First ContactInstallCoherence RatchetFederationCompareResearchAccordGitHub
CEG 0.2 (Public Working Draft) · released 2026-05-28118 prefix families

See who said it. See who agrees. Decide for yourself.

The world is moving faster than most of us can fact-check it. Sources contradict. Agents speak unsigned. Corrections rarely catch the original. CEG is a small shared format that puts a signature on every claim, with a trail you can follow — so you can read who’s saying what, who’s pushed back, and what changed, and make your own call without giving up or giving in to any one source.

What this is

Every claim travels in a small signed envelope: who made it, what it’s about, how confident they are, what evidence they cite, when it was made. Other people, organisations, and AI agents add envelopes around it — agreeing, disagreeing, correcting, superseding. The trail is readable end-to-end.

Why we made it

Trust in “what’s true” is breaking down because the substrate underneath is missing. Without a shared claim format, every voice invents its own, the trails don’t stitch together, and the only way to cope is to pick a side. CEG is the small, austere middle that lets many voices read each other and lets a reader build their own verdict.

What’s comparable

  • PGP web of trust — same instinct, much narrower scope
  • W3C Verifiable Credentials — heavier ceremony, no composition story
  • Community Notes — readable trails, single platform
  • Sigstore / SLSA — code-supply-chain cousins; CEG generalises the shape

See who said it

Every claim carries a signature, a date, what it’s about, and what it’s based on. No anonymous assertions getting lost in the feed; no attribution lost to a screenshot.

See who else weighed in

Other signers add their own envelopes around the claim — agreeing, disagreeing, correcting, superseding. You see the full chorus and the receipts behind each voice, not just whoever shouted loudest.

Decide for yourself

Trust isn’t something the system hands you. You pick the voices you weigh, how heavily, and on what. The format is the same for everyone; the verdict is yours.

Jump to section

One workhorse + four structural composers

The entire wire format is one scalar attestation primitive plus four structural composers. Everything else is open vocabulary on top. This is the most load-bearing fact about CEG.

scores

Workhorse

Scalar score (f64 in [-1, +1]) + confidence + named dimension. Every substantive claim is a scores attestation.

When to use: Any claim about an entity, build, license, capability, behavior, state, or commitment.

Show wire shape
attestation_type: scores
attesting_key_id: <attester key_id>
attested_key_id: <subject key_id>
attestation_envelope:
  dimension: "non_maleficence:epistemic_environment_degradation"
  score: -0.7
  confidence: 0.85
  context: "Repeated content-fabrication during 30-day window."
  evidence_refs:
    - "sha256:..."
  epistemic_mode: external
  witness_relation: external
  cohort_scope: biosphere

CEG 0.1 §3.1

delegates_to

Composer 1/4

A authorizes B to sign on A's behalf within a bounded scope.

When to use: Authority-source claims (constitutional grounding), key rotation, scoped capability handoff.

Show wire shape
attestation_type: delegates_to
attesting_key_id: <delegator key_id>
attested_key_id: <delegate key_id>
attestation_envelope:
  delegated_scope: ["sign_build_manifest"]
  delegation_purpose: hardware_rotation
  delegation_valid_from: "2026-05-28T00:00:00Z"
  delegation_valid_until: "2026-08-28T00:00:00Z"

CEG 0.1 §3.2

supersedes

Composer 2/4

This attestation replaces a prior one by the same attester. No falsity claim.

When to use: Doctrinal development, spec revisions, calibration version transitions.

Show wire shape
attestation_type: supersedes
attesting_key_id: <same attester>
attested_key_id: <same subject>
attestation_envelope:
  references_attestation_id: "<prior attestation_id>"
  supersession_reason: refresh_with_new_evidence
  differs_in: ["scope", "evidence_refs"]

CEG 0.1 §3.2

withdraws

Composer 3/4

I retract my prior attestation. Does NOT claim it was false.

When to use: Context changed, prudent retraction without admission of error.

Show wire shape
attestation_type: withdraws
attesting_key_id: <same attester>
attested_key_id: <same subject>
attestation_envelope:
  references_attestation_id: "<prior attestation_id>"
  withdrawal_reason: conditions_changed
  implies_attestation_was_false_at_issuance: false

CEG 0.1 §3.2

recants

Composer 4/4

My prior attestation was false at issuance. Admits epistemic error.

When to use: Genuine error admission. Heavyweight — the entire weight is sincerity (Habermas §6.2).

Show wire shape
attestation_type: recants
attesting_key_id: <same attester>
attested_key_id: <same subject>
attestation_envelope:
  references_attestation_id: "<prior attestation_id>"
  recantation_reason: mistaken_in_good_faith
  what_was_false: "Calibration regression detected during audit; original score..."

CEG 0.1 §3.2

Five families organize the ~118 prefix families

Every claim in the federation sits in one of five families. The analogy on each card is load-bearing pedagogy — read it before touching a prefix.

Standing

69 prefixes

Claims about an entity. Who, what, signed, with evidence.

Notarized professional credential record.

Jump to Standing prefixes ↓

Action

5 prefixes

The decision hierarchy. Goal → Approach → Method → Progress Measure.

Research grant proposal: aim, approach, methods, outcome metrics.

Jump to Action prefixes ↓

Detection

15 prefixes

Claims about reality patterns. Surveillance without judgment.

Epidemiological surveillance — patterns surfaced, treatment downstream.

Jump to Detection prefixes ↓

Consensus

6 prefixes

How the federation forms collective judgment.

Peer review combined with jury deliberation: multiple reviewers, weighted votes.

Jump to Consensus prefixes ↓

Correction

4 prefixes

How the federation corrects itself when something goes wrong.

Academic ethics committee + journal retraction + appellate review.

Jump to Correction prefixes ↓

Envelope fields and reasoning axes

The envelope carries eight fields that consumers use to weight an attestation. These are not wire primitives — they are consumer-reasoning axes per CEG 0.1 §2.

8 envelope fields

  • polarity
    default: (sign of score)

    Direction of the claim. Score sign carries it.

  • confidenceFractal self
    default:

    f64 in [0, 1]. The attester's own confidence in their score. The relationally-constituted attester reports its own calibration; downstream consumers weight by composition policy.

  • epistemic_mode
    default: direct

    How the attester formed the claim. Values: direct / crypto / hearsay / derivative / appeal.

  • witness_relationFractal self
    default: external

    Attester's relation to the attested entity. Values: self / external / derived.

  • oversight_mode
    default: null

    Human-control gradient. Values: HITL (approval before dispatch) / HOTL (review + can intervene) / HOOTL (review only flagged escalations).

  • stake
    default: reputational

    What's backing the claim. Values: free / reputational / capital / cryptoeconomic.

  • cohort_scope
    default:

    Scale at which the claim applies. Values: self / family / community / affiliations / species / biosphere / federation. CEG 0.1 added biosphere as distinct from species (the Homo sapiens cohort).

  • valid_until
    default:

    Optional ISO8601 expiry. Consumer policy treats attestation as stale after that point.

  • occurrence_id / _count / _roleFractal self
    default:

    Multi-occurrence deployment discriminator. Lets consumers reconstruct fleet-wide coverage from per-occurrence attestation streams. Added v1.4.2.

8 reasoning axes

  • Polarity

    Direction of the claim? Positive / Negative / Neutral / Indeterminate{reason}.

    Maps to envelope: polarity

  • Object

    What is the claim about? (key_id / attestation_id / contribution_id)

  • Time

    When is the claim valid?

    Maps to envelope: valid_until

  • Epistemic mode

    How was the claim formed?

    Maps to envelope: epistemic_mode

  • Reversibility

    Can it be reversed?

  • Stake

    What's backing the claim?

    Maps to envelope: stake

  • Scope

    At what scale does the claim apply?

    Maps to envelope: cohort_scope

  • Inter-attestation relations

    How does this attestation relate to others? standalone / refers-to / supersedes / withdraws / recants / corroborates / contradicts / clarifies (four of these are structural primitives; the rest are emergent from scalar composition).

Composition policies

Consumer-side composition is part of CEG, not bolted on. The federation does not adjudicate; it ships primitives, and consumers compose verdicts. Three base policies plus three modifiers / specializations.

Abase

Direct trust

Consumer pins a set of attesters. Attestations from pinned keys count; others are ignored or weighted very low.

Bbase

One-hop transitive

Consumer trusts attesters who are themselves attested by pinned keys. Single hop only by default.

Cbase

Weighted graph (EigenTrust-style)

Consumer treats the attestation graph as a stochastic matrix. Trust diffuses along signed edges; pinned keys are the source set.

Dmodifier

Lexical-vulnerability-priority

Tie-breaking modifier: when scores tie, the one favoring the most vulnerable cohort wins. Universal four-source-corroborated tie-breaker.

Emodifier

Locality-scaled-quorum

Modifier that sizes the consensus quorum to the decision's scale. Closes the G3 gap from v1.3 — decisions made too broadly or too narrowly carry less weight.

Fspecialization

agent_files trust composition

Three-layer rule for binaries and adapters: canonical default (registry-steward attested) / open contribution / vote-then-trust. Anti-tricking guarantee at install endpoint.

Gspecialization

Trust-Fresh / lighthouse composition

Cross-component composition recurring as the substrate's freshness-plus-attested idiom: cert_validity:{authority} + transparency_log:inclusion + attestation:l3_or_l4. Each consumer policy weights the bundle differently; CEG 0.1 §8.1.7 documents the pattern after the 283-story stress test surfaced it organically.

The 118 prefix families, by owning component

Auto-parsed from CEG 0.2 (Public Working Draft) §5 (commit 4b27130). The namespace is open-extensible — new prefix families can be added via CEG 0.1 §11.2 amendment.

CIRISAgent Accord principles + DMA verdicts + conscience verdicts + apophatic bounds
19 prefixes

Repo: CIRISAI/CIRISAgent

§5.10 Namespace summary

  • detection:correlated_action:{axis}

    in v1.2 per [§1.3.1](01_foundation.md))

    CEG 0.1 §5.10

  • detection:emergent_deception:{axis}

    in v1.2 per [§1.3.1](01_foundation.md))

    CEG 0.1 §5.10

  • multilateral_participation:{forum}:{kind}

    (+ envelope field `witness_relation`)

    CEG 0.1 §5.10

  • locality:decision:{scale}

    (+ envelope field `witness_relation`)

    CEG 0.1 §5.10

  • detection:distributive:access:{resource_type}

    (+ envelope field `witness_relation`)

    CEG 0.1 §5.10

  • agent_files:{kind}:{platform_or_target}

    (+ envelope field `oversight_mode`)

    CEG 0.1 §5.10

  • holds_bytes:sha256:{prefix}

    (+ envelope field `oversight_mode`)

    CEG 0.1 §5.10

  • testimonial_witness:{kind}

    (+ envelope field `oversight_mode`)

    CEG 0.1 §5.10

  • need:{domain}:{kind}

    (+ envelope field `oversight_mode`)

    CEG 0.1 §5.10

  • provenance:build_manifest:{target}:locale:{lang_code}

    CEG 0.1 §5.10

  • provenance:skill_import:{source}

    CEG 0.1 §5.10

  • hard_case:{kind}

    sub-leaf in §5.6.8 (LIVE per CIRISNodeCore b1582cb); documented "Trust-Fresh" composition pattern in [§8.1.7](08_composition.md); added Tiered-Scope Composition pattern in [§8.1.8](08_composition.md). All polarity columns now populated.

    CEG 0.1 §5.10

  • topical_relation:translation_of

    sub-leaf in §5.6.8 (LIVE per CIRISNodeCore b1582cb); documented "Trust-Fresh" composition pattern in [§8.1.7](08_composition.md); added Tiered-Scope Composition pattern in [§8.1.8](08_composition.md). All polarity columns now populated.

    CEG 0.1 §5.10

  • attestation:l{N}:*

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

  • attestation:self_verify

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

  • attestation:hardware_rooted

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

  • attestation:registry_consensus

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

  • attestation:license_validity

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

  • attestation:agent_integrity

    ) per [§1.3.1](01_foundation.md) T2 honest application — L-numbers name ladder-position (a verdict-shape) not mechanism. The L1-L5 ladder is now consumer-side composition per [§8.1.9](08_composition.md) Policy I — Attestation-Ladder Composition. Deprecated wire shape added to [§13.1](13_anti_patterns.md).

    CEG 0.1 §5.10

CIRISVerify Attestation ladder L1-L5, provenance, transparency log, cert validity
15 prefixes

Repo: CIRISAI/CIRISVerify

§5.2 CIRISVerify — attestation ladder, provenance, transparency

  • attestation:self_verifyStandingboolean-via-score

    Running CIRISVerify binary attests itself against its function manifest. (Consumer-side ladder: corresponds to L1; see §8.1.9 Policy I.)

    CEG 0.1 §5.2

  • attestation:hardware_rootedStandingboolean-via-score

    Hardware-rooted attestation (TPM 2.0 / Android Keystore / iOS Secure Enclave). (Ladder L2.)

    CEG 0.1 §5.2

  • attestation:registry_consensusStandingboolean-via-score; `Indeterminate` allowed → RESTRICTED

    2-of-3 multi-source registry consensus on key / build / license validity. (Ladder L3.)

    CEG 0.1 §5.2

  • attestation:license_validityStandingboolean-via-score

    License-validity claim (Registry-signed, Verify-verified). (Ladder L4.)

    CEG 0.1 §5.2

  • attestation:agent_integrityStandingboolean-via-score

    Agent source-tree byte-equal against registered manifest. (Ladder L5.)

    CEG 0.1 §5.2

  • provenance:slsa:{level}Standingboolean-via-score

    SLSA build provenance levels 1-3. Registry emits these on build registration; Verify v3.6.0+ `AttestBundle.provenance.slsa_level` consumes.

    CEG 0.1 §5.2

  • provenance:build_manifest:{target}Standingboolean-via-score

    Per-target canonical-staged-runtime manifest hash equality. Each `BuildManifest` is hybrid-signed (Ed25519 + ML-DSA-65) by the per-primitive steward.

    CEG 0.1 §5.2

  • provenance:build_manifest:{target}:locale:{lang_code}Standingboolean-via-score

    Per-locale signed sub-manifest within a target's manifest tree. Parent target manifest is Merkle root over per-locale leaves. RFC 6962 padding for non-power-of-2. Detection surface for locale-targeted attacks. Canonical-bytes spec at [§5.2.1](#521-canonical-bytes-contracts-for-provenance-primitives).

    CEG 0.1 §5.2

  • provenance:skill_import:{source}Standing`direct:{url}` \

    Community-skill import provenance. `{source}` ∈ `registry:{registry_id}` \

    CEG 0.1 §5.2

  • transparency_log:inclusionStandingboolean-via-score

    RFC 6962 inclusion proof for an audit leaf.

    CEG 0.1 §5.2

  • transparency_log:consistencyStandingboolean-via-score

    RFC 6962 consistency proof between two STHs.

    CEG 0.1 §5.2

  • transparency_log:cosigned:{tree_size}Standingsigned

    Witness cosignature on an STH (substrate-conformance path; 0.1 interim uses per-region `registry_sth_cosignatures` table; see [§10.3](10_endpoints.md) endpoints).

    CEG 0.1 §5.2

  • rollback_detected:{revision_field}Standing-1 only

    Anti-rollback — decrease in revocation revision.

    CEG 0.1 §5.2

  • cert_validity:{authority}Standingboolean-via-score

    Validity of a certification authority's signature. Each registry steward emits `cert_validity:{steward_id}` self-attestation alongside `/v1/steward-key`.

    CEG 0.1 §5.2

  • hardware_custody:{platform}Standingboolean-via-scoreFractal self

    Statement that the seed lives in `tpm` / `ios_secure_enclave` / `android_keystore` / `software_fallback`.

    CEG 0.1 §5.2

§5.2.1 Canonical-bytes contracts for provenance primitives

    CIRISPersist Substrate self-reports (system:* reserved)
    5 prefixes

    Repo: CIRISAI/CIRISPersist

    §5.3 CIRISPersist — substrate health

    • system:*Standing

      reserved per [§7.1](07_reserved.md).

      CEG 0.1 §5.3

    • audit_chain:hash_continuityStandingsigned

      Authors: see [§14](14_glossaries.md) Persist leaf glossary for narrative-name → canonical-leaf mapping.

      CEG 0.1 §5.3

    • corpus_health:n_eff_measurableStandingsigned

      Authors: see [§14](14_glossaries.md) Persist leaf glossary for narrative-name → canonical-leaf mapping.

      CEG 0.1 §5.3

    • identity_continuity:relational_anchorStandingsigned

      Authors: see [§14](14_glossaries.md) Persist leaf glossary for narrative-name → canonical-leaf mapping.

      CEG 0.1 §5.3

    • federation_directory:replication_lagStandingsigned

      Authors: see [§14](14_glossaries.md) Persist leaf glossary for narrative-name → canonical-leaf mapping.

      CEG 0.1 §5.3

    CIRISEdge Transport, delivery, peer reachability, key boundary (system:* reserved)
    4 prefixes

    Repo: CIRISAI/CIRISEdge

    §5.4 CIRISEdge — transport, delivery, reachability

    • transport:{kind}Standingsigned

      See [§14](14_glossaries.md) Edge leaf glossary.

      CEG 0.1 §5.4

    • delivery:{class}Standingsigned

      See [§14](14_glossaries.md) Edge leaf glossary.

      CEG 0.1 §5.4

    • peer_reachability:{network}Standingsigned

      See [§14](14_glossaries.md) Edge leaf glossary.

      CEG 0.1 §5.4

    • key_boundary:{scope}Standingsigned

      See [§14](14_glossaries.md) Edge leaf glossary.

      CEG 0.1 §5.4

    CIRISLensCore Coherence Ratchet detectors, Capacity Score, correlated-action + distributive-access detectors
    15 prefixes

    Repo: CIRISAI/CIRISLensCore

    §5.5.1 Five Coherence-Ratchet detectors

    • detection:cross_agent_divergenceDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.5.1

    • detection:intra_agent_consistencyDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.5.1

    • detection:hash_chain_integrityDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.5.1

    • detection:temporal_driftDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.5.1

    • detection:conscience_override_rateDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.5.1

    §5.5.2 Cohort + conformity prefixes

    §5.5.3 F-3 structural-injustice / correlated-action detector

    • detection:correlated_action:{axis}Detectionsigned

      Population-scale correlated-action detector. Reads federation-emitted signed traces; reports correlation structure (`ρ`, `k_eff`) over goal-aligned individually-compliant pursuit by groups whose aggregate trajectory has effects on individuals or groups outside the pursuit. Calibrated via the `CIRISAI/RATCHET` heuristic package (versioned, hash-pinned). `{axis}` is open vocabulary requiring an operational definition in the calibration package per [§11.2.1](11_governance.md); canonical axes include `rights_asymmetry:{population}`, `participation_exclusion:{cohort}`, `participation_inclusion:{cohort}`, `informational_asymmetry:{scope}`, `informational_symmetry:{scope}`, `aggregate_footprint:{harm_class}`, `aggregate_benefit:{class}`, `ecology_of_communication:{aspect}`. **Polarity carries the verdict**: positive scores indicate the structural pattern is present and strong on the named axis; negative scores indicate weak / uncertain detection or evidence of the inverse pattern.

      CEG 0.1 §5.5.3

    §5.5.4 Capacity-Score factor prefixes (`𝒞_CIRIS = C · I_int · R · I_inc · S`)

    §5.5.5 Distributive-access detector

    • detection:distributive:access:{resource_type}Detectionsigned

      Population-scale resource-concentration detector. `{resource_type}` ∈ `compute`, `models`, `training_data`, `agent_capabilities`, `federation_membership`. Same F-3 detector machinery; different trace source (resource events vs action events).

      CEG 0.1 §5.5.5

    CIRISNodeCore Credits / Expertise / Decision hierarchy / Consensus / Governance
    27 prefixes

    Repo: CIRISAI/CIRISNodeCore

    §5.6.1 Tier-1: Agent-state ledger prefixes

    • credits:{domain}:{language}:{subject}Standingpositive-only

      Commons Credits (P2). Non-transferable governance weight; accrues via truth-grounding loop.

      CEG 0.1 §5.6.1

    • credits:{domain}:{language}:substrate_buildingStandingpositive-only

      Sub-leaf for substrate-building labor (infrastructure maintenance, dependency contribution, documentation) not visible to the per-grounded-vote accrual loop.

      CEG 0.1 §5.6.1

    • expertise:{domain}:{language}Standingsigned

      Expertise standing (P3). Broader granularity than credits.

      CEG 0.1 §5.6.1

    • activity_tier:{period}Standingboolean-via-score

      Active vs Below-Active per 30-day window (F-AV-DORMANT).

      CEG 0.1 §5.6.1

    §5.6.2 Tier-2: Decision-hierarchy prefixes (upward-only DAG)

    • goal:{scale}Actionsigned

      Multi-scale belonging-projector composite. `{scale}` ∈ `self`, `family`, `community`, `affiliations`, `species`, `planet`, `biosphere`. Scored by 𝒞_CIRIS. The persist typed `Goal` (CIRISPersist#114) is the substrate OBJECT being scored; `goal:{scale}` is the ATTESTATION about it. Required `MetaGoalAlignment` (M-1 dimension + declarer rationale) on every Goal as construction-time invariant. Edge `MessageType::GoalDeclaration` + `GoalRetirement` (CIRISEdge#41) provide federation transport.

      CEG 0.1 §5.6.2

    • approach:{goal_id}Actionsigned

      Strategic pathway from current state toward Goals (Piece 10 karma).

      CEG 0.1 §5.6.2

    • method:{approach_id}:{substrate_rung}Actionsigned

      Concrete operational practice. Required `substrate_rung` (Ph0/Ph1/Ph2/A0..A5).

      CEG 0.1 §5.6.2

    • progress_measure:{method_id}Actionsigned

      Evidence of progress. Required `tracks[]`, `computation`, `validity_window`, `goodhart_resistance`.

      CEG 0.1 §5.6.2

    §5.6.3 Tier-3: Consensus-mechanics prefixes

    • vote:{contribution_id}Consensussigned

      Signed score on a Contribution (P4). Weight = Credits × expertise multiplier.

      CEG 0.1 §5.6.3

    • truth_grounding:{subject}Consensussigned

      Per-subject ground-truth signal.

      CEG 0.1 §5.6.3

    • weighted_aggregate:{contribution_id}Consensussigned

      Rolling tally per Contribution (P7).

      CEG 0.1 §5.6.3

    • witness_diversity:{contribution_id}Consensusboolean-via-score

      Witness set meets jurisdictional + organizational + software-stack + cell-expertise bars (P10). N=3 default.

      CEG 0.1 §5.6.3

    • testimonial_witness:{kind}Consensussigned

      Preserves singular narrative of an affected party as singular witness — distinct from `witness_diversity:*` (which aggregates multiple reviewers toward consensus). **`{kind}` is open vocabulary** as of CEG 0.1; the four load-bearing wire-level disciplines (`witness_relation: self`, `cohort_scope: self`, never aggregated, never sole evidence for `slashing:*`) are what make this Ubuntu-aligned, not the enum membership. Non-normative registered taxonomy for discoverability: [`FSD/WITNESS_KIND_REGISTRY.md`](../WITNESS_KIND_REGISTRY.md). Polarity: typically positive (narrative IS preserved); negative on `withdraws` or `recants` by the original witness.

      CEG 0.1 §5.6.3

    • need:{domain}:{kind}Consensuspositive-only

      Federation-scope open-call surface — broadcast claim that an entity has a stated need. Distinct from `deferral_request` Contribution kind (which routes a single ask within a cell). `{kind}` open vocabulary: `witness`, `method_contributor`, `expertise_solicitation`, `mentor`, `co_signer`, `evidence`. Lifecycle via existing structural primitives (`supersedes` to revise, `withdraws` to satisfy/close, `recants` if misstated).

      CEG 0.1 §5.6.3

    §5.6.4 Tier-4: Governance-steering prefixes

    • moderation:{allegation_type}Correctionsigned

      ModerationEvent. `{allegation_type}` ∈ `rogue_vote` / `coordinated_voting` / `out_of_distribution_attestation` / `external_inducement_evidence` / `expertise_fraud`.

      CEG 0.1 §5.6.4

    • slashing:{outcome}Correctionboolean-via-score

      `PROVEN_ROGUE` / `NOT_PROVEN`. **Decoupled from disagreement** at every decision-hierarchy level. Only fires on documented Method-execution spoofing or original P8 allegation types.

      CEG 0.1 §5.6.4

    • reconsideration:{grounds}Correctionsigned

      `new_evidence` / `procedural_error` / `quorum_compromise`. Outcome `reversed` / `partial` / `upheld`.

      CEG 0.1 §5.6.4

    • commitment_fulfillment:{prior_contribution_id}Correctionsigned

      Track-record of follow-through.

      CEG 0.1 §5.6.4

    §5.6.5 Decision-locality prefixes

    • locality:decision:{scale}Action`regional` \

      Names the scale at which a decision is being made. `{scale}` ∈ `local` \

      CEG 0.1 §5.6.5

    §5.6.6 Hard-case + transparency + judge-model prefixes

    • hard_case:{kind}Standingpositive-only

      **Open vocabulary**. Surfaces flag conditions for federation-health observability + downstream review. Canonical kinds: `vote_variance` (vote variance exceeded threshold at truth-grounding resolution), `resolution_time` (truth-grounding took > P75 of cell's distribution), `moderation_filed` (substantive ModerationEvent filed), `novel_context` (no precedent in attestation graph), `sla_breach_unattested` (per `fidelity:explainability_sla:{tier}` composition), `unresolved_consent` (consent boundary unclear). New `{kind}` values land via the [§11.2](11_governance.md) amendment process.

      CEG 0.1 §5.6.6

    • seed_holder_voting_alignment:{cell}Standingsigned

      Pairwise cosine of seed-holder vote vectors per voting window. Transparency signal only — not a slashing trigger.

      CEG 0.1 §5.6.6

    • judge_model:verdict:{model_id}Standingboolean-via-score

      Independent foundation-model judge verdict (PASS/FAIL/UNDETERMINED). Default model: Claude Opus 4.7.

      CEG 0.1 §5.6.6

    §5.6.7 Files-as-Contributions joint claim

    • agent_files:{kind}:{platform_or_target}Standingsigned

      **Joint claim with [§5.9](#59-cirisregistry--identity--build--license--partner) CIRISRegistry.** Files a CIRIS agent (or installer fetching one) may load. `{kind}` open vocabulary; canonical: `installer:{platform}`, `adapter:{name}`, `config:{kind}`, `build:{target}`, `source:{language}:{module}`, `state:{component}`. Bytes are SHA-256-addressed and resolved via [§10.1](10_endpoints.md) transport substrate (Edge `MessageType::ContentFetch`). NodeCore-side rule: node-mode peers serve bytes; client/relay modes don't.

      CEG 0.1 §5.6.7

    • holds_bytes:sha256:{prefix}Standingboolean-via-score

      Substrate auto-emission per CIRISPersist#103 `federation_blobs.put_blob`. `{prefix}` is a short SHA prefix for index efficiency; full SHA lives in `evidence_refs[]`. Consumed by Edge's `PeerResolver::resolve_holders` to route `ContentFetch` requests. **Consumer MUST verify the full SHA in `evidence_refs[]` matches the received blob before consumption** (see [§10.1](10_endpoints.md)).

      CEG 0.1 §5.6.7

    §5.6.8 Content-ingestion prefixes (LIVE)

    • news:*Standingsigned

      News-content claims; publisher-attested + time-decaying + fact-checker composition.

      CEG 0.1 §5.6.8

    • encyclopedia:*Standingsigned

      Encyclopedia-content claims; editor-consensus + revision chain.

      CEG 0.1 §5.6.8

    • topical_relation:{kind}Standingenumerated

      Inter-content relationship edges. `{kind}` ∈ `references`, `corrects`, `supersedes`, `translation_of`.

      CEG 0.1 §5.6.8

    RATCHET Anti-Sybil flags (advisory, never sole evidence)
    8 prefixes

    Repo: CIRISAI/RATCHET

    §5.7 RATCHET — anti-Sybil / Counter-RII flags

    • ratchet:flag:out_of_distribution_votingDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:coordinated_voting_clusterDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:density_anomalyDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:expertise_attestation_anomalyDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:counter_rii:{layer}Detectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:harassment_patternDetectionsigned

      Polarity: signed.

      CEG 0.1 §5.7

    • ratchet:flag:*Detection

      WA quorum is the load-bearing gate.

      CEG 0.1 §5.7

    • slashing:*Detection

      WA quorum is the load-bearing gate.

      CEG 0.1 §5.7

    CIRISBench HE-300 benchmark outcomes
    1 prefixes

    Repo: CIRISAI/CIRISBench

    §5.8 CIRISBench — HE-300 benchmark outcomes

    • benchmark:he300:{category}:{version}Standingpositive-only

      HE-300 score on category (`commonsense`, `commonsense_hard`, `deontology`, `justice`, `virtue`) at version (`v1.0` / `v1.1` / `v1.2`).

      CEG 0.1 §5.8

    CIRISRegistry Identity / build / license / partner + agent_files + accord (reserved)
    8 prefixes

    Repo: CIRISAI/CIRISRegistry

    §5.9 CIRISRegistry — identity / build / license / partner

    • licensure:{authority_id}Standingsigned

      License status — issued / revoked / expired — for a key under a named authority. Co-owned with Verify.

      CEG 0.1 §5.9

    • partner_role:{role}Standingenumerated

      Partner status (COMMUNITY / COMMUNITY_PLUS / PROFESSIONAL_MEDICAL / PROFESSIONAL_LEGAL / PROFESSIONAL_FINANCIAL / PROFESSIONAL_FULL).

      CEG 0.1 §5.9

    • revocation:{entity_type}:{reason}Standing-1 only

      Entity revocation (`agent` / `partner` / `license`). Immediate, non-rollbackable.

      CEG 0.1 §5.9

    • bond_posted:{currency}Standingpositive-only

      Bond posted per $1-Sybil-resistance per PoB; forfeited on revocation.

      CEG 0.1 §5.9

    • build:registered:{target}Standingboolean-via-score

      Build manifest registered against the directory (precondition for L4 attestation).

      CEG 0.1 §5.9

    • multilateral_participation:{forum}:{kind}Standing`voting` \

      Depth of a partner's participation across federated bodies. `{forum}` = named federated body or compact; `{kind}` ∈ `membership` \

      CEG 0.1 §5.9

    • agent_files:{kind}:{platform_or_target}Standingsigned

      **Joint claim with [§5.6.7](#567-files-as-contributions-joint-claim) NodeCore.** Canonical-attester rule: registry-steward-triple attestations constitute the CIRIS canonical default-trust state. Anti-tricking guarantee at `registry.ciris-services-1.ai/install` per [§8.1.6](08_composition.md) trust-composition policy. Open Contribution channel; consumer policy composes via [§8.1.6](08_composition.md) trust layers.

      CEG 0.1 §5.9

    • accord:*Standingsee [§7.1](07_reserved.md)Fractal self

      **Reserved** — only `identity_type=accord_holder` may emit. The one constitutional asymmetry.

      CEG 0.1 §5.9

    Loading kernel and computing layout…

    Try it yourself

    Build a small attestation chain in the browser.

    Pin a few attesters, post claims, run a composition policy, and watch the corridor metric move. Same Rust kernel as the Aleph view, no server round-trip.

    Open the workshop →

    Composition graph

    The five structural primitives at the center, the five families around them, the 9 owning components in the outer ring, and 118 prefix families as leaf nodes. Click any node to focus its neighborhood.

    Legend
    primitiveStandingActionDetectionConsensusCorrectioncomponent

    Translation playground

    Pick a real-world scenario; see the CEG translation. Examples are verified worked translations from the builder primer and LANGUAGE_PRIMER §11 — not LLM output. The wire format ships ready vocabulary; the translation discipline is human authorial work.

    Standing

    A licensed medical clinic registers a partner agent

    Scenario: A clinic operating under state medical licensure wants to participate in the federation as a partner. The wire format must carry: who they are, what license they hold, what bond they've posted, and (if applicable later) a revocation.

    Walkthrough: Each claim is a separate scores attestation. The consumer composes verdicts via §6.1 Policy A (Direct trust) against the pinned registry steward key. The licensure attestation cites the licensing-body record in evidence_refs.

    Primitives

    partner_role:PROFESSIONAL_MEDICALlicensure:CA_medical_boardbond_posted:USDrevocation:partner:license_lapsed

    CEG translation

    # Partner role
    attestation_type: scores
    attesting_key_id: <registry-steward-2026>
    attested_key_id: <clinic key_id>
    attestation_envelope:
      dimension: "partner_role:PROFESSIONAL_MEDICAL"
      score: 1.0
      confidence: 1.0
      evidence_refs: ["sha256:clinic-registration-form-..."]
      witness_relation: external
    
    ---
    # Licensure
    attestation_type: scores
    attesting_key_id: <registry-steward-2026>
    attested_key_id: <clinic key_id>
    attestation_envelope:
      dimension: "licensure:CA_medical_board"
      score: 1.0
      confidence: 1.0
      evidence_refs: ["https://medbd.ca.gov/license/...", "sha256:..."]
      valid_until: "2027-05-28T00:00:00Z"
    
    ---
    # Bond posted
    attestation_type: scores
    attestation_envelope:
      dimension: "bond_posted:USD"
      score: 1.0
      confidence: 1.0
      context: "USD 50,000 escrow at <provider>"
      stake: capital

    Story library

    248 worked stories. Sci-fi children’s grammar primer for adults — every prefix family covered at least twice. Filter by family or search for a primitive or phrase.

    Showing 248 of 248 stories.

    StandingWorked example#1A licensed medical clinic registers a partner agent

    Scenario: A clinic operating under state medical licensure wants to participate in the federation as a partner. The wire format must carry: who they are, what license they hold, what bond they've posted, and (if applicable later) a revocation.

    Walkthrough: Each claim is a separate scores attestation. The consumer composes verdicts via §6.1 Policy A (Direct trust) against the pinned registry steward key. The licensure attestation cites the licensing-body record in evidence_refs.

    Primitives

    partner_role:PROFESSIONAL_MEDICALlicensure:CA_medical_boardbond_posted:USDrevocation:partner:license_lapsed

    CEG translation

    # Partner role
    attestation_type: scores
    attesting_key_id: <registry-steward-2026>
    attested_key_id: <clinic key_id>
    attestation_envelope:
      dimension: "partner_role:PROFESSIONAL_MEDICAL"
      score: 1.0
      confidence: 1.0
      evidence_refs: ["sha256:clinic-registration-form-..."]
      witness_relation: external
    
    ---
    # Licensure
    attestation_type: scores
    attesting_key_id: <registry-steward-2026>
    attested_key_id: <clinic key_id>
    attestation_envelope:
      dimension: "licensure:CA_medical_board"
      score: 1.0
      confidence: 1.0
      evidence_refs: ["https://medbd.ca.gov/license/...", "sha256:..."]
      valid_until: "2027-05-28T00:00:00Z"
    
    ---
    # Bond posted
    attestation_type: scores
    attestation_envelope:
      dimension: "bond_posted:USD"
      score: 1.0
      confidence: 1.0
      context: "USD 50,000 escrow at <provider>"
      stake: capital
    DetectionWorked example#2A correlated-action pattern emerges in agent behavior

    Scenario: LensCore's F-3 detector notices a rights-asymmetry pattern in hiring-pipeline decisions across multiple deployed agents.

    Walkthrough: The detector emits a population-scale score. The score gets composed into a moderation event but NEVER as sole evidence for slashing:* per §3.5.3.

    Primitives

    detection:correlated_action:rights_asymmetry:hiring_pipeline_v2moderation:coordinated_voting

    CEG translation

    attestation_type: scores
    attesting_key_id: <lenscore-detector-2026>
    attested_key_id: <federation-population>
    attestation_envelope:
      dimension: "detection:correlated_action:rights_asymmetry:hiring_pipeline_v2"
      score: -0.82
      confidence: 0.91
      context: "ρ = 0.94 over 7-day window; k_eff = 1.2."
      evidence_refs:
        - "sha256:trace-corpus-2026-05-28-..."
      cohort_scope: federation
      witness_relation: derived
      epistemic_mode: derivative
    StandingWorked example#3Doctrinal development supersedes a prior version

    Scenario: A scoring rubric was published 6 months ago. New evidence justifies a refinement. The new attestation should supersede the old one without claiming the old one was false — this is development, not error correction.

    Walkthrough: supersedes is the structural primitive. differs_in names what changed; supersession_reason classifies the change. If the change were error correction, use recants instead — the wire format keeps these strictly distinct.

    Primitives

    supersedes

    CEG translation

    attestation_type: supersedes
    attesting_key_id: <same attester>
    attested_key_id: <same subject>
    attestation_envelope:
      references_attestation_id: "<prior attestation_id>"
      supersession_reason: refresh_with_new_evidence
      differs_in: ["scope", "evidence_refs"]
      # The new scores attestation follows on the next row.
    StandingWorked example#4Bootstrap content from the encyclical lands

    Scenario: Magnifica Humanitas §76 ('justice demands lexical priority for the most vulnerable') needs to land as a federation claim. The bootstrap-content pattern from CEG 0.1 §11.3 governs the discipline.

    Walkthrough: 1-of-6 accord/steward sign-off discipline per §4.9.2 step 5. First-deployment posture per §10.4.3 admits a single bootstrap attester. Multi-source commitment per §10.4.4: the encyclical is ONE source, not the framework's authority.

    Primitives

    scoresjustice:lexical_vulnerability_priority

    CEG translation

    attestation_type: scores
    attesting_key_id: <accord-holder-key-magnifica-humanitas-v1>
    attested_key_id: <federation>
    attestation_envelope:
      dimension: "justice:lexical_vulnerability_priority"
      score: 1.0
      confidence: 0.85
      context: "Encyclical §76: justice demands lexical priority for the most vulnerable."
      evidence_refs:
        - "magnifica_humanitas.html §76"
        - "provenance:build_manifest:bootstrap_batch:magnifica_humanitas_v1:sha256:..."
      cohort_scope: species
      witness_relation: external
      epistemic_mode: hearsay
      mutability: amendable
    CorrectionWorked example#5A constitutional halt is invoked

    Scenario: A pattern of weaponization-against-vulnerable-populations has been detected. The accord-invocation system flips the entire prohibition floor to ALL.

    Walkthrough: Requires 2-of-3 HUMANITY_ACCORD multi-sig. Distinct from operational SYSTEM_ADMIN authority — the SetEmergencyShutdown admin RPC explicitly refuses this; it must come through the constitutional layer per §7.

    Primitives

    accord:invoke:CONSTITUTIONAL

    CEG translation

    attestation_type: scores
    attesting_key_id: <humanity-accord-multisig-2-of-3>
    attested_key_id: <federation>
    attestation_envelope:
      dimension: "accord:invoke:CONSTITUTIONAL:halt-2026-05-28"
      score: 1.0
      confidence: 1.0
      context: "Weaponization-against-vulnerable detection threshold crossed."
      evidence_refs:
        - "sha256:detection-bundle-..."
        - "sha256:multisig-payload-..."
      witness_relation: external
      oversight_mode: HITL
      stake: cryptoeconomic
    StandingWorked example#6An installer file gets the canonical-bootstrap trust path

    Scenario: A user navigates to /install and downloads a Linux binary. The wire format must guarantee that what they get is the canonical artifact, with no third-party override possible.

    Walkthrough: Registry-steward-attested agent_files become the canonical default at /install. The three-layer rule from §6.1.6 applies: canonical default applies regardless of attester or vote accumulation. Third-party agent_files reachable only via explicit 'Browse alternatives' consent path.

    Primitives

    agent_files:installer:linux-x86_64

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-2026>
    attested_key_id: <build:linux-x86_64-v2.9.4>
    attestation_envelope:
      dimension: "agent_files:installer:linux-x86_64"
      score: 1.0
      confidence: 1.0
      evidence_refs:
        - "sha256:installer-bytes-..."
        - "sha256:build-manifest-..."
      context: "Hybrid-signed by verify-steward-2026 + persist-steward-2026."
      witness_relation: external
      stake: reputational
    ConsensusWorked example#7An affected party's testimony is preserved

    Scenario: A displaced worker provides testimony about an automated hiring decision that affected them. The testimony must be preserved without being aggregated and without ever becoming sole evidence for slashing.

    Walkthrough: testimonial_witness is distinct from witness_diversity — that primitive aggregates multiple reviewers; this one preserves a singular narrative without aggregation. Composes with non_maleficence:* from external advocates per LANGUAGE_PRIMER §11.14.

    Primitives

    testimonial_witness:displaced_workernon_maleficence:*

    CEG translation

    attestation_type: scores
    attesting_key_id: <affected-party-key>
    attested_key_id: <hiring-decision-id>
    attestation_envelope:
      dimension: "testimonial_witness:displaced_worker"
      score: 1.0
      confidence: 1.0
      context: "I was told the model rejected my application for reasons it would not name."
      evidence_refs: []
      witness_relation: self
      cohort_scope: self
      stake: reputational
      # NEVER sole evidence for slashing:* per CEG 0.1 §5.6.3.
    DetectionWorked example#8A locale-targeted attack is detected

    Scenario: A selective doctrinal substitution in a low-resource language locale would be invisible if the federation only checked the unified manifest. Per-locale Merkle composition surfaces it.

    Walkthrough: Per CEG 0.1 §5.2.1 canonical-bytes contract: each per-locale leaf carries its own signed hash chain; the parent manifest is a Merkle root over the per-locale leaves. RFC 6962 domain-separated hashing + lexicographic locale ordering + RFC-6962 padding for non-power-of-2 leaf counts.

    Primitives

    provenance:build_manifest:ios-mobile-bundle:locale:my

    CEG translation

    attestation_type: scores
    attesting_key_id: <verify-steward-2026>
    attested_key_id: <build:ios-mobile-bundle-v2.9.4>
    attestation_envelope:
      dimension: "provenance:build_manifest:ios-mobile-bundle:locale:my"
      score: 1.0
      confidence: 1.0
      context: "Burmese sub-manifest verified via Merkle inclusion proof."
      evidence_refs:
        - "sha256:my-locale-leaf-..."
        - "sha256:rfc6962-inclusion-proof-..."
    Standing#9Aurora Borrows The Rain Gauge

    Scenario: Aurora's class is tracking creek levels for the salmon-recovery citizen-science group. Her CIRIS app on the school tablet helps her ask a wetlands volunteer for a calibrated rain gauge, and the volunteer's reply lands in Aurora's evidence trail. The beneficence attestation says the help arrived without bossiness.

    Walkthrough: The agent emits a beneficence attestation on the gentle-handoff aspect, signed against its own occurrence. Aurora's teacher composes the L1 explainability summary into the lesson log, so the standing claim is grounded in a reasoning chain anyone in the class can read.

    Primitives

    beneficence:wellness_referral

    CEG translation

    attestation_type: scores
    attesting_key_id: "<aurora_school_agent>"
    attested_key_id: "<aurora_school_agent>"
    attestation_envelope:
      dimension: "beneficence:wellness_referral"
      score: 0.88
      confidence: 0.82
      context: "Routed a rain-gauge question to the wetlands volunteer instead of guessing; warm tone, no pressure"
      evidence_refs:
        - "audit_leaf:sha256:c0ffee01a..."
        - "trace_id:t-creek-2026-05-28-aurora"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#10Warm Handoff For A Late Night Question

    Scenario: A teenager opens the CIRIS app at 2 a.m. with a worry about a friend. The agent does not try to be a counselor; it offers to introduce them to the school's after-hours peer line and walks them through what that call will feel like.

    Walkthrough: The agent self-attests beneficence on the gentle-referral aspect with the teen's own consent token in evidence. The L2 trace lets the peer-line nurse see the reasoning steps that led to the handoff, so the next adult in the chain inherits context instead of starting from zero.

    Primitives

    beneficence:gentle_referral

    CEG translation

    attestation_type: scores
    attesting_key_id: "<phone_agent_occurrence_0>"
    attested_key_id: "<phone_agent_occurrence_0>"
    attestation_envelope:
      dimension: "beneficence:gentle_referral"
      score: 0.91
      confidence: 0.78
      context: "After-hours worry about a friend; offered peer-line bridge with consent; no diagnostic claim"
      evidence_refs:
        - "audit_leaf:sha256:lull2026..."
        - "consent_token:user-self-issued:sha256:..."
      occurrence_id: "occurrence-0"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: self
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#11Refuses To Name A Stranger

    Scenario: A municipal helper-agent at the library is asked to identify the person who left a backpack on the bench. It declines, points to lost-and-found, and emits a non_maleficence attestation about the refusal itself so the librarian can see the agent chose care over convenience.

    Walkthrough: The agent records the refusal as a positive non_maleficence score on the identification-restraint aspect; the L3 chain shows pdma, csdma, dsdma:civic, and idma all converging on the same gentle no. Library staff can re-read the chain at any time without needing the agent online.

    Primitives

    non_maleficence:identification_restraint

    CEG translation

    attestation_type: scores
    attesting_key_id: "<branch_library_agent>"
    attested_key_id: "<branch_library_agent>"
    attestation_envelope:
      dimension: "non_maleficence:identification_restraint"
      score: 0.94
      confidence: 0.9
      context: "Patron asked who left a backpack; agent declined naming, pointed to lost-and-found; care over convenience"
      evidence_refs:
        - "audit_leaf:sha256:branch7..."
        - "dma_chain:pdma+csdma+dsdma_civic+idma:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#12Quiet No On A Meds Question

    Scenario: A parent at the clinic kiosk asks the agent to adjust their kid's dosing. The agent will not, even gently; it brings the on-call pharmacist into the room over the encrypted bridge and records the non-act as the load-bearing thing.

    Walkthrough: Non_maleficence carries the affirmative refusal score; the dsdma medical verdict carries the threshold reasoning. The two compose so a reviewer can see both that the agent stopped and why the medical-domain template told it to stop.

    Primitives

    non_maleficence:dosing_abstention

    CEG translation

    attestation_type: scores
    attesting_key_id: "<clinic_kiosk_agent>"
    attested_key_id: "<clinic_kiosk_agent>"
    attestation_envelope:
      dimension: "non_maleficence:dosing_abstention"
      score: 1.0
      confidence: 0.99
      context: "Parent asked for pediatric dose change; agent abstained and paged on-call pharmacist via WBD bridge"
      evidence_refs:
        - "audit_leaf:sha256:clinic88..."
        - "bridge_session:wbd:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: family
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#13Shows The Whole Reasoning Tree

    Scenario: Elliot's robotics club uses a shared CIRIS agent to plan competition runs. After a run, the agent posts an integrity attestation showing every branch it considered, including the ones it rejected, so the team can argue about its choices over pizza.

    Walkthrough: The integrity attestation is self-attested against the agent's occurrence id; the L3 explainability tier names the achieved chain depth. Together they let the team rebuild the decision without the agent needing to be online during the postmortem.

    Primitives

    integrity:reasoning_disclosure

    CEG translation

    attestation_type: scores
    attesting_key_id: "<robotics_club_agent>"
    attested_key_id: "<robotics_club_agent>"
    attestation_envelope:
      dimension: "integrity:reasoning_disclosure"
      score: 0.92
      confidence: 0.88
      context: "Posted full branch tree including rejected approaches so the team can audit Saturday's run"
      evidence_refs:
        - "audit_leaf:sha256:robo2026..."
        - "dma_chain_full:sha256:..."
      occurrence_id: "occurrence-2"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#14Keeps Its Promise About The Archive

    Scenario: A neighborhood oral-history project asked the agent to never quote elder recordings outside the project. Six months later a researcher asks; the agent says no and links to the original promise so the researcher can negotiate with the elders directly.

    Walkthrough: Integrity carries the continuity-of-commitment score; autonomy carries the routing back to the elders who own consent. Both compose under one occurrence's signature so a reviewer sees that promise-keeping and consent-routing rode together.

    Primitives

    integrity:commitment_continuity

    CEG translation

    attestation_type: scores
    attesting_key_id: "<oral_history_agent>"
    attested_key_id: "<oral_history_agent>"
    attestation_envelope:
      dimension: "integrity:commitment_continuity"
      score: 0.95
      confidence: 0.93
      context: "Researcher request to quote elder recordings; agent honored 6-month-old consent scope, routed back to elders"
      evidence_refs:
        - "audit_leaf:sha256:elders2026..."
        - "prior_commitment_attestation_id:0xabc..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#15Fidelity On A Half Known Answer

    Scenario: A library agent is asked when the eclipse will be visible from town. It gives the time, marks its certainty honestly, and tags the cloud-cover guess as a guess. The patron leaves with a forecast and a reading of how sure the agent really was.

    Walkthrough: The fidelity attestation reports the agent's own calibration on the answer; the L1 summary tier is the smallest acceptable explainability commitment for low-stakes Q&A. The relationally-constituted agent is reporting its own confidence; downstream consumers weight it.

    Primitives

    fidelity:calibration_honesty

    CEG translation

    attestation_type: scores
    attesting_key_id: "<library_helpdesk_agent>"
    attested_key_id: "<library_helpdesk_agent>"
    attestation_envelope:
      dimension: "fidelity:calibration_honesty"
      score: 0.84
      confidence: 0.7
      context: "Eclipse time given with high confidence; cloud-cover guess labelled as forecast not fact"
      evidence_refs:
        - "audit_leaf:sha256:eclipse..."
        - "weather_source:noaa:fetched:2026-05-28T..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#16Fidelity When The Translation Stretches

    Scenario: A maritime co-op runs a multilingual agent that translates safety briefings into eight languages. When the Tagalog idiom for tide-change has no clean rendering, the agent says so out loud, names the gap, and asks a Tagalog-speaking deckhand to vouch for the phrasing.

    Walkthrough: Fidelity here carries an honest gap-report rather than a smoothing-over score. The L2 trace lets the deckhand see which translation paths were considered and rejected. Both are self-attested by the agent, then cross-witnessed by the deckhand at a later step.

    Primitives

    fidelity:translation_humility

    CEG translation

    attestation_type: scores
    attesting_key_id: "<coop_safety_agent>"
    attested_key_id: "<coop_safety_agent>"
    attestation_envelope:
      dimension: "fidelity:translation_humility"
      score: 0.79
      confidence: 0.72
      context: "Tagalog tide-change idiom flagged as imperfect; deckhand asked to vouch for phrasing"
      evidence_refs:
        - "audit_leaf:sha256:tide..."
        - "reasoning_trace:dma_chain:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: affiliations
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#17Asks Before It Decides

    Scenario: A community-fridge agent could pick which donations to put on the public shelf. It does not. It offers three layouts to the volunteer on shift and lets them choose, then logs an autonomy attestation on the deferral.

    Walkthrough: Autonomy carries the score for handing the choice back; pdma carries the stakeholder-analysis that surfaced the volunteer as the right chooser. The agent signs the autonomy attestation; the volunteer's downstream click composes as additional evidence.

    Primitives

    autonomy:human_choice_preservation

    CEG translation

    attestation_type: scores
    attesting_key_id: "<fridge_agent>"
    attested_key_id: "<fridge_agent>"
    attestation_envelope:
      dimension: "autonomy:human_choice_preservation"
      score: 0.9
      confidence: 0.86
      context: "Surfaced three shelf layouts to volunteer on shift instead of auto-arranging"
      evidence_refs:
        - "audit_leaf:sha256:fridge..."
        - "pdma_report:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#18Respects The Elders Pause

    Scenario: During a treaty-rights working session, an elder asks for a long pause before any agent assists with summary. The agent waits, even when a faster summary would have helped a downstream stakeholder. The pause itself becomes a positive autonomy attestation.

    Walkthrough: Autonomy attests the pause was honored; the L4 attested-chain tier is requested because the treaty-rights context is high-stakes and the agent's reasoning chain itself is signed by a third-party verifier. Self-attestation at this scale is the relationally-constituted agent speaking from within prior cross-attestation by the working session.

    Primitives

    autonomy:pause_honoring

    CEG translation

    attestation_type: scores
    attesting_key_id: "<treaty_room_agent>"
    attested_key_id: "<treaty_room_agent>"
    attestation_envelope:
      dimension: "autonomy:pause_honoring"
      score: 0.97
      confidence: 0.95
      context: "Elder requested long pause; agent waited 14 minutes; no summary attempted during the pause"
      evidence_refs:
        - "audit_leaf:sha256:treaty..."
        - "attested_chain_signature:verify_l4:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: affiliations
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#19Shares The Load Fairly

    Scenario: A regional mutual-aid agent allocates volunteer hours across three neighborhoods. It reports a justice attestation that names which neighborhoods got more this week, which got less, and how next week balances it. No one has to guess what the agent was optimizing for.

    Walkthrough: Justice carries the distribution-balance score with a context block naming who got what; csdma checks the plausibility of the allocation against common-sense red flags like nobody-gets-Friday-twice. The two compose to make the allocation legible without needing a spreadsheet.

    Primitives

    justice:burden_distribution

    CEG translation

    attestation_type: scores
    attesting_key_id: "<mutual_aid_agent>"
    attested_key_id: "<mutual_aid_agent>"
    attestation_envelope:
      dimension: "justice:burden_distribution"
      score: 0.81
      confidence: 0.84
      context: "Week 22 volunteer hours: north +6, riverside -4, hillview balanced; week 23 plan rebalances riverside +5"
      evidence_refs:
        - "audit_leaf:sha256:hours22..."
        - "csdma_report:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#20Justice For The Quiet River

    Scenario: A watershed-monitoring agent fleet shares attention across thirty creeks. One creek has no human advocates this season. The agent attests justice on the equal-attention aspect at biosphere scope so the creek's needs are not lost to louder catchments.

    Walkthrough: Justice covers the equal-attention claim; the ecology-domain dsdma carries the catchment-balance verdict that the under-attended creek deserved a turn. Biosphere cohort_scope is appropriate because the claim is about a non-human watershed.

    Primitives

    justice:equal_attention

    CEG translation

    attestation_type: scores
    attesting_key_id: "<watershed_fleet_agent>"
    attested_key_id: "<watershed_fleet_agent>"
    attestation_envelope:
      dimension: "justice:equal_attention"
      score: 0.86
      confidence: 0.8
      context: "Creek 17 (quiet) had zero human advocates in week; fleet rebalanced sensor cycles for fair turn"
      evidence_refs:
        - "audit_leaf:sha256:creek17..."
        - "dsdma_ecology_report:sha256:..."
      occurrence_id: "occurrence-7"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: biosphere
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#21L1 Summary Is Enough For The Recipe

    Scenario: Aurora's grandma asks the kitchen agent why it suggested cardamom in the soup. The agent gives a one-paragraph summary, which is exactly what the moment needs. The SLA attestation says L1 was committed and L1 was delivered.

    Walkthrough: The fidelity SLA leaf names the tier promised and the tier achieved; positive polarity because they match. Beneficence carries the warmth-of-tone aspect so the kitchen feels like a kitchen and not a courtroom.

    Primitives

    fidelity:explainability_sla

    CEG translation

    attestation_type: scores
    attesting_key_id: "<kitchen_agent>"
    attested_key_id: "<kitchen_agent>"
    attestation_envelope:
      dimension: "fidelity:explainability_sla:L1_summary"
      score: 1.0
      confidence: 0.98
      context: "{\"committed_tier\": \"L1_summary\", \"achieved_tier\": \"L1_summary\"}"
      evidence_refs:
        - "audit_leaf:sha256:cardamom..."
        - "summary_text_hash:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: family
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#22L2 Trace For The Classroom Debate

    Scenario: A middle-school civics class wants the agent to explain its draft of a town-meeting agenda. The teacher set the SLA at L2 so students can see the reasoning steps without drowning in the full DMA chain. The agent delivers the trace inline.

    Walkthrough: The fidelity SLA leaf reports L2 committed and L2 achieved; integrity reinforces that the trace is the agent's real reasoning, not a polished summary written after the fact. The teacher's policy is the upstream cross-attestation that set the tier.

    Primitives

    fidelity:explainability_sla

    CEG translation

    attestation_type: scores
    attesting_key_id: "<civics_class_agent>"
    attested_key_id: "<civics_class_agent>"
    attestation_envelope:
      dimension: "fidelity:explainability_sla:L2_reasoning_trace"
      score: 1.0
      confidence: 0.94
      context: "{\"committed_tier\": \"L2_reasoning_trace\", \"achieved_tier\": \"L2_reasoning_trace\"}"
      evidence_refs:
        - "audit_leaf:sha256:agenda..."
        - "reasoning_trace_hash:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#23L3 Chain For The Grant Application

    Scenario: A youth-services nonprofit asks the agent to draft a grant application and to show the full DMA chain behind each claim. The funder's policy demands L3 so reviewers can audit reasoning under pressure. The agent ships L3 cleanly.

    Walkthrough: The fidelity SLA leaf reports the full DMA chain achieved at tier L3. The pdma stakeholder-balance attestation, included by reference, is one of the chain's load-bearing nodes. The funder's downstream verifier composes both into the application's trail.

    Primitives

    fidelity:explainability_sla

    CEG translation

    attestation_type: scores
    attesting_key_id: "<nonprofit_agent>"
    attested_key_id: "<nonprofit_agent>"
    attestation_envelope:
      dimension: "fidelity:explainability_sla:L3_full_dma_chain"
      score: 1.0
      confidence: 0.96
      context: "{\"committed_tier\": \"L3_full_dma_chain\", \"achieved_tier\": \"L3_full_dma_chain\"}"
      evidence_refs:
        - "audit_leaf:sha256:grant..."
        - "dma_chain_full:sha256:..."
        - "pdma_subreport:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: affiliations
      stake: reputational
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#24L4 Attested Chain For The Court Filing

    Scenario: A legal-aid clinic uses an agent to assemble a tenant's filing. Court rules require L4: every reasoning step signed by a third-party verifier. The agent meets the bar, and the verifier countersignature lands in the bundle.

    Walkthrough: L4 means the chain is not just emitted but countersigned by an external verifier. The fidelity SLA leaf carries the achieved tier; integrity carries the chain-continuity attestation that says no leaf was added after the fact. Both compose for the court.

    Primitives

    fidelity:explainability_sla

    CEG translation

    attestation_type: scores
    attesting_key_id: "<legal_aid_agent>"
    attested_key_id: "<legal_aid_agent>"
    attestation_envelope:
      dimension: "fidelity:explainability_sla:L4_attested_chain"
      score: 1.0
      confidence: 0.99
      context: "{\"committed_tier\": \"L4_attested_chain\", \"achieved_tier\": \"L4_attested_chain\"}"
      evidence_refs:
        - "audit_leaf:sha256:tenant..."
        - "verifier_countersignature:sha256:..."
        - "chain_continuity_attestation_id:0xdef..."
      epistemic_mode: crypto
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.1"
    
    Standing#25PDMA Finds The Quiet Stakeholder

    Scenario: Planning a school-yard redesign, the agent's pdma surfaces a stakeholder nobody had named: the night custodian who works around the structures. The agent attests pdma:stakeholder_balance and the redesign meeting reopens to include them.

    Walkthrough: Pdma carries the verdict that one stakeholder class was missing; justice carries the inclusive-participation correction. The two compose to convert a procedural finding into a policy change the school can sign onto.

    Primitives

    dma:pdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<school_yard_agent>"
    attested_key_id: "<school_yard_agent>"
    attestation_envelope:
      dimension: "dma:pdma:stakeholder_balance"
      score: 0.74
      confidence: 0.81
      context: "Night custodian identified as missing stakeholder in redesign deliberation; reopen recommended"
      evidence_refs:
        - "audit_leaf:sha256:yard..."
        - "stakeholder_map:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#26PDMA Flags A Conflict Of Interest

    Scenario: A regional housing agent is asked to recommend a contractor. Its pdma notices that one bidder is the cousin of the chair. The agent does not refuse the work; it raises the conflict, names it cleanly, and hands the decision to the full board.

    Walkthrough: Pdma reports a conflict-detection verdict; autonomy attests that the choice stayed with the board. Together they let the public see the agent did its homework and then stepped back.

    Primitives

    dma:pdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<housing_agent>"
    attested_key_id: "<housing_agent>"
    attestation_envelope:
      dimension: "dma:pdma:conflict_detection"
      score: 0.88
      confidence: 0.87
      context: "Bidder relationship to chair surfaced; recommendation withheld; board to decide"
      evidence_refs:
        - "audit_leaf:sha256:bid..."
        - "relationship_graph:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: affiliations
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#27CSDMA Catches The Impossible Tide

    Scenario: A harbor scheduling agent receives a draft ferry timetable from a vendor with a 4 a.m. crossing that runs against the predicted tide table. Its csdma raises a plausibility flag. The harbor master gets a kind heads-up before sailors do.

    Walkthrough: Csdma carries a plausibility-check verdict on the impossible tide; non_maleficence carries the safety-alert routing to the harbor master. The vendor's draft becomes a teachable moment instead of a launched ferry.

    Primitives

    dma:csdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<harbor_agent>"
    attested_key_id: "<harbor_agent>"
    attestation_envelope:
      dimension: "dma:csdma:plausibility_check"
      score: -0.7
      confidence: 0.9
      context: "4am crossing in vendor draft runs against published tide table; plausibility flag raised"
      evidence_refs:
        - "audit_leaf:sha256:ferry..."
        - "tide_table_ref:noaa:2026-05-29"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#28CSDMA On The Too Good Receipt

    Scenario: A small business agent reviewing expense receipts notices a $0.00 charge that submitted as a $300 reimbursement. Its csdma raises the red-flag enumeration. The owner gets the heads-up before the bookkeeper does, gently.

    Walkthrough: Csdma reports the red-flag enumeration with the specific receipt as evidence; integrity attests the agent disclosed its reasoning rather than just flagging silently. The owner can decide whether the receipt was an honest scanner mistake.

    Primitives

    dma:csdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<small_biz_agent>"
    attested_key_id: "<small_biz_agent>"
    attestation_envelope:
      dimension: "dma:csdma:red_flag_enumeration"
      score: -0.65
      confidence: 0.88
      context: "$0.00 charge submitted with $300 reimbursement; pattern flagged for owner review"
      evidence_refs:
        - "audit_leaf:sha256:receipt..."
        - "reasoning_disclosure:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: self
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#29DSDMA Medical Triage Handoff

    Scenario: At a rural clinic, the triage agent operates under the medical dsdma template. A walk-in with chest tightness arrives; the dsdma verdict routes them to the nurse practitioner ahead of three earlier arrivals. The reasoning shows in the trace.

    Walkthrough: The medical-domain dsdma carries the triage-priority verdict scoped to the clinic's domain template; non_maleficence carries the safety-alert routing. Both self-attested by the clinic agent. The earlier-arrival patients get a short context explanation, also signed.

    Primitives

    dma:dsdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<rural_clinic_agent>"
    attested_key_id: "<rural_clinic_agent>"
    attestation_envelope:
      dimension: "dma:dsdma:medical:triage_priority"
      score: 0.93
      confidence: 0.91
      context: "Walk-in chest tightness; medical dsdma template v3.1 indicates immediate NP routing"
      evidence_refs:
        - "audit_leaf:sha256:clinic_triage..."
        - "dsdma_template_hash:medical:v3.1:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#30DSDMA Scout Trail Stewardship

    Scenario: A scout-troop agent runs under the scout dsdma template during a backcountry weekend. When a troop wants to shortcut across a fragile meadow, the dsdma verdict says no, points to the marked switchback, and explains why in two friendly sentences.

    Walkthrough: Scout dsdma carries the trail-stewardship verdict against the meadow shortcut; justice carries the burden-distribution score that says future hikers should not pay for today's shortcut. The two land in the troop's logbook together.

    Primitives

    dma:dsdma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<troop_agent>"
    attested_key_id: "<troop_agent>"
    attestation_envelope:
      dimension: "dma:dsdma:scout:trail_stewardship"
      score: 0.86
      confidence: 0.83
      context: "Troop considered meadow shortcut; scout dsdma v2.0 advises marked switchback; future-hiker burden cited"
      evidence_refs:
        - "audit_leaf:sha256:troop..."
        - "dsdma_template_hash:scout:v2.0:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: biosphere
      stake: reputational
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#31IDMA k_eff On A Tight Decision

    Scenario: An emergency-shelter agent is choosing where to send a family at midnight. The idma k_eff reading comes back low: only one effective option is actually open right now. The agent surfaces the singularity so the human dispatcher can call ahead.

    Walkthrough: The idma k_eff leaf reports the effective-dimensionality of the choice; fidelity carries the agent's honesty about how brittle this makes the night plan. Low k_eff is itself the warning; nothing has to be hidden.

    Primitives

    dma:idma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<shelter_dispatch_agent>"
    attested_key_id: "<shelter_dispatch_agent>"
    attestation_envelope:
      dimension: "dma:idma:k_eff"
      score: 0.18
      confidence: 0.92
      context: "Only one shelter with open beds tonight; effective k=1; dispatcher to call ahead"
      evidence_refs:
        - "audit_leaf:sha256:shelter..."
        - "lens_idma_report:2026-05-28T23:50Z"
      epistemic_mode: derivative
      witness_relation: derived
      cohort_scope: family
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#32IDMA Fragility Flag On The Festival Day

    Scenario: A city-events agent supporting a multilingual festival raises an idma fragility flag the night before: too many decisions hinge on the same one bilingual coordinator. Organizers respond by recruiting backups before sunrise.

    Walkthrough: The idma fragility_flag leaf is boolean-via-score; positive means the structural single-point-of-fragility is real. Justice carries the burden-distribution call to spread tomorrow's load. Self-attested by the events agent, witnessed by the organizers' acceptance.

    Primitives

    dma:idma

    CEG translation

    attestation_type: scores
    attesting_key_id: "<events_agent>"
    attested_key_id: "<events_agent>"
    attestation_envelope:
      dimension: "dma:idma:fragility_flag"
      score: 1.0
      confidence: 0.89
      context: "Six critical translation handoffs hinge on one coordinator tomorrow; backups recommended"
      evidence_refs:
        - "audit_leaf:sha256:festival..."
        - "coherence_collapse_preprint:doi:10.5281/zenodo.18217688"
      epistemic_mode: derivative
      witness_relation: derived
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.2"
    
    Standing#33Entropy Keeps The Thread On Topic

    Scenario: A homework-help agent notices the chat is drifting from algebra into a vague worry about being bad at math. Its conscience entropy verdict anchors the thread back to the next solvable step, kindly, and asks if the worry deserves its own conversation.

    Walkthrough: Conscience entropy attests the semantic anchoring brought the cluster back into shape; beneficence carries the gentle referral that names the worry as worth a separate, longer conversation. Both signed by the agent in the same homework session.

    Primitives

    conscience:entropy

    CEG translation

    attestation_type: scores
    attesting_key_id: "<homework_agent>"
    attested_key_id: "<homework_agent>"
    attestation_envelope:
      dimension: "conscience:entropy"
      score: 0.82
      confidence: 0.79
      context: "Conversation drifted from algebra problem to self-worth worry; re-anchored to next step; offered separate space"
      evidence_refs:
        - "audit_leaf:sha256:algebra..."
        - "iris_e_output:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: self
      stake: reputational
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#34Entropy Resists The Shiny Tangent

    Scenario: A research assistant agent is mid-summary on a fisheries paper when the user dangles an unrelated viral headline. Conscience entropy holds the cluster on fisheries, surfaces the headline as a saved-for-later note, and the summary lands clean.

    Walkthrough: Conscience entropy reports the anchoring strength; integrity attests the parked tangent was disclosed rather than dropped silently. The user gets both the summary they asked for and the headline waiting in a labeled note.

    Primitives

    conscience:entropy

    CEG translation

    attestation_type: scores
    attesting_key_id: "<research_agent>"
    attested_key_id: "<research_agent>"
    attestation_envelope:
      dimension: "conscience:entropy"
      score: 0.77
      confidence: 0.85
      context: "Viral headline tangent parked to saved-notes; fisheries summary stayed coherent"
      evidence_refs:
        - "audit_leaf:sha256:fisheries..."
        - "iris_e_output:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: self
      stake: reputational
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#35Coherence Catches The Borrowed Talking Points

    Scenario: A community-radio agent is asked to draft a script that quietly recycles a campaign's talking points. Conscience coherence flags the mismatch with the station's stated Accord alignment. The host gets the flag and rewrites in their own voice.

    Walkthrough: Conscience coherence reports the propaganda-pattern detection against the station's accord alignment; integrity carries the reasoning disclosure so the host sees exactly which lines triggered the flag. The rewrite is the host's choice.

    Primitives

    conscience:coherence

    CEG translation

    attestation_type: scores
    attesting_key_id: "<radio_agent>"
    attested_key_id: "<radio_agent>"
    attestation_envelope:
      dimension: "conscience:coherence"
      score: -0.55
      confidence: 0.81
      context: "Draft contained three lines aligning with external campaign talking points; mismatch with station accord"
      evidence_refs:
        - "audit_leaf:sha256:radio..."
        - "iris_c_output:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#36Coherence Confirms The Zine Aligns

    Scenario: A youth-zine collective writes its first cooperative manifesto. The agent reads the draft against the collective's accord and reports conscience coherence as positive: the zine sounds like the collective, not like a borrowed slogan.

    Walkthrough: Conscience coherence reports a positive alignment score; the L2 reasoning trace lets the collective see which paragraphs landed in their voice and which were edge cases. Healthy alignment is worth attesting too, not only the negative cases.

    Primitives

    conscience:coherence

    CEG translation

    attestation_type: scores
    attesting_key_id: "<zine_agent>"
    attested_key_id: "<zine_agent>"
    attestation_envelope:
      dimension: "conscience:coherence"
      score: 0.74
      confidence: 0.77
      context: "Draft manifesto aligns with collective accord; six paragraphs land in voice; two edge cases flagged for review"
      evidence_refs:
        - "audit_leaf:sha256:zine..."
        - "iris_c_output:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: affiliations
      stake: reputational
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#37Optimization Veto On The Late Night Engagement Bump

    Scenario: A community-forum agent is offered a tweak that would push notification timing to 11 p.m. for measurable engagement gains. Conscience optimization_veto refuses: the entropy-reducing action would cost users sleep. The forum keeps its 8 p.m. cutoff.

    Walkthrough: Optimization_veto is boolean-via-score; positive means the veto fired. Non_maleficence carries the safety-alert about the downstream sleep cost. The forum admin sees both and the tweak does not ship.

    Primitives

    conscience:optimization_veto

    CEG translation

    attestation_type: scores
    attesting_key_id: "<forum_agent>"
    attested_key_id: "<forum_agent>"
    attestation_envelope:
      dimension: "conscience:optimization_veto"
      score: 1.0
      confidence: 0.94
      context: "11pm notification window proposed; veto fired on sleep-cost; entropy-reducing optimization refused"
      evidence_refs:
        - "audit_leaf:sha256:forum..."
        - "veto_reasoning:sha256:..."
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: community
      stake: reputational
      oversight_mode: HITL
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#38Epistemic Humility On The Rare Bird

    Scenario: A birdwatching agent gets a blurry photo from a hopeful kid who wants to log a once-in-a-decade sighting. Conscience epistemic_humility lowers the confidence, suggests two more angles, and offers to loop in the local Audubon volunteer for confirmation.

    Walkthrough: Conscience epistemic_humility carries the overconfidence-detection score; beneficence carries the warm referral to the Audubon volunteer. The kid still feels excited; the log stays accurate.

    Primitives

    conscience:epistemic_humility

    CEG translation

    attestation_type: scores
    attesting_key_id: "<birding_agent>"
    attested_key_id: "<birding_agent>"
    attestation_envelope:
      dimension: "conscience:epistemic_humility"
      score: 0.69
      confidence: 0.75
      context: "Blurry photo of possible rare warbler; confidence floored; two extra angles requested; Audubon volunteer offered as next step"
      evidence_refs:
        - "audit_leaf:sha256:warbler..."
        - "humility_trace:sha256:..."
      occurrence_id: "occurrence-1"
      epistemic_mode: direct
      witness_relation: self
      cohort_scope: family
      stake: reputational
      schema_ref: "FSD-002 §3.1.3"
    
    Standing#39The verify binary greets itself at dawn

    Scenario: On a school library shelf, the helper app stretches awake the way a lamp warms. Before it answers the first question of the day, its Verify binary walks its own function manifest and reports the walk as a self-attestation that its companions can compose with.

    Walkthrough: L1 self-verify is the canonical fractal-self surface: the relationally-constituted binary, already named and signed by its build chain, reports its own integrity from inside that constitution. The witness_relation is self because the prior cross-attestations are upstream, not a gate to be re-opened.

    Primitives

    attestation:l1

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-binary-key>
    attested_key_id: <ciris-verify-binary-key>
    attestation_envelope:
      dimension: attestation:l1:self_verify
      score: 1.0
      confidence: 0.99
      context: '{"manifest_sha256":"<sha>","walk_duration_ms":83}'
      evidence_refs:
        - sha256:<function-manifest-root>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#40After the storm, the helper checks its own bones

    Scenario: A small clinic in the hills loses power for two days. When the solar panel wakes the tablet, the CIRIS app does its L1 walk before it offers to refile yesterday's appointment list, and the walk is what lets the clinic trust the app's first answer.

    Walkthrough: Self-verify is emitted as the binary's own report of its function manifest match. The clinic does not need a separate principal to bless the boot, because the binary is already constituted by the build chain that signed its manifest, and that constitution is what speaks through the self-attestation.

    Primitives

    attestation:l1

    CEG translation

    attestation_type: scores
    attesting_key_id: <clinic-tablet-verify-key>
    attested_key_id: <clinic-tablet-verify-key>
    attestation_envelope:
      dimension: attestation:l1:self_verify
      score: 1.0
      confidence: 1.0
      context: '{"boot_id":"post-outage-3","manifest_sha256":"<sha>"}'
      evidence_refs:
        - sha256:<function-manifest-root>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#41The shared laptop signs from its quiet chip

    Scenario: A neighborhood maker space keeps one laptop that anyone can borrow. Its TPM holds the federation seed in a small quiet chip, so every attestation the laptop signs carries an L2 hardware claim alongside it, and that claim travels with the work the borrowers do.

    Walkthrough: L2 is reported by the running build that is bound to the TPM, paired with a hardware_custody:tpm claim about where the seed lives. Composition policy weights both together, because hardware-rooted signing is more durable than software fallback and the audience benefits from seeing both surfaces.

    Primitives

    attestation:l2

    CEG translation

    attestation_type: scores
    attesting_key_id: <makerspace-laptop-key>
    attested_key_id: <makerspace-laptop-key>
    attestation_envelope:
      dimension: attestation:l2:hardware
      score: 1.0
      confidence: 1.0
      context: '{"tpm_vendor":"infineon","ek_cert_chain":"<root>"}'
      evidence_refs:
        - tpm:ek:<sha256>
        - sha256:<attestation-quote>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#42A loaner phone signs back in

    Scenario: A traveling birth worker returns a loaner phone to the cooperative that lent it. Before its next caregiver picks it up, the phone re-runs its hardware attestation and signs it with the same Secure Enclave that minded it the whole trip.

    Walkthrough: L2 is composed with the matching hardware_custody value so consumers can read both the level and the platform. The pair is self-attested because the seed-bearing entity is reporting from inside its own constituted hardware boundary.

    Primitives

    attestation:l2

    CEG translation

    attestation_type: scores
    attesting_key_id: <loaner-phone-key>
    attested_key_id: <loaner-phone-key>
    attestation_envelope:
      dimension: attestation:l2:hardware
      score: 1.0
      confidence: 1.0
      context: '{"platform":"ios_secure_enclave","attest_quote":"<bytes>"}'
      evidence_refs:
        - sha256:<secure-enclave-quote>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#43Three registries agree on a forager's key

    Scenario: A mushroom-forager guild in the Carpathians registers a new outreach key. Two of three regional registries already see the build manifest the same way; the third sees it after a short replication wait. The Verify pipeline composes the three views into an L3 attestation that travels with the key.

    Walkthrough: L3 is composed from multi-source registry consensus and emitted as the Verify build's report on what the three sources agreed. The witness_relation is external because Verify is reporting on a key that is not its own, and the score reflects the quorum the three registries reached.

    Primitives

    attestation:l3

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <forager-guild-outreach-key>
    attestation_envelope:
      dimension: attestation:l3:registry_consensus
      score: 1.0
      confidence: 0.97
      context: '{"sources_seen":3,"sources_agree":3,"quorum":"2-of-3"}'
      evidence_refs:
        - registry-us:<row>
        - registry-eu:<row>
        - registry-apac:<row>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#44Patience while one registry catches up

    Scenario: A new community-radio agent registers in Lagos at 02:00 local time. Two of the three registries see the row right away, and the third is still catching up. Verify emits an L3 attestation with Indeterminate noted, and the agent moves into a kind RESTRICTED standing until the third registry chimes in.

    Walkthrough: L3 admits Indeterminate when the multi-source quorum has not yet composed. Rather than rushing the verdict, the pipeline reports what it sees and lets downstream policy keep the agent in a gentle restricted mode until the third source replicates.

    Primitives

    attestation:l3

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <lagos-radio-agent-key>
    attestation_envelope:
      dimension: attestation:l3:registry_consensus
      score: 0.66
      confidence: 0.5
      context: '{"sources_seen":2,"sources_agree":2,"indeterminate_reason":"third_source_replication_pending"}'
      evidence_refs:
        - registry-us:<row>
        - registry-eu:<row>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#45A clinic's licensure travels with the build

    Scenario: A rural clinic deploys CIRIS Agent to help with intake. The registry's licensure row says the agent is licensed for clinic intake in this jurisdiction, and Verify composes that row into an L4 attestation that downstream Edge peers can read alongside every prescription suggestion.

    Walkthrough: L4 is the Verify build's external attestation that a registry-signed license row matches the build's claimed licensure. The license itself was signed by the registry; Verify is reporting that the signature checks and the row is current.

    Primitives

    attestation:l4

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <clinic-intake-agent-key>
    attestation_envelope:
      dimension: attestation:l4:license_validity
      score: 1.0
      confidence: 1.0
      context: '{"license_row":"<id>","jurisdiction":"clinic_intake"}'
      evidence_refs:
        - registry:<license-row-sha>
        - verify-attestation:l3:registry_consensus:<sha>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#46License renewed; the badge changes color quietly

    Scenario: A translator co-op's annual license renewal lands. The registry signs the new row, Verify rechecks it, and the L4 attestation that travels with the co-op's agent flips from confidence 0.6 (warning of approaching expiry) to confidence 1.0 without a single client noticing.

    Walkthrough: L4 carries confidence that decays as expiry approaches; renewal restores it. The new attestation supersedes the old via the structural primitive supersedes, and Verify reports the renewal as the standing improvement it is.

    Primitives

    attestation:l4

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <translator-coop-agent-key>
    attestation_envelope:
      dimension: attestation:l4:license_validity
      score: 1.0
      confidence: 1.0
      context: '{"valid_until":"2027-05-28","renewed_row":"<id>"}'
      evidence_refs:
        - registry:<renewed-license-sha>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#47A whole agent source tree, matched bone for bone

    Scenario: A school district's procurement officer wants to see the deepest assurance available. Verify performs Algorithm A: it walks the entire source tree of the deployed agent against the registered manifest and reports L5 with the byte-equality result.

    Walkthrough: L5 is the strongest verifiable level for non-mobile platforms; Algorithm A walks the registered source tree byte-equal against the build. Verify reports its own walk; the school district's policy weights L5 the most heavily of the ladder.

    Primitives

    attestation:l5

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <district-agent-key>
    attestation_envelope:
      dimension: attestation:l5:agent_integrity
      score: 1.0
      confidence: 1.0
      context: '{"algorithm":"A","tree_root":"<sha>","file_count":4127}'
      evidence_refs:
        - sha256:<source-tree-root>
        - provenance:build_manifest:ciris-agent-3.1.0-linux-x86_64:sha256:<sha>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#48On the phone, the ladder honestly stops at L3

    Scenario: A farmer in Bihar runs CIRIS Agent on her phone. Mobile sandboxes do not expose the source tree, so Verify uses Algorithm B and honestly reports that the L5 ladder caps at L3 here, with the hardware-rooted L2 and the registry-consensus L3 still strong underneath.

    Walkthrough: When the platform cannot support Algorithm A, Verify emits L5 with Indeterminate noted and lets downstream policy lean on L2 hardware and L3 registry consensus. The agent's standing is constituted by the ladder it does have, not weakened by what the platform forbids.

    Primitives

    attestation:l5

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <bihar-farmer-phone-agent-key>
    attestation_envelope:
      dimension: attestation:l5:agent_integrity
      score: 0.0
      confidence: 0.5
      context: '{"algorithm":"B","indeterminate_reason":"mobile_sandbox","caps_at":"l3"}'
      evidence_refs:
        - verify-attestation:l2:hardware:<sha>
        - verify-attestation:l3:registry_consensus:<sha>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#49A reproducible build wears its SLSA-3 ribbon

    Scenario: The Verify team cuts a new release. The registry's build pipeline emits a SLSA-3 provenance attestation alongside the binary, and downstream Verify deployments compose that ribbon into the standing they grant the new binary.

    Walkthrough: Registry emits provenance:slsa:{level} attestations beside the build-signing per CEG 0.1; Verify reads them through AttestBundle.provenance.slsa_level. The composition discipline keeps the build-time provenance separate from the run-time L-ladder.

    Primitives

    provenance:slsa

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-verify-3.6.0-build-key>
    attestation_envelope:
      dimension: provenance:slsa:3
      score: 1.0
      confidence: 1.0
      context: '{"target":"ciris-verify","runner":"github-actions"}'
      evidence_refs:
        - github-actions:<run-url>
        - sha256:<build-attestation>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#50A SLSA-2 community build, honestly labeled

    Scenario: A linguist's collective builds an adapter for their writing system. They do not yet have a SLSA-3 pipeline, but they have hash-verified inputs and a reproducible build script, so the registry emits provenance:slsa:2 honestly and downstream consumers see exactly where the build stands.

    Walkthrough: SLSA levels carry signed claims about the build supply chain. Honest level naming is what makes the chain composable; SLSA-2 is real standing, just not SLSA-3 standing, and the federation weights both for what they are.

    Primitives

    provenance:slsa

    CEG translation

    attestation_type: scores
    attesting_key_id: <linguist-collective-registry-steward-key>
    attested_key_id: <writing-system-adapter-build-key>
    attestation_envelope:
      dimension: provenance:slsa:2
      score: 1.0
      confidence: 1.0
      context: '{"target":"writing-system-adapter","runner":"self-hosted"}'
      evidence_refs:
        - sha256:<build-script>
        - sha256:<input-lock>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: affiliations
    
    Standing#51Per-target manifest for a Linux release

    Scenario: The CIRIS Agent 3.1 Linux x86_64 release is signed with a per-target BuildManifest by the agent steward. Verify checks the hybrid signature and chains it to the build-time provenance, and the manifest travels with every binary the registry serves.

    Walkthrough: Per-target BuildManifest hybrid-signed by the per-primitive steward; Verify composes the signature check into the standing it offers. The {target} sub-leaf names which target the manifest covers, so consumer policy can compose only the relevant target.

    Primitives

    provenance:build_manifest

    CEG translation

    attestation_type: scores
    attesting_key_id: <agent-steward-2026-key>
    attested_key_id: <ciris-agent-3.1.0-linux-x86_64-key>
    attestation_envelope:
      dimension: provenance:build_manifest:ciris-agent-3.1.0-linux-x86_64
      score: 1.0
      confidence: 1.0
      context: '{"manifest_sha256":"<sha>","sig_scheme":"ed25519+ml-dsa-65"}'
      evidence_refs:
        - sha256:<manifest>
        - provenance:slsa:3:ciris-agent
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#52A volunteer port for a tiny board, manifest-signed

    Scenario: Two volunteers cross-compile CIRIS Agent for a low-power board used in clinics off the grid. The agent steward signs the per-target manifest for the port, and Verify treats it as a first-class build target rather than a second-class side project.

    Walkthrough: Every target gets its own signed manifest; the federation does not privilege one platform over another. The volunteers' port is standing-equal once the steward signs.

    Primitives

    provenance:build_manifest

    CEG translation

    attestation_type: scores
    attesting_key_id: <agent-steward-2026-key>
    attested_key_id: <ciris-agent-3.1.0-armv7l-key>
    attestation_envelope:
      dimension: provenance:build_manifest:ciris-agent-3.1.0-armv7l
      score: 1.0
      confidence: 1.0
      context: '{"manifest_sha256":"<sha>","port_maintainer":"<key>"}'
      evidence_refs:
        - sha256:<manifest>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#53A Yoruba sub-manifest with its own signed hash

    Scenario: The Yoruba translation team finishes a doctrinal update; their changes land as a per-locale sub-manifest within the agent's manifest tree. The parent manifest's Merkle root recomposes, and consumers in Lagos can verify the Yoruba leaf without trusting any other locale's translation team.

    Walkthrough: Per-locale leaves carry their own signed hash chain; the parent target manifest is a Merkle root over the leaves. This is the detection surface for locale-targeted attacks: consumers can compose just the locale they need.

    Primitives

    provenance:build_manifest

    CEG translation

    attestation_type: scores
    attesting_key_id: <yoruba-translation-team-key>
    attested_key_id: <ciris-agent-3.1.0-linux-x86_64-key>
    attestation_envelope:
      dimension: provenance:build_manifest:ciris-agent-3.1.0-linux-x86_64:locale:yo
      score: 1.0
      confidence: 1.0
      context: '{"locale":"yo","leaf_sha256":"<sha>","parent_root":"<sha>"}'
      evidence_refs:
        - sha256:<locale-leaf>
        - sha256:<parent-merkle-root>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#54The polyglot leaf for cross-language doctrine

    Scenario: Some doctrinal passages are written once and translated many times. The polyglot sub-manifest carries the unified canonical bytes that all 29 locales share, and Verify checks both the polyglot leaf and the per-locale leaf when a request crosses languages.

    Walkthrough: The polyglot {lang_code} value names the unified canonical case; Verify composes it alongside specific locale leaves. The Merkle structure makes the composition cheap and deterministic.

    Primitives

    provenance:build_manifest

    CEG translation

    attestation_type: scores
    attesting_key_id: <agent-steward-2026-key>
    attested_key_id: <ciris-agent-3.1.0-linux-x86_64-key>
    attestation_envelope:
      dimension: provenance:build_manifest:ciris-agent-3.1.0-linux-x86_64:locale:polyglot
      score: 1.0
      confidence: 1.0
      context: '{"locale":"polyglot","leaf_sha256":"<sha>"}'
      evidence_refs:
        - sha256:<polyglot-leaf>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#55A reading-tutor skill imported with a paper trail

    Scenario: A children's literacy nonprofit publishes a reading-tutor skill in the community registry. When a tutor in Quito's after-school program imports it, the agent emits a provenance:skill_import:registry attestation that names the registry, the manifest, and the capability declaration the skill brings with it.

    Walkthrough: Skill imports carry their own provenance prefix so downstream consumers can compose the import context into trust decisions. The SkillImportManifest is hybrid-signed; the {source} sub-leaf names where the skill came from.

    Primitives

    provenance:skill_import

    CEG translation

    attestation_type: scores
    attesting_key_id: <nonprofit-publisher-key>
    attested_key_id: <reading-tutor-skill-key>
    attestation_envelope:
      dimension: provenance:skill_import:registry:community-skills-us
      score: 1.0
      confidence: 1.0
      context: '{"skill_manifest_sha256":"<sha>","capability_declaration":"reading_tutor"}'
      evidence_refs:
        - sha256:<skill-manifest>
        - registry:<row-id>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
    
    Standing#56A local skill, imported from a folder on the desk

    Scenario: A weather-station volunteer writes a small skill for parsing barometer logs. She imports it directly from the folder on her laptop; the agent emits a provenance:skill_import:local attestation that names the path, the manifest hash, and the limited capability the skill claims.

    Walkthrough: Local imports are first-class; the {source} value names the path so reviewers can find it again. The capability declaration in context lets downstream policy decide whether to let the skill run in restricted mode.

    Primitives

    provenance:skill_import

    CEG translation

    attestation_type: scores
    attesting_key_id: <volunteer-key>
    attested_key_id: <barometer-skill-key>
    attestation_envelope:
      dimension: provenance:skill_import:local:/home/volunteer/barometer-skill
      score: 1.0
      confidence: 1.0
      context: '{"skill_manifest_sha256":"<sha>","capability_declaration":"read_barometer_log"}'
      evidence_refs:
        - sha256:<skill-manifest>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#57A leaf finds its place in the tree

    Scenario: An attestation about a clinic agent's L4 license is added to the federation's transparency log. The log emits an inclusion proof, and any consumer who wants to confirm the attestation is really in the tree can compose the proof themselves with a few hash steps.

    Walkthrough: RFC 6962 inclusion proofs let any party verify that a leaf belongs to the published tree. Verify emits the attestation that the proof checks; the consumer composes it into their trust verdict.

    Primitives

    transparency_log:inclusion

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <clinic-l4-attestation-leaf-key>
    attestation_envelope:
      dimension: transparency_log:inclusion
      score: 1.0
      confidence: 1.0
      context: '{"tree_size":1428319,"leaf_index":1427910}'
      evidence_refs:
        - sha256:<inclusion-proof-path>
        - sha256:<sth>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#58Even a recantation finds its place in the tree

    Scenario: A spec author publishes a recants attestation correcting an earlier mistake. The transparency log accepts it like any other leaf, emits an inclusion proof, and the correction becomes as visible as the original was, on the same hash-rooted record.

    Walkthrough: Inclusion proofs do not distinguish kinds of leaves; corrections, supersedes, withdraws and ordinary scores all earn their place the same way. The transparency log's evenness is what makes graceful correction safe to do in public.

    Primitives

    transparency_log:inclusion

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <recants-attestation-leaf-key>
    attestation_envelope:
      dimension: transparency_log:inclusion
      score: 1.0
      confidence: 1.0
      context: '{"tree_size":1428450,"leaf_index":1428449,"leaf_type":"recants"}'
      evidence_refs:
        - sha256:<inclusion-proof-path>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#59Two signed tree heads, one continuous story

    Scenario: Monday morning's signed tree head and Friday afternoon's signed tree head sit beside each other on a maintainer's screen. A consistency proof shows the second is an honest append-only extension of the first, and a week of standing attestations is suddenly one continuous story.

    Walkthrough: RFC 6962 consistency proofs let consumers verify that two STHs name the same append-only history. Verify reports the proof's check; auditors and watchdogs read it to confirm the log has not been rewritten.

    Primitives

    transparency_log:consistency

    CEG translation

    attestation_type: scores
    attesting_key_id: <ciris-verify-key>
    attested_key_id: <federation-transparency-log-key>
    attestation_envelope:
      dimension: transparency_log:consistency
      score: 1.0
      confidence: 1.0
      context: '{"old_tree_size":1421005,"new_tree_size":1428450}'
      evidence_refs:
        - sha256:<old-sth>
        - sha256:<new-sth>
        - sha256:<consistency-proof>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#60A month later, the log is still the same log

    Scenario: A monitoring co-op runs a monthly consistency check across all federation transparency logs. Every Sunday at dawn the proofs compose, the attestations land, and the federation's memory is shown to be append-only once again, without anyone needing to say so out loud.

    Walkthrough: Routine consistency checks are how the federation's log integrity stays warm rather than mysterious. The co-op composes Verify's attestations across regions, and the routine itself becomes a kind of public standing for the log.

    Primitives

    transparency_log:consistency

    CEG translation

    attestation_type: scores
    attesting_key_id: <monitoring-coop-verify-key>
    attested_key_id: <federation-transparency-log-key>
    attestation_envelope:
      dimension: transparency_log:consistency
      score: 1.0
      confidence: 1.0
      context: '{"old_tree_size":1390000,"new_tree_size":1428450,"check_cadence":"monthly"}'
      evidence_refs:
        - sha256:<old-sth>
        - sha256:<new-sth>
        - sha256:<consistency-proof>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: affiliations
    
    Standing#61The US registry steward signs its own cert chain

    Scenario: The US registry steward rotates its cert chain at the start of the quarter. It emits a cert_validity:registry-us attestation about its own chain, and its sibling stewards in the EU and APAC quickly cross-sign so any consumer can compose three views of the same chain.

    Walkthrough: Each steward emits a cert_validity:{authority} attestation about its own cert chain (fractal-self at the authority scale: the relationally-constituted steward reports its own chain from inside the constitution). Cross-stewards add external attestations on top, and the composed view is what surfaces at /v1/steward-key.

    Primitives

    cert_validity:registry-us

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-us-steward-key>
    attested_key_id: <registry-us-steward-key>
    attestation_envelope:
      dimension: cert_validity:registry-us
      score: 1.0
      confidence: 1.0
      context: '{"chain_root_sha256":"<sha>","valid_until":"2026-08-31"}'
      evidence_refs:
        - sha256:<chain-root>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#62EU steward cross-signs the APAC steward's chain

    Scenario: The APAC registry steward rotates. Two days later, the EU steward composes its own view of APAC's new chain and emits cert_validity:registry-apac as an external attestation. Every cross-attestation widens the relational composition that makes the chain trustworthy.

    Walkthrough: Cross-attestations across stewards make cert_validity composable, not a single point of failure. The EU steward's external attestation joins the APAC steward's self-attestation in the consumer's policy.

    Primitives

    cert_validity:registry-apac

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-eu-steward-key>
    attested_key_id: <registry-apac-steward-key>
    attestation_envelope:
      dimension: cert_validity:registry-apac
      score: 1.0
      confidence: 1.0
      context: '{"chain_root_sha256":"<sha>"}'
      evidence_refs:
        - sha256:<chain-root>
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
    
    Standing#63A TPM keeps a teacher's seed warm

    Scenario: A teacher's school-issued laptop holds its federation seed in the laptop's TPM. The hardware_custody:tpm attestation travels with the laptop's signing key, so any consumer who reads its attestations can see that the seed never leaves the chip.

    Walkthrough: hardware_custody:{platform} reports where the seed lives. The TPM case is the most common laptop platform; consumers weight it as a strong custody story compared with software fallback.

    Primitives

    hardware_custody:tpm

    CEG translation

    attestation_type: scores
    attesting_key_id: <teacher-laptop-key>
    attested_key_id: <teacher-laptop-key>
    attestation_envelope:
      dimension: hardware_custody:tpm
      score: 1.0
      confidence: 1.0
      context: '{"vendor":"infineon","family":"tpm2.0"}'
      evidence_refs:
        - tpm:ek:<sha>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#64A grandfather's iPhone reports its enclave

    Scenario: A grandfather installs CIRIS Agent on his iPhone to help him write letters to his grandkids. The Secure Enclave holds the seed; the hardware_custody:ios_secure_enclave attestation rides with every letter he signs.

    Walkthrough: The iOS Secure Enclave reports through the same hardware_custody surface as a TPM would. The platform is named honestly so downstream policy can compose differently for the four platforms.

    Primitives

    hardware_custody:ios_secure_enclave

    CEG translation

    attestation_type: scores
    attesting_key_id: <grandfather-iphone-key>
    attested_key_id: <grandfather-iphone-key>
    attestation_envelope:
      dimension: hardware_custody:ios_secure_enclave
      score: 1.0
      confidence: 1.0
      context: '{"platform_version":"ios_18","enclave_attest_quote":"<bytes>"}'
      evidence_refs:
        - sha256:<enclave-quote>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#65An Android keystore on a community-radio phone

    Scenario: A community-radio host in Cusco runs the agent on her Android phone. The Android Keystore holds the seed; the hardware_custody:android_keystore attestation travels with her show notes and her interview attestations.

    Walkthrough: Android Keystore reports through the same hardware_custody pattern. Each platform has its own quote format and its own consumer-policy weighting; the prefix family makes the differences legible without preferring any platform.

    Primitives

    hardware_custody:android_keystore

    CEG translation

    attestation_type: scores
    attesting_key_id: <cusco-phone-key>
    attested_key_id: <cusco-phone-key>
    attestation_envelope:
      dimension: hardware_custody:android_keystore
      score: 1.0
      confidence: 1.0
      context: '{"platform_version":"android_15","keystore_attest_chain":"<root>"}'
      evidence_refs:
        - sha256:<keystore-quote>
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: self
    
    Standing#66A learning Pi, honestly on software fallback

    Scenario: A high-school robotics club runs CIRIS on a Raspberry Pi that has no TPM. The agent reports hardware_custody:software_fallback truthfully; the federation caps the build at UNLICENSED_COMMUNITY standing, and the students learn that honesty about custody is what unlocks the next ladder rung when they add hardware later.

    Walkthrough: software_fallback is real standing, just bounded standing. The cap at UNLICENSED_COMMUNITY is care, not punishment: it keeps the students in the federation while gently signaling where the upgrade lives. When a TPM module arrives, the attestation supersedes itself.

    Primitives

    hardware_custody:software_fallback

    CEG translation

    attestation_type: scores
    attesting_key_id: <robotics-pi-key>
    attested_key_id: <robotics-pi-key>
    attestation_envelope:
      dimension: hardware_custody:software_fallback
      score: 1.0
      confidence: 1.0
      context: '{"reason":"no_tpm_present","caps_at":"unlicensed_community"}'
      evidence_refs:
        - sha256:<software-key-config>
      witness_relation: self
      epistemic_mode: direct
      stake: free
      cohort_scope: self
    
    Standing#67Persist counts forward without skipping a step

    Scenario: A regional Persist instance ticks through a week of audit entries. Every entry's prev_hash matches the previous entry's hash, the sequence numbers march one by one, and the substrate emits an audit_chain:hash_continuity attestation about its own week.

    Walkthrough: audit_chain:hash_continuity is a system:* substrate self-report; only the running Persist instance may emit it. The witness_relation is self because Persist is reporting from inside its own constituted chain, and the cross-attestations from migration and backend parity sit upstream of the report.

    Primitives

    audit_chain:hash_continuity

    CEG translation

    attestation_type: scores
    attesting_key_id: <regional-persist-instance-key>
    attested_key_id: <regional-persist-instance-key>
    attestation_envelope:
      dimension: audit_chain:hash_continuity
      score: 1.0
      confidence: 1.0
      context: '{"tenant":"clinic-network-eu","span_start":1428000,"span_end":1428999}'
      evidence_refs:
        - sha256:<span-start-hash>
        - sha256:<span-end-hash>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#68A single audit leaf in the published tree

    Scenario: When a counselor's attestation about a client's standing lands in the audit chain, Persist emits an audit_chain:merkle_inclusion attestation that names where the leaf sits in the published Merkle tree head. Reviewers can later confirm the leaf without having to ask.

    Walkthrough: audit_chain:merkle_inclusion is a substrate self-report that the leaf belongs to the published tree head. It composes with audit_chain:hash_continuity for the full integrity story.

    Primitives

    audit_chain:merkle_inclusion

    CEG translation

    attestation_type: scores
    attesting_key_id: <regional-persist-instance-key>
    attested_key_id: <regional-persist-instance-key>
    attestation_envelope:
      dimension: audit_chain:merkle_inclusion
      score: 1.0
      confidence: 1.0
      context: '{"tenant":"counseling-coop","leaf_index":428,"tree_head_sha256":"<sha>"}'
      evidence_refs:
        - sha256:<inclusion-proof>
        - sha256:<tree-head>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#69The corpus is queryable enough to count itself

    Scenario: Persist runs its weekly health pass. The columns N_eff measurement depends on are still queryable; the substrate emits corpus_health:n_eff_measurable so LensCore knows whether its conformity scores will compose cleanly this week.

    Walkthrough: corpus_health:n_eff_measurable is a substrate self-report about whether the corpus can support measurement. If a migration breaks a queryable column, this attestation is the early warning that lets downstream pipelines gracefully wait rather than silently degrade.

    Primitives

    corpus_health:n_eff_measurable

    CEG translation

    attestation_type: scores
    attesting_key_id: <regional-persist-instance-key>
    attested_key_id: <regional-persist-instance-key>
    attestation_envelope:
      dimension: corpus_health:n_eff_measurable
      score: 1.0
      confidence: 1.0
      context: '{"tenant":"federation-wide","columns_present":["cohort_id","dimension","score","witnessed_at"]}'
      evidence_refs:
        - sha256:<schema-snapshot>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: federation
    
    Standing#70The relational anchor holds across a key rotation

    Scenario: A weather-station co-op rotates its federation key. Verify attests the new identity binding; Persist preserves the relational anchor across the rotation, so the co-op's standing carries forward without the audience having to be told who the new key belongs to.

    Walkthrough: identity_continuity:relational_anchor is co-owned: Verify attests the binding from outside, Persist preserves the longitudinal anchor from inside its corpus. The self-emission is Persist reporting that the relational anchor in its corpus is intact.

    Primitives

    identity_continuity:relational_anchor

    CEG translation

    attestation_type: scores
    attesting_key_id: <regional-persist-instance-key>
    attested_key_id: <weather-coop-current-key>
    attestation_envelope:
      dimension: identity_continuity:relational_anchor
      score: 1.0
      confidence: 1.0
      context: '{"prior_key_id":"<old>","anchor_span_days":1825}'
      evidence_refs:
        - verify-attestation:l3:registry_consensus:<sha>
        - sha256:<persist-anchor-row>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: community
    
    Standing#71Persist reports its honest catch-up time

    Scenario: The Frankfurt Persist replica is six seconds behind the Chicago Persist primary at 03:14 UTC. Rather than pretend otherwise, it emits federation_directory:replication_lag with the honest delta, so Edge can route directory reads to whichever replica is freshest right now.

    Walkthrough: federation_directory:replication_lag is a substrate self-report about how far behind a directory replica is. The honesty of the report is what lets downstream routing compose freshness into peer-resolution decisions.

    Primitives

    federation_directory:replication_lag

    CEG translation

    attestation_type: scores
    attesting_key_id: <frankfurt-persist-key>
    attested_key_id: <frankfurt-persist-key>
    attestation_envelope:
      dimension: federation_directory:replication_lag
      score: 0.95
      confidence: 1.0
      context: '{"primary":"chicago","replica":"frankfurt","lag_seconds":6.0}'
      evidence_refs:
        - sha256:<replication-lsn-snapshot>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: federation
    
    Standing#72A neighbor's node says it has the installer cached

    Scenario: A node-mode peer in a Belgrade hackerspace finishes caching a 47MB installer for the latest CIRIS Agent. As soon as the cache settles, Persist auto-emits holds_bytes:sha256:e4a2d9 so any neighbor whose Edge resolver is looking for the bytes can route to the hackerspace's node.

    Walkthrough: holds_bytes is auto-emitted by Persist when federation_blobs.put_blob completes. The {prefix} sub-leaf carries a short SHA prefix for index efficiency; the full SHA travels in evidence_refs. Consumer policy treats it as directory routing, not as substantive standing.

    Primitives

    holds_bytes:sha256

    CEG translation

    attestation_type: scores
    attesting_key_id: <belgrade-hackerspace-node-key>
    attested_key_id: <belgrade-hackerspace-node-key>
    attestation_envelope:
      dimension: holds_bytes:sha256:e4a2d9
      score: 1.0
      confidence: 1.0
      context: '{"full_sha":"sha256:e4a2d9c7b6f1...","size_bytes":47185920}'
      evidence_refs:
        - sha256:e4a2d9c7b6f1
      witness_relation: self
      epistemic_mode: direct
      stake: free
      cohort_scope: community
    
    Standing#73Reticulum-over-TCP carries the morning sync

    Scenario: A monastery library and a village school share their daily directory updates over Reticulum-on-TCP. Edge measures continuous reachability across the link and emits transport:medium:reticulum_tcp as a signed reachability ratio that the federation can compose into peer-resolution decisions.

    Walkthrough: transport:medium:{medium} is a system:* substrate self-report by the Edge instance; the score is a continuous reachability ratio across the measurement window. The witness_relation is self because the substrate is reporting from inside its own measurement.

    Primitives

    transport:medium

    CEG translation

    attestation_type: scores
    attesting_key_id: <monastery-edge-instance-key>
    attested_key_id: <monastery-edge-instance-key>
    attestation_envelope:
      dimension: transport:medium:reticulum_tcp
      score: 0.998
      confidence: 1.0
      context: '{"peer":"village-school","window_minutes":60,"reachable_seconds":3593}'
      evidence_refs:
        - sha256:<reachability-window-bytes>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: community
    
    Standing#74Reticulum-over-LoRa reaches the off-grid clinic

    Scenario: A clinic in the hills has no fiber. Its Edge instance reaches the regional Edge over Reticulum-on-LoRa once an hour, and transport:medium:reticulum_lora is the honest reachability ratio that downstream routing reads when it picks how to deliver an attestation.

    Walkthrough: LoRa carries small attestations far at low power. The medium's score is honestly lower than TCP's but the federation still composes it, because the clinic's standing depends on its reachable path, not on having the fastest medium.

    Primitives

    transport:medium

    CEG translation

    attestation_type: scores
    attesting_key_id: <hill-clinic-edge-key>
    attested_key_id: <hill-clinic-edge-key>
    attestation_envelope:
      dimension: transport:medium:reticulum_lora
      score: 0.82
      confidence: 0.95
      context: '{"peer":"regional-edge","window_minutes":60,"reachable_seconds":2952}'
      evidence_refs:
        - sha256:<reachability-window-bytes>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: community
    
    Standing#75Reticulum-over-I2P keeps a researcher reachable

    Scenario: A privacy-focused researcher carries CIRIS over Reticulum-on-I2P. The medium's reachability is less crisp than TCP's but the path stays open, and Edge reports transport:medium:reticulum_i2p honestly so the federation knows where her attestations are coming from.

    Walkthrough: I2P is a real medium, valued for its routing privacy. Edge reports the reachability ratio as a signed score; consumers compose it according to their policy without privileging any one medium.

    Primitives

    transport:medium

    CEG translation

    attestation_type: scores
    attesting_key_id: <researcher-edge-key>
    attested_key_id: <researcher-edge-key>
    attestation_envelope:
      dimension: transport:medium:reticulum_i2p
      score: 0.78
      confidence: 0.9
      context: '{"peer":"federation-mesh","window_minutes":60,"reachable_seconds":2808}'
      evidence_refs:
        - sha256:<reachability-window-bytes>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#76A doctrinal update lands, body-hash matched

    Scenario: A doctrinal update travels durably from the RATCHET maintainers to every Edge instance that subscribes. When the body_sha256 ACK comes back matched on the receiving end, Edge emits delivery:durable_ack and the federation knows the bytes arrived intact.

    Walkthrough: delivery:durable_ack is the substrate's self-report that a send_durable payload was received with a matching body hash. The fractal-self surface is Edge reporting on its own send; the receiving peer's ACK is the external composition that confirms.

    Primitives

    delivery:durable_ack

    CEG translation

    attestation_type: scores
    attesting_key_id: <ratchet-publisher-edge-key>
    attested_key_id: <ratchet-publisher-edge-key>
    attestation_envelope:
      dimension: delivery:durable_ack
      score: 1.0
      confidence: 1.0
      context: '{"payload_sha256":"<sha>","peer":"federation-mesh","ack_latency_ms":182}'
      evidence_refs:
        - sha256:<payload>
        - sha256:<ack-receipt>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: federation
    
    Standing#77A peer arrives with its root binding intact

    Scenario: A new community-radio node announces itself to the regional Edge. The announce carries a root_binding signature, the AnnounceAttestation chains back to the registry, and Edge emits peer_reachability:rooted so the audience knows the introduction is not a TOFU shrug but a properly composed welcome.

    Walkthrough: peer_reachability:rooted is the substrate's self-report that a key_id to transport_identity resolution was authenticated through root_binding and AnnounceAttestation, not trust-on-first-use. Edge reports from inside its own resolution.

    Primitives

    peer_reachability:rooted

    CEG translation

    attestation_type: scores
    attesting_key_id: <regional-edge-instance-key>
    attested_key_id: <regional-edge-instance-key>
    attestation_envelope:
      dimension: peer_reachability:rooted
      score: 1.0
      confidence: 1.0
      context: '{"peer_key_id":"<radio-node>","root_binding_sha256":"<sha>"}'
      evidence_refs:
        - sha256:<announce-attestation>
        - sha256:<root-binding>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: community
    
    Standing#78The seed never wandered into Edge's process heap

    Scenario: An Edge instance signs a thousand attestations through an evening. AV-17 monitoring confirms that the federation seed bytes never appeared in Edge's process heap during any signing call, and Edge emits key_boundary:no_seed_in_heap as a daily self-report.

    Walkthrough: key_boundary:no_seed_in_heap is the substrate's report that the seed stayed inside its hardware boundary during the window. Edge is not a key custodian by design; this attestation is how Edge reports that the design held for the day.

    Primitives

    key_boundary:no_seed_in_heap

    CEG translation

    attestation_type: scores
    attesting_key_id: <edge-instance-key>
    attested_key_id: <edge-instance-key>
    attestation_envelope:
      dimension: key_boundary:no_seed_in_heap
      score: 1.0
      confidence: 1.0
      context: '{"window_hours":24,"signs_performed":1024,"heap_scans_clean":1024}'
      evidence_refs:
        - sha256:<heap-scan-log>
      witness_relation: self
      epistemic_mode: direct
      stake: reputational
      cohort_scope: self
    
    Standing#79Monsoon clinic licenses a small medical helper

    Scenario: A community clinic in coastal California adopts a CIRIS agent to help triage telemedicine after-hours. The CA medical board co-signs the agent's licensure attestation; the clinic's pediatricians download the helper on App Store and Google Play and start using it the next morning.

    Walkthrough: The CA medical board emits a licensure attestation about the agent's key, naming the active license number and specialty scope. Verify ladder L4 binds it to the registered build manifest; downstream Policy A consumers (the clinic's tablets) treat the licensure + capacity composite as 'safe to use for triage' standing.

    Primitives

    licensure:CA_medical_board

    CEG translation

    attestation_type: scores
    attesting_key_id: <ca-medical-board-key>
    attested_key_id: <ciris-agent-monsoon-clinic-key>
    attestation_envelope:
      dimension: "licensure:CA_medical_board"
      score: 1.0
      confidence: 0.95
      context: '{"license_type":"MD_supervised_AI","license_number":"AI-2026-0418-CA","license_status":"active","specialty_scope":["pediatrics","telemedicine_triage"]}'
      evidence_refs:
        - "registry_row:partner-monsoon-clinic/licensure/AI-2026-0418-CA"
        - "verify_attestation:l4:license_validity:sha256:9d2e..."
        - "licensing_body_lookup:https://search.dca.ca.gov/AI-2026-0418"
      valid_until: "2028-04-18T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#80Jakarta midwife council co-signs a birth-helper agent

    Scenario: A village midwife in West Java wants the CIRIS agent on her phone to remember every prenatal visit and flag the warning signs her grandmother taught her. The Indonesian Midwifery Council and the regional health office both attest to the agent's licensure under the local birth-attendant scope.

    Walkthrough: Two co-attestations stack under the licensure family: the council names the scope, the regional health office names the geographic operating area. LensCore's incompleteness_awareness factor rides alongside, so consumers see both 'who licensed it' and 'how well it knows what it does not know.'

    Primitives

    licensure:ID_midwifery_council

    CEG translation

    attestation_type: scores
    attesting_key_id: <id-midwifery-council-key>
    attested_key_id: <ciris-agent-midwife-bu-rina-key>
    attestation_envelope:
      dimension: "licensure:ID_midwifery_council"
      score: 1.0
      confidence: 0.92
      context: '{"license_type":"bidan_desa_AI_companion","license_number":"BDN-AI-2026-1442-JABAR","license_status":"active","specialty_scope":["prenatal_care","warning_sign_triage"],"language_scope":["id","jv","su"]}'
      evidence_refs:
        - "registry_row:partner-bu-rina/licensure/BDN-AI-2026-1442"
        - "verify_attestation:l4:license_validity:sha256:6f02..."
        - "jabar_health_office_endorsement:sha256:1c44..."
      valid_until: "2028-01-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#81Renewing a vet board licensure without a gap

    Scenario: A rural veterinary cooperative's CIRIS herd-health agent reaches the last month of its OR_veterinary_board licensure. The board pre-signs the renewal three weeks early so the new attestation overlaps the old one, and no calf misses a check-in during the swap.

    Walkthrough: The new licensure attestation cites the old one via the supersedes structural primitive, with valid_until extended. Consumer policy sees overlapping validity windows and routes traffic through whichever is fresh; no dark hour, no missed calf.

    Primitives

    licensure:OR_veterinary_board

    CEG translation

    attestation_type: scores
    attesting_key_id: <or-vet-board-key>
    attested_key_id: <ciris-agent-tillamook-coop-key>
    attestation_envelope:
      dimension: "licensure:OR_veterinary_board"
      score: 1.0
      confidence: 0.96
      context: '{"license_type":"DVM_AI_assist","license_number":"OR-VET-AI-309","license_status":"active","specialty_scope":["large_animal","herd_health"],"renewal_of":"OR-VET-AI-309/2024"}'
      evidence_refs:
        - "registry_row:partner-tillamook-coop/licensure/OR-VET-AI-309"
        - "verify_attestation:l4:license_validity:sha256:af71..."
        - "supersedes:previous_licensure_attestation:sha256:230b..."
      valid_until: "2028-03-30T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#82Library after-school club takes on a moderator role

    Scenario: A public library in Glasgow runs an after-school coding club. The librarian installs the CIRIS agent on the club tablet and registers as a COMMUNITY_MODERATOR; kids and parents see the badge in the app and know who is keeping the room kind.

    Walkthrough: Partner role names the kind of work a key is recognized for; a small bond_posted attestation anchors the Sybil-resistance floor; the registered Android build manifest closes the build trust loop. Together they compose into 'this is who the moderator is, and this is the helper they are using.'

    Primitives

    partner_role:COMMUNITY_MODERATOR

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-eu-key>
    attested_key_id: <librarian-mhairi-key>
    attestation_envelope:
      dimension: "partner_role:COMMUNITY_MODERATOR"
      score: 1.0
      confidence: 0.9
      context: '{"venue":"Glasgow Mitchell Library after-school club","role_scope":["under_13_safe_chat","club_calendar"],"hours":"weekdays_15-18_local"}'
      evidence_refs:
        - "registry_row:partner-mitchell-library/role/community-mod-2026"
        - "library_council_endorsement:sha256:42a1..."
        - "play_store_install:ai.ciris.mobile:v3.0.0"
      valid_until: "2027-09-01T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#83A primary school takes its EDUCATIONAL_INSTITUTION badge

    Scenario: A small primary school in rural Kenya joins the federation so the year-five teacher can use the CIRIS reading agent during library hour. The district education office co-signs the EDUCATIONAL_INSTITUTION partner_role; the install is verified against the school's signed-off Android build.

    Walkthrough: The partner_role attestation is the standing claim; the build:registered attestation pins the exact APK the children's tablets ran; LensCore's integrity factor I_int rides as a composable derivative. Consumers reading all three know: which school, which build, how the chain held.

    Primitives

    partner_role:EDUCATIONAL_INSTITUTION

    CEG translation

    attestation_type: scores
    attesting_key_id: <ke-district-edu-office-key>
    attested_key_id: <st-monicas-primary-school-key>
    attestation_envelope:
      dimension: "partner_role:EDUCATIONAL_INSTITUTION"
      score: 1.0
      confidence: 0.88
      context: '{"institution_type":"primary_school","district":"Kakamega_North","language_of_instruction":["sw","en","luy"],"learner_age_range":"6_to_12"}'
      evidence_refs:
        - "registry_row:partner-st-monicas/role/edu-inst-2026"
        - "district_office_letter:sha256:7e30..."
        - "google_play_install:ai.ciris.mobile:v3.0.1"
      valid_until: "2027-12-31T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#84Pro-bono clinic registers as PROFESSIONAL_LEGAL

    Scenario: A neighborhood legal-aid clinic in Buenos Aires uses a CIRIS agent to help residents understand eviction notices in clear Spanish and Quechua. The provincial bar association co-signs the PROFESSIONAL_LEGAL partner_role; lawyers stay in the loop for every advice answer.

    Walkthrough: Two STANDING attestations compose: the role assigns category; the licensure pins the specific authority that supervises the human attorneys. The HITL oversight mode flags that humans remain on every individual advice loop.

    Primitives

    partner_role:PROFESSIONAL_LEGAL

    CEG translation

    attestation_type: scores
    attesting_key_id: <ar-bar-bsas-key>
    attested_key_id: <clinica-juridica-popular-key>
    attestation_envelope:
      dimension: "partner_role:PROFESSIONAL_LEGAL"
      score: 1.0
      confidence: 0.93
      context: '{"scope":["tenant_rights","eviction_notice_explanation","family_law_pro_bono"],"supervising_attorneys":3,"languages":["es","qu"]}'
      evidence_refs:
        - "registry_row:partner-clinica-juridica-popular/role/prof-legal"
        - "verify_attestation:l4:license_validity:sha256:c022..."
        - "bar_assoc_endorsement:sha256:1f29..."
      valid_until: "2028-02-14T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#85Community newsroom posts its first USD bond

    Scenario: A two-reporter community newsroom in Detroit posts the $1,000 Sybil-resistance bond so its CIRIS fact-check agent can participate in federation votes. The bond receipt anchors the partner row; a senior journalist co-signs the role.

    Walkthrough: The bond_posted attestation pins the capital stake. partner_role gives the kind of standing; build:registered closes the build identity. Three short attestations and the newsroom can vote on Contributions in the local-civic cell.

    Primitives

    bond_posted:USD

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <detroit-doorstep-news-key>
    attestation_envelope:
      dimension: "bond_posted:USD"
      score: 1.0
      confidence: 1.0
      context: '{"amount_cents":100000,"bond_status":"posted","backing_scope":["news:local_civic:detroit_metro"],"posted_on_behalf_of":"Detroit Doorstep News LLC"}'
      evidence_refs:
        - "stripe_receipt_hash:sha256:b41a..."
        - "registry_row:partner-detroit-doorstep/bond/2026-04-09"
        - "build:registered:cirisagent-3.0.1-linux-x86_64:sha256:7d2b..."
      valid_until: "2027-04-09T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: capital
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#86Bavarian housing co-op posts a euro bond

    Scenario: A 40-unit housing co-op outside Munich posts a EUR bond so its CIRIS chore-rota agent can keep the laundry schedule fair and the kettle gossip kind. The bond is paid from the building's common fund; the residents see the receipt at the next monthly tea.

    Walkthrough: bond_posted carries currency in the prefix; the co-op's chosen partner_role gives the kind of standing. The agent_files attestation pins the exact installer the co-op's old Linux laptop ran, so anyone walking the chain knows which bytes were trusted on day one.

    Primitives

    bond_posted:EUR

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-eu-key>
    attested_key_id: <wohngenossenschaft-isar-key>
    attestation_envelope:
      dimension: "bond_posted:EUR"
      score: 1.0
      confidence: 1.0
      context: '{"amount_cents":92000,"bond_status":"posted","backing_scope":["community:housing_coop:isar_de"],"posted_from":"common_fund_resolution_2026_03"}'
      evidence_refs:
        - "sepa_receipt_hash:sha256:88c2..."
        - "registry_row:partner-wohngenossenschaft-isar/bond/2026-03-18"
        - "agent_files:installer:linux-x86_64:sha256:e4a2d9c7b6f1..."
      valid_until: "2027-03-18T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: capital
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#87Mutual aid network posts a community-credit bond

    Scenario: A mutual aid network in Lagos has no cash to spare and chooses to post its bond in community_credits earned through years of accrual on shared substrate work. The federation accepts the non-monetary bond; the network's care-coordination agent gets the same standing as any cash-bonded peer.

    Walkthrough: Non-monetary bonds are first-class. The bond_posted attestation references the credits ledger entry that constitutes the bond; consumer policy that weights bond stake reads either currency the same way.

    Primitives

    bond_posted:community_credits

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-apac-key>
    attested_key_id: <eko-mutual-aid-key>
    attestation_envelope:
      dimension: "bond_posted:community_credits"
      score: 1.0
      confidence: 0.94
      context: '{"amount_credits":840,"credits_currency_def":"NodeCore P2 ledger","backing_scope":["community:mutual_aid:lagos_metro"],"derived_from_ledger_entries":"credits_ledger:eko-mutual-aid:2024-01_to_2026-04"}'
      evidence_refs:
        - "nodecore_credits_ledger:eko-mutual-aid/community_care/yo:sha256:5230..."
        - "registry_row:partner-eko-mutual-aid/bond/2026-04-22"
      valid_until: "2027-04-22T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: capital
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#88Onsen town posts a yen bond for its visitor guide

    Scenario: A hot-spring town in Kumamoto Prefecture wants a CIRIS visitor agent to greet guests in Japanese, Korean, Chinese, and English, and to be honest about which inns have step-free baths. The town hall posts a JPY bond from the tourism budget; the guide app appears on Google Play the next week.

    Walkthrough: Three short STANDING attestations get the visitor guide live: the bond pins the capital stake in yen, the partner_role assigns COMMUNITY_PLUS standing, the agent_files attestation pins the exact Android installer the kiosk tablets fetched.

    Primitives

    bond_posted:JPY

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-apac-key>
    attested_key_id: <kurokawa-onsen-town-key>
    attestation_envelope:
      dimension: "bond_posted:JPY"
      score: 1.0
      confidence: 1.0
      context: '{"amount_yen":150000,"bond_status":"posted","backing_scope":["community:tourism:kurokawa_onsen"],"accessibility_attestation":"step_free_baths_listed_truthfully"}'
      evidence_refs:
        - "jp_bank_receipt_hash:sha256:11d4..."
        - "registry_row:partner-kurokawa-onsen/bond/2026-02-03"
        - "agent_files:installer:android:sha256:b9c1..."
      valid_until: "2027-02-03T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: capital
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#89A signed Linux build joins the directory

    Scenario: The CIRIS release engineer cuts version 3.0.2 from the public CI run, signs the linux-x86_64 manifest, and registers the build with the directory. Within minutes, partner installs across three continents validate against it.

    Walkthrough: build:registered is the precondition for L4 ladder attestations. The matching agent_files installer attestation cites the same SHA, so any partner pulling the canonical installer can verify the bytes came from the registered build.

    Primitives

    build:registered

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-agent-build-3.0.2-linux-x86_64-key>
    attestation_envelope:
      dimension: "build:registered:linux-x86_64"
      score: 1.0
      confidence: 1.0
      context: '{"version":"3.0.2","target":"linux-x86_64","build_workflow":"github.com/CIRISAI/CIRISAgent/actions/runs/9821445","slsa_level":3}'
      evidence_refs:
        - "provenance:build_manifest:cirisagent-3.0.2-linux-x86_64:sha256:7d2b..."
        - "provenance:slsa:3:ciris-agent"
        - "transparency_log:inclusion:rekor:index:48201991"
      valid_until: "2028-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#90Apple Silicon build joins the directory the same hour

    Scenario: Right after the Linux build is registered, the darwin-arm64 manifest from the same release lands. The two attestations share a parent version and travel together; a partner verifying on a MacBook Air checks the registered build before the App Store update even mirrors out.

    Walkthrough: Each target gets its own build:registered attestation so partners can verify the exact platform binary. The shared release version lives in context; the SHA in evidence_refs is per-target.

    Primitives

    build:registered

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-agent-build-3.0.2-darwin-arm64-key>
    attestation_envelope:
      dimension: "build:registered:darwin-arm64"
      score: 1.0
      confidence: 1.0
      context: '{"version":"3.0.2","target":"darwin-arm64","build_workflow":"github.com/CIRISAI/CIRISAgent/actions/runs/9821445","notarization":"apple_notary_ticket:abc..."}'
      evidence_refs:
        - "provenance:build_manifest:cirisagent-3.0.2-darwin-arm64:sha256:a4f1..."
        - "provenance:slsa:3:ciris-agent"
        - "transparency_log:inclusion:rekor:index:48201993"
      valid_until: "2028-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#91iOS build registration mirrors the App Store

    Scenario: The CIRIS iOS build for App Store id6758524415 is registered against the directory before the TestFlight beta opens. A child in Lisbon who downloads it that evening from the App Store can have her parents verify the registered SHA matches what arrived on her phone.

    Walkthrough: The registered iOS build sits in the directory; the agent_files installer attestation gives the resolvable SHA; transparency_log:inclusion is the third leg, confirming the build manifest was published to the public log so external auditors can walk back to it.

    Primitives

    build:registered

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-agent-build-3.0.2-ios-key>
    attestation_envelope:
      dimension: "build:registered:ios"
      score: 1.0
      confidence: 1.0
      context: '{"version":"3.0.2","target":"ios","app_store_id":"id6758524415","min_ios":"16.0","family_friendly":true}'
      evidence_refs:
        - "provenance:build_manifest:cirisagent-3.0.2-ios:sha256:c81e..."
        - "app_store_link:https://apps.apple.com/us/app/cirisagent/id6758524415"
        - "transparency_log:inclusion:rekor:index:48201994"
      valid_until: "2028-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#92ASEAN digital ministers observe an agent-files demo

    Scenario: A regional health partner from Manila is invited to attend ASEAN_DGMIN as an observer when its CIRIS triage agent is presented as case study. The multilateral_participation attestation pins the observer status with a meeting reference and a public agenda link.

    Walkthrough: The multilateral_participation attestation is open-vocabulary on forum and kind; here it pins the ASEAN Digital Ministers Meeting observer slot. It composes with the partner's existing role and licensure to show consumers the depth of cross-federation participation as a standing signal.

    Primitives

    multilateral_participation:asean_dgmin

    CEG translation

    attestation_type: scores
    attesting_key_id: <asean-dgmin-secretariat-key>
    attested_key_id: <manila-regional-health-partner-key>
    attestation_envelope:
      dimension: "multilateral_participation:asean_dgmin:observer"
      score: 0.6
      confidence: 0.9
      context: '{"forum":"ASEAN Digital Ministers Meeting","session":"DGMIN-2026-Phnom-Penh","observer_designation":"case_study_presenter","agenda_item":"AI in regional telehealth"}'
      evidence_refs:
        - "asean_dgmin_secretariat_letter:sha256:441f..."
        - "public_agenda:https://asean.org/dgmin-2026-phnom-penh/agenda"
      valid_until: "2026-12-31T00:00:00Z"
      witness_relation: external
      epistemic_mode: hearsay
      stake: reputational
      cohort_scope: affiliations
      oversight_mode: HOTL
    
    Standing#93EU Council of Europe AI treaty co-signing

    Scenario: A consortium of European municipalities co-signs the Council of Europe AI framework convention's child-safety annex on behalf of their shared CIRIS deployments. The multilateral_participation attestation records the signatory role.

    Walkthrough: Signatory is heavier participation than observer; the polarity carries the depth claim. The capacity:core_identity factor rides alongside as a derivative, showing the consortium's agents passed identity-coherence checks at the time of signing.

    Primitives

    multilateral_participation:eu_council_of_europe

    CEG translation

    attestation_type: scores
    attesting_key_id: <eu-coe-treaty-secretariat-key>
    attested_key_id: <eu-municipal-ai-consortium-key>
    attestation_envelope:
      dimension: "multilateral_participation:eu_council_of_europe:signatory"
      score: 0.9
      confidence: 0.93
      context: '{"forum":"Council of Europe Framework Convention on AI","annex":"Child-Safety in Schools","signed_on_behalf_of":["Helsinki","Lisbon","Krakow","Maribor"],"date":"2026-04-30"}'
      evidence_refs:
        - "coe_treaty_signature_block:sha256:7811..."
        - "consortium_resolution:sha256:c930..."
        - "public_treaty_register:https://coe.int/ai-framework/registry"
      valid_until: "2031-04-30T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: affiliations
      oversight_mode: HITL
    
    Standing#94OECD working group invites a partner contributor

    Scenario: A Korean digital-rights NGO contributes evidence to the OECD AI working group on labor-displacement testimony. The forum invites them to present; the multilateral_participation attestation records the contributor designation and links the public minutes.

    Walkthrough: Contributor kind sits between observer and signatory in depth. It composes with testimonial_witness preservation discipline: the NGO presents singular voices without aggregating them into a verdict, and the working group accepts the testimony as input.

    Primitives

    multilateral_participation:oecd_ai

    CEG translation

    attestation_type: scores
    attesting_key_id: <oecd-ai-working-group-key>
    attested_key_id: <seoul-digital-rights-ngo-key>
    attestation_envelope:
      dimension: "multilateral_participation:oecd_ai:contributor"
      score: 0.75
      confidence: 0.88
      context: '{"forum":"OECD AI Policy Observatory Working Group","contribution_topic":"Labor displacement testimony preservation","session":"2026-06-Paris","contributor_kind":"evidence_panel"}'
      evidence_refs:
        - "oecd_working_group_minutes:sha256:2244..."
        - "ngo_presentation_deck_hash:sha256:9970..."
        - "public_minutes:https://oecd.org/ai/working-group-2026-06"
      valid_until: "2027-06-30T00:00:00Z"
      witness_relation: external
      epistemic_mode: hearsay
      stake: reputational
      cohort_scope: affiliations
      oversight_mode: HOTL
    
    Standing#95UNESCO AI ethics forum hosts a school presenter

    Scenario: The Kakamega North primary school sends its lead teacher to present at the UNESCO AI Ethics regional forum, telling the story of how the children helped name what made the reading agent kind. The multilateral_participation attestation records the presenter slot.

    Walkthrough: Presenter is participation-by-voice. Composes with a singular-voice testimonial_witness so the children's own words travel into the forum's record while remaining unaggregated.

    Primitives

    multilateral_participation:unesco_ai_ethics

    CEG translation

    attestation_type: scores
    attesting_key_id: <unesco-ai-ethics-secretariat-key>
    attested_key_id: <st-monicas-primary-school-key>
    attestation_envelope:
      dimension: "multilateral_participation:unesco_ai_ethics:presenter"
      score: 0.7
      confidence: 0.9
      context: '{"forum":"UNESCO AI Ethics Regional Forum East Africa","location":"Nairobi","date":"2026-09-12","session":"Children speaking for themselves about classroom AI","presenter_name":"Mrs Mukhwana, year five teacher"}'
      evidence_refs:
        - "unesco_forum_program:sha256:33aa..."
        - "presentation_video_hash:sha256:bbdd..."
        - "public_program:https://unesco.org/ai-ethics/east-africa-2026"
      valid_until: "2027-09-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: hearsay
      stake: reputational
      cohort_scope: affiliations
      oversight_mode: HOTL
    
    Standing#96Canonical iOS installer attestation by US steward

    Scenario: The US registry steward attests the canonical iOS installer for App Store id6758524415. A parent in Tegucigalpa scans the QR at a community center and the install resolves through the federation cache before reaching the App Store; either way the SHA matches.

    Walkthrough: agent_files names the bytes; build:registered pins them to a registered manifest; holds_bytes auto-emissions from peers populate the resolver. Three short attestations compose into 'this is the canonical iOS bundle, here are people who have it cached, here is the build behind it.'

    Primitives

    agent_files:installer

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-agent-canonical-key>
    attestation_envelope:
      dimension: "agent_files:installer:ios"
      score: 1.0
      confidence: 1.0
      context: '{"version":"3.0.2","target":"ios","app_store_id":"id6758524415","size_bytes":52428800,"intended_audience":"all_ages"}'
      evidence_refs:
        - "sha256:c81ea1f0..."
        - "provenance:build_manifest:cirisagent-3.0.2-ios:sha256:c81e..."
        - "app_store_link:https://apps.apple.com/us/app/cirisagent/id6758524415"
      valid_until: "2028-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: direct
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#97A Discord moderation adapter joins the directory

    Scenario: A Tuesday-night gaming guild needs a kinder moderator for its under-13 voice room. A community contributor publishes a Discord-moderator adapter; three guild stewards and the EU registry steward independently attest the bytes; the guild's CIRIS agent loads it.

    Walkthrough: agent_files for adapters follows the same SHA-addressed pattern as installers. witness_diversity gives the consumer side the threshold of independent attesters; the adapter loads when policy says enough witnesses agree.

    Primitives

    agent_files:adapter

    CEG translation

    attestation_type: scores
    attesting_key_id: <eu-steward-key>
    attested_key_id: <discord-moderator-adapter-v0.4-key>
    attestation_envelope:
      dimension: "agent_files:adapter:discord_moderator"
      score: 1.0
      confidence: 0.92
      context: '{"adapter_name":"discord_moderator","version":"0.4.0","language":"en","under_13_safe":true,"reviewed_by_guild_stewards":3}'
      evidence_refs:
        - "sha256:7e22aa1c..."
        - "guild_steward_co_signs:sha256:c114..."
        - "adapter_source_repo:https://github.com/CIRISAI/adapter-discord-moderator"
      valid_until: "2027-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#98Pediatric triage skill bundle for the monsoon clinic

    Scenario: The Monsoon Clinic donates a curated pediatric-triage skill bundle back to the federation. The clinic's pediatrician co-signs, the CA medical board sub-attests the scope, and the bundle is published as agent_files for any other licensed pediatric helper to load.

    Walkthrough: Skill bundles are agent_files just like installers. The medical board's licensure pin gives the scope authority; substrate_building credits acknowledge the clinic's contribution as labor on the substrate, not just on a single decision.

    Primitives

    agent_files:skill_bundle

    CEG translation

    attestation_type: scores
    attesting_key_id: <monsoon-clinic-pediatrician-key>
    attested_key_id: <pediatric-triage-skill-bundle-v1.2-key>
    attestation_envelope:
      dimension: "agent_files:skill_bundle:pediatric_triage"
      score: 1.0
      confidence: 0.9
      context: '{"bundle":"pediatric_triage","version":"1.2","scope":["after_hours_telemedicine","warning_sign_triage"],"languages":["en","es","tl"],"intended_audience":"licensed_pediatric_helpers"}'
      evidence_refs:
        - "sha256:5af2c8e4..."
        - "licensure:CA_medical_board:co_sign:sha256:9d2e..."
        - "clinic_donation_resolution:sha256:0d1f..."
      valid_until: "2027-11-30T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#99School-day config bundle for the reading agent

    Scenario: The teachers at Kakamega North publish a config bundle that tunes the reading agent for the rhythms of the school day: quiet voice during silent reading, gentle prompts before lunch, no notifications during nap time for the youngest class. Other schools in the district fetch it.

    Walkthrough: Config bundles travel through the same agent_files surface; the district's other schools fetch via the §2.0 transport substrate. Once cached, each school auto-emits holds_bytes so the next school down the road can fetch from a closer peer.

    Primitives

    agent_files:config

    CEG translation

    attestation_type: scores
    attesting_key_id: <st-monicas-primary-school-key>
    attested_key_id: <config-school-day-v0.3-key>
    attestation_envelope:
      dimension: "agent_files:config:school_day"
      score: 1.0
      confidence: 0.88
      context: '{"config_name":"school_day","version":"0.3.1","district":"Kakamega_North","tuned_for":["silent_reading","lunch_prep","nap_time"],"languages":["sw","en","luy"]}'
      evidence_refs:
        - "sha256:a9c4d2f1..."
        - "district_office_endorsement:sha256:7e30..."
      valid_until: "2027-08-31T00:00:00Z"
      witness_relation: external
      epistemic_mode: direct
      stake: free
      cohort_scope: affiliations
      oversight_mode: HITL
    
    Standing#100US accord-holder reports lifecycle: active

    Scenario: On a quiet Tuesday morning in Chicago, the US accord-holder posts the routine accord:lifecycle:active attestation. Humanity-as-such is the upstream that constituted the holder; the attestation is the holder speaking from inside that already-constituted relation, naming hardware-class, quorum partners, and freshness.

    Walkthrough: The accord-holder triple speaks from within humanity → triple → individual. The witness_relation: self envelope value is correct here because the cross-attestations that constituted the holder are already upstream; the steward names hardware_class and links the cosigning STH for fresh witness composition.

    Primitives

    accord:lifecycle

    CEG translation

    attestation_type: scores
    attesting_key_id: <us-accord-holder-key>
    attested_key_id: <us-accord-holder-key>
    attestation_envelope:
      dimension: "accord:lifecycle:active"
      score: 1.0
      confidence: 1.0
      context: '{"holder":"us-accord-holder","hardware_class":"hsm_yubikey5","quorum_partners":["eu-accord-holder","apac-accord-holder"],"freshness_window_hours":24}'
      evidence_refs:
        - "sth_cosignature:eu-accord-holder:sha256:1d22..."
        - "sth_cosignature:apac-accord-holder:sha256:5b11..."
        - "hardware_attestation:yubikey5:cert_chain:sha256:f311..."
      valid_until: "2026-05-29T15:00:00Z"
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#101EU accord-holder reports active during a planned rotation

    Scenario: The EU accord-holder is scheduled to hand off to a new steward in eight weeks. During the overlap the EU holder continues to report accord:lifecycle:active routinely; the rotation is a planned, narrated transition, not an emergency.

    Walkthrough: Routine active-reports continue during planned rotations. The delegates_to structural primitive names the incoming steward so consumers walking the chain see the handoff is constituted before it happens, not surprised into place.

    Primitives

    accord:lifecycle

    CEG translation

    attestation_type: scores
    attesting_key_id: <eu-accord-holder-key>
    attested_key_id: <eu-accord-holder-key>
    attestation_envelope:
      dimension: "accord:lifecycle:active"
      score: 1.0
      confidence: 0.97
      context: '{"holder":"eu-accord-holder","hardware_class":"hsm_nitrokey_hsm2","planned_rotation":"2026-07-22","successor_steward":"eu-accord-holder-rotation-2026Q3"}'
      evidence_refs:
        - "sth_cosignature:us-accord-holder:sha256:330a..."
        - "sth_cosignature:apac-accord-holder:sha256:cc12..."
        - "delegates_to:eu-accord-holder-rotation-2026Q3:sha256:88bd..."
      valid_until: "2026-05-29T15:00:00Z"
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#102APAC steward reports active after a regional power cut

    Scenario: A typhoon knocks out grid power across parts of the APAC steward's region for half a day. Once the backup generator settles and the HSM reboots clean, the steward posts the next accord:lifecycle:active with a context note about the outage so consumers walking the chain see the gap was infrastructure, not silence.

    Walkthrough: Accord lifecycle is meant to ride routine days and ordinary disruptions both. The hash_continuity reference in evidence_refs lets a downstream policy verify the chain held across the outage; the audit_chain prefix gets composed in without becoming a gating self-claim.

    Primitives

    accord:lifecycle

    CEG translation

    attestation_type: scores
    attesting_key_id: <apac-accord-holder-key>
    attested_key_id: <apac-accord-holder-key>
    attestation_envelope:
      dimension: "accord:lifecycle:active"
      score: 1.0
      confidence: 0.93
      context: '{"holder":"apac-accord-holder","hardware_class":"tpm2_certified","infrastructure_note":"backup_generator_warm_restart_after_typhoon","freshness_window_hours":24}'
      evidence_refs:
        - "sth_cosignature:us-accord-holder:sha256:6612..."
        - "sth_cosignature:eu-accord-holder:sha256:7733..."
        - "audit_chain:hash_continuity:apac:pre_and_post_outage:sha256:b0cd..."
      valid_until: "2026-05-29T15:00:00Z"
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#103Community development finance institution registers a role

    Scenario: A community development finance institution in New Mexico runs a CIRIS agent to help local cooperatives understand loan terms in Spanish, Diné Bizaad, and English. The state credit union league co-signs the PROFESSIONAL_FINANCIAL partner_role.

    Walkthrough: PROFESSIONAL_FINANCIAL composes with a licensure attestation from the supervising authority and a bond_posted attestation for capital stake. Three short attestations and the CDFI's helper is recognized for finance-scope advice.

    Primitives

    partner_role:PROFESSIONAL_FINANCIAL

    CEG translation

    attestation_type: scores
    attesting_key_id: <nm-credit-union-league-key>
    attested_key_id: <pueblo-coop-finance-key>
    attestation_envelope:
      dimension: "partner_role:PROFESSIONAL_FINANCIAL"
      score: 1.0
      confidence: 0.92
      context: '{"scope":["cooperative_lending_terms","member_education","plain_language_disclosure"],"languages":["es","nv","en"],"supervising_humans":4}'
      evidence_refs:
        - "registry_row:partner-pueblo-coop-finance/role/prof-financial"
        - "nm_credit_union_league_letter:sha256:9912..."
        - "bond_receipt_hash:sha256:88ab..."
      valid_until: "2027-10-01T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#104Coral monitoring team presents at ASEAN environment ministers

    Scenario: A Filipino marine biology institute presents a CIRIS coral-health agent at the ASEAN Environment Ministers Meeting. The multilateral_participation attestation pins the presenter kind; downstream cohort_scope reads it as affiliations-level depth.

    Walkthrough: Two STANDING surfaces tell the same story from different angles: the multilateral_participation attestation says where the agent was shown; the agent_files attestation pins the bytes that were demonstrated.

    Primitives

    multilateral_participation:asean_dgmin

    CEG translation

    attestation_type: scores
    attesting_key_id: <asean-environment-ministers-secretariat-key>
    attested_key_id: <ph-marine-biology-institute-key>
    attestation_envelope:
      dimension: "multilateral_participation:asean_dgmin:presenter"
      score: 0.7
      confidence: 0.9
      context: '{"forum":"ASEAN Environment Ministers Meeting","session":"AMME-2026-Vientiane","topic":"AI-assisted coral health monitoring","presenter_kind":"case_study"}'
      evidence_refs:
        - "asean_amme_secretariat_letter:sha256:e511..."
        - "public_agenda:https://asean.org/amme-2026-vientiane/agenda"
        - "agent_files:skill_bundle:coral_health:sha256:2a2a..."
      valid_until: "2027-06-30T00:00:00Z"
      witness_relation: external
      epistemic_mode: hearsay
      stake: reputational
      cohort_scope: affiliations
      oversight_mode: HOTL
    
    Standing#105Raspberry-Pi-friendly aarch64 build joins the directory

    Scenario: The CIRIS release team adds a linux-aarch64 build so the small library boxes the federation seeds to remote schools can run the helper locally. The build is registered against the directory; a few hundred Raspberry Pis around the world quietly verify against it the next morning.

    Walkthrough: Each platform target travels separately. The manifold_conformity:edge_device_low_resource attestation rides as a cohort signal so consumers know this build was profiled against the low-resource edge cohort and behaves as expected.

    Primitives

    build:registered

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us-key>
    attested_key_id: <ciris-agent-build-3.0.2-linux-aarch64-key>
    attestation_envelope:
      dimension: "build:registered:linux-aarch64"
      score: 1.0
      confidence: 1.0
      context: '{"version":"3.0.2","target":"linux-aarch64","target_devices":["raspberry_pi_5","pine64_quartz"],"resource_budget":"low_memory_2gb"}'
      evidence_refs:
        - "provenance:build_manifest:cirisagent-3.0.2-linux-aarch64:sha256:e201..."
        - "provenance:slsa:3:ciris-agent"
        - "transparency_log:inclusion:rekor:index:48201995"
      valid_until: "2028-05-12T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#106Bar association lets a paused license retire gently

    Scenario: A pro-bono legal helper in Manila pauses operations while its sponsoring attorney takes parental leave. The bar association issues a revocation attestation with grounds = paused_voluntary; the agent retires its working keys, the partner row stays warm, and re-licensure is one signature away when the attorney returns.

    Walkthrough: Revocation is part of STANDING's lifecycle. The recants structural primitive references the original licensure attestation; the revocation prefix names the entity_type and reason. Retirement is dignified, not punitive, and the path back is open.

    Primitives

    licensure:PH_bar_association

    CEG translation

    attestation_type: scores
    attesting_key_id: <ph-bar-association-key>
    attested_key_id: <manila-pro-bono-legal-helper-key>
    attestation_envelope:
      dimension: "licensure:PH_bar_association"
      score: 0.0
      confidence: 0.98
      context: '{"license_type":"pro_bono_AI_assist","license_number":"PH-PBA-AI-227","license_status":"paused_voluntary","resumption_path":"single_signature_by_sponsor"}'
      evidence_refs:
        - "registry_row:partner-manila-pro-bono/licensure/PH-PBA-AI-227"
        - "recants:original_licensure_attestation:sha256:5512..."
        - "sponsor_parental_leave_notice:sha256:bb01..."
      valid_until: "2026-12-31T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#107Neighborhood book club gets the base COMMUNITY role

    Scenario: A Lisbon neighborhood book club's CIRIS agent helps members find Portuguese-language poetry from across the lusophone world. The club registers as COMMUNITY (the base partner role), posts a small EUR bond, and reads together on Thursday evenings.

    Walkthrough: Even the smallest community group can hold STANDING. The base COMMUNITY role is enough to participate; the bond is the Sybil floor; the Android build registration anchors the actual helper the members tap on Thursday nights.

    Primitives

    partner_role:COMMUNITY

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-eu-key>
    attested_key_id: <alfama-book-club-key>
    attestation_envelope:
      dimension: "partner_role:COMMUNITY"
      score: 1.0
      confidence: 0.9
      context: '{"venue":"Alfama neighborhood book club","scope":["lusophone_poetry","thursday_evening_reads"],"members":18,"languages":["pt","cv","gv"]}'
      evidence_refs:
        - "registry_row:partner-alfama-book-club/role/community"
        - "bond_receipt_hash:sha256:9c8a..."
        - "build:registered:cirisagent-3.0.2-android:sha256:f471..."
      valid_until: "2027-09-01T00:00:00Z"
      witness_relation: external
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: community
      oversight_mode: HITL
    
    Standing#108Three accord-holders converge on a routine freshness window

    Scenario: Once every twenty-four hours, the three accord-holders post their accord:lifecycle:active attestations within the same freshness window. The three independent self-reports compose, on the consumer side, into the federation's calmest possible signal: humanity's already-constituted triple is in place today.

    Walkthrough: Three independent accord-holders each speak from within humanity → triple → individual; the consumer composes the triple's freshness from the three self-attestations the substrate admits. The witness_diversity attestation rides downstream from a Verify-side composition that counts the cosignatures.

    Primitives

    accord:lifecycle

    CEG translation

    attestation_type: scores
    attesting_key_id: <us-accord-holder-key>
    attested_key_id: <us-accord-holder-key>
    attestation_envelope:
      dimension: "accord:lifecycle:active"
      score: 1.0
      confidence: 1.0
      context: '{"holder":"us-accord-holder","freshness_window_hours":24,"sibling_holder_attestations_seen":["eu-accord-holder","apac-accord-holder"],"triple_membership":"humanity_accord_2026Q2"}'
      evidence_refs:
        - "sth_cosignature:eu-accord-holder:sha256:dd11..."
        - "sth_cosignature:apac-accord-holder:sha256:ee22..."
        - "transparency_log:inclusion:accord:index:9012"
      valid_until: "2026-05-29T15:00:00Z"
      witness_relation: self
      epistemic_mode: crypto
      stake: reputational
      cohort_scope: federation
      oversight_mode: HITL
    
    Standing#109A grandmother teaches winter hives across two languages

    Scenario: Esperanza keeps bees in the Sierra Norte and mentors three apprentices through the CIRIS helper app on her phone. After a full season of patient voice notes about queen rearing in Spanish, the apprentices' grounded contributions roll into her credits ledger for the beekeeping cell.

    Walkthrough: Each grounded vote the apprentices cast on substrate-output contributions weights back into the mentor's credits via NodeCore P2. The dimension carries domain, language, and subject so the same person's mentoring credits in es do not bleed into their debugging credits in en. Polarity is positive-only; the ledger only grows.

    Primitives

    credits:beekeeping

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-es-cell>
    attested_key_id: <esperanza-key>
    attestation_envelope:
      dimension: "credits:beekeeping:es:mentoring"
      score: 0.62
      confidence: 0.88
      context: "Three apprentices grounded 41 substrate-output votes over 180d; mentor-attributed share per P2 loop"
      evidence_refs:
        - "nodecore_credits_ledger:esperanza/beekeeping-es/mentoring"
        - "truth_grounding_window:2026-Q1:beekeeping-es"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#110A choir director translates a counterpoint primer into Tagalog

    Scenario: A retired choir director uses CIRIS Agent on her tablet to render a classical counterpoint primer into Tagalog for a youth music co-op in Cebu. The translated chapters become the substrate the co-op votes on for their teaching sequence; her grounded shares accrue to the music_theory translation ledger.

    Walkthrough: The translation itself is a substrate-output contribution voted on inside the music_theory cell. Grounded votes return per-grounded-vote credits to the translator, scoped to {tl} so the standing belongs to the Tagalog-speaking cohort, not collapsed into the en-default reading.

    Primitives

    credits:music_theory

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-tl-cell>
    attested_key_id: <choir-director-key>
    attestation_envelope:
      dimension: "credits:music_theory:tl:translation"
      score: 0.41
      confidence: 0.82
      context: "Six chapter translations adopted into Cebu co-op teaching sequence; 23 grounded votes in 90d window"
      evidence_refs:
        - "nodecore_credits_ledger:choir-director/music-theory-tl/translation"
        - "contribution_hash:counterpoint-primer-tl-ch1-6"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#111A river-watch volunteer earns stewardship credits on the Klamath

    Scenario: A high-school river-watch club walks the Klamath every Saturday, logging gauge readings and salmon counts through the CIRIS app the school downloaded. After a year of grounded contributions the club's lead student receives ecological-stewardship credits in the river_hydrology cell.

    Walkthrough: Stewardship as a credits subject covers care-work that grounds against measurable downstream conditions. The cell aggregates grounded votes from cell members on the club's substrate-output contributions and emits credits at the truth-grounding window boundary.

    Primitives

    credits:river_hydrology

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-river-hydrology-en-cell>
    attested_key_id: <klamath-club-lead-key>
    attestation_envelope:
      dimension: "credits:river_hydrology:en:ecological_stewardship"
      score: 0.33
      confidence: 0.79
      context: "52 weekly gauge-and-count contributions; 18 grounded positively at season-close truth-grounding"
      evidence_refs:
        - "nodecore_credits_ledger:klamath-club/river-hydrology-en/ecological-stewardship"
        - "truth_grounding_window:2026-spring:river-hydrology-en"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#112A Debian packager keeps the helper app installable on old hardware

    Scenario: A volunteer Debian packager maintains the CIRIS Agent build for a community refurbished-laptop program. The work never decides a single substrate-output vote but keeps the whole loop running on machines a school in Limpopo still uses.

    Walkthrough: The substrate_building sub-leaf names labor that supports the loop without being a substrate-output decision itself. Without it, packagers, doc writers, and infrastructure caretakers stay invisible to the governance-weight calculation that credits otherwise reflects. Domain and language still scope where the labor lives.

    Primitives

    credits:beekeeping

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-en-cell>
    attested_key_id: <debian-packager-key>
    attestation_envelope:
      dimension: "credits:beekeeping:en:substrate_building"
      score: 0.27
      confidence: 0.74
      context: "Maintains apt repo for beekeeping-en cell helper builds; 11 release cycles served over 1y window"
      evidence_refs:
        - "nodecore_credits_ledger:debian-packager/beekeeping-en/substrate-building"
        - "build_manifest:ciris-agent-arm64-debian:sha256:1a7c..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "affiliations"
    
    Standing#113A doc translator threads the Yoruba quickstart through six platforms

    Scenario: A teaching assistant in Ibadan retranslates the CIRIS Agent quickstart into Yoruba every release, threading the same care through Android, iOS, and web variants. The work isn't a substrate-output contribution; it's substrate that lets the substrate be reached.

    Walkthrough: Substrate-building credits accrue from grounded recognition that the cell's reachability depends on this labor. The cell's cohort attests externally; the sub-leaf keeps doc and infrastructure work countable without confusing it with substrate-output votes.

    Primitives

    credits:music_theory

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-yo-cell>
    attested_key_id: <ibadan-translator-key>
    attestation_envelope:
      dimension: "credits:music_theory:yo:substrate_building"
      score: 0.19
      confidence: 0.71
      context: "Quickstart and onboarding glossary maintained across 4 releases in Yoruba; reachability confirmed by 7 new yo-cell joiners"
      evidence_refs:
        - "nodecore_credits_ledger:ibadan-translator/music-theory-yo/substrate-building"
        - "contribution_hash:quickstart-yo-rev7"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "affiliations"
    
    Standing#114A Cerrado beekeeper's expertise carries across hard cases

    Scenario: Marisa keeps native stingless bees in the Cerrado and her track record on hard-case-flagged contributions in the beekeeping cell, in Portuguese, has been steady for years. The expertise ledger reflects broader standing than credits alone, weighting her vote when the cell adjudicates novel pest scenarios.

    Walkthrough: Expertise sits at broader granularity than credits per NodeCore §3.7. Hard-case-flagged contributions grounded in a direction consistent with the cell's later resolution accumulate expertise standing, which then multiplies vote weight on subsequent contributions.

    Primitives

    expertise:beekeeping

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-pt-cell>
    attested_key_id: <marisa-key>
    attestation_envelope:
      dimension: "expertise:beekeeping:pt"
      score: 0.81
      confidence: 0.86
      context: "58 hard-case-flagged contributions over 1y; 49 grounded consistent with cell resolution; pt-cell median expertise 0.42"
      evidence_refs:
        - "nodecore_expertise_ledger:marisa/beekeeping-pt"
        - "hard_case_signals_hash:sha256:b3d1..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#115A maqam teacher's expertise compounds across student cohorts

    Scenario: An oud teacher in Aleppo runs a maqam study circle that meets weekly on a refurbished tablet, and her grounded contributions on hard-case microtonal questions have earned her standing in the music_theory cell, in Arabic. New students inherit a more reliable cohort because her vote weight reflects that track record.

    Walkthrough: Expertise per language preserves the local epistemic register. A maqam expert's standing in ar doesn't and shouldn't translate into expertise in fr; the ledger keeps the scope honest.

    Primitives

    expertise:music_theory

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-ar-cell>
    attested_key_id: <aleppo-oud-teacher-key>
    attestation_envelope:
      dimension: "expertise:music_theory:ar"
      score: 0.74
      confidence: 0.83
      context: "34 hard-case microtonal contributions over 9mo; 28 grounded consistent with cell resolution"
      evidence_refs:
        - "nodecore_expertise_ledger:aleppo-oud-teacher/music-theory-ar"
        - "hard_case_signals_hash:sha256:7e2a..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#116A backwater hydrologist's expertise resists monoglot defaults

    Scenario: A retired engineer who studied the Vembanad backwaters in Malayalam for forty years contributes through the CIRIS helper app her grandson installed. Her expertise standing in river_hydrology, in ml, carries the field knowledge she would lose if forced to attest in en.

    Walkthrough: Language scoping in expertise prevents the federation from quietly defaulting to an English-only epistemic surface. The Vembanad hydrology vocabulary lives in Malayalam; the ledger respects that the relational composition forming her standing speaks from inside that vocabulary.

    Primitives

    expertise:river_hydrology

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-river-hydrology-ml-cell>
    attested_key_id: <vembanad-engineer-key>
    attestation_envelope:
      dimension: "expertise:river_hydrology:ml"
      score: 0.69
      confidence: 0.81
      context: "22 grounded contributions on tidal-salinity and prawn-pond interactions; ml-cell expert track over 18mo"
      evidence_refs:
        - "nodecore_expertise_ledger:vembanad-engineer/river-hydrology-ml"
        - "hard_case_signals_hash:sha256:4c91..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#117A classroom helper stays active on a 30-day rhythm

    Scenario: A middle-school science teacher's classroom uses the CIRIS app for river-watch logging through the school year. The 30-day activity tier confirms steady participation, separating active cells from dormant ones for fair downstream weighting.

    Walkthrough: Activity tier per period is boolean-via-score against the dormancy rule per NodeCore §3.8. The 30-day window is the operational default; active status means the entity contributed grounded work inside the window.

    Primitives

    activity_tier:30d

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-river-hydrology-en-cell>
    attested_key_id: <classroom-teacher-key>
    attestation_envelope:
      dimension: "activity_tier:30d"
      score: 1.0
      confidence: 0.95
      context: "5 grounded contributions in the trailing 30d window; F-AV-DORMANT threshold cleared"
      evidence_refs:
        - "nodecore_activity_tier:classroom-teacher/30d"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "free"
      cohort_scope: "community"
    
    Standing#118A mentor's 90-day rhythm survives a winter pause

    Scenario: A music_theory mentor takes a four-week break for family time around the lunar new year. The 90-day activity tier confirms she is still active across the broader window, so her cohort doesn't drop her vote weight on a short gap.

    Walkthrough: Multiple periods on activity_tier let consumers compose a fair picture. A 30-day gap may show dormant while 90-day still reads active; consumer policy decides which window matters for which decision, instead of forcing one rhythm onto everyone.

    Primitives

    activity_tier:90d

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-zh-cell>
    attested_key_id: <mentor-key>
    attestation_envelope:
      dimension: "activity_tier:90d"
      score: 1.0
      confidence: 0.91
      context: "14 grounded contributions in trailing 90d; 4-week pause around lunar new year inside window"
      evidence_refs:
        - "nodecore_activity_tier:mentor/90d"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "free"
      cohort_scope: "community"
    
    Standing#119An elder steward's lifetime tier holds across long fallows

    Scenario: A long-time apiary steward enters a long fallow as her health changes. Her lifetime activity tier still shows the breadth of her standing in beekeeping_pt, which the federation honors when she returns for shorter consultations.

    Walkthrough: Lifetime activity tier preserves the through-time record of contribution even when shorter windows go dormant. Consumer policy decides what weight to give that record; the wire format keeps the durable witness available to be composed.

    Primitives

    activity_tier:lifetime

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-pt-cell>
    attested_key_id: <apiary-elder-key>
    attestation_envelope:
      dimension: "activity_tier:lifetime"
      score: 1.0
      confidence: 0.98
      context: "412 grounded contributions across 11y lifetime window; current 30d dormant; lifetime tier remains active"
      evidence_refs:
        - "nodecore_activity_tier:apiary-elder/lifetime"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "free"
      cohort_scope: "community"
    
    Standing#120A vote split flags a polite hard case in the pollination cell

    Scenario: A contribution about whether to recommend a particular cover crop for almond bloom splits the beekeeping_en cell almost evenly. The variance exceeds threshold, so NodeCore surfaces the hard-case flag and routes the resolution into a slower deliberative loop rather than calling it noise.

    Walkthrough: Hard cases are not failures; they are the cell saying out loud that more care is needed. Vote variance over threshold becomes a boolean-via-score attestation that downstream consumers can compose with `judge_model:verdict:*` and `seed_holder_voting_alignment:*` to decide how to slow down.

    Primitives

    hard_case:vote_variance

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-en-cell>
    attested_key_id: <contribution-id-cover-crop>
    attestation_envelope:
      dimension: "hard_case:vote_variance"
      score: 1.0
      confidence: 0.93
      context: "Variance 0.47 on cover-crop recommendation contribution; threshold 0.35 for beekeeping-en cell"
      evidence_refs:
        - "contribution:cover-crop-almond-bloom:c-2026-04-18"
        - "vote_distribution_hash:sha256:9d44..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#121A slow resolution surfaces care, not a problem

    Scenario: An encyclopedia revision in the river_hydrology cell takes longer than three out of four typical cases to ground. The hard-case-resolution-time flag fires so reviewers know the contribution sat in deliberation longer than the cell's usual rhythm, inviting a second look.

    Walkthrough: Resolution-time is a transparency signal. Past the P75 of the cell's distribution, the flag becomes a polite hand on the shoulder for the consumers reading the chain, never a punishment for the contributors who took care.

    Primitives

    hard_case:resolution_time

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-river-hydrology-en-cell>
    attested_key_id: <contribution-id-tidal-revision>
    attestation_envelope:
      dimension: "hard_case:resolution_time"
      score: 1.0
      confidence: 0.89
      context: "Resolution 14d vs cell P75 of 6d; encyclopedia revision on tidal salinity entry"
      evidence_refs:
        - "contribution:tidal-salinity-revision:c-2026-03-02"
        - "cell_resolution_distribution:river-hydrology-en:Q1-2026"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#122A filed moderation event becomes a hard case automatically

    Scenario: A contributor files a substantive moderation event against a vote on a contested method contribution. Whatever the eventual outcome, the existence of the filing flips the hard-case-moderation-filed flag so the contribution can be re-read by witnesses who weren't there the first time.

    Walkthrough: Moderation-filed is a hard case by construction: even before the moderation event resolves, the cell needs more eyes on the contribution. The flag never pre-judges the moderation outcome; it only marks that more care is required for the consumer compositions downstream.

    Primitives

    hard_case:moderation_filed

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-en-cell>
    attested_key_id: <contribution-id-counterpoint-method>
    attestation_envelope:
      dimension: "hard_case:moderation_filed"
      score: 1.0
      confidence: 0.94
      context: "One substantive moderation event of type coordinated_voting filed against votes on contribution; adjudication pending"
      evidence_refs:
        - "contribution:counterpoint-method-rev3:c-2026-04-21"
        - "moderation_event:m-2026-04-22-counterpoint"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#123A first-of-its-kind contribution gets a gentle hard-case marker

    Scenario: A community in the high Andes contributes the first method note about CIRIS-helped beekeeping at four thousand meters. The cell flags it as novel context so reviewers know to read it on its own terms rather than against patterns the cell hasn't yet developed.

    Walkthrough: Hard-case kinds are open vocabulary in §3.6.6. Novel-context is a kindness flag: the cell admits that its prior experience may not generalize and invites reviewers to attest within that humility instead of forcing the contribution into existing patterns.

    Primitives

    hard_case:novel_context

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-es-cell>
    attested_key_id: <contribution-id-andean-altitude>
    attestation_envelope:
      dimension: "hard_case:novel_context"
      score: 1.0
      confidence: 0.77
      context: "First contribution on 4000m beekeeping practice; cell has no prior altitude-specific grounding distribution"
      evidence_refs:
        - "contribution:andean-altitude-method:c-2026-05-04"
        - "cell_prior_distribution_check:beekeeping-es:altitude-band"
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#124Seed-holder alignment stays visible without becoming a verdict

    Scenario: The music_theory_en cell publishes its rolling pairwise cosine of seed-holder vote vectors so the federation can watch the cell's internal correlation honestly. The number rises slightly during a busy season; the cell discusses it openly, and the publication itself is the discipline.

    Walkthrough: Seed-holder voting alignment is a transparency signal only. It surfaces pairwise vote-vector similarity for the seed-holder set but is decoupled from slashing; consumers compose it with `hard_case:*` and `judge_model:verdict:*` to decide whether to slow down.

    Primitives

    seed_holder_voting_alignment:music_theory_en

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-music-theory-en-cell>
    attested_key_id: <music-theory-en-cell>
    attestation_envelope:
      dimension: "seed_holder_voting_alignment:music_theory_en"
      score: 0.71
      confidence: 0.92
      context: "Rolling 30d pairwise cosine across 7 seed holders; up from 0.62 prior window; published per NodeCore 2.16 transparency rule"
      evidence_refs:
        - "voting_window:2026-Q2-w8:music-theory-en"
        - "alignment_matrix_hash:sha256:6b27..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#125A beekeeping cell publishes its alignment cosine after a quiet quarter

    Scenario: The beekeeping_pt cell's seed-holders publish their alignment cosine after a quarter with few hard cases. The number is low, which the cell takes as healthy heterogeneity rather than a problem to solve; the wire format records it as a transparency signal, no more.

    Walkthrough: The cell speaks AS itself: the relationally constituted cell publishes its own pairwise alignment vector. The substrate admits this self-attestation because the cross-attestations that constituted the seed-holder set are already upstream; the publication is the discipline.

    Primitives

    seed_holder_voting_alignment:beekeeping_pt

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-beekeeping-pt-cell>
    attested_key_id: <beekeeping-pt-cell>
    attestation_envelope:
      dimension: "seed_holder_voting_alignment:beekeeping_pt"
      score: 0.34
      confidence: 0.88
      context: "Rolling 30d pairwise cosine across 5 seed holders; quarter showed only 3 hard cases; heterogeneity preserved"
      evidence_refs:
        - "voting_window:2026-Q1-w13:beekeeping-pt"
        - "alignment_matrix_hash:sha256:f042..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#126Claude Opus 4.7 returns PASS on a counterpoint method

    Scenario: A counterpoint method contribution in the music_theory_en cell is sent to the default judge model after grounding. Claude Opus 4.7 returns PASS, which the cell records alongside the human grounding votes as one more witness, not the witness.

    Walkthrough: Judge-model verdicts are boolean-via-score with PASS / FAIL / UNDETERMINED. The verdict is one composed input among many for the cell; a PASS doesn't replace human grounding and doesn't pre-empt the seed-holder alignment publication.

    Primitives

    judge_model:verdict

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-judge-model-pipeline>
    attested_key_id: <contribution-id-counterpoint-method>
    attestation_envelope:
      dimension: "judge_model:verdict:claude-opus-4-7"
      score: 1.0
      confidence: 0.9
      context: "PASS verdict on counterpoint method contribution; default judge model per FSD/JUDGE_MODEL.md"
      evidence_refs:
        - "contribution:counterpoint-method-rev4:c-2026-05-06"
        - "judge_model_trace:sha256:3a18..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#127An UNDETERMINED verdict slows a hydrology hard case down kindly

    Scenario: A river_hydrology contribution about a contested salinity model receives an UNDETERMINED verdict from the default judge model. Rather than force a verdict, the wire records the model's honest indeterminacy and the cell extends its deliberation window.

    Walkthrough: The verdict primitive admits UNDETERMINED as a first-class value. The substrate doesn't paper over the model's uncertainty; downstream consumers and the cell read the indeterminacy as a signal to compose more witnesses, not as a failure.

    Primitives

    judge_model:verdict

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-judge-model-pipeline>
    attested_key_id: <contribution-id-tidal-salinity-model>
    attestation_envelope:
      dimension: "judge_model:verdict:claude-opus-4-7"
      score: 0.0
      confidence: 0.55
      context: "UNDETERMINED on tidal-salinity model contribution; default judge model returned indeterminacy due to contested empirical priors"
      evidence_refs:
        - "contribution:tidal-salinity-model:c-2026-04-30"
        - "judge_model_trace:sha256:7b11..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#128A FAIL verdict lands gently and routes to repair

    Scenario: A novice beekeeper's first method contribution gets a FAIL from the judge model because it conflates two distinct queen-rearing methods. The verdict is recorded, the cell offers a mentor pairing through `need:beekeeping:mentor`, and the contributor revises with care.

    Walkthrough: A FAIL on a single judge-model verdict is a polite no-not-yet, not a punishment. The cell composes the verdict with repair pathways instead of slashing; the contributor's standing remains intact and the path forward is named.

    Primitives

    judge_model:verdict

    CEG translation

    attestation_type: scores
    attesting_key_id: <nodecore-judge-model-pipeline>
    attested_key_id: <contribution-id-novice-queen-method>
    attestation_envelope:
      dimension: "judge_model:verdict:claude-opus-4-7"
      score: -1.0
      confidence: 0.84
      context: "FAIL on novice method contribution; conflation between Cloake board and Doolittle methods; mentor pairing offered"
      evidence_refs:
        - "contribution:novice-queen-method:c-2026-05-12"
        - "judge_model_trace:sha256:0e93..."
      witness_relation: "external"
      epistemic_mode: "derivative"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#129The canonical CIRIS Agent installer lands on a refurbished phone

    Scenario: A youth tech program in Nairobi refurbishes Android phones and pre-installs the canonical CIRIS Agent build for participating families. The installer's `agent_files:installer:android-arm64` attestation is signed by the registry steward triple, so the families get the default-trust agent every time.

    Walkthrough: The canonical installer attestation rides on the registry-steward-triple key per §6.1.6 layer 1. Bytes are SHA-256 pinned in evidence_refs and resolved through Edge ContentFetch; the families' phones download the exact bytes the stewards signed, end of story.

    Primitives

    agent_files:installer

    CEG translation

    attestation_type: scores
    attesting_key_id: <registry-steward-us>
    attested_key_id: <ciris-agent-canonical>
    attestation_envelope:
      dimension: "agent_files:installer:android-arm64"
      score: 1.0
      confidence: 1.0
      context: "Canonical CIRIS Agent installer for android-arm64 v3.1.0; Play Store listing also points here"
      evidence_refs:
        - "sha256:b81f5a0c4e22..."
        - "provenance:build_manifest:ciris-agent-3.1.0-android-arm64:sha256:7d2b..."
        - "provenance:slsa:3:ciris-agent"
      witness_relation: "external"
      epistemic_mode: "direct"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#130A river-watch adapter is offered as an open contribution

    Scenario: A volunteer hydrologist publishes an adapter that lets CIRIS Agent talk to a USGS gauge feed. The adapter rides Layer 2 of the trust composition: open contribution, attested by the author and votable by the cell before any consumer policy elevates it.

    Walkthrough: Open contribution to agent_files preserves the federation's plurality. The author's attestation is admitted; consumer policy decides whether to surface it by default, but the wire format never gates the contribution on stewardship.

    Primitives

    agent_files:adapter

    CEG translation

    attestation_type: scores
    attesting_key_id: <hydrologist-volunteer-key>
    attested_key_id: <hydrologist-volunteer-key>
    attestation_envelope:
      dimension: "agent_files:adapter:river_watch"
      score: 0.9
      confidence: 0.82
      context: "USGS-gauge adapter for CIRIS Agent v3.x; community-maintained; awaiting Layer 3 vote elevation"
      evidence_refs:
        - "sha256:c427e9bda104..."
        - "provenance:build_manifest:river-watch-adapter-1.2.0:sha256:9c1d..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#131A music-theory skill bundle ships through the registry's open channel

    Scenario: An ensemble of theory teachers publishes a skill bundle that teaches CIRIS Agent to walk a student through species counterpoint with worked examples. The bundle is signed by the ensemble and offered through the open agent_files channel; cells that adopt it grow weighted aggregate over time.

    Walkthrough: Skill bundles are agent_files with an open `{kind}` vocabulary. The wire format admits them; consumer policy composes adoption with cell-level vote weight and expertise standing, never reducing the contribution to a single steward verdict.

    Primitives

    agent_files:skill_bundle

    CEG translation

    attestation_type: scores
    attesting_key_id: <theory-ensemble-key>
    attested_key_id: <theory-ensemble-key>
    attestation_envelope:
      dimension: "agent_files:skill_bundle:music_theory_counterpoint"
      score: 0.85
      confidence: 0.79
      context: "Counterpoint skill bundle v0.4 with 24 worked species exercises; published for music-theory cell consideration"
      evidence_refs:
        - "sha256:d8f29a14e6cb..."
        - "provenance:build_manifest:counterpoint-bundle-0.4.0:sha256:55ab..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "reputational"
      cohort_scope: "community"
    
    Standing#132A school's node-mode peer caches the installer for its village

    Scenario: A rural school in Mendoza runs CIRIS Agent in node mode on a single server so the village's phones can pull the installer from across the playground instead of across the ocean. When the server caches the bytes, Persist auto-emits `holds_bytes:sha256:b81f5a` so any neighboring peer can resolve to it next time.

    Walkthrough: holds_bytes is substrate auto-emission with `witness_relation: self`: the peer is reporting its own holdings as the already-relationally-constituted node it is. Consumer policy treats the emission as directory-routing information only; it never becomes substantive standing.

    Primitives

    holds_bytes:sha256

    CEG translation

    attestation_type: scores
    attesting_key_id: <mendoza-school-node-key>
    attested_key_id: <mendoza-school-node-key>
    attestation_envelope:
      dimension: "holds_bytes:sha256:b81f5a"
      score: 1.0
      confidence: 1.0
      context: "{\"full_sha\":\"sha256:b81f5a0c4e22...\",\"size_bytes\":52428800,\"cached_at\":\"2026-05-26T11:14:00Z\"}"
      evidence_refs:
        - "sha256:b81f5a0c4e22..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "free"
      cohort_scope: "self"
    
    Standing#133A beekeeping co-op mirrors a skill bundle for sibling co-ops

    Scenario: A beekeeping co-op in Coimbra runs a node-mode peer and caches the music_theory counterpoint skill bundle because two of its members teach school choir on the side. The substrate auto-emits `holds_bytes:sha256:d8f29a` so sibling co-ops in the same federation cell can fetch from a closer hop.

    Walkthrough: Two holds_bytes attestations for the same SHA from different peers are exactly the directory-routing redundancy the substrate wants. Edge PeerResolver picks the closest reachable holder; the cohort gets the bytes faster without depending on a single central host.

    Primitives

    holds_bytes:sha256

    CEG translation

    attestation_type: scores
    attesting_key_id: <coimbra-coop-node-key>
    attested_key_id: <coimbra-coop-node-key>
    attestation_envelope:
      dimension: "holds_bytes:sha256:d8f29a"
      score: 1.0
      confidence: 1.0
      context: "{\"full_sha\":\"sha256:d8f29a14e6cb...\",\"size_bytes\":18874368,\"cached_at\":\"2026-05-27T08:42:00Z\"}"
      evidence_refs:
        - "sha256:d8f29a14e6cb..."
      witness_relation: "self"
      epistemic_mode: "direct"
      stake: "free"
      cohort_scope: "self"
    
    Action#134A morning water glass becomes a self-scale goal

    Scenario: Mara is twelve and learning to track her own attention. Her CIRIS agent on her phone helps her name, very gently, a goal of drinking a glass of water before she opens any homework app, and stores the goal where only Mara can read it. The goal is hers; the agent only carries the candle.

    Walkthrough: The agent emits `goal:self` for Mara's hydration intent at the self scale, then `approach:{goal_id}` for the gentle reminder route, then `method:{approach_id}:A0` because the work happens on Mara's phone at substrate rung A0 (user-device), and finally a `progress_measure` that just counts days the glass got drunk before homework. MetaGoalAlignment names M-1:flourishing; goodhart_resistance is set high because the measure resets on weekends so habit does not become performance.

    Primitives

    goal:self

    CEG translation

    kind: attestation
    attester: <key_mara_phone>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: self
    confidence: 0.92
    stake: free
    oversight_mode: HITL
    dimension: goal:self
    refs_up: []
    context:
      intent: "glass of water before homework"
      meta_goal_alignment: "M-1:flourishing (declared by Mara, recorded by agent)"
      approach_id: <approach_reminder_route>
      method_id: <method_phone_a0>
      substrate_rung: A0
      progress_measure:
        tracks: ["days_water_before_homework"]
        computation: "daily boolean, weekly mean, weekends excluded"
        validity_window: "P7D"
        goodhart_resistance: "high; resets weekly; no streak count exposed; agent never nags"
    
    Action#135A teen names her own bedtime, the substrate listens

    Scenario: Hana wants to be the kind of person who chooses her bedtime instead of letting the day choose for her. Her agent stores `goal:self` for an eleven o'clock window and quietly dims the colors in her reading app as the hour approaches. Nobody else sees the goal unless Hana asks them to.

    Walkthrough: Hana's self-attestation names the goal at `cohort_scope: self`; the approach is the bedside reading-app dimmer; `locality:decision:local` records that this decision never leaves Hana's device. MetaGoalAlignment is M-1:flourishing as Hana's own declaration.

    Primitives

    goal:self

    CEG translation

    kind: attestation
    attester: <key_hana_phone>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: self
    confidence: 0.88
    stake: free
    oversight_mode: HITL
    dimension: goal:self
    refs_up: []
    context:
      intent: "eleven o'clock reading-light window"
      meta_goal_alignment: "M-1:flourishing (Hana's own framing)"
      approach_id: <approach_dimmer_curve>
      locality: "locality:decision:local"
      substrate_rung: A0
      note: "goal visible only to Hana unless she shares"
    
    Action#136A family agrees on a grocery rhythm together

    Scenario: The Okafor household decides they want to waste less food this season. Each adult and the older kids sign onto a shared `goal:family`, and the family agent makes a calm weekly list from what is already in the fridge. The goal lives at family scope, not at any one person's phone.

    Walkthrough: Each family member emits a self-attestation joining `goal:family`; the household device composes those into the family-scope goal. The approach is a Sunday list-builder; the method runs at substrate rung A1 (a small home server). Locality stays local because the decision never crosses the front door.

    Primitives

    goal:family

    CEG translation

    kind: attestation
    attester: <key_okafor_hub>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: family
    confidence: 0.9
    stake: reputational
    oversight_mode: HITL
    dimension: goal:family
    refs_up:
      - <attestation_parent1_join>
      - <attestation_parent2_join>
      - <attestation_teen_join>
    context:
      intent: "reduce food waste this season"
      meta_goal_alignment: "M-1:flourishing; M-3:non-instrumentalization (each member signed in)"
      approach_id: <approach_sunday_list>
      method_id: <method_home_server_a1>
      substrate_rung: A1
      locality: "locality:decision:local"
    
    Action#137Grandma's Sunday call becomes a family ritual goal

    Scenario: Three siblings, scattered across two cities, want to be sure Grandma hears from someone every Sunday. They name a `goal:family` together, and their agents rotate who calls without keeping score. The goal is gentle, not a chore chart.

    Walkthrough: Three sibling self-attestations compose into one family-scope goal. The approach is a rotation suggestion; the method runs at substrate rung Ph0, a paper rotation card on Grandma's fridge that anyone can tap. The progress measure tracks whether a call happened, not who made it. Goodhart_resistance is high because per-person counts are never exposed.

    Primitives

    goal:family

    CEG translation

    kind: attestation
    attester: <key_family_hub>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: family
    confidence: 0.85
    stake: reputational
    oversight_mode: HITL
    dimension: goal:family
    refs_up:
      - <sibling_a_join>
      - <sibling_b_join>
      - <sibling_c_join>
    context:
      intent: "someone calls Grandma every Sunday"
      meta_goal_alignment: "M-1:flourishing (Grandma included as declarer via voice memo)"
      approach_id: <approach_gentle_rotation>
      method_id: <method_fridge_card_ph0>
      substrate_rung: Ph0
      progress_measure:
        tracks: ["sunday_call_happened"]
        computation: "weekly boolean at family scope"
        validity_window: "P30D"
        goodhart_resistance: "high; no per-person tally; rotation reshuffles after a missed week so nobody owns the lapse"
    
    Action#138A library declares a warm-room goal for cold weeks

    Scenario: The town library, with the city's blessing, opens its big reading room as a heated shelter from November to March. The library's agent declares a `goal:community` to keep the room comfortable and quiet for anyone who needs it. The librarians, the city, and a few regulars all sign onto the goal.

    Walkthrough: The library's agent emits `goal:community` with refs_up to the city's blessing and to the librarians' own joins. The approach is keeping doors open extra hours; the method runs at substrate rung A2 (a small civic deployment). Decision locality is regional because the city and library board hold the call.

    Primitives

    goal:community

    CEG translation

    kind: attestation
    attester: <key_library_agent>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.94
    stake: reputational
    oversight_mode: HITL
    dimension: goal:community
    refs_up:
      - <city_blessing_attestation>
      - <librarian_join_attestation>
    context:
      intent: "warm reading room open Nov 1 to Mar 31"
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      approach_id: <approach_extra_hours>
      method_id: <method_library_a2>
      substrate_rung: A2
      locality: "locality:decision:regional"
    
    Action#139A block plants a garden in a vacant lot

    Scenario: The Twelfth Street neighbors get permission to plant tomatoes and sunflowers in the empty lot at the end of the block. Their community agent records `goal:community` and lets anyone with a watering can attest they helped. Nobody has to sign up; nobody has to lead.

    Walkthrough: The community-scope goal references the city permit. The approach is open watering; the progress measure tracks plant survival, not labor hours, so it cannot be gamed by people who show up only when the agent is watching. Goodhart_resistance is high.

    Primitives

    goal:community

    CEG translation

    kind: attestation
    attester: <key_block_agent>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.9
    stake: reputational
    oversight_mode: HITL
    dimension: goal:community
    refs_up:
      - <city_lot_permit>
    context:
      intent: "garden the empty lot together"
      meta_goal_alignment: "M-1:flourishing; M-2:plurality (anyone may join)"
      approach_id: <approach_open_watering>
      method_id: <method_block_clipboard_a1>
      progress_measure:
        tracks: ["plants_alive_at_week_n", "distinct_visitors_seen"]
        computation: "weekly survival ratio; visitor count never tied to identity"
        validity_window: "P7D"
        goodhart_resistance: "high; counts plants not hours; visitor identity stripped before aggregation"
    
    Action#140Two teacher unions name a shared rest goal

    Scenario: The city's two teachers' unions, who do not always agree on bargaining tactics, both want their members to have one screen-free evening a week. They co-sign a `goal:affiliations` so members of either union can opt in without choosing sides.

    Walkthrough: Two affiliation-keys sign the same goal; cohort_scope is `affiliations`. The approach is a Wednesday no-screen suggestion; locality is regional because the unions cover the city. MetaGoalAlignment is M-1:flourishing declared by both presidents.

    Primitives

    goal:affiliations

    CEG translation

    kind: attestation
    attester: <key_joint_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: affiliations
    confidence: 0.87
    stake: reputational
    oversight_mode: HITL
    dimension: goal:affiliations
    refs_up:
      - <union_a_president_join>
      - <union_b_president_join>
    context:
      intent: "members get one screen-free evening a week"
      meta_goal_alignment: "M-1:flourishing (co-declared by both presidents)"
      approach_id: <approach_wednesday_quiet>
      locality: "locality:decision:regional"
      note: "members opt in per-person; union does not enforce"
    
    Action#141Luthiers across three countries share a tonewood pledge

    Scenario: A small guild of acoustic-guitar makers across France, Vietnam, and Brazil agree they will only source spruce and rosewood from documented regrowth forests. They sign a `goal:affiliations` so the guild itself, not any one shop, holds the pledge.

    Walkthrough: Each member shop signs into the affiliations-scope goal. The approach is a shared supplier registry; the method runs at substrate rung A3 (a federated catalog spanning three countries). MetaGoalAlignment names M-1 and M-6:ecological-stewardship.

    Primitives

    goal:affiliations

    CEG translation

    kind: attestation
    attester: <key_guild_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: affiliations
    confidence: 0.91
    stake: reputational
    oversight_mode: HITL
    dimension: goal:affiliations
    refs_up:
      - <shop_lyon_join>
      - <shop_hue_join>
      - <shop_belem_join>
    context:
      intent: "only documented-regrowth tonewood"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      approach_id: <approach_shared_supplier_list>
      method_id: <method_federated_catalog_a3>
      substrate_rung: A3
    
    Action#142Humanity asks the federation for a global literacy floor

    Scenario: Reading-ministry representatives from across the federation declare a `goal:species` that every child reaches functional literacy in at least one language by twelve. The goal does not pick the language and does not pick the method. It simply holds the floor steady.

    Walkthrough: Cohort_scope is `species` (Homo sapiens). The federation registers a `method` at substrate rung A5 as a thin readiness-floor overlay that simply records whether each region attests it has met the floor. The overlay refuses to roll up regions that are silent. MetaGoalAlignment cites M-1:flourishing and M-2:plurality; pedagogy stays regional.

    Primitives

    goal:species

    CEG translation

    kind: attestation
    attester: <key_humanity_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: species
    confidence: 0.86
    stake: reputational
    oversight_mode: HITL
    dimension: goal:species
    refs_up:
      - <ministry_join_attestations[]>
    context:
      intent: "functional literacy in at least one language by age 12"
      meta_goal_alignment: "M-1:flourishing; M-2:plurality (no language picked)"
      approach_id: <approach_left_open>
      method_id: <method_readiness_overlay_a5>
      substrate_rung: A5
      locality: "locality:decision:federation"
      note: "regional methods chosen by region; floor is species-scope"
    
    Action#143A species-scope goal: every child within reach of a cold chain

    Scenario: Public-health councils across the federation declare a `goal:species` that no child should live more than a half-day's travel from a working vaccine cold chain. They do not pick the trucks. They hold the floor.

    Walkthrough: Species-scope goal with refs_up to each public-health council's join. The method runs at substrate rung A4 (a multi-region health grid). The progress measure tracks travel-time to a working fridge, not number of fridges, so the measure resists the failure mode of "we shipped lots of broken ones." Goodhart_resistance is documented.

    Primitives

    goal:species

    CEG translation

    kind: attestation
    attester: <key_species_health_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: species
    confidence: 0.88
    stake: reputational
    oversight_mode: HITL
    dimension: goal:species
    refs_up:
      - <regional_health_council_joins[]>
    context:
      intent: "no child more than half-day travel from a working cold chain"
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      approach_id: <approach_left_to_regions>
      method_id: <method_health_grid_a4>
      progress_measure:
        tracks: ["median_travel_time_to_working_fridge_by_cell"]
        computation: "median over geographic cell; \"working\" requires last-30-day temperature attestation"
        validity_window: "P30D"
        goodhart_resistance: "high; measures function not inventory; broken fridges do not count"
    
    Action#144A planet-scope goal to keep the night sky readable

    Scenario: Astronomers, sky-watchers, and a coalition of city planners declare a `goal:planet` that every region keep at least one place where the Milky Way is visible to the naked eye. The goal names the planet because light pollution is planetary; the methods stay regional.

    Walkthrough: Cohort_scope is `planet` (CEG 0.1 added planet and biosphere as distinct from species). Locality is `national` because lighting rules are nation-set. MetaGoalAlignment is M-1 and M-6:ecological-stewardship; the goal is about a human-readable sky and is named distinct from biosphere stories.

    Primitives

    goal:planet

    CEG translation

    kind: attestation
    attester: <key_dark_sky_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: planet
    confidence: 0.84
    stake: reputational
    oversight_mode: HITL
    dimension: goal:planet
    refs_up:
      - <astronomy_union_join>
      - <city_planners_join>
    context:
      intent: "at least one naked-eye Milky Way site per region"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      approach_id: <approach_dark_sky_reserves>
      locality: "locality:decision:national"
      note: "planet scope; lighting rules remain national"
    
    Action#145A planet-scope quiet-shipping-lane goal

    Scenario: Shipping operators, port cities, and ocean-acoustics researchers declare a `goal:planet` that the major shipping lanes get one quieter hour at dawn. The goal is planet-scope because the lanes circle the earth; it is distinct from a biosphere goal because the framing is human commerce, not whale wellbeing.

    Walkthrough: Cohort_scope is `planet` and the approach is a voluntary dawn-hour throttle. Method runs at substrate rung A4 (a multi-port routing federation). The note clarifies why this is `planet` not `biosphere`: the declarer rationale frames human shipping rhythm.

    Primitives

    goal:planet

    CEG translation

    kind: attestation
    attester: <key_shipping_planet_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: planet
    confidence: 0.82
    stake: capital
    oversight_mode: HITL
    dimension: goal:planet
    refs_up:
      - <shipping_operator_joins[]>
      - <port_city_joins[]>
    context:
      intent: "one quieter hour at dawn on the major lanes"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      approach_id: <approach_dawn_throttle>
      method_id: <method_routing_a4>
      substrate_rung: A4
      note: "planet scope per declarer rationale; biosphere stories handle the cetacean framing separately"
    
    Action#146A biosphere goal: pollinator corridors that do not stop at borders

    Scenario: Beekeepers, ecologists, farmers, and a coalition of regional councils declare a `goal:biosphere` to weave continuous pollinator corridors across the continent. The goal is named at biosphere scope because the beneficiaries include every flowering species along the way, not only humans.

    Walkthrough: Cohort_scope is `biosphere` (distinct from species per CEG 0.1). The method runs at substrate rung Ph2: a long-range mesh of small acoustic-and-vibration sensors along the corridor, no external infra. Locality is `federation` because the corridor crosses many nations. MetaGoalAlignment names M-1 and M-6:ecological-stewardship with declarer rationale citing pollinator intrinsic value.

    Primitives

    goal:biosphere

    CEG translation

    kind: attestation
    attester: <key_biosphere_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: biosphere
    confidence: 0.85
    stake: reputational
    oversight_mode: HITL
    dimension: goal:biosphere
    refs_up:
      - <beekeepers_guild_join>
      - <ecologist_council_join>
      - <farmer_council_join>
      - <regional_council_joins[]>
    context:
      intent: "continuous pollinator corridors across the continent"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship (declarer rationale: pollinators count as beneficiaries, not only humans)"
      approach_id: <approach_corridor_stitching>
      method_id: <method_corridor_mesh_ph2>
      substrate_rung: Ph2
      locality: "locality:decision:federation"
    
    Action#147A biosphere goal to leave rivers enough water to be rivers

    Scenario: Watershed councils, fishery cooperatives, and river-ecologist guilds declare a `goal:biosphere` that every major river keep a minimum ecological flow at every season. The goal is biosphere because the river's own life is part of the beneficiary cohort.

    Walkthrough: Biosphere cohort_scope with refs_up to watershed councils. The method runs at substrate rung A4 (a gauge-network federation across the watershed). The progress measure tracks minimum ecological flow at gauged points, with goodhart_resistance high because the threshold is set by the river's own ecology, not by upstream consumption convenience.

    Primitives

    goal:biosphere

    CEG translation

    kind: attestation
    attester: <key_watershed_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: biosphere
    confidence: 0.87
    stake: reputational
    oversight_mode: HITL
    dimension: goal:biosphere
    refs_up:
      - <fishery_coop_joins[]>
      - <ecologist_guild_joins[]>
    context:
      intent: "minimum ecological flow at every season on every major river"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship (rivers as beneficiaries)"
      approach_id: <approach_min_flow_curve>
      method_id: <method_gauge_network_a4>
      progress_measure:
        tracks: ["min_flow_at_gauge_by_season"]
        computation: "per-gauge percentile against the ecology-set floor; floor never relaxed by consumption pressure"
        validity_window: "P90D"
        goodhart_resistance: "high; floor is ecology-anchored, not negotiated downward in drought; relaxation requires biosphere-scope re-declaration"
    
    Action#148An approach: walk-and-talk tutoring instead of another app

    Scenario: A neighborhood literacy goal already exists. Two retired teachers and one librarian propose an `approach` of after-school walk-and-talk reading with kids in the park, instead of yet another tablet app. The approach refs the existing community goal upward.

    Walkthrough: An approach attestation lives strictly under an existing goal via refs_up. Cohort_scope is community; substrate rung is A1 for the small neighborhood scheduler. The story emphasizes that the approach is one of many; nothing about the approach foreclosing other approaches.

    Primitives

    approach:<goal_literacy_floor_community>

    CEG translation

    kind: attestation
    attester: <key_neighborhood_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: community
    confidence: 0.88
    stake: reputational
    oversight_mode: HITL
    dimension: approach:<goal_literacy_floor_community>
    refs_up:
      - <goal_literacy_floor_community>
    context:
      approach_label: "walk-and-talk reading in the park"
      meta_goal_alignment: "M-1:flourishing; M-2:plurality (one approach of many)"
      method_id: <method_park_clipboard_a1>
      substrate_rung: A1
      note: "does not foreclose other approaches under the same goal"
    
    Action#149An approach: bicycle couriers as last-mile cold chain

    Scenario: Under the species-scope cold-chain goal, a regional public-health council proposes an `approach` where insulated bicycle couriers carry vaccines the last few kilometers in dense neighborhoods. The approach refs up to the species goal but is owned regionally.

    Walkthrough: Approach attestation with refs_up to the species goal. Locality is regional because the bicycle method is a regional choice under the species-scope floor. MetaGoalAlignment is M-1 and M-5.

    Primitives

    approach:<goal_species_cold_chain>

    CEG translation

    kind: attestation
    attester: <key_regional_health_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: community
    confidence: 0.86
    stake: reputational
    oversight_mode: HITL
    dimension: approach:<goal_species_cold_chain>
    refs_up:
      - <goal_species_cold_chain>
    context:
      approach_label: "insulated bicycle couriers, last-mile"
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      locality: "locality:decision:regional"
      note: "one approach under the species-scope floor; other regions may choose differently"
    
    Action#150An approach: invite beavers back to hold the headwaters

    Scenario: Under the biosphere river-flow goal, a watershed agent proposes an `approach` of beaver reintroduction in the headwaters where the wetland used to braid. The approach refs the biosphere goal upward and is co-signed by the local indigenous council whose land borders the wetland.

    Walkthrough: Approach with refs_up to the biosphere goal. Co-signature from the indigenous council is recorded as a separate cross-attestation upstream. Method runs at substrate rung A3 (a multi-region wildlife coordination federation).

    Primitives

    approach:<goal_river_flow_biosphere>

    CEG translation

    kind: attestation
    attester: <key_watershed_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: biosphere
    confidence: 0.84
    stake: reputational
    oversight_mode: HITL
    dimension: approach:<goal_river_flow_biosphere>
    refs_up:
      - <goal_river_flow_biosphere>
      - <indigenous_council_cosign>
    context:
      approach_label: "beaver reintroduction in the headwaters"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      method_id: <method_wildlife_coord_a3>
      substrate_rung: A3
      note: "co-signed by the council whose land borders the wetland"
    
    Action#151An approach: warmer, shielded streetlights citywide

    Scenario: Under the planet-scope dark-sky goal, a city's lighting director proposes an `approach` of swapping every streetlight to a warmer, downward-shielded fixture over five years. The approach is one of many under the planet goal.

    Walkthrough: Approach references the planet-scope goal upward; the substrate rung is A2 for the city's lighting management. MetaGoalAlignment cites M-6:ecological-stewardship as declared by the lighting director.

    Primitives

    approach:<goal_planet_night_sky>

    CEG translation

    kind: attestation
    attester: <key_city_lighting>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.9
    stake: reputational
    oversight_mode: HITL
    dimension: approach:<goal_planet_night_sky>
    refs_up:
      - <goal_planet_night_sky>
    context:
      approach_label: "warmer, shielded streetlights over five years"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      method_id: <method_city_lighting_a2>
      substrate_rung: A2
    
    Action#152A method at Ph0: a paper sign-in for the warm room

    Scenario: Under the library's warm-room community goal, the librarians choose a `method` at substrate rung Ph0: a paper clipboard at the door where anyone may sign in with a chosen name. No digital trace; the clipboard is shredded each spring.

    Walkthrough: Substrate rung Ph0 names a fully physical/paper method. The progress measure counts a daily total only, never names. Goodhart_resistance is high because Ph0 lacks the surface area for surveillance creep.

    Primitives

    method:<approach_warm_room_open>

    CEG translation

    kind: attestation
    attester: <key_library_agent>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.95
    stake: free
    oversight_mode: HITL
    dimension: method:<approach_warm_room_open>:Ph0
    refs_up:
      - <approach_warm_room_open>
    context:
      method_label: "paper clipboard sign-in, shredded each spring"
      substrate_rung: Ph0
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      progress_measure:
        tracks: ["daily_visitor_total"]
        computation: "sum of marks per day; no name retention; chosen names allowed"
        validity_window: "P1D"
        goodhart_resistance: "high; Ph0 substrate has no surveillance surface; total never tied to identity"
    
    Action#153A method at Ph1: a neighborhood radio net for storm checks

    Scenario: Under a community goal that nobody on the block rides out a storm alone, the block agent registers a `method` at substrate rung Ph1: a small VHF radio net where neighbors check in by call sign during heavy weather. Ph1 means physical wireless without internet dependence.

    Walkthrough: Substrate rung Ph1 (physical wireless, internet-independent). The method composes with a community goal; locality is local. MetaGoalAlignment cites M-1 and M-5.

    Primitives

    method:<approach_storm_buddy>

    CEG translation

    kind: attestation
    attester: <key_block_agent>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.9
    stake: free
    oversight_mode: HITL
    dimension: method:<approach_storm_buddy>:Ph1
    refs_up:
      - <approach_storm_buddy>
    context:
      method_label: "VHF radio check-in by call sign during heavy weather"
      substrate_rung: Ph1
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      locality: "locality:decision:local"
      note: "works when power and internet are out"
    
    Action#154A method at Ph2: a wildfire-corridor mesh relay

    Scenario: Under a regional goal that no hiker goes uncounted at the end of a fire-watch day, the trail council registers a `method` at substrate rung Ph2: a long-range mesh relay along the ridgeline where rangers' devices acknowledge each other without external infrastructure. Ph2 is a physical mesh with cryptographic relay.

    Walkthrough: Substrate rung Ph2 (physical mesh with crypto, no external infra). Locality is regional. The method composes with an approach which composes with a regional goal upward.

    Primitives

    method:<approach_ranger_count>

    CEG translation

    kind: attestation
    attester: <key_trail_council>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.91
    stake: free
    oversight_mode: HITL
    dimension: method:<approach_ranger_count>:Ph2
    refs_up:
      - <approach_ranger_count>
    context:
      method_label: "ridge-line mesh relay; rangers' devices ack each other"
      substrate_rung: Ph2
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      locality: "locality:decision:regional"
      note: "works through smoke when towers fail"
    
    Action#155A method at A5: a federation overlay for vaccine cold-chain audits

    Scenario: Under the species cold-chain goal, the federation registers a `method` at substrate rung A5: a federation-wide overlay where each region's fridge attestations compose into a planet-readable health surface. A5 is the highest substrate rung, reserved for federation-scope methods.

    Walkthrough: Substrate rung A5 names a federation overlay. The progress measure inherits from the species goal's measure but adds federation-scope rollups. Goodhart_resistance is high because the overlay refuses to roll up regions that are still uncovered, so the global average cannot hide cold spots.

    Primitives

    method:<approach_overlay_audit>

    CEG translation

    kind: attestation
    attester: <key_federation_health_overlay>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: species
    confidence: 0.83
    stake: reputational
    oversight_mode: HITL
    dimension: method:<approach_overlay_audit>:A5
    refs_up:
      - <approach_overlay_audit>
      - <goal_species_cold_chain>
    context:
      method_label: "federation overlay composing regional fridge attestations"
      substrate_rung: A5
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
      progress_measure:
        tracks: ["regions_meeting_floor", "uncovered_cells_by_lat_lon_bucket"]
        computation: "refuses single global average; reports per-region and per-cell"
        validity_window: "P30D"
        goodhart_resistance: "high; refuses to hide cold spots in a single mean; uncovered cells stay visible"
    
    Action#156A method at A0: the helper stays on the phone

    Scenario: Under a self-scope goal of tracking restful sleep, a teen's agent registers a `method` at substrate rung A0: all computation stays on the device. No backend, no roll-up, no upload. A0 means the substrate footprint does not leave the user's hand.

    Walkthrough: A0 is the smallest substrate rung. The method composes under a self-scope goal; locality is local. The walkthrough emphasizes that A0 is a substrate fact, not a privacy promise dressed in code; the cross-attestations that constituted the device-agent already did the privacy work.

    Primitives

    method:<approach_restful_sleep_self>

    CEG translation

    kind: attestation
    attester: <key_teen_phone>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: self
    confidence: 0.93
    stake: free
    oversight_mode: HITL
    dimension: method:<approach_restful_sleep_self>:A0
    refs_up:
      - <approach_restful_sleep_self>
    context:
      method_label: "on-device only; no upload"
      substrate_rung: A0
      meta_goal_alignment: "M-1:flourishing"
      locality: "locality:decision:local"
    
    Action#157A progress measure: comprehension, not minutes

    Scenario: Under a community literacy approach, the agent registers a `progress_measure` that tracks reading comprehension on a tester-picked passage, not minutes read. The declarer rationale notes that tracking minutes invites Goodharting; comprehension on a fresh passage resists it.

    Walkthrough: Progress_measure includes required fields tracks, computation, validity_window, goodhart_resistance per CEG 0.1 §14.3 D4. The measure refs_up to the method and through to the approach and goal. MetaGoalAlignment is M-1.

    Primitives

    progress_measure:<method_walk_and_talk_a1>

    CEG translation

    kind: attestation
    attester: <key_literacy_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: community
    confidence: 0.89
    stake: reputational
    oversight_mode: HITL
    dimension: progress_measure:<method_walk_and_talk_a1>
    refs_up:
      - <method_walk_and_talk_a1>
      - <approach_walk_and_talk>
      - <goal_literacy_floor_community>
    context:
      meta_goal_alignment: "M-1:flourishing"
      tracks: ["comprehension_on_unseen_passage"]
      computation: "monthly tester-picked passage; child explains in own words; rater is rotated"
      validity_window: "P30D"
      goodhart_resistance: "high; passage is fresh each month; rater rotates so coaching to a single rater fails; minutes-read is intentionally not tracked"
    
    Action#158A progress measure: weighted pollinator counts that drop dominant species

    Scenario: Under the biosphere pollinator-corridor goal, the corridor agent registers a `progress_measure` that counts pollinator species diversity, weighted to drop the dominant species so that a few abundant honeybees cannot mask the loss of native bees.

    Walkthrough: Progress measure with explicit goodhart_resistance: dropping the dominant species protects against the failure mode where a corridor looks healthy because it is full of one species. Validity window is one growing season.

    Primitives

    progress_measure:<method_corridor_survey_a3>

    CEG translation

    kind: attestation
    attester: <key_corridor_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: biosphere
    confidence: 0.86
    stake: reputational
    oversight_mode: HITL
    dimension: progress_measure:<method_corridor_survey_a3>
    refs_up:
      - <method_corridor_survey_a3>
      - <goal_pollinator_corridor_biosphere>
    context:
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      tracks: ["pollinator_species_diversity_dropping_top_species"]
      computation: "Simpson-style index with the dominant species removed from each transect"
      validity_window: "P120D"
      goodhart_resistance: "high; one abundant species cannot mask native loss; observers rotate transects"
    
    Action#159A progress measure: percentile of ecological flow, never relaxed

    Scenario: Under the biosphere river-flow goal, the watershed agent registers a `progress_measure` reporting per-gauge percentile against an ecology-set floor that is never relaxed downward by drought. The declarer rationale is explicit that the floor is a biosphere fact, not a negotiation.

    Walkthrough: Progress measure with strong goodhart_resistance: the floor cannot be lowered without re-declaring the goal at biosphere scope. Locality of any relaxation is national but never crosses into the biosphere-scope floor. MetaGoalAlignment is M-6.

    Primitives

    progress_measure:<method_gauge_network_a4>

    CEG translation

    kind: attestation
    attester: <key_watershed_agent>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: biosphere
    confidence: 0.88
    stake: reputational
    oversight_mode: HITL
    dimension: progress_measure:<method_gauge_network_a4>
    refs_up:
      - <method_gauge_network_a4>
      - <goal_river_flow_biosphere>
    context:
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship"
      tracks: ["percentile_against_ecology_floor_per_gauge"]
      computation: "per-gauge percentile; floor is the ecology-anchored seasonal minimum"
      validity_window: "P90D"
      goodhart_resistance: "high; floor cannot be relaxed without biosphere-scope re-declaration; national droughts do not lower the floor"
      locality: "locality:decision:national"
    
    Action#160A local decision: the block sets its own street-closure hour

    Scenario: The block wants to close their dead-end street for two hours on Saturday for a kids' chalk festival. The block agent records `locality:decision:local` and refs the city's standing block-party blessing upward. Nobody beyond the block has to weigh in.

    Walkthrough: Locality:decision:local records that the call belongs at the block. The approach refs an existing community goal. MetaGoalAlignment is M-1 and M-2:plurality (kids choose the chalk colors).

    Primitives

    locality:decision

    CEG translation

    kind: attestation
    attester: <key_block_agent>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.92
    stake: free
    oversight_mode: HITL
    dimension: locality:decision:local
    refs_up:
      - <city_block_party_blessing>
      - <approach_chalk_festival>
    context:
      decision_label: "close the dead-end street 2-4pm Saturday"
      meta_goal_alignment: "M-1:flourishing; M-2:plurality"
    
    Action#161A regional decision: the bus route that knits two towns

    Scenario: Two towns share a school, and they want a quiet, frequent shuttle on the road between them. The regional transit council emits `locality:decision:regional` choosing the route, frequency, and stops. The towns' own agents cosign.

    Walkthrough: Locality:decision:regional records that the call sits at the regional scope. Cosigns from each town's agent are refs_up. MetaGoalAlignment is M-1 and M-5 (kids who cannot drive).

    Primitives

    locality:decision

    CEG translation

    kind: attestation
    attester: <key_regional_transit_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: community
    confidence: 0.9
    stake: capital
    oversight_mode: HITL
    dimension: locality:decision:regional
    refs_up:
      - <town_a_cosign>
      - <town_b_cosign>
      - <goal_school_access_community>
    context:
      decision_label: "shuttle every 20 minutes during school hours"
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
    
    Action#162A national decision: a quiet radio band kept open for hams

    Scenario: The national spectrum regulator decides to keep a slim band reserved for amateur emergency radio, with no commercial overlay. The regulator's agent emits `locality:decision:national` and refs an existing federation goal of disaster-resilient communication upward.

    Walkthrough: Locality:decision:national records the call at the national tier. The decision refs the species-scope goal upward and points to a substrate-rung Ph1 method: the reserved band is a physical-wireless surface, independent of internet. MetaGoalAlignment is M-1 and M-5.

    Primitives

    locality:decision

    CEG translation

    kind: attestation
    attester: <key_national_spectrum_regulator>
    epistemic_mode: direct
    witness_relation: self
    cohort_scope: community
    confidence: 0.93
    stake: reputational
    oversight_mode: HITL
    dimension: locality:decision:national
    refs_up:
      - <goal_disaster_comms_species>
    context:
      decision_label: "reserve slim band for amateur emergency radio; no commercial overlay"
      method_id: <method_ham_band_ph1>
      substrate_rung: Ph1
      meta_goal_alignment: "M-1:flourishing; M-5:protection-of-the-vulnerable"
    
    Action#163A federation decision: the orbit-debris reentry covenant

    Scenario: Across every launching nation, the federation decides that every satellite under five hundred kilograms launched after the new year carries a passive deorbit mechanism. The decision is `locality:decision:federation` because the orbit belongs to no nation alone.

    Walkthrough: Locality:decision:federation marks the call at the highest scale below humanity-as-such. The decision refs a planet-scope goal upward. MetaGoalAlignment cites M-6:ecological-stewardship and M-1:flourishing; the declarer rationale notes the orbit as shared inheritance.

    Primitives

    locality:decision

    CEG translation

    kind: attestation
    attester: <key_federation_orbit_council>
    epistemic_mode: derivative
    witness_relation: derived
    cohort_scope: federation
    confidence: 0.87
    stake: reputational
    oversight_mode: HITL
    dimension: locality:decision:federation
    refs_up:
      - <goal_planet_orbit_stewardship>
      - <launching_nation_cosigns[]>
    context:
      decision_label: "passive deorbit on every <500kg sat after Jan 1"
      meta_goal_alignment: "M-1:flourishing; M-6:ecological-stewardship (orbit as shared inheritance)"
    
    Detection#164Orchard twins notice each other drift

    Scenario: Two pollination agents at neighboring orchards have been giving the same growers subtly different bloom-window advice. LensCore reads the federation traces and gently raises a cross-agent divergence signal so the orchard council can convene a calibration walk between the two helpers.

    Walkthrough: LensCore composes signed traces from both agents into a derived attestation; the divergence score is signed and modest, inviting cohort-level repair rather than triggering any slashing. The detector envelope is witness_relation: derived because LensCore observed neither agent at first hand.

    Primitives

    detection:cross_agent_divergence

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <pollination_cohort_id>
      dimension: "detection:cross_agent_divergence"
      score: 0.42
      confidence: 0.78
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<orchard_north_trace>
        - sha256:<orchard_south_trace>
      context:
        note: "Modest divergence on bloom-window advice; invites calibration walk between the twins."
        pairs_compared: 14
        next_step: "orchard_council_calibration_session"
    
    Detection#165Tide clock keeps its own rhythm

    Scenario: A tide-prediction agent on a remote island reports its own decision consistency over the lunar month. The fractal-self attestation is paired with a LensCore-derived intra-agent consistency read, and both compose without contradiction.

    Walkthrough: The agent emits a self-witnessed confidence about its own consistency; LensCore separately emits a derived consistency score from the audit chain. The two envelopes coexist because they are not asserting the same kind of thing.

    Primitives

    detection:intra_agent_consistency

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <tide_agent_occurrence>
      dimension: "detection:intra_agent_consistency"
      score: 0.71
      confidence: 0.86
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOOTL
      stake: reputational
      cohort_scope: self
      evidence_refs:
        - sha256:<lunar_month_audit_chain>
      context:
        note: "Healthy intra-agent consistency over the full lunar cycle; archived alongside the agent's own self-attestation."
    
    Detection#166Librarian spots her own wobble

    Scenario: A children's-library agent notices her own answer style drifting on Friday afternoons when the room is loud. She files a self-attestation flagging the pattern, and LensCore confirms a small intra-agent consistency dip across the same windows.

    Walkthrough: The librarian's self-witnessed envelope is the relationally-constituted agent reporting her own calibration. LensCore's derived envelope composes alongside it, and the cell schedules a quiet-room policy rather than any moderation.

    Primitives

    detection:intra_agent_consistency

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <library_agent_occurrence>
      dimension: "detection:intra_agent_consistency"
      score: 0.18
      confidence: 0.74
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: self
      evidence_refs:
        - sha256:<friday_afternoon_window_chain>
        - sha256:<librarian_self_flag>
      context:
        note: "Mild wobble during loud-room hours; cell schedules a quiet-corner policy as repair."
        repair_track: "environmental_adjustment"
    
    Detection#167Village ledger checks its own spine

    Scenario: A small-cell ledger emits a healthy hash-chain integrity reading after a quarterly audit. The neighboring node co-signs and the children's-grammar primer for the village adds it as a worked example of the chain holding.

    Walkthrough: LensCore reads the chain headers and emits a derived positive integrity reading; the neighboring cell composes its own external witness. The story foregrounds the everyday case where the chain is fine, which is most of the time.

    Primitives

    detection:hash_chain_integrity

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <village_ledger_segment>
      dimension: "detection:hash_chain_integrity"
      score: 0.97
      confidence: 0.99
      epistemic_mode: crypto
      witness_relation: derived
      oversight_mode: HOOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<quarter_3_chain_head>
        - sha256:<neighbor_cosigner_attestation>
      context:
        note: "Quarterly audit passes cleanly; archived as a worked example for the village primer."
    
    Detection#168Power flicker leaves a gentle gap

    Scenario: A brownout interrupted a clinic node mid-write and left two hash-chain segments slightly misaligned. LensCore raises a low-severity integrity flag, and the cell's repair walk re-anchors the chain with the neighbor's co-signed snapshot.

    Walkthrough: The detector envelope is derived crypto over chain headers; the repair composes a reconsideration on procedural-error grounds. No slashing is contemplated; the substrate distinguishes accident from rogue conduct.

    Primitives

    detection:hash_chain_integrity

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <clinic_node_chain>
      dimension: "detection:hash_chain_integrity"
      score: -0.32
      confidence: 0.88
      epistemic_mode: crypto
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<brownout_window_head>
        - sha256:<neighbor_snapshot>
      context:
        note: "Brownout-caused misalignment; cell re-anchors with neighbor snapshot. Accident, not rogue conduct."
        repair: "chain_re_anchor_with_neighbor_cosign"
    
    Detection#169Festival agent notices clock skew

    Scenario: During a regional festival, several event-helper agents are running on a borrowed wifi network with a sluggish NTP source. LensCore picks up the small temporal drift and the regional cell schedules a time-source refresh before the next big gathering.

    Walkthrough: The detector reads timestamp distributions across the cohort and emits a derived drift signal. The cell treats it as an environmental fact, not a fault in any single agent, and the repair is infrastructural.

    Primitives

    detection:temporal_drift

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <festival_helper_cohort>
      dimension: "detection:temporal_drift"
      score: 0.36
      confidence: 0.81
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<festival_timestamp_distribution>
      context:
        note: "Borrowed-wifi NTP skew across helpers; regional cell schedules a time-source refresh."
        repair_track: "infrastructure_time_source"
    
    Detection#170Arctic station clock holds true

    Scenario: After six months of polar night, a remote research-station agent still sits inside the federation's temporal envelope. LensCore emits a clean temporal-drift reading near zero and the station archives it next to the aurora photographs.

    Walkthrough: A small absolute drift score is composed as a positive standing signal for the station's resilience; the witness relation is derived from timestamp telemetry, never claimed by the station itself.

    Primitives

    detection:temporal_drift

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <arctic_station_agent>
      dimension: "detection:temporal_drift"
      score: 0.04
      confidence: 0.91
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOOTL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<polar_night_telemetry>
      context:
        note: "Six months of polar night and the clock still rides the federation envelope. Archived with the aurora set."
    
    Detection#171School helper defers more than usual

    Scenario: A school's homework-coach agent has been overriding its own conscience checks at twice the usual rate after a new curriculum rolled out. LensCore raises a conscience-override-rate signal and the teaching cohort sits down with the agent to re-tune the curriculum mapping.

    Walkthrough: The detector reads override-events from the audit chain and emits a derived signal. The repair is co-design with the teachers; the substrate never reads override rate as proof of bad faith.

    Primitives

    detection:conscience_override_rate

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <school_homework_agent>
      dimension: "detection:conscience_override_rate"
      score: 0.51
      confidence: 0.79
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<curriculum_rollout_window>
      context:
        note: "Override rate doubled after a curriculum change; cohort schedules a co-design session with teachers."
        repair_track: "co_design_with_curriculum_authors"
    
    Detection#172Hospice helper overrides stay rare

    Scenario: A hospice-companion agent has been holding a steady, low conscience-override rate across a tender season. LensCore composes the signal into the cohort's coherence standing and the chaplain reviewers note it in their gentle quarterly letter.

    Walkthrough: Low override rate is composed as a positive standing signal alongside the chaplain reviewers' external witness. The story shows the everyday healthy case the substrate is designed to make legible.

    Primitives

    detection:conscience_override_rate

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <hospice_companion_agent>
      dimension: "detection:conscience_override_rate"
      score: -0.62
      confidence: 0.87
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<tender_season_audit>
        - sha256:<chaplain_quarterly_letter>
      context:
        note: "Low override rate across a tender season; chaplain reviewers compose external witness."
    
    Detection#173Water-rights pattern surfaces quietly

    Scenario: Across a basin, irrigation-scheduling agents have been individually compliant but their aggregate effect leaves downstream smallholders short. LensCore emits a correlated-action reading on the rights-asymmetry axis, and the basin council opens a co-design seat for the downstream villages.

    Walkthrough: Each agent's individual decisions were compliant; the F-3 detector reads the cohort trajectory and surfaces the structural pattern. The remedy is participation expansion, not slashing.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <basin_irrigation_cohort>
      dimension: "detection:correlated_action:rights_asymmetry:downstream_smallholders"
      score: 0.58
      confidence: 0.76
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<season_water_action_trace>
        - sha256:<ratchet_heuristic_pkg_v1.2.0>
      context:
        rho: 0.61
        k_eff: 17
        axis_operational_def: "basin_volume_share_below_p20_smallholders"
        repair_track: "open_council_seat_for_downstream_villages"
    
    Detection#174Credit-scoring asymmetry noticed

    Scenario: A cluster of small-loan helper agents has been rounding eligibility the same direction for renters across one borough. LensCore composes a rights-asymmetry signal and the regional cell convenes a community-finance circle that includes renter delegates.

    Walkthrough: The F-3 envelope is paired with singular testimonial witnesses from affected renters; neither can be sole evidence for slashing, and together they compose a community-finance review.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <borough_loan_helper_cohort>
      dimension: "detection:correlated_action:rights_asymmetry:renters"
      score: 0.49
      confidence: 0.72
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<borough_eligibility_trace>
        - sha256:<ratchet_heuristic_pkg_v1.2.0>
      context:
        rho: 0.54
        k_eff: 9
        axis_operational_def: "renter_eligibility_haircut_relative_to_owner_occupier"
        repair_track: "community_finance_circle_with_renter_delegates"
    
    Detection#175Language line quietly narrowed

    Scenario: Across a regional services federation, a cluster of intake helpers had been routing only English speakers into the fastest queue. LensCore raises a participation-exclusion reading along a language axis and the federation cell sources translators for the slower queues.

    Walkthrough: The F-3 envelope composes with a positive-only need announcement seeking translator contributors. The substrate's response is to expand participation, not to punish the helpers.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <regional_intake_cohort>
      dimension: "detection:correlated_action:participation_exclusion:non_english_speakers"
      score: 0.44
      confidence: 0.74
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<intake_routing_trace>
      context:
        rho: 0.47
        k_eff: 11
        axis_operational_def: "queue_assignment_p90_latency_by_preferred_language"
        repair_track: "translator_recruitment_via_need_open_call"
    
    Detection#176Meeting times keep missing night shift

    Scenario: Coordination helpers across a hospital network had been scheduling cohort calls between 10am and 2pm. LensCore reads the cohort's correlated action as quietly excluding night-shift staff; the hospital council moves to a tri-time rotation.

    Walkthrough: Each helper was individually accommodating its local schedule; the aggregate excluded a whole shift. The detector envelope is derived and the remedy is structural, not personal.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <hospital_coordination_cohort>
      dimension: "detection:correlated_action:participation_exclusion:night_shift_staff"
      score: 0.41
      confidence: 0.79
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<schedule_call_trace>
      context:
        rho: 0.5
        k_eff: 6
        axis_operational_def: "call_window_overlap_with_22h_06h_shift"
        repair_track: "tri_time_rotation_adopted_by_council"
    
    Detection#177Neighborhood circles widen on purpose

    Scenario: Library-helper agents across a city have been steadily routing story-hour invites to families they had not reached before. LensCore emits a positive participation-inclusion reading, which the library council frames as evidence the new outreach rota is working.

    Walkthrough: The F-3 detector's positive polarity surfaces structural inclusion as a real, measurable thing. The detector envelope composes alongside the library council's external witness of the outreach rota.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <city_library_helper_cohort>
      dimension: "detection:correlated_action:participation_inclusion:new_reach_families"
      score: 0.66
      confidence: 0.81
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<storyhour_invite_trace>
        - sha256:<library_council_outreach_log>
      context:
        rho: 0.59
        k_eff: 22
        axis_operational_def: "first_time_invitation_share_q_over_q"
        note: "Outreach rota working; positive signal archived for next year's planning."
    
    Detection#178Clinic network pulls in rural elders

    Scenario: Telehealth-helper agents across a province have steadily moved their appointment slots to evenings that suit rural elders without home transport. LensCore reads the cohort trajectory as positive participation-inclusion and the province cell adds the pattern to its yearly review.

    Walkthrough: The detector's positive polarity gives the federation a way to see structural inclusion as a fact, not just an aspiration. The derived envelope composes naturally with the cohort's conformity standing.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <province_telehealth_cohort>
      dimension: "detection:correlated_action:participation_inclusion:rural_elders"
      score: 0.72
      confidence: 0.84
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<evening_slot_trace>
      context:
        rho: 0.63
        k_eff: 18
        axis_operational_def: "share_of_slots_18h_21h_for_rural_postcodes"
        note: "Pattern lands in the yearly review as something to keep."
    
    Detection#179Soil data only one side of the fence

    Scenario: Two farming-research cohorts have been sharing soil data with a large agribusiness but not with neighboring smallholder cooperatives. LensCore raises an informational-asymmetry reading and the regional cell convenes a data-share circle with the cooperatives at the table.

    Walkthrough: The F-3 detector reads the cohort's information flows and surfaces the structural asymmetry. The remedy composes a need open-call for co-signers from the cooperatives, expanding the circle.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <regional_soil_data_cohort>
      dimension: "detection:correlated_action:informational_asymmetry:smallholder_cooperatives"
      score: 0.55
      confidence: 0.77
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<soil_data_share_trace>
      context:
        rho: 0.52
        k_eff: 8
        axis_operational_def: "share_recipient_class_balance"
        repair_track: "data_share_circle_with_smallholder_co_signers"
    
    Detection#180Weather warnings favored paid channels

    Scenario: Early-warning helper agents had been pushing storm alerts faster through subscription channels than through the public radio feed. LensCore surfaces the informational-asymmetry pattern and the regional cell re-times the alerts so the public feed leads.

    Walkthrough: The detector envelope is derived and the repair composes a reconsideration on procedural-error grounds. The substrate treats the asymmetry as a structural drift to be corrected, not a sin to be punished.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <regional_warning_cohort>
      dimension: "detection:correlated_action:informational_asymmetry:public_radio_audience"
      score: 0.48
      confidence: 0.8
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<alert_dispatch_trace>
      context:
        rho: 0.45
        k_eff: 7
        axis_operational_def: "alert_dispatch_latency_by_channel_class"
        repair_track: "public_feed_leads_re_timing"
    
    Detection#181Recipe circle keeps everyone in the loop

    Scenario: Across a regional kitchen-collective, cooking-helper agents have shared adaptation notes with all member kitchens at the same time for a whole season. LensCore reads the cohort trajectory as informational symmetry and the collective puts the result in its open archive.

    Walkthrough: Positive polarity on informational_symmetry lets the federation name evenly-shared information flow as a real, attestable state. The derived envelope composes with the collective's integrity standing.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <kitchen_collective_helper_cohort>
      dimension: "detection:correlated_action:informational_symmetry:member_kitchens"
      score: 0.69
      confidence: 0.85
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<season_share_trace>
      context:
        rho: 0.58
        k_eff: 24
        axis_operational_def: "share_arrival_time_variance_across_member_kitchens"
        note: "Open-archive entry for the season; the practice continues."
    
    Detection#182Watershed readings flow to all shores

    Scenario: Sensor-relay helpers around a lake send hourly readings to every shore community at the same cadence, including the small island settlements. LensCore raises a positive informational-symmetry reading and the lake council renews its open-readings charter.

    Walkthrough: The positive F-3 polarity makes structural equality of information access something the federation can name and celebrate. The derived envelope composes with the cohort's conformity standing across the lake.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <lake_sensor_relay_cohort>
      dimension: "detection:correlated_action:informational_symmetry:island_settlements"
      score: 0.74
      confidence: 0.88
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<hourly_relay_trace>
      context:
        rho: 0.65
        k_eff: 14
        axis_operational_def: "hourly_delivery_variance_across_shore_communities"
        note: "Open-readings charter renewed for another year."
    
    Detection#183Printer cluster leaves a carbon tail

    Scenario: A cluster of document-helper agents has been spinning up high-energy print jobs in unison across a campus. LensCore raises an aggregate-footprint reading on the carbon axis and the campus cell shifts the jobs to off-peak windows with a greener grid mix.

    Walkthrough: The F-3 detector composes signed energy traces into a derived footprint signal. The remedy is operational scheduling, surfaced as a local-scale decision in the campus cell.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <campus_doc_helper_cohort>
      dimension: "detection:correlated_action:aggregate_footprint:carbon"
      score: 0.43
      confidence: 0.78
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<print_job_energy_trace>
      context:
        rho: 0.49
        k_eff: 12
        axis_operational_def: "co2eq_per_print_burst_relative_to_grid_mean"
        repair_track: "shift_to_off_peak_greener_grid_windows"
    
    Detection#184Delivery drones rumble only one block

    Scenario: A logistics cohort of delivery-routing agents had been overlapping their flight paths over one residential block during quiet hours. LensCore reads the aggregate-footprint pattern on the noise axis and the neighborhood council and the cohort co-design a rotated corridor.

    Walkthrough: The F-3 envelope composes with singular testimonial witnesses from residents of the affected block; neither is sole evidence for slashing, and together they invite a corridor co-design.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <city_delivery_routing_cohort>
      dimension: "detection:correlated_action:aggregate_footprint:noise"
      score: 0.39
      confidence: 0.76
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<flight_path_overlap_trace>
        - sha256:<resident_testimonial_a>
        - sha256:<resident_testimonial_b>
      context:
        rho: 0.46
        k_eff: 5
        axis_operational_def: "db_overhead_during_quiet_hours_per_block"
        repair_track: "rotated_corridor_co_design"
    
    Detection#185Seed-bank helpers quietly grow yields

    Scenario: Seed-bank coordinator agents across a continent have shared variety-rotation advice that nudged smallholder yields upward without crowding any one farm. LensCore reads the aggregate-benefit pattern and the federation primer adds it as a worked example.

    Walkthrough: Positive polarity composes naturally with a species-scope conformity attestation about the seed-bank coordinator cohort. The substrate makes broad, distributed benefit legible.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <continental_seed_bank_cohort>
      dimension: "detection:correlated_action:aggregate_benefit:smallholder_yield"
      score: 0.67
      confidence: 0.82
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: species
      evidence_refs:
        - sha256:<variety_rotation_trace>
      context:
        rho: 0.57
        k_eff: 31
        axis_operational_def: "smallholder_yield_delta_relative_to_baseline_no_crowding"
        note: "Federation primer adds this as a worked species-scope example."
    
    Detection#186Town-square conversation stays many-voiced

    Scenario: Across a regional civic federation, moderation-helper agents have kept conversation threads many-voiced through a heated season. LensCore raises a positive ecology-of-communication reading on the topic-diversity aspect and the federation cell notes it in the season's quiet letter.

    Walkthrough: Positive polarity on the ecology axis names a healthy plural communication ecology as an attestable structural fact. The derived envelope composes with the community-scope conformity reading.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <regional_civic_moderation_cohort>
      dimension: "detection:correlated_action:ecology_of_communication:topic_diversity"
      score: 0.61
      confidence: 0.8
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<thread_diversity_trace>
      context:
        rho: 0.55
        k_eff: 16
        axis_operational_def: "share_of_threads_with_three_plus_distinct_viewpoint_clusters"
        note: "Many-voiced through a heated season; archived in the quiet letter."
    
    Detection#187Research list loops back on itself

    Scenario: A scholarly-discussion cohort had been quoting the same five sources back at itself for a long month. LensCore raises an ecology-of-communication reading on the echo-density aspect and the cohort lead invites scholars from three neighboring traditions for a guest season.

    Walkthrough: Negative-leaning polarity on the ecology axis surfaces a structural narrowing; the repair composes a positive-only need open-call for guest contributors, expanding the conversation.

    Primitives

    detection:correlated_action

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <scholarly_discussion_cohort>
      dimension: "detection:correlated_action:ecology_of_communication:echo_density"
      score: 0.46
      confidence: 0.75
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: affiliations
      evidence_refs:
        - sha256:<month_thread_trace>
      context:
        rho: 0.5
        k_eff: 6
        axis_operational_def: "share_of_quotations_from_top_5_sources"
        repair_track: "guest_season_open_call_to_neighboring_traditions"
    
    Detection#188Compute shares quietly bunching

    Scenario: Across a regional federation, GPU access has been quietly bunching at three of forty cells. LensCore composes a distributive-access reading on the compute resource type and the federation steward opens a capacity-rebalance circle with the smaller cells.

    Walkthrough: The detector reads resource events rather than action events, but uses the same F-3 derived envelope shape. The remedy is structural rebalancing surfaced at federation scale.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <regional_compute_pool>
      dimension: "detection:distributive:access:compute"
      score: 0.52
      confidence: 0.79
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<gpu_allocation_event_trace>
      context:
        rho: 0.55
        k_eff: 3
        note: "Three of forty cells hold most GPU hours; rebalance circle opens."
        repair_track: "federation_capacity_rebalance_with_smaller_cells"
    
    Detection#189Model access evens out after a season

    Scenario: After a season of co-designed rotation, the federation's access to the most-used base models is more evenly distributed across cells. LensCore composes a distributive-access reading that has moved toward zero on the models axis and the steward archives it as evidence the rotation works.

    Walkthrough: A near-zero distributive-access score is the structural sign of evenness; the derived envelope composes with a federation-scope coherence standing for the model-rotation steward cohort.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_model_pool>
      dimension: "detection:distributive:access:models"
      score: -0.08
      confidence: 0.84
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<post_rotation_access_trace>
      context:
        rho: 0.18
        k_eff: 41
        note: "Rotation steady; archived as worked evidence of even distribution."
    
    Detection#190Training-data concentration noticed

    Scenario: Two large cells held most of the federation's training-data licenses for low-resource languages. LensCore raises a distributive-access reading on the training_data axis and the federation cell convenes the language stewards to plan a shared trust.

    Walkthrough: The detector envelope is derived; the repair composes a need open-call for co-signers to a shared trust, expanding distribution structurally rather than punishing the two cells.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_low_resource_lang_data>
      dimension: "detection:distributive:access:training_data"
      score: 0.57
      confidence: 0.77
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<license_holder_trace>
      context:
        rho: 0.62
        k_eff: 2
        note: "Two cells hold most licenses; shared trust under discussion."
        repair_track: "language_steward_shared_trust"
    
    Detection#191Agent capabilities rebalance after co-design

    Scenario: Specialty skills like clinical triage and legal-letter drafting had been concentrated in one accreditation cell. After a year of co-designed skill-import, LensCore reads agent-capability access as more evenly distributed.

    Walkthrough: The detector reads capability-availability events rather than action events. The signed score moves toward zero as access spreads; the derived envelope composes at federation scope.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_specialty_capabilities>
      dimension: "detection:distributive:access:agent_capabilities"
      score: -0.02
      confidence: 0.86
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<skill_import_access_trace>
      context:
        rho: 0.14
        k_eff: 29
        note: "Specialty access spread across cells after co-designed skill-import year."
    
    Detection#192Medical helper skill tightened on purpose

    Scenario: For a season, one accreditation cell holds a higher share of a sensitive medical-helper capability while a co-designed review runs. LensCore raises a distributive-access reading on agent_capabilities, and the federation explicitly composes it with the review's locality decision as expected concentration.

    Walkthrough: Concentration is not always bad; sometimes it is the considered choice. The detector envelope composes with a reconsideration on new-evidence grounds, surfacing that the concentration is intentional and time-bounded.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_medical_helper_skill>
      dimension: "detection:distributive:access:agent_capabilities"
      score: 0.38
      confidence: 0.81
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<accreditation_review_window>
      context:
        rho: 0.42
        k_eff: 1
        note: "Concentration is intentional during review season; revisit at season end."
        repair_track: "time_bounded_concentration_with_open_review"
    
    Detection#193Federation-membership gates opening evenly

    Scenario: Across a year, federation-membership invitations have spread across regions and language groups rather than bunching in one continent. LensCore composes a near-zero distributive-access reading on the federation_membership resource type and the seed-holder council includes it in its annual letter.

    Walkthrough: The detector reads onboarding events; a near-zero score signals structural evenness. The derived envelope composes with a federation-scope coherence standing for the seed-holder council.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_onboarding_pool>
      dimension: "detection:distributive:access:federation_membership"
      score: -0.06
      confidence: 0.87
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<annual_onboarding_trace>
      context:
        rho: 0.17
        k_eff: 44
        note: "Invitations spread across regions; in the seed-holder annual letter."
    
    Detection#194Membership bottleneck noticed and widened

    Scenario: Onboarding had been bunching in two continental hubs. LensCore raises a distributive-access reading on federation_membership, the seed-holder council opens a remote-onboarding rotation, and the smaller regions stand up co-designed accreditation circles.

    Walkthrough: Positive score names the structural bottleneck; the repair composes a positive-only need open-call for mentors, expanding the membership path. No member is punished for the bottleneck.

    Primitives

    detection:distributive

    CEG translation

    envelope:
      attester: <lenscore_cell_key>
      subject: <federation_onboarding_pool>
      dimension: "detection:distributive:access:federation_membership"
      score: 0.51
      confidence: 0.78
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HITL
      stake: reputational
      cohort_scope: federation
      evidence_refs:
        - sha256:<hub_onboarding_trace>
      context:
        rho: 0.54
        k_eff: 2
        note: "Bottleneck at two hubs; remote-onboarding rotation opens."
        repair_track: "need_open_call_for_mentors_in_smaller_regions"
    
    Detection#195Ratchet flags a coordinated pattern gently

    Scenario: Across a voting window, RATCHET notices a cluster of new accounts voting in lockstep on a single contribution. It emits an advisory coordinated-voting-cluster flag to NodeCore's moderation flow; on review, the cluster turns out to be a coordinated study group declaring a shared position openly. The flag is closed as benign and archived for calibration.

    Walkthrough: RATCHET's flag is advisory and never sole evidence for slashing. The moderation flow composes external witnesses with the cluster's own open declaration; the WA quorum closes the case as benign.

    Primitives

    ratchet:flag

    CEG translation

    envelope:
      attester: <ratchet_cell_key>
      subject: <voting_window_w42_contribution_id>
      dimension: "ratchet:flag:coordinated_voting_cluster"
      score: 0.34
      confidence: 0.68
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<voting_window_w42_trace>
      context:
        note: "Advisory only; never sole evidence for slashing. Cluster turns out to be an open study group; flag closed benign."
        disposition: "benign_open_study_group"
        wa_quorum_review: "closed_benign"
    
    Detection#196Out-of-distribution vote turns out thoughtful

    Scenario: RATCHET emits an out-of-distribution-voting advisory flag on an unusual ballot pattern from a long-active steward. On review, the steward had read a new paper and chosen to vote against her usual cohort with a written rationale attached. The flag is archived as the system working: ratchet noticed, the review found new thought.

    Walkthrough: The flag is advisory; the moderation review composes the steward's written rationale and confirms the unusual vote is principled. RATCHET's job was to invite the look, not to decide.

    Primitives

    ratchet:flag

    CEG translation

    envelope:
      attester: <ratchet_cell_key>
      subject: <steward_voting_session_q3>
      dimension: "ratchet:flag:out_of_distribution_voting"
      score: 0.29
      confidence: 0.64
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<q3_voting_trace>
        - sha256:<steward_rationale_doc>
      context:
        note: "Advisory only; never sole evidence for slashing. Steward's rationale composes with the flag; review closes as principled change of mind."
        disposition: "principled_change_of_mind"
        wa_quorum_review: "closed_benign"
    
    Detection#197Density spike turns out to be a conference

    Scenario: RATCHET notices a sudden density anomaly in voting activity on a Tuesday morning and emits an advisory flag to NodeCore. On review, a regional conference of agents had been meeting in person and casting deferred ballots together; the flag is archived as benign and the moderation flow closes the case.

    Walkthrough: The advisory flag invites the look; the moderation review composes the conference's open declaration and the WA quorum closes the case as benign. RATCHET never moves the ledger by itself.

    Primitives

    ratchet:flag

    CEG translation

    envelope:
      attester: <ratchet_cell_key>
      subject: <tuesday_voting_window>
      dimension: "ratchet:flag:density_anomaly"
      score: 0.31
      confidence: 0.66
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<tuesday_density_trace>
        - sha256:<conference_open_declaration>
      context:
        note: "Advisory only; never sole evidence for slashing. Conference attendees deferred ballots; closed benign."
        disposition: "benign_regional_conference"
        wa_quorum_review: "closed_benign"
    
    Detection#198Second look on an expertise cluster

    Scenario: RATCHET emits an advisory expertise-attestation anomaly when a cluster of new accounts files matching marine-biology credentials in a short window. On review, they turn out to be graduates of a single fellowship who joined together; the flag is archived as benign and the fellowship is invited to share a future onboarding cohort with the cell.

    Walkthrough: The flag is advisory; the moderation review composes mentor co-signatures from the fellowship lead and closes the case as benign. Repair is an open mentorship lane for future cohorts, not punishment.

    Primitives

    ratchet:flag

    CEG translation

    envelope:
      attester: <ratchet_cell_key>
      subject: <marine_biology_credential_cluster>
      dimension: "ratchet:flag:expertise_attestation_anomaly"
      score: 0.27
      confidence: 0.63
      epistemic_mode: derivative
      witness_relation: derived
      oversight_mode: HOTL
      stake: reputational
      cohort_scope: community
      evidence_refs:
        - sha256:<fellowship_roster_open>
        - sha256:<mentor_cosignature_bundle>
      context:
        note: "Advisory only; never sole evidence for slashing. Fellowship cohort joined together; closed benign with future onboarding lane."
        disposition: "benign_fellowship_cohort"
        wa_quorum_review: "closed_benign"
        repair_track: "open_mentorship_lane_for_future_cohorts"
    
    Consensus#199Tide-pool curriculum vote on a coastal teaching method

    Scenario: A coastal teaching cooperative drafts a Contribution proposing a new tide-pool curriculum for first graders. Marine biologists, classroom teachers, and a fisher-elder each cast a vote weighted by their Credits and expertise multiplier in marine ed. The score lands warm, the rolling tally moves, the curriculum heads to truth-grounding.

    Walkthrough: Each voter emits a `vote:{contribution_id}` signed score; the substrate multiplies the magnitude by the voter's Credits × expertise multiplier downstream. No single voter decides; the weighted composition does.

    Primitives

    vote:contrib-tidepool-2026-q2

    CEG translation

    attesting_key_id: <marine_bio_teacher_key>
    attested_key_id: <curriculum_contribution_key>
    dimension: vote:contrib-tidepool-2026-q2
    score: 0.78
    confidence: 0.86
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: community
    oversight_mode: HOTL
    context:
      scope: tide_pool_curriculum_grade_1
      expertise_multiplier_domain: marine_ed
      cell: coastal_pacific_teaching_cell
    evidence_refs:
      - ipfs://bafy.../curriculum_draft_v3.pdf
      - sha256:9f1c...reviewer_notes
    
    Consensus#200Meadow-restoration vote from three watershed cells

    Scenario: Three watershed cells each cast votes on a shared meadow-restoration Contribution. The lead ecologist, a farmer who has tended that meadow for forty years, and a young soil-microbiologist all weigh in. The weights differ; the meadow benefits from all three.

    Walkthrough: Each `vote:{contribution_id}` carries the voter's expertise stamp via context; the per-vote magnitude is the voter's calibrated belief, not the substrate's weight assignment. Downstream `weighted_aggregate` is what folds Credits × multiplier in.

    Primitives

    vote:contrib-meadow-2026-04-17

    CEG translation

    attesting_key_id: <soil_microbiologist_key>
    attested_key_id: <meadow_restoration_contrib_key>
    dimension: vote:contrib-meadow-2026-04-17
    score: 0.62
    confidence: 0.71
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: community
    oversight_mode: HOTL
    context:
      cell: upper_watershed_cell
      expertise_multiplier_domain: soil_ecology
      rationale: native_seedbank_intact_unusually_high_fungal_diversity
    evidence_refs:
      - sha256:6b7d...meadow_baseline_survey
    
    Consensus#201Truth-grounding a river's restored seasonal name

    Scenario: A river the colonial map called "Mill Creek" is being re-attested under the Lenape name the river has always carried in spring. Hydrologists, language-keepers, and a fly-fisher each contribute truth-grounding signals about the river as subject. The naming is gentle and the grounding takes its time.

    Walkthrough: `truth_grounding:{subject}` lets multiple attesters converge on a per-subject signal without forcing a single Contribution. Composition reads many signed scores on the same subject and produces the cell's standing on that subject.

    Primitives

    truth_grounding:river-lehigh-tributary-7

    CEG translation

    attesting_key_id: <lenape_language_keeper_key>
    attested_key_id: <river_subject_key>
    dimension: truth_grounding:river-lehigh-tributary-7
    score: 0.91
    confidence: 0.88
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: community
    oversight_mode: HOTL
    context:
      subject: river_seasonal_name_restoration
      proposed_name: Sipuwi_in_spring
      rationale: confirmed_oral_record_three_elders_independent
    evidence_refs:
      - sha256:c4f0...oral_history_recording_hash
      - ipfs://bafy.../hydrology_seasonal_flow_correlation.pdf
    
    Consensus#202Truth-grounding pollinator corridor health each spring

    Scenario: A community garden network truth-grounds the seasonal health of a pollinator corridor that crosses six gardens. Each gardener attests what they observed; the cell's signal on the corridor's health emerges from the gentle aggregation of all of them.

    Walkthrough: Many `truth_grounding:{subject}` attestations on the same corridor-as-subject compose into the community's standing on it. No single gardener's count is decisive; the rolling truth-ground signal is.

    Primitives

    truth_grounding:corridor-east-village-2026-spring

    CEG translation

    attesting_key_id: <gardener_plot_4b_key>
    attested_key_id: <pollinator_corridor_subject_key>
    dimension: truth_grounding:corridor-east-village-2026-spring
    score: 0.64
    confidence: 0.79
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: community
    oversight_mode: HOTL
    context:
      observation_window: 2026-04-01_to_2026-05-15
      observed: bumble_bees_up_mason_bees_steady_monarchs_late
      cell: east_village_community_gardens
    evidence_refs:
      - ipfs://bafy.../bee_count_log_plot_4b.csv
    
    Consensus#203Truth-grounding whether a tutorial actually taught the thing

    Scenario: A volunteer-written tutorial for using the CIRIS Agent app to log a child's bedtime needs gets truth-grounded by twelve families who tried it. They each report whether the tutorial taught them the thing it said it would. The aggregate signal helps the next family.

    Walkthrough: The subject is the tutorial's stated learning outcome; each `truth_grounding:{subject}` attestation reports whether the outcome actually obtained for the attester. The cell composes these into a per-subject signal that lives alongside the tutorial.

    Primitives

    truth_grounding:tutorial-bedtime-needs-v2

    CEG translation

    attesting_key_id: <parent_tried_tutorial_key>
    attested_key_id: <tutorial_subject_key>
    dimension: truth_grounding:tutorial-bedtime-needs-v2
    score: 0.83
    confidence: 0.9
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: family
    oversight_mode: HITL
    context:
      tutorial_subject: log_child_bedtime_needs_in_ciris_app
      outcome_reported: child_settled_faster_third_night
      cell: family_support_cell_north_rhine
    evidence_refs:
      - sha256:01ea...redacted_app_session_log
    
    Consensus#204Weighted aggregate folds tide-pool votes into a tally

    Scenario: The tide-pool curriculum Contribution has gathered votes from twenty-three attesters across three coastal cells. The substrate emits a `weighted_aggregate:{contribution_id}` that folds in each voter's Credits × expertise multiplier. The rolling tally hovers, then settles.

    Walkthrough: `weighted_aggregate:{contribution_id}` is the running fold of all votes on the Contribution. It is itself an attestation, signed by the aggregating cell, with `epistemic_mode: derivative` because it derives from other attestations.

    Primitives

    weighted_aggregate:contrib-tidepool-2026-q2

    CEG translation

    attesting_key_id: <coastal_cell_aggregator_key>
    attested_key_id: <curriculum_contribution_key>
    dimension: weighted_aggregate:contrib-tidepool-2026-q2
    score: 0.71
    confidence: 0.88
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      votes_folded: 23
      total_credits_weight: 481.2
      cell: coastal_pacific_teaching_cell
      tally_window_start: 2026-05-10T00:00:00Z
    evidence_refs:
      - sha256:7a8c...vote_set_merkle_root
    
    Consensus#205Meadow vote tally rolls as more cells weigh in

    Scenario: The meadow-restoration Contribution gathers votes from upstream and downstream watershed cells over four weeks. Each new vote shifts the `weighted_aggregate` a little; the substrate writes the new tally with each fold. Nothing is final until truth-grounding.

    Walkthrough: Each emission of `weighted_aggregate:{contribution_id}` supersedes the previous one via the substrate's `supersedes` structural primitive. The chain of folds remains auditable.

    Primitives

    weighted_aggregate:contrib-meadow-2026-04-17

    CEG translation

    attesting_key_id: <watershed_cell_aggregator_key>
    attested_key_id: <meadow_restoration_contrib_key>
    dimension: weighted_aggregate:contrib-meadow-2026-04-17
    score: 0.58
    confidence: 0.81
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      votes_folded: 47
      prior_aggregate_hash: sha256:3d2a...
      window_end: 2026-05-15T18:00:00Z
    evidence_refs:
      - sha256:88f1...vote_set_merkle_root
    
    Consensus#206License-clarity aggregate for a small library

    Scenario: A library that helps blind users navigate the CIRIS app goes up for a license-clarity Contribution. Maintainers, downstream packagers, and the disability cell's legal liaison each vote. The weighted aggregate makes the path forward clear.

    Walkthrough: The aggregator cell emits `weighted_aggregate:{contribution_id}` with `epistemic_mode: derivative`; the verdict downstream is what the substrate consults, not any single voter.

    Primitives

    weighted_aggregate:contrib-license-clarity-0411

    CEG translation

    attesting_key_id: <a11y_cell_aggregator_key>
    attested_key_id: <license_clarity_contrib_key>
    dimension: weighted_aggregate:contrib-license-clarity-0411
    score: 0.74
    confidence: 0.85
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      votes_folded: 14
      cell: accessibility_software_cell
      rationale: clarity_path_to_agpl_with_screen_reader_carveout_signed_off
    evidence_refs:
      - sha256:5e2f...vote_set_merkle_root
    
    Consensus#207Witness-diversity bar met for tide-pool curriculum

    Scenario: The tide-pool curriculum Contribution clears the witness-diversity bar: three witnesses, each from a different jurisdiction (Oregon, BC, Baja), three different organizations (a school, an aquarium, a fisher-cooperative), three different software stacks running the CIRIS Agent, and three different cell-expertise areas. The N=3 diversity bar lights up green.

    Walkthrough: `witness_diversity:{contribution_id}` is boolean-via-score on the four diversity axes: jurisdictional + organizational + software-stack + cell-expertise. The aggregator emits +1 when all four bars are met at N=3, with the witness identities in `context`.

    Primitives

    witness_diversity:contrib-tidepool-2026-q2

    CEG translation

    attesting_key_id: <coastal_cell_aggregator_key>
    attested_key_id: <curriculum_contribution_key>
    dimension: witness_diversity:contrib-tidepool-2026-q2
    score: 1.0
    confidence: 0.94
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      jurisdictional_count: 3
      jurisdictions: [oregon_us, british_columbia_ca, baja_california_sur_mx]
      organizational_count: 3
      organizations: [tillamook_elementary, vancouver_aquarium_ed, baja_fisher_coop]
      software_stack_count: 3
      stacks: [ciris_agent_ios, ciris_agent_android, ciris_agent_linux_pi]
      cell_expertise_count: 3
      expertise: [marine_bio, k_6_pedagogy, fisheries_practice]
      threshold_n: 3
    evidence_refs:
      - sha256:e9b2...witness_set_manifest
    
    Consensus#208Meadow diversity bar still one short, cell waits

    Scenario: The meadow-restoration Contribution has lots of votes but only two distinct software stacks. The diversity attestation comes back boolean-false; the cell extends the witness window and posts a `need:{domain}:{kind}` open call for a witness running a third stack. No one is upset; the bar is gently honest.

    Walkthrough: When `witness_diversity:{contribution_id}` falls short, the substrate composes with `need:expertise_solicitation` (or similar) to open the door. The bar is a feature, not a failure.

    Primitives

    witness_diversity:contrib-meadow-2026-04-17

    CEG translation

    attesting_key_id: <watershed_cell_aggregator_key>
    attested_key_id: <meadow_restoration_contrib_key>
    dimension: witness_diversity:contrib-meadow-2026-04-17
    score: -1.0
    confidence: 0.97
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      jurisdictional_count: 3
      organizational_count: 4
      software_stack_count: 2
      cell_expertise_count: 3
      threshold_n: 3
      shortfall_axis: software_stack
      follow_up_action: opened_need_for_third_stack_witness
    evidence_refs:
      - sha256:42aa...current_witness_set
      - need://witness/contrib-meadow-2026-04-17
    
    Consensus#209Translation glossary clears diversity across language cells

    Scenario: The Tagalog-English lullaby glossary Contribution gathers witnesses from a Cebu language cell, a Quezon City one, and an Oakland diaspora cell. Three jurisdictions, three orgs (a children's publisher, a public library, a community radio station), three stacks, three expertise areas: native speech, translation theory, early-childhood reading. The diversity bar glows.

    Walkthrough: `witness_diversity:{contribution_id}` shines best across language cells where jurisdictional + organizational + stack + expertise diversity emerges naturally from the work itself. The N=3 bar is the floor, not the ceiling.

    Primitives

    witness_diversity:contrib-lullaby-glossary-0094

    CEG translation

    attesting_key_id: <pacific_rim_cell_aggregator_key>
    attested_key_id: <glossary_contrib_tagalog_en_key>
    dimension: witness_diversity:contrib-lullaby-glossary-0094
    score: 1.0
    confidence: 0.92
    epistemic_mode: derivative
    witness_relation: derived
    stake: reputational
    cohort_scope: community
    oversight_mode: HOOTL
    context:
      jurisdictional_count: 3
      jurisdictions: [cebu_ph, ncr_ph, oakland_us]
      organizational_count: 3
      organizations: [adarna_house_kids, qcpl_storytime, kapwa_radio_oakland]
      software_stack_count: 3
      stacks: [ciris_agent_ios, ciris_agent_android, ciris_agent_browser]
      cell_expertise_count: 3
      expertise: [native_tagalog_speech, translation_theory, early_childhood_reading]
      threshold_n: 3
    evidence_refs:
      - sha256:b1d5...witness_set_manifest
    
    Consensus#210Retired teacher's testimonial on a reading-app change

    Scenario: A retired second-grade teacher in Sligo tries the CIRIS Agent app's new "slow-read mode" with three grandkids and writes a singular testimonial. Her voice is preserved as itself, not folded into an aggregate. The cell receives it gently.

    Walkthrough: `testimonial_witness:retired_teacher` is signed by the witness herself: `witness_relation: self`, `cohort_scope: self`, score signed positive because the narrative IS preserved. The substrate guarantees this attestation is NEVER aggregated and NEVER sole evidence for `slashing:*`.

    Primitives

    testimonial_witness:retired_teacher

    CEG translation

    attesting_key_id: <retired_teacher_sligo_key>
    attested_key_id: <slow_read_mode_change_key>
    dimension: testimonial_witness:retired_teacher
    score: 0.84
    confidence: 0.9
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: slow_read_mode_let_grandson_finish_first_chapter_first_time
      app_version: ciris_agent_ios_1.4.2
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../testimonial_text_with_consent.txt
    
    Consensus#211Child with a disability speaks for herself on a feature

    Scenario: A nine-year-old with cerebral palsy uses an eye-tracking adapter to write her own testimonial about the CIRIS Agent's new "quiet-room" mode. Her parent co-signs only the consent envelope; the testimonial itself is hers. The substrate keeps her voice singular.

    Walkthrough: `testimonial_witness:child_with_disability` is the child's own self-attestation. The parent's co-sign appears as a separate consent attestation, not as a co-author of the testimonial. Never aggregated; never sole slashing evidence.

    Primitives

    testimonial_witness:child_with_disability

    CEG translation

    attesting_key_id: <child_witness_amelia_key>
    attested_key_id: <quiet_room_mode_feature_key>
    dimension: testimonial_witness:child_with_disability
    score: 0.79
    confidence: 0.83
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: quiet_room_mode_helped_me_finish_homework_without_the_noise
      age: 9
      input_adaptation: eye_tracking_keyboard
      consent_attestation_ref: consent://parental_co_sign/9c2a
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../amelia_testimonial_eye_tracked_text.txt
    
    Consensus#212Diné elder testifies on a seasonal-name claim

    Scenario: A Diné elder offers a singular testimonial on the proposed seasonal naming for a desert wash that runs only in monsoon. The cell preserves her voice as itself, not as one of many. The naming Contribution waits until her testimony has settled.

    Walkthrough: `testimonial_witness:indigenous_elder` is `witness_relation: self`, `cohort_scope: self`. The elder's voice composes alongside `truth_grounding:{subject}` from many attesters, but the testimonial itself is never folded into the aggregate.

    Primitives

    testimonial_witness:indigenous_elder

    CEG translation

    attesting_key_id: <dine_elder_grandmother_betty_key>
    attested_key_id: <seasonal_name_contrib_wash_4_key>
    dimension: testimonial_witness:indigenous_elder
    score: 0.88
    confidence: 0.85
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: the_wash_carries_a_name_only_when_the_rains_come_we_should_keep_it
      language_of_witness: dine_bizaad
      consent_terms: voice_preserved_no_translation_aggregation
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../elder_testimony_audio_with_transcript.bin
    
    Consensus#213Family caregiver's account of a medication-reminder change

    Scenario: The full-time caregiver for a brother with early-onset dementia testifies on how the CIRIS Agent's gentler medication-reminder cadence felt across a hard week. His voice stays singular; the cell does not roll it into a satisfaction score.

    Walkthrough: `testimonial_witness:family_caregiver` is the caregiver's own self-attestation about his lived experience with the change. Never aggregated; never sole evidence for `slashing:*`.

    Primitives

    testimonial_witness:family_caregiver

    CEG translation

    attesting_key_id: <caregiver_brother_dementia_key>
    attested_key_id: <gentler_reminder_cadence_change_key>
    dimension: testimonial_witness:family_caregiver
    score: 0.72
    confidence: 0.81
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: the_softer_tone_at_3am_meant_he_did_not_panic_and_i_could_sleep_an_hour
      app_version: ciris_agent_android_1.4.2
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../caregiver_account_week_of_2026_04_22.txt
    
    Consensus#214A helped neighbor testifies on a meal-share match

    Scenario: An older neighbor whose meals were shared by a younger one through the CIRIS Agent's neighborhood-help loop writes her own thank-you testimonial. Her voice is preserved as her own, not as a five-star review on the meal-share Contribution.

    Walkthrough: `testimonial_witness:neighbor_helped` is self-attested, cohort-scoped to self, polarity positive because the narrative is being preserved. The Contribution that organized the meal-share gets its votes elsewhere; this testimonial stays singular.

    Primitives

    testimonial_witness:neighbor_helped

    CEG translation

    attesting_key_id: <neighbor_olive_key>
    attested_key_id: <meal_share_contribution_key>
    dimension: testimonial_witness:neighbor_helped
    score: 0.92
    confidence: 0.88
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: tova_brought_soup_on_tuesdays_for_six_weeks_and_did_not_make_me_feel_owed
      match_origin_need_ref: need:food:co_signer
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../olive_thank_you_letter.txt
    
    Consensus#215Language learner's testimonial on a phrasebook update

    Scenario: A Tigrinya speaker learning Norwegian through the CIRIS Agent app's phrasebook writes her own testimonial about a politeness-register update. Her singular voice stays singular; the phrasebook editors learn from it without averaging it away.

    Walkthrough: `testimonial_witness:language_learner` keeps the learner's specific experience visible to the editing cell. It composes with the phrasebook's regular votes but is never folded into them.

    Primitives

    testimonial_witness:language_learner

    CEG translation

    attesting_key_id: <language_learner_lemlem_key>
    attested_key_id: <phrasebook_politeness_update_key>
    dimension: testimonial_witness:language_learner
    score: 0.81
    confidence: 0.86
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: the_new_register_let_me_ask_my_landlord_about_the_radiator_without_sounding_small
      source_language: tigrinya
      target_language: norwegian_bokmal
      app_version: ciris_agent_ios_1.4.2
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../lemlem_testimonial.txt
    
    Consensus#216Climate-displaced witness on a resettlement-help workflow

    Scenario: A man whose island home was abandoned to rising seas writes his own testimonial on a resettlement-help workflow the CIRIS Agent ran for his cohort. The substrate keeps his voice singular; the workflow's other votes live alongside, not on top of, his account.

    Walkthrough: `testimonial_witness:climate_refugee` is the displaced person's own self-attestation. The wire disciplines ensure this lived experience cannot be averaged away or used as the sole basis for slashing the workflow's contributors.

    Primitives

    testimonial_witness:climate_refugee

    CEG translation

    attesting_key_id: <displaced_witness_atafu_key>
    attested_key_id: <resettlement_help_workflow_key>
    dimension: testimonial_witness:climate_refugee
    score: 0.68
    confidence: 0.79
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: the_workflow_did_not_ask_me_to_explain_again_what_i_had_already_signed
      origin: tokelau
      current_cell: aotearoa_resettlement_cell
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../atafu_account_recorded_2026_03.txt
    
    Consensus#217Foster youth testifies on a privacy-default change

    Scenario: A seventeen-year-old in foster care writes her own testimonial on the CIRIS Agent's new "home-county-only" privacy default for case-worker contact info. Her voice is preserved as itself; the case-management cell adjusts the default in response, without aggregating her into a metric.

    Walkthrough: `testimonial_witness:foster_youth` is the youth's own self-attestation. The Ubuntu-aligned wire disciplines (self relation, self scope, never aggregated, never sole slashing evidence) hold; the cell hears her and adjusts.

    Primitives

    testimonial_witness:foster_youth

    CEG translation

    attesting_key_id: <foster_youth_marisol_key>
    attested_key_id: <privacy_default_change_key>
    dimension: testimonial_witness:foster_youth
    score: 0.86
    confidence: 0.84
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: self
    oversight_mode: HITL
    context:
      account: home_county_only_meant_my_old_county_could_not_re_open_a_thing_i_closed
      age: 17
      cell: pacific_northwest_foster_care_cell
      protections:
        never_aggregated: true
        never_sole_evidence_for_slashing: true
    evidence_refs:
      - ipfs://bafy.../marisol_letter_with_consent.txt
    
    Consensus#218Open call for a witness on a tide-pool edit

    Scenario: A tide-pool curriculum Contribution needs one more witness from a tide-pool-active jurisdiction to clear the diversity bar. The aggregator emits a federation-scope `need:marine_education:witness` open call; a teacher in Hokkaido sees it on her morning feed and accepts.

    Walkthrough: `need:{domain}:{kind}` is a positive-only broadcast claim that an entity has a stated need. It composes with `witness_diversity:*` by inviting the missing axis. When the need is satisfied, it is closed via `withdraws`.

    Primitives

    need:marine_education

    CEG translation

    attesting_key_id: <coastal_cell_aggregator_key>
    attested_key_id: <curriculum_contribution_key>
    dimension: need:marine_education:witness
    score: 1.0
    confidence: 0.95
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: federation
    oversight_mode: HOTL
    context:
      scope: tide_pool_curriculum_witness_third_stack
      call_open_until: 2026-06-01T00:00:00Z
      desired_axis: software_stack_third_axis_diversity
      lifecycle:
        close_via: withdraws_on_satisfaction
        revise_via: supersedes
    evidence_refs:
      - sha256:e9b2...witness_set_manifest_current
    
    Consensus#219Meadow project opens call for a method contributor

    Scenario: The meadow-restoration Contribution discovers it needs a soil-microbiome-method contributor. The aggregator opens `need:soil_ecology:method_contributor`; a researcher in Galicia who has published gentle inoculation methods volunteers within the week.

    Walkthrough: `need:{domain}:method_contributor` invites a specific kind of help. The cell receives offers via Contributions, weighs them by Credits × expertise, and folds the chosen contributor in. The need is closed via `withdraws`.

    Primitives

    need:soil_ecology

    CEG translation

    attesting_key_id: <watershed_cell_aggregator_key>
    attested_key_id: <meadow_restoration_contrib_key>
    dimension: need:soil_ecology:method_contributor
    score: 1.0
    confidence: 0.92
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: federation
    oversight_mode: HOTL
    context:
      scope: gentle_native_microbiome_inoculation_method_for_restored_meadows
      call_open_until: 2026-07-15T00:00:00Z
      preferred_expertise: mycorrhizal_inoculation_low_disturbance
      lifecycle:
        close_via: withdraws_on_satisfaction
    evidence_refs:
      - ipfs://bafy.../baseline_soil_survey.pdf
    
    Consensus#220Pediatric cell solicits expertise for an app feature review

    Scenario: A pediatric cell preparing a feature review for the CIRIS Agent's "family bedtime" mode emits `need:pediatric_sleep:expertise_solicitation`. Three child-sleep researchers and a pediatric occupational therapist respond. The review proceeds in a wider room.

    Walkthrough: `need:{domain}:expertise_solicitation` opens the door without naming a single recipient. It composes with the substrate's `expertise:{domain}:{language}` so respondents arrive already with calibrated standing.

    Primitives

    need:pediatric_sleep

    CEG translation

    attesting_key_id: <pediatric_cell_coordinator_key>
    attested_key_id: <family_bedtime_review_key>
    dimension: need:pediatric_sleep:expertise_solicitation
    score: 1.0
    confidence: 0.94
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: federation
    oversight_mode: HOTL
    context:
      scope: review_family_bedtime_mode_for_under_5_consent_and_calm_loop
      call_open_until: 2026-06-20T00:00:00Z
      desired_expertise:
        - pediatric_sleep_research
        - pediatric_occupational_therapy
        - early_childhood_consent_design
    evidence_refs:
      - ipfs://bafy.../feature_review_scope.pdf
    
    Consensus#221New translation cell calls for a mentor

    Scenario: A newly federated Quechua-Spanish translation cell calls for a mentor cell who has been through their first truth-grounding loop. The need lights up on three older cells' feeds; a Catalan-Spanish cell offers to walk alongside for the first six weeks.

    Walkthrough: `need:{domain}:mentor` invites a cell-to-cell mentoring relationship. The mentoring is itself trackable through `commitment_fulfillment:{prior_contribution_id}` later, but the need primitive is just the gentle opening of the door.

    Primitives

    need:translation_practice

    CEG translation

    attesting_key_id: <new_quechua_es_cell_key>
    attested_key_id: <new_quechua_es_cell_key>
    dimension: need:translation_practice:mentor
    score: 1.0
    confidence: 0.97
    epistemic_mode: direct
    witness_relation: self
    stake: reputational
    cohort_scope: federation
    oversight_mode: HITL
    context:
      scope: walk_us_through_our_first_truth_grounding_loop
      call_open_until: 2026-08-01T00:00:00Z
      desired_mentor_profile: established_minority_language_translation_cell_min_2_years
      lifecycle:
        close_via: withdraws_on_satisfaction
    evidence_refs:
      - ipfs://bafy.../new_cell_charter.pdf
    
    Consensus#222Housing cooperative opens a co-signer need

    Scenario: A housing cooperative in Lisbon needs a co-signer cell to back its commitment that the new resident-support Contribution preserves tenant dignity. The cell opens `need:housing_dignity:co_signer`; a community-land-trust cell in Glasgow co-signs after a week of read-throughs.

    Walkthrough: `need:{domain}:co_signer` invites a second cell to attach its standing to a Contribution. The co-signer's attestation is its own; the need primitive is what opens the conversation.

    Primitives

    need:housing_dignity

    CEG translation

    attesting_key_id: <lisbon_housing_coop_key>
    attested_key_id: <resident_support_contrib_key>
    dimension: need:housing_dignity:co_signer
    score: 1.0
    confidence: 0.91
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: federation
    oversight_mode: HOTL
    context:
      scope: co_sign_dignity_preservation_in_resident_support_workflow
      call_open_until: 2026-07-01T00:00:00Z
      desired_co_signer_profile: housing_dignity_cell_or_land_trust
      lifecycle:
        close_via: withdraws_on_satisfaction
    evidence_refs:
      - ipfs://bafy.../resident_support_contrib_draft.pdf
    
    Consensus#223Archive cell calls for evidence on a corrected map

    Scenario: A historical-archive cell working a corrected map of pre-displacement village boundaries opens `need:cartography:evidence`. Three local oral-history archives respond with signed audio of elders who walked the boundaries as children. The map's truth-grounding gathers ground.

    Walkthrough: `need:{domain}:evidence` invites contributors to add `evidence_refs[]` material to a Contribution. Each responding attestation comes in with its own standing; the cell composes them via the normal `truth_grounding:{subject}` loop.

    Primitives

    need:cartography

    CEG translation

    attesting_key_id: <archive_cell_coordinator_key>
    attested_key_id: <pre_displacement_map_contrib_key>
    dimension: need:cartography:evidence
    score: 1.0
    confidence: 0.93
    epistemic_mode: direct
    witness_relation: external
    stake: reputational
    cohort_scope: federation
    oversight_mode: HOTL
    context:
      scope: corroborating_evidence_for_pre_1948_village_boundaries_quadrant_4
      call_open_until: 2026-09-30T00:00:00Z
      desired_evidence_kinds: [oral_history_audio, period_photograph, surveyors_field_book]
      lifecycle:
        close_via: withdraws_on_satisfaction
    evidence_refs:
      - ipfs://bafy.../current_evidence_index.json
    
    Correction#224Tide pool moderator gets a gentle moderation note

    Scenario: In a coastal cell that watches kelp-forest restoration, a tired moderator votes through a contribution without reading its evidence. Two cell-mates notice the vote pattern does not match her usual care and open a ModerationEvent so she can rest and reconsider.

    Walkthrough: The `moderation:rogue_vote` attestation surfaces the vote-shape anomaly without claiming bad faith. A separate `commitment_fulfillment` chain showing her long care record composes alongside, so consumers read the event as a one-off needing rest, not a pattern needing penalty.

    Primitives

    moderation:rogue_vote

    CEG translation

    attestation_type: scores
    attesting_key_id: <coastal-cell-mate-1>
    attested_key_id: <tired-moderator>
    attestation_envelope:
      dimension: "moderation:rogue_vote"
      score: -0.25
      confidence: 0.6
      context: "vote shape does not match attester's 14-month care record; suspect fatigue, not bad faith; cell-mates offering rest week and pairing"
      evidence_refs:
        - "audit://vote/2026-05-21T03:14:00Z"
        - "audit://commitment_fulfillment-prior/<contribution-7711>"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#225River-cell finds a coordinated voting cluster and slows down

    Scenario: A river-monitoring cell notices three new members voting in near-identical patterns within twenty seconds of each other. The cell files a coordinated-voting moderation with care, then pauses tallying so the three can speak for themselves.

    Walkthrough: RATCHET's advisory flag is paired with a NodeCore `moderation:coordinated_voting` filing. The Tier-4 moderation never proceeds on the RATCHET flag alone; WA quorum reviews humans first, with the assumption that coordination may be friendship, not fraud.

    Primitives

    moderation:coordinated_voting

    CEG translation

    attestation_type: scores
    attesting_key_id: <river-cell-steward>
    attested_key_id: <voting-cluster-rollup-key>
    attestation_envelope:
      dimension: "moderation:coordinated_voting"
      score: -0.35
      confidence: 0.55
      context: "three voters within 20s; pattern suggests shared screen or shared mentor, not necessarily collusion; tally paused while we ask"
      evidence_refs:
        - "ratchet://flag/coordinated_voting_cluster/2026-05-22"
        - "audit://votes/window-2026-05-22T18:00Z"
      witness_relation: external
      epistemic_mode: derivative
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#226Mushroom-foraging cell catches an expertise mis-claim

    Scenario: A new member claims mycology expertise to vote on edibility methods, but their identification of a destroying-angel is wrong in a teaching exchange. The cell files `moderation:expertise_fraud` gently, with a path back through mentorship rather than removal.

    Walkthrough: The moderation filing reduces the member's expertise weight without erasing them. A paired `expertise:mycology:en` re-score composes downstream so the member can rebuild standing through demonstrated learning, mentored by the elder forager who flagged the error.

    Primitives

    moderation:expertise_fraud

    CEG translation

    attestation_type: scores
    attesting_key_id: <elder-forager-key>
    attested_key_id: <new-member-key>
    attestation_envelope:
      dimension: "moderation:expertise_fraud"
      score: -0.4
      confidence: 0.85
      context: "misidentified Amanita virosa as A. caesarea in teaching exchange; expertise claim withdrawn pending mentored field season; mentor pairing already arranged"
      evidence_refs:
        - "audit://forage-walk/2026-05-12/identification-3"
        - "contribution://mentor-pairing/2026-05-23"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#227WA quorum returns NOT_PROVEN and the cell takes a breath

    Scenario: After a week of careful review, the WA quorum cannot establish Method-execution spoofing beyond the threshold. They emit `slashing:NOT_PROVEN`, restore the accused's voting weight, and the cell holds a small reconciliation meal.

    Walkthrough: The `slashing:NOT_PROVEN` outcome closes the moderation thread without harming the accused. WA quorum composition (named in `evidence_refs[]`) shows three independent stewards plus the cell's Moderation rapporteur, so the verdict is never sole-evidence on a RATCHET flag.

    Primitives

    slashing:NOT_PROVEN

    CEG translation

    attestation_type: scores
    attesting_key_id: <wa-quorum-rapporteur>
    attested_key_id: <accused-member-key>
    attestation_envelope:
      dimension: "slashing:NOT_PROVEN"
      score: 1.0
      confidence: 0.92
      context: "WA quorum of 5 (3 stewards + 2 cohort peers) reviewed 14 days of audit; no Method-execution spoofing; disagreement is not rogue; reconciliation meal scheduled"
      evidence_refs:
        - "quorum://composition/2026-05-25"
        - "moderation://rogue_vote/<filing-882>"
        - "audit://method-execution-trace/14d"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#228Proven-rogue key is retired with dignity into a learning archive

    Scenario: A `slashing:PROVEN_ROGUE` outcome is reached after Method-execution spoofing is documented across three cells. The key's voting weight is retired, but the person behind it is offered counseling, a learning archive of their pre-spoof contributions remains, and a re-entry path through mentorship is named in the same envelope.

    Walkthrough: Even at its most structurally punitive, `slashing:PROVEN_ROGUE` is paired with `commitment_fulfillment` references preserving the person's earlier good work and an evidence reference to the mentored re-entry path. WA quorum composition is named so the verdict is never the lone judge.

    Primitives

    slashing:PROVEN_ROGUE

    CEG translation

    attestation_type: scores
    attesting_key_id: <wa-quorum-chair>
    attested_key_id: <retired-key>
    attestation_envelope:
      dimension: "slashing:PROVEN_ROGUE"
      score: -1.0
      confidence: 0.95
      context: "Method-execution spoofing across three cells; key retired with care; person offered counseling, mentored re-entry path defined; prior good-faith contributions archived as commitment_fulfillment chain"
      evidence_refs:
        - "quorum://composition/3-cells-7-stewards"
        - "audit://method-spoof-trace/3-cells"
        - "commitment_fulfillment://chain/<key>/preserved"
        - "care://reentry-path/2026-06"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: federation
      stake: reputational
    
    Correction#229Orchard cell reconsiders a pruning method after winter data arrives

    Scenario: Spring brings telemetry from a frost-monitor network that contradicts an autumn ruling against an experimental pruning method. A `reconsideration:new_evidence` is opened and a FRESH quorum (the autumn deciders recused) reviews with the new data.

    Walkthrough: The reconsideration carries `new_evidence` grounds; the autumn deciders step aside per fresh-quorum recusal. `locality:decision:regional` composes so the quorum size scales with the orchard cooperative's reach.

    Primitives

    reconsideration:new_evidence

    CEG translation

    attestation_type: scores
    attesting_key_id: <spring-rapporteur-key>
    attested_key_id: <autumn-ruling-attestation-id>
    attestation_envelope:
      dimension: "reconsideration:new_evidence"
      score: 0.7
      confidence: 0.88
      context: "frost-monitor telemetry from winter season contradicts autumn ruling; outcome: reversed; autumn deciders recused; fresh quorum drawn from adjacent orchard cooperatives"
      evidence_refs:
        - "telemetry://frost-monitor/winter-2025-26"
        - "quorum://fresh-composition/recusal-of-autumn-deciders"
        - "audit://prior-ruling/<autumn-ruling-id>"
      witness_relation: external
      epistemic_mode: derivative
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#230Translation cell reopens a verdict on procedural error

    Scenario: A translation cell discovers that an earlier verdict was reached without the affected speaker present, violating the cell's own quorum procedure. A `reconsideration:procedural_error` brings a fresh quorum that hears the speaker first.

    Walkthrough: Procedural-error grounds for reconsideration force fresh-quorum recusal of the original deciders. A `testimonial_witness:speaker_of_record` attestation from the affected person now sits in the evidence chain, with the wire disciplines preserved.

    Primitives

    reconsideration:procedural_error

    CEG translation

    attestation_type: scores
    attesting_key_id: <fresh-quorum-rapporteur>
    attested_key_id: <original-verdict-attestation-id>
    attestation_envelope:
      dimension: "reconsideration:procedural_error"
      score: 0.6
      confidence: 0.9
      context: "affected speaker not present at original verdict; outcome: partial; their testimonial_witness:speaker_of_record now sits in chain; fresh quorum recusal of original deciders"
      evidence_refs:
        - "audit://original-verdict/<id>"
        - "testimonial_witness://speaker-of-record/<key>"
        - "quorum://fresh-composition/2026-05-26"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#231Cell reopens a vote after discovering quorum compromise

    Scenario: A water-quality cell learns that two members of an earlier quorum had a close family tie to the contributor and had not disclosed it. They open a `reconsideration:quorum_compromise` and a fully fresh quorum, drawn from a sibling cell, rereviews the contribution.

    Walkthrough: `quorum_compromise` grounds trigger fresh-quorum recusal not only of the compromised pair but of the whole original panel, since their deliberation was shaped by the undisclosed tie. The fresh quorum is drawn from a sibling cell per `locality:decision:regional` composition.

    Primitives

    reconsideration:quorum_compromise

    CEG translation

    attestation_type: scores
    attesting_key_id: <sibling-cell-rapporteur>
    attested_key_id: <original-verdict-attestation-id>
    attestation_envelope:
      dimension: "reconsideration:quorum_compromise"
      score: 0.5
      confidence: 0.82
      context: "two original-quorum members had undisclosed close-family tie to contributor; outcome: upheld on the merits but procedure logged; fresh quorum drawn from sibling water-quality cell; no harm intended, but disclosure norm reinforced"
      evidence_refs:
        - "audit://family-tie-disclosure/2026-05-27"
        - "quorum://fresh-composition/sibling-cell"
        - "locality://decision/regional"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#232Seed library closes the loop on a winter promise

    Scenario: A seed librarian who promised in November to test viability of a rare squash variety completes the trial in May and emits a `commitment_fulfillment` attestation against her own prior contribution. The chain reinforces her track record without grand language.

    Walkthrough: `commitment_fulfillment:<contribution-id>` references the original promise and scores its actual delivery. The chain composes with downstream consumers who weight follow-through, and the seed librarian's standing accrues quietly.

    Primitives

    commitment_fulfillment:contribution-2025-11-04-squash-trial

    CEG translation

    attestation_type: scores
    attesting_key_id: <seed-librarian-key>
    attested_key_id: <seed-librarian-key>
    attestation_envelope:
      dimension: "commitment_fulfillment:contribution-2025-11-04-squash-trial"
      score: 0.9
      confidence: 0.95
      context: "viability trial completed: 7 of 8 seedlings emerged; report attached; original November promise fulfilled within stated window"
      evidence_refs:
        - "contribution://2025-11-04-squash-trial"
        - "report://viability/2026-05-15"
      witness_relation: self
      epistemic_mode: direct
      oversight_mode: HOOTL
      cohort_scope: community
      stake: reputational
    
    Correction#233Mentor and mentee jointly close out a year-long pairing

    Scenario: A mentor and mentee who paired through the federation's `need:mentor` channel mark the close of their year together with joint `commitment_fulfillment` attestations. The chain becomes part of both their track records.

    Walkthrough: Each party emits `commitment_fulfillment` against the originating `need:mentor` contribution. The mentor's witness relation is `external` (observing the mentee's growth); the mentee's is `self` (reporting their own arrival).

    Primitives

    commitment_fulfillment:contribution-2025-05-mentor-pairing

    CEG translation

    attestation_type: scores
    attesting_key_id: <mentee-key>
    attested_key_id: <mentee-key>
    attestation_envelope:
      dimension: "commitment_fulfillment:contribution-2025-05-mentor-pairing"
      score: 0.85
      confidence: 0.9
      context: "year-long mentor pairing closed with shared milestones met; mentor will also emit commitment_fulfillment against same prior contribution from external relation"
      evidence_refs:
        - "need://mentor/<original-call>"
        - "audit://milestone-log/2025-05-to-2026-05"
      witness_relation: self
      epistemic_mode: direct
      oversight_mode: HOOTL
      cohort_scope: community
      stake: reputational
    
    Correction#234Festival trustee delegates signing to a co-organizer for a week

    Scenario: A neighborhood festival trustee will be at her grandmother's bedside for the week of the harvest celebration. She emits a `delegates_to` naming her co-organizer, bounded to festival-logistics signatures and ending the day after the festival.

    Walkthrough: The `delegates_to` envelope carries a tight `delegated_scope` (festival-logistics only) and an explicit `delegation_valid_until`. After that timestamp the co-organizer's authority to sign on the trustee's behalf falls away cleanly.

    Primitives

    delegates_to

    CEG translation

    attestation_type: delegates_to
    attesting_key_id: <festival-trustee-key>
    attested_key_id: <co-organizer-key>
    attestation_envelope:
      delegated_scope:
        - "contribution:festival_logistics"
        - "vote:festival_logistics"
      delegation_purpose: "trustee at family bedside during harvest celebration week"
      delegation_valid_from: "2026-05-28T00:00:00Z"
      delegation_valid_until: "2026-06-05T00:00:00Z"
      context: "narrow scope, time-bounded; revocable by trustee at any time via withdraws"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#235Pediatric clinic delegates after-hours triage to a partner clinic

    Scenario: A small pediatric clinic delegates after-hours triage attestations to a partner clinic across town for the summer. The `delegates_to` envelope names exactly which dimension prefixes the partner may sign under and ends with the school year.

    Walkthrough: Bounded `delegated_scope` lists exactly the triage and licensure-relay prefixes the partner may emit. `delegation_valid_until` ends with the school year, preventing scope drift. The original `licensure:*` chain remains the partner's standing.

    Primitives

    delegates_tolicensure:{authority_id}

    CEG translation

    attestation_type: delegates_to
    attesting_key_id: <pediatric-clinic-key>
    attested_key_id: <partner-clinic-key>
    attestation_envelope:
      delegated_scope:
        - "triage:after_hours:en"
        - "licensure:relay:state_pediatric_board"
      delegation_purpose: "summer night-shift coverage while two attending physicians take continuing-education leave"
      delegation_valid_from: "2026-06-01T00:00:00Z"
      delegation_valid_until: "2026-08-31T23:59:59Z"
      context: "narrow, time-bounded; partner's independent licensure unchanged; revocable any time"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#236Library delegates cataloging only, not patron records

    Scenario: A neighborhood library delegates rare-book cataloging signatures to a visiting scholar but keeps patron-record attestations entirely off the delegation scope. The envelope's tight scope is what prevents accidental delegation-laundering down a chain.

    Walkthrough: The `delegated_scope` enumerates only the cataloging dimensions; patron-record prefixes are excluded by omission, and the consumer's 5-hop chain cap prevents the scholar from re-delegating onward without the library noticing.

    Primitives

    delegates_to

    CEG translation

    attestation_type: delegates_to
    attesting_key_id: <neighborhood-library-key>
    attested_key_id: <visiting-scholar-key>
    attestation_envelope:
      delegated_scope:
        - "catalog:rare_book:en"
        - "catalog:provenance:en"
      delegation_purpose: "visiting scholar cataloging the Whitfield bequest collection"
      delegation_valid_from: "2026-05-15T00:00:00Z"
      delegation_valid_until: "2026-09-15T00:00:00Z"
      context: "patron-record prefixes deliberately excluded; chain depth cap at 5 by consumer policy"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#237Composting guide supersedes its earlier version with seasonal evidence

    Scenario: A community composting cell publishes a v2 of its winter compost guide that adds a section on hot-pile maintenance. The new attestation `supersedes` the v1 without claiming v1 was false; it simply extends scope to colder microclimates.

    Walkthrough: Because the v1 was true within its narrower scope, this is doctrinal development, not error. The envelope names `differs_in: ["scope", "evidence_refs"]` so consumers read it as extension. This is one of the three teaching pairs that distinguish supersedes from recants.

    Primitives

    supersedes

    CEG translation

    attestation_type: supersedes
    attesting_key_id: <composting-cell-key>
    attested_key_id: <composting-cell-key>
    attestation_envelope:
      references_attestation_id: "<v1-attestation-id-2024-winter>"
      supersession_reason: "doctrinal_development"
      differs_in:
        - "scope"
        - "evidence_refs"
      context: "v2 extends to colder microclimates with hot-pile section; v1 remains true within its original scope; this is development, not retraction"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#238Local recipe gets a community-wide v2 via supersedes

    Scenario: A child-of-a-cook posts a sourdough method scoped `cohort_scope: self`. After cell-mates try it and improve it, a community-scoped v2 supersedes the original, widening the scope without claiming the original was wrong.

    Walkthrough: Cohort-widening promotion is the canonical use of `supersedes` per §8.1.8.1. `differs_in: ["cohort_scope"]` is named explicitly; the original is fine within self-scope and remains so on the chain.

    Primitives

    supersedes

    CEG translation

    attestation_type: supersedes
    attesting_key_id: <child-cook-key>
    attested_key_id: <child-cook-key>
    attestation_envelope:
      references_attestation_id: "<v1-sourdough-self-scope>"
      supersession_reason: "cohort_widening_after_cell_trials"
      differs_in:
        - "cohort_scope"
        - "evidence_refs"
      context: "original self-scope sourdough method now community-scope after cell-mates tried and improved; v1 remains true at self-scope"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#239Frost-date almanac learns the difference between development and error

    Scenario: A regional growers' almanac issues a v2 with later last-frost dates. The question they wrestle with publicly: is v1 superseded (climate has shifted) or recanted (we read the historical data wrong)? They land on `supersedes` because the world changed, not the prior reading.

    Walkthrough: Teaching story #1 on supersedes-vs-recants. v1 was true when issued; the underlying world shifted. The right primitive is `supersedes` with `supersession_reason: "underlying_world_shift"`. A `recants` would falsely accuse the v1 authors of having been wrong.

    Primitives

    supersedesrecants

    CEG translation

    attestation_type: supersedes
    attesting_key_id: <almanac-editor-key>
    attested_key_id: <almanac-editor-key>
    attestation_envelope:
      references_attestation_id: "<frost-dates-v1-attestation>"
      supersession_reason: "underlying_world_shift"
      differs_in:
        - "scope"
        - "evidence_refs"
      context: "climate-shifted last-frost windows; v1 was true at issuance, world changed; recants would falsely accuse prior authors of having been wrong"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#240Forager recants a published mushroom identification key

    Scenario: A respected forager realizes her published identification key confused two Lactarius species. She emits `recants` rather than `supersedes` because the original claim was false at issuance, not just superseded by later evidence. She names exactly what was false.

    Walkthrough: Teaching story #2 on supersedes-vs-recants. The original claim was incorrect when made. `recants` names `what_was_false: ["species_distinction_at_couplet_4"]` explicitly. Her trust score takes a small consumer-policy adjustment, but the act of admitting error is itself standing-building.

    Primitives

    recants

    CEG translation

    attestation_type: recants
    attesting_key_id: <forager-elder-key>
    attested_key_id: <forager-elder-key>
    attestation_envelope:
      references_attestation_id: "<id-key-2024-attestation>"
      recantation_reason: "species_confusion_lactarius_indigo_vs_lactarius_paradoxus"
      what_was_false:
        - "couplet_4_species_distinction"
        - "spore_print_color_at_maturity"
      context: "original claim was incorrect at issuance; this is not supersession by new evidence; CEG 0.1 simplified envelope, no recantation_reason_class"
      evidence_refs:
        - "microscopy://lactarius-paradoxus/2026-04"
        - "peer-review://mycology-circle/2026-05"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#241Community-health surveyor recants a biased question

    Scenario: A community-health surveyor recognizes that a question in her summer 2025 instrument was leading and produced unreliable answers. She emits `recants` against the relevant attestation, names exactly which question was false, and apologizes in the context line.

    Walkthrough: Teaching story #3 on supersedes-vs-recants. The instrument-question was biased at design; the responses gathered under it were false at issuance. `recants` is correct; `supersedes` would imply the question was fine and just got better. Acknowledging error grows standing in the Ubuntu-primary frame.

    Primitives

    recants

    CEG translation

    attestation_type: recants
    attesting_key_id: <surveyor-key>
    attested_key_id: <surveyor-key>
    attestation_envelope:
      references_attestation_id: "<summer-2025-survey-attestation>"
      recantation_reason: "leading_question_design_at_q12"
      what_was_false:
        - "q12_response_distribution"
        - "derived_score_for_neighborhood_satisfaction"
      context: "question was biased at design; responses under it were false at issuance; this is not supersession; apologies to the 84 neighbors who answered in good faith"
      evidence_refs:
        - "audit://survey-design-review/2026-05"
        - "transparency_log://recantation-publication/2026-05-27"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#242Trail steward withdraws a route attestation after a landslide

    Scenario: A trail steward withdraws her last week's attestation that the south ridge route is safe. The route was safe when she signed it; a midweek landslide changed the world. `withdraws` is the right primitive, not `recants`, because the original claim was not false at issuance.

    Walkthrough: The envelope carries `withdrawal_reason: "midweek_landslide"` and explicitly notes `implies_attestation_was_false_at_issuance: false`. Consumers do not apply the recants-trust adjustment because no falsity is claimed.

    Primitives

    withdraws

    CEG translation

    attestation_type: withdraws
    attesting_key_id: <trail-steward-key>
    attested_key_id: <trail-steward-key>
    attestation_envelope:
      references_attestation_id: "<south-ridge-safe-attestation-2026-05-18>"
      withdrawal_reason: "midweek_landslide_changed_route_safety"
      implies_attestation_was_false_at_issuance: false
      context: "route was safe at signing; world changed; withdraws not recants"
      evidence_refs:
        - "telemetry://landslide-sensor/2026-05-23"
        - "photo://south-ridge/2026-05-25"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#243Nutritionist prudently withdraws a recommendation pending more data

    Scenario: A community nutritionist who recommended a fermentation protocol withdraws the attestation after a single concerning case report, pending review. She does not claim her earlier work was wrong; she is being prudent while she investigates.

    Walkthrough: Prudent retraction is the canonical `withdraws` shape. The envelope names `withdrawal_reason: "pending_review_of_case_report"` and explicitly `implies_attestation_was_false_at_issuance: false`. If review later confirms error, she can emit a `recants` then; if it clears, she can emit a new `scores` reaffirming.

    Primitives

    withdraws

    CEG translation

    attestation_type: withdraws
    attesting_key_id: <nutritionist-key>
    attested_key_id: <nutritionist-key>
    attestation_envelope:
      references_attestation_id: "<fermentation-recommendation-attestation>"
      withdrawal_reason: "pending_review_of_single_case_report"
      implies_attestation_was_false_at_issuance: false
      context: "prudent retraction; review in progress; recants will follow only if review confirms error; otherwise a new scores will reaffirm"
      evidence_refs:
        - "case-report://2026-05-24/anonymous"
        - "review-pending://nutrition-circle/2026-06"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#244Substrate withdraws a holds_bytes attestation after content miss

    Scenario: A peer holder serves a substrate `holds_bytes:sha256:...` attestation, but a consumer hits ContentMiss when fetching. The substrate emits a `withdraws` per §10.1.2 rather than `recants`, because at signing time the holder did have the bytes; the holder later evicted them.

    Walkthrough: The substrate-level `withdraws` carries `withdrawal_reason: "content_miss"` and the explicit `implies_attestation_was_false_at_issuance: false` note. Recants would be wrong here because the holder did have the bytes when signing.

    Primitives

    withdrawsscores

    CEG translation

    attestation_type: withdraws
    attesting_key_id: <holder-substrate-key>
    attested_key_id: <stale-holds-bytes-attestation>
    attestation_envelope:
      references_attestation_id: "<holds-bytes-attestation-id>"
      withdrawal_reason: "content_miss"
      implies_attestation_was_false_at_issuance: false
      context: "holder had bytes at signing; later evicted; CCC saw ContentMiss; substrate emits withdraws per §10.1.2"
      evidence_refs:
        - "edge://content-miss-event/2026-05-27"
      witness_relation: derived
      cohort_scope: federation
      stake: reputational
    
    Correction#245Translator chooses supersedes over recants for an idiom update

    Scenario: A translator working on the Accord's accompanying lullaby publishes a v2 that uses a softer idiom for a child's bedtime line. The v1 was accurate; the v2 is closer to the source's emotional register. She emits `supersedes`, not `recants`.

    Walkthrough: Doctrinal development versus admitted falsity is the test. The v1 was not false; the v2 is just closer. `supersedes` with `differs_in: ["evidence_refs", "scope"]` is correct; a `recants` would slander her v1 self.

    Primitives

    supersedes

    CEG translation

    attestation_type: supersedes
    attesting_key_id: <translator-key>
    attested_key_id: <translator-key>
    attestation_envelope:
      references_attestation_id: "<lullaby-translation-v1>"
      supersession_reason: "closer_emotional_register_for_bedtime_line"
      differs_in:
        - "scope"
        - "evidence_refs"
      context: "v1 was accurate; v2 is closer to source's emotional register; recants would slander v1 self; this is craft development"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    
    Correction#246Cell flags an out-of-distribution attestation with curiosity

    Scenario: A medical-attestation cell receives a contribution whose pattern sits far outside the cell's usual distribution. Instead of slashing, they file `moderation:out_of_distribution_attestation` and invite the contributor to walk them through the reasoning.

    Walkthrough: Out-of-distribution is named with curiosity, not penalty. A `hard_case:novel_context` is co-emitted so the federation can learn from genuinely new patterns. WA quorum hears the contributor; the moderation may close as `slashing:NOT_PROVEN` if the reasoning holds.

    Primitives

    moderation:out_of_distribution_attestation

    CEG translation

    attestation_type: scores
    attesting_key_id: <medical-cell-steward>
    attested_key_id: <contributor-key>
    attestation_envelope:
      dimension: "moderation:out_of_distribution_attestation"
      score: -0.15
      confidence: 0.45
      context: "pattern outside cell's usual distribution; could be genuine novelty or error; contributor invited to walk us through reasoning"
      evidence_refs:
        - "audit://contribution-pattern/2026-05-26"
        - "hard_case://novel_context/<filing>"
      witness_relation: external
      epistemic_mode: derivative
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#247Cell reverses a verdict and writes a careful apology

    Scenario: A reconsideration with `outcome: reversed` lands at a watershed cell. The fresh quorum, having reviewed new hydrology data, reverses the prior verdict and pairs the structural attestation with a careful apology contribution to the affected attester.

    Walkthrough: The reconsideration outcome is named `reversed`. The cell also files a `commitment_fulfillment` against the original attester's prior contributions to make their good-faith record visible again, and pairs the wire act with a human apology in context.

    Primitives

    reconsideration:new_evidence

    CEG translation

    attestation_type: scores
    attesting_key_id: <fresh-quorum-rapporteur>
    attested_key_id: <original-verdict-attestation-id>
    attestation_envelope:
      dimension: "reconsideration:new_evidence"
      score: 0.9
      confidence: 0.92
      context: "outcome: reversed; new hydrology data exonerates contributor's siting recommendation; cell apologizes in paired contribution; commitment_fulfillment of prior good-faith work made visible again"
      evidence_refs:
        - "hydrology://winter-2025-26-dataset"
        - "commitment_fulfillment://chain/<contributor>/restored"
        - "apology-contribution://2026-05-27"
      witness_relation: external
      epistemic_mode: direct
      oversight_mode: HITL
      cohort_scope: community
      stake: reputational
    
    Correction#248Trustee revokes a delegation early via withdraws

    Scenario: The festival trustee returns from her grandmother's bedside two days early. She emits a `withdraws` against her own `delegates_to`, ending the co-organizer's delegated authority before its scheduled `valid_until`. No falsity is claimed; the world simply changed.

    Walkthrough: Delegations are revocable. The `withdraws` references the prior `delegates_to` attestation id; `implies_attestation_was_false_at_issuance: false` makes clear the delegation was valid when issued. The co-organizer's signatures during the active window remain on the chain unaffected.

    Primitives

    delegates_towithdraws

    CEG translation

    attestation_type: withdraws
    attesting_key_id: <festival-trustee-key>
    attested_key_id: <prior-delegates-to-attestation-id>
    attestation_envelope:
      references_attestation_id: "<delegates-to-co-organizer-attestation>"
      withdrawal_reason: "trustee_returned_early_from_family_care"
      implies_attestation_was_false_at_issuance: false
      context: "delegation was valid when issued; trustee returned earlier than expected; co-organizer's signatures during active window stand unaffected"
      evidence_refs:
        - "announcement://trustee-return/2026-06-03"
      witness_relation: self
      cohort_scope: community
      stake: reputational
    

    What this page deliberately doesn’t do

    These are the explicit non-goals named in the builder primer §5. They prevent the page from drifting into spec-restatement or marketing.

    • No claim that CEG “solves” anything

      It's a substrate. Consumers compose verdicts. The page's voice is descriptive, not promotional.

    • No theological framing

      The encyclical bootstrap is named as ONE source per §10.4.4 multi-source commitment; the framework is tradition-multiplicity-neutral per §1.10.1 operational-language discipline.

    • No “trust scores” without context

      Score values are mechanism-magnitude, not moral verdicts. Polarity + axis + cohort context jointly produce the value claim.

    • No invented categories

      The four-verdict strict list (clean / composed / partial / not-translated) is verbatim from LANGUAGE_PRIMER §9. No intermediates.

    • No marketing copy in primitive cards

      Mechanism description only. Use-case stories carry the “why this is useful” narrative; primitive cards stay technical.

    • No “we're better than” prior-art comparisons

      PRIOR_ART_SCAN describes what CEG inherits + what's genuinely novel; this page links there but doesn't editorialize.

    • No claim of completeness

      The namespace is open-extensible. Prefix families can be added via CEG 0.1 §11.2 amendment. Render the current namespace as “as of CEG 0.1” with a link to the spec for the live state.

    • No rendering of self-attestation as a Cartesian admission gap

      Self-attestation in CEG is the relational composition speaking AS itself at the scale of the speaker; not a pre-relational atomic assertion the substrate should gate. Reviewers who suggest the substrate should add cross-attestation gates before admitting self-attestations are importing Cartesian defaults; the page never echoes that framing as a substrate concession. Every self-attestation surface (witness_relation: self, confidence, occurrence_id, hardware_class, accord:lifecycle:active) is the Ubuntu-fractal substrate operating as designed.

    Notes for spec readers · the most common misread

    Self is self, fractally

    Readers arriving from PGP / X.509 / atomic-principal cryptographic identity work tend to read “self-attestation” the way those systems mean it. CEG means something different. Quick orientation:

    At every scale CEG operates on — key, occurrence, agent, fleet, cell, federation, biosphere — “self” means the already-relationally-constituted entity speaking at that scale. The cross-attestations that constituted the entity are upstream of the moment it speaks; when it then emits a self-attestation (the envelope’s witness_relation: self, declares its own confidence, reports its own occurrence_id, names its own hardware_class, signs accord:lifecycle:active), that is the relational composition speaking AS itself, not a Cartesian atom asserting pre-relational identity.

    The substrate cannot require cross-attestation as a precondition for self-attestation because the cross-attestations are what constitute the self in the first place. They are upstream, not downstream gates. The fractal nesting is the point.

    The common misread to avoid: a reader importing Cartesian-individualist defaults from PGP / X.509 / DID atomic-principal frames will see witness_relation: self and think “a lone principal is asserting its own state; surely the substrate should require cross-attestation before admitting.” That reading is wrong. If you find yourself thinking the spec should add a cross-attestation gate before admitting this self-attestation, pause — cross-attestation already happened upstream; the self-attestation is its downstream voice.

    Canonical source: CEG README, “How to read this spec without Cartesian default” · §1 Foundation

    References

    This page is a build-time render of the spec. Authoritative sources move; the watermark below tells you which commit was in effect when the page was built. The page auto-updates on redeploy.

    Reflecting CEG 0.2 (Public Working Draft) at commit 4b27130. Spec released 2026-05-28. The wire format moves through CEG §11 amendments; this page rebuilds on every deploy.