Hijack
provr

SESSION-0047

Start
Apr 22, 2026, 11:29 PM
End
Apr 23, 2026, 1:07 PM
Duration
14 hours
Source: provr/sessions/SESSION-0047-2026-04-22.md

Session 0047 — 2026-04-22

Opening

  • Start time: 2026-04-22 23:29:05 BST

  • Sessions completed: 45 (SESSION-0001 through SESSION-0046;
    SESSION-0037 did not run)

  • LAUNCH-1: CLOSED — GO decision (SESSION-0021, 2026-04-15).
    Protective disciplines active. Day-180 go/no-go checkpoint
    remains. No active countdown — decision made before the
    2026-04-27 deadline.

  • Starting state (per SESSION-0046 close):

    • Highest SPEC-N: SPEC-155
    • Highest SCHEMA-N: SCHEMA-7
    • Highest VAL-N: VAL-5
    • Highest DOC-N: DOC-12
    • Highest RELEASE-N: RELEASE-10
    • Open SPEC: 2 — SPEC-151 (sole v1.0 ratification-blocker,
      optional X.509 signer identity) and SPEC-152 (optional
      transparency-log attestation, v1.1 / v1.2 consideration)
    • Closed SPEC: 152
    • Open non-SPEC: 1 SCHEMA (SCHEMA-2 v1.1) + 1 VAL (VAL-4
      post-RELEASE-8) + 4 DOC (DOC-3, 9, 11, 12) + 5 RELEASE
      (3, 4, 8, 9, 10) = 11
    • Total open: 13; total closed: 172
    • Deferred (uncounted): VAL-2, DOC-2 = 2
    • Completion: 172 / 185 ≈ 93.0%
    • v1.0 SPEC blockers: 1 (SPEC-151). After SPEC-151 lands,
      RELEASE-8 pre-Rust review gate unblocks. DOC-9 corpus regen
      is the other substantial v1.0 track but does not gate
      RELEASE-8.

  • Cleanliness check: PASSED. Git — working tree clean; 8 commits
    ahead of origin/main (none pushed). SESSION-0046 closing
    section fully populated (end time, duration, ending state,
    8 commits listed, next work unit, notes). CURRENT_SESSION_STATE.md
    body reflects post-SESSION-0046 state; the "Last updated" header
    line still reads post SESSION-0045; SESSION-0046 opening
    additions     — a minor staleness flagged for tidy if this session
    touches the state file.

  • Mid-flow notes from SESSION-0046 close:

    • Next work unit (carry-forward): SPEC-151 — optional X.509
      signer identity alongside DID-based signing. Sole remaining
      v1.0 ratification-blocker. Schema additions on six tables
      (ProvenanceData, ApprovedSigner, ReadVerification,
      RepudiationNote, ResolutionNote, PolicyOverride) with
      exactly-one-identity rule per signed structure; §6.7.0
      canonical-signing-input extension (identity-tag discriminator
      byte — preimage shape changes across every signing
      construction); reuses SPEC-150's §6.7.1.3 X.509 validation
      primitive; new exit code 0x3A WARN_X509_CHAIN_UNRESOLVED;
      prose across §6.13 / §6.30 / §6.16.5 / §12; optional Appendix
      A follow-up (dual-identity-path display rows in §A.10 / §A.11
      / §A.9 that SPEC-146 deferred). Size estimate 4–6 hours; Opus
      1M recommended for cross-section consistency. Must extend
      tools/gen_signing_vectors.py and regen V1–V8 test vectors in
      the same commit as the spec change.
    • Commit discipline: PROVR_RULES rev 25 active —
      single-focus subjects, narrative bodies, enumeration only for
      list-shaped content. Held cleanly through SESSION-0046.
    • Framing guard: PROVR_RULES rev 24 active — ratification-
      quality up front; no MVP-iterate-later slips. Held cleanly
      through SESSION-0046.
    • Signing-vector generator: tools/gen_signing_vectors.py
      remains at the post-SPEC-143 shape. SPEC-151 is the next
      preimage-changing SPEC; extend the generator in the same
      commit per established discipline.
    • Audit report preserved: AUDIT-2026-04-22-C2PA-2_3.md
      captures the C2PA 2.3 interop review findings, including three
      pieces of positive interop signal (Manifest-Store preservation,
      device attestation, hard-binding coexistence) worth keeping
      for future ecosystem-doc work.

  • Fixes / follow-ups flagged in CURRENT_SESSION_STATE.md:

    • CURRENT_SESSION_STATE.md "Last updated" header line still
      reads post-SESSION-0045 framing; body content is current
      post-SESSION-0046. Tidy if this session touches the state file.
    • Design-doc Status-header audit across docs/design/ files
      (rev-20 coupling rule) still outstanding from SESSION-0044
      carry-forward; ledger_architecture.md updated, others not
      re-checked.
    • DOC-3, DOC-9 (substantially expanded scope), DOC-11, DOC-12
      remain open; DOC-9 is the other substantial remaining v1.0
      blocker (corpus regeneration, ~65–70 fixtures at v1.0,
      parallel track that does not gate RELEASE-8).
    • SCHEMA-2 (v1.1), VAL-4 (post-RELEASE-8), five RELEASE gates
      (3, 4, 8, 9, 10) still open.
    • Optional SPEC-146 follow-up: dual-identity-path display rows
      in Appendix A §A.10 / §A.11 / §A.9 were deferred pending
      SPEC-151 schema fields. Consider bundling with SPEC-151 or
      filing as a small follow-up once SPEC-151 closes.

Work

Primary deliverable: SPEC-151 closed end-to-end at the widest-
possible scope. The item as filed at SESSION-0046 enumerated six
signing surfaces; at SESSION-0047 opening the scope was widened to
every signing construction that binds an identity — twelve signing
preimages in total (PROVRSIG, PROVRSCP, PROVRKEY, PROVROVR, PROVRFIN,
PROVRLEV, PROVRLST, PROVRRDV, PROVRRPD, PROVRRSV, PROVRACK, PROVRSGL)
— on the ratification-quality ground that an enterprise-PKI-only
facility cannot coherently run half the format in X.509 and half in
DIDs. A new §6.7.0.3 defines a canonical identity block (1-byte
discriminator — 0x00 = DID URI, 0x01 = X.509 subject DN in RFC 4514
canonical form — followed by length-prefixed UTF-8 identity bytes)
referenced by every signing input.

Schema: every identity-bearing table gained a parallel
*_x509_subject + *_x509_cert_chain pair alongside the existing
DID field, with the exactly-one-identity rule enforced at parse /
verification time. Tables extended: ProvenanceData, CreatorInfo,
PolicyOverride, ReadVerification, RepudiationNote,
ResolutionNote, RegistryAck (acknowledged_signer_*), Manifest
(final_seal_by_*), LedgerEvent, LedgerState. ApprovedSigner
gained signer_x509_subject + signer_x509_cert_chain_hash (BLAKE3-32
digest; hash rather than full chain keeps the list compact).
Metadata-only identity fields (LockReceipt.locked_by,
VFXVersionMetadata.approved_by) gained parallel X.509 pairs for
structural uniformity even though they are not bound into any signing
preimage.

Canonical encodings: §6.7.0.2.1/2/3 (per-attestor) and §6.24.6.1
(CreatorInfo) extended with the identity block plus wire-fidelity
binding of the X.509 cert chain bytes. §6.30.10 canonical_approved_signer
extended with the identity block plus the 32-byte cert-chain hash.

New exit code 0x3A WARN_X509_CHAIN_UNRESOLVED allocated after
SPEC-150's 0x38 / 0x39 block. Exit Code Classes range extended
from 0x07–0x39 to 0x07–0x3A. §6.4.4's Cross-Chain Grafting
Prevention rule generalised from same-signer_did to identity-
agnostic same-identity-path-and-bytes equality; mixed-identity-path
resumption chains are explicitly non-conformant.

Prose updates across §4 References (RFC 4514 added, RFC 5280
elaborated as the shared X.509 validation primitive), §6.13 Identity
(rewritten with DIDs and X.509 both first-class; did:key remains
archival-recommended default; workflow-matching not tier-gating),
§6.16.5 Attested rule 2 (identity-agnostic signer matching), §12
Forensic Conformance (both identity paths listed explicitly),
§6.30.3 ApprovedSigner field semantics, §6.27 and §6.28 per-entry
prose (exactly-one-identity rule).

Test vectors regenerated: V1 (MmrLeaf, binds no identity) unchanged;
V2, V2b, V3, V4, V5, V6, V7, V8 regenerated with the identity-block
shape; two new X.509-path companion vectors added (V2x at §6.7.0,
V6x at §6.27.6). Generator output deterministic across runs.
FlatBuffers bindings regenerated across Rust / C++ / Python.

Follow-on work this session:

  • PROVR_RULES rev 26 — Licensing / certification / trademark
    docs at ~/hijackr/Notes/provr/licensing/ formalised as an
    authoritative source. Repository cleanliness rule extended to
    forbid commercial-licence content in the provr repo.

  • Pre-Corpus Audit Campaign — a 24-round v1.0-ratification audit
    discipline drafted and iterated with the user into v2.1 at
    ~/hijackr/Notes/provr/PRE_CORPUS_AUDIT_CAMPAIGN.md. Each lens
    becomes its own round; every round has a wildcard reflection
    step; finding-retention discipline codified; Phase A market-fit /
    industry-positioning review inserted between campaign termination
    and corpus. INDUSTRY_POSITIONING.md stub created for Phase A.

  • PROVR_RULES rev 27 — Campaign doc formalised as mandatory
    session-startup reading. Session-startup protocol updated to read
    the campaign doc after CURRENT_SESSION_STATE.md. Notes-side
    durability (new hijackr-notes private repo) codified. Next
    session's natural work unit is Phase 0 (Polish pass) per campaign
    doc §4.

  • Notes-side repository — github.com/hijackr-dev/hijackr-notes
    (private) created. Website-migration working assets physically
    relocated from ~/hijackr/Notes/hijackpost/ to
    ~/hijackr/working/hijackpost-migration/ outside the Notes tree.
    Partner contracts (ARRI Partner Program Agreement; HIJACK-POST
    standard T&Cs) centralised at ~/hijackr/Notes/contracts/.
    107MB incomplete download deleted. .gitignore minimised
    (.DS_Store, *.crdownload). Initial commit 8386296 pushed;
    114 files tracked.

  • Design-doc Status-header audit (rev-20 carry-forward) —
    docs/design/ledger_architecture.md updated with a SPEC-151
    extension note; the other three design docs were already current.

  • EUDI alignment memory updated — project_eudi_alignment.md now
    records that SPEC-151's X.509 support is end-to-end across every
    signing surface, not just the outer manifest signature.

  • CURRENT_SESSION_STATE.md rewritten — post-SESSION-0047 state
    (153 / 154 SPEC items closed; no v1.0 SPEC blockers remain);
    Natural Next Work Unit rewritten to point at Phase 0 Polish pass.

Commits:

  • c46cb2e — spec: optional X.509 signer identity alongside DIDs
    end-to-end
  • 6f73d26 — docs(ledger): note SPEC-151 identity-block extension
    in ledger rationale
  • (Notes-side, in hijackr-notes repo): 8386296 initial commit +
    SESSION-0047 close notes + CURRENT_SESSION_STATE + PROVR_RULES
    rev 27.

Closing

  • End time: 2026-04-23 13:07:16 BST

  • Duration: approximately 13h 35m (start 2026-04-22 23:29:05 BST;
    end 2026-04-23 13:07:16 BST; a long session spanning the
    SESSION-0047 envelope — sustained heavy execution on SPEC-151
    plus the campaign planning and Notes-repo setup)

  • Ending state:

    • Highest SPEC-N: SPEC-155 (unchanged)
    • Highest SCHEMA-N: SCHEMA-7 (unchanged)
    • Highest VAL-N: VAL-5 (unchanged)
    • Highest DOC-N: DOC-12 (unchanged)
    • Highest RELEASE-N: RELEASE-10 (unchanged)
    • Open SPEC: 1 — SPEC-152 (v1.1 / v1.2 consideration, not a v1.0
      blocker)
    • Closed SPEC: 153 (152 at session start + 1 this session —
      SPEC-151)
    • Open non-SPEC: 1 SCHEMA (SCHEMA-2 v1.1) + 1 VAL (VAL-4 post-
      RELEASE-8) + 4 DOC (DOC-3, 9, 11, 12) + 5 RELEASE (3, 4, 8, 9,
      1. = 11
    • Total open: 12; total closed: 173
    • Deferred (uncounted): VAL-2, DOC-2 = 2
    • Completion: 173 / 185 ≈ 93.5%
    • v1.0 SPEC blockers: 0. Pre-Corpus Audit Campaign is the next
      active track per PROVR_RULES rev 27.

  • Commits (this session's delta on main, both pushed to origin):

    • c46cb2e — spec: optional X.509 signer identity alongside DIDs
      end-to-end (26 files changed, +2,795 / −837)
    • 6f73d26 — docs(ledger): note SPEC-151 identity-block extension
      in ledger rationale (1 file, +1 / −1)

  • Push status: 6f73d26 pushed to origin/main; range pushed
    c0b920b..6f73d26. origin/main now even with local main.

  • Notes-side durability: github.com/hijackr-dev/hijackr-notes live
    and tracking.

Next work unit (SESSION-0048)

Phase 0 — Polish pass per PRE_CORPUS_AUDIT_CAMPAIGN.md §4.
Session-budget capped at 1 session. Known-pending items:

  1. Appendix A §A.9 dual-identity-path display row (supersede /
    key-rotation).
  2. Appendix A §A.10 dual-identity-path display row (PolicyOverride).
  3. Appendix A §A.11 dual-identity-path display row (RegistryAck).
  4. Mixed-identity-path display convention — decided once, applied
    uniformly.
  5. Cross-reference housekeeping (stale see §N references from
    SPEC-151 prose rewrites).

Overflow items (e.g. X.509 display-format design calls beyond DN
truncation, chain-resolution indicator conventions) escalate to
Round 1 Assumption audit findings rather than expanding polish
scope.

Notes for SESSION-0048

  • PROVR_RULES rev 27 adds the campaign doc to mandatory session-
    startup reading. SESSION-0048 startup protocol reads the campaign
    doc after CURRENT_SESSION_STATE.md, identifies Phase 0 from the
    §13.1 status table, and reads §4 for the polish-pass spec.
  • Finding log convention is established in campaign-doc §3.11.
    Polish-pass overflow items are captured as FINDING-R1-NN
    entries in TRACKING.md with full entry-format fields.
  • Session-close protocol gains a mandatory Notes-side commit +
    push per campaign-doc §3.12. Message pattern: notes: SESSION- NNNN — {summary}.
  • INDUSTRY_POSITIONING.md exists as a stub for Phase A; sessions
    through the campaign may add reference material there but the
    full writeup lands at Phase A (post-campaign).
  • hijackr-notes repo is the canonical backup for all Notes-side
    artefacts. Working-folder media lives outside the Notes tree at
    ~/hijackr/working/hijackpost-migration/. Partner contracts live
    at ~/hijackr/Notes/contracts/.
  • 24 rounds + fix passes + Phase A + corpus + external reviews +
    user actions = an estimated 70–100 sessions to v1.0 public
    ratification. Rev-24 ratification-quality framing justifies the
    budget; corpus regeneration post-ratification is a major-version
    break.