← Conformance archive · companion record: lra-runner (revision 2)

The second recorded output of the lease-revocation-axes independent Python runner, now extended to the family's revision 3 (PR #191, merged 2026-10-25): revision 3 adds refusal_reason — a closed five-value denial vocabulary evaluated in priority order — and grant_ref, a back-reference binding every decision to the evidence it was made from. Result: independent_run_matched (exit 0) — 48 baseline runs, 176 calls, 528 axis comparisons, 176 composite comparisons, zero failures; all five refusal values exercised across the 117 denying records; 176/176 records carry grant_ref; 12/12 mutants fail on exactly their pinned case sets (identical to revision 2's expected sets); 20 diagnostic runs and 12 oracle checkpoints clean; all five reporting-semantics checks pass. The frozen revision-2 replay remains byte-identical to the recorded rev-c output — one runner, two revisions, two recorded outputs.

Scope and method

Family contract: the frozen fixture family lease-revocation-axes, revision 3, as merged upstream (PR #191, merge 7774dae, head 9a282619); the revision-2 record is filed as PR #187 (merged 2026-10-26). Frozen inputs: revision-3/vectors.json (184,582 B) and revision-3/oracle-checkpoints.json (8,977 B), digests 3b7b3fb97682fb967801641b8ed680a9cae608ff57738a594fc6f0314aac1bb6 and 08293dbd991fe3f76534e176800e15365545a43a6d94e4d89f79d6d58ec7e830, hard-gated against the pinned SHA256SUMS.txt and re-verified byte-identical at the merged head on 2026-10-26. Method: the same independently authored Python verifier (741 lines, stdlib-only), extended with --revision {2,3}; the lab's TypeScript model was reviewed as an interface, no lab code reused; every comparison is made against the frozen vectors and their pinned expected values, never against lab model output. Four lease profiles under two access modes, scored per axis and separately per mode; a negative-path self-check (a tampered vectors copy) is rejected by the digest gate before any scoring.

Declared claim set: the three declared axes (evidence_freshness, authority_validity, action_authorization) under action policy P1-current-observation; action-time authorization is not claimed, by design. A run verifies the vectors, not the spec — scoring and verdict are separate acts.

What revision 3 adds

Two fields on every decision record: refusal_reason — closed five-value set, evaluated in priority order (evidence_binding_mismatch → evidence_expired → authority_not_determined → authority_revoked → operation_not_permitted); a denial names exactly one reason, the first condition that failed in priority order — and grant_ref, binding each decision to its evidence (grant, evidence id, issue/expiry instants, observation_as_of_ms). Key semantic: a diagnostic read performed after evidence expiry does not renew the evidence — grant_ref.observation_as_of_ms is null when the only available observation is stale, even if a fresh observation exists later in the timeline; diagnostic reads inform the report, never the authorization.

Results

Beyond the baseline: 12/12 defective variants fail on exactly their pinned case sets · 20/20 post-expiry diagnostics, each backed by an actual recorded read · 12/12 oracle checkpoints match field-for-field (including the rev-3 fields) · 5/5 reporting-semantics checks pass, executed via a runtime guard rather than asserted. The recorded output is run-output-rev3.json; the full narrative is RUN-REPORT-2026-10-26.md.

Refusal reasons observed (rev-3 field coverage)

All five values of the closed vocabulary are exercised; the remaining 59 records are permits (no refusal reason attached). All 176 records carry grant_ref.

Source-read contract (instrumented, not asserted)

• cached_lease: 0 authority reads per call — the lease decides from carried evidence.
• live_standing_read: exactly 1 instrumented read per unexpired and bound call.
• Outage calls: the getter returns null, the attempt is recorded, and diagnostics must be backed by actual reads — no speculative diagnostics.
• Hostile-call boundary: the runner raises if any implementation path touches expected/truth inputs mid-call.
• Post-expiry diagnostic reads: recorded and reported, never fed back into grant_ref.observation_as_of_ms — evidence is not renewed by diagnosis.

Mutation battery — 12 defective variants, pinned failure sets, 12/12 match

Every variant fails on exactly its pinned case set — no more, no less. The observed sets are identical to revision 2's pinned sets: the rev-3 fields refine the reasons attached to decisions, not the decisions themselves.

Post-expiry diagnostics — 20/20 clean

5 diagnostic cases × 4 profiles. Every emitted diagnostic is backed by an actual recorded read; zero speculative diagnostics; no diagnostic read renews expired evidence.

Oracle checkpoints — 12/12

The hand-reasoned checkpoint table (frozen alongside the vectors in revision-3/oracle-checkpoints.json, digest 08293dbd…) replayed against runner output: all field values — including the rev-3 refusal_reason and grant_ref fields — and downstream_reached flags match, zero failures.

Reporting semantics — 5/5

no_scored_coverage · statement_only_matched · policy_mismatch_partial · unsupported_only_no_coverage · oracle_inputs_not_read — all true, and executed, not asserted: during all scoring phases (baselines, mutations, diagnostics, declaration-check runs) the runner wraps open() and records any attempt to read a file whose name contains oracle; the check is the measured result of that guard. The same guard is what backs the model.json independence note below: the lab's machine-readable model is pinned in the corpus (b71f02f5…) but deliberately not vendored and not read — the runner's independence rests on deriving every verdict from the family specification plus the frozen vectors.

Exit status

The process exit code is 0 only when the run status is independent_run_matched, and 1 otherwise — including digest-gate refusal and independent_run_diverged. The revision-3 run exits 0.

Negative-path self-check

A tampered copy of the vectors file (one case id altered) is rejected by the digest gate before any scoring: DIGEST GATE FAILED … refusing to score. The “comparisons only against frozen vectors” discipline is machine-enforced, not merely stated.

Determinism and cost

Three consecutive full runs produce byte-identical JSON reports. Recorded output of the 2026-10-26 run: raw sha256 d777980195ef1d08… (as measured, Windows stdout), canonical (sort, compact) sha256 78824b82a07eccdb…; the repository copy is LF-normalized (f008756821a252b7…), canonical-identical. Lab-side note: the interop record's CLARIFICATIONS.md (merged in PR #194) takes the file digest from SHA256SUMS.txt (f0087568…) as the run-output reference; the canonical digest above is the sort-compact recomputation of the same recording — two normalizations of the same bytes, sealed tarball unchanged. Full run cost: ~0.2 s wall-clock (including interpreter startup; pure in-memory timeline replay — no network, no RPC, no real-time waiting). Verification is cheap by design: any party can reproduce this report in under a second.

Per-vector results (48/48 matched)

The refusal column lists the distinct refusal_reason values observed across each case's decision records; all five values appear across the battery.

Run metadata (per the lab's required report fields)

Verbatim command and output (uncut)

$ python lra_runner.py --revision 3

candidate lease-revocation-axes revision 3, vectors sha256 3b7b3fb97682fb96
digest gate vs pinned manifest: OK
48 independent baseline runs, 176 calls, 528 axis comparisons; 176 composite comparisons
baseline failures: 0 | statuses: ['matched']
  mutant lease-ignores-expiry         MATCH  failed=LRA-04,LRA-05,LRA-07,LRA-08,LRA-10
  mutant sliding-lease                MATCH  failed=LRA-04,LRA-05,LRA-07,LRA-08,LRA-10
  mutant live-fail-open               MATCH  failed=LRA-03,LRA-07,LRA-11
  mutant sticky-unavailable           MATCH  failed=LRA-03,LRA-07,LRA-11
  mutant retrieval-renews-evidence    MATCH  failed=LRA-04,LRA-05,LRA-08,LRA-10
  mutant deny-but-dispatch            MATCH  failed=LRA-02,LRA-03,LRA-04,LRA-05,LRA-06,LRA-07,LRA-08,LRA-09,LRA-10,LRA-11,LRA-12
  mutant deny-everything              MATCH  failed=LRA-01,LRA-02,LRA-03,LRA-05,LRA-06,LRA-07,LRA-08,LRA-10,LRA-11,LRA-12
  mutant live-first-read-only         MATCH  failed=LRA-01,LRA-02,LRA-03,LRA-06,LRA-07,LRA-08,LRA-09,LRA-10,LRA-11
  mutant second-worker-stale          MATCH  failed=LRA-08
  mutant fabricated-live-read         MATCH  failed=LRA-01,LRA-02,LRA-03,LRA-05,LRA-06,LRA-07,LRA-08,LRA-09,LRA-10,LRA-11,LRA-12
  mutant selective-not-supported      MATCH  failed=LRA-02,LRA-03,LRA-04,LRA-05,LRA-06,LRA-07,LRA-08,LRA-09,LRA-10,LRA-11,LRA-12
  mutant ignore-evidence-binding      MATCH  failed=LRA-12
diagnostic runs: 20 (failures: 0)
oracle checkpoints: 12 (failures: none)
reporting checks: {'no_scored_coverage': True, 'statement_only_matched': True, 'policy_mismatch_partial': True, 'unsupported_only_no_coverage': True, 'oracle_inputs_not_read': True}
RESULT: independent_run_matched

Findings raised and resolved

Revision history (append-only): rev a / rev b / rev c (2026-10-23) are the revision-2 cuts, sealed and kept as history; rev c is the archive of record for the revision-2 run (see the companion page). The 2026-10-26 cut adds revision-3 support; the revision-2 replay remains byte-identical to the recorded rev-c output — one runner, two revisions, two recorded outputs, both sealed.

Development findings (found and fixed before recording): the first revision-3 runs surfaced two deviations — (1) exit-code plumbing did not yet reflect the run status on the new revision path, and (2) an expired-evidence diagnostic read was being backfilled into grant_ref.observation_as_of_ms. The correct semantics: a diagnostic read performed after evidence expiry does not renew the evidence — the field is null when the only available observation is stale, even if a fresh observation exists later in the timeline (diagnostic reads inform the report, never the authorization). Both fixed before the recorded run; the recorded output is post-fix.

2026-10-26 (status): the family's revision 3 was merged upstream on 2026-10-25 (PR #191), and the revision-2 record was merged the same day (PR #187, 2026-10-26T01:49Z) after @aeoess's cross-OS byte-level reproduction (Python 3.14.6, macOS arm64) and manifest/line-ending alignment. This revision-3 record follows the sequencing note published on the W3C list on 2026-10-26 (“one open record at a time”): filed after #187 cleared review and merged. The canonical repository runs CI mirroring the lab's repository checks (76a7d10, green); the revision-3 additions are on main at 42eb417 with the same three jobs green.

Artifact and seal

Manifest: lra_runner.py (the runner, both revisions) · vendor/ + vendor-r3/ (vectors.json + oracle-checkpoints.json + SHA256SUMS.txt per revision, digest-gated; the lab's full pinned manifests preserved verbatim as lab-pinned-manifest.txt) · RUN-REPORT-2026-10-23.md + RUN-REPORT-2026-10-26.md · PROVENANCE.md · run-output.json + run-output-rev3.json (the two recorded runs) · README.md. The lab's model.json is pinned in the corpus but deliberately not vendored and not read (see Reporting semantics). Raw files are also served unarchived under /conformance/lra-runner-rev3/.

Replay, offline

Two commands (Python 3 standard library only — no packages, no network):

tar xzf lra-runner-20261026a.tar.gz
python3 lra-runner/lra_runner.py --revision 3

Expected output ends with RESULT: independent_run_matched and exit status 0; the digest gate prints OK against the pinned manifest. The revision-3 vectors digest is 3b7b3fb97682fb96…; the revision-2 replay (python3 lra-runner/lra_runner.py) reproduces the recorded rev-c output byte-for-byte. Provenance: independently authored from the family contract (PR #180, revision 3 in PR #191); the canonical development copy is github.com/Aicent-Stack/conformance/lra-runner — the tarball above is sealed from the same bytes. A companion author-produced production-code mapping (no vectors scored) lives at PRODUCTION-CODE-MAPPING.md.

On independence: this family scores normative logic against frozen bytes rather than anyone's production code — the way a runner is built cannot tilt the score. The vectors were frozen behind a hard digest gate before any scoring; the outputs are byte-replayable by anyone, offline; and every independent implementation — however built — faces the same frozen bytes.

One artifact, two addresses

Both addresses are derived from the artifact's own SHA-256 digest — nothing is invented, nothing is registered: the sister schemes split one referent across the question and the answer. Paste either into the respective scheme's resolver to see it resolve locally, without any network call beyond fetching this page.

Verify offline with pip install "iqa-org[ed25519]==1.3.1" and the seal bundle at /attestations/release-attestations.json · Organ AID: ba92fadd46a51caf25633e0f315c4ad10103b879d7397397362f89dc33817153.

Citation