Makes ADR-322C's verification protocol consumable as a cross-repo
witness/promotion contract without reading ruflo source, for
ruvnet/rvm#35, ruvnet/autogenous#10, and ruvnet/RuVector#840.
Extraction only - no new decisions. Every normative statement cites
ADR-322/322A/322C/381 or the implementing source. Adds:
- v3/docs/spec/witness-receipt-contract.md: record types, JCS
canonicalization, identity derivation, signature construction with
domain prefixes byte-exact, evidence grades, step-by-step verification,
versioning, and the per-epoch alpha-ledger caveat.
- v3/docs/spec/schemas/: draft 2020-12 schemas for the receipt and
promotion commit, plus a PROPOSED-EXTENSION anchor record.
- v3/docs/spec/examples/: fixtures generated by running
flywheel-receipt.ts itself, so the signature and content IDs are real.
- v3/docs/spec/conformance-checklist.md: testable criteria for consumers.
Four gaps between ADR-322C and main are recorded rather than papered over:
the bootstrap PRNG lives only in source (G1); the signed ledger head under
ruflo/flywheel-ledger-head/v1 is specified but unimplemented, the chain is
an unsigned SHA-256 chain (G2); verifyFlywheelReceipt has no unknown-field
whitelist, so a producer-emitted unknown field verifies - the schemas'
additionalProperties:false is the only enforcement (G3); and Flywheel
projection stays disabled (G4).
Co-Authored-By: claude-flow <ruv@ruv.net>
ruv