# Vaultfire V3 open interface and conformance package

SPDX-License-Identifier: MIT

Repository-local, additive specification version 1.0.0 for third-party compatible Accountability and Partnership bond implementations.

**Current candidate status: BLOCKED / NONCONFORMANT.** All 15 canonical source hashes, including the stabilized governance source, are current. The working candidate remains blocked only because it is not a final clean commit containing both the root `LICENSE` and this package. Open MIT licensing is separate from production deployment, decentralization, authorization, audit, endorsement, and module activation; none is claimed.

## Run offline

```sh
python3 tools/check.py
python3 tools/check.py --release
python3 -m unittest discover -s tests -v
python3 -O tools/check.py
python3 -O -m unittest discover -s tests -v
python3 tools/conform.py vectors/positive.json --adversarial vectors/adversarial.json --output reports/conformance-report.json
python3 update_vector_errors.py
```

The tools use only the Python 3 standard library, make no network/RPC/wallet calls, and perform no signing. `check.py` is fail-closed in normal and optimized Python execution and checks schemas, semantic invariants, the complete canonical interface closure, source/license bindings, deterministic vectors, truth labels, symlink/path safety, and full source-artifact checksums. Development discovery ignores interpreter/test caches; `--release` rejects their presence. `conform.py` emits a post-commit report without modifying committed inputs, so one candidate commit/tree binds the mapping, interface, evidence, manifest, license, and report through one envelope without a checksum fixed point. The legacy-named `update_vector_errors.py` is a read-only frozen-vector verifier; it never rewrites expected results.

The package contains:

* 8 strict versioned schemas and semantic validation;
* 8 positive and 38 adversarial vectors;
* a 29-check mandatory conformance registry;
* exact snapshots of 15 source modules, 4 SDK deployment identities, 11 SDK read routes, and 20 generated API paths;
* standard-library regression and tamper tests, including all 16 independent findings and all 21 reported invalid mutations.

Specification compliance does not imply audited, deployed, authorized, or endorsed. See `spec/1.0.0/VF3-OPEN.md`.

## License

SPDX-License-Identifier: MIT. The authoritative repository-root `LICENSE` SHA-256 is `6ffb9af0a5ff2c17d0bbcb866634076f7bcd0f82ce756bd80856398ef67dd42a`. Open licensing does not imply production decentralization, deployment, audit, authorization, activation, or endorsement.
