AGENTICRAIL ENFORCEMENT SPECIFICATION v1.2
DATE: 2026-07-05 (amends v1.1, 2026-06-07; v1.1 amends v1.0, 2026-05-17)
ENTITY: TUARA KURI LIMITED

AMENDMENT: v1.2 corrects the ALLOW/DENY receipt field lists published in v1.0/v1.1,
which named fields that do not exist in the implementation (nonce, action, schema_version,
denial_code, expected_step at the receipt's top level) and omitted fields that do
(meta, executed, sealed, reasons, signature_alg) — verified directly against the live
enforcement engine's receipt-building code and cross-checked against the JSON Schema
at agenticrail.nz/spec/receipt-schema.json, which already carried the correct structure.
v1.2 also adds one new enforcement rule (9) and its denial code, ARTIFACT_UNBOUND,
introduced 2026-07-05. Receipt schema, canonicalization, pack_id derivation, chain
linkage, and signature algorithm are UNCHANGED from v1.1 — this amendment corrects
DOCUMENTATION of the receipt shape and denial-code set; it does not alter the shape
or the set. v1.0 and v1.1 remain independently reproducible and are not edited.

DECISIONS: ALLOW, DENY, HALT

ENFORCEMENT RULES:
1. function missing or empty -> DENY:missing_function
2. action_type not permitted for function -> DENY:ACTION_NOT_ALLOWED
3. step !== function name -> DENY:FUNCTION_STEP_MISMATCH
4. Sequence already sealed -> DENY:SEALED_SEQUENCE
5. Nonce already used -> DENY:REPLAY_NONCE
6. Step out of order -> DENY:SEQUENCE_VIOLATION
7. Timestamp stale (|ts_ms - now| > 300s) -> DENY:STALE_TIMESTAMP
8. RECORD_RESULT at boundary with witnessed_pack_id not matching the real,
   durably-written, immediately-preceding receipt -> DENY:ARTIFACT_UNBOUND
9. All pass -> ALLOW

MSMD SPINE: intake,disruption,instability,state_read,internal_driver,execution,boundary,settle
HOKIANGA SPINE: dialect_request,hapuu_identity,corpus_query,provenance_token,compression_check,kaitiaki_gate,output_authorised,settle

RECEIPT FIELDS (top level, alphabetical, both ALLOW and DENY):
attestation,decision,executed,key_id,meta,pack_id,payload_hash,prev_receipt_id,reasons,sealed,signature,signature_alg,ts_ms,version

META SUB-OBJECT (nested under meta, alphabetical):
action_type,function,model_id,policy_map_ids,sequence_id,step

DENIAL CODES (enforcement-rule level, non-exhaustive — field-validation codes such as
missing_schema_version/missing_nonce/etc. are documented at agenticrail.nz/spec/receipt-schema.json,
not enumerated here):
ACTION_NOT_ALLOWED,ARTIFACT_UNBOUND,FUNCTION_STEP_MISMATCH,REPLAY_NONCE,SEALED_SEQUENCE,SEQUENCE_VIOLATION,STALE_TIMESTAMP,missing_function

PACK_ID: SHA-256 of canonical JSON (alphabetically sorted keys)
PREV_RECEIPT_ID: SHA-256 of previous receipt (chain linkage) — anchor updates ONLY on
                 decision===ALLOW and a confirmed-durable R2 write (2026-07-05 fix; a
                 DENY or a failed write never becomes "the last true thing that happened")
PAYLOAD_HASH: SHA-256 of raw request body
SIGNATURE: Ed25519 over canonical JSON (receipt minus signature field), base64-encoded
           (legacy receipts before 2026-06-07: HMAC-SHA256, hex-encoded)
KEY_ID: k2_2026-06-07_ed25519 (active, Ed25519); k1_2026-02-22_01 (legacy, HMAC)

PUBLIC KEYS: agenticrail.nz/spec/receipt-public-keys.json (Ed25519 - offline-verifiable by anyone)
VERIFICATION: report.agenticrail.nz (no login, no operator required)