core.verdict
core.verdict
The inbound verdict channel — the owner's authorization to promote/supersede an interpretation (design-notes/verdict-authority.md; the sacred boundary, inbound: verdict).
payload.py — the pure signing core (canonical serialization, signing, verification).
taxonomy.py — the ratified verdict categories the store accepts (build plan R3).
apply.py — the receive+verify seam (SEPARATE from the Ambassador, R7); the promotion-apply
half is deferred (parked on recursive-strata I1). The append-only signed store itself lives in
core/stores/verdicts.py. Zone A, no network.
This package __init__ exports only the PURE surface (payload + taxonomy). apply.py depends on
core.stores.verdicts, which imports core.verdict.payload — importing apply here would close a
package-init cycle. It is a leaf consumers import directly:
from core.verdict.apply import build_verdict_receiver.
VERDICT_TAXONOMY = frozenset({'novel_useful', 'true_known', 'plausible', 'wrong', 'noise'})
module-attribute
SignedVerdict
dataclass
A verdict payload plus its owner Ed25519 signature — the transport artifact.
verify needs only the owner PUBLIC key, so the acceptor (a compromised Ambassador, a
tampered store) can check authenticity but never forge one (verdict-authority.md §3–§4:
the Ambassador degrades to transport). The append-only store (build plan Item 4b) adds
monotonic-seq enforcement + persistence on top of this.
payload
instance-attribute
signature
instance-attribute
signer
instance-attribute
verify(public_b64)
True iff signature is a valid signature of THIS payload under the given owner public
key. Any failure mode (bad signature, wrong key, tampered field, malformed base64) returns
False, never raises (delegates to crypto.verify).
to_dict()
The transport form — what the Ambassador (or any carrier) moves inbound. The signature travels WITH the payload, so the receiver re-verifies against the owner public key.
from_dict(d)
classmethod
VerdictPayload
dataclass
One owner verdict — the minimum §3 commitment: which insight/cluster the verdict applies to, which category, a MONOTONIC sequence number, and a timestamp.
Signing THIS binds the authorization to THIS verdict: a compromised transport cannot take a
signature produced for verdict A and staple it to verdict B (verdict-authority.md §2, defect
2 — "authenticates a message, not a moment"). The verdict category is intentionally a free
string here, not an enum: the taxonomy is owner-ratified elsewhere (build plan R3), and this
pure layer must sign whatever the ratified set turns out to be without a code change.
subject_id
instance-attribute
verdict
instance-attribute
seq
instance-attribute
timestamp
instance-attribute
signing_payload()
The exact bytes the owner signature covers.
to_dict()
from_dict(d)
classmethod
sign_verdict(payload, signer)
Sign a verdict with the owner's key. The signer holds the private key inside the
Ed25519Signer; this module — and any agent that later handles the result — only ever sees
the signature, never the key (model advises, code signs; attestation-layer.md §4).
apply
Receive + verify a transported owner verdict, then persist it — the inbound verdict channel's verify seam (design-notes/verdict-authority.md §4; build plan Item 4b).
SEPARATE from the Ambassador, which is read+propose only (build plan R7): the Ambassador — or any
transport — carries a SignedVerdict HERE; this verifies it against the owner PUBLIC key and
appends it to the append-only store. A compromised transport can drop/reorder (refused or made
visible by the store's monotonic seq + gaps()) but can never FORGE one (only the public key is
held). Zone A, no network.
The APPLY half — effecting the promotion / supersession on the reasoning graph — is deliberately deferred: it depends on the promotion mechanism (recursive-strata I1), which is parked. This seam closes the AUTHENTICATION + DURABILITY boundary; promotion lands with that mechanism (4b-apply).
OwnerKeyMissing
Bases: RuntimeError
No owner public key is placed, so a verdict cannot be verified — fail closed (an
unverifiable verdict is never stored). Place [attestation] owner_pub before receiving.
load_owner_pub_b64(config=None)
The owner's base64 Ed25519 public key from the committed [attestation] owner_pub file —
the same non-secret key material the attestation verifier already loads
(core/attestation/verify.load_public_keys). Raises OwnerKeyMissing if absent, so a verdict
is never accepted without a key to check it against.
receive_verdict(signed, store, *, owner_pub_b64)
Verify a transported verdict against the owner key and append it. Fail-closed throughout:
store.append re-verifies the signature, enforces the ratified taxonomy, and enforces the
monotonic sequence — so a forged, mis-categorized, or replayed verdict never persists.
effect_of(verdict)
Map a verdict category to its active-projection effect (pure). wrong/noise RETRACT the
claim (drop it from the active view, keep it in history); novel_useful ENDORSES it;
true_known/plausible are RECORDED. WEIGHT promotion (recursive-strata I1) is parked and
intentionally not expressed here.
apply_verdict(record, dispositions)
Apply a stored verdict to the active projection: compute its effect and record the disposition against its subject (append-only, latest-wins by seq). Implements the supersession / endorsement half of 'apply' (ingest-identity §6); the WEIGHT-promotion half (recursive-strata I1) is parked. Returns the effect applied.
build_verdict_receiver(config=None)
Wire (store, owner key) from config into a receive(signed) closure — the transport seam a
scheduler/interface layer calls with a SignedVerdict it carried inbound. The store is opened
beside the other core stores with the ratified VERDICT_TAXONOMY; the owner public key is the
committed [attestation] owner_pub. Reuses existing key material — no parallel key path.
dispositions
Verdict dispositions — the buildable half of verdict 'apply' (verdict-authority.md).
A verdict labels an interpreted claim; its EFFECT is a disposition on that claim. The half that is
buildable WITHOUT the parked recursive-strata weight machinery is supersession: a
wrong/noise verdict RETRACTS the claim from the active projection — the reasoning complex and
the surfaced dreams stop showing it — while it stays in the historical log (ingest-identity §6: two
views over one log, applied to the interpreted layer). Endorsement / record are noted, for later.
Append-only, latest-wins by subject_id: a newer verdict supersedes an earlier disposition (the
owner may change their mind) and the full history stays queryable. WEIGHT promotion (recursive-
strata I1 — a derived node's edge weights rising) is deliberately NOT here; parked. No network.
VerdictEffect
Bases: StrEnum
What a verdict does to its subject claim in the ACTIVE projection.
RETRACT — drop from the active view (kept in history): a wrong/noise claim.
ENDORSE — the owner affirmed it (a novel_useful claim); surfaced, but weight promotion (I1)
stays parked, so this is a label, not yet a weight change.
RECORD — noted only (true_known / plausible): no change to what is shown.
RETRACT = 'retract'
class-attribute
instance-attribute
ENDORSE = 'endorse'
class-attribute
instance-attribute
RECORD = 'record'
class-attribute
instance-attribute
Disposition
dataclass
verdict_seq
instance-attribute
subject_id
instance-attribute
effect
instance-attribute
at
instance-attribute
DispositionStore
dataclass
path
instance-attribute
record(subject_id, effect, verdict_seq)
Append the disposition a verdict set. Keyed by verdict_seq (one disposition per
verdict), so re-applying the same verdict is idempotent (INSERT OR REPLACE on the seq).
effect_for(subject_id)
The subject's CURRENT disposition — the effect of its highest-seq verdict (latest wins), or None if never verdicted.
retracted()
Every subject whose CURRENT disposition is RETRACT — the active-projection filter a reader applies to exclude owner-superseded claims (ingest-identity §6).
all()
count()
close()
open_disposition_store(config=None)
payload
Canonical serialization + signing for owner verdicts (design-notes/verdict-authority.md §3).
A verdict authorizes a promotion / supersession of an interpretation. Authentication is an
Ed25519 signature over the canonical serialization of the verdict — asymmetric, so the
acceptor holds only the public key and cannot forge (verdict-authority.md §3: the
capability-dissolution test passing, and the two TOTP defects of §2 fixed — payload-binding
and non-repudiation). This module is the PURE core: the payload, its canonical bytes, signing,
and verification. No store, no apply — those are separate (the append-only signed store is
core/stores/verdicts.py; verify+apply is a component distinct from the Ambassador, which is
read+propose only).
Reuses the attestation Ed25519 primitives verbatim (core/attestation/crypto.py) — the same
primitive family the prompt-integrity audit names as the Threat B defense set, since verdict
forgery is a Threat B event (tampering with a governing signal). It deliberately does NOT reuse
the attestation record: record.py::_canonical has no field for a verdict category, a subject
id, or a monotonic sequence number, so a verdict needs its own canonical serialization (build
plan risk R6). Zone A, no network (imports only hashlib/json/dataclasses + the crypto wrappers).
VerdictPayload
dataclass
One owner verdict — the minimum §3 commitment: which insight/cluster the verdict applies to, which category, a MONOTONIC sequence number, and a timestamp.
Signing THIS binds the authorization to THIS verdict: a compromised transport cannot take a
signature produced for verdict A and staple it to verdict B (verdict-authority.md §2, defect
2 — "authenticates a message, not a moment"). The verdict category is intentionally a free
string here, not an enum: the taxonomy is owner-ratified elsewhere (build plan R3), and this
pure layer must sign whatever the ratified set turns out to be without a code change.
subject_id
instance-attribute
verdict
instance-attribute
seq
instance-attribute
timestamp
instance-attribute
signing_payload()
The exact bytes the owner signature covers.
to_dict()
from_dict(d)
classmethod
SignedVerdict
dataclass
A verdict payload plus its owner Ed25519 signature — the transport artifact.
verify needs only the owner PUBLIC key, so the acceptor (a compromised Ambassador, a
tampered store) can check authenticity but never forge one (verdict-authority.md §3–§4:
the Ambassador degrades to transport). The append-only store (build plan Item 4b) adds
monotonic-seq enforcement + persistence on top of this.
payload
instance-attribute
signature
instance-attribute
signer
instance-attribute
verify(public_b64)
True iff signature is a valid signature of THIS payload under the given owner public
key. Any failure mode (bad signature, wrong key, tampered field, malformed base64) returns
False, never raises (delegates to crypto.verify).
to_dict()
The transport form — what the Ambassador (or any carrier) moves inbound. The signature travels WITH the payload, so the receiver re-verifies against the owner public key.
from_dict(d)
classmethod
sign_verdict(payload, signer)
Sign a verdict with the owner's key. The signer holds the private key inside the
Ed25519Signer; this module — and any agent that later handles the result — only ever sees
the signature, never the key (model advises, code signs; attestation-layer.md §4).
taxonomy
The ratified verdict taxonomy — the categories the signed verdict store accepts.
Ratified as the live-adoption §3 (L2) review set (build plan R3, resolving the verdict-authority §1 "adopt/reject/supersede/promote" paraphrase against the concrete L2 candidate). Kept to five — the review-fatigue bound live-adoption names: "keep it ≤5 or review fatigue kills the loop."
These are LABELING verdicts (how good is this claim?). The promotion / supersession the
sacred-boundary channel effects is the DOWNSTREAM action a label triggers (novel_useful ⇒ promote,
…) — the apply-half (build plan Item 4b-apply), parked on the promotion mechanism (recursive-strata
I1). A strata-promotion verdict ("promote insight weight", recursive-strata §8) folds in when that
layer unparks; it is intentionally NOT added now, to keep this the clean L2 set.