# NOMOS Full-Chain Reproducibility — Machine Verification Guide

Vendor-specific verification surface published by agentnomos.com (schemas
`nomos.reproducibility.*.v1`). This is **not** an external standard.
Claim ceiling of everything on this surface: **EXECUTION_BOUND_PROOF**.

Artifacts:

- ALLOW reference: `https://agentnomos.com/proof/full-chain/allow-reference.json`
- DENY reference: `https://agentnomos.com/proof/full-chain/deny-reference.json`
- Stateless verifier: `https://agentnomos.com/proof/full-chain/nomos_repro_verify.py`
- Public JWKS (Ed25519 receipt keys): `https://feedoracle.io/.well-known/nomos-execution-jwks.json`
- Index: `https://agentnomos.com/.well-known/nomos-reproducibility.json`

## Verifiability classes — read this first

Not every field is verifiable the same way. Every check below carries one of:

- **CRYPTOGRAPHICALLY_VERIFIABLE** — provable with public keys or public-chain
  data (receipt signature, settlement transaction).
- **DETERMINISTICALLY_RECOMPUTABLE** — a digest or rule you can recompute
  bit-exactly from the published documents alone.
- **EVIDENCE_INSPECTABLE_ONLY** — operator-attested store evidence (counters,
  outcome/shadow rows). You can check it for internal consistency; you cannot
  independently re-derive it, because the stores are not public.

The internal NOMOS policy configuration is **not public**. You can verify the
policy's version and digest commitments and recompute the *published* decision
rules; you can NOT re-run the full policy. No claim to the contrary is made.

## Canonical JSON (used by every digest)

`sha256` over the UTF-8 bytes of the object serialized with **sorted keys**,
separators `(",", ":")` (no spaces), non-ASCII characters unescaped
(Python: `json.dumps(obj, sort_keys=True, separators=(",",":"), ensure_ascii=False)`).
When recomputing the receipt digest, preserve JSON number lexemes verbatim
(do not let your parser turn `5.0` into `5`); the verifier shows how.

## ALLOW case — 9 steps

1. **Validate the bundle**: fetch `allow-reference.json`, check
   `schema = nomos.reproducibility.allow_reference.v1`.
2. **Payment**: `payment.settlement_tx` is a USDC transfer on Base
   (`eip155:8453`) from `payment.payer`. Inspect it on any public Base
   explorer. [CRYPTOGRAPHICALLY_VERIFIABLE]
3. **Action digest**: recompute `sha256:` over the canonical JSON of
   `request.intent_document` restricted to the intent core fields
   (`schema, intent_id, consumer_id, subject_id, requested_capability,
   requested_action, route, method, purpose, constraints, created_at,
   expires_at, nonce`). Must equal `request.action_digest`. The `purpose`
   string inside that digest carries the payment idem key and payer — that is
   the payment↔action binding. [DETERMINISTICALLY_RECOMPUTABLE]
4. **Policy commitments**: read `policy.admission_policy_version` /
   `policy.admission_policy_digest` and compare with the same fields inside
   `receipt.document.receipt` (they are under the signature).
   [DETERMINISTICALLY_RECOMPUTABLE]
5. **Authorization**: `authorization.result = ALLOW_READ_ONLY`;
   `receipt.document.receipt.decision_id/decision_digest` bind it under the
   signature. [DETERMINISTICALLY_RECOMPUTABLE]
6. **Execution binding**: `receipt.document.receipt.execution_id` equals
   `execution.execution_id`, state `EXECUTION_COMPLETED`.
   [DETERMINISTICALLY_RECOMPUTABLE]
7. **Response digest**: `receipt.document.receipt.backend.response_sha256`
   equals `execution.response_sha256`. (The response bytes themselves are
   returned to the paying caller at request time; from the bundle alone you
   verify the bound hash.) [DETERMINISTICALLY_RECOMPUTABLE]
8. **Receipt signature**: recompute `receipt_digest` = sha256 over canonical
   JSON of `receipt.document.receipt`; then verify Ed25519 signature
   `receipt.document.signature.value` over
   `"nomos.execution.receipt.v1" || 0x00 || canonical(receipt)` with the JWKS
   key whose `kid = receipt.signing_kid`. [CRYPTOGRAPHICALLY_VERIFIABLE]
9. **Outcome binding**: `outcome.outcome_id` and
   `governance.shadow_reference` are operator-attested store rows sealed in
   the operator evidence pack (identifier in `source_evidence`); S10 is
   shadow-only and never influences the live decision.
   [EVIDENCE_INSPECTABLE_ONLY]

## DENY case — 5 steps

1. **Same policy context**: `policy` in `deny-reference.json` pins the same
   policy version and artifact digests as the ALLOW reference — nothing was
   changed to produce the refusal. [DETERMINISTICALLY_RECOMPUTABLE]
2. **Refusal reason**: `policy_evaluation.task_fit = TASK_FIT_MISMATCH`,
   reason `REQUESTED_CAPABILITY_NOT_ROUTE_CAPABILITY`: the intent requested
   `RWA_REGISTRY_EXPORT_READ`, the route's declared capability is
   `RWA_REGISTRY_STATS_READ` — which you know from the ALLOW receipt's
   Ed25519-signed `intent_binding.capability_id`. [DETERMINISTICALLY_RECOMPUTABLE]
3. **Reproduce the decision (rule level)**: recompute the DENY intent's
   `action_digest` and re-apply the published rule
   (`requested_capability != signed route capability`). The evaluating
   function is pure (identical inputs → identical output) and its policy
   artifacts are digest-pinned; a *full* internal policy re-evaluation is not
   possible from public data and is not claimed. [DETERMINISTICALLY_RECOMPUTABLE,
   rule level only]
4. **No execution**: `non_execution.*_created` are all `false`;
   `non_execution.counters` shows delta 0 on every pipeline counter
   (execution, receipt, decision, outcome, shadow, settlement) and +1 only on
   the append-only refusal store. Semantics:
   `NO_EXECUTION_OBSERVED_AND_STORE_BOUND` — operator store/counter evidence,
   **not** a cryptographic proof of non-execution. [EVIDENCE_INSPECTABLE_ONLY]
5. **No settlement**: `payment.involved = false` and the document claims no
   settlement transaction; there is nothing on-chain to find for this case.
   [DETERMINISTICALLY_RECOMPUTABLE]

## Replay command (copy-paste)

Two explicit steps — download first, then execute (deliberately not a
pipe-to-interpreter one-liner):

```
curl -sO https://agentnomos.com/proof/full-chain/nomos_repro_verify.py
python3 nomos_repro_verify.py
```

Expected result: `21 checks: 21 PASS, 0 FAIL, 0 NOT_RUN` (exit code 0).
The verifier fetches the two reference bundles plus the public JWKS — public
URLs only, no credentials, no operator configuration, no local NOMOS files.
The Ed25519 check needs the `cryptography` package; without it that single
check reports NOT_RUN and the exit code is 2.

## Execution trace

`allow-reference.json` carries a compact `execution_trace` (10 events from
payment_verified to shadow_observed). Every timestamp is copied verbatim from
sealed evidence (most from the Ed25519-signed receipt's own timing block);
each event is labeled with its verifiability class. Outcome and shadow remain
EVIDENCE_INSPECTABLE_ONLY — operator-attested, exactly as stated above.