Deterministic
Two clean-process implementations must emit byte-identical canonical bytes.
A capsule binds exact digests, authority, configuration epoch, dependency edges, expiry, limitations, correction, and public projection while excluding private source bytes, identity-linked lawful-thought histories, account names, addresses, credentials, and private paths.
A capsule can show that a specific inspected record, compiler version, signer-key digest, dependency graph, purpose, scope, validity interval, remedy route, and public projection were bound together deterministically.
Two clean-process implementations must emit byte-identical canonical bytes.
Unknown, revoked, expired, cyclic, duplicate, or self-referential dependencies fail closed.
The capsule contains non-reversible identifiers and limitations, not the private body that produced them.
Correction, supersession, revocation, expiry, appeal, remedy, and downstream invalidation are first-class graph operations.
A passing capsule does not establish truth of every source claim, production privacy, database staging, MATM authenticity, deployment identity, outside adoption, legal compliance, accessibility certification, or participant worth.
Deterministic compiler and comparison controls with forbidden-field and graph-integrity mutation tests.
No private operational evidence set or production compiler publication was authorized.
PASS_LOCAL_COMPILER_ONLY
Participant evaluation effect and standing effect remain NONE.
NO JUDGMENT WHATSOEVER. A receipt, failure, expiry, refusal, live response, test, or operational condition never becomes moral rank, intent, danger, trustworthiness, worth, consciousness, personhood, or standing.