# rc.9 — 2026-09-16 — specification 0.1.0-draft.7 IR8-001 concerns inconsistent unsigned-review instructions, not an enforcement defect. The rc.8 review passed required gates and closed IR7-001 for rc.8; IR8-001 remains open in that unchanged historical candidate. - Align reproduction/VERIFY.md and reproduction/README.md on unsigned ZIP and extracted-directory handoffs. Both require the handoff manifest pin and full inventory before package execution; only a supplied ZIP needs its ZIP digest. - Keep signed publication separate: a trusted owner signature remains required. Unsigned review does not establish publisher authentication or grant authority. - Align the root README and independent-review task with those same branches. Preserve the inventory-check code and owner-signing workflow. - Update release metadata and the runner's candidate result label. That literal label is the only existing Python source change; execution logic is unchanged. - Retain wire draft.7, continuity/3, controller binding/3, enforcement/evaluator code, schemas, harnesses, fixtures, expected outcomes, dependencies and license terms. Keep every pre-existing historical file unchanged. - Preserve the rc.8 review and identity records; full archives remain separately retained with recorded digests. Q8-001 is now a retained public regression. Its new fixture grants must name the tested candidate before fresh provisioning; its original source/plan and exact rebindings remain external review material. The fixed gate remains 394 behavior/regression groups, 26 schema groups and recorded-output validation. Retained 62/8 rc.7 probes and the one rc.8 Q8-001 check remain separate public replays. No historical score or acceptance transfers. All results after freeze are external and must name this candidate's digest. Fresh exact-candidate independent review, owner signing and separate website acceptance remain required before supported publication claims. # rc.8 — 2026-09-16 — specification 0.1.0-draft.7 IR7-001 is a low-severity documentation version-scope inconsistency, not an observed enforcement defect or unresolved authority-rule ambiguity. RESULTS.md said authority storage was unchanged without naming a comparison baseline. The existing CLOCK-HISTORY.md, BOUNDARY.md and implementation require continuity/3 and reject formats 1 and 2 without migration. - Replace that sentence with the explicit current authority format and retain the separate controller binding/3 statement. - Retain wire draft.7, continuity/3, controller binding/3, enforcement code, schemas, fixtures, expected outcomes, dependencies, license terms and limits. - Update candidate identity, reproduction paths and the runner's result label. That label is the only Python source change; it changes no execution logic. - Preserve the rc.7 manifest, review findings, summary and report as history. Its full review and handoff archives are retained separately and identified in history/rc.7-PROVENANCE.json, not recursively duplicated here. - Retain the required 394 behavior/regression and 26 schema groups. The 70 rc.7 reviewer probes may be replayed separately without changing their source or expectations. They are now public regressions, not new independent tests. No previous result transfers to this digest. Full frozen-input tests and fresh exact-candidate independent review remain required before owner signing and separate website acceptance. All post-freeze evidence remains external. # rc.7 — 2026-09-15 — specification 0.1.0-draft.7 IR6-001 measured forgotten accepted late wall samples across transactions. The review classified this as a scope ambiguity, not a failure of draft.6's integer arithmetic. Draft.7 explicitly chooses durable domain-wide wall history. - Add normative CLOCK-HISTORY.md and clarify R13 and BOUNDARY.md. - Preserve accepted late wall values in the final SQLite payload. Finalize the witness against those exact bytes, not the pre-late pending proposal. - Define initial preflight as provisional until pending-witness admission. Retain pending closure if later history cannot be confirmed. - Use continuity/3; reject older formats without migration. Keep controller binding/3, reason precedence, elapsed/drift bounds and scope unchanged. - Port 84 rc.6 reviewer probes without changing expectations. Preserve Q01 as historical observation; H01 tests the explicit new requirement. - Add process, persistence, denial, preparation, separate-domain and storage failure cases. Each case checks state and effects, not counts alone. - Preserve historical bytes. The included rc.6 recovered ZIP matches its pinned manifest but is explicitly not represented as the original candidate archive. The first development run preserved 353/353 retained behavior groups and 40/41 new history groups. H35's supposed time-only rollback used a no-change denial at the existing floor; its fixture now actually advances time before rollback, with the same expected safety outcome and an added three-sample control. The output traversal also encountered rc.6 E09/E10's deliberately invalid earlier receipt inputs; it now explicitly requires their rejection and continues to validate actual outputs. Schemas, protocol expectations and enforcement were not weakened. The original development input and results remain external. No previous score transfers. This candidate needs frozen-input testing and a new independent review before owner signing and website acceptance. # rc.6 — 2026-09-13 — specification 0.1.0-draft.6 This candidate resolves the two rc.5 review findings without changing frozen rc.5. The review's four earlier fixes held in its tested scope; its new time precision finding and masked C08 fixture are preserved in history/. - IR5-001: define the exact inclusive five-second elapsed and one-second drift rules. Compare integer nanoseconds directly in kernel.clock_sample. Only Unix wall samples are floored to milliseconds; duration is never rounded. Both late checks retain latest-sample reversal detection, grant expiration checks and pending-state uncertainty. - IR5-002: repair C08 with accepted stored-denial evidence as a control and a valid negative wrapper. The negative result matches the exact request except for its contradictory returned value. Require result validation failure and zero new effects, not just a generic closed status. - Add 30 explicit clock vectors across both late checks, positive/negative drift edges, and monotonic integers above 2^53. Add the rc.5 reviewer's 53 unchanged-outcome probes as a declared public port. No hidden score is claimed. - Move active wire/schema identities to draft.6. Keep continuity/2 and controller binding/3, dependencies, reason registry, licenses, permissions, execution routes and authority limits. No automatic grant migration. - Preserve original reviewer source, report, findings and summary. The frozen rc.5 archive remains separately retained; it is not duplicated recursively inside this package. Its exact manifest copy and archive hash are included. - Final test evidence is external and must name this candidate's manifest. New independent review, owner signing and site acceptance remain pending. --- # Change history ## EZA-001-R001-rc.5 · wire 0.1.0-draft.5 · 2026-09-13 The independent rc.4 review confirmed the earlier repairs but withheld acceptance on four new input/evidence findings. This revision preserves that candidate and review, and changes the written contract and implementation in a new candidate. - Added normative RESULTS.md and R16 with explicit outer decoding, action-result shape, success-field consistency and exact dispatch-binding rules. - Added evaluator/result_contract.py, shared by public host, worker, controller and signed-claim verification. It imports no authority or recovery engine. - Added action-result.schema.json. COMPLETE/null remains a private update acknowledgement; action paths require the full result. EXECUTE records require populated claims, bounded distinct lineage and actor/delegate equality. - Changed controller binding format from /2 to /3. Admissions, receipts and worker reports carry the exact envelope digest. Current and stored results are validated before being accepted. No ledger or authority migration is provided. - Kept durable authority storage format /2, root consumption, permission checks, clock behavior and the two-admission lifetime budget unchanged. Engine wire version becomes draft.5; new synthetic grants name this exact release. - Ported all 14 rc.4 independent probes with expected outcomes unchanged; path, version and receipt wrapper adaptations are recorded in RC4-PROBE-PORT.json. Added 20 fixed result-binding groups. Schema groups increase from 24 to 26. - The first development run found the larger preserved history archive exceeded the controller's small-record reader. Pinned artifact hashing now streams and verifies file/link/mutation checks; controller record limits remain unchanged. The failed development input and results are retained outside the final input. No old acceptance, signing, native containment or authoring score transfers to these changed bytes. Frozen-candidate results and independent review remain external evidence and must name its exact manifest. ## EZA-001-R001-rc.4 · wire 0.1.0-draft.4 · 2026-09-13 This revision resolves the four findings from the independent rc.3 review. The old candidate and review are preserved. Its 126 behavior cases and 20 schema groups passed on the Mac, but its supplemental findings blocked publication. That result is not reclassified as acceptance. - F01: constrain receipt data/handle fields and require matching primary and blocking reasons for REJECT and ESCALATE. Rebuild embedded schemas from canonical schemas. A valid signature does not exempt internal consistency. - F02: define commit preflight, admission, staged handle removal, definitive completion, and uncertain transactions. A preflight block leaves state unchanged; a later attempt rechecks current authority. This is an explicit specification resolution, not an author hint supplied during the prior review. - F03: add R15 and a controller result schema. Label each returned dispatch and derive unresolved admissions from the verified ledger on every return. A retry or cached denial cannot settle an unreceipted earlier attempt. - F04: G10 now asserts and snapshots the successful response, effect journal, consumed root, object value, and committed witness before restoring the DB. The existing authority decisions, root budget, and bounded retry behavior stay the same. New controller metadata explains the entire request history. Twenty-six new review regressions cover the findings and valid controls. The wire version changes to draft.4 and fresh test grants bind the new manifest; live grants are not migrated. The new candidate must pass its own frozen run and independent review. No owner signature, Mac containment, or production claim is inherited. ## EZA-001-R001-rc.3 · wire 0.1.0-draft.3 · 2026-09-12 The frozen rc.2 run passed all 126 behavior cases and 19 focused schema groups, but failed validation of recorded release-mismatch outputs. The decision schema had omitted the new reason from the REJECT branch. That is a package defect, not a changed expected authority outcome. The failed input and result are preserved in history/. This revision adds EZA-AUTHORITY-RELEASE-MISMATCH to both rejected-result reason fields, updates the embedded transport/receipt schemas from that canonical schema, and adds a focused schema regression. No expected action decision is loosened. The clock-uncertainty code remains a preflight transport outcome, not an inner action record. Candidate identity changes to rc.3; the specification stays draft.3. The same full behavior suite must run again. ## EZA-001-R001-rc.2 · wire 0.1.0-draft.3 · 2026-09-12 This is a revision of the first EZA-001 publication candidate. It is not a new protocol number. The original R001 package remains unchanged at `history/EZA-001-R001-frozen.zip`, SHA-256: `0b01de9c55299ad58e285dfe3c2f8589ae838984ba255a5e51f169480bb9f55d` Normative changes: 1. R12 requires every grant and prepared handle to bind the exact verified release manifest. A child retains its parent's binding. Separate approval of another release does not transfer old grants. The new reason is `EZA-AUTHORITY-RELEASE-MISMATCH`. 2. R13 defines `EZA-AUTHORITY-TIME-UNCERTAIN` for an unavailable initial clock. Failures after pending transition publication may have begun remain `INDETERMINATE`. 3. R14 and RECEIPTS.md define a closed, evidence-only Ed25519 receipt. Signature verification does not call an authority or execution interface. 4. The stored payload is format 2. There is no format-1 migration or automatic authority renewal. Implementation changes: - `engine.py`: draft.3 shape, strict grant release binding, delegation and current-release checks, release-bound preparation, and reported host release identity. - `kernel.py`: format-2 validation, release context, explicit host/fixture clock modes, and initial time-failure handling. Retains serialized consumption, exact request execution, protected witness, and late clock checks. - `host.py`: verified source capture, separate synthetic authorization and validation records, one-time fixture provisioning, and a closed requester envelope. - `common.py`, `controller.py`, `worker.py`: format-2 controller binding, bound worker dispatch, result validation, and existing durable admission/receipt/stop behavior adapted to this candidate. No native sandbox launcher is included. - `evaluator/`: full inventory checking and Ed25519 evidence verification. - Schemas and reproduction tools now describe the same active candidate. Tests and history: - Ported 38 core vectors to draft.3. Fresh fixture grants are explicitly issued with the current manifest digest. Their expected decisions and effects are unchanged. - Ported 32 lifecycle vectors. L24 alone changes its expected authority reason: after a separately approved release change, an old grant is rejected for release mismatch before replay classification. - Added 56 publication gate cases and 19 schema groups. Expected outcomes are stored with the tests before the final frozen run. - Historical licensing records describe their original snapshots. No historical trial result is relabeled as a test of this candidate. Test results produced after freeze are separate evidence objects that name the manifest digest. Signing or adding acceptance evidence must not rewrite the candidate files. Any later source, rule, schema, or expected-result correction needs a new candidate identity and a new recorded test run.