Integrate
Conformance suite
Falsify envelope assembly, binding, burn ordering, and reject stages against your deployment before you call migration done.
ENI6MA Verify and the DEMO-HACK adversary path exercise attacks that should land on named reject stages. Your integration conforms when the same stages fire against your Gate, not when a demo container passes in isolation.
Minimum checks
- Allow path: valid envelope → 2xx and side effect
- Replay: identical envelope bytes → reject at nonce
- Body tamper without re-prove → reject at request-hash
- Endpoint retarget → reject at endpoint
- Policy loosen → reject at policy-hash
- Stale tau outside window → reject at freshness (when window is server-enforced)
Run these in CI against a staging Gate with a durable ledger. Treat green Verify as evidence for the Deployment Security Package conversation, not as a substitute for your own environment matrix.
Mechanism claims
A conformance suite can falsify envelope assembly, binding, burn ordering, and reject stages against a deployment.ValidatedVerify / adversary harness exercises allow path, replay reject, and named reject stages.
The nonce is burned before twin validation, so a failed or replayed submission cannot be spent twice.ShippingGate order spends nonce_uuid prior to validate-proof; spent nonces reject at the nonce stage.Holds under the reference architecture