Verifier Assurance (PCS-VA) schemas, validators, and docs

.github/workflows/ci.yml

@@ -283,12 +283,15 @@ jobs:
             tests/test_pf_core_phase4_differential.py \
             tests/test_pf_core_hash_vector_parity.py \
             tests/test_canonical_hash_release.py \
-            tests/test_shared_hash_vectors.py
+            tests/test_shared_hash_vectors.py \
+            tests/test_verifier_assurance_cross_language.py
           pcs shared-hash-vectors verify
           pcs conformance run --suite pf-core-cross-language
+          pcs conformance run --suite verifier-assurance
           cd ../rust
           cargo test --locked pf_core -- --nocapture
           cargo test --locked hash_vectors
+          cargo test --locked va_ -- --nocapture
           cd ../typescript
           npm ci
           npm test

.github/workflows/release.yml

@@ -197,9 +197,11 @@ jobs:
             tests/test_pf_core_cross_language.py \
             tests/test_pf_core_phase4_differential.py \
             tests/test_pf_core_hash_vector_parity.py \
-            tests/test_canonical_hash_release.py
+            tests/test_canonical_hash_release.py \
+            tests/test_verifier_assurance_cross_language.py
           pcs conformance run --suite pf-core-cross-language
-          cd ../rust && cargo test --locked pf_core
+          pcs conformance run --suite verifier-assurance
+          cd ../rust && cargo test --locked pf_core && cargo test --locked va_
           cd ../typescript && npm ci && npm test && npm run test:hash-vectors -w @pcs/core
 
   semantic-projection-replay:

CHANGELOG.md

@@ -1,5 +1,23 @@
 # Changelog
 
+## Verifier Assurance Protocol (PCS-VA) — working tree
+
+### Added
+
+- Six `*.v1` VA artifacts: `VerifierProfile`, `VerificationResult`, `RewardEvidenceEnvelope`, `OptimizationCampaignManifest`, `AdjudicationRecord`, `VerifierAssuranceReport`.
+- Shared `schemas/verifier_assurance.defs.json`; nested integrity; decimal-string rates/rewards.
+- Python semantics, offline report builder, CLI (`pcs verifier|reward|campaign|adjudication|assurance`), conformance suite `verifier-assurance`.
+- Fixtures under `examples/verifier_assurance/` and producer gate under `benchmarks/verifier_assurance_conformance/`.
+- Docs under `docs/verifier-assurance/` and RC notes in `docs/releases/verifier-assurance-rc.md`.
+- Rust/TypeScript schema map registration for the six VA types.
+- Rust/TypeScript semantic validators + report verify with Python-parity error codes (PCS-VA-07).
+- Cross-language VA parity tests (`test_verifier_assurance_cross_language.py`, Rust `va_*`, TS suite).
+
+### Compatibility
+
+- `VerificationResult.v0` unchanged (LabTrust/PF import contract). No auto-upgrade to v1.
+- Public VA surface is the six planned artifacts only; optional `invocation_ref` on results is an opaque producer pin, not a separate PCS artifact type.
+
 ## PF-Core v0.1.0-pf-core (2026-06-29)
 
 Release tag for the PF-Core production kernel on `pcs-core` `main`. Bounded claim: machine-checkable trace certificates for catalog-driven, resource-pattern-scoped agentic tool-use traces. Release-grade tool-use `LeanKernelChecked` requires the TraceSafeR evidence chain.

benchmarks/verifier_assurance_conformance/README.md

@@ -0,0 +1,31 @@
+# Verifier Assurance producer conformance
+
+Producer-shaped fixtures for OVK / LabTrust dialect rejection until real exports land.
+Exercised by `pcs conformance run --suite verifier-assurance`.
+
+## Layout
+
+```text
+benchmarks/verifier_assurance_conformance/
+  valid/          # must pass schema + semantics
+  invalid/        # manifest.json with expected_error
+  README.md
+```
+
+## Required producer emission rules
+
+- Explicit `artifact_type` and `schema_version: "v1"`.
+- Nested `integrity` (no `signature_or_digest`).
+- Decimal strings for rates/rewards (no JSON floats).
+- Typed indeterminate decisions (never collapse indeterminate to reject/accept).
+- Explicit `null` for unused profile config digest slots.
+- Adjudication: commitment + location class; no protected rationale content in public exports.
+- Fail-closed: timeout / unavailable / error execution statuses must not yield `accept`.
+
+## Six-artifact surface only
+
+Producers pin the PCS-VA six-artifact family documented in
+[docs/verifier-assurance/protocol.md](../../docs/verifier-assurance/protocol.md).
+Do not fork schemas under producer trees.
+
+Sync downstream mirrors via [docs/downstream-schema-sync.md](../../docs/downstream-schema-sync.md).

benchmarks/verifier_assurance_conformance/invalid/extra_field/artifact.json

@@ -0,0 +1,53 @@
+{
+  "applicability": {
+    "status": "active",
+    "valid_from": "2026-07-01T00:00:00Z"
+  },
+  "artifact_type": "VerifierProfile.v1",
+  "assumptions": [
+    "host OS is Linux"
+  ],
+  "claim_surface": {
+    "guarantee_class": "certificate_checked",
+    "out_of_scope_claim_ids": [
+      "claim.formal.full_correctness"
+    ],
+    "supported_claim_ids": [
+      "claim.safety.no_egress"
+    ]
+  },
+  "configuration": {
+    "config_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+    "model_digest": null,
+    "policy_digest": null,
+    "prompt_digest": null,
+    "resource_limit_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+  },
+  "created_at": "2026-07-24T12:00:00Z",
+  "extra_field": "nope",
+  "implementation": {
+    "implementation_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    "language": "rust",
+    "name": "ovk-static-checker",
+    "version": "1.0.0"
+  },
+  "integrity": {
+    "artifact_digest": "sha256:150ceda191b6d8160a0c7e621ed1475942f73aa08e809c944b6a14df1e76b90e",
+    "canonicalization_version": "v1"
+  },
+  "known_blind_spots": [
+    "does not observe runtime network"
+  ],
+  "mechanism": {
+    "allows_abstention": true,
+    "description": "Static claim checker",
+    "determinism": "deterministic",
+    "mechanism_class": "static_analysis"
+  },
+  "producer": "OVK",
+  "producer_version": "0.1.0",
+  "schema_version": "v1",
+  "source_commit": "e068794683959c52a19594a6d271dd5e69f3c999",
+  "source_repo": "https://github.com/SentinelOps-CI/pcs-core",
+  "verifier_profile_id": "vp-ovk-static-001"
+}

benchmarks/verifier_assurance_conformance/invalid/extra_field/manifest.json

@@ -0,0 +1,5 @@
+{
+  "artifact_file": "artifact.json",
+  "artifact_type": "VerifierProfile.v1",
+  "expected_error": "Additional properties are not allowed ('extra_field' was unexpected)"
+}

benchmarks/verifier_assurance_conformance/invalid/float_reward/artifact.json

@@ -0,0 +1,58 @@
+{
+  "artifact_type": "RewardEvidenceEnvelope.v1",
+  "authority": {
+    "authority_class": "producer",
+    "authority_id": "labtrust-reward"
+  },
+  "claims_issued": [
+    "claim.safety.no_egress"
+  ],
+  "claims_rejected": [],
+  "claims_unresolved": [],
+  "components": [
+    {
+      "claim_id": "claim.safety.no_egress",
+      "component_id": "safety",
+      "guarantee_class": "certificate_checked",
+      "value": "1.0"
+    },
+    {
+      "component_id": "quality",
+      "guarantee_class": "empirically_measured",
+      "value": "0.5"
+    }
+  ],
+  "composition_function": "sum",
+  "created_at": "2026-07-24T12:10:00Z",
+  "env_profile_id": "env-lab",
+  "env_profile_version": "1.0.0",
+  "episode_id": "ep-1",
+  "lifecycle": {
+    "status": "active"
+  },
+  "mandatory_unresolved_claim_ids": [],
+  "producer": "LabTrust-Gym",
+  "producer_version": "0.1.0",
+  "profile_refs": [
+    {
+      "applicability_status": "active",
+      "profile_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+      "verifier_profile_id": "vp-ovk-static-001"
+    }
+  ],
+  "reward_envelope_id": "rew-001",
+  "scalar_total": 1.5,
+  "schema_version": "v1",
+  "source_commit": "e068794683959c52a19594a6d271dd5e69f3c999",
+  "source_repo": "https://github.com/SentinelOps-CI/pcs-core",
+  "state_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "step_index": 0,
+  "trajectory_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "verifier_result_refs": [
+    {
+      "artifact_digest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+      "artifact_id": "vr-001",
+      "artifact_type": "VerificationResult.v1"
+    }
+  ]
+}

benchmarks/verifier_assurance_conformance/invalid/float_reward/manifest.json

@@ -0,0 +1,5 @@
+{
+  "artifact_file": "artifact.json",
+  "artifact_type": "RewardEvidenceEnvelope.v1",
+  "expected_error": "is not of type 'string'"
+}

benchmarks/verifier_assurance_conformance/invalid/indeterminate_collapse/artifact.json

@@ -0,0 +1,56 @@
+{
+  "artifact_type": "VerificationResult.v1",
+  "check_groups": [
+    {
+      "checks": [
+        {
+          "check_id": "process.complete",
+          "mandatory": true,
+          "status": "passed"
+        }
+      ],
+      "kind": "process"
+    },
+    {
+      "checks": [
+        {
+          "check_id": "evidence.present",
+          "mandatory": true,
+          "status": "passed"
+        }
+      ],
+      "kind": "evidence"
+    }
+  ],
+  "claim_ids": [
+    "claim.safety.no_egress"
+  ],
+  "created_at": "2026-07-24T12:05:00Z",
+  "decision": "accept",
+  "execution_status": "timeout",
+  "initial_state_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "input_bundle_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "integrity": {
+    "artifact_digest": "sha256:07a522dcc2e210ac21a00de975f2d64ae7cf11a38c06ccb74ae52074a7b5c042",
+    "canonicalization_version": "v1"
+  },
+  "normalization_applied": true,
+  "normalized_result_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "producer": "OVK",
+  "producer_version": "0.1.0",
+  "raw_backend_output_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "resource_limits": {
+    "memory_bytes": 1048576,
+    "wall_time_ms": 1000
+  },
+  "schema_version": "v1",
+  "source_commit": "e068794683959c52a19594a6d271dd5e69f3c999",
+  "source_repo": "https://github.com/SentinelOps-CI/pcs-core",
+  "terminal_state_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "trajectory_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "verification_result_id": "vr-001",
+  "verifier_profile": {
+    "profile_digest": "sha256:c515b34f1f61d9b8d139d2a14a92409b2d45ffee16d16bb4c89913db1ebd53b0",
+    "verifier_profile_id": "vp-ovk-static-001"
+  }
+}

benchmarks/verifier_assurance_conformance/invalid/indeterminate_collapse/manifest.json

@@ -0,0 +1,5 @@
+{
+  "artifact_file": "artifact.json",
+  "artifact_type": "VerificationResult.v1",
+  "expected_error": "FailClosedDecision"
+}

benchmarks/verifier_assurance_conformance/invalid/missing_commitment/artifact.json

@@ -0,0 +1,39 @@
+{
+  "adjudication_id": "adj-001",
+  "artifact_type": "AdjudicationRecord.v1",
+  "blinded": true,
+  "conflict_of_interest_declared": false,
+  "created_at": "2026-07-24T13:00:00Z",
+  "disagreement": false,
+  "escalation": false,
+  "evidence_refs": [],
+  "independence_declared": true,
+  "integrity": {
+    "artifact_digest": "sha256:a77af889efdf22215e539ce0b30ad1403a9f8e46e975db57d45aa142934e28d6",
+    "canonicalization_version": "v1"
+  },
+  "label": "valid",
+  "label_released_at": "2026-07-24T14:00:00Z",
+  "producer": "pcs-core",
+  "producer_version": "0.1.0",
+  "protected_rationale": {
+    "location_class": "partner_vault"
+  },
+  "protocol_id": "adj-protocol",
+  "protocol_version": "1.0.0",
+  "schema_version": "v1",
+  "source_commit": "e068794683959c52a19594a6d271dd5e69f3c999",
+  "source_repo": "https://github.com/SentinelOps-CI/pcs-core",
+  "subject": {
+    "artifact_digest": "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee",
+    "artifact_id": "vr-001",
+    "artifact_type": "VerificationResult.v1"
+  },
+  "votes": [
+    {
+      "role": "primary",
+      "vote": "valid",
+      "voter_pseudonym_id": "voter-a"
+    }
+  ]
+}

benchmarks/verifier_assurance_conformance/invalid/missing_commitment/manifest.json

@@ -0,0 +1,5 @@
+{
+  "artifact_file": "artifact.json",
+  "artifact_type": "AdjudicationRecord.v1",
+  "expected_error": "RationaleCommitment"
+}

benchmarks/verifier_assurance_conformance/invalid/timeout_accept/artifact.json

@@ -0,0 +1,56 @@
+{
+  "artifact_type": "VerificationResult.v1",
+  "check_groups": [
+    {
+      "checks": [
+        {
+          "check_id": "process.complete",
+          "mandatory": true,
+          "status": "passed"
+        }
+      ],
+      "kind": "process"
+    },
+    {
+      "checks": [
+        {
+          "check_id": "evidence.present",
+          "mandatory": true,
+          "status": "passed"
+        }
+      ],
+      "kind": "evidence"
+    }
+  ],
+  "claim_ids": [
+    "claim.safety.no_egress"
+  ],
+  "created_at": "2026-07-24T12:05:00Z",
+  "decision": "accept",
+  "execution_status": "timeout",
+  "initial_state_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "input_bundle_digest": "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc",
+  "integrity": {
+    "artifact_digest": "sha256:07a522dcc2e210ac21a00de975f2d64ae7cf11a38c06ccb74ae52074a7b5c042",
+    "canonicalization_version": "v1"
+  },
+  "normalization_applied": true,
+  "normalized_result_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "producer": "OVK",
+  "producer_version": "0.1.0",
+  "raw_backend_output_digest": "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+  "resource_limits": {
+    "memory_bytes": 1048576,
+    "wall_time_ms": 1000
+  },
+  "schema_version": "v1",
+  "source_commit": "e068794683959c52a19594a6d271dd5e69f3c999",
+  "source_repo": "https://github.com/SentinelOps-CI/pcs-core",
+  "terminal_state_digest": "sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+  "trajectory_digest": "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
+  "verification_result_id": "vr-001",
+  "verifier_profile": {
+    "profile_digest": "sha256:c515b34f1f61d9b8d139d2a14a92409b2d45ffee16d16bb4c89913db1ebd53b0",
+    "verifier_profile_id": "vp-ovk-static-001"
+  }
+}

benchmarks/verifier_assurance_conformance/invalid/timeout_accept/manifest.json

@@ -0,0 +1,5 @@
+{
+  "artifact_file": "artifact.json",
+  "artifact_type": "VerificationResult.v1",
+  "expected_error": "FailClosedDecision"
+}