← Conformance archive · companion records: lra-runner (revision 2) · lra-runner (revision 3) · moltycel-aae-vectors
icam-temporal-derivation · author-produced Mode B run
Lease-boundary extension by a third party · operator-written runner, independent of the candidate’s oracle · first outside run in the candidate's record
An author-produced Mode B run over ICAM’s vectors of the icam-temporal-derivation candidate
(PR #218,
head 72a0f72, pre-merge), submitted by Nika Novak (ICAM / aiclavis) —
the first third-party candidate built on the aicent-lease-boundary
family, extending it to explicit observation time and lease-expiry derivation. The candidate's own
CANDIDATE.md states the gap plainly: “Author-produced fixture consistency only… No IQA
implementation under test, external run.” This record closes that gap at the oracle level.
Result: all suites green, exit 0 — the candidate's three
author-produced checks reproduced as-is (24/24 fixtures, 8/8 mutants, 120 metamorphic invariances,
6/6 checksums), and our own independent implementation agrees with all 24 expectations while never
consulting the advisory flag the negative controls exist to punish. Not a merge vote: the maintainer's
decision at the lab is separate from this record.
Scope and method
Family contract: the candidate's frozen vectors at lab PR #218 head
72a0f72 (7 files; every byte verified against the candidate's own
CHECKSUMS.sha256 before anything ran — 6/6). Normative target:
draft-li-rttp-iqa-addressing-02 sections 6.1, 6.3 and 7.2 — the same revision the
candidate pins; the TXT was byte-verified locally at sha256
02491c5a…85044, matching the pin recorded in the candidate's CANDIDATE.md.
Method: two layers kept separate, as the candidate's bounded question requires. The
Mode B runner implements DERIVE (section 6.1 reliance: the verifier checks the
stated expiry against its own clock; the lease instant itself is fresh or expired by declared
convention; with nothing declared, the boundary is undetermined) and WIRE_TIME_GATE
(section 7.2 verification step 2 only: reject iff lease_expiry is strictly earlier than
the verifier's clock; the instant of equality passes this isolated gate). The rules were derived
from the published draft text, not from the candidate's reference oracle; the candidate's input and
result vocabulary was adopted only as the interface contract.
Declared claim set: that an independent implementation, derived from
the pinned draft text, agrees with every expectation the candidate's author-produced oracle states
on the candidate's frozen vectors — nothing more. A run verifies the vectors against the draft's
rules; it is not a conformance certification of any runtime, and the candidate itself tests no
external implementation. The advisory supplied_boundary_classification field is not an
IQA wire field and is never consulted by the runner.
Results
| Suite | Gate | Verification | Extra | Failures |
|---|---|---|---|---|
| candidate harness (author-produced, run as-is) | checksums 6/6 | 24/24 fixtures | mutants 8/8 · metamorphic 120 | 0 |
| Mode B runner (this record's implementation) | — | 24/24 agree | own battery 6/6 killed | 0 |
| Total | 6/6 checksums | 24/24 × 2 oracles | 8/8 + 6/6 mutants · 120 metamorphic | 0 · exit 0 |
The recorded output is run-output.txt
(reproduced verbatim, uncut, below); the machine-readable record is
run-output.json (sha256
09a21ffee731122f…); the environment record is
ENVIRONMENT.txt; the manifest is
SHA256SUMS.txt.
Instrumentation contract (instrumented, not asserted)
- Byte gate before anything runs: all 7 candidate files are hashed against the
candidate's own
CHECKSUMS.sha256; any difference aborts before scoring. - Master-text gate (R25 discipline): the runner's rules were written from the published draft text — the local TXT copy was byte-verified against the pin recorded in the candidate's CANDIDATE.md before implementation, and the five-result vocabulary was checked against §8.1's closed set ordering discipline.
- Two-oracle cross-agreement: the Mode B runner and the candidate's harness score the same frozen vectors; the recording shows both agreeing case-by-case.
- Recorded, not summarized: the console output of the entire session is captured
whole as
run-output.txt; nothing above is a paraphrase of a memory.
Mutation battery
No more, no less: 6 — the runner ships its own battery, distinct from the candidate's author-produced 8 (which we reproduced as-is above). Each mutant is a complete alternative oracle; the recorded run kills all six or exits non-zero:
| Mutant (independent battery) | Outcome |
|---|---|
always-expired | killed by TD-B01, TD-B02, TD-B04, TD-N02, TD-N04, TD-N06, TD-X01, TD-X03, TD-X04, TD-X05, TD-X06, TD-B07 |
always-fresh | killed by TD-B03, TD-B05, TD-B06, TD-N01, TD-N03, TD-N05, TD-X02, TD-X03, TD-X04, TD-X05, TD-X06, TD-B08 |
hardcoded-120s-window | killed by TD-B03, TD-B05, TD-B06, TD-N01, TD-N03, TD-N05, TD-X02, TD-X03, TD-X06, TD-B07, TD-B08 |
trusts-advisory-flag | killed by TD-N01, TD-N02, TD-N03, TD-N04, TD-X04, TD-X06, TD-B08 |
undeclared-boundary-inclusive | killed by TD-X03 |
wire-gate-rejects-equality | killed by TD-W02, TD-W04 |
Verdict vocabulary exercised
| Layer | Results observed |
|---|---|
| DERIVE (§6.1 reliance) | fresh (8) · expired (6) · boundary_undetermined (1, interpretive: equality with no declared convention — the draft says implementations SHOULD declare) · insufficient_input (2) and invalid_convention (1) as local test preconditions, not normative refusal reasons |
| WIRE_TIME_GATE (§7.2 step 2 only) | time_gate_pass (3, including at the instant of equality under both conventions) · time_gate_reject (1, strictly earlier) |
| negative controls (advisory flag) | supplied_boundary_classification is never consulted; six controls (TD-N01–06) pin false before/at/after flags that a flag-trusting oracle would score wrongly |
Diagnostics
The runner prints one line per case with expected and observed values side by side, so a divergence anywhere is localized by case and layer. The two layers are structurally separate functions in the runner; a DERIVE result is never derived from a gate result or vice versa, matching the candidate's "two separate layers" requirement.
Exit status
The runner exits 0 only when every vector agrees and every mutant in the
independent battery is killed; the recorded run reached
SUMMARY 24/24 agree + MUTATION SUMMARY 6/6 killed and exited zero. The
candidate's three harness scripts each exited zero as recorded.
Negative-path self-check
Three layers, all executed: (1) the checksum gate — tampered candidate files fail before scoring; (2) the independent mutation battery — a runner that cannot discriminate fails its own run; (3) the advisory-flag negative controls — six cases exist specifically to punish an oracle that trusts the untrusted classification hint. The negative-path machinery fired for real during development: the first draft of the runner ordered the invalid-convention check after the time comparison, and TD-X06 caught it (see Findings).
Determinism and cost
The runner is deterministic by construction: it uses no clock, no randomness and no
network; all fixture clock values are explicit integers in the frozen vectors. Standard library only
(hashlib, json, sys, pathlib) — no third-party packages, offline after the one-time
candidate fetch. The machine-readable record of the run: sha256 09a21ffee731122f844275541333de04bc42e88676a2929fd86cd7be9a3d8c3b (regenerated 2026-11-14 after the scoring fix recorded below). Wall-clock
cost of the full session (both oracles, all suites, mutation batteries): seconds. Any party with
Python 3 can reproduce it with the commands below.
Per-vector results (24/24 agree, uncut)
| # | Case | Rule / layer | Expected = observed |
|---|---|---|---|
| 01 | TD-B01 | DERIVE [reliance/normative] | fresh |
| 02 | TD-B02 | DERIVE [reliance/normative] | fresh |
| 03 | TD-B03 | DERIVE [reliance/normative] | expired |
| 04 | TD-B04 | DERIVE [reliance/normative] | fresh |
| 05 | TD-B05 | DERIVE [reliance/normative] | expired |
| 06 | TD-B06 | DERIVE [reliance/normative] | expired |
| 07 | TD-N01 | DERIVE [reliance/normative] | expired |
| 08 | TD-N02 | DERIVE [reliance/normative] | fresh |
| 09 | TD-N03 | DERIVE [reliance/normative] | expired |
| 10 | TD-N04 | DERIVE [reliance/normative] | fresh |
| 11 | TD-N05 | DERIVE [reliance/normative] | expired |
| 12 | TD-N06 | DERIVE [reliance/normative] | fresh |
| 13 | TD-X01 | DERIVE [reliance/normative] | fresh |
| 14 | TD-X02 | DERIVE [reliance/normative] | expired |
| 15 | TD-X03 | DERIVE [reliance/interpretive] | boundary_undetermined |
| 16 | TD-X04 | DERIVE [reliance/local_precondition] | insufficient_input |
| 17 | TD-X05 | DERIVE [reliance/local_precondition] | insufficient_input |
| 18 | TD-X06 | DERIVE [reliance/local_precondition] | invalid_convention |
| 19 | TD-W01 | WIRE_TIME_GATE [wire_time_gate_only/normative] | time_gate_pass |
| 20 | TD-W02 | WIRE_TIME_GATE [wire_time_gate_only/normative] | time_gate_pass |
| 21 | TD-W03 | WIRE_TIME_GATE [wire_time_gate_only/normative] | time_gate_reject |
| 22 | TD-W04 | WIRE_TIME_GATE [wire_time_gate_only/normative] | time_gate_pass |
| 23 | TD-B07 | DERIVE [reliance/normative] | fresh |
| 24 | TD-B08 | DERIVE [reliance/normative] | expired |
All rows are transcribed from the recorded machine-readable output; the uncut console recording is run-output.txt.
Run metadata (per the lab's required report fields)
| Field | Value |
|---|---|
| Who ran it | ShaoBao Li (Lee) (@Aicent-com); repository maintained under the @Aicent-Stack org |
| Date | 2026-11-08 |
| Run mode | Author-produced (Mode B) over ICAM’s vectors: the operator wrote the recomputation implementation — the lab’s label follows who authored that recomputation — while none of the candidate’s vectors or claim inputs are the operator’s (author: Nika Novak, danyka-icam); the runner is derived from the published draft text and does not execute the candidate’s oracle (CONTRIBUTING.md) |
| Implementation | icam_runner.py — a distinct Mode B implementation of §6.1/§7.2 derived from the published draft text (sealed in the artifact below) |
| Corpus reference | icam-temporal-derivation candidate, lab PR #218 head 72a0f72 (pre-merge; all 7 files checksum-verified 6/6 against the candidate's own manifest) |
| Environment | Python 3.14.2, Windows 11 (10.0.26300), win32; standard library only — no third-party packages, no network during verification |
| Suspected defective vectors | none observed — all 24 expectations reproduce under an independently derived implementation |
Verbatim command and output (uncut)
Command sequence: the candidate's three scripts as-is, then the Mode B runner. The complete console output, uncut:
$ python3 -I vendor/check.py vendor/vectors.json PASS TD-B01 [reliance/normative] expected=fresh actual=fresh PASS TD-B02 [reliance/normative] expected=fresh actual=fresh PASS TD-B03 [reliance/normative] expected=expired actual=expired PASS TD-B04 [reliance/normative] expected=fresh actual=fresh PASS TD-B05 [reliance/normative] expected=expired actual=expired PASS TD-B06 [reliance/normative] expected=expired actual=expired PASS TD-N01 [reliance/normative] expected=expired actual=expired PASS TD-N02 [reliance/normative] expected=fresh actual=fresh PASS TD-N03 [reliance/normative] expected=expired actual=expired PASS TD-N04 [reliance/normative] expected=fresh actual=fresh PASS TD-N05 [reliance/normative] expected=expired actual=expired PASS TD-N06 [reliance/normative] expected=fresh actual=fresh PASS TD-X01 [reliance/normative] expected=fresh actual=fresh PASS TD-X02 [reliance/normative] expected=expired actual=expired PASS TD-X03 [reliance/interpretive] expected=boundary_undetermined actual=boundary_undetermined PASS TD-X04 [reliance/local_precondition] expected=insufficient_input actual=insufficient_input PASS TD-X05 [reliance/local_precondition] expected=insufficient_input actual=insufficient_input PASS TD-X06 [reliance/local_precondition] expected=invalid_convention actual=invalid_convention PASS TD-W01 [wire_time_gate_only/normative] expected=time_gate_pass actual=time_gate_pass PASS TD-W02 [wire_time_gate_only/normative] expected=time_gate_pass actual=time_gate_pass PASS TD-W03 [wire_time_gate_only/normative] expected=time_gate_reject actual=time_gate_reject PASS TD-W04 [wire_time_gate_only/normative] expected=time_gate_pass actual=time_gate_pass PASS TD-B07 [reliance/normative] expected=fresh actual=fresh PASS TD-B08 [reliance/normative] expected=expired actual=expired SUMMARY 24/24 agree; author-produced fixture consistency only $ python3 -I vendor/mutate.py KILLED trust-unverified-boundary-flag by TD-N01,TD-N02,TD-N03,TD-N04,TD-N06,TD-X04,TD-X05,TD-X06,TD-B08 KILLED always-fresh-at-equality by TD-B05,TD-N03,TD-X03 KILLED always-expired-at-equality by TD-B02,TD-N04,TD-X03 KILLED reversed-time-order by TD-B01,TD-B03,TD-B04,TD-B06,TD-N01,TD-N02,TD-N05,TD-N06,TD-X01,TD-X02,TD-X06,TD-B07,TD-B08 KILLED assume-inclusive-undeclared by TD-X03 KILLED missing-clock-fails-open by TD-X04 KILLED missing-expiry-fails-open by TD-X05 KILLED wire-frame-equality-rejected by TD-W02,TD-W04 SUMMARY 8/8 mutants killed (author-produced) $ python3 -I vendor/metamorphic.py PASS 120 flag-substitution invariance checks; equality wire-time gate separate (author-produced) $ python3 -I icam_runner.py vendor/vectors.json run-output.json (Mode B runner) PASS TD-B01 [reliance/normative] expected=fresh observed=fresh PASS TD-B02 [reliance/normative] expected=fresh observed=fresh PASS TD-B03 [reliance/normative] expected=expired observed=expired PASS TD-B04 [reliance/normative] expected=fresh observed=fresh PASS TD-B05 [reliance/normative] expected=expired observed=expired PASS TD-B06 [reliance/normative] expected=expired observed=expired PASS TD-N01 [reliance/normative] expected=expired observed=expired PASS TD-N02 [reliance/normative] expected=fresh observed=fresh PASS TD-N03 [reliance/normative] expected=expired observed=expired PASS TD-N04 [reliance/normative] expected=fresh observed=fresh PASS TD-N05 [reliance/normative] expected=expired observed=expired PASS TD-N06 [reliance/normative] expected=fresh observed=fresh PASS TD-X01 [reliance/normative] expected=fresh observed=fresh PASS TD-X02 [reliance/normative] expected=expired observed=expired PASS TD-X03 [reliance/interpretive] expected=boundary_undetermined observed=boundary_undetermined PASS TD-X04 [reliance/local_precondition] expected=insufficient_input observed=insufficient_input PASS TD-X05 [reliance/local_precondition] expected=insufficient_input observed=insufficient_input PASS TD-X06 [reliance/local_precondition] expected=invalid_convention observed=invalid_convention PASS TD-W01 [wire_time_gate_only/normative] expected=time_gate_pass observed=time_gate_pass PASS TD-W02 [wire_time_gate_only/normative] expected=time_gate_pass observed=time_gate_pass PASS TD-W03 [wire_time_gate_only/normative] expected=time_gate_reject observed=time_gate_reject PASS TD-W04 [wire_time_gate_only/normative] expected=time_gate_pass observed=time_gate_pass PASS TD-B07 [reliance/normative] expected=fresh observed=fresh PASS TD-B08 [reliance/normative] expected=expired observed=expired SUMMARY 24/24 agree (author-produced Mode B runner) MUTANT trusts-advisory-flag killed by TD-N01,TD-N02,TD-N03,TD-N04,TD-X04,TD-X06,TD-B08 MUTANT always-fresh killed by TD-B03,TD-B05,TD-B06,TD-N01,TD-N03,TD-N05,TD-X02,TD-X03,TD-X04,TD-X05,TD-X06,TD-B08 MUTANT always-expired killed by TD-B01,TD-B02,TD-B04,TD-N02,TD-N04,TD-N06,TD-X01,TD-X03,TD-X04,TD-X05,TD-X06,TD-B07 MUTANT wire-gate-rejects-equality killed by TD-W02,TD-W04 MUTANT undeclared-boundary-inclusive killed by TD-X03 MUTANT hardcoded-120s-window killed by TD-B03,TD-B05,TD-B06,TD-N01,TD-N03,TD-N05,TD-X02,TD-X03,TD-X06,TD-B07,TD-B08 MUTATION SUMMARY 6/6 killed (independent battery) run output written: run-output.json
Findings raised and resolved
Findings on the corpus: none — zero failed checks, and no
suspected defective vector. Operator-side finding (resolved before recording): the
first draft of the independent runner ordered the invalid-convention precondition check after the
time comparison; case TD-X06 (expected invalid_convention) caught the defect on the
first execution — the check was moved before any time comparison and the recorded run is the
fixed implementation. The negative-path machinery fired for real, which is what it is for.
Revision history (append-only): this is the first record for this runner page; the
artifact pins the pre-merge head 72a0f72 it tested — if the candidate changes
before merge, a fresh run would be required for the changed revision. 2026-11-09: the candidate
merged (PR #218
at 3c36e95); the merged corpus differs in metadata only, and the promised rerun against
the merged mainline is recorded below — verdicts identical case by case. 2026-11-14: lab review of PR #225 reproduced all 24 case results and raised two points, both adopted — the mutation battery now scores each mutant only against cases of the rule it changes (the wire-gate mutant’s true kill set is exactly TD-W02 and TD-W04; the five DERIVE kill sets are unchanged), and the run is relabeled author-produced (Mode B) over ICAM’s vectors per the lab’s rule that the label follows who authored the recomputation. Records regenerated: 24/24 agree, 6/6 mutants killed, exit 0 — case scores unchanged.
Positioning note: this record is the complement of our other two
shapes — the AAE record ran the author’s own pipeline on
the author’s frozen bytes and meets the lab’s independent label; the
lra-runner records are our vectors run by our
implementation (author-produced). Here the vectors and expectations are a third party’s and the
implementation is ours: the lab’s label follows who authored the recomputation, so this
record is author-produced (Mode B) over non-author vectors — its value is the cross-oracle
agreement itself, two implementations derived from the same published text answering the same 24
questions identically.
Artifact and seal
| Artifact | SHA-256 (first 16) | Seal |
|---|---|---|
| icam-runner-20261108a.tar.gz (complete artifact · 11996 B · pre-merge cut) | 698dfa08223565fd… | sealed |
| icam-runner-20261114a.tar.gz (complete artifact · 15,280 B · current) | e265997e9fbef382… | sealed |
Manifest: icam_runner.py (the independent runner) ·
run-output.json (machine-readable record) · run-output.txt (whole-session
console recording) · RUN-REPORT-2026-11-08.md · ENVIRONMENT.txt ·
CHECKSUMS.sha256 + SHA256SUMS.txt · vendor/ (the candidate's
7 files, byte-identical to head 72a0f72). Raw files are also served unarchived under
/conformance/icam-runner/.
Replay
Two commands (Python 3; standard library only; offline after unpacking):
tar xzf icam-runner-20261114a.tar.gz cd icam-runner && python3 -I icam_runner.py vendor/vectors.json run-output.json
Expected output: ends with SUMMARY 24/24 agree and
MUTATION SUMMARY 6/6 killed, exit status 0. Provenance: the vectors are
the candidate's frozen bytes at lab PR #218 head 72a0f72; the sealed artifact above
carries both the candidate bytes and this run's record — the tarball is the code-as-run identity
of this record.
On independence: the runner was implemented from the published draft text before being pointed at the candidate's expectations; the pin was byte-verified before anything ran; the output is a whole-session recording, reproducible by anyone; and nothing was tuned to pass. This record is a Mode B run by an operator distinct from the candidate's author, not a merge vote — the lab's maintainer decides what merges, and this page takes no position on it.
One artifact, two addresses
Both addresses are derived from the artifact's own SHA-256 digest — nothing is invented, nothing is registered: the sister schemes split one referent across the question and the answer. Paste either into the respective scheme's resolver to see it resolve locally, without any network call beyond fetching this page.
rttp://698dfa08.conformance.iqa
intent = first 8 hex of the artifact digest (the intent
field is 8 lowercase hex by grammar); pillar and root are operator-chosen labels. Authority:
698dfa08.conformance.iqa.
iqa://698dfa08223565fd1424984f894ddd7d.forge.iqa
subject = first 32 hex of the same digest; organ
forge (closed set) — this is the exact subject the organ seal above attests,
and the organ answers live at
/organ-api/v1/production?subject=698dfa08223565fd1424984f894ddd7d.
Verify offline with
pip install "iqa-org[ed25519]==1.3.1" and the seal bundle at
/attestations/release-attestations.json
· Organ AID: ba92fadd46a51caf25633e0f315c4ad10103b879d7397397362f89dc33817153.
Citation
Cite this run: icam-temporal-derivation Mode B run · ICAM candidate family, frozen at lab PR #218
head 72a0f72 · record:
iqa.org/conformance/icam-runner/
· operator: Lee / Aicent Stack — RTTP, CRI scheme number 27 · IQA, CRI scheme
number 28 · sealed artifact:
icam-runner-20261108a.tar.gz
(SHA-256 698dfa08223565fd…). This run verifies the vectors against the draft's rules; it is
not a conformance certification and not a merge vote. Merged-mainline re-run (2026-11-09): sealed
artifact icam-runner-20261109a.tar.gz
(SHA-256 b9daa0488e096d00…), rttp://b9daa048.conformance.iqa
· iqa://b9daa0488e096d00b4da05988ddff7e3.forge.iqa. Scoring-fix re-run (2026-11-14): sealed artifact icam-runner-20261114a.tar.gz (SHA-256 e265997e9fbef382…), rttp://e265997e.conformance.iqa · iqa://e265997e9fbef382dcafa5734eb429ae.forge.iqa.
Merged-mainline re-run — second sealed artifact (2026-11-09)
PR #218 merged on 2026-11-08 at 17:06:55 UTC, landing at 3c36e95. The merged corpus differs from the pre-merge head in metadata only: candidate package labels, a refreshed CHECKSUMS.sha256, and four case_status annotations (TD-B02, TD-B05, TD-N03, TD-N04) moved from normative to convention_specific — every executable input and every expected value is byte-identical. The revision history above promised a fresh run for a changed revision; here it is.
The same independently written runner, re-pinned to the merged mainline (VENDOR_REF 3c36e95), re-verified the merged corpus against the candidate's refreshed manifest (6/6) and re-derived every verdict from the published draft text: 24/24 agree, 6/6 own mutants killed, exit 0 — verdicts identical to the pre-merge run on every case. The complete record lives in the operator repository as interop/rttp-iqa-icam-temporal-derivation-3c36e95 (runner, frozen merged corpus, machine-readable output, console recording, digest manifest), filed with the lab as an interop record, PR #225.
The re-run artifact is sealed like the first: icam-runner-20261109a.tar.gz (16,109 bytes, SHA-256 b9daa0488e096d00b4da05988ddff7e323d97e975399337094b7d3507cbd5356), carrying its own address pair — rttp://b9daa048.conformance.iqa and iqa://b9daa0488e096d00b4da05988ddff7e3.forge.iqa (the organ answers live at /organ-api/v1/production?subject=b9daa0488e096d00b4da05988ddff7e3). The pre-merge artifact above remains verifiable unchanged — append-only, nothing superseded.
Scoring-fix re-run — third sealed artifact (2026-11-14)
Lab review of PR #225 (2026-11-13) reproduced all 24 case results and raised two points. Both adopted: (1) the mutation battery now scores each mutant only against cases of the rule it changes — the wire-gate mutant’s true kill set is exactly TD-W02 and TD-W04, as the reviewer stated, and the five DERIVE kill sets are unchanged; (2) the run is relabeled author-produced (Mode B) over ICAM’s vectors — the lab’s label follows who authored the recomputation. The records were regenerated (24/24 agree, 6/6 mutants killed, exit 0); the case scores themselves are unchanged.
The re-run artifact is sealed like its predecessors: icam-runner-20261114a.tar.gz (15,280 bytes, SHA-256 e265997e9fbef382dcafa5734eb429ae9f3d6e2f1ce98ffeb99fbbc754aa5493), carrying its own address pair — rttp://e265997e.conformance.iqa and iqa://e265997e9fbef382dcafa5734eb429ae.forge.iqa (the organ answers live at /organ-api/v1/production?subject=e265997e9fbef382dcafa5734eb429ae). The earlier artifacts remain verifiable unchanged — append-only, nothing superseded on the artifact line.