QZR-1 §4.4 Freeze Evidence: Committed-value dominance

Status: Frozen for QZR-1 Candidate (Charge Authority v1)
Date: 2026-08-20
Audience: Independent implementers, Halborn / NCC / equivalent reviewers

Verdict

Committed-value dominance is spec-defined, fixture-backed, and cross-language enforced. It is not merely “implemented in the JS verifier.”

An independent reviewer can cite:

Implemented QZR-1 §4.4, authoritative registry version 1, digest 1a2e01b8e2a89bf530da4ad87fc185b29f5915882a6fefa9e5dde41c4a762676, vector set digest 138b56b72f2874c869cd44b0ba46c70c6be99b09a48bb47c2f85a954b8973dbb; JS and Python both PASS the pinned suite including negative controls.

What is frozen

Artifact	Path	Pin
Normative prose	protocol/docs/qzr-1.md §4.4	Committed-value dominance + presence + equality
Authoritative-field registry	protocol/conformance/qzr-1/authoritative-field-registry.json	version: 1, SHA-256 below
Attack / equality vectors	protocol/conformance/qzr-1/committed-value-vectors.json	SHA-256 below
JS evaluator	protocol/packages/sdk/committedValues.js	Loads registry; hard-codes v1 schema constants
Python evaluator	protocol/conformance/qzr-1/committed_values.py	Independent; same artifacts

Artifact digests (normative)

Digests are SHA-256 over the exact raw UTF-8 file bytes (not JCS re-serialization). Whitespace changes create a new pin.

authoritative-field-registry.json
  sha256: 1a2e01b8e2a89bf530da4ad87fc185b29f5915882a6fefa9e5dde41c4a762676

committed-value-vectors.json
  sha256: 138b56b72f2874c869cd44b0ba46c70c6be99b09a48bb47c2f85a954b8973dbb

Changing either file is a spec change, not a casual test edit.

Normative invariants (registry v1)

Invariant	Rule
fact	unique
authoritative	exactly one per fact; unique across facts
mirrors	unique within fact; ≠ authoritative
equality	enum only: integer, hex, string
unknown entry keys	reject
version	integer ≥ 1
document allowed_*	describe schema only; MUST match hard-coded v1 constants (not self-authorizing)

Profile rule:

conflicting committed semantics  → FAIL at every profile (incl. Minimal)
missing stronger evidence        → profile-dependent

Freeze bar

Until an independently written third verifier exists:

JS + Python MUST agree on the same pinned registry and vector files.

Agreement proves interoperability against the contract. It does not by itself prove the contract is correct. That is why negative controls and a future third implementation matter.

Negative controls (permanent)

The suite detects the class of failure, not only the happy path:

Control	Wrong behavior that MUST remain detectable
Wrong authoritative source	Registry that never consults the fingerprint PASSes a split-charge receipt; real registry FAILs
Self-authorizing schema	Declaring fuzzy in allowed_equality_types is malformed
Unknown entry key	Rejected at load
Duplicate authoritative path	Rejected at load
Integer / bool coercion	"120" and Python bool are not QZR integers
Case-insensitive strings	USD ≠ usd for currency
Malformed hex	Invalid encodings are not equal
Mirror backfill	Missing fingerprint charge cannot be replaced by convenience copy
Minimal downgrade	Split-brain charge FAILs Minimal as well as Standard
Artifact pin	One-byte file change → hash mismatch → conformance FAIL

How to reproduce

cd protocol
npm run test:committed-values
# or:
node --test --test-force-exit test/committed-values.test.js
python3 conformance/qzr-1/run_committed_values.py

Related Claim 1 hardening (post-freeze sibling)

Authority continuity and execution-intent binding are not part of the §4.4 pin, but they share the same anti-downgrade posture. See protocol/test/authority-intent-binding.test.js and charge-authority.md Claim 1 / continuity chain.

Bugs closed while building the golden path:

1. 0x vs bare digest. Fingerprint hex canonicalization strips 0x; intent binding previously compared with the prefix still attached, so a correctly bound receipt FAILed.
2. Wire authority_id vs recomputed identity. Continuity now compares the fingerprint to authorityIdFromDigest(canonical payload), so matching a tampered wire field is not enough.
3. Object consumption logs. { event_id, execution_intent_digest } entries in consumedAuthorityIds were misclassified as CONSUMED_BY_OTHER_EVENT; they now match via the same digest normalization.
4. Minimal anti-downgrade. Present authority_continuity / execution_intent_binding FAIL also fails Minimal (absence remains profile-dependent).

Related Claim 2 hardening

Claim 2 (fingerprint charge ≤ authority constraints) was attacked the same way. See protocol/test/claim2-charge-constraints.test.js.

Bug closed: when fingerprint expected_charge_micros was absent, bind fell back to meter.expected_charge_micros and could yield authority: PASS under a low convenience charge. Receipt bind now accepts only a caller-supplied canonical integer (from the fingerprint); no meter/billing backfill and no string coercion.

Related Claim 3 hardening

Claim 3 (atomic single-use only with authenticated consumption evidence) was attacked next. See protocol/test/claim3-consumption-evidence.test.js.

Ambiguity removed: v1 “authenticated” means a trusted consumption-evidence channel (same class as revocation snapshots), not a self-authenticating unsigned map. Classification bug closed: when an execution_intent_digest is expected, bare event_id strings or null digests MUST NOT become CONSUMED_BY_THIS_EVENT. Portable signed ConsumptionEvidence envelopes remain out of scope for v1.

Related Claim 4 hardening

Claim 4 (request-path enforcement is an integrator non-claim) was attacked last for the v1 set. See protocol/test/claim4-path-enforcement.test.js.

Invariant pinned: no post-facto artifact may manufacture MAY_EXECUTE / execution_eligible / “path enforced” semantics. reportOffline and receipt-time evaluateQzr1 force may_execute = false even if mirror fields or poisoned eval objects claim otherwise. Only preflightChargeAuthority may set execution_eligible true.

Charge Authority v1 freeze

With Claims 1–4 adversarially pinned, treat Charge Authority v1 as frozen. Signed ConsumptionEvidence is a v1.1 extension candidate, not an in-v1 feature.

Next assurance step

An engineer who did not author the JS/Python evaluators implements §4.4 from:

1. This freeze memo + qzr-1.md §4.4
2. The pinned registry and vectors

and reports PASS/FAIL on every vector, including negative controls.