the sworn action and the browser verifier: a second implementation agrees on all 1689 vectors in scope

[fathomlab]

Leg 3, items 4 and 5 of papers/PLAN_the_next_level_2026_09_02.md: the report-only sworn action, and the browser verifier held to the conformance vectors with the capsule profile that seals what it re-derives. Base is feat/charon-v01; this branch contains the conformance-vectors leg (#63) and the harness-adapters leg (#62) by merge, because the action needs the adapters and the verifier needs the vectors. Review after those two, or review this alone and take all four legs together.

The headline

A second implementation of the sworn verifier, written in another language, reproduces the verdict core digest on every conformance vector in scope: 1689 of 1689, zero disagreements.

The vector set exists so a second verifier can be shown where it disagrees, byte by byte, before anyone is asked to trust it. Nothing had ever been held to it. Now something has, and the five places where it first disagreed were exactly the places where Python and JavaScript read the same bytes differently:

what disagreed	what the vector said
the class name Python prints for a parsed JSON object	_Obj, not dict
absent over a receipt with no declared completeness	UNRESOLVED manifest_no_completeness
absent over a receipt declared incomplete	MALFORMED absent_over_partial, provenance carried
a manifest's numbers	plain JSON, while receipt bytes stay decimal-exact
the last line of an L-anchor	its terminating newline is excluded

All five were repaired in the JavaScript. styxx/sworn.py is not touched by this branch, and the vector set digest does not move.

Item 4 — the sworn action (report-only)

sworn/action.yml + sworn/sworn_action.py, in its own subdirectory because the root action is diffgate's. In a pull-request job it runs the project's test command, mints a sworn/manifest/0.2 after the turn through the JUnit and GitHub adapters, verifies every sworn document the pull request touched, writes a job-summary table carrying the rung and the harness string on every row, and exits zero on every verdict — the command's exit status is a record, never the job's, because a gate this lab has not measured is a gate this lab does not ship.

• The composed receipt numbering is stated, not guessed: r1–r4 are the JUnit adapter's, r5–r9 the GitHub adapter's shifted by four. A document citing an rN the runner never minted reads UNRESOLVED, not an error.
• The fork sentence is printed into every manifest: on a pull_request from a fork the minting job runs the workflow file as it exists in the head, so the manifest is minted by a party the claimant controls and the sentence L2 rests on does not hold.
• A committed sample run drives the whole action over a temporary repository with no network: a held body, a five-span held document, a contradicted document, an unresolved citation, two skips with reasons, exit 0 throughout.
• RESULT_sworn_action_v01_ships_2026_09_05.md, sworn, 16 spans.

Nothing under .github/ is touched — no token in this lab can push a workflow file. sworn/examples/sworn.yml is there for the operator to copy, and this repository enables nothing.

Item 5 — the browser verifier and the capsule profile

styxx/_data/sworn_verify.js: the lexer, the receipt grammar, the manifest, the four kinds and the core assembly, ported so sha256(utf8(jcs(core))) equals what styxx.sworn computes. Pure — no I/O, no clock, no globals, no network; byte offsets over Uint8Array, never string indices; sha256 implemented in the file because crypto.subtle is async-only and a capsule layer must answer without a promise chain.

The capsule's sworn profile seals the document bytes, the manifest, the verdict receipt and the verifier's own bytes, LF-only so the sealed copy and the copy the browser runs are byte-identical. Five named refusals at mint (sworn_document_mismatch, sworn_tree_receipt, sworn_no_manifest, sworn_manifest_mismatch, sworn_receipt_mismatch); INSTRUMENT SKEW kept apart from tamper on verify.

The label is demonstrated, not asserted. The tamper battery builds the forger the plan's own words describe — a page whose inlined verifier quietly un-does the change made to the document — and shows layer 1 believing it while layer 2 names the inlined copy as not the sealed one. That is what a forger controlling the whole file passes both browser layers; the package at the named commit is the check means, and it is now a test.

Verification

• tests/test_sworn_action.py 35 · tests/test_sworn_verify_js.py 7 · tests/test_capsule_sworn.py 14 · tests/test_sworn_eol.py 163.
• node conformance/sworn/replay_js.js: 1689 ran, 1689 passed, 0 failed, 1929 skipped, against set cb5d5148….
• Both RESULTs re-derive: python -m styxx.sworn check VERIFIED.
• python -m ruff check styxx: clean. Full suite on this branch (Windows, Python 3.12): 4192 passed, 11 skipped, 4 xfailed. The dogfood guard caught both RESULT sidecars naming no commit at first; they were re-canoned at the commits their receipts resolve at, with no verdict and no number moved.

What none of it says

That the action has run on GitHub. That L2 has been verified — the rung is the workflow's declaration, printed, never checked. That agreement on the vectors makes either verifier correct: the same hands wrote both, and that is the objection to press. That the format is covered — 1929 vectors sit outside this subset, including every sidecar and everything needing a tree. That path: receipts can be checked offline. That anything here is self-verifying.

🤖 Generated with Claude Code