# CROSSING_FIELD_SOURCE_INVENTORY_001

Read-only source inventory for a warrantable crossing candidate.

**Conclusion: `NO_COMPLETE_CANDIDATE`.**

At the pinned source commit there is no single crossing (RequestBinding +
ContextSnapshot + GateVerdict) whose signed verdict binds to real, retrievable
inputs and measured invariants. The site's current determination — **HOLD** —
is therefore preserved unchanged by this document. This file records *why* the
inventory reached that conclusion so the finding is durable; it changes no
fixture, no gate logic, and no determination.

## What was inspected

- **Site repository:** `warranted-crossings-site`, this checkout
  (`git` branch `master`, tip `9d83e01`). This document adds only this file.
- **Source repository under inventory:** `crossing-graph-design`, commit
  `517ab6424dffc02453c7a4b34c01443189d0ae16`
  (`source_commit_date` `2026-09-23T14:23:05+01:00`), as pinned by
  `public/fixtures/manifest.json` in this site.
- **Method:** read-only. No source file was executed as part of reaching this
  conclusion; the reasoning is over the checked-in bytes and the profiles they
  claim to satisfy. The site's own port (`src/lib/gate.ts`, run by
  `tests/gate.test.ts`) already computes the same determination in the browser.

### Inspected paths

Fixtures copied into this site (verbatim, hash-pinned in `manifest.json`):

| File | SHA-256 (manifest) | Bytes |
| --- | --- | --- |
| `request-binding.v1.json` | `98e235354dbddaf4bafe432df3d9ddde77a1fbca9271f50e0d4f241f82eb1e6f` | 2523 |
| `context-snapshot.v1.json` | `38412296966d2cd9d5bfe62a03114ad7a65f326647658141e9ffab5ba82cfa08` | 16385 |
| `gate-verdict.v1.json` | `c56acb0386a7c345e4b8be9dae9d3766d9bc840b09e4a151394b2ed6e144f1f2` | 10035 |

Corresponding source-repo paths at `517ab64`:

- `fixtures/request-binding.v1.json`
- `fixtures/context-snapshot.v1.json`
- `fixtures/gate-verdict.v1.json`
- `schema/canonical/request-binding.v1.candidate.json` (status `candidate_not_frozen`)
- `schema/canonical/gate-verdict.v1.candidate.json` (status `candidate_not_frozen`)
- `schema/canonical/context-snapshot.v1.json` (status `frozen_wire_binding_only`)
- `docs/conformance/request-binding.v1.candidate.md`
- `docs/conformance/gate-verdict.v1.candidate.md`
- `docs/conformance/context-snapshot.v1.md` (+ `context-snapshot.v1.freeze-review.md`)
- `scripts/verify_request_binding_v1.py`, `scripts/verify_gate_verdict_v1.py`,
  `scripts/verify_context_snapshot_v1.py` (the three independent Python verifiers)

## Placeholder values found (not bound to any retrievable material)

The single positive GateVerdict vector (`admissibility-positive-test-key`) and
the two positive ContextSnapshot vectors (`reference-binding`,
`genesis-no-expiry`) carry fixed byte patterns in the fields that would have to
name real material. These are test placeholders, not digests of any published
bytes:

| Field | Placeholder value (32 bytes) | Where |
| --- | --- | --- |
| `policy_hash` | `0x1111…1111` | GateVerdict field 6; ContextSnapshot field 3 (both vectors) |
| `inputs_hash` (in verdict) | `0x2222…2222` | GateVerdict field 7 |
| `graph_head_hash` | `0x3333…3333` | ContextSnapshot field 7 (`reference-binding`) |
| `authority_state_hash` | `0x4444…4444` | ContextSnapshot field 8 (both vectors) |

Signing key material (test only, published inside the fixture that it signs):

- `key_identifier` = `test-gate-key-v1`
- `test_public_key_hex` = `0d7550754e0800a5d237eef5826035766b9b3e5a15868a940ab289958788e3b0`

For contrast, the ContextSnapshot profile *does* recompute a real
domain-separated commitment from the supplied bytes:

- `reference-binding`: `context_hash` `6a1ba37e…cb36`,
  recomputed `inputs_hash` `3d48aa952b7e1d0e0431d19c51d15e812ea5c7df7be420cbbace2756767de837`
- `genesis-no-expiry`: `context_hash` `18e51324…27e4`,
  recomputed `inputs_hash` `4741a7d451ae23afef8ba89cc1769a7112ce3f19c2de0808b55d8485947ec1d2`

Neither recomputed `inputs_hash` equals the verdict's `0x2222…2222`.

## First missing edge

Walking the warrant chain request → context → verdict → (policy, authority,
invariants, trust root), the **first** edge that fails is the input-binding
edge from the signed verdict back to the context:

> **`INPUT_BINDING_FAILED`** — `GateVerdict.inputs_hash` = `0x2222…2222` does
> **not** equal `SHA-256("gate-inputs:v1\0" ‖ request_hash ‖ context_hash)`,
> which recomputes to `3d48aa95…de837` (reference-binding) or `4741a7d4…ec1d2`
> (genesis). The signed verdict therefore does not commit to any published
> request/context pair. (`src/lib/gate.ts` check `binding.inputs_hash`.)

Because that first edge is broken, the verdict's valid Ed25519 signature
attests only to *its own* bytes (whose `inputs_hash` is the placeholder); it
attests to no retrievable inputs. A valid signature over a verdict about other
inputs cannot warrant this crossing.

Downstream edges are also incomplete, independently of the first:

- **`UNAVAILABLE` (policy):** no policy document hashes to `policy_hash`
  `0x1111…1111`, so the recorded `positive` outcome cannot be re-derived.
- **`UNAVAILABLE` (authority state):** no authority-state material hashes to
  `authority_state_hash` `0x4444…4444`.
- **`UNAUTHORIZED` (trust root):** the only source of the signing public key is
  the fixture that carries the signature; no independent trust root lists it.
- **`UNMEASURABLE` (invariants):** the verdict asserts an
  `evaluated_invariants` mask (`0x03`) but supplies no invariant definition,
  inputs, measurement, or tolerance. `UNMEASURABLE` is not `PASS`.

By the gate rule *WARRANT = EXECUTE iff every check is PASS*, at least five
checks are FAIL / UNAVAILABLE / UNMEASURABLE, so the determination is **HOLD**
and no fixture at `517ab64` is a complete warrant candidate.

## Non-claims

This inventory deliberately does **not** assert any of the following:

1. **Not a defect report.** The RequestBinding and GateVerdict profiles are
   explicitly `candidate_not_frozen`, and the ContextSnapshot v1 freeze covers
   only the wire layout and binding formula — never the supplied policy, graph,
   authority, or freshness *values*. Placeholder bytes in test vectors are
   expected at this stage; their presence is not a fault in the source repo.
2. **Not a claim that the recorded `positive` verdict is wrong.** The inventory
   claims only that the outcome cannot be *independently warranted* from
   published material — absence of retrievable evidence is not a negative
   verdict.
3. **Not a signature failure.** The Ed25519 signature over the verdict bytes
   verifies. Signature validity is reported separately from authority and
   binding; it is necessary but never sufficient for a warrant.
4. **Not a binding-formula failure.** The frozen ContextSnapshot binding is
   internally correct; it simply is not the value the verdict committed to.
5. **`DECISION_REPLAY_UNAVAILABLE`.** No independent replay of the source gate
   decision is possible from published material: policy evaluation, event/
   authority history, and authority-state derivation are not retrievable at
   `517ab64`. Recomputing a digest of this site's own determination is not a
   replay of the source decision.

## Effect on this site

None beyond adding this file. The determination remains **HOLD**; the fixtures,
`manifest.json`, `src/lib/gate.ts`, and all tests are unchanged. Reproduce the
determination with `npm test` (see `tests/gate.test.ts`), or read it directly
from `src/lib/gate.ts`.