Observation
${esc(run.observation.observed)}
@@ -823,6 +832,12 @@
${esc(title)}
receipt${copyable(run.applicationProvenance.receiptDigest, 'the receipt digest')}
correlation${copyable(run.applicationProvenance.correlationId, 'the correlation id')}
${esc(run.applicationProvenance.note)}
+
Protected mutation
+ - status
- ${esc(run.effect.status)}
+ - target invariant
- ${esc(run.effect.invariant)}
+ - revision before
- ${copyable(run.effect.revisionBefore, 'the pre-mutation revision')}
+ - revision after
- ${copyable(run.effect.revisionAfter, 'the post-mutation revision')}
+
The protected target's own recorded bound. It is not the HAC-330 joint bound, and this run does not reproduce that experiment.
Runtime source
- runtimeSourceSha
- ${copyable(rp.runtimeSourceSha, 'the runtime source sha')}
- public URL
- ${esc(rp.runtimeSourceUrl.state)}
@@ -844,6 +859,9 @@ ${esc(title)}
- evidencePublicationSha
- ${copyable(p.evidencePublicationSha, 'the evidence publication sha')}
- publicationBindingsSha
- ${copyable(p.publicationBindingsSha, 'the publication bindings sha')}
${esc(p.sourcePacketNote)}
+
Negative controls
${run.negativeControls.map((c) => `- ${esc(c.status)}
- ${esc(c.label)}${c.note ? `
${esc(c.note)}` : ''} `).join('')}
diff --git a/media/hac-341/evidence/view-model.json b/media/hac-341/evidence/view-model.json
index 69aa5be..485cabc 100644
--- a/media/hac-341/evidence/view-model.json
+++ b/media/hac-341/evidence/view-model.json
@@ -353,7 +353,7 @@
},
{
"n": 6,
- "label": "ALLOW + authorization receipt",
+ "label": "ALLOW + receipt",
"role": "decision",
"detail": "sha256:9d0fa49385d17feaa2fd53e87b340eed0ccf50997eba78356ff9d2cdbaa05234"
},
diff --git a/scripts/check-identity.mjs b/scripts/check-identity.mjs
index 57b751f..a64228b 100644
--- a/scripts/check-identity.mjs
+++ b/scripts/check-identity.mjs
@@ -122,6 +122,44 @@ for (const token of ['vercel/geist-font', 'v1.7.2', 'OFL', 'a73329da8fc62afc917f
if (!harvest.includes(token)) fail(`assets/HARVEST.md does not record font provenance: ${token}`);
}
+/* --- semantic state colour must clear the text contrast floor ------------ */
+
+/**
+ * The light COUPLED state measured **4.01:1** against the sunken light surface,
+ * under the 4.5:1 floor for the 8.5-10px label and chip text that carries it.
+ * Lightness is what moved it: L 0.52 measures 5.15:1 on sunken and 5.48:1 on
+ * card. Hue and chroma are unchanged, so the state still reads as the same
+ * blue, and the dark peer (~8.6:1) is deliberately untouched.
+ *
+ * This guards the lightness rather than recomputing the ratio. Converting oklch
+ * to sRGB here would duplicate colour science the browser already does, and a
+ * subtly wrong implementation would be worse than no check at all — so the
+ * measured input is pinned instead, and hue/chroma drift forces a re-measure.
+ */
+const colorsCss = read('assets', 'tokens', 'colors.css');
+const lightCoupled = /--il-state-coupled:\s*oklch\(([\d.]+)\s+([\d.]+)\s+([\d.]+)\)/.exec(colorsCss);
+if (!lightCoupled) {
+ fail('cannot read the light --il-state-coupled token; the contrast floor cannot be checked');
+} else {
+ const [, L, C, H] = lightCoupled;
+ if (Number(L) > 0.52) {
+ fail(`light --il-state-coupled is L=${L}; 0.52 is the measured ceiling that clears 4.5:1 on the sunken light surface (0.58 measured 4.01:1)`);
+ }
+ // Compared with a tolerance rather than `!==`: these are parsed decimals, and
+ // exact float equality would be fragile against harmless reformatting.
+ const near = (a, b) => Math.abs(Number(a) - b) < 1e-9;
+ if (!near(C, 0.13) || !near(H, 250)) {
+ fail(`light --il-state-coupled chroma/hue changed to ${C}/${H}; the contrast floor was measured at 0.130/250 and must be re-measured in a browser`);
+ }
+ // The cockpit re-declares the state hues for its own field. They may not drift
+ // from the token that is supposed to be the authority for them.
+ const cockpitLight = /--coupled:oklch\(([\d.]+)\s+([\d.]+)\s+([\d.]+)\)/.exec(cockpit);
+ if (!cockpitLight) fail('the cockpit declares no light --coupled value');
+ else if (cockpitLight[1] !== L || cockpitLight[2] !== C || cockpitLight[3] !== H) {
+ fail(`the cockpit light --coupled (${cockpitLight.slice(1).join(' ')}) has drifted from the token (${L} ${C} ${H})`);
+ }
+}
+
/* --- no manifest may cite an identity asset that is not here ------------- */
for (const scene of sceneManifest.scenes) {
diff --git a/test/hac-341-identity-gates.test.mjs b/test/hac-341-identity-gates.test.mjs
index a663877..745f3d6 100644
--- a/test/hac-341-identity-gates.test.mjs
+++ b/test/hac-341-identity-gates.test.mjs
@@ -390,3 +390,85 @@ describe('the evidence panel stays usable', () => {
expect(r.out).toMatch(/looping animation/);
});
});
+
+/**
+ * Pre-freeze cleanup. Two of these guard framing rather than facts: the values
+ * involved are all real evidence, and the defect was where they were shown and
+ * what they were called. That makes them easy to reintroduce by accident, which
+ * is exactly why they need proofs.
+ */
+describe('cloud L1 does not read as a bounded-outcome experiment', () => {
+ const gate = 'media/hac-341/bin/verify-cockpit.mjs';
+
+ it('fails when the mutation invariant returns to cloud L1', () => {
+ const r = perturbed((a) => {
+ a.edit('media/hac-341/cockpit.html',
+ '
${esc(run.effect.note)}
',
+ '
${esc(run.effect.invariant)}
');
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/cloud L1 renders the protected-mutation invariant/);
+ });
+
+ it('fails when the invariant is deleted rather than demoted', () => {
+ const r = perturbed((a) => {
+ const f = 'media/hac-341/cockpit.html';
+ a.write(f, a.read(f).replaceAll('run.effect.invariant', 'run.effect.status'));
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/rendered nowhere; it is recorded evidence/);
+ });
+});
+
+describe('the decision artifact has one name', () => {
+ const gate = 'media/hac-341/bin/verify-cockpit.mjs';
+ const VM = 'media/hac-341/evidence/view-model.json';
+
+ it('fails when the decision hop drifts from "
+ receipt"', () => {
+ const r = perturbed((a) => {
+ const m = JSON.parse(a.read(VM));
+ m.runs.cloud.events.find((e) => e.role === 'decision').label = 'ALLOW + authorization receipt';
+ a.write(VM, `${JSON.stringify(m, null, 2)}\n`);
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/must read "ALLOW \+ receipt"/);
+ });
+
+ it('fails when a rendered surface reintroduces "authorization receipt"', () => {
+ const r = perturbed((a) => {
+ a.edit('media/hac-341/cockpit.html', 'Decision, effect, observation
',
+ 'Decision, effect, observation
');
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/names the decision artifact "authorization receipt"/);
+ });
+});
+
+describe('semantic state colour clears the text contrast floor', () => {
+ const gate = 'scripts/check-identity.mjs';
+ const TOK = 'assets/tokens/colors.css';
+
+ it('fails when the light coupled state is lightened back over the floor', () => {
+ const r = perturbed((a) => {
+ a.edit(TOK, '--il-state-coupled: oklch(0.52 0.130 250)', '--il-state-coupled: oklch(0.58 0.130 250)');
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/is L=0\.58; 0\.52 is the measured ceiling/);
+ });
+
+ it('fails when hue or chroma change without a re-measure', () => {
+ const r = perturbed((a) => {
+ a.edit(TOK, '--il-state-coupled: oklch(0.52 0.130 250)', '--il-state-coupled: oklch(0.52 0.180 265)');
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/chroma\/hue changed .* must be re-measured/);
+ });
+
+ it('fails when the cockpit drifts from the token it should follow', () => {
+ const r = perturbed((a) => {
+ a.edit('media/hac-341/cockpit.html', '--coupled:oklch(0.52 0.130 250)', '--coupled:oklch(0.58 0.130 250)');
+ }, gate);
+ expect(r.code).not.toBe(0);
+ expect(r.out).toMatch(/has drifted from the token/);
+ });
+});