KISMET Semantic Conformance Harness — candidate 0.1

Run from the extracted package root:

python3 -m pip install jsonschema pyyaml packaging
python3 validate_package.py
python3 conformance_harness.py
python3 conformance_harness.py --strict

validate_package.py uses the shared local policy-schema selector: original policies without $schema are checked against the unchanged v1 schema; explicitly selected v2 policies are checked against v2. Unknown selectors and malformed policies fail. This command reports policy schema validation only; the subsequent conformance harness checks typed semantics. Other contract families retain their v1 schemas. Package and core-gate command regressions are included in schemas/kismet/reference/test_package_validation.py.

conformance_harness.py returns exit code 0 if local contract checks pass; in default mode it prints PENDING for unresolved KCC references. --strict returns nonzero until all external references are resolved. An optional --external-registry registry.json accepts a mapping from artifact IDs to available version lists, but a version assertion is not evidence of the external artifact's schema or runtime conformance. The production integration must retrieve and verify authoritative artifacts and their digests.

Covered offline

• JSON Schema validation for each supplied KEC, KBC, KRC, KPC, KCC, and execution-manifest specimen
• Local ID and compatible version resolution; binding arity, resolver slots, permitted guards; policy target binding
• Resolver four-level fallback ordering, declared cohort evidence, negative mixed-cohort and mixed-snapshot checks
• Restricted, non-evaluating policy expression interpretation; boundary, overlap, gap, and admissibility examples
• KCC graph node identity, edge endpoints, cycle detection, and pending external references
• Manifest local reference compatibility, guards, payload hash consistency, resolver snapshot-hash format, anchored-state ALTD reference requirement, stochastic recording preconditions
• Reference z-score golden vectors, including zero variance and nonfinite rejection

Not covered / release blockers

• No live RIF or Scope 3 implementation is executed. Golden vectors test a reference model in the harness, not an independently built kernel.
• No actual cohort query, source dataset membership proof, snapshot byte retrieval, unit-class/type lineage, geographic derivation, quality eligibility evaluation, or resolver-produced hash verification.
• No complete edge port typing; external MEID and kernel contracts absent. No dynamic DAG execution, retry handling, or composition child-manifest closure.
• No actual object retrieval and SHA-256 recomputation for input/output/build artifacts. Reference and hash consistency are not proof of immutability.
• No ZAR trace lookup, ALTD cryptographic inclusion proof, authorisation/policy effectiveness checks, constitutional identity-registration checks, cross-environment reproducibility test, or CI integration.
• Policy-expression evaluator deliberately accepts only variable comparisons joined by and. Broader normative policy syntax needs an explicit contract and conformance suite before adoption.

Current external dependencies

• KISMET-KERNEL-UNIT-CONVERT
• KISMET-RESOLVER-CORE-EMISSION_FACTOR
• KISMET-KERNEL-RATE-PRODUCT
• MEID_GHG_QUALITY_SCORE

The supplied KCC is therefore a contract specimen, not an executable or independently proven Scope 3 composite.

Integration

Develop in the temporary zayaz-docs-mice workspace. Upon meeting release gates, propose a PR to viroway-ltd/zayaz-docs targeting main. Do not directly treat this package as canonical governance registration.

Candidate 0.2 — Core/domain gate separation and executable offline evidence

Commands from package root:

python3 release_gates.py --gate core
python3 release_gates.py --gate domain
python3 release_gates.py --gate all
python3 real_artifact_harness.py

• Core gate runs schemas, local semantic fixtures (without making external Scope 3 dependencies fatal), and independent test-only executable reference implementations. It does not imply operational ZAR or ALTD integration, production implementations, or constitutional registration.
• Domain gate runs strict composite reference validation. The four missing Scope 3 references remain blockers to Scope 3 adoption, not blockers to core offline conformance. An external version inventory is not proof of actual artifact attestation or correctness.
• Real artifact offline harness runs a separate z-score implementation against golden vectors, property checks, simple two-step composition, signed difference, seeded stochastic sampling, recomputed SHA-256 checks for actual local executable and retained input/output bytes, and tampering negative cases.
• Generated offline evidence uses evidence_level=offline_fixture_only and deliberately fails the authoritative ZAR/ALTD gate. The offline evidence specimen is a test-specific format, not a substitute for the normative KISMET execution-manifest schema. Build production adapters and independently verify authoritative ZAR/ALTD proofs before claiming full evidence conformance.

Remaining gates: proof-bound external KCC references and typed ports; real RIF/Scope 3 implementations; real frozen cohort source/member proofs; real ZAR lineage lookup and ALTD inclusion verification; runtime build attestation; registered KXID identities; CI wiring and constitutional release approval.

Candidate 0.3 — Read-only authority integration boundary

New: authority_evidence.py, authority_evidence_harness.py. Updated: release_gates.py, this README. Unchanged: schemas/kismet/, content/, validate_package.py, conformance_harness.py, real_artifact_harness.py, reference_kernels/.

Run python3 release_gates.py --gate core --authority to include seven new security-boundary tests. This flag does not connect to live systems and must not be interpreted as an authoritative production signoff. KISMET 0.3 defines a read-only ReadOnlyProvider interface, cryptographic Ed25519 receipt verification against independently provisioned trust roots, actual artifact-byte digest checking, and fail-closed ZAR lineage / ALTD inclusion-and-anchor / SSSR / method checks. A fixture provider cannot ever return AUTHORITY_VERIFIED.

The proposed output adapter retains a UTF-8 JSON object with exactly result and verdict (null when no verdict exists). Both must match the manifest; the retained object's hash is bound by signed lineage evidence. A result-only legacy payload fails this adapter contract. Changing severity, admissibility or rationale without changing the signed evidence is rejected. ZAR lineage and ALTD anchor claims must both carry manifest_hash: SHA-256 of the complete manifest encoded as sorted-key compact UTF-8 JSON with non-finite numbers rejected. No manifest fields are excluded. Receipts are external records, not embedded in that manifest; references must be allocated before signing. Changing any contract, resolver, build, guard or execution metadata requires new signed evidence. Older claims lacking this digest fail closed.

Integration remains blocked: the current canonical GitHub documents describe ZAR provenance and hash identities, but do not establish a deployable, authenticated, read-only endpoint for every required authority record or a trusted ALTD Merkle/Fabric proof verification adapter. Operator-approved trust roots, source schemas, transport authentication, and real proof verification must be supplied and separately tested. The proposed adapter receipt envelope is not an existing ZAR/ALTD API contract. verify_inclusion_anchor must independently check Merkle inclusion and finalized ledger anchoring; a booleans-only implementation is invalid. Also validate schema/manifest and the complete graph independently; this evidence module is not a substitute for the existing harness.

KISMET 0.4 — read-only authority adapter boundary

• NEW requirements-kismet.txt: reproducible test environment requirements; pin is for the verified development environment, not an OS-agnostic production lockfile.
• NEW dependency_preflight.py: checks missing/mismatched dependencies before the other core checks.
• NEW authority_adapters.py: AuthorityAdapter read protocol, guarded offline ReadOnlySnapshotProvider, and explicit fail-closed UnconfiguredLiveProvider.
• NEW authority_adapters_harness.py: 10 extra offline tests for declared references, traversal protection, and prevention of fixture promotion.
• NEW KISMET-AUTHORITY-ADAPTER-0.4.md: mappings, source distinctions, and conditions for eventual live integration.
• UPDATED release_gates.py: runs preflight for core and the new adapter tests with --authority.
• UNCHANGED schemas/, content/, previous harnesses, and reference kernels.

Install dependencies in the same Python interpreter as the gate:

python3 -m pip install -r requirements-kismet.txt
python3 release_gates.py --gate core --authority
python3 release_gates.py --gate domain

The core gate reports offline-only assurance when successful. The domain gate is expected to remain blocked on four Scope 3 external references. No connection to live ZAR, ALTD, SSSR, Method Registry or KISMET services is asserted.

0.5 — Real-source discovery and independent authority gate

Run python3 release_gates.py --gate core --authority to include the 0.5 negative/anti-promotion checks. Run python3 release_gates.py --gate authority to attempt the separately blocking production authority gate; it correctly exits nonzero until genuine authority adapters and ALTD verification are implemented. See KISMET-AUTHORITY-SOURCE-0.5.md.