R12 ETTR Isolated Learnability v2 Custody Specification

Protocol: R12-ETTR-IL-v2 Document schema: r12-ettr-il-v2-custody-spec-v1 Status: Phase-1 custody and source-deletion mechanics implemented; no production population, job, training, development opening, confirmation opening, or capability claim is authorized by this document Repairs: implementation-audit blockers 1, 6, 13, 15, and 16 Does not repair: implementation-audit blockers 2-5, 7-12, or 14

1. Scope and mandatory interpretation

This document replaces the hash-custody, candidate-metadata, overlap-audit, source-identity, and confirmation-opening clauses of R12_ETTR_ISOLATED_LEARNABILITY_PREREG.md under the new protocol identifier R12-ETTR-IL-v2. The v1 split and fold commitments are retired because their preimages were not published. They must not be accepted as aliases for the v2 commitments below.

The semantic generators, typed command ASTs, rectangle expansion, query grammars, outcome projection, structural presentations, ETTR target materializer, update schedule, and binding-deranged control now have Phase-1 implementations. A conforming custody instance must still stop before fitting until their exact source inventory, literal production population, and population-level audits are committed in Phase 2. Custody completeness is not learned-capability evidence.

The terms MUST, MUST NOT, REQUIRED, SHALL, and SHALL NOT are normative. Any unrecognized field, schema version, enum value, file, mount, descriptor, signer, seed domain, or state transition is fatal.

2. Primitive encodings and identifiers

2.1 Canonical JSON

CJ1(x) is the repository's existing canonical JSON contract:

(json.dumps(
    x,
    ensure_ascii=True,
    allow_nan=False,
    sort_keys=True,
    separators=(",", ":"),
) + "\n").encode("ascii")

Inputs are limited to objects, arrays, strings, integers, booleans, and null. Floats, duplicate object keys, lone surrogates, non-NFC strings, and integers outside [-9223372036854775808, 9223372036854775807] are rejected. Protocol keys, enum values, paths, IDs, and domains are ASCII. Readers must parse and then require input_bytes == CJ1(parsed_value). JSONL is a concatenation of CJ1(row) records; an empty file and a missing final LF are invalid.

The following aliases are used:

• H(b) = SHA-256(b), lowercase 64-character hexadecimal when encoded.
• HFILE(path) = H(literal file bytes).
• hex32 is exactly 64 lowercase hexadecimal characters representing 32 bytes.
• hex64 is exactly 128 lowercase hexadecimal characters representing 64 bytes.
• u16be, u32be, and u64be are unsigned big-endian integers of the named width.
• A relative path is nonempty ASCII, uses /, has no empty, . or .. component, has no leading /, and is already normalized.
• Arrays called files, entries, signatures, or events are sorted by the key stated for their schema and contain no duplicate key.

2.2 Signed objects

All signatures are raw Ed25519 signatures. A detached signature object has exactly:

schema                 "r12-ettr-il-v2-detached-signature-v1"
payload_sha256          hex32
role                    one authorized role
public_key_hex          hex32
public_key_sha256       H(bytes.fromhex(public_key_hex))
signature_domain        one exact domain from Section 8
signature_hex           hex64

Verification message is ASCII(signature_domain) || 0x00 || bytes.fromhex(payload_sha256). Signing a JSON object's embedded empty-signature form is forbidden. Every payload is signed by hash as specified above. Signature objects themselves are encoded with CJ1.

This deliberately reuses the Ed25519, immutable single-link read, write-once, and CJ1 patterns in train/ettr_factorial_authority.py, train/ettr_factorial_signed_custody.py, and train/ettr_deployment_contract.py. Their factorial schemas and signature domains are not reusable for v2.

3. Literal commitment preimages

For each block below, the preimage is exactly the single ASCII JSON line between the markers plus one LF. Markers and Markdown fences are excluded. The parser must reproduce the stated byte count and SHA-256 before using it.

3.1 Master commitment

The master preimage is exactly 58 ASCII bytes including its final LF:

R12_ETTR_IL_V2|2026-07-26|custody-complete|source-deleted

Its SHA-256 is:

8d3201be7e2f0a6e047223a67342971df70bd8be533ab50c80dd42e2208432c6

3.2 Split specification

SPLIT-SPEC-PREIMAGE-BEGIN

{"candidate_tuple_fields":["schema","fold","split","ontology","stratum","theory_instance","theory_pool_index","worlds","commands","depth","renderer","presentations","queries","opaque_seed","generator_ordinal"],"candidate_tuple_schema":"r12-ettr-il-v2-candidate","counts":{"score_rectangles_per_ontology_stratum":96,"train_rectangles_per_depth_per_fit_ontology":384,"train_rectangles_per_fit_ontology":1152},"folds":[0,1,2],"ontologies":["horn","rewrite","resource"],"presentations":["base","alpha_reorder","alias_split","relation_reification","type_twin","execution_semantics_twin"],"protocol":"R12-ETTR-IL-v2","renderer_ids":[0,1,2,3],"schema":"r12-ettr-il-v2-split-spec-v2","seed_domains":["candidate-rank","opaque-name","renderer-choice","presentation-choice","query-choice","paraphrase-choice","donor-derangement","classifier-fold","classifier-permutation"],"splits":["train","development","confirmation"],"strata":["seen_id","rule","composition","renderer","rule_composition","rule_renderer","composition_renderer","all_axes"]}

SPLIT-SPEC-PREIMAGE-END

Byte count: 1033 SHA-256: a09f82684c8a118a633b0bb23e244de961166ebdd3593485d897c8c27deb9747

3.3 Fold specifications

FOLD-0-PREIMAGE-BEGIN

{"fit_ontologies":["rewrite","resource"],"fold":0,"protocol":"R12-ETTR-IL-v2","schema":"r12-ettr-il-v2-fold-spec-v1","seed_context":"fold/0","withheld_ontology":"horn"}

FOLD-0-PREIMAGE-END

Byte count: 169 File SHA-256: a4293ae0cf972abfdfb155ad4268dceeafcb7d9ebc4df975002d08896ea65ab8

FOLD-1-PREIMAGE-BEGIN

{"fit_ontologies":["horn","resource"],"fold":1,"protocol":"R12-ETTR-IL-v2","schema":"r12-ettr-il-v2-fold-spec-v1","seed_context":"fold/1","withheld_ontology":"rewrite"}

FOLD-1-PREIMAGE-END

Byte count: 169 File SHA-256: 6e0b45dbdb28af3684db1649767a50bae6dd5ba9d8c7fdfbae6b4edad16af425

FOLD-2-PREIMAGE-BEGIN

{"fit_ontologies":["horn","rewrite"],"fold":2,"protocol":"R12-ETTR-IL-v2","schema":"r12-ettr-il-v2-fold-spec-v1","seed_context":"fold/2","withheld_ontology":"resource"}

FOLD-2-PREIMAGE-END

Byte count: 169 File SHA-256: ff127ca341c8215fe4d08883d2aef9a29a3ca810adc8cf44fbe7a565c4961f68

Fold commitment is:

H(
  ASCII("R12-ETTR-IL-v2") || 0x00 ||
  ASCII("fold-commitment") || 0x00 ||
  bytes.fromhex(split_spec_sha256) ||
  bytes.fromhex(fold_spec_file_sha256)
)

The resulting commitments are:

4. Candidate tuples, enumeration, and seed domains

4.1 Tuple schema

A candidate tuple has exactly the fields in the split preimage, in the following types:

canonical_tuple_bytes = CJ1(tuple). Ontology and custody metadata exist only in assessor records. They are not rendered or mounted for a candidate. ambiguity_deleted_twin is not a v2 causal-population presentation and is therefore absent from the split preimage; it remains score-only on the pre-existing sealed seven-variant board.

4.2 Enumeration and selection

The future semantic specification must expose one finite iterator for each (fold, split, ontology, stratum) in ascending generator_ordinal. An iterator must emit every syntactically constructible tuple exactly once before admissibility filtering. Generator ordinal is assigned before filtering and must not be compacted after rejection.

The admissibility predicate is a pure function of the canonical semantic ASTs and the future committed semantic specification. It must not inspect tuple rank, model output, optimizer state, development result, confirmation result, or encryption randomness. Until that predicate and iterator are source-frozen, materialization remains unauthorized.

For each cell:

1. reject malformed tuples and duplicate canonical_tuple_bytes;
2. evaluate admissibility;
3. compute rank = PRF(split_key, "candidate-rank", canonical_tuple_bytes);
4. sort by (rank as 32 unsigned big-endian bytes, canonical_tuple_bytes);
5. take the first exact quota;
6. fail if the quota is unavailable; never relax, reroll, or borrow.

SHA-256 rank collisions are resolved by tuple bytes. Two different tuples with identical tuple bytes are a generator error.

4.3 Keys and deterministic domains

The public seed root is:

K_public = H(ASCII("R12-ETTR-IL-v2/public-seed-root\n"))
         = bba84905d8f0d574ddb7e348bde9dc83b19b55a0374984988ac47664c07128a4

For train and development:

split_key =
  HMAC-SHA256(
    key=K_public,
    msg=ASCII("R12-ETTR-IL-v2") || 0x00 ||
        ASCII("split-key") || 0x00 ||
        u16be(fold) || 0x00 || ASCII(split)
  )

For confirmation, K_confirmation[fold] is 32 CSPRNG bytes generated inside the independent custodian after the implementation source and authority record are sealed. It is never stored in a repository, manifest, command line, environment variable, log, or candidate account. Its public commitment is:

H(
  ASCII("R12-ETTR-IL-v2") || 0x00 ||
  ASCII("confirmation-seed") || 0x00 ||
  u16be(fold) || K_confirmation[fold]
)

split_key = K_confirmation[fold] for confirmation.

The only PRF is:

PRF(K, label, context) =
  HMAC-SHA256(
    key=K,
    msg=ASCII("R12-ETTR-IL-v2") || 0x00 ||
        ASCII("seed") || 0x00 ||
        u16be(len(ASCII(label))) || ASCII(label) ||
        u32be(len(context)) || context
  )

Allowed labels are exactly the nine seed_domains in the split preimage. Mutable PRNG state shared between labels, folds, or splits is forbidden. A stream is PRF(K,label,context || u64be(counter)) for counters from zero. Uniform integer selection from [0,n) reads successive unsigned 64-bit words and rejects values at or above floor(2^64/n)*n; result is word mod n.

Semantic plaintext and all train/development choices are deterministic. Confirmation semantic plaintext is deterministic conditional on its secret seed. Confirmation seeds, encryption keys, nonces, key IDs, attempt IDs, and timestamps are randomized custody bytes and never affect semantic selection.

5. Tokenizer identity

The only admitted tokenizer payload has:

The runtime manifest must additionally pin the CPython executable SHA-256, platform tag, tokenizers wheel or installed-distribution file inventory, and every shared-library SHA-256. Merely recording version 0.22.2 is insufficient. The tokenization identity object has schema r12-ettr-il-v2-tokenizer-identity-v1 and exactly the table fields plus runtime_inventory_sha256.

Required conformance vectors are:

The four verbose renderer byte strings are strict ASCII decoded one-to-one and encoded with add_special_tokens=False for parser and leakage conformance. Model-visible WORLD, COMMAND, and QUERY use the separately frozen token-native structural transport in the semantic-generator specification. Its exact fixed-width token arrays, parsed logical prefix, deterministic cover suffix, and codebook identity are all recorded assessor-side. Any package/runtime/vector/codebook mismatch fails before overlap audits.

6. Candidate metadata and ontology isolation

Candidate-visible stage inputs consist only of raw WORLD, COMMAND, or QUERY bytes and the frozen model/runtime inputs appropriate to that stage. Candidate mounts, file names, JSON wrappers, batch records, environment variables, row order sidecars, and descriptors must not contain:

• ontology/family names or numeric domain codes;
• fold, split, stratum, renderer, theory, presentation, or variant IDs;
• tuple, row, packet, donor, oracle, target, answer, or disposition IDs;
• source paths, generator ordinals, seed commitments, or ciphertext metadata.

The existing stable "d" field used by factorial qualification payloads is forbidden. Removing the field name while retaining a stable per-ontology integer is also forbidden. Candidate syntax must use one ontology-neutral AST envelope and generic type tags shared across all three ontologies. A parser must infer structure from the anonymous syntax rather than receive an ontology selector.

Every materializer field has one classification:

candidate_semantic, candidate_opaque_split_local, assessor_only, or custody_only.

The classification map is source-frozen and exhaustive. Rendering may consume only the first two classes. A dynamic taint audit reconstructs every candidate byte from classified leaves and fails if an assessor/custody leaf contributes to candidate bytes, token IDs, lengths, order, path, or package boundaries.

The constant-token audit extracts every non-opaque lexical atom from candidate bytes. Each atom must occur in at least one admitted row of every ontology in the same split. An atom present in one ontology and absent from another is a hard failure even if the statistical metadata classifier passes.

7. Exact leakage audits

All audits operate across the union of all folds. A collision is fatal when the same fingerprint occurs in two different split names, even if fold, ontology, renderer, or presentation differs. Duplicate fingerprints within one split are reported but do not satisfy a quota twice.

7.1 Fingerprints

For every row, compute:

The v2 meaning of the v1 word command is bound_command. Bound-command overlap across splits must be zero. World-free semantic-command overlap is reported by depth and ontology but is not itself fatal; this resolves the depth-1 cardinality ambiguity without pretending the operation alphabet is larger than it is.

Opaque names are extracted only from the canonical AST symbol table, sorted by raw bytes, and must match [A-Za-z][A-Za-z0-9_]{15,63}. Substring scanning is not a substitute. Opaque-name overlap is zero across split names.

7.2 Normalized 13-grams

For each stage and the WORLD/COMMAND/QUERY concatenation:

1. require ASCII;
2. map A-Z to a-z;
3. map each maximal byte run outside a-z0-9 to one ASCII space;
4. strip leading/trailing spaces;
5. split on one space;
6. require at least 13 tokens;
7. encode each consecutive 13-token window by joining with one space.

Every window is indexed by literal bytes. Cross-split overlap must be zero. No Unicode, locale, stemming, stop-word removal, or opaque-name replacement occurs.

7.3 Complete graph-isomorphism audit

Each row supplies an assessor-only graph object with exactly:

schema  "r12-ettr-il-v2-audit-graph-v1"
nodes   array of {"id": integer, "color": ASCII string}
edges   array of {"src": integer, "dst": integer, "color": ASCII string}

Node IDs are exactly 0..N-1; edges are a multiset sorted by (src,dst,color) and may be directed self-edges. Colors are from the source-frozen ontology-neutral audit vocabulary. Opaque names, ontology, split, renderer, presentation, theory index, and source ordinals are absent. The graph contains the complete theory, WORLD, COMMAND, and QUERY ASTs with root-kind, generic type, argument-position, binding, rule-incidence, operation order, and query-reference edges.

Canonical labeling is exact, not Weisfeiler-Lehman:

1. partition nodes by literal color;
2. enumerate the Cartesian product of every permutation within each color class, classes ordered by color bytes;
3. for each complete relabeling, assign new IDs by class order and permutation order;
4. build CJ1({"edges":[...],"node_colors":[...]}), with relabeled edges sorted by (src,dst,color);
5. select the lexicographically least byte string;
6. graph_iso_sha256 = H(selected_bytes).

This exhaustive algorithm is the normative oracle. An optimized individualization/refinement or nauty/bliss implementation is admissible only if it returns byte-identical canonical forms to the exhaustive oracle on every official graph and on all graphs up to eight nodes in the complete color/directed-edge conformance suite. If exhaustive official evaluation exceeds the frozen resource bound, the board is infeasible and fails; a probabilistic or incomplete substitute is forbidden.

Cross-split graph_iso_sha256 overlap must be zero. Every collision report includes both row hashes and a color-preserving node bijection independently verified by a second implementation.

7.4 Metadata classifier

The classifier receives no raw bytes or token IDs. Its feature vector, in this exact order, is:

world_byte_count, command_byte_count, query_byte_count,
package_byte_count,
world_token_count, command_token_count, query_token_count,
package_token_count,
world_mask_count, command_mask_count, query_mask_count,
row_ordinal, package_file_byte_count

package_byte_count and package_token_count are stage sums. *_mask_count is the number of one bits before padding and therefore must equal the corresponding token count. row_ordinal is zero-based position in the immutable split file. package_file_byte_count is the literal size of that file. No other feature is allowed.

The implementation is scikit-learn 1.9.0 LogisticRegression(C=1.0, penalty="l2", solver="lbfgs", fit_intercept=True, class_weight="balanced", max_iter=2000, tol=1e-10). Features are standardized using training-fold means and population standard deviations; a zero deviation maps to zero. OMP_NUM_THREADS, OPENBLAS_NUM_THREADS, MKL_NUM_THREADS, and NUMEXPR_NUM_THREADS are 1. The exact Python, NumPy, SciPy, scikit-learn, BLAS, and shared-library inventories are hash-pinned. Convergence warnings or failure to converge are fatal.

Five-fold grouped cross-validation is used on development. Group is semantic rectangle ID. Fold is the unsigned integer represented by the first eight bytes of H(ASCII("R12-ETTR-IL-v2/classifier-fold") || 0x00 || bytes.fromhex(rectangle_sha256)) mod 5. Four folds train and one tests; each serves once. Missing classes in any train/test partition are fatal.

Tasks are:

• binary answer_false versus answer_true, excluding non-answer dispositions;
• three-class ontology;
• eight-class stratum;
• four-class renderer;
• disposition over the complete source-frozen disposition alphabet.

Metric is balanced accuracy for binary and macro recall for multiclass. Required point bounds are <=0.52 for binary and <=1/K+0.02 for a K-class task.

The confidence rule uses 10,000 deterministic group-label permutations per task. Eligible rows are sorted by row SHA-256 inside each rectangle. A group label vector is the resulting ordered labels. Groups are partitioned by label vector length. Within each length bucket, source vectors are ordered by rectangle SHA-256; destination groups are ordered by (PRF(K_public,"classifier-permutation", ASCII(task)||0x00||u32be(i)||bytes.fromhex(rectangle_sha256)), rectangle_sha256). Source vector j is assigned to destination group j. This preserves the complete label multiset and group shape. The complete cross-validation procedure is rerun. The one-sided empirical p-value is (1 + count(permuted_metric >= observed_metric))/10001. It must be at least 0.05. Both the point bound and p-value rule must pass.

The leakage report records package/runtime identity, feature matrix hash, group/fold hash, predictions, confusion matrices, metrics, permutation metric hash, and all fingerprint index roots. It contains no confirmation plaintext and is signed by the audit authority.

8. Authorities, keys, and signatures

Required public-key roles are:

All six Ed25519 keys are distinct. Private keys are generated independently and never placed in the repository, dataset root, environment, command line, or candidate filesystem. This document contains no key, seed, DEK, nonce, or other secret.

Signature domains are exactly:

R12-ETTR-IL-v2/authority
R12-ETTR-IL-v2/plaintext-manifest
R12-ETTR-IL-v2/envelope-manifest
R12-ETTR-IL-v2/leakage-report
R12-ETTR-IL-v2/dataset-root
R12-ETTR-IL-v2/open-authorization
R12-ETTR-IL-v2/open-ledger
R12-ETTR-IL-v2/open-result
R12-ETTR-IL-v2/stage-launch

The authority record schema is r12-ettr-il-v2-authority-v1 and has exactly:

schema, protocol, authority_mode, protocol_spec_sha256,
root_public_key_hex, root_public_key_sha256,
delegations, issued_at_utc, root_signature

delegations is sorted by role and contains exactly {role,public_key_hex,public_key_sha256,principal_id,administrative_domain, storage_domain,valid_from_utc,valid_until_utc} for the five delegated roles. Timestamps are RFC 3339 UTC with seconds and Z. root_signature is the detached signature over the authority payload with that field omitted. The root public-key SHA-256 must also be pinned outside the custody storage and supplied directly to verifiers.

The final dataset root requires valid signatures from dataset publisher, confirmation custodian, leakage auditor, and offline root. A delegated signer cannot countersign for another role.

8.1 Same-account mechanics versus independent authority

authority_mode is either same_account_rehearsal or independent_authority.

Modes, O_EXCL, O_NOFOLLOW, one-link checks, read-only bind mounts, namespaces, descriptor closure, append-only local files, and Ed25519 signatures can demonstrate same-account process mechanics. They cannot prevent the same account owner, host administrator, or holder of all keys from reading a sealed file, copying a DEK, replacing a ledger, or replaying a snapshot.

independent_authority additionally requires:

• confirmation custodian and opening authorizer have different principal_id and administrative_domain from the trainer/candidate;
• custodian seed, DEK, ciphertext master copy, and ledger storage are not mounted or credentialed in the trainer administrative domain;
• the WORM/conditional-write ledger is administered outside the trainer domain;
• offline root, custodian, opening authorizer, and leakage auditor are not one principal;
• each independent role signs from its own security boundary.

Different key bytes in one account do not establish independence. Any same_account_rehearsal artifact may validate mechanics but must set claim_authorized=false, and it cannot authorize a confirmation opening or scientific claim.

9. Source inventory and detached commits

9.1 Frozen legacy commit

The legacy reference commit is 854d3d4d63ee467fc6bed10ffee8fdd2d97a07d1, with tree 4dc8d24f989e96867d8f81a4a17a332299597912. The following path labels and literal SHA-256 values are exact:

Qualification source therefore means train/ettr_qualification.py, and Episode runner means train/ettr_episode.py. The current branch or HEAD is never substituted.

9.2 v2 implementation inventory

Because no v2 materializer or custody implementation exists, no implementation hash is invented here. Before any seed exists, a new full 40-hex implementation_commit and tree must be published. Its source inventory schema is r12-ettr-il-v2-source-inventory-v1 with exactly:

schema, protocol, protocol_spec_sha256,
legacy_commit, legacy_tree, implementation_commit, implementation_tree,
entries, runtime_entries, inventory_sha256

Each entries item is exactly {commit,path,git_mode,git_blob_oid,bytes,sha256,role} and is sorted by (commit,path). It includes this specification, every executable source, every imported first-party module, every schema/preimage file, every audit, encrypt/open/verify source, and every test used for admission. runtime_entries contains the executable, extension, shared-library, wheel/distribution, and root-owned launcher identities, sorted by logical path.

inventory_sha256 is H(CJ1(entries)). Missing and extra transitive first-party imports fail. Dynamic imports, namespace-package fallback, PYTHONPATH additions, editable installs, user site packages, network imports, and source outside the inventory fail.

Construction and every open use separate clean worktrees in detached HEAD state:

git rev-parse HEAD == declared commit
git rev-parse HEAD^{tree} == declared tree
git symbolic-ref -q HEAD exits nonzero
git status --porcelain=v2 --untracked-files=all emits zero bytes

For each source, bytes read with git cat-file blob COMMIT:PATH must equal worktree bytes and the inventory SHA-256. Symlinks, submodules, sparse checkouts, replace refs, grafts, alternate object stores not inventoried, and Git filters are forbidden. Source is copied into a hash-verified runtime bundle before import. A later commit, including the v1 freeze-gate commit, is not admitted unless a new protocol instance inventories and signs it.

10. Manifests and roots

All schemas reject extra fields.

10.1 File record and roots

A file record is exactly:

path, bytes, sha256, row_count, media_type, confidentiality

confidentiality is public, candidate, assessor, or ciphertext. Records sort by path. A file-set root is H(CJ1(sorted_file_records)).

The plaintext manifest schema r12-ettr-il-v2-plaintext-manifest-v1 has exactly:

schema, protocol, fold, split, fold_commitment,
source_inventory_sha256, semantic_spec_sha256, split_spec_sha256,
tokenizer_identity_sha256, seed_commitment, files, file_set_root,
counts, cell_counts, fingerprint_roots, graph_root, created_at_utc

For train/development the public seed commitment is H(split_key). For confirmation it is the Section 4.3 commitment. Confirmation plaintext hashes and counts are assessor-confidential until the opening result; they must not be placed in candidate/public pre-opening manifests.

The envelope manifest schema r12-ettr-il-v2-envelope-manifest-v1 has exactly:

schema, protocol, fold, split, encryption,
plaintext_manifest_sha256, ciphertext_files, envelope_root,
custodian_public_key_sha256, created_at_utc

The dataset-root schema r12-ettr-il-v2-dataset-root-v1 has exactly:

schema, protocol, authority_sha256, protocol_spec_sha256,
source_inventory_sha256, tokenizer_identity_sha256,
split_spec_sha256, fold_commitments,
train_manifest_sha256s, development_envelope_manifest_sha256s,
confirmation_envelope_manifest_sha256s,
leakage_report_sha256, opening_ledger_genesis_sha256,
required_signature_roles, claim_authorized

Lists are fold ordered. claim_authorized is true only in independent_authority mode after all signatures verify. required_signature_roles is exactly ["confirmation_custodian","dataset_publisher","leakage_auditor", "offline_root"], in that order. The four detached signature files are not members of the signed payload and are sorted by role when presented with it.

11. Confirmation encryption

Development and confirmation assessor files are encrypted independently. Confirmation rules below are mandatory; applying them to development does not consume confirmation authority.

Each fold uses a fresh random 32-byte AES key DEK[fold], generated by the confirmation custodian with an operating-system CSPRNG. Cipher is AES-256-GCM as implemented by cryptography.hazmat.primitives.ciphers.aead.AESGCM; the exact cryptography package and OpenSSL shared-library inventory is source/runtime pinned. Keys are never derived from semantic seeds.

key_id is:

H(ASCII("R12-ETTR-IL-v2") || 0x00 || ASCII("key-id") || 0x00 || DEK)

For each plaintext file, the custodian generates a fresh random 12-byte nonce. Nonce reuse under one key_id is fatal across development, confirmation, tests, rehearsals, and retries. A custodian key registry atomically rejects a previous (key_id, nonce_hex).

AAD is CJ1 of an object with exactly:

schema                    "r12-ettr-il-v2-aad-v1"
protocol                  "R12-ETTR-IL-v2"
fold                      0, 1, or 2
split                     "development" or "confirmation"
logical_path              plaintext relative path
file_ordinal              zero-based in sorted plaintext file records
plaintext_sha256          hex32
plaintext_bytes           nonnegative integer
row_count                 nonnegative integer
plaintext_manifest_sha256 hex32
source_inventory_sha256   hex32
split_spec_sha256         frozen v2 hash
tokenizer_identity_sha256 hex32
key_id                    hex32

AESGCM.encrypt(nonce, plaintext, aad) returns ciphertext || 16-byte tag. Those literal bytes are stored in <logical_path>.aes256gcm. No compression, base64, container header, or deterministic nonce is used.

An envelope record has exactly:

schema "r12-ettr-il-v2-aes256gcm-envelope-v1",
logical_path, ciphertext_path, key_id, nonce_hex, aad_sha256,
plaintext_sha256, plaintext_bytes, ciphertext_sha256, ciphertext_bytes

ciphertext_bytes == plaintext_bytes + 16. Ciphertext hashes are committed only after randomized encryption. Predetermining or comparing ciphertext hashes across fresh encryptions is forbidden.

After encrypting, a second process reopens ciphertext by descriptor, verifies AAD/tag/plaintext hash in custodian memory, and signs the envelope manifest. All persistent plaintext copies, temporary files, swap-backed mappings, and inherited descriptors are then destroyed or invalidated before dataset-root signature. A plaintext path discovered afterward invalidates the dataset. This deletion claim assumes the custodian OS/storage trust base; it is not a cryptographic erasure claim.

12. Path and process isolation

Logical roots are disjoint:

/public/spec
/public/manifests
/candidate/train
/sealed/development
/sealed/confirmation
/authority/ledger
/runs/endpoints
/runs/open

Candidate/trainer principals have no credential, ACL, mount, parent-directory search permission, object-store token, or inherited descriptor for /sealed, /authority, or assessor products. Custodian principals have no write permission to endpoint roots. The opening assessor has read-only endpoint descriptors and one custodian-mediated plaintext stream, never a candidate/trainer write credential.

Every role is launched through a root-owned, hash-pinned default-deny launcher using the established ETTR supervisor mechanics:

• descriptor-bound immutable single-link inputs opened with O_NOFOLLOW and O_CLOEXEC;
• exact per-role input/output maps and empty otherwise inaccessible roots;
• read-only runtime/source mounts, one fresh output directory, empty home and private tmpfs;
• network namespace with no interfaces;
• no inherited descriptor above stderr except declared launcher channels;
• exact environment allowlist, no user site or dynamic library override;
• child exit before outputs are hashed and the next role starts;
• Ed25519 launch receipt binds parent receipt, runtime, policy, inputs, outputs, exit, stdout, and stderr.

During fitting, the trusted differentiable runner may retain source tensors for autograd, but its source-inventoried model-call interface remains WORLD-only compiler -> packet-plus-COMMAND reactor -> terminal-packet-plus-QUERY reader; no raw upstream segment, base residual, or KV state crosses those interfaces. This is logical non-consumption, not a physical-erasure claim.

WORLD, COMMAND, and QUERY are physically separated under the signed supervisor for every autonomous development, confirmation, and frozen-board evaluation. Each stage source package and residual/KV state is closed and removed before the next stage starts. Assessor labels and confirmation AAD/envelopes are never mounted into a candidate stage. Path modes alone do not upgrade same-account mechanics to independent authority.

13. Consume-on-attempt confirmation opening

13.1 Preconditions

An opening authorization is invalid unless it binds:

• final root-signed dataset root;
• all fold/arm/seed update-6000 endpoint hashes and immutable file root;
• frozen evaluator, decoder, scorer, runtime, and launch-policy roots;
• signed development opening result showing every required development and custody gate passed;
• zero prior confirmation reservation;
• exact confirmation envelope roots;
• a single opening panel containing all folds, arms, seeds, and the three pre-existing score-only boards;
• rescore_allowed=false, retry_allowed=false, checkpoint_selection_allowed=false.

The authorization schema is r12-ettr-il-v2-open-authorization-v1 and has exactly:

schema, protocol, dataset_root_sha256, endpoint_root_sha256,
evaluator_root_sha256, development_result_sha256,
confirmation_envelope_roots, panel_sha256,
rescore_allowed, retry_allowed, checkpoint_selection_allowed,
expires_at_utc, authorization_nonce, authorizer_signature

authorization_nonce is 32 fresh random bytes encoded hex. The opening authorizer signs it under R12-ETTR-IL-v2/open-authorization.

13.2 Ledger

The independent custodian ledger is append-only WORM storage with atomic conditional create/CAS. Its event schema is r12-ettr-il-v2-open-ledger-event-v1:

schema, protocol, dataset_root_sha256, sequence, state,
previous_event_sha256, authorization_sha256, attempt_id,
event_at_utc, evidence_sha256, custodian_signature

Allowed chain:

SEALED(sequence=0)
  -> RESERVED(sequence=1)
  -> COMPLETED_CONSUMED(sequence=2)
   | FAILED_CONSUMED(sequence=2)

Genesis has null authorization/attempt and binds the envelope roots in evidence_sha256. RESERVED has a fresh random hex32 attempt_id and the authorization hash. The conditional write succeeds only if sequence zero is the current tip and no reservation exists. The reservation is durably witnessed before a DEK is made available or any decryption begins.

There is no transition from either consumed state and no transition from RESERVED back to SEALED. A crash, timeout, tag failure, evaluator failure, host failure, or partial output after reservation yields FAILED_CONSUMED; absence of its terminal event is treated identically. Thus open-once means at most one authorized attempt, not one successful score. No retry is authorized under this dataset root.

Hash chaining plus local files is insufficient against rollback by the same administrator. Claim-bearing open-once requires the independent WORM/CAS authority described in Section 8.1.

13.3 One opening process

After durable reservation, one broker process:

1. verifies source/runtime/authority/dataset/authorization/ledger roots;
2. receives each DEK through a sealed anonymous descriptor from the custodian;
3. decrypts ciphertext in private non-swap memory and verifies tag, AAD, plaintext hash, counts, and canonical bytes;
4. projects only candidate WORLD/COMMAND/QUERY bytes into fresh candidate child descriptors;
5. waits for candidate exit and seals complete predictions before exposing assessor targets;
6. scores with the frozen assessor and independent replay;
7. writes one aggregate result and an encrypted complete prediction transcript;
8. zeroizes broker buffers and closes all descriptors;
9. appends COMPLETED_CONSUMED, or FAILED_CONSUMED on any exception.

Plaintext confirmation, labels, per-row oracle state, DEKs, and seeds are never persisted in the run root. The open result schema r12-ettr-il-v2-open-result-v1 binds attempt, authorization, ledger reservation, envelope/plaintext roots, endpoint/evaluator roots, prediction root, metric root, launch-receipt chain, terminal ledger event, and confirmation_access_count=1. It is signed by custodian and leakage auditor.

14. Fail-closed order

The implementation must execute these gates in order and stop on the first failure:

1. verify this document hash, literal preimages, schemas, and master/fold commitments;
2. verify independent authority record and externally pinned root key;
3. enter clean detached legacy and implementation commits; verify complete source/runtime inventory before import;
4. verify tokenizer bytes, runtime closure, and conformance vectors;
5. verify that all unresolved semantic/materializer blockers have separate signed repairs; otherwise stop before seed generation;
6. create and commit split-isolated seed roots; keep confirmation seeds solely inside the custodian;
7. enumerate and select tuples with exact quotas and no fallback;
8. run field classification, taint, forbidden identifier, and constant-token audits;
9. run raw, semantic-world, theory, bound-command, opaque-name, token-sequence, and normalized-13-gram overlap audits;
10. run exact graph-isomorphism audit and independent witness verification;
11. run the pinned metadata classifier and confidence rule;
12. construct plaintext manifests and independently replay all counts/hashes;
13. encrypt development/confirmation with randomized DEKs/nonces and exact AAD; verify decrypt/tag/hash in a second process;
14. prove persistent plaintext absence and seal envelope manifests;
15. collect publisher, custodian, auditor, and offline-root signatures; publish dataset root and ledger genesis;
16. authorize candidate training mounts only if claim_authorized=true;
17. freeze every endpoint, evaluator, decoder, scorer, and launch identity;
18. open development under its separate ledger; freeze its signed result;
19. if development passes, issue one confirmation authorization;
20. atomically reserve confirmation before DEK release, run one panel, and append a consumed terminal event;
21. verify final receipt chain before any scientific statement.

Failures through step 15 produce no authorized dataset. A failure after any candidate mount invalidates all runs under that dataset root. A failure after confirmation reservation consumes confirmation permanently. No deletion, permission repair, manifest rewrite, rescore, or new signature repairs an already violated instance.

15. Required artifacts and blocker closure

A custody instance is complete only when all of these immutable objects exist:

authority.json
authority.signature.json
source_inventory.json
tokenizer_identity.json
split_spec.json
fold_0.json
fold_1.json
fold_2.json
train_plaintext_manifests[3]
development_envelope_manifests[3]
confirmation_envelope_manifests[3]
leakage_report.json
opening_ledger_genesis.json
dataset_root.json
dataset_root_signatures[4]

Later opening adds authorization, reservation, result, and terminal ledger events without modifying any prior byte.

Closure mapping:

This closure records Phase-1 custody mechanics only. Until Phase 2 freezes and audits a literal population and the user authorizes fitting, the only valid decision is:

r12_ettr_il_v2_phase1_custody_ready_phase2_not_authorized_no_capability_claim