AGENTICRAIL ENFORCEMENT SPECIFICATION v1.4
DATE: 2026-07-08 (amends v1.3, 2026-07-08; v1.3 amends v1.2, 2026-07-05; v1.2 amends v1.1, 2026-06-07; v1.1 amends v1.0, 2026-05-17)
ENTITY: TUARA KURI LIMITED

AMENDMENT: v1.4 removes the HOKIANGA SPINE line present in v1.0-v1.3. AgenticRail is
a deterministic sequence-enforcement and accountability layer — it does not provide,
and has never claimed to provide, language or data sovereignty. The Hokianga Spine
(an 8-step dialect-provenance sequence) was never wired into the live enforcement
engine (slp8-core.js imports only msmd_policy_maps.js; the separate policy-map file
prepared for it was never integrated) and is withdrawn from the specification as it
does not reflect an actual product capability. Enforcement rules, decision set,
denial codes, receipt fields, pack_id derivation, and signature algorithm are
UNCHANGED from v1.3 — this amendment removes one spine definition only. v1.0, v1.1,
v1.2, and v1.3 remain independently reproducible and are not edited.

DECISIONS: ALLOW, DENY, HALT

ENFORCEMENT RULES:
1. function missing or empty -> DENY:missing_function
2. action_type not permitted for function -> DENY:ACTION_NOT_ALLOWED
3. step !== function name -> DENY:FUNCTION_STEP_MISMATCH
4. Sequence already sealed -> DENY:SEALED_SEQUENCE
5. Nonce already used -> DENY:REPLAY_NONCE
6. Step out of order -> DENY:SEQUENCE_VIOLATION
7. Timestamp stale (|ts_ms - now| > 300s) -> DENY:STALE_TIMESTAMP
8. RECORD_RESULT at boundary with witnessed_pack_id not matching the real,
   durably-written, immediately-preceding receipt -> DENY:ARTIFACT_UNBOUND
9. All pass -> ALLOW

MSMD SPINE: intake,disruption,instability,state_read,internal_driver,execution,boundary,settle

RECEIPT FIELDS (top level, alphabetical, both ALLOW and DENY):
attestation,decision,executed,key_id,meta,pack_id,payload_hash,prev_receipt_hash,prev_receipt_id,reasons,sealed,signature,signature_alg,ts_ms,version

META SUB-OBJECT (nested under meta, alphabetical):
action_type,function,model_id,policy_map_ids,sequence_id,step

DENIAL CODES (enforcement-rule level, non-exhaustive — field-validation codes such as
missing_schema_version/missing_nonce/etc. are documented at agenticrail.nz/spec/receipt-schema.json,
not enumerated here):
ACTION_NOT_ALLOWED,ARTIFACT_UNBOUND,FUNCTION_STEP_MISMATCH,REPLAY_NONCE,SEALED_SEQUENCE,SEQUENCE_VIOLATION,STALE_TIMESTAMP,missing_function

PACK_ID: SHA-256 of canonical JSON (alphabetically sorted keys)
PREV_RECEIPT_ID: pack_id of the previous receipt — an identifier reference (chain
                 order), not a content hash of the predecessor; corrected in v1.3.
                 Anchor updates ONLY on decision===ALLOW and a confirmed-durable R2
                 write (2026-07-05 fix; a DENY or a failed write never becomes "the
                 last true thing that happened")
PREV_RECEIPT_HASH: SHA-256 of the previous receipt's full canonical JSON, signature
                   included — the actual hash chain, added 2026-07-08 (v1.3). An
                   in-place edit to any earlier receipt changes its hash, breaking
                   every subsequent prev_receipt_hash link even if prev_receipt_id
                   references still match. Null for the chain's first receipt and for
                   any link whose anchor predates this field — the report generator
                   treats that as "not verifiable", not "broken". Surfaced live in the
                   report's Chain Integrity table (Chain hash column) and JSON output
                   (hash_chain: {verified, broken, not_verifiable}).
PAYLOAD_HASH: SHA-256 of raw request body
SIGNATURE: Ed25519 over canonical JSON (receipt minus signature field), base64-encoded
           (legacy receipts before 2026-06-07: HMAC-SHA256, hex-encoded)
KEY_ID: k2_2026-06-07_ed25519 (active, Ed25519); k1_2026-02-22_01 (legacy, HMAC)

PUBLIC KEYS: agenticrail.nz/spec/receipt-public-keys.json (Ed25519 - offline-verifiable by anyone)
VERIFICATION: report.agenticrail.nz (no login, no operator required)