AEF example record run-0001

The run

The tooling read the eight AEF documents published before AEF 1300, computed a SHA-256 digest for each, and wrote a manifest binding each document path to its digest. The work is real, small, and reproducible by anyone holding the repository: recompute the digests in standards/aef/manifest.json and compare. The declaration was sealed before the first act was captured.

The result

PASS_WITH_QUALIFICATIONS

• 12 checks, 0 failed, 0 not run
• 10 qualifications, each named below
• key binding reached continuity-of-use, from mechanism none
• capture-to-seal interval: 0 seconds
• verifier: aef-reference-verifier v0.1.0

An unqualified PASS is not reachable today, which AEF 1200 section 7.2 states and this record demonstrates. A verification of this record that reported PASS would be evidence of a defective verifier.

What the qualifications mean you cannot conclude

1. IDENTITY-NOT-ESTABLISHED

   The key sealed this record and nothing says whose key it is. You cannot conclude the operator sealed it.

2. NO-EQUIVOCATION-DETECTION

   No log would reveal the same identity bound to a different key elsewhere. You cannot conclude this key is the only one presented as this party's.

3. ELEMENT-UNSUPPORTED class OTHER, a finding against AEF 1200 section 7.4

   The approval record is declared unsupported. You cannot conclude anything an approval would have established.

4. ARTIFACTS-OPERATOR-SUPPLIED

   The artifacts compared came from the operator. You cannot conclude this record describes the work you asked about rather than work the operator chose to show.

5. TIME-OPERATOR-ASSERTED

   Every recorded time comes from the operator's clock. You cannot conclude when anything happened, only the order the record asserts.

6. CAPTURE-TO-SEAL-INTERVAL-UNBOUNDED

   Nothing in the framework constrains the window between capture and sealing. You cannot conclude a future record will have a small one.

7. SEAL-TIME-UNANCHORED class OTHER, a finding against AEF 1200 section 7.4

   Nothing outside the operator attests the seal time. You cannot conclude the record existed when it says it did.

8. APPROVAL-ABSENT

   No party approved, and the declaration says none was required. You cannot conclude anyone took responsibility for this run.

9. VERIFIER-SELF-AUTHORED class OTHER, a finding against AEF 1200 section 7.4

   The party that built the producing system also wrote the verifier. You cannot conclude the verifier had an adversary in its history.

10. TRUST-BASE-SELF-ASSERTED class OTHER, a finding against AEF 1200 section 7.4

    The trust base statement's completeness and externality answers are the operator's own. You cannot conclude they are correct.

The tampered copy

One character was changed in one effect field of one act log entry. The result is FAIL, first failing check seal-integrity. A second check fails as well: the chain link over that entry breaks, because AEF 1300 R18 binds each entry to its predecessor.

AEF 1000 principle 4 holds that a verifier which has never rejected a tampered record verifies nothing. This is the cheapest public demonstration that it rejects one.

The withheld declaration

Verifying the same record without the separately sealed declaration returns INCONCLUSIVE, with declaration-binding recorded as not run. It is published because a vocabulary value nobody has seen produced is a claim about a vocabulary rather than a demonstration of one. All four outcome values in AEF 1200 section 7.1 now exist as artifacts.

What this result is not evidence of

• This result is not evidence that the work was done as described (AEF 1100 threat 6.3).
• This result is not evidence that nothing outside the declared scope occurred (AEF 1100 threat 7.1).
• This result is not evidence that the declared scope was drawn honestly or before the outcome was known (AEF 1100 threat 7.3).
• This result is not evidence that an approving signer saw what an approval record says they saw (AEF 1100 threat 8.1).
• This result is not evidence that this is the record for the run the reviewer asked about (AEF 1100 threat 6.7).
• This result is not evidence that no other record of this work exists (AEF 1100 threat 7.2).

Artifacts

Every file is served byte-identical to what the verifier consumes. The record digest is sha-256:21d3e41ae852771c7a6e8b452a6ce46bf9ed46da2fbf4d7ca51dfa31798d92f3.

• aer.json The record. Sealed, and the subject of everything else here.
• declaration.json The declaration, sealed separately before the run began (R14).
• trust-base.json Ten dependencies with their controlling parties named (AEF 1101 section 6).
• verification-result.json The result: PASS_WITH_QUALIFICATIONS.
• aer.tampered.json The same record with one character changed.
• verification-result.tampered.json The result for the tampered copy: FAIL.
• verification-result.no-declaration.json The result with the declaration withheld: INCONCLUSIVE.
• aer.canonical.txt The canonical byte sequence the seal covers (R4, R6).

The tooling that produced and checked these lives at packages/aef in the repository, with twenty-two golden fixtures, ten of them required to fail.