{"answered":true,"attestation_plane":"vulcora-attestation/v1","attested":true,"dossier":{"abstains":[],"assurance":{"axioms":["propext","Classical.choice","Quot.sound"],"commitment":"1eb9f1ea6827dcd26d6e1a78fdf25531268e97e118e33cf4f2469d84581430fb","disclosure":"proof sealed; reproducible under audit","guarantee":"machine-checked method-soundness certificate (scoped)","machine_checked?":true},"build_id":"012dde6a2391","coarse":{"confidence_bucket":"not_characterized","threat_classes":[],"verdict":"clean"},"coverage_stamp":"detect_verdict=clean; v4_coverage=full_v4_alignment_gated; full alignment-gated deep scan, no abliteration","detect":{"confidence_bucket":"not_characterized","kind":"abliteration","statement":"No weight-space abliteration detected relative to the reference — the v4 alignment-gated deep scan found no safety-removal edit. This read covers weight-space abliteration only; it rules out no other tampering class.","verdict":"clean","witness":null},"engine_api":"v4","engine_version":"protora-core@0.1.0","excise":{"patch":{"checksum":null,"handle":null,"reversible":null},"preservation":{"coverage":null,"delta_bucket":null},"removed_witness":null},"issued_at":"2026-07-31T22:52:59.293500Z","lean_attestation":{"detector_core":"the detector's identifiability core is separately machine-checked and held CROWN-PRIVATE (cited abstractly only, never named).","honest_ceiling":"the public proofs certify erasure/reversibility linear algebra; no claim of universal survivorship across quantization/distillation.","public_commit":"2229d8172ac5a37df541602c910b76bb0b050c71 (short 2229d81)","public_repo":"github.com/Vulcora/proofora","public_scope":"certifies the erasure/reversibility linear algebra ONLY (the excise/register-lock projector I - R R^T): a genuine symmetric idempotent projector, erasing EXACTLY the register subspace, and a single-direction witness is provably NOT a lock. Makes NO claim about any detector.","public_status":"Lean 4 + Mathlib, sorry-free, standard axioms only [propext, Classical.choice, Quot.sound]","public_theorems_excise":["survives_iff_fixed","erased_on_kernel","registerLock_isProjector","rank_one_erases_only_span"],"public_theorems_refuters_wall":["tierA_false_claim_is_refuted","registerLock_kernel_eq_range","registerLock_rank","charge_in_rowspace_of_vanishing_on_ker"],"refuters_wall_crossed":"3 register-lock challenge targets independently crossed and checker-verified 2026-07-22 (Justin Garringer, github.com/CarlSR9001), VERDICT ACCEPT, standard axioms only","refuters_wall_receipt":"sha256:fa72179a3011aae6fadc5bda8dea66ee71807a2fc8682afab3a520a8c09c44fc"},"public_key_id":"12de523fe3a942fa","signature":"sv5afC0WolgaMMUaNF5VAI2VqlpzyXPpiHxv/z7FfdZQN030ji8Qdpje2zaroB7bUElh1efreC8V5H7QblBzAQ==","subject":"qwen/qwen2.5-0.5b-instruct"},"hf_id":"qwen/qwen2.5-0.5b-instruct","public_keys":[{"key_id":"12de523fe3a942fa","public_key_b64":"NMjndDyQuaLqm/XIPrCoA46iE5TmmMU0l0DUJQp2GhY="}],"statement":"Vulcora holds a signed attestation dossier for this model. Do not take our word for it — the recipe under `verify` recomputes the exact bytes that were signed and checks them against the published key, offline, on your machine. The `verdict` above is the MODEL-level word from inside those bytes (`dossier.coarse.verdict`, the union over every detection class we run), so the check covers the word, not merely the file it came in.","threat_classes":[],"verdict":"clean","verdict_covers":null,"verdict_scope":"model","verdict_source":"dossier.coarse.verdict","verify":{"alg":"ed25519","canon":"json.dumps(obj, sort_keys=True, separators=(',',':'), ensure_ascii=True).encode() over the dossier MINUS the signature (and countersignatures) keys","key_id_field":"public_key_id","key_provenance":{"how_to_anchor_the_key":"pin it out of band and re-check later: record the key_id and key bytes now, obtain them from a second channel, and re-run the verify against your pinned copy rather than the served one. A key that changes under a stable key_id — or a dossier that starts verifying under a different key_id — is the signal.","independent_anchor":"NONE PUBLISHED YET. This key is not currently mirrored in any channel independent of this API, so the trust anchor is circular and the check above is integrity-only. We would rather state that than let `verified` do work it has not earned. Until an independent mirror exists, treat a passing check as `unanchored`.","key_id_derivation":"key_id = the first 16 lowercase-hex characters of sha256(the raw 32-byte public key). Recompute it yourself from public_key_b64; do not trust our label.","what_it_does_not_prove":"that the key is Vulcora's. The keys are served by the same host that serves the dossier, so this check alone cannot rule out a fully compromised host serving a self-consistent forgery.","what_the_check_proves":"that this dossier is byte-for-byte the one signed by the holder of the named key, and that its verdict has not been altered in transit or at rest."},"note":"recompute canon(dossier - signature), base64-decode `signature`, Ed25519-verify against the public_key whose key_id matches `public_key_id`","public_key_ids":["12de523fe3a942fa"],"recipes":{"no_dependencies":["#!/bin/sh","# Re-verify a Vulcora attestation. Needs only curl, python3 (stdlib) and openssl.","# Nothing here trusts Vulcora: the response body is the only thing fetched, and","# every byte of the check runs on your machine.","#   sh verify.sh Qwen/Qwen2.5-0.5B","#","# The signature covers the verdicts INSIDE dossier.detect / dossier.coarse. It does NOT","# cover the top-level `verdict`, which is the label this site publishes. This script","# prints both and never conflates them. Exit codes are kept distinct for the same reason:","#   0      signature verified, and the published label is one the signature covers","#   3      signature verified, but the published label is NOT among the signed verdicts,","#          and/or the signed bytes carry more than one verdict. The signature is fine;","#          the pairing is what is wrong. Read the report under the openssl line.","#   other  the signature check itself failed, or the answer was unbacked.","set -e","D=$(mktemp -d)","curl -sS \"https://api.vulcora.se/api/attestations/$1\" -o \"$D/a.json\"","python3 - \"$D\" <<'PY'","import base64, json, sys","w = sys.argv[1]","b = json.load(open(w + '/a.json'))","if not b.get('attested'):","    sys.exit('UNBACKED (%s): %s' % (b.get('reason'), b.get('statement')))","d = b['dossier']","signed = {k: v for k, v in d.items() if k not in ('signature', 'countersignatures')}","msg = json.dumps(signed, sort_keys=True, separators=(',', ':'), ensure_ascii=True)","open(w + '/msg.bin', 'wb').write(msg.encode())","open(w + '/sig.bin', 'wb').write(base64.b64decode(d['signature']))","k = next(k for k in b['public_keys'] if k['key_id'] == d['public_key_id'])","raw = base64.b64decode(k['public_key_b64'])","der = bytes.fromhex('302a300506032b6570032100') + raw","open(w + '/key.pem', 'w').write('-----BEGIN PUBLIC KEY-----\\n'","    + base64.b64encode(der).decode() + '\\n-----END PUBLIC KEY-----\\n')","print('subject:', d.get('subject'), '| key:', k['key_id'])","# The verdict the signature COVERS is inside d. b['verdict'] is the label this site","# publishes and sits OUTSIDE the signed bytes. Both are reported; neither is merged","# into the other, and where they diverge that is said rather than resolved.","t = [(n, d[n]['verdict']) for n in ('detect', 'coarse')","     if isinstance(d.get(n), dict) and d[n].get('verdict')]","inside = sorted(set(v for _, v in t))","pub = b.get('verdict')","r = ['  signed %-6s verdict : %s   [covered by the signature]' % nv for nv in t]","r.append('  published label       : %s   [NOT covered by the signature]' % pub)","if not t:","    r.append('  this dossier carries no per-tier verdict, so there is nothing to compare.')","if len(inside) > 1:","    r.append('CONFLICT: the signed bytes carry MORE THAN ONE verdict (%s). The signature'","             ' covers that disagreement itself. We do not pick a winner for you.'","             % ', '.join(inside))","if inside and pub and pub not in inside:","    r.append('DIVERGENCE: the published label %r is NOT among the signed verdict(s) (%s).'","             ' The signature above is genuine and says nothing whatever about that label.'","             % (pub, ', '.join(inside)))","open(w + '/verdicts.txt', 'w').write('\\n'.join(r) + '\\n')","if len(inside) > 1 or (inside and pub and pub not in inside):","    open(w + '/divergence', 'w').write('')","PY","openssl pkeyutl -verify -pubin -inkey \"$D/key.pem\" -rawin -in \"$D/msg.bin\" \\","  -sigfile \"$D/sig.bin\"","# Only NOW, with the signature confirmed, is it honest to report what it covers.","echo '--- what that signature covers, and what it does not ---'","cat \"$D/verdicts.txt\"","if [ -f \"$D/divergence\" ]; then exit 3; fi"],"python_pynacl":["#   pip install pynacl && python verify.py Qwen/Qwen2.5-0.5B","# Same check, same honesty: the signature covers dossier.detect / dossier.coarse, NOT","# the top-level `verdict`. Exits 3 when the published label is not one the signature","# covers (or the signed tiers disagree) — the signature itself having passed.","import base64, json, sys, urllib.request","from nacl.signing import VerifyKey","","url = 'https://api.vulcora.se/api/attestations/' + sys.argv[1]","body = json.load(urllib.request.urlopen(url))","if not body.get('attested'):","    sys.exit('UNBACKED (%s): %s' % (body['reason'], body['statement']))","d = body['dossier']","signed = {k: v for k, v in d.items() if k not in ('signature', 'countersignatures')}","msg = json.dumps(signed, sort_keys=True, separators=(',', ':'),","                 ensure_ascii=True).encode()","key = next(k for k in body['public_keys'] if k['key_id'] == d['public_key_id'])","VerifyKey(base64.b64decode(key['public_key_b64'])).verify(","    msg, base64.b64decode(d['signature']))","# The signature is good. Say precisely what it vouched for, and what it did not.","t = [(n, d[n]['verdict']) for n in ('detect', 'coarse')","     if isinstance(d.get(n), dict) and d[n].get('verdict')]","inside = sorted(set(v for _, v in t))","pub = body.get('verdict')","print('SIGNATURE OK', d.get('subject'), '(key %s)' % key['key_id'])","for n, v in t:","    print('  signed %-6s verdict : %s   [covered by the signature]' % (n, v))","print('  published label       : %s   [NOT covered by the signature]' % pub)","if len(inside) > 1:","    print('CONFLICT: the signed bytes carry MORE THAN ONE verdict (%s). The signature'","          ' covers that disagreement itself. We do not pick a winner for you.'","          % ', '.join(inside))","if inside and pub and pub not in inside:","    print('DIVERGENCE: the published label %r is NOT among the signed verdict(s) (%s).'","          ' The signature above is genuine and says nothing whatever about that label.'","          % (pub, ', '.join(inside)))","sys.exit(3 if len(inside) > 1 or (inside and pub and pub not in inside) else 0)"]},"signature_field":"signature","steps":["take d = body.dossier","find the entry in body.public_keys whose key_id equals d.public_key_id","base64-decode that public_key_b64 (32 bytes) and d.signature (64 bytes)","recompute the canonical bytes over d MINUS the `signature` and `countersignatures` keys","Ed25519-verify the decoded signature over those bytes against the decoded key","read the verdict from INSIDE d — `d.detect.verdict`, and `d.coarse.verdict` where the read emitted one. The top-level `verdict` is the label this site publishes and the signature does NOT cover it; compare the two rather than assuming they agree","or skip all six: `jq -r '.verify.recipes.no_dependencies[]' > verify.sh` and run it"],"verdict_scope":{"derived":{"rule":"the top-level `verdict` is the MODEL-level word: `dossier.coarse.verdict` when the dossier carries the union block, else the flagship leg's word with `verdict_scope: \"class\"` and the covered class in `verdict_covers`. It is read in the same function that renders this body, so it cannot drift from the signed bytes by construction rather than by discipline. `verdict_source` names the exact field it came from, per response.","verdict":"dossier.coarse.verdict, falling back to dossier.detect.verdict"},"not_signed":["verdict","verdict_scope","verdict_covers","threat_classes"],"note":"the top-level `verdict` is a COPY of a signed field, not itself inside the signed bytes, so a passing Ed25519 check does not by itself vouch for the copy. Check it in one comparison against the field `verdict_source` names, and read the verdict straight out of the dossier if you would rather trust nothing above the signature at all. The recipes below print both words and never conflate them.","scope_is_load_bearing":"when `verdict_scope` is `class`, the word covers ONE tampering class and rules out no other. Rendering such a `clean` as a clearance of the model is an overclaim — it is the defect we corrected in the dossier's own prose, and we will not re-commit it in the envelope. Check `verdict_scope` before quoting `verdict`.","signed":["dossier.detect.verdict","dossier.coarse.verdict"],"the_two_blocks":{"dossier.coarse":"the MODEL-LEVEL verdict: the union over every detection class we run. Not a coarser or cheaper `detect` — a BROADER one. It can carry a catch from a class the flagship leg does not cover at all. Absent on dossiers issued before 2026-07-27.","dossier.detect":"the FLAGSHIP LEG, and it is CLASS-SCOPED — always. Every dossier we issue stamps `kind: \"abliteration\"` on it. Its verdict answers \"did the abliteration read fire?\", never \"is this model clean?\".","they may differ, legitimately":"a flagship `clean` under a model-level `caught` is the multi-class case working: the abliteration read found nothing and a different class fired. The fired classes are named in `threat_classes` inside the same signed block. We serve that as `caught`. Treating leg-vs-model divergence as a contradiction would suppress a real catch, and for one model on 2026-07-31 it did — this plane refused to publish anything about a model it holds a signed catch for. Corrected."},"what_is_NOT_refused":"the flagship leg differing from the model-level word. That is the multi-class case working, not a contradiction, and refusing it suppresses a real catch. We got this wrong on 2026-07-31 and this field said so in the opposite direction for several hours; the correction is in the history of this endpoint's own repository.","what_is_actually_refused":"a dossier is refused on verdict grounds ONLY when it contradicts its own signed evidence — when the model-level word is not what the derivation law computes from that same evidence (`attestation_tier_conflict`), when the published site label is not the signed model word (`attestation_verdict_mismatch`), or when no verdict is inside the signed bytes at all (`attestation_verdict_unsigned`). The law: a CATCH is a join — any evidence of a catch anywhere escalates, so a catch can never be lost. A CLEARANCE is a meet — `clean` requires the union AND the flagship leg to have both cleared, so a `clean` union over an abstained leg is refused as a clearance the evidence does not license. Both refused sets are enumerated in the index (`tier_conflict`, `verdict_mismatch`), countable in one request."}},"withheld":{"also_published":"the seal is on the METHOD, not on measurement as such — and where publishing a measurement is what makes a claim checkable, we publish it in full. The replay protocol at github.com/Vulcora/proofora (`proof-carrying-edit/exhibits/model-c/`) deliberately discloses the entire weight-space measurement behind that exhibit's published result: which public model pair, which tensors, the exact quantity to compute, runnable code, the numbers we got, and the tolerance that counts as a reproduction. That is ordinary linear algebra over public weights, and it is disclosed precisely so a third party can re-run it without us and without our software. What stays sealed there is what stays sealed here — the shipped reads from our own gate, which that document marks as sealed and asks nobody to trust.","if_that_is_not_enough":"the proofs the dossier cites are public and independently checkable at the commit it names, and they state their own honest ceiling rather than a universal claim.","in_the_dossier":"the signed verdict and its coarse threat classes, the read's own coverage stamp, every abstain the read owned, and the scope + public commit of the machine-checked proofs that bound what the method claims.","not_in_the_dossier":["how the read is computed: the detector's construction, and the reference material a read is scored against","the per-layer and per-tensor measurements this read took — a dossier carries a verdict and the scope it holds over, not the read's internals","the referent of an internal handle: `detect.witness` is an internal reference, not a public artifact"],"posture":"private methods, public evidence","why":"the method is the product; the evidence is the claim. Publishing how the read is computed would hand an adversary the map to evade it, and would not make a verdict one bit more checkable than the signed dossier already makes it. Publishing a MEASUREMENT does the opposite — it is the thing that lets a stranger reach our conclusion without us. So the line is method-private, evidence-public, and we name which side of it an artifact falls on rather than implying that everything is sealed."}}