feat(spec): per-(CSD, tier) evidence ladders compiled from the CSD (N19, for N33)

[LamaSu]

Update 2026-09-24 @9cfdafd8

• The oracle mirrors the ladder byte-for-byte (0xe9cf2a2f…0560) and grants a tier only when every listed primitive is verified. It accepts the empty tier 0 and mirrors the tier-adds-no-event-type and tier-drops-requirement refusals.
• EvidenceVerifier takes the CSD's ladder through verify(bundle, { tierRequirements }), so a non-FDM bundle is no longer judged by the FDM default. A claimed tier the ladder does not define fails closed as tier_requirement_defined; before, it passed silently. 4 new tests, 2 mutants killed; verifier 589/589.
• The eligibility text says what it does. A bad reference in tier k caps the CSD below k, not at 0 (adk feat(spec): planProvenance, the deterministic provenance planner (ADK D2) #406). There is a new pinning test, and evidence-primitives passes 42/42.

---

Summary

Board N19, which N33 depends on. The oracle's /settle now recomputes the achieved tier from a kernel-signed bundle's authenticated event types, under the funded capability's ladder (private 88ea27b). The only public ladder was DEFAULT_TIER_REQUIREMENTS, which is FDM-shaped. A print-and-mail bundle has no gcode_hash_verified, so it failed even tier 0. This PR publishes each CSD's own ladder, compiled deterministically from its evidence tiers. The oracle mirrors it by value and checks its service-pinned ladder against the digest.

• compileTierLadder(resolvedCsd) → TierLadderV1, one entry per tier:
  • requiredEventTypes: AND of OR-groups, the DEFAULT_TIER_REQUIREMENTS shape, so every existing consumer accepts it.
  • nonEventRequirements: required fields that no event can prove.
  • primitives: the list the oracle runs registered verifiers over. Every listed primitive is verified, supporting ones included.
• The ladder carries the CSD's capabilityContractDigest. It is committed with computeTierLadderDigest: 0x + sha256 of the canonical ladder, with schemaHash: "tier-ladder/v1".
• achievedTierFromEventTypes: the reference monotone closure. Tier T counts only if tiers 0..T are all met.
• Pinned: document.print-and-mail → 0xe9cf2a2f9f6dcc355a5c71cd503b7598c0cbf1b58429e452adfafe6cf0fe0560. The full ladder is in tier-ladder.vectors.json, and the CSD digest is sha256:35560b16…c331.

tier	required event types
0	none (self-attested)
1	execution_completed, printer_job_verified, printer_log_captured
2	tier 1 + photo_captured, photo_anti_spoof_check, courier_pickup_confirmed
3	tier 2 + courier_delivery_confirmed

Fails closed

Compilation throws TierLadderError on:

• tiers that are not contiguous from tier0, or an unknown evidence key;
• a primitive bound to evidence its tier does not require;
• a tier that drops a lower tier's requirement;
• a tier that adds no event type over the tier below. An events-only recompute could not tell those two tiers apart.

Without the last rule, the eight legacy built-in CSDs compiled to empty sets that any bundle would meet at tier 3. Their required[] lists field names, not event types. They now get no ladder above tier 0, which matches computeCsdEligibility. A role: "supporting" flag never removes a bind, so relabelling evidence cannot weaken a tier (N19's done-when).

What this does NOT change

• Nothing about funding. Separately: under the public eligibility rule, computeCsdEligibility caps print-and-mail at tier 0 as authored, even in report-only mode. The reasons:
  • tiers 1–3 miss the ident.registered_key dependency of receipt.kernel_signed and machine.execution_log;
  • tier 2 has no Family-G (human-attestation) primitive;
  • tier 3 lists four primitives whose tierSupport excludes tier 3.
• In oracle-enforcing mode, six tier-2 verifiers are also still stubs: machine.execution_log, artifact.hash, capture.photo_nonced, fresh.challenge_bound, confirm.target_system, and ident.registered_key by dependency.
• photo_anti_spoof_check has no producer in the repo.

The funding-gate consequence is proposed separately, on #349.

Test plan

• tier-ladder.test.ts 18/18. It covers the pinned vector and digest, the tier-2 promise, supporting-flag immutability, closure on a non-cumulative ladder, every fail-closed code, and legacy CSDs.
• spec 815/815; tsc --noEmit clean.
• 11 mutants, all killed: each compile rule, closure, any-group, digest canonicality, malformed entries, and the committed supporting flag.
• Secret scan of the range: 0 findings.

🤖 Generated with Claude Code

https://claude.ai/code/session_0117ows6894R3n6YQXBCRahS