Receipts, Not Promises: Fail-Closed Governance for High-Stakes AI (Kingdom Conformance RFC v1.3.6, Public Draft)

Receipts, not promises.

This Zenodo record publishes Kingdom Conformance RFC v1.3.6 (Public Draft) — a procurement-ready standard for replay-verifiable conformance receipts and deterministic validation of high-stakes AI and other machine-assisted decision artifacts. “Kingdom Conformance” is a project label (files prefixed Kingdom_Conformance_*) and does not change the technical scope. The RFC is intended for AI safety, AI governance, assurance, incident response, audit, and procurement teams who need independently replay-verifiable receipts—not unverifiable assurances.

Normative scope

Only the RFC PDF is normative. All other files in this record are supporting artifacts (templates, interop evidence, test vectors, verifier kits, and reviewer/auditor packets).

Fail-closed posture: HOLD blocks sensitive side effects by default when evidence is missing, stale, inconsistent, unverifiable, or nondeterministic.

What the standard specifies (high level)

• A deterministic validator output contract producing PASS / FAIL / HOLD outcomes with structured reason codes (where applicable).

• Replay semantics for verifying outcomes from receipts and referenced evidence within freshness bounds.

• Procurement-ready language and acceptance tests for fail-closed gating of sensitive operations.

• Interoperability foundations via minimal schemas/registry seeds and stewardship/change-control expectations.

Interoperability evidence (included)

This record includes a reference verifier test-vector suite and an independent minimal verifier kit, plus corresponding run logs, demonstrating replay of the published vectors across two implementations (including negative cases and freshness-boundary cases).

Included artifacts: S2 (reference verifier + vectors), S8 (independent verifier), S6 + run logs (interop evidence), S7 (schemas/registry seeds), S9 (stewardship/change-control).

Security considerations (snapshot)

Threat model snapshot includes: forged receipts/permits; stale or substituted evidence beyond freshness bounds; and time-of-check/time-of-use (TOCTOU) drift.

Public-safe by design

The RFC and artifacts avoid exploit guidance and do not require disclosure of confidential implementation details by default.

License / rights notice

Text and supporting artifacts are licensed under CC BY 4.0 unless a file states otherwise. Patent rights are not licensed by this publication. Vendor-neutral does not mean IP-unencumbered; implementers are responsible for obtaining any necessary rights. This record is not legal advice.

Integrity / verification

Use SHA256SUMS.txt to verify file integrity (SHA-256) after download.

How to cite

Use the Zenodo “Cite as” entry after publication.

Contact

MeridianVerity@proton.me