KISMET 0.5 — Authoritative Source Integration & Proof Closure

Status: integration-discovery candidate, NOT authority verified.

Source findings (canonical repository)

• ZAR: content/key-zayaz-features/zar-artifact-framework/zar-core.mdx describes canonical YAML, hashing, review-before-activation, and immutable ZAR:ruleset:...@sha256:<digest> references. This is documentation, not evidence of a deployed read API or signing endpoint.
• SSSR: sql/zar/v_signal_registry_export.sql defines zar.v_signal_registry_export from zar.signal_registry joined to zar.signal_binding_registry, filtering registration and availability states. SQL defines an export view but not a cryptographic attestation interface.
• Method Registry: code/associated-files/introduction/database-tables/compute-method-versoning.txt describes ref_compute_method_registry, ref_compute_method_latest, and fact_compute_executions; this is a model, not verification of a live schema or API.
• ALTD: documentation references Merkle audit trees / Fabric anchoring, but an independently usable proof inclusion + finality verifier, trust roots, and endpoint contract were not established during this inspection.
• KISMET Registry: 0.4 contracts/examples exist locally. No production registry serving approved contracts has been verified.

Release-gate model

• --gate core --authority: offline contract, reference executable, and negative-test assurance; does not certify live sources.
• --gate domain: validates consumer-specific dependencies separately (four Scope 3 refs remain unresolved).
• --gate authority: intentionally BLOCKED until real authenticated adapters, independently trusted keys, and source-specific cryptographic proof tests are implemented.
• --gate all: includes all gates and consequently returns nonzero while domain/authority are unverified.

The 0.5 readiness JSON (optional) is never treated as independently verified evidence. Even all-green self-reported flags are blocked. Authoritative closure requires a future executable adapter runner capable of actually fetching bytes, validating keys/signatures and proofs, and ensuring exact KXID/manifest/lineage identity match. Local snapshots do not satisfy this requirement.

Required work to clear the authority gate

1. Identify deployed endpoints / DB read replicas and authentication for each authority, recording service owner, environment, principal, and immutable ID mapping.
2. Implement bounded read-only retrieval with deny-by-default namespaces; validate exact payload bytes, digests, versions, and source provenance.
3. Provision trust roots outside the KISMET package; verify key rotation/revocation and signing scopes.
4. Implement a real ALTD inclusion proof verifier against trusted Fabric-finalised anchor evidence; test absent, tampered, stale, unfinalized, cross-tenant and mismatched proofs.
5. Verify execution manifest -> KEC/KBC/KRC/KPC/KCC -> ZAR lineage -> ALTD anchor -> SSSR/method applicability with end-to-end test data from authority-operated test systems.
6. Only after independent verification succeeds, implement an executable authority gate adapter and enable AUTHORITY_VERIFIED.

No fake keys, dummy records, or self-asserted signing/anchoring flags should unlock the gate.