AEF 1300: Record Structure and Scope Declaration

1. Status#

AEF 1300 v0.2 is an early draft and will change. It is a breaking revision, and the break is the point: v0.1's seal boundary left the seal's own members outside the signature, which AEF 1400 section 7's hostile review found, and this version repairs it. v0.1 remains readable at its own path, and records in the v0.1 form remain conformant to v0.1: the old boundary is not retroactively wrong, it is retroactively weaker, and section 5 states exactly what a verifier reports about it.

What changed, enumerated. R2 now defines the record-form version as the member that selects every structural expectation, closing the unversioned-transition defect challenge-0003 demonstrated. R6 is repaired: the v0.2 seal covers its own time, key id, algorithm, and anchor. R24 is superseded by reference to AEF 1301 A3, with the member set closed. R7 gains the `sealLatency` member AEF 1400 T8 needed. R1 gains the `supersedes` member as R27, resolving AEF 1400 T9's two-domain interim convention. R23 gains the content-addressed guidance the run-0001 decay lesson forced. A new section, the signed-boundary audit, enumerates every member of every structure against the signature, so the defect class that produced this revision is closed by enumeration rather than by hoping. Section 13's description of the fixture set is corrected per AEF 1201 section 14's inventory. Section 17 reworks v0.1's terms section, carrying its recorded terms and adding this revision's. Everything else not named here carries forward from v0.1 unchanged, including the selector grammar, canonicalization, chaining, time sourcing, and roles.

This document is normative throughout. Its requirements bind an attested execution record and an implementation that produces one. AEF 1000 is the source of authority; AEF 1001 supplies the vocabulary; AEF 1100 is cited by threat id; AEF 1101, AEF 1200, AEF 1201, AEF 1301, and AEF 1400 by section and requirement id. The challenge record's resolution entry 0003, the ruling this document shares with AEF 1200 v0.2, was recorded before this text was written to reflect it.

Versions are dated, kept at their own paths, and recorded in CHANGELOG.md beside this document.

2. Why this revision exists#

Three sessions of building against v0.1 produced a ledger this document pays. Challenge-0003 showed that structural evolution without a version member makes conformant records fail newer verifiers with no way to say which form they carry. AEF 1400 section 7 showed that R6's boundary, remove the whole seal member, left `sealedAt`, `keyId`, `alg`, and the anchor rewritable by any holder without a key, a defect present since v0.1 and load-bearing once anchors moved into the margin. AEF 1301 section 16 showed R24 superseded in place and its member set unclosed, R1's hiding place one level down. AEF 1400 section 16 filed the supersession member, the latency member, and the content-addressed lesson. Every one of those is a record-structure debt, and record-structure debts compound: each document built on the unversioned, under-signed form inherited its weaknesses.

3. Normative language#

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, MAY, and OPTIONAL are to be interpreted as described in RFC 2119 and RFC 8174, and only when they appear in all capitals.

Requirements keep their v0.1 numbers where their subject is unchanged, carry revised text where it is, and one new number is issued: R27. The revised set is R1 through R27, collected in section 12.

4. The record and its form#

R1 (revised). An aer MUST be a JSON object carrying exactly these members: `aefVersion`, `runId`, `declaration`, `declarationSeal`, `actLog`, `inputState`, `outputArtifacts`, `permissionSurface`, `approvalRecord`, `roles`, `keyBinding`, `trustBase`, `hashAlg`, `supersedes`, and `seal`. The member set is fixed for the reason v0.1 gave: an open set is a place for content to hide inside an otherwise valid record.

R2 (revised). `aefVersion` MUST name the record-structure document and version whose form the record carries, as `1300/0.2` for this form and `1300/0.1` for the previous one. The member sits inside the signed bytes, and it is now defined as what it turned out to be: the selector for every structural expectation a verifier applies, the seal boundary, the approval form, and the member set. A verifier that cannot determine the claimed form reports it rather than guessing and checks nothing else, an obligation AEF 1200 V53 owns and V36 makes INCONCLUSIVE; it is cited here rather than imposed, per the discipline this block keeps. Challenge-0003 is the argument: a record that cannot say which form it carries is conformant to the version it declares and fatally non-conformant to a newer verifier, with the defect in neither.

R27 (new). An aer MUST carry `supersedes`, either null or an object with `ref`, where the superseded record can be obtained, and `digest`, over the superseded record's canonical bytes: the whole sealed record as held, the same identity renewals, acceptances, and verification results bind. This resolves AEF 1400 T9's interim convention and its two-domain cost: a correction now names its predecessor in the identity domain, machine-comparably, rather than as an input-state entry legible only to a reader. What a verifier does with a populated member is report it; verifying claims about the superseded record requires holding it, and that behavior is on the running failure list, not in this document.

5. Serialization and canonical form#

R3, R4, and R5 carry forward unchanged: UTF-8 JSON, RFC 8785 canonicalization, and the integer-only number rule.

R6 (repaired). The bytes a v0.2 seal covers MUST be the canonical form of the sealed object with only the seal's `value` member removed, and nothing else. The seal's own `alg`, `keyId`, `sealedAt`, and `anchor` are inside the signature: the seal is assembled first with an empty value, signed over the value-less form, and completed. Rewriting the recorded seal time or stripping the anchor now breaks the signature, which is the repair of AEF 1400 section 7's discovery, and the form-0002 fixture set demonstrates both halves as required-to-fail inputs that the v0.1 boundary would have passed.

The two-form transition, stated as verifier-visible behavior. For a v0.1-form record, the old boundary applies, the seal still verifies, and the result carries the UNAUTHENTICATED-SEAL-MARGIN qualification naming what the boundary leaves open: the seal's own members are assertions any holder can rewrite. Retroactively weaker, not retroactively wrong: nothing a v0.1 record established is un-established, and what it never established is now named instead of assumed. For a v0.2-form record, the repaired boundary applies and the margin qualification does not arise. An external holder of a record's whole digest, a renewal, an acceptance, a verification result, can detect a rewrite of the margin for either form, and nobody is designated to hold one, which AEF 1400 T10 and section 17 established together and this revision restates whole rather than by its stronger half.

What remains outside, justified. Exactly one thing: the seal's `value`, which cannot sign itself. The anchor's `evidence.anchoredDigest` binds the content bytes, the canonical form with the whole seal member removed, under both forms, because the anchor must exist before the signature that now covers it; the anchor asserts content existence and the signature asserts the anchor, in that order; the ordering is stated as design, with AEF 1400 T3's concession intact, since what the anchor does not cover it still does not cover. One consequence of the repair is named rather than left for a reader to trip on: AEF 1400 T3 defined the anchored digest as the sealed bytes per R6's boundary, and R6's boundary moved, so T3's words now point at the wrong bytes for a v0.2 seal. The binding is the content bytes, this document is the authority for that as of this revision, and T3's restatement is filed for AEF 1400 v0.2 in section 14. A second consequence: one anchor is valid for any number of seals over the same content, so a key holder can mint several differently timed seals sharing one anchor; the anchor attests content, never the seal time, under either form.

6. The declaration#

R8 through R16 carry forward unchanged: inclusion and exclusion selectors, machine-decidable boundaries, declared elements with unsupported status, termination, separate sealing before execution, and optional linkage.

R7 (revised). A declaration MUST contain `aefVersion`, `runId`, `declaredAt`, `purpose`, `include`, `exclude`, `elements`, `termination`, and `approvalRequired`. It MAY contain `linkage` and `sealLatency`, the operator's own declared maximum capture-to-seal latency as `{maxSeconds}`, per AEF 1400 T8. The declaration's `aefVersion` selects its own form the way R2 selects the record's, and a v0.2 declaration's envelope seal uses R6's repaired boundary. One member crosses the forms, stated as the grandfather it is: `sealLatency` entered v0.1 declarations under T8's authority before this revision versioned the forms, three published declarations carry it that way, and a verifier honors it in either form, because T8 did not condition on form and un-honoring a sealed, attributable bound would convert the operator's own stated constraint into noise. The cost travels with it: a declared bound converts the unbounded qualification into V51's checked finding in either form, which is T8's priced trade and not a new one, and the grandfather is exactly one member wide, closed by this sentence.

7. The signed-boundary audit#

One instance of the outside-the-signature defect class was found by accident, three documents after it shipped. This section closes the class by enumeration: every member of every structure this document defines, with its covering authority and the consequence of the answer. The rule the audit enforces: a member is either inside some signature or digest a reviewer can check, or its exposure is stated.

The aer. Every member except `seal` is inside the record signature under both forms. `seal.alg`, `seal.keyId`, `seal.sealedAt`, `seal.anchor`: inside under v0.2, outside under v0.1 with the margin qualification naming it. `seal.value`: outside by necessity, it is the signature.

The declaration envelope. `declaration` and every member below it: inside the envelope's own seal, under the form its `aefVersion` selects. The envelope's seal members: same per-form answer as the record's. The whole envelope, seal included: additionally bound by the record's `declarationSeal` digest, which is why AEF 1400 could call the declaration's anchor the protected one even under v0.1.

The approval record. Every member including its inner `seal`: inside the record's signature, because the approval is record content. The approval's own seal follows R6's rule, which AEF 1301 A3 defines it by reference to, so a v0.2 record's approval uses the value-only boundary and a v0.1 record's uses the old one; either way the record seal is the outer cover, authenticating even what the approver's own signature does not reach.

The acceptance envelope. `acceptance` and members: inside the envelope's seal. The envelope's seal members: outside its own signature under the v0.1-style boundary AEF 1301 specified, the same defect class, repaired the same way: an acceptance for a v0.2-form record uses the value-only boundary, and a v0.1-form acceptance carries the same weakness its record does. Found by this audit, repaired in this revision, and the reference verifier dispatches accordingly, with no fixture yet on the v0.2 branch, per section 11.

Anchor evidence and renewals. Signed by nobody in this framework: the `proof` member carries the mechanism's own signature, which is the anchor party's and is exactly as verifiable as the mechanism allows. Inside the record signature when carried in a v0.2 seal; a renewal travels bare and is worth its proof.

Verification results and the challenge record. Unsealed entirely, carried as open questions since AEF 1200 open question 6 and AEF 1201 open question 2, unchanged here and restated so the audit is complete rather than flattering.

The audit found two instances beyond the record seal itself, the acceptance envelope and the approval's inner seal, and both resolve the same way: R6's rule, applied per form, to every seal this series defines. The first pass of this audit tried to carve the approval out instead, and this session's own hostile review refused the carve-out, which is the audit doing its job on its author.

8. Chaining, time, and roles#

R17 through R21 carry forward unchanged: entry chaining, sourced times, the seal-time anchor member whose semantics AEF 1400 now owns, and role disclosure.

9. Key binding, artifacts, approval, and trust base#

R22, R25, and R26 carry forward unchanged.

R23 (revised). `inputState` entries MUST carry `ref`, `retained`, and `digest`; `outputArtifacts` entries MUST carry `ref` and `digest`; every digest MUST carry `alg` and `value`, all as v0.1 required. Added: a `ref` SHOULD be content-addressed or otherwise immutable, and an implementation that binds mutable paths accepts the decay the run-0001 record demonstrated, where every edit to a bound repository file surfaces as artifact drift until the bindings report nothing else. The SHOULD is not a MUST because the run-0001 record itself would fail it, and a requirement written to condemn the series' first record retroactively would be theater; the decay is real either way and the reviewer sees it as drift.

R24 (superseded by reference). For a v0.2-form record, `approvalRecord` MUST be null or an authorization in AEF 1301 A3's form, and the member set is closed: exactly A3's required members, with `basis` and `criteriaRef` OPTIONAL, and nothing else. An unknown member inside the sealed approval is R1's hiding place one level down, and it is now a form violation the reference verifier fails, with a pinned fixture demonstrating it. For a v0.1-form record, R24's original three-member form governs, per resolution-0003: the form a record's claimed version defines is the form a verifier tests.

10. What this document does not specify#

Unchanged from v0.1: boundary adequacy, reference resolution beyond the retained flag, cross-record indexing, approval referent checking beyond AEF 1301, and anchor semantics, which AEF 1400 owns.

11. What could not be produced#

The v0.2 worked example, at `/aef/examples/form-0002/`, satisfies every requirement here: a v0.2 record with the repaired boundary, an anchored seal, a closed A3 approval, a declared latency bound, and a populated and a null `supersedes`. One requirement is demonstrated only in one direction: R27's populated member points at run-0001's record by canonical digest, and no verifier behavior confirms the target matches, which is the running-list entry section 4 states. The supersession fixture is also, deliberately visibly, a second sealed record over the same declaration as the worked example, which is the shape of threats 6.7 and 7.2 inside the example set: supersession and substitution are structurally the same act, distinguished only by the R27 member that names it, and a reader should see that here rather than discover it. The v0.2 acceptance-envelope boundary from section 7's audit is implemented and has no fixture, an untested branch the coverage declaration carries. The transition behavior could not be produced as a single artifact, because it is a property of the verifier over two records, and it is pinned instead as the pair of fixtures: the same tampering that passes under v0.1's boundary fails under v0.2's.

12. Requirement count and classification#

Twenty-seven requirements: R1 through R26 with the revisions stated, plus R27. Applying AEF 1101 section 16's test, the classification shifts by one from v0.1: checkable by inspecting a record: twenty-six, all but R14, whose sealed-before-execution ordering still has no observer inside the artifact and now has a candidate one outside it, the anchored pair AEF 1400 T6 reports, with 1400's own caveats. The two form-not-substance entries v0.1 flagged, R11's reason and R21's truthfulness, remain flagged. R27's populated form is checkable as to structure and digest format; whether the referenced record exists and matches is checkable only by holding it, the same artifact-versus-world line R23 walks.

13. The worked examples, and the corrected inventory#

The run-0001 example carries forward at its permanent path, in the v0.1 form it was sealed in, now verifying with the margin qualification its form earns. The form-0002 example is this revision's: eighteen act log entries' worth of structure was not repeated; it is a minimal run whose point is the form itself.

The corrected description, per AEF 1201 section 14's inventory. v0.1's section 13 described the fixture set as twenty-two golden fixtures, ten required to fail. That description was generous: under AEF 1001 section 6.12's definition, which AEF 1201 C5 enforces, the set was four pinned fixtures and eighteen generated tests. The honest current inventory lives in the coverage declaration, suite version four as of this revision: fifty entries, thirty-two pinned, eighteen generated, six retired expectations carried with their reasons, and the pinned-versus-generated distinction stated per entry. This document no longer describes the suite; the declaration does, and a description that can drift from its artifact has been replaced by the artifact.

14. Findings from this revision#

Fixed here. The seal boundary, R6. The unversioned transition, R2. The acceptance envelope's boundary, found by section 7's audit and repaired in the same revision per the brief's instruction that further members found outside get repaired rather than filed. The approval member set, R24. The supersession domain, R27.

Recorded for other documents, not applied. AEF 1201 v0.2 inherits three: C12 has no category for an expectation superseded by document revision rather than found wrong, and the five retirements this session recorded stretched its "found to be wrong" language to cover four of them; C12's retirement was designed to take an expectation out of the checked set, not to swap a successor in at the same path in the same version, which this session did and C12's next version should either bless or forbid; and C15's append-only rule needed the resolution-entry mechanic the challenge record now uses, which C15 did not state. AEF 1400 v0.2 inherits three: T3's margin language is form-dependent after this revision; T3's anchored-digest definition points at R6's moved boundary and must be restated as the content bytes, per section 5; and T9's input-state supersession convention is replaced by R27 and should be withdrawn in its favor. AEF 1001's next version inherits the terms in section 17.

15. Requirements with no observer#

R14, unchanged, with AEF 1400's candidate observer noted. R11's reason and R21's disclosure, unchanged as form-not-substance. R27's `ref`, like R23's: resolvable only by a party who can reach it, and nothing tests reachability. New: R2's form selection is honest only if the claimed form matches the actual structure. A record claiming v0.2 while shaped like v0.1 fails its seal check, which is the observer working. A record claiming v0.1 while carrying v0.2 members now fails the record-form check at its top level, which the reference verifier tests against R1's set for the claimed form, with a pinned fixture for the missing-member case. The declaration's member set is not yet checked the same way, and `sealLatency` is the one member the R7 grandfather makes legitimately cross-form; anything else a v0.1 declaration carries beyond R7's list is unexamined, a gap on the running failure list.

16. Weaknesses in this document#

The break is priced but not migrated. Every record published before this revision, the run-0001, approval-0001, and anchor-0001 sets, is v0.1-form, and this revision provides no migration: a v0.1 record cannot become v0.2 without re-sealing, which T9 forbids, so the installed base carries the margin qualification forever and the correction path is supersession by a new v0.2 record. That is the honest consequence of immutability, and it means the margin's population shrinks only by new records.

The signed-boundary audit is one author's enumeration. It closed the class as far as one reading reaches, the same limit AEF 1400 section 18 recorded when the first instance was found by a reviewer and not the author. The audit's value is that the next reviewer checks a table instead of rediscovering the method.

Two forms double the verifier's surface. Every check that dispatches on form is two checks wearing one id, and the fixture suite now pins both branches of some and one branch of others; the coverage declaration says which, and the asymmetry is a standing invitation for the untested branch to rot.

17. Terms used here that AEF 1001 does not define#

Following the practice of every document since AEF 1100. Carried from v0.1's recording, still in use and still unowned by AEF 1001: selector, canonical form, declaration envelope, termination condition, and element status. Added by this revision: record form (the structural version R2 selects), value-only boundary (R6 v0.2's rule, the name the verifier dispatches on), two-form transition (section 5's verifier-visible behavior across the break), form dispatch (a verifier selecting expectations from the claimed form), signed-boundary audit (section 7's per-member enumeration), signed boundary and unauthenticated margin (from AEF 1400, now load-bearing here), supersession (from AEF 1400 T9, now a member), and retirement (from AEF 1201 C12, exercised for the first time by this revision's suite). Still undefined from earlier documents and used here: time source and key history, carried through a fifth document, and external index, seventh appearance.

18. Open questions#

1. Top-level member-set checking per form, per section 15. Reference implementation, then AEF 1200 v0.3 if a requirement is warranted.
2. Migration pressure. Whether the permanent margin qualification on v0.1 records creates the incentive to quietly re-seal old records as v0.2, which R6 makes detectable only to holders of the original. The external index, again. No document assigned.
3. Carried forward from v0.1: reference resolution, boundary adequacy, selector grammar growth, the closed member set's price, an external index, and sealed verification results. All still open; the last is now also the challenge record's problem.

19. License and citation#

Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0).

Cite as:

Stellmacher, G. (2026). AEF 1300: Record Structure and Scope Declaration, v0.2. 14 August 2026. https://grantstell.com/aef/1300

Cite the version and date, always.