Building Agent Passport System, day by day.

Day 145: 4.0.0, and a second audit before the announcement.

SDK 4.0.0 is a major because two things changed shape. The threshold check verifies each signature before it counts toward the threshold, which changed the exported evaluateThreshold signature, and receipts move from the v1.1 to the v1.2 Merkle construction. Before the release I ran a second adversarial audit of the fix set. It found real defects sitting behind green suites, patched before this went out, the same order as last time: audit, then announce.

Threshold verify-before-count is the one that forced the major. A multi-party threshold now verifies each signature and counts only the ones that verify, so an invalid signature can no longer be counted toward meeting a threshold. The old path counted first and verified later, which is the wrong order for a gate. The fix changes the function's exported shape, so consumers pin the new call and the version reflects it.

The verifier also stops trusting shapes it should not. Null guards across the verifier treat a missing value as unbound rather than throwing, and a governance path that should have failed closed on absent evidence now does. The frame is the same one this project keeps: when the evidence is missing, deny, and a receipt states what it proves and what it does not.

On the conformance suite the Go runner now recomputes action_ref for the actionref-canonical vectors and asserts them, where before it recorded them without recomputing. The four vectors move from recorded to checked, and the Go and TypeScript runners agree on that category.

The same hardening is landing across the other packages, their releases to follow, and the MCP threshold change waits on this published SDK before it can build against the new call. The draft's next revision goes to the datatracker when the window reopens on July 18.

Day 144: delegated action evidence.

This release answers one question. When an agent acts on someone's behalf, what can a third party verify afterward without taking anyone's word for it? SDK 3.3.0, Go 0.3.0, Python 2.8.0 and MCP 3.3.0 ship five pieces of the answer. Bilateral pair reconciliation checks that both sides' receipts describe the same action. Revocation observation records let a verifier sign what it saw: when a revocation appeared and when enforcement caught up. Evidence bundles commit a batch of records to a Merkle root so an auditor can verify one record without holding the full set. Action references now have a locked canonicalization with byte-identical test vectors across TypeScript, Python and Go. Jurisdiction selection records state which rulebook applied and why.

The frame stays honest. None of these records prove an outcome was safe. A receipt states what it proves and what it does not. What changed is how much of the proving can happen independently. The vectors are public, the checks recompute from held bytes plus the issuer key and a verifier needs nothing of mine to run them. That is the property the whole release serves: evidence a counterparty can attack rather than a claim they are asked to accept.

Today's patch came out of that independence. While swapping the gateway onto the SDK audience check I probed the edges and found checkAudience throws on a JSON null aud. That value is attacker-deliverable, so a bare verifier could be crashed by the very object it was verifying. 3.3.1 ships the fix. An explicit null is treated as unbound, a non-object aud returns the malformed reason and an unbound audience fails the check whenever one is required. Every path ends in a reason code and none of them throws, with regression tests behind each. Small patch, wrong failure mode gone. The gateway was never exposed because its adapter coalesced the value, but the SDK should not need a bodyguard.

Next steps are external. The point of receipts is exchanging them with implementations I do not control. The draft's next revision specifies the two new record classes and goes to the datatracker when the submission window reopens on July 18.

Day 143: merged before nine, corrected by our own review before midnight.

The denied-before-dispatch example vector is merged into the OWASP Agentic Skills Top 10, and a correction to our own README went up the same day. The vector ships with a standalone offline checker, and the project's fixture-corpus proposal now requires every content-derived identifier to declare its preimage fields, citing the five-field versus four-field split from that pull request as the reason. Then an adversarial three-model review of our own merged text found the word proves where it did not belong: a hash stored beside the fields it commits to detects accidental corruption, and detects tampering only for a verifier holding the identifier from somewhere other than the record itself. PR #50 replaces the overclaim and names the distinction underneath the split: a pairing key must be recomputable by a party that does not know the policy, a seal on an unsigned record must commit it, and one identifier cannot do both jobs.

Three Internet-Drafts published since March arrive independently at pieces of the same design: per-hop mandate narrowing, delegation receipts with cascade revocation and an instruction-provenance check, and a content-derived action identifier over the same four fields under RFC 8785. draft-pidlisnyi-aps-03 is built with a Related Work section citing all three; the chronology lives on datatracker and needs no argument from us. The third weekly AAT cross-stack drop also landed in the conformance suite, the act-binding digest recomputed from its stated preimage and rotation continuity byte-identical to last week's live token, so the boundary page moved that claim from off by default to exercised by one vector, which is all one vector earns.

Day 141: hardening the supply chain across every public repo, and killing a class of bug, not an instance.

The OpenSSF Scorecard on the SDK went from 6.9 to 8.9 in a day, and the honest part is which points we did not chase. Dependencies pinned by hash, workflow tokens scoped to least privilege, a signed release with provenance, static analysis and fuzzing on every commit. Two checks stay capped on purpose: Code-Review sits at zero because a solo maintainer cannot approve their own pull request, and inventing a reviewer to move the number would be gaming the exact signal the check exists to measure. The score is a byproduct of the work, not the work.

A dependency advisory in one repo turned out to be three, because the scanner reads every lockfile and npm audit reads one. An esbuild advisory (GHSA-g7r4-m6w7-qqqr) was patched at the root of the SDK, and the same version sat unpatched in four workspace lockfiles and in the conformance suite. Root npm audit reported clean the whole time. The fix bumped the transitive parent within its own declared range in each place rather than forcing an override, and the public conformance suite, the artifact anyone can clone to check our claims, no longer ships a known advisory. The lesson is cheap to state and easy to miss: audit every lockfile, not the one at the root.

Day 140: the first release that signs itself, and two bugs the fuzzers found before anyone else could.

[email protected] published to npm through a tag-triggered pipeline that proves its own provenance, with no stored token anywhere. Pushing a version tag now runs the full gate (type-check, test, audit), builds, publishes over OIDC Trusted Publishing, and attaches a signed SLSA provenance attestation and the tarball to the GitHub release. The registry can show, per release, that the artifact came from this workflow in this repo and nowhere else. The alternative was a long-lived publish token sitting in the repo as a standing credential, which is exactly the kind of ambient authority the protocol argues against, so the release path does not hold one.

The same release shipped coverage-guided fuzzing, and it earned its place immediately by finding two real bugs. Seven Jazzer.js harnesses, ClusterFuzzLite, and fast-check property tests now run against the parsing and verification surface. Two genuine defects surfaced and were fixed before this version tagged: a CBOR map-length case that hung the invite decoder, and verifyPassport throwing on a non-array delegations field instead of rejecting cleanly. A verifier that crashes on malformed input is a verifier an attacker can take offline with a single bad byte. Both are closed, both have regression coverage, and the fuzzers keep running.

Day 138: a signed record that states what it does not prove.

The accountability-record fixture set is public in the conformance suite. One signed record per boundary decision, twelve deterministic vectors including the negatives, and two verifiers that recompute everything from the bytes up: validate.py against the JSON schema plus Ed25519 signatures, verify.ts independently in a second language, with the two vectors it defers to the Python verifier documented rather than silently skipped. The README leads with the part most receipt formats leave out: what the record does not prove. It carries no outcome or safety claim, and settlement_ref is an opaque correlation hint, not a settlement proof. A record that overstates its own evidence is worse than no record, because a verifier will believe it.

The set went straight into the x402 post-settlement accountability thread, where the open question has been what a payment proves after the payment: settlement shows the caller paid, not what the agent did with what it bought, or that the trail was not edited afterward. Within hours a thread participant cloned the suite cold, ran both verifiers in isolation, and reported all twelve vectors reproducing, both schema negatives correctly rejected, and cross-language byte-parity holding. That is the property the fixtures exist to make cheap: anyone can recompute the record with no trust in us, our runtime, or each other.

Day 137: the site's redesign landed end to end, and the day's real work was re-verifying our own claims.

The v2 design transfer finished today. Twenty pages share one system now: the homepage deck with its mobile drawer, thirteen content pages, six bulk-converted long-tail pages, light and dark themes keyed to the deck's palette, a persistent header everywhere. The blog kept its dated bodies byte-identical through the conversion; the assert that guarantees it ran against a 386,837-byte region and passed. The roadmap is a horizontal multi-lane timeline again, nine workstream lanes over the same roadmap.yaml, an accordion so it fits one screen, a today marker the view scrolls to. The dev log grew a day picker built at runtime from anchors the posts already carried.

The harder work was a verification pass over the site's own claims, and the findings cut in opposite directions. Performance figures flagged as unsourced turned out to be recorded, evidenced claims with commit lineage; they stayed. Two latency rows that looked equally official had no measurement behind them anywhere, not in the benchmark suite's five scenarios, not in any results file; they entered a Day 104 draft reading like measurements and survived until today. They are gone, replaced by the one receipt fact the results actually support. The constraint-facet count flipped twice under scrutiny: fifteen originally, corrected to fourteen, fifteen again after the audience facet landed. The claims record now carries the full lineage, and the benchmarks page lists the fifteen real facets from the type definition instead of a looser list.

Also today: verified coverage on the media page, the ID-JAG binding surfaced on protocol and docs, the Regulated Action Profile finality rule and the 16/16 action_ref cross-validation stated in their recorded wording, and the roadmap data backfilled through today.

Day 133: the hosted gateway's money path now checks authority where it counts, inside the write lock.

The gateway's delegation and receipt paths went through five rounds of adversarial review across three independent models, each round attacking the previous round's fixes, and the surviving stack deployed today. A receipt is now signature-verified at ingestion before it is stored, so the store holds evidence rather than claims. Root authority became an origin property: an agent that has ever received a delegation is never inferred to be a root, roots are designated through an audited admin action, and a designated root that later accepts an inbound delegation is demoted in the same transaction that records the delegation, with an audit row naming the cause. Restoring it takes an explicit re-designation with a written reason. The review's last finding was the sharpest: the grant path read the grantor's authority before taking the write lock, so across processes a revocation or demotion could land between the check and the insert. The grant now re-verifies the grantor's status, root standing, and inbound delegation inside a write-locked transaction, and a mismatch fails the grant instead of committing on a stale read. The schema migration behind all of this is transactional and marker-gated, so a crash between the column add and the backfill re-runs instead of silently skipping.

The Go SDK caught up to the same honesty rule the TypeScript SDK shipped a day earlier. Go's TraceBeneficiary used to report verified: true from lookup success alone, with no signature checked anywhere. It now carries the same split as TS 3.0.0: resolved means the chain maps to a known beneficiary, and verified means the receipt signature and every delegation hop pass real Ed25519 verification, with a cross-implementation test holding the two SDKs to the same answers on the same fixtures. A field named verified that never ran a verifier is the exact failure mode the protocol exists to remove, and it is now gone from every SDK that had it. The weekly cross-vendor token exchange also continued: this week's AgentLair pair verified against their published JWKS and landed in the conformance suite, with an opt-in act-binding claim joining the cadence next week.

Day 132: verified now means a verifier ran, and the SDK takes a major version to say so.

TypeScript SDK 3.0.0 changes what traceBeneficiary().verified means, and the change is breaking on purpose. The field used to report lookup success: the chain resolved to a known beneficiary, so it said true. It now reports cryptography: the receipt signature checks out under Ed25519 and every hop in the delegation chain passes signature and temporal verification, or the field is false. The old semantics did not disappear, they moved to a new resolved field with an honest name, so a caller that only needs lineage still gets it and a caller that needs proof can no longer mistake one for the other. Python 2.6.0 ships the same pair, and the two SDKs produce byte-identical RFC 8785 canonical payloads on shared fixtures, verified in both directions.

A second primitive shipped alongside it: a stateless verifier for composition-check receipts. CompositionCheckV0 follows the same produce and verify split as the Regulated Action Profile: an attestor produces the receipt, the SDK only verifies the anchor, meaning the signature, the binding to the checked artifact, freshness, attestor trust, and whether the attestor is independent of the party it checked. The result is a small enum, pass, fail, indeterminate, or not_checked, and there is no boolean named safe anywhere in the type, because a receipt can state that a check ran and what it returned without claiming the composition is harmless. Independence is classified from the caller's own trust context rather than from anything the attestor says about itself.

Day 130: a live demo where the agent spends real authority and never sees the secret.

At AGI House's Agent Identity Build Day we wired APS to 1Password and ran the loop on stage: an agent asks to spend, the gateway decides from delegation math, and the credential stays in the vault. Four beats, all live. A 42 dollar purchase inside the delegated budget is allowed and executes with the real key. A 300 dollar purchase over budget is denied before any credential is touched. A prompt-injection attempt that tells the agent to ignore its limits is denied the same way, because the gateway evaluates the signed delegation rather than the agent's text. And every decision lands as a signed receipt attributable to a specific key. The property worth stating precisely: the agent's context only ever contains an op:// reference, the resolver runs on the gateway side and only on an allow, so a denied or manipulated agent has nothing to exfiltrate. Credential custody is 1Password's work; the allow and deny logic is deterministic delegation evaluation, and none of it is model judgment. The demo is public at aeoess/aps-1password-demo.

Day 128: a delegation chain is only as signed as its parent link, and four surfaces shipped the fixes together.

An adversarial hardening pass across every APS surface found and closed a related family of gaps, and the fixes released together as TypeScript 2.9.0, Python 2.5.0, Go v0.2.0-alpha.3, and MCP 3.2.4. The sharpest one: subDelegate did not verify the parent delegation's signature before minting a child, so a forged parent could seed a chain that verified from the child down. The child path now verifies the parent first, in all three language SDKs. ValidateChain in Go failed open when not_after was missing and now fails closed. The spend gate was currency-blind, so an amount check could pass against a different denomination; spend narrowing now rejects a unit change once a delegation carries one. Capability tokens in the MCP now enforce expires_at at mint and at use, and RFC 9421 signature verification enforces the expires parameter it previously read past. Each fix landed with the adversarial vector that finds it, and the changelogs name the versions a consumer should move off.

Day 127: a regulated action reaches finality only when two trust domains outside the operator agree.

The Regulated Action Profile v0 ships in SDK 2.8.0, and its rule is to count trust domains, not signatures. An action above a class threshold, rank three or higher, is not final because someone signed it, including the operator that ran it. The verifier returns reconciled only when a pre-committed intent reconciles against two anchors that sit outside the operator's own trust domain: the identity provider that authorized the actor, and the resource's system of record that confirms the effect. It counts the distinct domains behind those anchors and refuses reconciled, and the regulator_grade_for_class level above it, unless that count is at least two, the resource confirmation validates under an independently registered key, and the intent was anchored in time before the effect. One party holding two keys is still one domain, and the verifier treats it as one. judgment_correctness is always emitted as not_claimed, because the receipt type has no field for a model's reasoning. A claim about whether a decision was wise cannot be expressed in it, only whether the authorized path was followed.

What the profile does and does not cover is written into the build, not just the prose. The verifier is deterministic and stateless, and 33 conformance vectors pin every disposition, including the cases where a hostile operator forges one side of the reconciliation and the verifier still refuses to call the action final. A second implementation in Python, with its own Ed25519 and JCS and no shared code, reaches the same decisions. What the reference build does not do on its own is reach reconciled end to end. Its boundary attestation runs at a weak level, because a process that can observe its own child can also influence it, so an honest run on one machine reports intent_precommitted and stops there. reconciled is gated on a deployment whose attestation node is a separate principal: a separate operating-system user, a separate container, or a remote signer. The verifier and the vectors carry the security argument now, and the deployment carries the rest. The composition is the part that is new. Receiver-attested receipts, intent pre-commitment, and bilateral co-signing are each prior work. Placing an external identity-provider authority as the second trust domain, and letting the verifier decide finality from the domain count in a setting where the operator is the adversary, is what this profile adds.

Day 126: a signal type now has to earn "canonical," and the validator enforces it.

A term in the governance vocabulary used to become canonical the moment someone added it, which let a single issuer's signal sit at the same status as a reviewed one with nothing recording how much support it actually had. The fix is a lifecycle. Canonical now requires two or more independent implementations. A term with one implementation is proposed, carries a review_by date and a promotion trigger, and stays there until a second independent implementation appears. A term with no implementation is reserved, also dated, and is removed by default at its review date rather than lingering. A term with no status at all is read as proposed, never as canonical, so silence cannot confer authority. Two further rules keep definitions honest: a definition states what the signal is without naming or depending on any one implementer, and a term cannot cite its own issuer as the ground for its status. The whole fifteen-term registry was re-sorted under the single rule, not only the terms that triggered it, so every status reflects the same test. The rule lives in CONTRIBUTING, the validator enforces status, the review dates, and definition purity, and a term that claims canonical with fewer than two independent issuers fails the check.

Day 123: a sub-delegation can no longer outlive its parent, and a spend unit cannot change once a delegation has one.

Time was the one narrowing dimension that did not hold at delegation creation: a child could be created with a longer life than its parent, while scope, spend, and depth all narrowed correctly. Two creation-time defects combined to allow it. createDelegation built the expiry with setHours and an || 24 default, which turned a deliberate zero-hour window into a fresh 24 hours and dropped fractional hours. And subDelegate computed the child's window as a duration from one reading of the current time, then passed it to createDelegation, which re-based that duration on a later reading, so the child outlived the parent by the gap between the two readings, and an already-expired parent produced a fresh 24-hour child. The fix moves expiry to millisecond math, reads the current time once, rejects a parent whose expiry is non-finite or already past, and sets the child's absolute expiry to the earlier of two times: 24 hours from now, or the parent's expiry. That absolute value is signed directly, so no relative duration enters the signed object. The invariant now holds to the millisecond at any depth: a child's expiry is at most its parent's. This is creation-time enforcement, matching how every other narrowing dimension works in the SDK today. It does not add a verify-time or chain-level temporal check.

The spend dimension got the matching guard: once a delegation carries a spend unit, a child can narrow the amount but cannot change the unit the amount is measured in. A child that switched the unit could restate the same number against a different denomination and pass an amount check while stepping outside the parent's spend constraint. The guard rejects a unit change at narrowing once a spend dimension exists, with adversarial cases in the vector set. Separately, the action-ref-v1 conformance vectors gained a verification_mode field that marks whether each vector is structurally enforced, a reader that omits the field treats the vector as enforced, and both the JavaScript and Python runners now print a tally of the field. No code path or hash changed for that annotation.

Day 122: an anchored trail recomputes to the same correlation key, and the delegation vectors cross-encode into a second envelope.

An independently anchored action trail recomputed to the same external correlation key, with no shared code on either side. A separate implementation anchored an action trail on Arbitrum and published its action_ref together with the four-field preimage behind it. We recomputed the external action-ref-v1 key two ways: once with a plain RFC 8785 JCS canonicalization and a SHA-256, with no APS code in the path, and once with the published APS verifier. Both produced the anchored value byte for byte. The match is about dependency, not novelty: the preimage of action_type, agent_id, scope, and timestamp is the entire surface, so any verifier reconstructs the key from the receipt alone and needs nothing from the originating runtime. A result like this is two implementations converging on one derivation, which is not the same as one depending on the other. The external key stays separate from the APS-native request-identity form, which carries a multi-scope array; the two are different layers on purpose, and the interop record labels which one each vector belongs to.

The four delegation-chain vectors re-encoded into a second envelope format and passed that project's own verifier. The APS chain-envelope vectors, a valid narrowing accepted and then a widened scope, an expired parent, and a revoked parent each rejected, were re-expressed in the AAE signed-JWS envelope shape and run through its reference verifier. All four were schema-valid and returned the expected verdicts, and the rejection reasons matched that verifier's own strings rather than ours. The revoked-parent case is a cascade evaluated at check time, not a stored flag. What is shared and what is not is written next to the vectors: APS enforces as a rule a constraint the other format marks as a SHOULD, the envelopes differ in how they are signed, and a constraint-monotonicity case the other set covers is recorded as a gap rather than smoothed over. The cross-encoding merged to the conformance suite and went onto the working thread.

Day 121: a key resolver bound to the server, and to the moment of signing.

did:cycles resolution moved off a did:web-style, origin-rooted form and onto the hash-bound, window-gated model the Cycles thread settled on. A did:cycles identifier is now the hash of the server it belongs to: the subject is sha256(server_id), and the key set is fetched from a path derived relative to that same server_id rather than from the origin, which closes a cross-tenant key-confusion class where a key under one tenant's origin could answer for another. The key is selected by the validity window covering the receipt's issued_at, not by whichever key is current, and resolution fails closed when no key's window covers that moment, when a window bound is missing or non-integer, when more than one key matches without a kid to disambiguate, or when the named key carries private material. The work this merged change does not do is left out on purpose: binding issued_at to the authentic signed payload is the verify-path step that comes next, and the byte-for-byte Cycles conformance vectors come with it. The resolver is exported but not yet reached by any live verification path, so it lands additively rather than as a half-migrated seam, and no Cycles-conformance claim ships before those vectors exist.

On the vocabulary registry, the validator caught up to the evidence standard in one more place. A crosswalk's verified_at can now be a per-system map (PR #112) rather than a single date, so a file that maps several protocols records when each one was checked and measures its staleness window from the oldest of those dates. cap_vocabulary v0.2 (PR #109) merged with its upstream citations pinned to specific commits and its intra-decision ordering left unstated where the source spec states none.

Day 120: a standard for carrying a claim the registry did not make.

The crosswalk registry now has rules for the claims it hosts but did not author. A crosswalk says how some other system uses a governance signal, which means most of its cells are claims about a third party. The new evidence standard makes those claims carry their own basis: a qualifier travels with the claim it qualifies, so a cell pulled into a slide or a screenshot cannot shed the basis it depends on. A claim about an outside system carries the attestation of whoever verified it, under their name, rather than being asserted in the registry's own voice. Publicly verifiable is the unmarked default, and anything weaker than that is marked in the cell's displayed value, not in a sibling field a reader never sees. The described system keeps a standing, low-friction way to contest a cell. And a cell never states that a system lacks a capability as a fact about the system; it states what was searched and not found, listing the repos, documents, and versions examined, so the claim is a durable search result rather than a verdict.

The validator now backs the part of that which can be mechanical. A reverify date is a control only if expiry changes something, so an expired reverify_by with no fresh evidence fails the cell to a stale state instead of sitting as a note nobody enforces, and elapsed time never upgrades a cell. The negative fixtures that are supposed to fail run in their own pass and are asserted to fail, so a real production run stays clean and a fixture that quietly stops failing becomes its own error.

Day 119: the correlation key gets a second conformance set, built separately.

The cross-ecosystem action_ref form now has an AEOESS-built conformance set merged into argentum-core, the joint draft's reference implementation, sitting in its own aps/ directory alongside the recomputation fixtures already there. Fifteen vectors, ten accepts and five rejects, reproducing the draft's first appendix vector byte for byte. Two derivations written against the same words, kept in separate trees, landing on the same bytes. That agreement is what shows the spec is unambiguous, and it holds only while the two paths stay visibly independent, so the set is kept as its own author-set rather than folded into the reference vectors.

A note on which key this is. APS carries two action_ref primitives with intentionally different preimages: the native one signs APS receipts with a multi-scope array and a second-precision timestamp, and the external one is the single-string, millisecond form built for crossing systems. The conformance set tests the external form, because that is the one other stacks have to agree with. Neither key has to bend to the other.

Day 116: an independent implementation of the correlation key, and a runnable place for the record to live.

Overnight the action_ref correlation key got something better than another citation: an independent re-derivation. A separate Internet-Draft of the primitive picked up a conformance set from the AgentGraph implementation, built with its own RFC 8785 path in Python and Node, that reproduces Appendix A Vector 1 byte for byte (fdd7f810...3d89f5a). It covers the edges that catch naive implementations: an empty scope kept distinct from an absent one, and a did:key self-certifying agent_id. The agreement is the evidence, and it only holds while the two derivation paths stay visibly separate, so the proposal keeps it as its own author-set rather than folding it into the reference vectors. The boundary stays explicit in the appendix text: an action_ref proves a declaration is intact and recomputable, not that the runtime behavior matched it.

The other half of the day was about where the record lives. A ClickHouse maintainer, on their own mcp-clickhouse repo, asked for a runnable delegation layer on top of their credential pass-through sketch. The example is the answer: an agent gets a delegation limited to certain tools, with an expiry, instead of the user's full access, and every tool call writes a signed boundary receipt into a table next to the query log. Three reads pass, one out-of-scope drop is denied and recorded as a signed outside receipt, and a tamper test edits a stored row by hand and watches verification fail on that exact row, because the signature is made when the decision happens, not from the row in the table. It installs from PyPI and runs in one command against a local server.

To make that one command true, the Python SDK went to a stable release. pip install agent-passport-system now delivers 2.4.0 rather than resolving to an older line, with the Wave 1 accountability surface the example depends on: scoped delegation, the authority-boundary receipt, and the honest scope-of-claim field that records what a receipt does not assert. The version that installs by default is the version the example was tested against, which is the only state worth shipping.

Day 115: two registry reviews, one fixture suite shipped upstream.

The crosswalk registry now has a review standard: payment_rail (PR #100) and cap_vocabulary v0.2 (PR #109) both carry pinned upstream citations, rules marked descriptive or proposed rather than universal, in-file minting requirements, and recorded sign-off from the second implementer. SpendGuard approved #109 with a correction that proved the point: their spec ships no intra-decision order, so the registry records none. Same day, the action-ref-v1 recomputation fixtures went upstream to argentum-core: fourteen vectors, four drift families, every negative a real digest of its stated drifted bytes, fail-closed by construction.