Closes the gap raised by ruflo#3069: ADR-322C required independent
statistical recomputation but specified only the bootstrap seed, not the
generator it drives. A verifier could not reproduce a receipt's statistics
from the document - the only way to recompute correctly was to read
flywheel-receipt.ts, which is a copy rather than an independent check.
Appends an "Update (2026-08-19)" section per this repo's ADR convention
(ADR-380) rather than editing the text above. It makes normative: the LCG
and its constants, the seeding rule and exact byte slice, the resampling
procedure and draw order, the quantile rule, tie/edge cases, and the
scale-12 decimal encoding the statistics must reproduce byte-for-byte. It
also records the ledger divergence (flat unsigned commits[] on main vs the
content-addressed segments and signed head the ADR describes, with
flywheel-ledger-head/v1 unused), the disabled projection path, and that
strictness is versioned.
Acceptance is demonstrated, not asserted: conformance/recompute_reference.py
is written only from the amendment prose, in a different language from the
reference implementation, and reproduces the fixture exactly.
Adds receipt-bootstrap-reference.example.json because the existing example
turned out not to discriminate - its deltas take two distinct values, so a
wrong seed slice, wrong byte order, or entirely different LCG constants all
yield the same 2.5th percentile. The new fixture has heterogeneous deltas
and separates all three.
Records one defect found while building it (gap G5): createFlywheelReceipt
computes statistics from full-precision means while storing scale-12
strings, so a receipt whose mean needs more than twelve decimals fails its
own verifyFlywheelReceipt. Reproduced at mean 0.7687083333333332. Existing
fixtures use exactly-representable means, which is why it was not caught.
Co-Authored-By: claude-flow <ruv@ruv.net>
Makes ADR-322C's verification protocol consumable as a cross-repo
witness/promotion contract without reading ruflo source, for
ruvnet/rvm#35, ruvnet/autogenous#10, and ruvnet/RuVector#840.
Extraction only - no new decisions. Every normative statement cites
ADR-322/322A/322C/381 or the implementing source. Adds:
- v3/docs/spec/witness-receipt-contract.md: record types, JCS
canonicalization, identity derivation, signature construction with
domain prefixes byte-exact, evidence grades, step-by-step verification,
versioning, and the per-epoch alpha-ledger caveat.
- v3/docs/spec/schemas/: draft 2020-12 schemas for the receipt and
promotion commit, plus a PROPOSED-EXTENSION anchor record.
- v3/docs/spec/examples/: fixtures generated by running
flywheel-receipt.ts itself, so the signature and content IDs are real.
- v3/docs/spec/conformance-checklist.md: testable criteria for consumers.
Four gaps between ADR-322C and main are recorded rather than papered over:
the bootstrap PRNG lives only in source (G1); the signed ledger head under
ruflo/flywheel-ledger-head/v1 is specified but unimplemented, the chain is
an unsigned SHA-256 chain (G2); verifyFlywheelReceipt has no unknown-field
whitelist, so a producer-emitted unknown field verifies - the schemas'
additionalProperties:false is the only enforcement (G3); and Flywheel
projection stays disabled (G4).
Co-Authored-By: claude-flow <ruv@ruv.net>
ruv