped key + different request digest | at most first request | other receives equivocation conflict and security finding |
| different keys + same recordId/digest | one unique record admission | other resolves duplicate record receipt or explicit conflict by profile |
| different keys + same stream expected sequence | one next sequence | loser receives expected-sequence conflict and reloads |
| old writer epoch + correct expected sequence | no append by stale writer | terminal fencing failure for that writer |
| outbox publish crashes after broker ack | one outbox row, possible duplicate deliveries | consumers converge by stable eventId |
#G3. Canonical record, receipt, event, and projection digest boundaries
| Changed fact | Digest that must change | Digest that must not change |
|---|---|---|
| portable body or semantic field | record/body; downstream receipt/projection | unrelated records |
| detached signature added | ProofRecord/proof set | RecordCore digest |
| tenant, stream sequence or received time | admission receipt | portable RecordCore |
| broker retry or consumer offset | transport-operation telemetry only | canonical eventData, eventId, record and receipt |
| audience/policy/redaction/as-of time | projection digest/ETag | source records/receipts |
| object encryption nonce | encoded artifact/envelope digest | plaintext artifact digest |
| schema migration projection | new record/projection/migration receipt | historical source bytes |
#G4. Stateful API transcript requirements
- Create two principals and two sender-bound credentials; prove that a token for service A fails at service B.
- Append a record at expected stream sequence zero; verify canonical bytes, record digest, receipt digest, sequence one and outbox event.
- Repeat the exact request after simulating a connection loss; obtain the same receipt and no second record/event.
- Retry the key with one changed body byte; receive the equivocation code without revealing prior private body content.
- Build public and owner projections at the same checkpoint; prove distinct projection digests and public non-interference after a private record is added.
- Replay broker delivery twice; materialized view and checkpoint advance once while delivery metrics count both attempts.
- Export the checkpoint-pinned dossier, verify every digest offline, import into another tenant as external assertions, and prove local grants/ownership are not copied.