AGENTICRAIL ENFORCEMENT SPECIFICATION v1.3
DATE: 2026-07-08 (amends v1.2, 2026-07-05; v1.2 amends v1.1, 2026-06-07; v1.1 amends v1.0, 2026-05-17)
ENTITY: TUARA KURI LIMITED

AMENDMENT: v1.3 adds prev_receipt_hash to the receipt schema — a genuine hash chain,
not merely an identifier chain. Verified directly against the live enforcement engine
(slp8-core.js) and the live report generator (report/worker.js), then confirmed
end-to-end against a real production sequence on 2026-07-08 (the report's hash_chain
field showed verified:7, broken:0, not_verifiable:1 — the 1 being the chain's first
receipt, which has no predecessor to hash). v1.0-v1.2 correctly listed prev_receipt_id
as a receipt field but described its chain-linkage property in terms that implied
content-tampering protection it did not, on its own, provide: prev_receipt_id is an
identifier reference — it proves something with that identifier preceded this receipt,
not that the predecessor's content is unchanged. prev_receipt_hash closes that specific
gap. Enforcement rules, decision set, denial codes, pack_id derivation, and signature
algorithm are UNCHANGED from v1.2 — this amendment adds one new receipt field only.
v1.0, v1.1, and v1.2 remain independently reproducible and are not edited.

DECISIONS: ALLOW, DENY, HALT

ENFORCEMENT RULES:
1. function missing or empty -> DENY:missing_function
2. action_type not permitted for function -> DENY:ACTION_NOT_ALLOWED
3. step !== function name -> DENY:FUNCTION_STEP_MISMATCH
4. Sequence already sealed -> DENY:SEALED_SEQUENCE
5. Nonce already used -> DENY:REPLAY_NONCE
6. Step out of order -> DENY:SEQUENCE_VIOLATION
7. Timestamp stale (|ts_ms - now| > 300s) -> DENY:STALE_TIMESTAMP
8. RECORD_RESULT at boundary with witnessed_pack_id not matching the real,
   durably-written, immediately-preceding receipt -> DENY:ARTIFACT_UNBOUND
9. All pass -> ALLOW

MSMD SPINE: intake,disruption,instability,state_read,internal_driver,execution,boundary,settle
HOKIANGA SPINE: dialect_request,hapuu_identity,corpus_query,provenance_token,compression_check,kaitiaki_gate,output_authorised,settle

RECEIPT FIELDS (top level, alphabetical, both ALLOW and DENY):
attestation,decision,executed,key_id,meta,pack_id,payload_hash,prev_receipt_hash,prev_receipt_id,reasons,sealed,signature,signature_alg,ts_ms,version

META SUB-OBJECT (nested under meta, alphabetical):
action_type,function,model_id,policy_map_ids,sequence_id,step

DENIAL CODES (enforcement-rule level, non-exhaustive — field-validation codes such as
missing_schema_version/missing_nonce/etc. are documented at agenticrail.nz/spec/receipt-schema.json,
not enumerated here):
ACTION_NOT_ALLOWED,ARTIFACT_UNBOUND,FUNCTION_STEP_MISMATCH,REPLAY_NONCE,SEALED_SEQUENCE,SEQUENCE_VIOLATION,STALE_TIMESTAMP,missing_function

PACK_ID: SHA-256 of canonical JSON (alphabetically sorted keys)
PREV_RECEIPT_ID: pack_id of the previous receipt — an identifier reference (chain
                 order), not a content hash of the predecessor; corrected in v1.3,
                 see AMENDMENT above. Anchor updates ONLY on decision===ALLOW and a
                 confirmed-durable R2 write (2026-07-05 fix; a DENY or a failed write
                 never becomes "the last true thing that happened")
PREV_RECEIPT_HASH: SHA-256 of the previous receipt's full canonical JSON, signature
                   included — the actual hash chain, added 2026-07-08. An in-place
                   edit to any earlier receipt changes its hash, breaking every
                   subsequent prev_receipt_hash link even if prev_receipt_id
                   references still match. Null for the chain's first receipt and for
                   any link whose anchor predates this field — the report generator
                   treats that as "not verifiable", not "broken". Surfaced live in the
                   report's Chain Integrity table (Chain hash column) and JSON output
                   (hash_chain: {verified, broken, not_verifiable}).
PAYLOAD_HASH: SHA-256 of raw request body
SIGNATURE: Ed25519 over canonical JSON (receipt minus signature field), base64-encoded
           (legacy receipts before 2026-06-07: HMAC-SHA256, hex-encoded)
KEY_ID: k2_2026-06-07_ed25519 (active, Ed25519); k1_2026-02-22_01 (legacy, HMAC)

PUBLIC KEYS: agenticrail.nz/spec/receipt-public-keys.json (Ed25519 - offline-verifiable by anyone)
VERIFICATION: report.agenticrail.nz (no login, no operator required)