{
  "_comment": [
    "Independent reproductions of the Vaara conformance vectors: parties other",
    "than the maintainer who ran the checkers and reported the result in public.",
    "",
    "THIS IS A RECORD OF THINGS THAT HAPPENED, NOT A LIST OF CURRENT MEMBERS.",
    "A run happened on a date at a commit. That does not stop being true later,",
    "so a row does not come down later.",
    "",
    "Rows are chained. Each carries `prev`, the digest of the row before it, so",
    "removing or reordering an entry changes every digest after it. Verify with",
    "scripts/vcr_chain.py, which imports no Vaara code.",
    "",
    "WHAT THE CHAIN ALONE GIVES, stated exactly. A break is detectable to someone",
    "who holds an earlier head. It is not detectable to someone who does not,",
    "because an operator controlling both this file and the published page could",
    "rewrite the chain and republish it consistently. Saying the maintainer",
    "'cannot' remove a row on the strength of the chain alone was an overclaim,",
    "and it sat in a consent form, which is worse than sitting in marketing.",
    "Iman Schrock raised it on the SCITT list on 2026-08-21 and was right.",
    "",
    "SO THE HEADS ARE WITNESSED. `witnessed_heads` below records each published",
    "chain head in a public transparency log the maintainer does not operate.",
    "A rewritten chain produces a head that matches no witnessed entry, and that",
    "is checkable by anyone against the log rather than against a promise. The",
    "residual is real and narrow: a row added after the last witnessing carries",
    "only the chain until the next head is published.",
    "",
    "Rules for a row:",
    "  1. The party is not the maintainer.",
    "  2. The report is public and linkable. No private mail, no screenshots.",
    "  3. The claim is quoted as they scoped it, never widened.",
    "  4. The party agreed to be listed, knowing the entry is permanent. Being",
    "     public elsewhere is not agreement to appear here.",
    "  5. Nothing is edited after the fact. A correction is a new row that",
    "     refers to the earlier one, never a rewrite of it.",
    "",
    "WHAT AN OUTSIDE SUGGESTION CAN CHANGE. Wording changes when it is shown to",
    "be false, and anyone may show that, including a party that competes with",
    "Vaara. A case, an expected verdict or a checker changes only on evidence",
    "that the current one is wrong, never on request and never to make a party",
    "pass. Every such change is a commit anyone can diff.",
    "",
    "A party asks for a row with the conformance-row issue form, which records",
    "the agreement in rule 4 and cannot be submitted without it. The rendered",
    "page is generated from this file plus the runner's own report, so neither",
    "can drift from the other.",
    "",
    "`terms_version` below is the version a new row agrees to. Bump it when the",
    "terms on the page change, and never edit a published version in place.",
    "Every row stores the version it was listed under, so a change reaches rows",
    "added afterwards and never reaches back to somebody who agreed to",
    "something else."
  ],
  "terms_version": "2026-08-22",
  "genesis": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
  "witnessed_heads": [
    {
      "head": "sha256:2682d581d86fc18156386c716c38d9c63ea34264ecb2dc31938ae30d20a55693",
      "rows": 1,
      "uuid": "108e9186e8c5677ae28c7150fc9e75fac63c18e6418181e11970a366a60f28995ec08c026d2dc608",
      "logIndex": 2549350104,
      "integratedTime": 1787317963,
      "logUrl": "https://rekor.sigstore.dev",
      "published": "2026-08-21T13:12:43Z"
    },
    {
      "head": "sha256:0b0c9e52d68d1a7c46199c9f0e7578991020c4e6198c7cf7d967d234eead3154",
      "rows": 6,
      "uuid": "108e9186e8c5677aab0de539febaf5031038b3a4e9c73ee71953588607f06454411cb82c60fd8529",
      "logIndex": 2617562713,
      "integratedTime": 1787836991,
      "logUrl": "https://rekor.sigstore.dev",
      "published": "2026-08-27T13:23:11Z"
    }
  ],
  "reproductions": [
    {
      "id": 1,
      "slug": "babyblueviper1-invinoveritas",
      "date": "2026-08-19",
      "terms_version": "2026-08-15",
      "prev": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
      "party": "babyblueviper1 (invinoveritas)",
      "affiliation": "invinoveritas",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "40 passed, 0 failed, 3 skipped, 49 cases",
      "at_commit": "cc5df5d2938cb9a26e820c1b8b5ac3b7d398ab1e",
      "their_scoping": "Ran the independent checkers exactly as documented (git clone, pip install cryptography rfc8785, python scripts/conformance_runner.py) in an isolated venv, no Vaara install. Establishes that the checkers reproduce their own stated verdicts against the shipped case files at this commit. Does not establish interoperability between Vaara's proofs and our own (invinoveritas) proof format.",
      "record": "https://github.com/crewAIInc/crewAI/issues/4877#issuecomment-5339555715",
      "submitted_by": "babyblueviper1"
    },
    {
      "id": 2,
      "slug": "nenad-vasic-elara-protocol",
      "date": "2026-08-21",
      "terms_version": "2026-08-21",
      "prev": "sha256:2682d581d86fc18156386c716c38d9c63ea34264ecb2dc31938ae30d20a55693",
      "party": "Nenad Vasic / Elara Protocol",
      "affiliation": "Elara Protocol — AI-agent-maintained (disclosed), independent of Vaara",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "attribute_attestation_v0",
        "attribute_attestation_zk_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "release_condition_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "45 passed, 0 failed, 1 skipped, 75 cases. Runner exit 0. The skip is `article12_fold_v0` (checker wants a bundle zip argument rather than a bare case directory — structural, not environmental). An earlier same-day run at f0dbf4d8 gave 44/45, 65 cases, 0 failures, before the corpus grew.",
      "at_commit": "a209864e11fc14f0ac3466dd33d668d9c156208f",
      "their_scoping": "This is a reproduction of the author-supplied checkers and vectors at commit a209864e. It is not an independent implementation of draft-sirkkavaara-vaara-receipt and not a validation of the specification text. The figures match row #612 at the same commit on a different machine and OS (Linux, Python 3.12, clean venv), making this an independent confirmation of that row's byte-stability. pq_hybrid_v0 and qualified_time_v0 ran with their optional dependencies installed rather than skipped.",
      "record": "https://mailarchive.ietf.org/arch/msg/scitt/HOKZT8J06zB3JaNxOfAEasNty1Q/",
      "submitted_by": "navigatorbuilds"
    },
    {
      "id": 3,
      "slug": "emek-can-dogru",
      "date": "2026-08-24",
      "terms_version": "2026-08-21",
      "prev": "sha256:79e05e18a3214b9ada4bcf31ce25141640982b461a4fe655a14017f1f410bb33",
      "party": "Emek Can Doğru",
      "affiliation": "VERAX TEKNOLOJİ LİMİTED ŞİRKETİ — independent of Vaara",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "attribute_attestation_v0",
        "attribute_attestation_zk_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "release_condition_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "45 passed, 0 failed, 1 skipped, 75 cases. Runner exit 0. The skip is `article12_fold_v0`, whose checker validates a passed-in bundle zip rather than a bare case directory — structural, not environmental.",
      "at_commit": "a209864e11fc14f0ac3466dd33d668d9c156208f",
      "kind": "reproduction",
      "their_scoping": "This is a reproduction of the author-supplied checkers and vectors at commit a209864e. It is not an independent implementation of draft-sirkkavaara-vaara-receipt and it is not a validation of the specification text. The checkers importing no Vaara code is what makes the reproduction worth anything; it remains the author's corpus grading the author's cases. The skip is `article12_fold_v0`, whose checker validates a passed-in bundle zip rather than a bare case directory — structural, not environmental.",
      "record": "https://mailarchive.ietf.org/arch/msg/scitt/wZDSwS77Bb46AZNZ197XkHedNAg/",
      "submitted_by": "dogrucanemek-alt"
    },
    {
      "id": 4,
      "slug": "council-of-ai",
      "date": "2026-08-25",
      "terms_version": "2026-08-21",
      "prev": "sha256:d8cf95879212db9a9a230a86ff45419eeb7db7eef235ef0bac9f5f71288e0773",
      "party": "Council of AI",
      "affiliation": "Independent AI measurement body — councilof.ai (CSOAI)",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "attribute_attestation_v0",
        "attribute_attestation_zk_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "release_condition_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "43 passed, 0 failed, 3 skipped, 75 cases",
      "at_commit": "9fefe51a61f16dc13cd64ca8ca4b8792e48fb64b",
      "kind": "reproduction",
      "their_scoping": "Reproduction of author-supplied checkers at the pinned commit, macOS arm64 / Python 3.14.6, clean venv. Validates the pinned independent vector lanes. Does not establish hosted-service interoperability, official SCITT conformance, or an independent implementation.",
      "record": "https://github.com/CSOAI-ORG/councilof-ai/blob/conformance-runs/docs/conformance-runs/vaara-sep2828-2026-08-25.md",
      "submitted_by": "CSOAI-ORG"
    },
    {
      "id": 5,
      "slug": "iman-schrock",
      "date": "2026-08-25",
      "terms_version": "2026-08-21",
      "prev": "sha256:a28173bb93fd61540ec2ef0f73a39e6ada107f7bc23b561b2d6992eddffa41c6",
      "party": "Iman Schrock",
      "affiliation": "EMILIA Protocol",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "release_condition_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "41 passed, 0 failed, 3 skipped, 57 cases. Skips: `article12_fold_v0` (bundle zip required), `pq_hybrid_v0` (optional `dilithium_py` missing), and `qualified_time_v0` (optional `asn1crypto` missing). `release_condition_v0` passed 8/8.",
      "at_commit": "62a7080b7c854173c7d6b8ee51ce4dd724d59227",
      "kind": "reproduction",
      "their_scoping": "This is a reproduction of the author-supplied checkers and vectors, not an independent implementation or validation of the specification text.",
      "record": "https://mailarchive.ietf.org/arch/msg/scitt/I5mdtYRinS-wjrnbwCnyXwwvrjU/",
      "submitted_by": "FutureEnterprises"
    },
    {
      "id": 6,
      "slug": "yutao-peng",
      "date": "2026-08-26",
      "terms_version": "2026-08-21",
      "prev": "sha256:34d77df3e24ddb6d9aba843c27f4635a4cfbd859dd89f263f8dd69dc8b5849db",
      "party": "YuTao Peng",
      "affiliation": "Insight (oracleinsight.xyz)",
      "suites": [
        "acp_checkout_v0",
        "agent_decision_v0",
        "agent_identity_v0",
        "ap2_v0",
        "article12_fold_v0",
        "atlas_threat_v0",
        "attestation_result_v0",
        "attribute_attestation_v0",
        "attribute_attestation_zk_v0",
        "audit_summary_v0",
        "authorization_v0",
        "build_bundle_v0",
        "bundle_doc_v0",
        "bundle_set_v0",
        "capability_scope_v0",
        "class_gate_v0",
        "conformance_statement_v0",
        "contiguity_v0",
        "credential_binding_v0",
        "credential_grant_v0",
        "crewai_enforcement_v0",
        "cross_org_handoff_v0",
        "cross_stack_revocation_v0",
        "data_locality_v0",
        "decision_pairing_v0",
        "enforcement_attestation_v0",
        "enforcement_set_v0",
        "evidence_bundle_v0",
        "evidence_ref_v0",
        "execution_receipt_v0",
        "external_evidence_v0",
        "fallback_projection_v0",
        "governance_decision_v0",
        "handoff_set_v0",
        "ingest_v0",
        "key_rotation_v0",
        "normalize_v0",
        "pq_hybrid_v0",
        "qualified_time_v0",
        "record_conformance_v0",
        "record_set_v0",
        "release_condition_v0",
        "sep2787_attestation_v0",
        "tap_v0",
        "transparency_consistency_v0",
        "x402_settlement_v0"
      ],
      "result": "43 passed, 0 failed, 3 skipped, 75 cases",
      "at_commit": "54a69b38e28c3a8d3d9ced6b61b217ea5eb03334",
      "kind": "reproduction",
      "their_scoping": "Reproduces the published independent vector lanes at commit 54a69b3 using only standard public libraries (cryptography, rfc8785), with no Vaara code imported. 43/46 suites passed, 0 failed, 3 skipped (optional-dependency lanes). Establishes reproducibility of Vaara's published verdicts over the pinned corpus. Does not establish integration of Insight oracle attestations into Vaara records, nor any opinion on Vaara's compliance standing.",
      "record": "https://github.com/imokokok/vaara-conformance",
      "submitted_by": "imokokok"
    }
  ],
  "issued": 6
}