(Lispex)

A bundle cannot choose the request used by a local gate. Native authority requires authentication, exact external source/input binding, current complete-transcript agreement, and the explicit required decision in one invocation.

Working method

diff-receipt evaluates a checked-profile rule with pinned input and emits csk.differential-receipt/v0.
Native lispex vouch issue constructs the receipt from supplied source and input, applies the signability gate, and signs the canonical payload in a DSSE envelope with an Ed25519 key.
Native and npm lispex vouch verify authenticate the envelope against consumer-supplied trust and pinned context and emit byte-identical csk.native-verify-report/v0 for the same bytes. Native --reexecute accepts only live request-bound evidence; with --bundle, both external --source and --input are mandatory.
lispex vouch gate ... --source RULE --input INPUT --require-decision approve --report-out GATE-REPORT performs authentication, request binding, current re-execution, and decision comparison internally. Exit 0 requires a live matching grant; 10 means authenticated current execution produced no matching grant.
lispex vouch inspect checks unsigned structure and consistency, while npm lispex vouch replay compares a fixed corpus across a change. Neither operation authenticates origin.
Bridge reports are a separate external-engine artifact class with a separate checker.
The bundle cannot choose the request used by a local gate. Native re-execution accepts only private request-bound evidence and mints a grant only after current complete-transcript agreement and exact required-decision equality.

Boundaries

A valid native signature establishes that an authorized key signed the exact checked payload under the supplied trust policy. It does not establish a human or organization identity, signing time, honest deployment, policy correctness, or semantic equivalence beyond the checked surface.
Issuance, verifier re-execution, and the local decision gate are Native-only. npm offers authenticated verify, structural inspect, and replay but exposes no live evidence handle or report-promotion API; public WASM and Playground expose evaluation but no authenticated Vouch surface.
A gate grant is an in-process local result, not a transferable token, freshness or replay protection, identity proof, policy-correctness proof, or permission for an external action. Serialized gate, re-execution, authentication, and Bridge reports cannot be promoted into a grant.
Native receipts and Bridge reports are deliberately non-confusable artifact shapes.