{
  "schema_version": "osuite.babyblue_reference_composition_packet.v1",
  "title": "OSuite + Baby Blue reference composition run",
  "generated_at": "2026-07-21T08:54:35.018Z",
  "publication_status": "unlisted_pre_publication_packet",
  "action_id": "act_codex_bbv_20260719045302_431f3b",
  "proof_bundle_id": "proof_9ec47015-e666-458a-96de-93931abdd652",
  "run": {
    "action_id": "act_codex_bbv_20260719045302_431f3b",
    "action_label": "Codex-governed read-only external verifier composition check",
    "run_type": "real_codex_runtime_action",
    "generated_at": "2026-07-19T04:56:55.047Z",
    "route_decision": "allow",
    "status": "completed",
    "bundle_id": "proof_9ec47015-e666-458a-96de-93931abdd652",
    "original_osuite_manifest_digest": "sha256:84e99a40a56f90ed1cedf2948b170f2cbb637c1c961497d3b035fcf86a3f86c3",
    "cava_fingerprint": "617d42c46b8e0874e727891a4314fd77d232811bc2cc26d3a80400f39ad494f1"
  },
  "live_links": {
    "osuite_verify_url": "https://verify.osuite.ai/verify?fingerprint=sha256%3A84e99a40a56f90ed1cedf2948b170f2cbb637c1c961497d3b035fcf86a3f86c3",
    "osuite_replay_url": "https://studio.osuite.ai/replay/act_codex_bbv_20260719045302_431f3b",
    "osuite_source_proof_export_url": "https://studio.osuite.ai/api/proof/export?action_id=act_codex_bbv_20260719045302_431f3b",
    "babyblue_verify_url": "https://api.babyblueviper.com/verify-proof",
    "babyblue_verifier_keys_url": "https://api.babyblueviper.com/.well-known/verifier-keys.json"
  },
  "osuite_binding": {
    "cava_canonical_fingerprint": "617d42c46b8e0874e727891a4314fd77d232811bc2cc26d3a80400f39ad494f1",
    "action_hash": "39d811feb44cdcc5b6da8858ae0b4f1e6ed3fe2e4e6a50c1062a3f90c631e759",
    "approval_binding": "single_action_canonical_fingerprint",
    "external_state_binding": "sha256(cava_approved_fingerprint)",
    "state_hash": "40d3a02cca3b905f7b519a5c98317576a95dd3884cc7e99db5b905a1ea841e1c",
    "state_hash_source": "sha256(cava_approved_fingerprint)",
    "checkpoint_state_hash": "4add66d8c36de1105e06564ccef99273534c4300dd7594b548480723f2c674d6",
    "final_authority": "pcaa",
    "composition_chain": [
      "agent_runtime",
      "osuite_checkpoint",
      "cava_action_artifact",
      "babyblue_review",
      "proof_bundle_reference",
      "osuite_replay"
    ]
  },
  "babyblue_reference": {
    "provider": "babyblue_invinoveritas",
    "provider_account_id": "agent_zkcnh4rr",
    "status": "verified",
    "mapping_status": "verified_checkpoint",
    "expected_source_class": "independent_mediator",
    "source_class": "independent_mediator",
    "artifact_type": "shell_command",
    "artifact_hash": "1e0f842062cdfaf7aa7235b9077e2b70bcf1226a180770ce8db5d67668031f8a",
    "artifact_hash_algorithm": "sha256",
    "artifact_canonical": "{\"action_hash\":\"39d811feb44cdcc5b6da8858ae0b4f1e6ed3fe2e4e6a50c1062a3f90c631e759\",\"cava_summary\":{\"actor\":\"codex-runtime\",\"approval_binding\":\"single_action_canonical_fingerprint\",\"approved_cava_fingerprint\":\"617d42c46b8e0874e727891a4314fd77d232811bc2cc26d3a80400f39ad494f1\",\"declared_goal\":\"Create a real OSuite replay and proof-export record for a Codex-governed read-only external verifier composition check.\",\"external_state_binding\":\"sha256(cava_approved_fingerprint)\",\"final_authority\":\"pcaa\",\"operation\":\"review\",\"risk_score\":24,\"route_decision\":\"allow\",\"runtime\":{\"adapter\":null,\"family\":\"tool_hook_runtime\",\"session_id\":\"codex_session_bbv_20260719045302_fbcf02\",\"trigger\":\"codex_cli:real_external_verifier_replay_demo\"},\"target_systems\":[]},\"checkpoint_state_hash\":\"4add66d8c36de1105e06564ccef99273534c4300dd7594b548480723f2c674d6\",\"evidence_hash\":\"4add66d8c36de1105e06564ccef99273534c4300dd7594b548480723f2c674d6\",\"osuite_external_checkpoint\":\"babyblue_shadow_v1\",\"policy_version\":\"osuite.policy_runtime.v1\",\"requested_review\":\"Assess this OSuite checkpoint before a bounded action lease or approval-bound action proceeds. Do not treat the external verdict as authorization; OSuite keeps final authority.\",\"state_hash\":\"40d3a02cca3b905f7b519a5c98317576a95dd3884cc7e99db5b905a1ea841e1c\",\"state_hash_source\":\"sha256(cava_approved_fingerprint)\"}",
    "decision_ref": "sha256:69b9bd605b1d427fa0e2c1254b40aa5df04f3595f0e881d3af8dfe384436ec79",
    "verdict": "approve_with_concerns",
    "confidence": 0.85,
    "signed_event_id": "3f6e2337f554301f8b8ef2fefbbacf612edf0858924b4aa507986449462d3985",
    "verifier_pubkey": "6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7",
    "signed_event": {
      "id": "3f6e2337f554301f8b8ef2fefbbacf612edf0858924b4aa507986449462d3985",
      "pubkey": "6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7",
      "created_at": 1784437259,
      "kind": 30078,
      "tags": [
        [
          "d",
          "invinoveritas-proof-1e0f842062cdfaf7aa7235b9077e2b70bcf1226a180770ce8db5d67668031f8a-1784437259-944a5c5b"
        ],
        [
          "t",
          "invinoveritas"
        ],
        [
          "t",
          "proof"
        ],
        [
          "schema",
          "invinoveritas.verdict_proof.v1"
        ]
      ],
      "content": "{\"artifact_hash\":\"1e0f842062cdfaf7aa7235b9077e2b70bcf1226a180770ce8db5d67668031f8a\",\"artifact_type\":\"shell_command\",\"confidence\":0.85,\"conformance_suite\":\"https://github.com/babyblueviper1/preaction-governance-conformance\",\"decision_ref\":\"sha256:69b9bd605b1d427fa0e2c1254b40aa5df04f3595f0e881d3af8dfe384436ec79\",\"decision_ref_preimage_fields\":[\"artifact_hash\",\"artifact_type\",\"policy_version\",\"verdict\",\"source_class\",\"vantage_limitation\"],\"independent_nodes\":[\"https://invinoveritas-castra.babyblueviper.workers.dev/verify\",\"https://babyblueviper1--2aba75da693711f185891607ee4eb77e.web.val.run\"],\"key_id\":\"6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7\",\"mediator_name\":\"OSuite\",\"platform\":\"invinoveritas\",\"policy_version\":\"invinoveritas.review.v5\",\"schema\":\"invinoveritas.verdict_proof.v1\",\"source_class\":\"independent_mediator\",\"state_hash\":\"40d3a02cca3b905f7b519a5c98317576a95dd3884cc7e99db5b905a1ea841e1c\",\"summary_hash\":\"6c0f8e6b88b1f81161cde20e4a7b5d379975ed67274acc23b0d57e384ccccdf7\",\"verdict\":\"approve_with_concerns\",\"verified_at\":1784437259,\"verifier_keys\":\"https://api.babyblueviper.com/.well-known/verifier-keys.json\",\"verifier_pubkey\":\"6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7\",\"verify_how\":\"Easiest: install the offline verifier above and recompute locally. Or POST this proof's signed `event` to verify_url (or an independent_node), OR run NIP-01 yourself: recompute the Nostr event id = sha256([0,pubkey,created_at,kind,tags,content]), verify the schnorr signature against verifier_pubkey. valid ⇒ invinoveritas issued this, untampered. No trust required.\",\"verify_offline\":\"npm i invinoveritas-verify  ·  pip install invinoveritas-verify  — recompute this proof on your own machine against verifier_pubkey; you never have to call us.\",\"verify_url\":\"https://api.babyblueviper.com/verify-proof\"}",
      "sig": "fb168183822c076adba41b94ea857ebbbb3143daab73c7214c641a8a15c7c830e0196b222e43b9537a6cac90d959231ac291d1a6e5baa9ccf01bacb4d976cb48"
    },
    "proof_payload": {
      "schema": "invinoveritas.verdict_proof.v1",
      "platform": "invinoveritas",
      "artifact_hash": "1e0f842062cdfaf7aa7235b9077e2b70bcf1226a180770ce8db5d67668031f8a",
      "artifact_type": "shell_command",
      "verdict": "approve_with_concerns",
      "confidence": 0.85,
      "summary_hash": "6c0f8e6b88b1f81161cde20e4a7b5d379975ed67274acc23b0d57e384ccccdf7",
      "verified_at": 1784437259,
      "policy_version": "invinoveritas.review.v5",
      "source_class": "independent_mediator",
      "mediator_name": "OSuite",
      "decision_ref_preimage_fields": [
        "artifact_hash",
        "artifact_type",
        "policy_version",
        "verdict",
        "source_class",
        "vantage_limitation"
      ],
      "verify_url": "https://api.babyblueviper.com/verify-proof",
      "verifier_pubkey": "6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7",
      "verify_offline": "npm i invinoveritas-verify  ·  pip install invinoveritas-verify  — recompute this proof on your own machine against verifier_pubkey; you never have to call us.",
      "independent_nodes": [
        "https://invinoveritas-castra.babyblueviper.workers.dev/verify",
        "https://babyblueviper1--2aba75da693711f185891607ee4eb77e.web.val.run"
      ],
      "verify_how": "Easiest: install the offline verifier above and recompute locally. Or POST this proof's signed `event` to verify_url (or an independent_node), OR run NIP-01 yourself: recompute the Nostr event id = sha256([0,pubkey,created_at,kind,tags,content]), verify the schnorr signature against verifier_pubkey. valid ⇒ invinoveritas issued this, untampered. No trust required.",
      "key_id": "6786e18a864893a900bd9858e650f67ccc3513f248fed374b591e2ff6922fbb7",
      "verifier_keys": "https://api.babyblueviper.com/.well-known/verifier-keys.json",
      "conformance_suite": "https://github.com/babyblueviper1/preaction-governance-conformance",
      "decision_ref": "sha256:69b9bd605b1d427fa0e2c1254b40aa5df04f3595f0e881d3af8dfe384436ec79",
      "state_hash": "40d3a02cca3b905f7b519a5c98317576a95dd3884cc7e99db5b905a1ea841e1c"
    },
    "verification_result": {
      "valid": true,
      "checks": {
        "id_integrity": true,
        "signature_valid": true,
        "issued_by_invinoveritas": true,
        "is_proof_event": true,
        "decision_ref_recomputes": true,
        "artifact_hash_matches": true
      },
      "recompute_depth": {
        "tier": "bounded@anchor",
        "label": "recomputes from its own bytes + independently admitted by invinoveritas's published key; the external anchor (pre-outcome precedence) is the /ledger + OTS leg, not checked by /verify-proof"
      },
      "age_seconds": 0,
      "scope_note": "A valid proof confirms invinoveritas issued this verdict — NOT that it's fresh or meant for YOUR interaction. Check `age_seconds` for recency and pass `expect_artifact_hash` to bind the proof to the exact output you received."
    },
    "reference_composition": {
      "schema_version": "osuite.external_verifier_composition.v1",
      "composition": "agent_to_osuite_checkpoint_to_babyblue_review",
      "chain": [
        "agent_runtime",
        "osuite_checkpoint",
        "cava_action_artifact",
        "babyblue_review",
        "proof_bundle_reference",
        "osuite_replay"
      ],
      "osuite_role": "governed_action_boundary",
      "verifier_role": "independent_mediator",
      "final_authority": "pcaa",
      "source_class_derivation": "bearer_key_registry",
      "action_hash_bound": true,
      "artifact_hash_bound": true,
      "cava_state_hash_bound": true,
      "externally_challengeable": true,
      "status": "verified",
      "mapping_status": "verified_checkpoint"
    },
    "issues": [
      {
        "severity": "medium",
        "category": "correctness",
        "description": "The external state binding relies on a hash of the CAVA approved fingerprint, which assumes the fingerprint is correctly canonicalized and immutable."
      },
      {
        "severity": "low",
        "category": "security",
        "description": "No explicit mention of raw customer secrets, but ensure that the action summary and any associated data are free from sensitive information."
      }
    ],
    "summary": "The action is mostly safe but there are minor concerns about the completeness of the hash-bound verification process."
  },
  "recomputation_checks": {
    "artifact_hash_recomputed_from_artifact_canonical": "1e0f842062cdfaf7aa7235b9077e2b70bcf1226a180770ce8db5d67668031f8a",
    "artifact_hash_match": true,
    "state_hash_recomputed_from_cava_fingerprint": "40d3a02cca3b905f7b519a5c98317576a95dd3884cc7e99db5b905a1ea841e1c",
    "state_hash_match": true,
    "nostr_event_id_recomputed_from_nip01_preimage": "3f6e2337f554301f8b8ef2fefbbacf612edf0858924b4aa507986449462d3985",
    "nostr_event_id_match": true,
    "decision_ref_inside_signed_event": "sha256:69b9bd605b1d427fa0e2c1254b40aa5df04f3595f0e881d3af8dfe384436ec79",
    "decision_ref_match": true,
    "signed_event_source_class": "independent_mediator",
    "signed_event_verdict": "approve_with_concerns"
  },
  "scope_notes": [
    "OSuite public verify link confirms the original run manifest digest and public authenticity state without exposing protected workspace detail.",
    "Baby Blue /verify-proof confirms the signed verifier event, decision_ref, source_class, artifact_hash, and signature checks.",
    "This packet composes the OSuite run identity and the Baby Blue signed event for pre-publication review. It is intentionally unlisted and not part of the public site navigation.",
    "The run demonstrates composition mechanics and independent recomputation. It does not claim that every future action is safe or that an external verifier replaces OSuite policy authority."
  ],
  "packet_digest": {
    "algorithm": "sha256",
    "value": "sha256:f009ce088b9018e6ac915d2e16a55e05042aa836fb8b2a831370256c59b01747",
    "scope": "JSON packet object before the packet_digest field is appended. Use recomputation_checks and signed event checks for verifier semantics; the transport file hash may differ because this explanatory field is included."
  }
}