# D30 integrity framing v1 — frozen shared wire contract

Root freeze, 25 October 2026, before Stage6 implementation. Applies to F05A04–A08. All Cedar inputs are synthetic. This is an authored binary framing, **not RFC8785 canonical JSON** and not a claim of Certificate Transparency protocol conformance. SHA-256 is the selected digest; signatures use pure Ed25519, not ctx/ph. Standards context: [RFC9162 section2.1](https://www.rfc-editor.org/rfc/rfc9162.html#section-2.1), [RFC8032](https://www.rfc-editor.org/rfc/rfc8032.html), opened25October2026. Primary fixed-retention provider research is recorded separately.

## Primitives and validation boundary

`U(n)` is exactly4 unsigned big-endian octets, n in0..2^32−1. `S(t)` is U(number of UTF-8 octets) followed by those octets. Strings must contain Unicode scalar values, never lone surrogates; no Unicode normalization, whitespace trimming or case changes. ASCII identifiers, canonical decimal money/sequence strings, real Gregorian UTC millisecond clocks and strict fields retain Stage0/2 meanings. NFC and NFD text intentionally commit different bytes. JSON object delivery order is irrelevant; ordered journal legs and ordered committed groups are semantic. Unknown fields reject rather than being silently unhashed. No floats, JSON numeric money, locale serialization or platform-native integer packing.

Integrity inputs are the full Stage2 committed groups: exact schema_version,group_id,kind,ledger_id,entity_id,available_at,journals,correction. Journals have exact command,sequence,recorded_at,adjustment_reason; command has the strict Stage1 ten fields and ordered legs. Posting has one journal/null correction; correction has two ordered journals and exact five-field correction link. Validate complete contiguous journal history1..trusted head (up to4096groups), duplicate business/journal/group identities, clock order, full atomic correction and exact inverse before committing a history. The accepted Stage2 historical validator may be pinned, with the closed-historical-account status boundary documented. Current account/period policy must not revoke historical acceptance.

The integrity framing also bounds every adjustment_reason to0..240Unicode scalars and rejects lone surrogates; mismatched effective/booking periods still require a nonblank Stage0-trimmed reason, matching periods require empty reason. This is an explicit narrower bounded integrity-export profile, not a change to Stage2 accepted histories. A host must archive a longer legacy reason under another version rather than truncate it. Correction reason retains the strict nonblank trimmed1..240 rule. Hashes prove correspondence to independently trusted commitments; they do not authenticate caller-supplied source heads, recognition, external receipts or financial correctness.

## Complete group bytes G

Start with the exact ASCII tag `D30-COMMITTED-GROUP-V1` and one zero octet. Then concatenate:

1. S(stream_id).
2. S of group schema_version,group_id,kind,ledger_id,entity_id,available_at in this order.
3. U(journals.length).
4. For each journal in sequence order: S(command.schema_version),S(command.ledger_id),S(command.entity_id),S(command.journal_id),S(command.business_operation_id),S(command.currency),S(command.effective_at),S(command.source_available_at),S(command.booking_period),U(command.legs.length); for each ordered leg S(account_id),S(side),S(amount_minor); then S(sequence),S(recorded_at),S(adjustment_reason).
5. U(0) for null correction. Otherwise U(1), then S(correction_id),S(original_journal_id),S(reversal_journal_id),S(replacement_journal_id),S(reason), in this order.

No per-journal hash discards the atomic group boundary. available_at is the trusted observer's post-COMMIT receipt time, not a fabricated physical commit clock. Both recorded timestamps in a correction are retained, even if distinct.

## Full-prefix hash chain

Genesis H0 = SHA256(ASCII `D30-CHAIN-GENESIS-V1` + zero octet + S(stream_id)+S(ledger_id)+S(entity_id)). No all-zero fabricated digest. For one-based committed-group index i, Hi = SHA256(ASCII `D30-CHAIN-NODE-V1` + zero octet + raw32-byte H(i−1) + U(i) + U(length of G_i bytes) + G_i).

Each proof/result reports group index separately from journal sequence. A complete two-journal correction increments group count once and journal head twice. Empty history has head_sequence0/group_count0/genesis head. Compare against an independent expected scope/head/group_count/chain_head; a locally recomputed chain with no independent expected commitment remains indeterminate for omission/rewrite detection. Independently expected current head must equal the covered head; a retained old checkpoint can verify a historical prefix but cannot certify a newer current tail.

## Merkle construction

Leaves are the identical whole-group G bytes. Use RFC9162's selected hash construction: empty root SHA256(empty bytes); one leaf SHA256(0x00||G); internal SHA256(0x01||left32||right32); recursively split at largest power of2 strictly less than n. Never duplicate the last odd leaf. Group order and scope are committed by G. Inclusion proof binds exact tree size, zero-based leaf index and trusted expected root; reject surplus/short/malformed proof nodes. Inclusion alone proves neither complete ledger coverage nor non-equivocation. A batch can be a declared contiguous group range; the signed checkpoint below selects the full prefix from genesis, not an unspecified batch root.

## Checkpoint payload and signature envelope

Checkpoint exact fields, all strings:

`schema_version="d30-integrity-checkpoint-v1", checkpoint_id, stream_id, ledger_id, entity_id, created_at, through_sequence, group_count, chain_head, merkle_root, merkle_size`.

IDs use Stage0 ASCII profile; created_at a genuine UTC millisecond. Digests exactly64 lowercase hex characters. group_count and merkle_size canonical decimal strings0..4096 and equal; through_sequence canonical decimal string0..8192, zero iff countzero, otherwise count<=sequence<=2*count. Actual source adapter must bind the precise whole-group ending sequence and group receipts<=created_at. A self-consistent payload alone cannot establish its claimed relationship to source history. No unsigned external-anchor/status/trust fields are silently attached to this payload.

Checkpoint bytes C start ASCII `D30-INTEGRITY-CHECKPOINT-V1` + zero octet, then S of every field in the exact order shown above, including schema_version and lowercase digest text. Pure Ed25519 signs **C itself**, not its SHA256 digest. A trust registry must independently bind key_id/raw32-byte public key to stream/ledger/entity and explicit validity/revocation/as-of policy. Caller key labels cannot establish trust. Verification must preserve invalid-signature FAIL versus missing/unsupported trust INDETERMINATE; unavailable cryptography cannot become PASS. Demonstration private seeds are public fixtures, never production credentials.

Envelope exact fields:

`schema_version="d30-signed-checkpoint-v1", key_id, algorithm="Ed25519", checkpoint, signature_hex`.

signature_hex exactly128 lowercase hexadecimal characters. Envelope bytes E start ASCII `D30-SIGNED-CHECKPOINT-V1` + zero octet, then S(schema_version),S(key_id),S(algorithm),U(length of C),C,S(signature_hex), in that order. **Anchor content digest is SHA256(E)**. This binds key identifier, algorithm, complete signed payload and signature. The anchor must not hash pretty JSON, C alone, a bare chain digest or provider ETag and call it the envelope digest.

## Independent cross-topic vectors and acceptance

Root will materialize byte-by-byte group/genesis/node/checkpoint/envelope vectors independently of the production implementations; agents must compare literal bytes/full outputs, not just a claimed pass Boolean. Include multi-byte Unicode, normalization distinctions, changed leg order, atomic correction membership, prefix truncation, source scope swap, empty/one/three-leaf trees, exact proof boundaries, published Ed25519 vectors and mutation of every signed field. A source projection with internally valid accounting can still fail an independent retained digest. A malicious signer/admin can rewrite and re-sign history unless an independent retained commitment exposes equivocation; hashes/signatures alone do not remove that trust boundary.

External Anchor will implement a bounded fixed-retention, version-specific S3 COMPLIANCE model. The profile and trusted adapter evidence must state as-of time, independently observed versus model evidence, content digest, object version, retention and availability separately. Synthetic/model-only receipt evidence always leaves live external assurance indeterminate. No cloud resources, irreversible retention or blockchain submission are required or authorized for these local teaching packages.