Document bounded Correctover / CCS external interoperability findings

docs/external-evidence-participation.md

@@ -21,6 +21,17 @@ result or a decision. Validate the index with:
 python3 tools/check_external_participation_campaign.py
 ```
 
+## Reported external binding experiments
+
+The [September 28 Correctover / CCS experiment](../evidence/IICP_CCS_INTEROPERABILITY_EXPERIMENT_2026-09-28.md)
+records externally reported composition of the released Python MCP gateway with
+an external execution-assurance layer. It preserves the tested versions,
+14/14 expected case outcomes, 415/426 checker checks and the missing reproduction
+artifacts. It is not a full IICP intent-to-execution result, independent Directory
+implementation, campaign participant acceptance or pre-1.0 qualification credit.
+Its architectural questions are tracked separately and deferred until after
+qualification; the five participation lanes below remain unchanged.
+
 ## Choose one lane
 
 | Lane | Tracker | Who is needed | Starting artifact | Completion evidence |

evidence/IICP_CCS_INTEROPERABILITY_EXPERIMENT_2026-09-28.md

@@ -0,0 +1,226 @@
+# IICP MCP gateway × CCS external interoperability experiment
+
+- **Experiment date:** 2026-09-28
+- **Source review date:** 2026-09-29
+- **Classification:** `EXTERNAL_INTEROPERABILITY_EVIDENCE`
+- **Disposition:** successful bounded externally reported experiment
+- **Pre-1.0 qualification credit:** zero
+
+Correctover reports that an external execution-assurance layer composed with an
+unmodified, released IICP MCP gateway. This is useful third-party composition
+evidence, not IICP certification, independent Directory implementation evidence,
+or a complete intent-to-execution interoperability result. No IICP source change,
+Core change or CCS dependency is required by this finding.
+
+## Source and verification boundary
+
+The source is Correctover's findings report, dated 2026-09-28 and supplied to the
+IICP maintainer. This note preserves a sanitized account, not the original
+correspondence, raw requests, responses or operational records. The report says
+that Correctover performed the experiment independently under a boundary of
+released IICP surfaces and no IICP-specific changes.
+
+All execution results below are **Correctover-reported**. IICP's September 29
+review inspected the report, the released Python gateway source and public
+background sources. It did not rerun the experiment or independently verify its
+receipts. The harness, raw receipts, signing-key identity, exact checker commit,
+artifact digests and complete checker output were not available in the supplied
+material. They remain unavailable; current repository HEADs must not be
+substituted for the experiment's missing identities. There is no complete public
+reproduction bundle or executable reproduction procedure established here.
+
+An independently implemented checker can recompute cryptographic results without
+being an unaffiliated operator or an independent IICP implementation. This note
+does not close a clean-room, external-participant or qualification gate.
+
+## Tested surface and environment
+
+The selected command was:
+
+```text
+iicp-node mcp-gateway --tools format_json,summarize_text
+```
+
+The actual installation was the **Python SDK from PyPI**, not Rust. The report
+states that a Rust toolchain was unavailable and the released Python entry point
+was used instead. These results do not qualify the Rust or TypeScript gateways.
+
+| Component | Reported tested version or boundary |
+| --- | --- |
+| Python `iicp-client` / `iicp-node` | `0.7.109`; gateway source unmodified |
+| `ccs-verifier` | **`1.3.0`**, not the proposal's `1.4.2` |
+| Python | `3.13.12`, CPython |
+| Environment | Linux x86_64 container; Linux `5.15.0-100-generic`, glibc `2.35` |
+| `cryptography` | `46.0.5` |
+| `jcs` | `0.2.1` |
+| Independent checker | `ccs-conformance-vectors` checker; exact revision unavailable |
+| Directory and backend | Local Directory stub and local MCP server |
+| Admission path | External pre-admission, gateway tool call, external post-admission, CCS receipt |
+
+The two tools were selected as safe, deterministic operations. The experiment
+did not exercise the dangerous-tool authorization/sandbox control bundle.
+Correctover's seven dimensions were Structure, Schema, Latency, Cost, Identity,
+Integrity and Security; they are the external verifier's checks, not newly
+adopted IICP requirements.
+
+The report attributes version drift to `1.4.2` being unavailable from PyPI at
+execution time. The actual tested version is retained without treating the
+package index's historical availability claim as separately reproduced by IICP.
+
+## Reported results
+
+| Case | Bounded observation | Expected / reported result |
+| --- | --- | --- |
+| P1 | Valid `format_json` invocation | Allow / allow |
+| P2 | Valid `summarize_text` invocation | Allow / allow |
+| P3 | Valid Unicode/CJK `summarize_text` invocation | Allow / allow |
+| N1 | Malformed response structure | Deny / deny |
+| N2 | Missing required argument | Deny / deny |
+| N3 | Incorrect argument type | Deny / deny |
+| N4 | Argument schema constraint violation | Deny / deny |
+| N5 | Identity mismatch | Deny / deny |
+| N6 | Argument-byte budget exceeded | Deny / deny |
+| N7 | Credential-pattern detection | Deny / deny |
+| N8 | End-to-end latency budget exceeded | Deny / deny |
+| N9 | Malformed response content | Deny / deny |
+| N10 | Mutation of an already signed receipt | Original verifies; modified receipt fails verification |
+| N11 | Backend transport failure | Escalate / escalate |
+
+Correctover reports **14/14 expected case outcomes**: three positive and eleven
+negative/escalation cases, with no negative case admitted as `allow`.
+The argument-byte budget test does not establish actual billing or monetary cost
+accuracy. Security checks are bounded test observations, not universal protection.
+
+Separate native gateway probes reportedly returned **HTTP 404** for an
+unadvertised tool and **HTTP 401** without authorization. These observations are
+distinct from CCS verdict logic and apply to the paths probed, not every possible
+gateway refusal or execution binding.
+
+### Checker vocabulary and cryptographic scope
+
+The reported independent-checker result is **415/426 individual checks**. The
+eleven remaining checks are attributed to a verdict vocabulary mismatch:
+
+- tested verifier: `allow` / `deny` / `escalate`;
+- checker: `allow` / `block`.
+
+The report attributes these eleven checks to vocabulary rather than receipt
+signature/hash failures. Do not describe the result as `426/426 conformance`.
+An escalation requiring operator action is not automatically equivalent to a
+binary refusal. No IICP vocabulary or normalization rule is changed here.
+
+Correctover reports detached Ed25519 signatures over RFC 8785 JCS bytes, SHA-256
+content bindings, independently recomputed canonical bytes/hashes/signatures,
+and rejection of a post-signing mutation. This supports the **reported**
+tamper-evidence result for the tested CCS receipt/key model. It does not establish
+who legitimately controlled that key, the truth of every issuer assertion, or
+execution of the full IICP chain.
+
+## Existing IICP mechanisms and separate trust responsibilities
+
+The tested Python release resolves locally to commit
+`7718dd35904568f3a10777a11ee3a3ffeeeaffab`:
+
+- [`McpToolPolicy.receipt`](https://github.com/RobLe3/iicp-client-python/blob/7718dd35904568f3a10777a11ee3a3ffeeeaffab/src/iicp_client/mcp_policy.py)
+  emits unsigned metadata including tool risk, decision, policy/sandbox labels,
+  redaction status, argument count and `argument_content: "excluded"`.
+- The [gateway response](https://github.com/RobLe3/iicp-client-python/blob/7718dd35904568f3a10777a11ee3a3ffeeeaffab/src/iicp_client/cli.py)
+  places `task_id` beside the successful result and policy receipt. This is
+  existing correlation, not detached-signed authorization or execution evidence.
+- The [MCP binding](../spec/v1.9/iicp-mcp-binding.md) distinguishes IICP task
+  correlation from MCP credentials and excludes downstream credentials, session
+  identifiers and raw tool arguments from receipts/audit records.
+- The [route-ticket and receipt proposal](../research/pre-normative-profiles/route-ticket-and-receipt-profile.md)
+  already separates Directory, client and node evidence. A v1 ticket authorizes
+  **route disclosure only**, not node admission or proof of execution. The
+  [optional v2 trust proposal](../research/pre-normative-profiles/dispatch-ticket-trust-profile-v2.md)
+  remains separately scoped; this experiment does not promote either profile.
+- Existing [session/principal/receipt crosswalks](../standards/EMERGING_SECURITY_SESSION_EVIDENCE_CROSSWALK_2026-09-25.md)
+  and [IICP #63](https://github.com/RobLe3/IICP/issues/63) distinguish identity,
+  authority and evidence assertions. [IICP #54](https://github.com/RobLe3/IICP/issues/54)
+  records the layered protocol approach. Their completed work is reused, not
+  reopened or treated as approval of CCS.
+
+The report's broad statement that both receipt models were detached-signed
+conflicts with its own unsigned-policy-receipt finding and the released source.
+This note does not carry that statement forward. The present MCP policy receipt
+must not be called cryptographically non-repudiable evidence.
+
+At the architectural level, IICP routing/policy evidence and external invocation
+evidence answer adjacent questions. Neither substitutes for the other's verifier
+or authority. In this experiment, the policy receipt alone did not prove a real
+Directory selection or route-ticket authorization.
+
+An external receipt could later reference an earlier immutable task, ticket or
+binding artifact. A possible later completion/provenance artifact could reference
+the external receipt digest. Those are review questions, not new wire fields:
+avoid cyclic signing and requiring an original ticket to reference a future
+receipt. Existing `task_id` correlation does not settle immutable binding or
+attempt identity for every future assurance use case.
+
+### Privacy, licensing and measurement boundaries
+
+IICP excludes tool arguments and execution content from the policy receipt; the
+reported CCS receipts use digests rather than embedding complete payloads. This
+is content-minimization alignment, not identical privacy models or evidence that
+the verifier never sees arguments/results. Digests can retain correlation or
+guessability risks; evidence purpose, issuer and disclosure limits remain explicit.
+
+The [public vectors repository's license scope](https://github.com/DSHCorrectover/ccs-conformance-vectors#license-scope)
+identifies CC0 vectors and an MIT checker. The separately distributed
+[`ccs-verifier` 1.3.0 package](https://pypi.org/project/ccs-verifier/1.3.0/)
+declares Elastic License 2.0; IICP is Apache-2.0. No verifier source, checker or
+vectors are imported, installed as an IICP dependency or vendored by this task.
+ELv2 implementation code must not be copied into IICP under this task. Any later
+third-party source/vector reuse needs explicit, component-specific licensing review.
+
+The report distinguishes Python canonicalization/sign/verify, security-rule work
+and the full local gateway/tool round trip. These boundaries and languages are
+not interchangeable. Its numerical measurements are not adopted as IICP
+performance claims, routing budgets or qualification thresholds.
+
+CCS background is an [individual Internet-Draft](https://datatracker.ietf.org/doc/draft-correctover-ccs/09/),
+not an RFC, adopted IICP contract or IETF endorsement. Revision `09` is a
+September 29 background reference; the experiment did not provide an exact
+draft-revision pin, and this note does not invent one.
+
+## Durable disposition map
+
+| Insight | Disposition | Owner / record | Revisit trigger |
+| --- | --- | --- | --- |
+| External execution-assurance composition | DOCUMENTED; TRACKED_AS_ISSUE; DEFERRED | [IICP #256](https://github.com/RobLe3/IICP/issues/256) and this note | Concrete relying-party need after pre-1.0 qualification |
+| Route/policy versus invocation evidence | COVERED_BY_EXISTING_ARCHITECTURE; DOCUMENTED | MCP binding; ticket/receipt proposals; [IICP #190](https://github.com/RobLe3/IICP/issues/190) | Demonstrated gap, not shared cryptographic vocabulary |
+| Authorization-artifact correlation | TRACKED_AS_ISSUE; DEFERRED | IICP #256 | Review immutable identity, verifier and causal scope |
+| Possible later completion/provenance artifact | TRACKED_AS_ISSUE; DEFERRED | IICP #256 | Justified reverse-link need; no cyclic signing |
+| Policy-receipt trust scope and unsigned status | TRACKED_AS_ISSUE; DEFERRED | [Python SDK #142](https://github.com/RobLe3/iicp-client-python/issues/142) | Accepted trust-model review after qualification |
+| Signing policy receipts merely by analogy | REJECTED_AS_UNNECESSARY | Python SDK #142 | Only a separately justified trust requirement could reopen signing design |
+| Verifier/checker verdict mismatch | DOCUMENTED; no IICP terminology change | This note, checker-boundary section | External version-pinned checker evidence; generic semantics only if later needed |
+| Proposed `1.4.2` versus tested `1.3.0` | DOCUMENTED; no IICP defect | This note, environment section | A future external experiment must pin actual artifacts |
+| Independent receipt recomputation and tamper rejection | DOCUMENTED as externally reported | This note, cryptographic-scope section | Public raw bundle and pinned verifier/checker/key identities for reproduction |
+| Content-minimization alignment and limits | DOCUMENTED; COVERED_BY_EXISTING_ARCHITECTURE | MCP binding; IICP #256 | Future composition review must preserve disclosure boundaries |
+| Latency calibers and language differences | DOCUMENTED; no imported performance claim | This note, measurement-boundary section | Any later evidence must declare exact measurement scope |
+| CC0/MIT/ELv2/Apache-2.0 boundaries | DOCUMENTED; dependency/import rejected for this task | This note, licensing section | Explicit licensing review before any later reuse |
+| Generic assurance Profile or evidence reference | TRACKED_AS_ISSUE; DEFERRED | IICP #256 | Compare entirely external, binding-local, optional Profile and no-change designs |
+| Full intent-to-execution/evidence-chain experiment | TRACKED_AS_ISSUE; DEFERRED | IICP #256 | After qualification plus a separately reviewed test proposal; not scheduled |
+| Future Software Defined Intelligence relevance | TRACKED_AS_ISSUE; DEFERRED | IICP #256; [architecture map](../docs/architecture/decision-documentation-map.md) | Independently justified post-qualification research, not a released Core capability |
+| CCS dependency, Core redesign or qualification expansion | REJECTED_AS_UNNECESSARY | This note and both new issues | Not authorized by this evidence record |
+
+The specification owns generic cross-binding questions; the Python SDK owns the
+gateway implementation tested here. Related Rust/TypeScript receipt behavior is
+a future parity concern only if a shared semantic requirement is independently
+accepted. No duplicate SDK, Management or SDI implementation issue is created.
+
+## What remains untested and unchanged
+
+The complete consumer intent -> real Directory discovery -> capability,
+eligibility/policy and selection -> real dispatch ticket -> execution binding ->
+invocation -> external attestation chain was **not tested**. A future experiment
+must distinguish route-disclosure verification from any separately authorized
+node-admission mechanism and keep assurance providers independently selectable.
+
+The active pre-1.0 candidate, support matrix, source bindings, sentinels,
+qualification scope and credit remain unchanged. This note neither delays nor
+adds requirements to Directory closure, Linux/Windows staging, successor
+freeze/rebind or the existing campaign. No full-chain experiment is scheduled,
+no assurance schema or SDI feature is implemented, and no release, production,
+deployment, standards submission or live Directory authority changes occur.

spec/v1.9/release-integrity-manifest.json

@@ -47,7 +47,7 @@
     "docs/architecture/task-time-semantics-v1.json": "4220ac57b0c874b4324a9df5ede50273c3be009f22fdb10ccf138cf561a68f69",
     "docs/architecture/task-time-semantics.md": "8662999ee16a7a777ac420a1909c0c9f89eb60b430ce3fca4eb0f3caf10d9f49",
     "docs/audits/specification-documentation-truth-2026-09-25.md": "8c61e093ab75b1f0a363019c651af37bff999407d717b70f53a220e011e816ef",
-    "docs/external-evidence-participation.md": "65a91e144bda38e77d7e2b3bfb247f84619a7668e110ad89ad99e65faa1ba5ae",
+    "docs/external-evidence-participation.md": "531b6bdc5ea1fe6a4555653f0099ceb9b636a2fb20af47a22cbd47beb596a863",
     "docs/governance/public-artifact-boundary.md": "776b00e46e5e6645d32d10761fe24dcb488aff2a62f647df0eb58bf0fee9bea0",
     "docs/oia-application-matrix.md": "8f3ab3aaf6d660e6e8e1653aff1a700be6aceabc53f5e81a45586f58a0a4eea6",
     "docs/operator-onboarding-recovery.md": "1dbf10a2a46ef110e545871ccce0a5a8e63838c1f85acc53cbcb4c0dfb2c34b1",
@@ -57,6 +57,7 @@
     "ecosystem/public-repositories.json": "956e5d3b7f24dc72e36e583839769418ee1244987579fd9eeec7e6835564c541",
     "ecosystem/releases.json": "2ab6da7cbbd8d086bd9467f645d23e095d80dd45ed914f50e0393555d5df77d8",
     "ecosystem/repositories.json": "ab3565df543623420465a11f5284fe8ae64b554289be070fbcb480042deb0e9e",
+    "evidence/IICP_CCS_INTEROPERABILITY_EXPERIMENT_2026-09-28.md": "b28a150f94c80d1964d172f88b490c1810ce76e7ba2b12b521948d4711f50509",
     "evidence/clean-room-interoperability-record-v1.json": "907a769090908ec1169c04f8e276396bb644765c0cb98bee735320467c449bc9",
     "evidence/compatibility-environment-v1.10.16.json": "9571cefa0823d21433bc092bac4bb8c537d074bcf03c36be3c7f9704ddb5d994",
     "evidence/compatibility-environment-v1.10.17.json": "149f3146bd0698e431ecf0d9879e370b2b736648a95e087b617cc3a7382f4d41",