{
  "version": "1.0",
  "updated": "2026-07-12",
  "about": "Machine-readable claims register for Magenta Canon's public trust surface. It maps each public claim to its status, supporting evidence, independent verification, and explicit limitations, so human and AI evaluators can distinguish proven capabilities from evaluation posture, roadmap, doctrine, and explicit non-claims. This register describes claims; it does not by itself establish truth — the evidence and the standalone verifier do.",
  "status_legend": {
    "proven": "Committed, verifiable evidence exists for this claim in the reference implementation.",
    "supported": "Implementation exists but its guarantees depend on deployment configuration.",
    "design_partner_evaluation": "Available to qualified design partners during controlled private evaluation.",
    "roadmap": "Planned; not implemented. Not to be relied upon.",
    "doctrine": "An operating/positioning principle, not a technical capability claim.",
    "not_claimed": "Something Magenta Canon intentionally does NOT claim."
  },
  "last_verified_meaning": "The date the claim was last reconciled against committed repository evidence — not a guarantee of a fresh live re-run against any particular deployment.",
  "deployment_note": "The public hosted instance (Render) is an evaluation surface running in-memory (MemStorage): execution receipts, transparency state, and control-plane state are memory-only and do not survive a restart, and replay-protection state also resets on restart. Durable Postgres and file mechanisms exist, but they require explicit receipt-ledger selectors (MAGENTA_LEDGER_DATABASE_URL or MAGENTA_LEDGER_FILE), appropriate persistent storage, and matching witness/issuer key custody; the canonical durable receipt mode is not activated by the visible production configuration. The canonical witness key is environment-custodied and may survive an ordinary restart/redeploy while the same pair remains configured — key custody, not a backup or disaster-recovery guarantee. Do not treat hosted evidence as durable production evidence storage.",
  "witness": {
    "status": "roadmap",
    "active": false,
    "note": "Witnessing this register on the transparency log (so its own hash is independently verifiable and cannot be silently changed) is planned, not implemented. Until then, do not treat this file as cryptographically attested."
  },
  "claims": [
    {
      "id": "mc.claim.authority_before_execution",
      "claim": "Authority is evaluated before an AI-agent action executes.",
      "status": "proven",
      "evidence": ["/proof", "/evidence"],
      "verification": ["standalone verifier", "MCP gateway proof run"],
      "limitations": ["Demonstrated on the reference/evaluation path; deployment-specific durability depends on configuration."],
      "pages": ["/", "/platform", "/proof", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.default_deny_blocks_unauthorized",
      "claim": "Unauthorized AI-requested actions are blocked before they reach the downstream tool.",
      "status": "proven",
      "evidence": ["/proof", "/evidence"],
      "verification": ["standalone verifier", "downstream tool log shows the blocked call is absent", "tamper-negative control"],
      "limitations": ["Enforced path today is capability grants + ceilings; richer operator policy is built but not the enforced path."],
      "pages": ["/", "/platform", "/proof", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.receipts_for_decisions",
      "claim": "Allowed and blocked decisions alike produce signed, hash-chained receipts.",
      "status": "proven",
      "evidence": ["/proof", "/evidence"],
      "verification": ["standalone verifier", "Merkle transparency log"],
      "limitations": ["On the hosted evaluation instance receipts are in-memory and ephemeral (see deployment_note)."],
      "pages": ["/platform", "/proof", "/evidence", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.independent_verification",
      "claim": "An exported evidence bundle can be verified independently, without trusting the hosted app.",
      "status": "proven",
      "evidence": ["/proof", "/evidence"],
      "verification": ["standalone verifier (shares no code with the server)"],
      "limitations": ["Verifies integrity of the bundle it is given; freshness and non-equivocation against the operator require an external witness (roadmap)."],
      "pages": ["/", "/platform", "/proof", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.tamper_negative",
      "claim": "Tampered evidence fails verification — one flipped byte makes the verifier report failure.",
      "status": "proven",
      "evidence": ["/proof", "/evidence"],
      "verification": ["standalone verifier", "tamper-negative control"],
      "limitations": [],
      "pages": ["/", "/proof", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.hosted_not_durable",
      "claim": "The public hosted instance is NOT durable production evidence storage.",
      "status": "not_claimed",
      "evidence": ["/trust#non-claims", "/platform", "docs/DURABILITY_AND_RECOVERY.md"],
      "verification": [],
      "limitations": ["Hosted receipts, transparency state, and control-plane state remain process-memory and do not survive a restart or redeploy; replay-protection state resets on restart.", "Durable Postgres/file mechanisms exist but are not activated for canonical receipts.", "Witness key custody is separate and currently environment-backed; environment custody is not a backup or disaster-recovery guarantee."],
      "pages": ["/platform", "/trust"],
      "last_verified": "2026-07-12"
    },
    {
      "id": "mc.claim.selfhost_durable_witness",
      "claim": "A self-host deployment can configure a durable, Postgres-backed or file-backed witness/evidence path.",
      "status": "supported",
      "evidence": ["self-host reference (repo-source)", "docs/DURABILITY_AND_RECOVERY.md"],
      "verification": ["\"Durable witness (Postgres)\" CI job exercises the Postgres-backed path", "file-ledger SIGKILL replay/recovery tests exercise the file-backed path"],
      "limitations": ["The durable receipt-ledger selectors are MAGENTA_LEDGER_DATABASE_URL (Postgres) and MAGENTA_LEDGER_FILE (file); the human-plane org database is a distinct path and does not activate the receipt ledger.", "File mode has real SIGKILL replay/recovery coverage; the Postgres path has transactional single-writer and clean-reopen coverage, but arbitrary-crash and region-loss recovery are not claimed.", "Continuity requires matching witness and issuer key custody; persistent storage and configuration are the operator's responsibility.", "No backup, restore, or disaster-recovery guarantee, and no claim of production activation."],
      "pages": ["/platform", "/trust"],
      "last_verified": "2026-07-12"
    },
    {
      "id": "mc.claim.not_iam_oauth_siem",
      "claim": "Magenta Canon does not replace IAM, OAuth, or SIEM.",
      "status": "not_claimed",
      "evidence": ["/platform", "/trust#non-claims"],
      "verification": [],
      "limitations": ["It governs and records AI-agent tool calls at the tool boundary; it is complementary to identity and logging systems, not a replacement."],
      "pages": ["/platform", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.not_broad_ai_safety",
      "claim": "Magenta Canon is not broad AI safety, model alignment, or prompt-injection prevention.",
      "status": "not_claimed",
      "evidence": ["/platform", "/jurisdictions/autonomous-systems", "/trust#non-claims"],
      "verification": [],
      "limitations": ["The claim is bounded to tool-action authority: allowed actions proceed, withheld actions are blocked and recorded. It does not make a model safe or aligned."],
      "pages": ["/platform", "/jurisdictions/autonomous-systems", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.sector_not_advice",
      "claim": "Sector proof rooms are evaluation contexts, not professional (legal, clinical, financial, or regulatory) advice.",
      "status": "doctrine",
      "evidence": ["/jurisdictions", "/trust#non-claims"],
      "verification": [],
      "limitations": ["Interpretation, compliance determination, and legal judgment remain the responsibility of external reviewers."],
      "pages": ["/jurisdictions", "/jurisdictions/finance", "/jurisdictions/healthcare", "/jurisdictions/law", "/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.mdk_reference_not_runtime",
      "claim": "MDK is a reference/internal initialization model, not a required public runtime.",
      "status": "doctrine",
      "evidence": ["/mdk"],
      "verification": [],
      "limitations": ["MDK illustrates how the trust core reasons about eligibility; it is not a public runtime an evaluator must install."],
      "pages": ["/mdk"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.nonequivocation_roadmap",
      "claim": "Non-equivocation via an external witness / STH mirroring (proving the operator cannot show different histories to different parties) is roadmap, not implemented.",
      "status": "roadmap",
      "evidence": [],
      "verification": [],
      "limitations": ["Today's verifier proves integrity of a given bundle; it does not yet prove freshness or a single, non-forked history against the operator. Do not rely on non-equivocation until implemented."],
      "pages": ["/trust"],
      "last_verified": "2026-07-04"
    },
    {
      "id": "mc.claim.sandbox_privacy_retention",
      "claim": "The invitation-only evaluation sandbox holds evidence in process memory only, with lazy idle (not absolute) eviction and shared LRU capacity; exports carry the evaluator username, and sandbox provenance requires witness-key pinning.",
      "status": "supported",
      "evidence": ["docs/SANDBOX_PRIVACY_AND_RETENTION.md"],
      "verification": ["standalone verifier with --expected-witness-key: a sandbox bundle verifies with the sandbox key, fails against the pinned production key, and its tampered twin fails"],
      "limitations": [
        "Process-memory only — no durable sandbox store; a process restart/replacement loses that process's records; each process has its own registry and sandbox witness key (per-process, not per-deployment).",
        "The ~8-hour threshold is INACTIVITY-based, not an absolute lifetime: recording, listing, and bundle-building refresh the activity clock and status inspection does not; eviction is a lazy sweep on later recording activity, so reads before a sweep can refresh a stream. No fixed or guaranteed time of deletion and no secure-erasure claim.",
        "Shared capacity (20 receipts/stream, 50 streams, LRU): one evaluator's activity can indirectly evict another's idle demo stream — an availability coupling, not a supported cross-user read. Not a tenant-isolation claim.",
        "Exports are not anonymous or de-identified: the evaluator username appears in the stream id, the bundle, and the download filename. Use synthetic / non-sensitive inputs only.",
        "No 'no operator access' claim: infrastructure-level operator/platform access to the running process and platform logs cannot be excluded by repository controls; platform-log retention and any external log drains are deployment-operator settings and are not established here.",
        "Provenance depends on witness-key pinning; the 'sandbox' text label alone is not a cryptographic provenance guarantee."
      ],
      "pages": ["/portal"],
      "last_verified": "2026-07-12"
    },
    {
      "id": "mc.claim.durability_recovery_posture",
      "claim": "Magenta Canon provides configuration-dependent durable ledger and identity continuity mechanisms, while the canonical hosted evaluator keeps execution receipts and control-plane state in process memory.",
      "status": "supported",
      "evidence": ["docs/DURABILITY_AND_RECOVERY.md", "docs/devops/RECOVERY_RUNBOOK.md"],
      "verification": ["file-ledger restart / SIGKILL replay tests", "Postgres durability tests (\"Durable witness (Postgres)\" CI job)", "deployment-identity mode-label tests", "standalone verifier with --expected-witness-key pinning"],
      "limitations": [
        "On the canonical hosted evaluator, execution receipts, transparency state, and control-plane state are memory-only and do not survive a restart or redeploy.",
        "The bare human-plane database configuration is not a receipt-ledger selector; the durable receipt selectors are MAGENTA_LEDGER_DATABASE_URL and MAGENTA_LEDGER_FILE.",
        "The canonical witness key is environment-custodied (not ephemeral) and may survive an ordinary restart while the same pair remains configured; this is key custody, not a backup guarantee, and witness continuity is not guaranteed.",
        "Canonical issuer (trust-root) custody is unknown from the available metadata; issuer continuity is not guaranteed.",
        "Receipt append and witness/STH append are separate writes, not one atomic transaction; transparency state is reconstructed from authoritative receipts on startup in durable modes.",
        "No exactly-once guarantee and no request-level idempotency guarantee; a lost response plus retry can produce another logical execution.",
        "/healthz is a liveness and mode-identification surface, not a durable-write readiness guarantee.",
        "Provider backup and restore status are unknown; no tested restore, no disaster-recovery, and no RPO/RTO/HA claim.",
        "Recovery requires both the matching ledger/state and the matching witness/issuer key custody; one without the other does not restore continuity."
      ],
      "pages": ["/platform", "/trust"],
      "last_verified": "2026-07-12"
    }
  ]
}