{ "schema": "immoquick.serverless.capabilities.v2", "manifest_schema_version": 2, "architecture_version": "1.4.0", "rule_package_version": "2.0.0", "rule_version_hash": "immoquick-serverless-v2.0.0", "name": "immo.quick Serverless Edition, Deterministic Execution Authorization & Evidence Manifest", "description": "The deterministic execution authorization and evidence infrastructure immo.quick actually runs in production. The Gate Catalog performs deterministic domain determination across regulatory domains, sector-specific controls and infrastructure-level execution conditions. Every gate performs domain determination. No gate independently grants execution authority. Execution rights are resolved by a separate Execution Rights Graph that binds Authority, Rule, Jurisdiction, Time and Dependency into a single authorization state root, cryptographically scoped, single-use, and protected against invalidation that is not itself backed by proven authority. Each gate states what happened to it, how strong that statement is, and whether an outside party can check it. No gate is called VERIFIED merely because it ran, and no score is derived anywhere in this model. The execution authorization and forensic evidence infrastructure described here is operational. Sovereign multi-witness anchoring remains subject to completion of external witness agreements.", "publisher": { "name": "immo.quick Serverless Edition", "operator": "immo.quick", "identity_document": "https://immoquick.eu/.well-known/immoquick-identity.json", "url": "https://immoquick.eu" }, "canonical_url": "https://immoquick.eu/immoquick-capabilities.json", "assurance_vocabulary": { "DETERMINISTIC_EVALUATION": "at the gate level: same inputs, same verdict, no model, no heuristic, no probability, f(x) = Law", "AUTHORIZATION_DETERMINISM": "same canonical input, same authoritative state and same authoritative ordering point produce the same execution-right outcome", "HMAC_SHA256_INTEGRITY_SEAL": "HMAC-SHA256 integrity seal over canonical receipt data using a non-public symmetric key; not an independently public verification mechanism", "HYBRID_PQC_SIGNATURE": "Ed25519 + ML-DSA-65 post-quantum signature, classical and quantum-resistant in one artifact", "MERKLE_CHAIN_BINDING": "SHA-256 chain link binding each receipt to its predecessor, append-only, tamper-evident", "AUTHORITY_PROVENANCE_HASH": "explicit declaration of which authority source legitimises a receipt, separable from the causal chain", "SOVEREIGN_MULTI_WITNESS_ANCHOR": "periodic Merkle-root anchoring across multiple independent non-US jurisdictions (DE/CH/LU)", "EXECUTION_RIGHT_ABSENCE": "failure of any mandatory closure condition results in ABSENT execution right; no executable capability is created, the transaction cannot proceed not because it was blocked, but because no execution right exists", "CRYPTO_SHREDDING": "PII destruction via encryption-key shredding after legal retention period, hash chain remains intact", "BI_TEMPORAL_VERSIONING": "valid-time and transaction-time bi-temporal ledger, rules can be retroactively audited at any point in time", "SHAMIR_THRESHOLD_COSIGN": "Shamir secret sharing threshold cosignature, no single party holds the full signing key", "SIX_EYES_APPROVAL": "dual-control multi-signature with independent approver roles, no single-actor execution. Threshold approval is an anti-manipulation control and does not itself create normative authority", "EXECUTION_RIGHTS_GRAPH": "five mandatory closure nodes (AUTHORITY, RULE, JURISDICTION, TIME, DEPENDENCY) resolved at T0, all must close for a capability to exist", "AUTHORIZATION_STATE_ROOT": "SHA-256 fingerprint binding Authority, Rule, Jurisdiction, Time and Dependency state, including authoritative provenance, into the authorization state from which the execution right was derived, sealed into every capability, checked by the execution plane", "GOVERNANCE_AUTHORITY_PROOF": "cryptographic proof that a valid AuthorityCredential authorises a specific governance mutation, no CapabilityInvalidationRecord may exist without one", "MONOTONIC_SEQUENCE_BINDING": "single monotonic AuthorizationStateSequence counter allocates deterministic ordering between invalidation and consumption, not wall clock, not replication speed", "ZERO_RETROACTIVITY": "an invalidation with sequence > execution_cut_sequence cannot retroactively unauthorise a consumption that already won the cut, the past is closed", "DETERMINISTIC_CHAINED_CAPABILITIES": "capability B may require capability A to be CONSUMED first, sealed via prerequisite_chain_hash, re-verified at issuance and consumption", "SINGLE_USE_CAPABILITY": "each ExecutionCapabilityToken is consumed exactly once, a second attempt yields BLOCK_CAPABILITY_ALREADY_CONSUMED, not a retry", "NEGATIVE_EXECUTION_RIGHT_PROOF": "at ABSENT, a signed proof seals that every admissible path for every mandatory node was traversed and none was valid, not merely that the requested ref was invalid" }, "gate_role_vocabulary": { "DOMAIN_DETERMINATION_ONLY": "gate determines domain conditions but grants no execution authority", "EVIDENCE_INPUT": "gate output may become evidence input to the Execution Rights Graph", "NOT_APPLICABLE": "gate does not apply to the submitted domain state" }, "authorization_role_vocabulary": { "EXECUTION_RIGHTS_CLOSURE": "the Execution Rights Graph resolves whether all five mandatory closure nodes close at T0, VALID may produce a capability, ABSENT produces a negative proof", "CAPABILITY_ENFORCEMENT_ONLY": "the Execution Plane enforces capability boundaries atomically, it interprets no authority, it checks only whether a valid, uninvalidated, unconsumed capability exists" }, "domain_workflow_outcome": { "HUMAN_REVIEW_REQUIRED": "domain workflow requires human review; this does not create execution permission, execution_right remains ABSENT until a new complete execution right is established" }, "stage_execution_semantics": { "ENFORCING_INPUT": "computed before authorization closure and capable of preventing the required closure conditions from being satisfied", "OBSERVING_ONLY": "no return path into admission, execution or enforcement", "POST_HOC_OBSERVATION": "runs after the transaction and cannot affect it", "RECORDING": "produces a forensic artefact as part of serving the request" }, "status_vocabulary": { "SEALED": "a receipt received an HMAC-SHA256 integrity seal and was Merkle-chain-bound with a deterministic verdict", "DELTA_FLAGGED": "a material divergence was detected and recorded, but the transaction was not blocked", "ATTESTATION_INCOMPLETE": "a required attestation was missing; the required authorization closure could not complete", "BLOCKED": "a critical rule failure caused dispositiv refusal at T=0, domain outcome only; does not itself represent execution authorization", "NO_DECISION": "the gate was not applicable to the submitted input" }, "forensic_stage_count": 5, "forensic_stage_range": "T0-T4", "stages": [ { "id": "T0", "name": "Authority Origination", "assurance": "AUTHORITY_PROVENANCE_HASH", "assurance_basis": "before any receipt is sealed, the authority source is validated against a registered AuthorityCredential, checking validity, jurisdictional scope match, and delegation permission. An authority that cannot be traced to a legitimate, registered, active source cannot be originated into the authorization chain", "evidence_types": [ "credential_id", "authority_source_did", "credential_hash", "regulatory_domain", "delegation_permitted", "authority_signature" ], "execution_role": "ENFORCING_INPUT", "scope": "every receipt before chain seeding", "status": "ORIGINATED", "publicly_verifiable": false, "execution_semantics_note": "an authority that is suspended, revoked, or jurisdictionally mismatched cannot be originated into the authorization chain, it does not merely annotate the receipt" }, { "id": "T1", "name": "Deterministic Gate Evaluation", "assurance": "DETERMINISTIC_EVALUATION", "assurance_basis": "each Gate in the catalog evaluates its input against a hard-coded rule table. The evaluator's source contains no probabilistic model, no heuristic, and no free-text interpretation. Same inputs produce the same verdict, f(x) = Law. Every gate declares execution_authority=false, a gate PASS is domain determination, not execution permission", "evidence_types": [ "gate_id", "rule_version_hash", "input_snapshot_hash", "validation_gates", "verdict", "applied_rule_ids", "execution_model_fields" ], "gate_role": "DOMAIN_DETERMINATION_ONLY", "scope": "The Gate Catalog across regulatory domains, sector-specific controls and infrastructure-level execution conditions", "status": "EVALUATED", "publicly_verifiable": false, "execution_semantics_note": "a gate PASS is domain determination, not execution permission. A missing attestation means the Execution Rights Graph cannot close, no execution right exists, no capability is created. In rights-sensitive domains (social benefits, employment), critical failure triggers HUMAN_REVIEW_REQUIRED; execution_right remains ABSENT until a new complete execution right is established" }, { "id": "T2", "name": "Receipt Sealing", "assurance": "HYBRID_PQC_SIGNATURE", "assurance_basis": "each receipt is sealed with HMAC-SHA256 over canonical data (deep recursive key sorting) and co-signed with a hybrid post-quantum signature (Ed25519 + ML-DSA-65). The signature is produced by a process separate from the evaluating gate", "evidence_types": [ "receipt_id", "payload_hash", "hmac_signature", "ed25519_signature", "ml_dsa_65_signature", "worker_version_hash", "ntp_timestamp" ], "execution_role": "RECORDING", "scope": "every sealed receipt across all gate entities", "status": "SEALED", "publicly_verifiable": true, "public_verification": "receipts verify against the public proof JWKS with no credential, the Ed25519 public key is freely publishable, the ML-DSA-65 public key is persisted for offline quantum-resistant verification" }, { "id": "T3", "name": "Chain Binding", "assurance": "MERKLE_CHAIN_BINDING", "assurance_basis": "each receipt carries a prev_receipt_hash and a chain_link (SHA-256 of certification_hash:prev_receipt_hash). The chain is append-only, a tampered receipt breaks the chain at the point of modification", "evidence_types": [ "certification_hash", "chain_link", "prev_receipt_hash", "merkle_link", "authority_provenance_hash" ], "execution_role": "RECORDING", "scope": "the complete append-only receipt ledger across all tenants", "status": "BOUND", "publicly_verifiable": true, "public_verification": "the chain can be re-walked from any receipt to the genesis receipt, a broken link is detectable by any party holding two consecutive receipts" }, { "id": "T4", "name": "Sovereign Multi-Witness Anchoring", "assurance": "SOVEREIGN_MULTI_WITNESS_ANCHOR", "assurance_basis": "periodic Merkle-root anchoring across multiple independent, non-US jurisdiction witnesses (DE/CH/LU). A 2-of-N quorum is required for the evidentiary anchoring profile designed for independent judicial and regulatory review. The anchor is periodic and per-window, not per-request", "evidence_types": [ "anchor_id", "merkle_root", "anchor_window_start", "anchor_window_end", "receipt_count", "witnesses", "witness_quorum", "anchor_verdict" ], "execution_role": "POST_HOC_OBSERVATION", "scope": "periodic Merkle-root anchoring over all receipts sealed within the window", "status": "ANCHORED", "publicly_verifiable": false, "execution_semantics_note": "anchoring runs after the transaction and cannot affect it. The anchor provides retroactive proof that the chain was intact at the window boundary, not that any individual transaction was anchored" } ], "execution_authorization": { "layer": "Execution Rights Graph → Capability → Execution Cut → Consumption", "authorization_role": "EXECUTION_RIGHTS_CLOSURE", "closure_nodes": [ "AUTHORITY", "RULE", "JURISDICTION", "TIME", "DEPENDENCY" ], "resolution": "the Decision Plane resolves the Execution Rights Graph to VALID or ABSENT. VALID may produce an ExecutionCapabilityToken. ABSENT produces a NegativeExecutionRightProof. A gate PASS is domain determination; it does not produce a capability, the Rights Graph must independently close", "execution_right_states": [ "VALID", "ABSENT" ], "capability_required_for_execution": true, "single_use": true, "zero_retroactivity": true, "monotonic_ordering": "a single monotonic AuthorizationStateSequence counter allocates deterministic ordering between invalidation and consumption, not wall clock, not replication speed", "invalidation_rule": "an invalidation with invalidation_sequence <= execution_cut_sequence is effective before or at the authoritative Execution Cut and blocks consumption. An invalidation with invalidation_sequence > execution_cut_sequence cannot retroactively unauthorise a consumption that already won the cut", "governance_authority_proof_required": true, "execution_plane_role": "CAPABILITY_ENFORCEMENT_ONLY", "execution_plane_note": "the Execution Plane interprets no authority, it checks only whether a valid, uninvalidated, unconsumed capability exists. It enforces capability boundaries atomically via consumption_attempt_id", "publicly_verifiable": true, "public_verification": "capabilities and consumption receipts carry hybrid Ed25519 + ML-DSA-65 signatures verifiable against the public proof JWKS, an external verifier can verify the signed authorization artifact and its bound execution evidence without relying on the platform as a trust intermediary" }, "gate_count": 130, "gate_catalog": { "Infrastructure / Edge": [ "gate0CoreDispatch, Enforced Edge Grid durable core re-execution", "gate0EdgeIntercept, Enforced Edge Grid write-side interception", "gate0EdgeReconciliation, Enforced Edge Grid core-edge reconciliation" ], "AML / KYC (Gate 2)": [ "gateAML, FATF-list screening / PEP / transaction monitoring", "gateCTA, USA Corporate Transparency Act / FinCEN BOI", "gateUKMLR, UK Money Laundering Regulations 2017", "gateSwissAMLA, Swiss Anti-Money Laundering Act (GwG SR 955.0)", "gateMAS, Singapore MAS Act 626", "gateAUSTRAC, Australia AML/CTF Act 2006", "gateJFSA, Japan Act on Prevention of Transfer of Criminal Proceeds", "gateHKAMLO, Hong Kong AMLO Cap. 615", "gateCOAF, Brazil Lei 9.613/1998", "gateFIC, South Africa FIC Act 38 of 2001", "gateUAELicensing, UAE AML/CFT Licensing", "gatePCMLTFA, Canada PCMLTFA", "gateFATF, FATF Recommendations 1-40", "gateAMLARegulation, EU AMLR Single Rulebook" ], "Banking & Finance": [ "gateBankingCompliance, BaFin KWG / DORA / DSGVO", "gateBaselLiquidity, Basel III LCR/NSFR/CET1", "gateMarketAbuse, MiFID II MAR / BMR", "gateCBDC, Digital Currency / Ledger Pre-Check", "gateHFT, High-Frequency Trading / MiFID II MAR", "gateConsortiumLoans, Cross-Jurisdiction Syndicated Loans", "gateCentralBankReserve, ECB Minimum Reserve", "gateStateAidControl, EU State Aid Art. 107/108 TFEU", "gatePublicSubsidies, §264 StGB / EU RRF / DNSH", "gateAntitrustMergerControl, EUMR / GWB / HSR / FSR" ], "Government & Constitution": [ "gateGovernmentActs, VwVfG / Gate 0 / DSGVO", "gateProcurement, EU 2014/24 ESG / Tariftreue", "gateTaxExecution, POS USt/VOst UStG", "gateBundID, eIDAS 910/2014", "gateElectionIntegrity, BSI / PartG / DSA", "gateWhistleblowerProtection, HinSchG", "gateEmergencyPowersReview, Richter-/Parlamentsvorbehalt GG" ], "Real Estate & FDI": [ "gateRealEstateTransactions, UBO / Escrow / ESG", "gateForeignDirectInvestment, AWV §55 / EU-FDI 2019/452" ], "Transatlantic & Export Controls": [ "gateUSExportControls, EAR 15 CFR", "gateEUDPF, EU Data Privacy Framework", "gateOFAC, OFAC / IEEPA 31 CFR", "gateTransatlanticConflict, EU/US legal conflict at T=0", "gateTransatlanticUSLaws, extraterritorial US law application", "gateMiCA, VO (EU) 2023/1114", "gateDORA, VO (EU) 2022/2554", "gateNIS2, RL (EU) 2022/2555", "gateHIPAA, 45 CFR §164 PHI", "gateSECCyber, Reg S-K 106 + 8-K 1.05" ], "EU Extended": [ "gateEUTaxonomy, VO 2020/852 DNSH + SFDR", "gateCSRD, RL 2022/2463 ESRS E+S+G", "gateEUESG, SFDR / MiFID II ESG preferences", "gateEUFinance, MiFID II / CRR / CRD / Solvency II", "gateEULaws, AEUV / TFEU / secondary law", "gateEUDataAI, GDPR / AI Act / Data Act" ], "International": [ "gateGloBE, OECD Pillar 2 15% Minimum Tax", "gateOECDUngp, Anti-Bribery + UNGPs 2011", "gateUNCAC, UN Convention against Corruption 2003", "gateIHR, WHO IHR 2005 + WTO-SPS" ], "DE Cross-Section": [ "gateDELaws, GwG/KWG/WpHG/BDSG/BSIG/ZAG/GrEStG/KAGB", "gateWHGAwSV, PFAS + Trinkwasser", "gateBBodSchG, Altlasten-Haftungstransfer", "gateTALuft, Immissionsschutz PM10/NO2/SO2", "gateG10, §1a/§5/§14 + G10 Kommission", "gateVAG, §7+§61+§153+§293c + DeckKG" ], "Sector-Specific Industry": [ "gateTelecom, TKG v2 / BSI / NIS2", "gateDefenseExport, KWKG / AWG / EU-Dual-Use / ITAR", "gatePharmaMedical, MDR / AMG / EU-FMD / GMP / EUDRA", "gateChemicalHazmat, REACH / Seveso III / CLP", "gateLogistics, ADR / CSDDD / CBAM", "gateRailLogistics, TSIV / RID / ETCS / KRITIS", "gateIntralogistics, CE / AGV / REACH / OT-Sec", "gateMusicCompliance, Split / AI / Clearance", "gateClinicalTrials, Consent / Protocol / AE", "gateEsgSocial, ESRS S2 Value-Chain Workers", "gateSustainabilityCompliance, CSRD/ESRS E+S+G", "gateAgriFoodCompliance, EUDR / EFSA / HACCP", "gateEnergyGridCompliance, RED III / SMGW / EU-ETS / NIS2", "gateHeavyIndustry, CBAM / IED / OHS / Seveso" ], "Sport Governance": [ "gateSportDecision, VAR Protocol / Betting Integrity", "gateMotorsportDecision, Cost Cap / Parc Fermé / Super License", "gateAntiDoping, WADA Prohibited List", "gateTransfers, PSR / FFP / Squad Cost" ], "Regional / National Laws": [ "gateUSLaws, US Federal Law (Dodd-Frank / SOX / BSA)", "gateUKLaws, UK Common Law (Companies Act / PRA / FCA)", "gateCHLaws, Switzerland (OR / FINMA / ZGB)", "gateATLaws, Austria (ABGB / FMA / WAG)", "gateBELaws, Belgium (Code civil / FSMA)", "gateCALaws, Canada (PIPEDA / OSFI / Criminal Code)", "gateCEELaws, Central/Eentral Europe (PL/CZ/HU/RO)", "gateESLaws, Spain (Codigo Civil / CNMV)", "gateFRLaws, France (Code civil / Code de commerce / AMF)", "gateITLaws, Italy (Codice Civile / CONSOB)", "gateNLLaws, Netherlands (BW / AFM / DNB)", "gateNordicLaws, Nordic states (DK/SE/FI/NO)", "gateSmallEULaws, Small EU states (MT/CY/LU/IE)", "gateAPACLaws, Asia-Pacific (JP/SG/HK/AU/NZ)", "gateASEANLaws, ASEAN + Emerging APAC (KR/CN/IN/MY/TH/ID)", "gateLATAMExtLaws, Latin America extended (MX/AR/CL/CO)", "gateLATAMMEALaws, LATAM / Middle East / North Africa", "gateAviationLaws, EASA / EU Reg 376/2014", "gateSocialMediaLaws, DSA / NetzDG / Platform Directive 2024/2831", "gateTechStandards, ISO / IEC / ETSI" ], "Forensic Meta-Gates": [ "gateAuthorityChainCheck, authority chain validation at T=0 (independent legitimacy aware)", "gateSuspensionOverride, authorised suspension with proof", "gateLogVerify, receipt integrity / Merkle chain verification", "gateARandfaelleTestMatrix, three named edge cases / determinism probe", "gateLegalConflict, competing legal norms / precedence resolution", "gateSectorSpecific, sector-specific special rules", "gateImpactAnalyzer, impact analysis on rule change" ], "AI Governance & Automated Decision-Making": [ "gateAIProhibitedPractices", "gateSocialBenefits, SGB X/II / Art. 22 DSGVO / BVerfGE 125,175", "gateTaxAdministration, §88 Abs. 5 AO", "gateCreditScoring, EuGH C-634/21 (SCHUFA) / §31 BDSG", "gateEmploymentADM, §87 BetrVG / AGG / EU AI Act Annex III", "gateEducationADM, Art. 22 DSGVO / Landeshochschulgesetze" ], "Tax Reporting & Cross-Border Transparency": [ "gateDAC6" ], "Critical Infrastructure & Resilience": [ "gateCER" ], "AI Act & AI Governance": [ "gateGPAIProvider", "gateAITransparency", "gateAIHighRiskConformity" ], "Digital Infrastructure Law": [ "gateDataAct", "gateDataGovernanceAct", "gateDMA", "gateCRA" ], "Financial Market Infrastructure": [ "gateBRRD", "gateEMIR", "gateCSDR", "gateDGSD" ], "Asset Management & Securities Financing": [ "gateAIFMD", "gateUCITS", "gateSFTR", "gateSecuritisation" ] }, "scope": { "execution_authorization": { "gate_execution_authority": false, "rights_graph_required": true, "execution_right_states": [ "VALID", "ABSENT" ], "capability_required_for_execution": true, "single_use": true, "zero_retroactivity": true, "rule_package_version": "immoquick-serverless-v2.0.0", "six_eyes_approval_enforced": true, "shamir_threshold_cosign": true }, "limitations": [ "The T0-T4 architecture is implemented and internally verified for the gates listed in gate_catalog. External sovereign witness participation remains pending. Not every sector deploys the full gate catalog, the active gate set is tenant-specific.", "Sovereign multi-witness anchoring (T4) is periodic and per-window, not per-request. Individual receipts are provably chain-bound; the anchor proves the chain was intact at the window boundary.", "Witness contracts for sovereign anchoring are in placeholder status, the architecture is deterministic, the witness agreements must be concluded before production.", "ML-DSA-65 post-quantum signatures are implemented and persisted. NIST FIPS-204 standardisation is final; production rollout follows standard publication.", "In most domains, failure of a mandatory condition results in an ABSENT execution right. No ExecutionCapabilityToken is created and consequence-bearing execution therefore has no executable path.", "In rights-sensitive domains (social benefits, employment termination), a critical domain condition may produce HUMAN_REVIEW_REQUIRED as a workflow outcome. This does not create execution permission; execution_right remains ABSENT until a new complete execution right is established.", "Authority invalidation follows explicit authority provenance and authorization-state dependencies. Merkle-chain linkage remains an integrity relation and does not by itself create normative dependency between receipts.", "Execution authorization requires that all five closure nodes (AUTHORITY, RULE, JURISDICTION, TIME, DEPENDENCY) close at T0 for a capability to exist. At ABSENT, a NegativeExecutionRightProof seals that every admissible path was traversed, not merely that the requested ref was invalid.", "A CapabilityInvalidationRecord may only exist when a valid GovernanceAuthorityProof establishes the authoritative basis for that exact mutation. Not an administrator, not an internal process, not the system itself. The system does not create authority, it binds execution to it." ], "production_gate_cohort": "The Gate Catalog across AML/KYC, banking, government, real estate, insurance, energy, defence, pharma, telecom, sport governance, ADM, national laws and international frameworks" }, "not_claimed": [ "immo.quick is not a certification body, a registrar, or an accreditation authority.", "Nothing here establishes regulatory compliance. No compliance status is determined automatically by this manifest or by the chain it describes.", "This manifest is a description of implemented mechanism, not a warranty, an audit opinion, or a guarantee of future behaviour.", "Not every gate runs on every transaction. The active gate set is tenant- and sector-specific.", "Not every receipt is individually blockchain-anchored. Anchoring is periodic and per-window.", "Sovereign multi-witness anchoring is in placeholder status, witness contracts are pending.", "The authority chain does not claim that every authority source is legitimate. It claims that every receipt's authority source is traceable, verifiable, and revocable.", "No score is derived anywhere in this model. Reliability is observed and counted, never judged or ranked.", "The platform does not provide legal advice. All compliance analysis is positioned as forensic divergence testing (Divergenzanalyse), not legal opinion.", "A gate PASS is not execution permission. Gates provide domain determination. The Execution Rights Graph deterministically resolves whether an already authoritatively grounded execution right exists. These are separable and independently verifiable.", "The system does not create authority. It binds execution to authority that already exists, provenance is verified, never invented." ], "verification": { "anonymous_public_artifacts": [ "https://immoquick.eu/immoquick-capabilities.json", "https://immoquick.eu/.well-known/immoquick-proof-jwks.json", "https://immoquick.eu/verify" ], "execution_receipts": { "jwks": { "algorithm": "EdDSA + ML-DSA-65", "key_type": "OKP / Ed25519 + ML-DSA-65 (FIPS 204)", "role": "Public hybrid post-quantum keys that receipts are signed with. Fetchable anonymously; no credential needed to verify a receipt you already hold.", "url": "https://immoquick.eu/.well-known/immoquick-proof-jwks.json" }, "receipt_verify": { "url": "https://immoquick.eu/verify", "role": "Public receipt verification portal, enter a receipt ID to verify chain binding, HMAC integrity seal, and authority provenance.", "authentication": "none, public verification" }, "response_headers": [ "x-immoquick-receipt-id", "x-immoquick-receipt-hash", "x-immoquick-chain-link", "x-immoquick-authority-provenance", "x-immoquick-gate-verdict" ], "self_verification_procedure": [ "Obtain a sealed receipt from any gate execution.", "Where access to the relevant institutional verification context exists, verify the HMAC-SHA256 integrity seal over the canonical receipt data (deep recursive key sorting). Public independent verification relies on the Ed25519 and ML-DSA-65 signature envelope.", "Verify the Ed25519 signature against the anonymous public proof JWKS.", "Verify the ML-DSA-65 post-quantum signature against the persisted ML-DSA public key.", "Walk the chain: compute SHA-256(certification_hash:prev_receipt_hash) and compare with chain_link.", "Check the authority_provenance_hash against the registered AuthorityCredential.", "Verify the ntp_timestamp is within the acceptable temporal window.", "For execution-capable transactions: verify the ExecutionCapabilityToken signature_envelope (Ed25519 + ML-DSA-65) against the public proof JWKS.", "Verify that capability_hash matches SHA-256 over the canonical capability data (capability_id|subject_id|action|target|intended_state_change_hash|authorization_state_root|issued_at_t0|valid_from|valid_until|nonce|prerequisite_chain_hash).", "Check whether any applicable CapabilityInvalidationRecord has invalidation_sequence <= execution_cut_sequence. If so, the capability was invalidated before or at the authoritative Execution Cut and must not be treated as executable.", "Verify the ExecutionConsumptionReceipt: consumption_attempt_id must match, commit_result must be CONSUMED_AND_COMMITTED or CONSUMED_NO_COMMIT, and execution_cut_sequence must be >= the capability's authorization_state_sequence." ] }, "note": "Every URL above was verified before publication. A URL that only looks plausible is not a verification surface." }, "cryptographic_primitives": { "classical_signature": "Ed25519 (FIPS 186-5), EdDSA", "post_quantum_signature": "ML-DSA-65 (NIST FIPS 204), CRYSTALS-Dilithium, Security Category 3 (≈ AES-192)", "hash_function": "SHA-256 (NIST 180-4)", "hmac": "HMAC-SHA256 over canonical JSON with deep recursive key sorting", "domain_separation": "neutral 'immoquick' branding, no platform-specific identifiers in cryptographic domain-separation strings", "key_ceremony": "Shamir threshold secret sharing, no single party holds the full signing key", "key_rotation": "deterministic key rotation drill with forensic proof hash binding" }, "discovery": { "manifest": "https://immoquick.eu/immoquick-capabilities.json", "linked_from": [ { "mechanism": "well-known manifest", "url": "https://immoquick.eu/immoquick-capabilities.json" }, { "mechanism": "public verification portal", "url": "https://immoquick.eu/verify" }, { "mechanism": "llms.txt discovery", "url": "https://immoquick.eu/llms.txt" } ] }, "digest_rule": { "canonical_json": "JSON.stringify(obj, sortKeys=true, separators=(',',':')), deep recursive key sorting", "content_digest": "SHA-256 of canonical JSON of this document with generated_at, content_digest and manifest_digest removed", "manifest_digest": "SHA-256 of canonical JSON of this document with manifest_digest removed" }, "generated_at": "2026-08-18T12:00:00Z", "content_digest": "sha256:989f9ab029710432ed7c9183b6a1de21362f9ad2586f467b5be67812defc25ec", "manifest_digest": "sha256:631efe4fd861d90c91160897e207de35b5a9e9c9e7d6de24541449b2b0382b0c", "assurance_state": { "fortress_baseline": "1.2.0", "fortress_baseline_status": "SEALED", "adversarial_verification": { "defined_test_cases_passed": "90/90", "attack_families": 12, "tested_invalid_paths_accepted": 0, "golden_path_executable": true, "scope_note": "Results describe the defined adversarial regression suite and do not constitute a claim of universal security or resistance to unknown attack classes." }, "public_claim_limitations_preserved": true }, "normative_provenance_chain": [ "AUTHORITATIVE_SOURCE", "VERIFIED_NORMATIVE_STATE", "EXPLICIT_NORMATIVE_SPECIFICATION", "GOVERNED_MACHINE_LAW_STATE", "DETERMINISTIC_EXECUTION", "CRYPTOGRAPHIC_EVIDENCE" ], "execution_invariant": "NO VALID EXECUTION RIGHT. NO CAPABILITY. NO EXECUTION." }