# KRINEIA public reference snapshot

This is a deliberately limited source and specification snapshot from
`hummbl-io/krineia` commit `928f75431d336124e6c1d3bbb7e9645d40b2d9fe`,
prepared on 2026-09-26. It includes the draft specification, reference verifier
and watcher, their tests, dependency lock, and license texts. `MANIFEST.json`
records the exact files and SHA-256 hashes.

The original repository remains private. This package contains no Git history,
operational receipt chain, research papers, product drafts, workflow definitions,
deployment credentials, or private issue/PR discussions. It is not clearance to
publish the rest of that repository or evidence of a production deployment.

## Status and assurance boundary

- Invariants: **v1.0-rc2 draft**.
- Strict signed receipt schema: **v2.1 proposed, not ratified** at this source ref.
- Legacy v0.1 inspection: unsigned and unauthenticated; structural checking alone
  does not authenticate the observer or establish that an event happened.
- A complete assurance result requires independently trusted keys and expected
  head/count anchors. Do not derive trusted anchors from the presented chain.
- Included documents preserve the source snapshot. References to internal
  constitutional amendments or historical governance chains do not make those
  records public and do not confer ratification on this package.

## Read the specification

- [Governing invariants](spec/INVARIANTS.md)
- [Operator semantics](spec/OPERATOR_SEMANTICS.md)
- [Receipt schema](spec/RECEIPT_SCHEMA.md)
- [Schema change history](spec/SCHEMA_CHANGELOG.md)
- [Machine-readable schema](spec/krineia_receipt.schema.json)
- [Signed-format test vector](spec/test-vectors/v2.1-ed25519-unicode-numbers.json)

## Verify and run locally

Python 3.11 or newer is required. Create a virtual environment, then install the
included hash-pinned test dependencies. On Windows replace `.venv/bin/python`
below with `.venv\Scripts\python.exe`.

```sh
python -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements-ci.txt
.venv/bin/python -m pytest -q
.venv/bin/python tools/verify_chain.py --help
.venv/bin/python daemon/krineia_watcher.py --help
```

The verifier's legacy structural path uses Python's standard library. Strict
Ed25519 verification and writing require `cryptography`, included in the lock.
The exported tests cover the verifier, watcher, and Merkle mountain range helper;
they do not cover excluded products, papers, or production infrastructure.

For real use, follow the verifier's explicit mode and independent-anchor options.
The watcher requires an explicitly authorized new-chain initialization or an
independently retained restart checkpoint. Supply any private signing material
through the documented environment interface; do not put it in command-line
arguments, receipts, or this source package. The package ships no operational
keys or live receipt chain.

## Check the snapshot

`MANIFEST.json` identifies whether each file was copied from the pinned source
or is an export-specific wrapper. Each `sha256` hashes the complete raw file
bytes. The manifest describes the payload files; it does not hash itself.

```sh
python verify_snapshot.py
```

The website also publishes the ZIP's SHA-256 separately. A matching checksum
detects a byte mismatch against the downloaded manifest or published digest; it
does not independently authenticate the publisher.

## Propose a change or report a problem

Visit https://krineia.org/ for participation instructions. Send a proposal to
**reuben@hummbl.io** with subject **KRINEIA proposal**, the source commit, the
affected file or clause, your proposed change, and a reproduction or rationale.
Do not include private operational data, credentials, or live receipt contents.
The private repository's issue tracker is not a prerequisite for participation.
Submission does not itself amend or ratify the standard.

Report security vulnerabilities privately to **security@hummbl.io**. This is a
draft reference snapshot with no production-support or response-time guarantee.

## License

Reference source and specification are available under **MIT OR Apache-2.0**;
see [LICENSE](LICENSE), [LICENSE-MIT](LICENSE-MIT), and
[LICENSE-APACHE](LICENSE-APACHE). The package does not grant trademark rights.