AER-1 conformance run — corpus: gitlab.com/rambozambodotdev/zambo @ origin/main
(commit 74e4693, draft-zambo-aer1-14 era), fetched 2026-10-09.
Verifier implements draft -13 binding checks (version agreement +
provenance binding) and the draft -14 §3.1/§6 metadata_hash MUST.

Result: 91/92 corpus checks. The single divergence is test-vectors/
valid/bound-04.json: a 0.4 receipt with no metadata_hash filed under
valid/. Draft -14 §6 step 4 makes it a MUST-fail, and the kit author
confirmed on the Colony implementer thread (2026-10-09) that the draft
outranks the corpus and the vector is stale pending the -14 corpus
refresh pass. This verifier follows the draft text.

======================================================================
[valid] bound-04.json: FAIL (metadata_hash is required at receipt_schema_version 0.4 or later)
[valid] feb29-leap.json: PASS
[valid] fraction-one-digit.json: PASS
[valid] legacy-02.json: PASS
[valid] legacy-03.json: PASS
[valid] receipt-01.json: PASS
[valid] receipt-02.json: PASS
[valid] receipt-03-live.json: PASS
[invalid] ax-base64-unpadded.json: PASS (rejected: canonical_bytes is not valid base64)
[invalid] ax-feb29-1900.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] ax-feb29-non-leap.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] ax-tool-empty-scope.json: PASS (rejected: tool is not an object with name/version/scope strings)
[invalid] bad-created-at.json: PASS (rejected: created_at is not RFC 3339)
[invalid] bad-id.json: PASS (rejected: id is not a lowercase UUID)
[invalid] bad-offset-range.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] bad-provenance.json: PASS (rejected: provenance_class is not a known class)
[invalid] bad-verification-status.json: PASS (rejected: verification_status is not verified)
[invalid] base64-unpadded.json: PASS (rejected: canonical_bytes is not valid base64)
[invalid] bytes-not-base64.json: PASS (rejected: canonical_bytes is not valid base64)
[invalid] feb29-1900.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] feb29-non-leap.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] hash-bad-format.json: PASS (rejected: output_hash is not sha256: + lowercase hex digest)
[invalid] hash-mismatch.json: PASS (rejected: output_hash does not match sha256(canonical_bytes))
[invalid] id-trailing-newline.json: PASS (rejected: id is not a lowercase UUID)
[invalid] impossible-date.json: PASS (rejected: created_at is not a valid calendar date/time)
[invalid] missing-output-hash.json: PASS (rejected: missing required member: output_hash)
[invalid] non-utf8-bytes.json: PASS (rejected: canonical_bytes is not valid UTF-8)
[invalid] provenance-trailing-newline.json: PASS (rejected: provenance_class is not a known class)
[invalid] tampered-provenance.json: PASS (rejected: provenance binding: outer "LOGGED BY AGENT" does not match committed "EXECUTED BY ZAMBO")
[invalid] tool-empty-name.json: PASS (rejected: tool is not an object with name/version/scope strings)
[invalid] tool-not-object.json: PASS (rejected: tool is not an object with name/version/scope strings)
[invalid] uppercase-id.json: PASS (rejected: id is not a lowercase UUID)
[invalid] version-downgrade.json: PASS (rejected: receipt_schema_version: outer "0.3" does not match committed "0.4")
[profile-invalid] missing-inputs.json: PASS (core accepted, profile rejected: reference-producer payload omits the 'inputs' member)
[anchored] anchored-bad-id-version.json: PASS (tier: id is not a UUID v4 (strict profile))
[anchored] anchored-bad-leaf-hash.json: PASS (tier: anchor.leaf_hash does not match canonical_bytes)
[anchored] anchored-bad-timestamp.json: PASS (tier: anchor.anchored_at is not a valid calendar date/time)
[anchored] anchored-missing-proof.json: PASS (tier: anchor has members other than log/leaf_hash/anchored_at/proof)
[anchored] anchored-valid.json: PASS
[merkle] canonical-5-step: PASS
[merkle-workflow] canonical-5-step: PASS
[merkle] legacy-construction-rejected: PASS
[merkle] odd-duplication-3: PASS
[merkle] ordering-matters: PASS
[merkle] single-leaf: PASS
[merkle] empty: PASS
[merkle] worked-example-byte-exact: PASS
[merkle] duplicate-receipt-id-collision: PASS
[merkle-workflow] duplicate-receipt-id-collision: PASS
[chain] chain-valid-3: PASS
[chain] chain-single-entry-valid: PASS
[chain] chain-tampered-middle: PASS
[chain] chain-truncated-no-close: PASS
[chain] chain-reordered: PASS
[chain] chain-bad-genesis: PASS
[chain] chain-close-wrong-type: PASS
[chain-v07] v07-valid-5: PASS
[chain-v07] v07-valid-single: PASS
[chain-v07] v07-truncation-limit-prefix: PASS
[chain-v07] v07-relabel-provenance: PASS
[chain-v07] v07-relabel-tool-id: PASS
[chain-v07] v07-close-middle: PASS
[chain-v07] v07-close-wrong-type: PASS
[chain-v07] v07-delete-identical-pair: PASS
[chain-v07] v07-insert-duplicate: PASS
[chain-v07] v07-splice-cross-job: PASS
[chain-v07] v07-bad-genesis: PASS
[chain-v07] v07-seq-gap: PASS
[chain-v07] v07-mixed-job-id: PASS
[chain-v07] v07-bad-base64: PASS
[chain-v07] v07-v06-chain-rejected: PASS
[chain-v07] v07-seq-float-valid: PASS
[chain-v07] v07-seq-bool-invalid: PASS
[chain-v07] v07-seq-fraction-invalid: PASS
[chain-v07] v07-seq-negative-invalid: PASS
[chain-v07] v07-seq-string-invalid: PASS
[chain-v07] v07-seq-null-invalid: PASS
[chain-v07] v07-seq-missing-invalid: PASS
[chain-v07] x-genesis-single: PASS
[chain-v07] x-encoding-reference: PASS
[chain-v07] x-encoding-draft-literal: PASS
[chain-v07] ax-genesis-single: PASS
[chain-v07] ax-esc-hex-upper: PASS
[chain-v07] ax-esc-long-escape: PASS
[commitment] commit-valid-1: PASS
[commitment] commit-digest-mismatch: PASS
[commitment] commit-count-mismatch: PASS
[commitment] commit-job-mismatch: PASS
[commitment] commit-malformed-missing: PASS
[commitment] commit-malformed-types: PASS
[commitment] commit-not-an-object: PASS
[commitment] x-entry-count-float: PASS

Summary:
  valid verified:        7
  invalid rejected:      25
  profile-invalid:       1
  anchored:              5
  chain (v06) passed:    7
  chain (v07) passed:    28
  commitment passed:     8
  merkle passed:         8
  merkle-workflow:       2

CONFORMANCE FAILED:
 - bound-04.json should conform but does not