From 88f4071718ed1d65fb420b235b57af0f7816c0dc Mon Sep 17 00:00:00 2001
From: mdheller <charles.peterson@socioprophet.ai>
Date: Mon, 3 Aug 2026 01:54:39 -0400
Subject: [PATCH] feat(model-plane): native InferenceReceipt emitter shim for
 inferenced (T7-12 emitter slice)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

source-os is a downstream emitter for the Tranche 7 Model Plane. This adds the
smallest real slice that proves source-os can emit a spec-conformant,
hash-chained InferenceReceipt natively when a completion finishes, into the
estate's single ledger (SEAM-011: no local-only ledger).

Consume-not-fork: the canonical emitter and schema are vendored BYTE-VERBATIM
from prophet-platform apps/receipt-gateway (provenance + source sha256 in
modules/model-plane/tools/VENDOR.md and the schema $comment). The only
source-os code is inferenced_shim.py, the serving-path caller — it delegates all
chaining to emit_receipt() and re-implements nothing.

Teeth (.github/workflows/model-plane-receipts.yml): a produced receipt validates
against InferenceReceipt.schema.json and chains (prevHash continuity); a tampered
entry and a local-only (unchained) entry are both rejected; and the vendored
emitter is asserted to match the canonical sha256 (consume-not-fork guard).

The full daemon set (T7-9..15) and seam-registry (T7-20) remain; see the T7
follow-up issue. docs/model-plane/architecture.md (T7-9 stub) tracks status.
---
 .github/workflows/model-plane-receipts.yml    |  48 +++
 docs/model-plane/architecture.md              |  47 +++
 .../inferenced_shim.cpython-312.pyc           | Bin 0 -> 8886 bytes
 modules/model-plane/inferenced_shim.py        | 144 +++++++
 .../model-plane/InferenceReceipt.schema.json  | 361 ++++++++++++++++++
 modules/model-plane/tools/VENDOR.md           |  27 ++
 .../inference_receipt_emitter.cpython-312.pyc | Bin 0 -> 10650 bytes
 .../tools/inference_receipt_emitter.py        | 171 +++++++++
 8 files changed, 798 insertions(+)
 create mode 100644 .github/workflows/model-plane-receipts.yml
 create mode 100644 docs/model-plane/architecture.md
 create mode 100644 modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc
 create mode 100755 modules/model-plane/inferenced_shim.py
 create mode 100644 modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json
 create mode 100644 modules/model-plane/tools/VENDOR.md
 create mode 100644 modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc
 create mode 100755 modules/model-plane/tools/inference_receipt_emitter.py

diff --git a/.github/workflows/model-plane-receipts.yml b/.github/workflows/model-plane-receipts.yml
new file mode 100644
index 0000000..b1cb851
--- /dev/null
+++ b/.github/workflows/model-plane-receipts.yml
@@ -0,0 +1,48 @@
+name: model-plane-receipts
+
+# Teeth for the Model Plane (Tranche 7) receipt emitter shim: proves source-os emits
+# spec-conformant, hash-chained InferenceReceipts and that tampered / local-only receipts
+# are rejected (SEAM-011). CI needs no model — the emitter path is what is under test.
+
+on:
+  pull_request:
+    paths:
+      - 'modules/model-plane/**'
+      - '.github/workflows/model-plane-receipts.yml'
+  push:
+    branches:
+      - main
+    paths:
+      - 'modules/model-plane/**'
+      - '.github/workflows/model-plane-receipts.yml'
+
+jobs:
+  inferenced-receipt-teeth:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install jsonschema
+        run: python -m pip install --quiet 'jsonschema>=4.22,<5'
+
+      - name: Assert emitter is vendored byte-verbatim (consume-not-fork)
+        run: |
+          set -euo pipefail
+          expected=6881246b8e41a515fb1b29df645faeb9be17d8195d22a7e0d5ce15f8477d8e6a
+          actual=$(sha256sum modules/model-plane/tools/inference_receipt_emitter.py | awk '{print $1}')
+          if [ "$actual" != "$expected" ]; then
+            echo "ERR: vendored emitter diverged from canonical (expected $expected, got $actual)."
+            echo "     Refresh from prophet-platform apps/receipt-gateway; do not fork (SEAM-011)."
+            exit 1
+          fi
+          echo "OK: emitter matches canonical sha256:$expected"
+
+      - name: inferenced emit-shim teeth
+        run: python modules/model-plane/inferenced_shim.py --selftest
+
+      - name: Canonical emitter self-test
+        run: python modules/model-plane/tools/inference_receipt_emitter.py --selftest
diff --git a/docs/model-plane/architecture.md b/docs/model-plane/architecture.md
new file mode 100644
index 0000000..a2d63d7
--- /dev/null
+++ b/docs/model-plane/architecture.md
@@ -0,0 +1,47 @@
+# Model Plane on source-os (Tranche 7)
+
+The Model Plane is source-os's tiered, on-device inference substrate: placement tiers
+**T0–T4** where a tier boundary *is* a data-residency boundary, with provenance receipts,
+consent-gated escalation, and governed distillation. The canonical contracts are owned by
+`SourceOS-Linux/sourceos-spec` (Tranche 7); source-os is a downstream **emitter**.
+
+## Status
+
+This directory currently ships the **emitter shim** for the serving path — the smallest
+real slice that proves source-os can emit a spec-conformant, hash-chained
+`InferenceReceipt` natively. The full daemon set is not yet built.
+
+| Slice | Item | State |
+|-------|------|-------|
+| T7-9  | `docs/model-plane/architecture.md` | this stub |
+| T7-10 | `profiles/model-plane/{constrained,standard,workstation,cluster-node}.nix` | not built |
+| T7-11 | `modules/modelplaned/` (catalog + residency) | not built |
+| T7-12 | `modules/inferenced/` (serving) | **emitter shim only** (`modules/model-plane/inferenced_shim.py`) |
+| T7-13 | `modules/embeddingd/` | not built |
+| T7-14 | `modules/visiond/` (no network namespace) | not built |
+| T7-15 | `modules/distilld/` (governed distillation) | not built |
+| T7-20 | `docs/seam-registry.md` — SEAM-014..017 | not built |
+
+Everything not built here is tracked in the T7 follow-up issue.
+
+## Receipt spine (SEAM-011)
+
+Every completion a serving daemon finishes must leave an `InferenceReceipt` in the estate's
+single **hash-chained** ledger — a local-only ledger is not permitted (SEAM-011). source-os
+**consumes** the canonical emitter (`prophet-platform apps/receipt-gateway`,
+vendored byte-verbatim under `modules/model-plane/tools/`); it does not re-implement the
+chain. `modules/model-plane/inferenced_shim.py` is the serving-path caller: given the
+content-addressed base-model digest and the input/output of a finished completion, it
+appends an on-device receipt via the vendored `emit_receipt()`.
+
+Teeth (`.github/workflows/model-plane-receipts.yml`): a produced receipt validates against
+`InferenceReceipt.schema.json` and chains (prevHash continuity); a tampered entry and a
+local-only (unchained) entry are both rejected; and the vendored emitter is asserted to
+match the canonical sha256 (consume-not-fork guard).
+
+## Off-device escalation
+
+An on-device (`on_device_only`) completion carries no lease and no escalation. A completion
+served off-device (`sovereign_cluster` / `external_permitted`) crosses a data boundary and
+must carry an authorizing capability lease and a non-empty escalation chain (SEAM-015);
+the schema enforces this. Off-device serving is out of scope for the emitter shim.
diff --git a/modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc b/modules/model-plane/__pycache__/inferenced_shim.cpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..c496b815e0bc02b1bc53fcce159d49ee67ecb586
GIT binary patch
literal 8886
zcmb_iZEPDydfp|MU&{}XA|+9>Wv?t*5@k`Jwv)<sY}r;U)!&v9$8=L>%^gal`IX(J
z9I@0v$sG_GXTUacXcY7gQGxrRzyhKI1)2j6sB<lPmrH<<kqj{#6>xj^C;g?Ib#Uun
zeP@<S(lT?+Azgv9JG1Z1yz{>A%skJmKDFCf3a-`eRP+~KiuxVSXqQQSpdT&K6!k78
zPytGy1zn7e>jF9&KkH-qfS%l$07LGEfPvhN0VCX*m?>@!m}yE!Av3bvgLd#0tyAxn
z>AhkmT3=bJJ_l^b5N&$4JlgzhnLtBdHOM9yGFFPxdc3DoC27i{>g^0TK|f2ZE?ys~
zk2eGw;@*Ha-WX_%HwBttY%YQQ5fj)USOwcpX$#aU{|U8%{YS>YPQfiWK&Dyn2sLou
zg?0<h>zx!OdO-sZ{C0uX$DY-&q*KuvZ_zXQRtmY=D6yGXs#Y*U&Gu(&E}P2Zz<mg2
zt*y7{8`K;6E7T3zSC{@dLs73q5@95wL<kA5aUu$#NJ{pjctnyS$pj}&MdDoN*`$DC
z+=UpQK;7Jg$R|Qmh<lFv&$*v)ASug8<fiyom`jGaiRb+N1HK-XodA(=Iu_%e>Oex`
zbR;p!2|S8J^PQ?V7m>I`Qs%CuBQcqq0(H2~h>T0G#gd`xNc6{e0VRgmQ51`v68Y2=
z7em4%bW7R`fmYXe3Hjqh&sZdc5)$;%&4ok+_2dX2lYBkg#1ynhMg(^m^cz1reCEu^
z_yj8=KE_G7B9!womlBiH2xOCKF@*d{i3{-wGE|P|q!bGIL&-!qDaQGP+zmsQru?BP
zK9WEJ``Vah&P%E-U*paVPmH}ha^?zmV+tjpflxA@iXj=BHylYsq$wl~aWGt&zYcw3
zy~2D*mOxTfOEno=G#T{9frb^0$dNeM3)cg!WEifW7X%SW5)vxSB19&U1nOcznU}72
zb9_R;IX03=rRCmaT85jCl=7(*N(j(Vf=ed+0-DB_DFz28CrKO77%!s^>8bG-{la#R
zj|`vn_x1M=fnzyvA|LZ76S0}%dmJDqk_jmtM}Ba;A8dJjh~ptzh#kRqy<qWVA_Day
z5|3@wJB`Fh7z&8tz=05wXc9DlF{lbngUU&8I9sY(iq1|snT$!jrBDwR#}X`tZ%=9l
zLTE-te(2>IbP?ymVlvJ`9Hgd@>`%pb8T*?9!$`f_EWy3s;AgbR3P)my1JmPJR>uJY
zpNxd?w1|K|lQ$B0*k{IuSdJ^HA_Q?nf&!f1UkvKQDPEp>0rKUb_N(55=;a3v92`1)
zaQ_r~;{~qj<@aOva))F5H59|m5dZp#dWXZfKy`Jg<lEGdP%JEin{h9##Fi4bk5l~s
zkqT2`CIRsy!w`wvxK7d~jH3L;$Fk@R2<|>EdHoRAk3&?QI3d)lRtocxSXxAfxB)IL
z@sp@mKsfkdMVjG|C?>@o_G`St`Dn$;Cm>o#1W4x~&s+dQDF)))O!LU4OG8{#g0O<+
zDbAA>C6a(Bje$lVfHbzi*LZ#R85HCAiP4d>!-}O8EQ$>WgBBTzQ8l$<C*z$7s=f(T
zuC)fp=qZYR^h<bnmy(OiG;CYNO{7v-#?s`98nvhLU7(kB+7hkZXDQjNNkqx!tL4;t
z)c$lH=dz`ZjHYCZ_P$!}vgA1B)1P}{NXudW^I#@3SUxGh6!e)C2Afkc#FD%qiMTn%
z0&9{Gl+hcq!j^5VcutCZSRUvb=<6SN8Ro3O%SlnOfg?iKgQ`EkUq<yw!iM6Ww8L_p
zjv=X+EZcaFB~W>amga@R2B)<aMZCBB;U^t~WRBXfyKV<=27YQ>_jcyJohuz{-l0|d
zp}7|~7{@x(nrB+qnZ7*Jw^F~xJilSBTeo)QtzAn8SFHm%X5bODK`HuBDh;|h@QRw2
zQBYm&LYgzN+pzJ8qhZs2%F$UWOJ{XieHLRHUDmLyzgKh_7?sIf9)XC06%<vhqTBZe
z4yFT4rQ%K?R4(kD+7bu50<0+7g6Qi}V9C}tZACZH51w-2wIWC?8C2H_g~7`J7KLG{
z9<!<wU(M9uO)erJF{th=ARmGGhLMtw76B4bKBHn(!(MEGthfg!tvG4J36_*_EUT-K
z*a(kG1DQnS-AS8IA~xM1uCW)AIcm#H*}Mg_Be!Spqqc&(dFfEW+qSg-zGKV8*o>PL
zV=#(4Kr#fs(pB=qZ^0{-6Hdc~vw+!VX&HQ_UQqxz+b>P_05z+Vi^vrwPHFlHI*bQr
z_2ua!=(Q<%l6v(jyklf+9&&;20lf-_Ec18N&vb%Oy#xL#PWM@ZT$-j?Dq5q}E8nvQ
zt#$1#(YN-?E=@u(<2D7$&-8MwRu=VWPv!eETgH5VORe~?Try*0D7itC2CXUW-Cx0C
zHEWzTWsOp2MX&a(36JQz_X&9UnLaDpbExfUW2C99K8hn|+a=U2J2jao4uEZ!=Dk_7
zT*CCxUE72pn>7nI+`QJ-tVPB#OfJEtm1ZqM?O`aBaa5BlTjCzL1^f>5#38%w65P>_
zZAFmHmT<P<&On}wrnnivf?U=9f(Pp<?yay@-T#}_>$Q<S8xh}gmNXP+$<s5zD>MpC
z717ViKFvy5R?}q`xKh?C>>$>)M)zqF<-4%6GIsyZ8D!O3*6vcJHJiVmHNpRQ$Jutl
zIB}#FeG6-eEo+PRZWDrRMP!w<RAWQawTfrHYn<%*ej}@hxZQt3oAOG;m8E7ptyDiH
z(KmqKU!iFDyF=gVQkmuUH@70+Qr=T!qAh7?g_=M}o*F9Atf#SMx5~*X@grbSjV-8L
zhOjomO-MP5_azZUkxHgyKAr+*DR97$#2J<5R5Fv!G|*Z?;(V$ICXAR<X>1J;uZT#a
zXNHfD0C7CYjbAx8F*-6ac7kwWfc+{171IfzMbOzH&<3bVkxl|uE-?}e@w*8`1&(#*
z%vlcV^khyI@jd@NuS|UjAQVYO4+d+oukp^Pm^EOZag`A~=onAQT&AvER319#W2!-b
zO#O?)V`o&CVIrn6#7qsRB0ZoU1iOhCCY<{kW2#KET8G#g_)Ib#1Dc9BA~(ck>d&99
zbn-qTH^hl}=M<epea({!tKykaAm9qkig+@n`yf$!P{oLi1tdchfQI<ULhTvzXmFT}
zgD$fdI#tE}z;!YAKto(Stx^qOnriKgvrJ@Fdn&Z7(7ZxlQ!FY_8b_}y4)yVZh^Db-
znf<CdMOMOxLMVk*;s0dtWroyRMYaVHv1&avmP>4#n@YxzFEa|mDXUtX14tMudZkR_
zMDAKro&tezS_1Bx;7W5qodOx(h2imWIGrfLO%lL<a)?4qM@aj%h>Uz*0?rk)jN&QG
zw3ONjcuI=AICC-rkpYBYM#OkbF~A8D9Nu6=s4&3qWyJ~&h(W^kB*l;tBMDj2OEVHM
z1{n~lC}IpHV$h?oQYsdaV{q6ai5L%wZk*U~g5jaU-VmWN72-0{WF(<5LL>yurIIOy
zNdmQ03`E3dS1cuBp%{yxnHEI6uPby!p+!ZPysqfu(j-tI+@YdF{R)GTw!#wo2JxAO
zLWd=+p9+JEsfvazL2asu7eL|#_(|_Wm=gT!+VPHUZmeK$0lH#wty|jimbNuZ`%=q>
ztL_f}PD5_TVBR%2Z`^Rz-+BFSz4OBx&W?h!eyM#WQ)up4dVMLB+cA(kemVEbmE7e(
z?%35WgU<CTJwLo<q@12RW9uGY-s4+pS@m>3sPS(&>vCRFYh`z?e)u!}=j<o!1Lt_5
z!TZ=nu^l-}`$JdbmV<J0i^e6(YVE*H)4Xo}#FsU$4Vx?H>0fDGsms+q_sh^fM}HB0
zU>hsAJ&zmJid#*T#gTKiFG`Cj=jdKD`!|i0t6|;A<(=G8N6yKuItSLBNAk`itInhI
zh9YfSFf8!znOE&C^SXZwe-v0fIJ!8n7|XW~Zn$?YTzcooykVZdX$F$8Zf?w*8yDK%
z_r2#^99eDZTAIi=^?!6KXKq|GpWLu|7wQ)qSFQV&hQF}(U~Owpem3~|&?iF=Y%gOq
z{Y5o<u$qnoYvzNGd!cA+KgHHov%5d<@`K%L+83wq*Z(F|7&vf$a7#}+N9lRy_jRDi
zJArxjqyELFrPKMA=L_cA+m4%#Ttml_XU*KRQR6PzzH8NUV6EmLQEBuu>GRAdnFqE2
zR;g(6&05OgxqbEK)dlzBjrpr<_TH8Lg3W&W)Xh^r8C!_1g8xqDJ$-Ao{>OUC(f9i*
zLp`_l(ktsP1@kWjAJ|^QP46g<b|)F_D{JN}kDKvmIm*E1*aK_K!GhKH_%aP;c}x3~
z$1l>*a?alS<gr_=`9yjd0`>2Q?WZaI$Gse+zw-7&`Y*M|2jKQ^b}LTz4?lOhQU9C$
zZb&~d?K*8Ye6n{Co`2h7h4fR(aGEuJYB!v&w|rV_!X=G{(|b%MUJX6KQF)P9e*yba
zC7-KyfKquxGD~OaXpv#zhO|r23(T@XLuJ4*s!JK=(h*GMN%^-(moWXewpZc|-zvfW
zSv^|+ENPoyUv@k-=F-8BW*1;4z(oYAsmzCTSzWbbA(1VkZH;S<Q^0F=QAfEo?J2AS
zcB+fwZF$=TZ!GYp#8}I(;SCFKsxVl1V}&<WzUzc_VZ%x4w*EE~(oa$$-K#J{!dvyT
zOqQ906PUZYTULgeHO%4?gV-aNxTW9}T-BIlnRgSOyHnG!8k=0ME!%g-U1pM?Z569P
zX%&k=X%%ZgX%$OEOMFz*3b>?axlY61P^*fSzC*3Ha(mj-a{ayHY?w8cttOY)Z4~d*
z+perpa4$D#Hqo@AsTpqwkbDSyFsr{o`5Mn<_EtcLF%3mrQa_ETP#<FnIDfMWND7JY
z@d?iQGpygQZJe;-19E^3T}&f<gb1HTu!LDVEr&8jo=KsMyUKZa#;6{KXKa<H;2HZ<
zN8lN!AHL_1!@uIE4iN_fG;9)3m`}%Ku^aN4o#cR-d>Ml;SR#5o4X_4qoHz;JZ!)@W
zj-Xr-9{`ros?SgjI2TXZ6k`M*bjt*}`sx%jw3XsTfESKoaS}d`B;*S?3n!`YT_Ff>
zNtueGSR#oFB@t6-f-nepDfg(I{t-N;o&MpBID~5)#mOO@U@A@k839>DJ%X+jgOHA=
zBzzPM9Zf4b9zYcCQlS$HJ*}9E<`74r0STX`J%xXmI1nlk;l}ZM94K&Ti@^?;w{SWC
z#G2)$x#I=K`1biX&)+$-v~%t}-kys2zx??G&UY2_IghWLxih-PG;4zAmOWUoN6VjI
zZo~QBQpNTagW9sye*4JHBMY7de&O1Jch$OQ?&L$0_3hcWW;bfQKmMDXx#{6<-_rgM
z4}EYbx9hpw(D~fOm)0*%<}Xg>{$i@I8+P~)8$W2w?HXK3+!ubG{5Y9A@N!{y&kD2N
zcP!s`EVpa;8-s4w33`jt)m)^%q44wFi8~h;=!Y+!x*z$2fpWSwN$K1vc#CC>l(}ZZ
zY|lBnmnJ^E^1+pr8>{}Kx$a{*hX&Hj<AoaMhIx0vY`bl}X<d}pJC5W#j@&=_>#>gk
zhBdr<^zPAhcX!_1y)v0|cdxo%D0sZ<p0>QFZQaw8_w;;Z%6WQLJ;w?SJJuVz@(o>E
z7RJ&&H@w9HB)HXfyX$5bsQCIC+p@;&0dVj?j~cOR<Z$<2J&seYM#UTqVqXS>KAmC|
zk(?G2nU;?77l58>9{@Uh4mBV#>?ctPs9qM;gXAe(hSxcfJmHl|eZuE@>eD2CItGbP
zC*o&C55xedXb_$=7R(&3LUXT@cVYy~wJ4@wP)LS?LHKMC45vX)6by<0FDUU9oDj-D
zLjC|`6%*#+vB))bO2HuU<bcX1_<ov<O(Vq!vka!8!i<hw8c`T5j%O{*Nm<nq|A&HN
z9m7mV9>Jfh)TxChl){eBNI-{1-~*V_SXv0RBXRBHBl)mG$O}1jSGf!!JosyeIx8`I
zAoB=2BEiS;ps*D_pvWn?$~Mf0)h{Y9h;P6vOtz)}f@D)q)ATothi3lRMbWLlqiVjQ
ztY1;=S5(cvQ{MkDS?5Q8_=9y*bKcavYTCVSYR{Y6=a>Sef7|?~`R$rFYwpl@2k*!W
zlXrix>TX}7IyM=G_I}0GJ!W;Z?vE5Ck61lDxap(@pZ~^Srj3QpeVclGA38$r54(Fe
zarwi;#~$JPqxyc@{%DGBqV1bQ6l0sue4%grlJ(r3SZIB}^S#b@{(6;d%Q0=6dWvcK
z@6F44%Iy9F^yB@KvE*3aivFM2e_$UlhoH)xi$C_~n1)RQynP~J8u;;E=6EmltKK~)
HT>Ae76v}|M

literal 0
HcmV?d00001

diff --git a/modules/model-plane/inferenced_shim.py b/modules/model-plane/inferenced_shim.py
new file mode 100755
index 0000000..9cf7e28
--- /dev/null
+++ b/modules/model-plane/inferenced_shim.py
@@ -0,0 +1,144 @@
+#!/usr/bin/env python3
+"""`inferenced` receipt-emission shim (Model Plane, Tranche 7 — emitter half of T7-12).
+
+The full `inferenced` serving daemon (T7-12) is not built here (it is blocker-laden:
+HellGraph ledger service, base-model licensing, credentials). This shim is the SMALLEST
+real slice that proves source-os can emit a spec-conformant, hash-chained
+`InferenceReceipt` NATIVELY when a completion finishes: it takes the facts a real serving
+daemon has at completion time (the content-addressed base-model digest, the task, and the
+input/output) and appends an on-device receipt to the estate's hash-chained ledger
+(SEAM-011: no local-only ledger).
+
+Consume-not-fork: all chaining/canonicalisation/verification is delegated to the vendored
+canonical emitter (tools/inference_receipt_emitter.py, byte-verbatim from
+prophet-platform apps/receipt-gateway). This file adds no chain logic of its own.
+
+CLI:
+  inferenced_shim.py --ledger <path> --base-model-digest sha256:<64hex> \
+                     --task <label> --input-file <f> --output-file <f>
+  inferenced_shim.py --selftest    # emits + verifies a synthetic chain (labelled synthetic)
+
+exit 0 ok; 1 conformance/chain failure; 2 usage/dependency error.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+import tempfile
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE / "tools"))
+
+try:
+    import jsonschema
+except ImportError:
+    print("ERR: jsonschema not installed", file=sys.stderr)
+    raise SystemExit(2)
+
+from inference_receipt_emitter import (  # noqa: E402
+    SCHEMA, canonical, emit_receipt, sha256, verify_ledger,
+)
+
+
+def _validator() -> "jsonschema.Draft202012Validator":
+    schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    jsonschema.Draft202012Validator.check_schema(schema)
+    return jsonschema.Draft202012Validator(schema)
+
+
+def emit_completion_receipt(ledger: Path, *, base_model_digest: str, task: str,
+                            input_text: str, output_text: str,
+                            compute_device: str = "cpu") -> dict:
+    """Emit one on-device InferenceReceipt for a finished completion (delegates to canonical)."""
+    return emit_receipt(
+        ledger, base_model_digest=base_model_digest, task=task,
+        input_text=input_text, output_text=output_text,
+        provider_daemon="inferenced", tier="T1", compute_device=compute_device,
+    )
+
+
+def _selftest() -> int:
+    """Teeth: emit a synthetic chain, prove conformance + chaining, and prove the chain
+    rejects a tampered entry and a local-only (unchained) entry. The completions are
+    LABELLED SYNTHETIC — no model runs here; this proves the emitter path, not an LLM run."""
+    validator = _validator()
+    digest = "sha256:" + "a" * 64
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "inference-ledger.jsonl"
+        for i in range(3):
+            r = emit_completion_receipt(
+                ledger, base_model_digest=digest, task="selftest",
+                input_text=f"synthetic prompt {i}", output_text=f"synthetic completion {i}")
+            if list(validator.iter_errors(r)):
+                print(f"FAIL: emitted receipt {i} schema-invalid", file=sys.stderr)
+                return 1
+        ok, msg = verify_ledger(ledger, validator)
+        if not ok:
+            print(f"FAIL: chain should be valid: {msg}", file=sys.stderr)
+            return 1
+        print(f"OK conformance+chain: {msg}")
+
+        # Tamper -> chain breaks.
+        lines = ledger.read_text(encoding="utf-8").splitlines()
+        e1 = json.loads(lines[1]); e1["outputHash"] = sha256("tampered")
+        lines[1] = canonical(e1)
+        ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        if verify_ledger(ledger, validator)[0]:
+            print("FAIL: tamper not detected — chain has no teeth", file=sys.stderr)
+            return 1
+        print("OK tamper-evidence: mutation detected")
+
+    # Local-only (unchained, seq>=1 without ledgerPrevHash) rejected by schema + verifier.
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "local-only.jsonl"
+        base = emit_completion_receipt(ledger, base_model_digest=digest, task="t",
+                                       input_text="a", output_text="b")
+        local_only = dict(base); local_only["ledgerSeq"] = 1
+        local_only.pop("ledgerPrevHash", None)
+        if not list(validator.iter_errors(local_only)):
+            print("FAIL: schema accepted a local-only (unchained) entry", file=sys.stderr)
+            return 1
+        with ledger.open("a", encoding="utf-8") as f:
+            f.write(canonical(local_only) + "\n")
+        if verify_ledger(ledger, validator)[0]:
+            print("FAIL: verifier accepted a local-only entry (SEAM-011 hole)", file=sys.stderr)
+            return 1
+        print("OK local-only rejected: schema + verifier both refuse an unchained entry")
+
+    print("PASS: inferenced emit-shim teeth all bite")
+    return 0
+
+
+def main(argv: list[str]) -> int:
+    ap = argparse.ArgumentParser(description="inferenced InferenceReceipt emit shim")
+    ap.add_argument("--selftest", action="store_true")
+    ap.add_argument("--ledger", type=Path)
+    ap.add_argument("--base-model-digest")
+    ap.add_argument("--task")
+    ap.add_argument("--input-file", type=Path)
+    ap.add_argument("--output-file", type=Path)
+    ap.add_argument("--compute-device", default="cpu")
+    args = ap.parse_args(argv[1:])
+
+    if args.selftest:
+        return _selftest()
+
+    missing = [n for n, v in (("--ledger", args.ledger), ("--base-model-digest", args.base_model_digest),
+                              ("--task", args.task), ("--input-file", args.input_file),
+                              ("--output-file", args.output_file)) if v is None]
+    if missing:
+        print(f"ERR: missing required args: {', '.join(missing)}", file=sys.stderr)
+        return 2
+    r = emit_completion_receipt(
+        args.ledger, base_model_digest=args.base_model_digest, task=args.task,
+        input_text=args.input_file.read_text(encoding="utf-8"),
+        output_text=args.output_file.read_text(encoding="utf-8"),
+        compute_device=args.compute_device)
+    print(json.dumps(r, indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))
diff --git a/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json b/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json
new file mode 100644
index 0000000..63a3716
--- /dev/null
+++ b/modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json
@@ -0,0 +1,361 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.srcos.ai/v2/InferenceReceipt.json",
+  "$comment": "VENDORED VERBATIM (do not edit) from SocioProphet/prophet-platform apps/receipt-gateway/schemas/model-plane/InferenceReceipt.schema.json @ commit abd98805, sha256:3d4c2a55070d65dbc902ba0880ea61c9ae6cbbca2b675c559a01a18a8b734499. Canonical owner: SourceOS-Linux/sourceos-spec (Tranche 7). Refresh via cp; do not diverge (SEAM-011).",
+  "title": "InferenceReceipt",
+  "description": "VENDORED from SourceOS-Linux/sourceos-spec (Tranche 7, canonical owner). Provenance receipt emitted for every model-plane completion (Tranche 7 / Model Plane). Identifies the tier, the content-addressed base model / adapter / tokenizer digests, the serving daemon and provider, the data-residency class the request was served under, and the escalation chain if any. This is the provenance primitive that makes on-device inference auditable: it references the existing Model Carry family (InferenceProvider, ModelResidency, SourceOSModelCarryRef) rather than restating it. Receipts are ledger-bound; a local-only ledger is not permitted (SEAM-011).",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "id",
+    "type",
+    "specVersion",
+    "issuedAt",
+    "providerDaemon",
+    "tier",
+    "baseModelDigest",
+    "task",
+    "inputHash",
+    "outputHash",
+    "dataResidencyClass",
+    "ledgerSeq"
+  ],
+  "properties": {
+    "id": {
+      "type": "string",
+      "pattern": "^urn:srcos:inference-receipt:",
+      "description": "Stable URN identifier. Pattern: urn:srcos:inference-receipt:<local-id>"
+    },
+    "type": {
+      "const": "InferenceReceipt",
+      "description": "Discriminator constant \u2014 always \"InferenceReceipt\"."
+    },
+    "specVersion": {
+      "type": "string",
+      "description": "Spec version of this document, e.g. \"2.1.0\"."
+    },
+    "issuedAt": {
+      "type": "string",
+      "format": "date-time",
+      "description": "Timestamp when the completion finished and the receipt was issued."
+    },
+    "requestingAgentRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:agent-passport:",
+      "description": "AgentPassport URN of the agent that requested the inference. Null only for internal system-initiated inference."
+    },
+    "requestingAgentClass": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "system_core",
+        "intelligence_automation",
+        "app_helper",
+        "legacy_bridge",
+        "third_party",
+        null
+      ],
+      "description": "Mirror of the requesting agent's AgentPassport.agent_class, for at-a-glance audit. Authoritative source is the referenced passport."
+    },
+    "capabilityLeaseRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:lease:",
+      "description": "AgentCapabilityLease URN authorizing this provider connection. Null is only valid for on_device_only T0 system inference; any non-on_device_only receipt MUST carry a lease (enforced below)."
+    },
+    "providerDaemon": {
+      "type": "string",
+      "enum": [
+        "inferenced",
+        "embeddingd",
+        "visiond",
+        "distilld"
+      ],
+      "description": "The model-plane serving daemon that produced this completion. Note: modelplaned is a catalog authority and does not perform inference, so it never emits an InferenceReceipt."
+    },
+    "providerRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:inference-provider:",
+      "description": "InferenceProvider URN backing the serving daemon."
+    },
+    "tier": {
+      "type": "string",
+      "enum": [
+        "T0",
+        "T1",
+        "T2",
+        "T3",
+        "T4"
+      ],
+      "description": "Placement tier that served the request. Tier boundaries are data-residency boundaries (Model Plane \u00a7II)."
+    },
+    "baseModelDigest": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the base model weights that served the request."
+    },
+    "adapterDigest": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the active LoRA adapter, or null when the base model served the request with no adapter."
+    },
+    "tokenizerDigest": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Content-addressed digest of the tokenizer used."
+    },
+    "modelCarryRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:model-carry-ref:",
+      "description": "SourceOSModelCarryRef URN under which the model was carried/authorized."
+    },
+    "modelResidencyRef": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^urn:srcos:model-residency:",
+      "description": "ModelResidency URN observed at serving time."
+    },
+    "task": {
+      "type": "string",
+      "description": "Task label the request was routed as, e.g. summarization, embedding, agent_classification, ocr-recognize."
+    },
+    "inputHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical input. The receipt records that an inference occurred and over what, not the content."
+    },
+    "inputTokenCount": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "Input token count, or null for non-text modalities."
+    },
+    "outputHash": {
+      "type": "string",
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical output."
+    },
+    "outputTokenCount": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "Output token count, or null for non-text modalities."
+    },
+    "confidence": {
+      "type": [
+        "number",
+        "null"
+      ],
+      "minimum": 0,
+      "maximum": 1,
+      "description": "Model-reported confidence used for the escalation trigger, or null when not estimated."
+    },
+    "confidenceMethod": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "logit-entropy",
+        "verbalized",
+        "calibration-head",
+        "downstream-validation",
+        "none",
+        null
+      ],
+      "description": "How `confidence` was derived. REVIEW HARDENING (Model Plane OQ1 / finding: confidence is the load-bearing escalation gate and is self-reported): recording the method makes the number auditable and lets downstream calibration checks run. A null method with a non-null confidence should be treated as uncalibrated."
+    },
+    "latencyMs": {
+      "type": [
+        "integer",
+        "null"
+      ],
+      "minimum": 0,
+      "description": "End-to-end serving latency in milliseconds."
+    },
+    "escalatedFrom": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "T0",
+        "T1",
+        "T2",
+        "T3",
+        null
+      ],
+      "description": "The tier this request was escalated FROM, or null if served at first placement. Must be null when dataResidencyClass is on_device_only (enforced below)."
+    },
+    "escalationChain": {
+      "type": "array",
+      "description": "Ordered EscalationDecision URNs recording each tier/residency boundary this request crossed. Empty when served at first placement.",
+      "items": {
+        "type": "string",
+        "pattern": "^urn:srcos:escalation-decision:"
+      }
+    },
+    "dataResidencyClass": {
+      "type": "string",
+      "enum": [
+        "on_device_only",
+        "sovereign_cluster",
+        "external_permitted"
+      ],
+      "description": "The residency class this completion was served under. Any class other than on_device_only means the input crossed a data boundary and MUST be accompanied by a lease and a non-empty escalation chain (enforced below; SEAM-015)."
+    },
+    "computeDevice": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "ane",
+        "gpu",
+        "cpu",
+        "npu",
+        "remote",
+        null
+      ],
+      "description": "Hardware path that executed the compute."
+    },
+    "ledgerSeq": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "Monotonic sequence number of this receipt in the append-only ledger."
+    },
+    "ledgerPrevHash": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "REVIEW HARDENING (finding: the ledger is the trust anchor for every Model Plane provenance claim but `ledgerSeq` alone does not bind entry N to N-1). Hash of the prior ledger entry, making the ledger tamper-evident/hash-chained so an enumerated contribution list cannot be retroactively rewritten."
+    },
+    "evidenceHash": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "pattern": "^sha256:[a-fA-F0-9]{64}$",
+      "description": "Hash of the canonical receipt evidence payload."
+    },
+    "evidenceRefs": {
+      "type": "array",
+      "description": "Additional evidence URNs or content hashes.",
+      "items": {
+        "type": "string"
+      }
+    }
+  },
+  "allOf": [
+    {
+      "$comment": "SEAM-015: a completion served off-device (not on_device_only) must carry both an authorizing capability lease and a non-empty escalation chain. Possession of the output is not authorization for the crossing.",
+      "if": {
+        "properties": {
+          "dataResidencyClass": {
+            "enum": [
+              "sovereign_cluster",
+              "external_permitted"
+            ]
+          }
+        },
+        "required": [
+          "dataResidencyClass"
+        ]
+      },
+      "then": {
+        "required": [
+          "capabilityLeaseRef",
+          "escalatedFrom",
+          "escalationChain"
+        ],
+        "properties": {
+          "capabilityLeaseRef": {
+            "type": "string"
+          },
+          "escalatedFrom": {
+            "type": "string",
+            "enum": [
+              "T0",
+              "T1",
+              "T2",
+              "T3"
+            ]
+          },
+          "escalationChain": {
+            "minItems": 1
+          }
+        }
+      }
+    },
+    {
+      "$comment": "An on_device_only completion cannot have been escalated from a lower tier.",
+      "if": {
+        "properties": {
+          "dataResidencyClass": {
+            "const": "on_device_only"
+          }
+        },
+        "required": [
+          "dataResidencyClass"
+        ]
+      },
+      "then": {
+        "properties": {
+          "escalatedFrom": {
+            "const": null
+          }
+        }
+      }
+    },
+    {
+      "$comment": "REVIEW HARDENING (ledger tamper-evidence): any non-genesis entry (ledgerSeq >= 1) must carry the prior entry's hash, so the append-only ledger is hash-chained and an enumerated contribution list cannot be retroactively rewritten.",
+      "if": {
+        "properties": {
+          "ledgerSeq": {
+            "minimum": 1
+          }
+        },
+        "required": [
+          "ledgerSeq"
+        ]
+      },
+      "then": {
+        "required": [
+          "ledgerPrevHash"
+        ],
+        "properties": {
+          "ledgerPrevHash": {
+            "type": "string"
+          }
+        }
+      }
+    }
+  ]
+}
diff --git a/modules/model-plane/tools/VENDOR.md b/modules/model-plane/tools/VENDOR.md
new file mode 100644
index 0000000..7430b65
--- /dev/null
+++ b/modules/model-plane/tools/VENDOR.md
@@ -0,0 +1,27 @@
+# Vendored: InferenceReceipt emitter
+
+`inference_receipt_emitter.py` in this directory is **vendored byte-verbatim** (do not
+edit) from the canonical emitter:
+
+- Source: `SocioProphet/prophet-platform` — `apps/receipt-gateway/tools/inference_receipt_emitter.py`
+- Pinned commit: `abd98805`
+- Source sha256: `6881246b8e41a515fb1b29df645faeb9be17d8195d22a7e0d5ce15f8477d8e6a`
+- Canonical owner of the schema: `SourceOS-Linux/sourceos-spec` (Tranche 7 / Model Plane)
+
+`schemas/model-plane/InferenceReceipt.schema.json` is likewise vendored verbatim (its
+`$comment` records the same provenance).
+
+**Consume-not-fork (SEAM-011):** the hash-chain, canonical-JSON, and ledger logic are
+consumed unchanged so this repo's receipts share one estate spine with the
+receipt-gateway. Refresh by re-copying from prophet-platform; do not diverge. The only
+source-os-specific code is `inferenced_shim.py`, which calls `emit_receipt()` — it does
+not re-implement any chaining.
+
+Refresh command:
+
+```sh
+cp <prophet-platform>/apps/receipt-gateway/tools/inference_receipt_emitter.py \
+   modules/model-plane/tools/inference_receipt_emitter.py
+cp <prophet-platform>/apps/receipt-gateway/schemas/model-plane/InferenceReceipt.schema.json \
+   modules/model-plane/schemas/model-plane/InferenceReceipt.schema.json  # then re-add $comment
+```
diff --git a/modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc b/modules/model-plane/tools/__pycache__/inference_receipt_emitter.cpython-312.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..7508040b14748ab1b0af7ee4d3bbb9866cf47cda
GIT binary patch
literal 10650
zcmcIqYj7Lab>0OQZ;$}^7DZ9Zmq=J7#g{0FdYK|AiF!~rNhuL63kI=E5g;Da?m`q1
z(4ieQrV_QHYfnVga?Ld9l&+PUo@OSRsei<Y6Q|SZbRp0sy=JCv<LT7@;K;2VWv0_}
z?qUIuR+@IEU5R(^-p9G;o_p^(-#Hh5mzQUy;Q6!0$-wt2DC$@Ep*<!wLqGUenxbw|
z95q65G^Y#FA>D|M#=JhLAJLOHGs2L!VZ;D$CTI+qMogrQA!rVnN6aD1h=qI`gVvC3
z#70vVm4bc5p3dcu<m)Kj#uvN+<KYviSKqnm8|jZgLvE>>=d4>GGg8bKbGDd`qBuKA
z^DrGL0otWn?~yXDoXfw)jBMeyat?Txa}}Hu-di~rSHS7HLcWYI<BIMWEx_lO|8d*6
z;%ml{3a*kXfnM9V?OZ9mD>;@cgZFlx<+e-!he8>QS_OaGc|)N0%N%Pn)!xt3)A|~U
z&#R>b14v6hVn0van4hAq>d#YCbh^e(Q$W$dnSdtyWtw-*Z|Kxg(#{a5{&E}6qK!yX
zFv8o~2=1!rF+D}~hsSt<5BvB*-pBhVC6*8QC5ac<o$R<*9B=ZCd;MXaV}m?*2}&CT
zKHZ-6hbDu3h!0C%$sY;3o2}O2algpIe`%c0kP-bH&ql^b+35(!2iYfr-Z0<APL1<n
z)*EL18Uw5^f)piQY-IfsJ0<ub%X+P%Z=4T#n|zV*SVRbU!&2i$&b~AQDS~vplaqXy
zYl?(}(;4Q6`npdywY0W&S;G-F81Z?7x%K-AlVrkd$U6ap0~?YzG|3B1{1uo-SaLVB
z!!S8PmDR4aP(ohcI0#9Yw!-8G`?^oT_#7+p!Lg=EA#w%gISw-3&rbOTfA|ui3M{fg
z{}rAM5t%^0NSJ4Vp&$$FKZA?lNssajNcQ-dfxe+(_Q;vD1HIjY=et;q|8##L8W!0G
zD4gQ`m&PTLofLQx`E6uHAlKA{%z!whXITC!FZlc-%np{xs;%~vUm9n9LEb9_r<;P_
zQ9cNBW5ww(G?M&2ZEawoVI0XTPO#M)$!ZWvzXT(~Og9pRA};EK!tB~<qJxD65y3J=
z!=plEf)6)tk~FKX!@tbF%nqCx241}q>;-}M2H8`mPUrB$Mtr`gAn;r>`$WVamNp5G
z#eOg<^g|9|6$O+q&RZ=_OIZXd^H-s;g^f(?XIt5WS+0HjE|r@xuRj>Ym289RsOY@}
z`&<wrLbLS~Ja}$ev3bMch<YN#0r)m>{N*U`)+uJrD}f|Kykf>Q2FnfA%oAQ|JhrWG
zaIlLFh#*|D*I{)fI2WP>+kxj^hh}5`ApZ#-^-oY=Dkim^7_*V>(=>@kDps-iBs8nd
znvt?Et!R-?$_RgO_UQ*f$bh=1rA%!gtx&L;_Qa`xLCa^~oK90L+B=XoBiS|-rK#Z<
z6b?~t{Xonlj(gj7cXmBAM5VE&y>3P^p{5D?M-`)5r5HgW!MRW@<NQ_5e+l+2$ch$4
z<dS{Z36qWnd2v_H<abGtNKo9BQ6}2q@uW9+^W?PPgx)0C2^kTM$}F{JD|&hA*0V1@
zyXgIk@$Zf=O(l2iNtW(iEj^MbJ(4W#P1t&6ruPA~r8Y<q<v}Fa2ANyb?~@-GO5I)k
z8_)wEkOMO?44Z;(ROl{vTf~SUc_#R2QL&2rq*w4t5kZ6s2A2*tQ8Y9uf(Z1H(SRxh
zp$O<G7N0j93Hw292$k@?3;x7nNM@;Zo8xBJ^{#o};_z}{#nvq|-2&EZm;?g_WD?gP
zbBlsy&TIoHNIx8{EiX+;=?Q?n)m?-3y_x0Z^miG}7R}IcS}2n;TPA?pZPOE{IT|gv
zMtg|j3?LR`?DQ$GD8T^;H;uxkp3qb`=rUot5sxIC3OM8;J`@qA*#>gF8baQyK|Xx2
z)y;wqg7Xb38c&S7S-{=AVa_;%cHH_$AajzU$-JK~r6}b3QS;X}ut?u1iqqerZ_zY$
zV+%t~Q$Ns8(XZ3wl#7z!pM>?&HMb~C5Nv^n1G8*;nGRgy!~E4r;ZUs76NLGB$aI<y
z5ECRGYR=SmLN5{J@^91^vy|-G{oU4ujwR+z>+9AZ*k7*wZtHJEGt@p`yq#V!ZKnkr
ze89dissb2*v&4uzKOx}C3R@vj48e$(!>vS*DU1aAYXfJt9Cide79bi*+y}`l^$}xu
z;plTm=UT7zuiKmn<R$6aeb2jMdwjO{gX$eOI>-*=7Fu7tl(bdKOv@6Sl@_wi6l>-r
za*A%aRnhw<qi&<(&~&he^TG;-fh9jLC{77YfIr3y9`(2@`3MH067S)_^7?qi<qyNB
zhqUwfBGIs<6hxxZrn1aRBhp1>M0WSbkdoaE1)HBhW=Cgh;IPtnb=q#G@myr~a!xBf
z$J{k&t#(s0HYu~upR1KJsxW{Hw&{uIv<(nczOjKu6_K-)r`5%6+G&}w$L)eSZs$z6
zS2!~&*D%dlX7c<LXXR{h-7A2I<9V-8uQD&uTppJXse^Mu>XIB9y#Ol2O^;Nd6$DVj
zY<jfu18`n8KU@aO!zhJu1EfW9Bc#P~8q$)u3DVNI4$?9S*(Oh1uhE3^EpdxfuGK^-
zVT-g)`-<xW+qHc5t({GcMwpIUfKGW1eMYN;@~v^}@1)QC59wQhP6f9O(n=0zxBU_Y
zDH}IKYKrIi=|87u^5c1&dEx>b!O|=zQkBMc+^+GYz2o^@)d8rE+X6LOtL!_cXTH{h
ztHw3gzF?2q0(IFQT27M>XzuLZtovW=%^e!0>^paFaz^}@Es5t3Q8oWBV@*+--%>-h
zQX)MCUg>$z-Zb@f7*q9`+%>WP>?Ww6fN3xxs`6kr<01rrXd@os;4}g#l%fK-B@zHa
z7M?-g%Qd0m1dmAdDWD&Y0?-w~Bw$$nsxKH75zTwKD}J!$;BiEJ69~P*U=ef*CM%6Z
zL_!q|H-bFD>*E3G0Y6-HG6;rT;?ovyh`-E6fI6$f<1`#@5W#^6@=e4!5?Js|SYk@R
z`$Aq3Q<wlgK$)nR0nUP{iA=<F-km}|tRNssGeK5BWI(Z~-U|#w%m^`+iq6l)Dq#Ly
zqTq{&T^TLjl!nP&3f%-sdwP;roSVg}*u+WRca9fCa1&yNw&qr_hGxGgMtQDViWStI
zZ>kG5)p5gh$GhrIchwDzDEXQ_=q2VrXaO!2$Ea82PorPdOR%5f$e4$80T?oILa`8=
za2&9s;vm^!v?4vkI9OHVKq{STKBu+-z_@piN8dE;o9+RVEGqetaN5{-&}UTgcoA?F
zEC_d0h=deJ`V*$sgD$a>m$p#7s)5Q^rTK)wUm=6iR(FwNRM$c=geEw@pfC~GHi}`)
z7nXwX!absxPMzsF>FN6_vAzP@8ATtCObK{i6@66lDP{l{W9Tyw?5Y?&X9tG*h7~;^
z9>pNSu8|1%Qw(HNAl)cPM5TLn!0k|sDr<@h<?11zIc;WzUK|B%HL;`oRY|dFMio8;
z#FJ!6gjUQU)D;jQ2pyQXAyF7`G_NRnk-w~%G*1c*4DQC9N5w&QJOUar7sjAj7yO9_
z04vQ>sRGJid*SqRr&pQM1XH@mEJ-p`y25m<SsXXFUf()Dym)MG>x!junFcr_+bY)W
zuA3*XpIo5t?0)Uw?Sm_JcS^@vn%4^}7cReaXs-8zrq=n61zV!9cJcE4!iMF`b3G|t
zacTaVvq&!MSRP(JdavqU&%NDpNq0&Q<sUgq<g&+72FRw2l&f-KDrLgFnR0EtbNsba
zw@=+Id$Z#8ieyFSYQ^D1#bNpJ;bg_xlm#1EDOc6vu9OY)cFI+{z@+jppHI1}<(iI^
z13#SPqdn!qj{>z-A?AxHSH+!kizkxXcBP83pd4EsI<qo#K5^*$_uCg^tMz*l^?Q=_
z`&MeYWY1)3E4HejT-)x9Ek2d3Y)x&$f=bF&BR@X4a_&On@eAMYS+cD*>`OH4OE&CZ
zsXZW%N~!JGiltn2@{Z0_6@FAxE_SgfRfG9j7<I8NRfqW<SYDZ`$9w~@w=ndn8}f6<
zQjL_eaNhf^s~<PE{czvC;lDndZ0wmg$z=@*r+dwwck|fwV=wnFTuK)0SSm^sHLcj2
z)1^21KXw$!4tCvHe9QKtZK3;4^tGAWGw(Z_K0iiN)~3{Pnz9$p4t(*MfpQi<vSCV3
zIjbIi-k00_p;!yM=&hZ{>h$ky>#aGuTlaGcKYqTu=~%Vly=pz=->Wkm+hy`0DAyhf
zWB~lp4?c#{-{t&h22?bm2N$ORQ0c~WLjcPF6g~<%q8pTUq8<erHF~|&O`T77iSp^5
z2Cr;J7uWrFzB6$>bT8^|lrq$een!VpGX}|~O(YAUda0*>Kv5T9J~PG{Q!aE2p!(nR
z#7!EfGiIq!s{|(q{lraA+^n_b%-5*97R}_(SmG983&_S8Hv;6e#x0x;v0b2K69M={
zFggaarosP>n>jnSiyJ5QfGR1>P{`A2fLcDG>3G$Y>1E`c1Xk_MfmP_`kSA`?c+}oA
z*0?#4fsk4|0L(6}MchipcV@;fh{G5$faEZ~<5fduWb=&S#+wYq6-pTxnw2}WEmHRd
z&d#Ts(M=%?$^d@|@w#R(Xl{rz>JIYh&O?xWhIy6&$CtdP=q$jI>>96+g6Kf4giupu
zZXz^^WHp+qj5pJD7Y`hb6{xm=M3~0FQgU4^fd;}}7&2C*!4kkcX&lnU#vmF4&Nmw?
z!q_gNmMh+%pJPu9of+t2GcFghj3)wi68)eNGPzL^I4!wn58J|{t-=r`AUMW&M-U(j
z7!`<$VZ?{e4R)9h1ihhA&U+}f9h`js*tAETOO6|zZg3Tdi73Na>TT}Ft?zZd)A@Fg
z_@x*_fiO$V#ipam{xF#gNCEj1&>qDc2n=&zSj@&YfcMV(01L1R?N;H^05*k)1cHGy
zNb5>>(m()Pb&z1p233H=u{J=LB+4#!X$<6qMt5d{p*hIZ?SyC;0y$B!KopbnNNA?5
z#O{+ogHR2OD5f(*eHe*UEPOZ$PyuiY@&5%3b14p7t6m;sYHBMZ2Ap_Ku|bSo@Q@g$
zsF*^$h%rqyP=)~|MSqExgb~QOZGs02EJR!wo>FMQFoXj|4**#3VKwa+P#G&UfE}PJ
zBJU_T5w+Eq@Ic;%brhb1HWTnCz6}}_Lvya12d^Kzad-`^M%iOaol6aJNxST5m(A@d
zo!-#CR#ClL(U_=cT)re%G$tz!tyc6WD*9I{P9~k_6BQ@tFaP55KTQ4Y)Zb74u}iKv
zIcJca=fSeuowL2`g%t~D|FN*<x@nG{>i}w&$LV!v(JkwX)`gCwlb!4S%t$#)=KZTB
zI};^4m%5WB&54c^D~^+M%m+5dT4CA3(Z$xq8o91>S-RK#*3^%_{?^y!&SP@<ak=pL
zef#k>n|<!7>xUMeyl<<_v|jWqKe_z1w=T*Zy+1xFKk?)*M0s#XE+3W)hws~mq02n|
zt<Lr0t#|qtxmV64iyP;Tt~s1Hqt~Nyab41}V`;~IN6T7i#iDWX@}f_6pOw#jMgHpf
z#JThG*%5i<DY^23TzcWY^8)m`&ZM?cMYRA4?9P{a77Q<)m_HzIe^Pc0%C<q78T`$!
z>nYa={l&Vi;MWul!bBlAE)6a9$t7*FqwRfj+iz2PsQB$?cFI|_>ZnOLYM><uDl;Fs
zZr{C{d&P43VY%?|s{Jr_fcl5xAgto;>RvbXH^sfR%sVay(_$SIytA{o&!~I1)&Ti;
z-IhMR{@pfX?;-uWduhxcGC=w>V`1Me!_T%@`W`d<teVFBV+KfZhh-j&nt-~YA6$bJ
zL)aV@q-Js=lmRBwHj~ME!2vY?n;sIPO&f1bHO<gcCO#9$sO4<OKqi`!EsN(yOfzQs
zQN6P*!KgDcdQg+DEFCTPMmhsACML&FXMhH0z*|p%1R28(K6!c`013(v4oI1ZP23RI
zb0*G=#`RSlXHnmGt#71bToBzXXQ-@!h4z_P7=ae18FSnuHb@!63-Km1(vsj-S$zVi
zJT^Ud?HXtx_rYNHI4WB*otHx|U!|wb0iqj*-?v_Ys!hYerzW=<OEzx(s9gb|B@e-f
zHr|X?s?n%%4y`n9<(wF!kuq_XxHVG;6iEEW@Thxi&J{pkY10$W+{<z<jOCEsmo}0R
zugONp9w~pJE=OJk|7Vgf+$?!qr48#uZ;roA)9L6-(ST}05o)S%;#m5o$Lk&CIyioG
zti`u?tYz=sy{-G&+Q-^_ZM(;OEn^(db8Q_R?YrCdwEEgc+xdNMz7FqLd*_~(4*187
z`eOF9rN`Tl;3sh4De#KZH<~f0mct9a5ZqwLiZUhXD`jxnSvMm*gPiqZ;>BbXl9=OY
zcmFAJSBux9fCCV<5epx)pE;=oZMs;vwj(#eJSQB(7H1%d?t^4gf3+34v*h3|n_vdK
z#8hzt0t>jMm3Uqnk3I&yVTcVk%s#jo4@K1rM0NuKcQLTQhbHl2BgeEGhkB0po$eMU
zftX^=-XSVQy@Gd4YHMk0X>B`)fQ=Y!J6tgOCOj(oQ3{5EU_|f=)4hH`CScX41q@s(
z2EiK!Ab>79G0Tc!60WW#aP;Ad$|y<@_!5N6SW7O|2v)F?_=Ad1m;hYG0%rIo5;Ll!
z3De{w9pI-q0w{zTEYw9N6n#j%Bz%p0@vV=>3l@*Iu)+c~`~&zCzXytLmimw>T+ege
z9JxMn$G8ffXj#K@J$R(avaV#_{@J7JO#UiUlVECAnU)08vRtyl>|J-3uR3=noV%8d
zN#~x~en1BKU!iA@u322GmfD1+cEz$|scPL-Jnwy}bm36K<(@OHyGrISf2VA&d);2P
zP_o?lW9!<E&gIL?KDo9_K5<d@JR@K9%Ew3lLr>>%G&rjT<$xm!*+t`$C0Wo0XhS#G
z^MS(!p^N!5i#?0G<pTE)^*^${Wqseif32|Sa~EZ;mn}O!E1)d-^Y(?Ig+4jIdc|A=
zv58eDn{cvA^|F&qI@?yA2NTYNN$24?Lwe#1h6V3!b26`LPWQvHdn3ut<BM&J!9-0v
zVx7U44$c|oyw}Z(J65aP6V>g@y+7)ItN$LK1SldUI!?;xo|dcISE?_r7i{0itt}6@
zl?zU<41Z;H_+n!C;`??FvRad7wH8>Fon80Z@72lqkFS`!Kd*xth#%PVKCjnu55;m=
ztam!P>yCEne_DN{171Jho{wp#;pk!01}_2)H!<y~7B_kkn!@F1;s+MQL2aU@<n-hx
zIM%G9*OdPdmA#1Mm>d9*@y?)o`pI7B(9|^THVz1A`&DIN&HjcW)=aMcyRtuB(PCOT
zx6N#}Jy9uc1HsW`;|hO>Wd8`0n~;E0!gz&CS8|;lCIoJU@Cwv^5B@|9y}_lf$vW5Z
zjp_OB=bv4uUATO^e(}Qn^44`n*|)zYo6FZ3i)`(BxA494cgo*qP63=$uj0%e4-)fu
zKm($i4~JM16r&pF7G8xCs6a1SVK~1}68;pjYO#*wV>T>i<Lm(bW}!$uwx}gkeToEB
zrAl%{vyvRDS3*aPBa$+V@2X|3kc(M?lQdy9x=0!k23~`Dw=rih)E=>_`mBa)ew2c%
zS6OyS5KiZx8igMPz%O7V;c2%z7ex<R45s@hNX&xH=2KX!&Uq1stWiuJ4;S%yJc`xh
z8H>VY0Ppb#XmbR_daCNhwNq@q2>d?7hrfOj)f-oYP-^5BqVN*_q=BeYVTd&EM_nrs
z2TYj5mSh{?4ghBfetM$7N}+a#p&^zkMuOlT;f1im44yeNEWChOBm4pYh7`_Y|BUWc
zgU1<dt!^^hJV-L^4IxSE(6k8lqYnlm(|?^J+e3}anh&VIsW>G374!m?N{NRd1w2pF
zpE7wg^Y4`uUGpm{|3k|5A!Yp~we6p%`d?CIDMnAbK4hFJGebK+WQsqvQfB+y@ozl4
zYTA}CZA+TAubS!;rurp1VR~$qS+nHLTN0Kn3#Stnx7>IlVL35t{AY{f+hw!H2S%Fi
zqaT=Q`Us>9-3sB-{l{o|_^WFz9lz*Xt8w2O`_$A-7p_%SrS$mj*rUD&o+R&&YMN38
zDF5haKY4>fKS2-B53tXJQM!~Kq91f@rSl#fVCXyu%rf@5*nRz$53EHm4lmTa)^NMw
zrHe^xt<2Pd;%3UfNIlI^=0b3JXxEzE`FtM=!}VK;^kSioc7A~8&AqIuZ)X1*W1sDL
z;rMgM=brrL$&>*aJQUG2|4Zh`Zt6{@M@Ri+x9P}X{Z9_jkp5J+v!_M>(_J*A{{<yK
BN@)N9

literal 0
HcmV?d00001

diff --git a/modules/model-plane/tools/inference_receipt_emitter.py b/modules/model-plane/tools/inference_receipt_emitter.py
new file mode 100755
index 0000000..ee420ef
--- /dev/null
+++ b/modules/model-plane/tools/inference_receipt_emitter.py
@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""InferenceReceipt emitter + hash-chained ledger (reference implementation).
+
+This is the emitter side of the Model Plane: when an inference completes, it writes a
+schema-conformant, hash-chained InferenceReceipt to an append-only ledger (SEAM-011:
+no local-only ledger; the chain makes it tamper-evident). The receipt/ledger machinery
+is REAL and self-proven here; wiring it to a live model is one call to `emit_receipt`.
+
+HONEST BOUNDARY: no local model runs (no weights present), so `--selftest` exercises the
+emitter with clearly-labelled synthetic completions (task "selftest"). It proves the
+emitter produces conformant receipts and an unbroken, tamper-evident chain — NOT that a
+real LLM completion occurred. Point `emit_receipt` at a real provider to emit real receipts.
+
+exit 0 ok; 1 = conformance/chain failure; 2 = usage error.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from collections import deque
+from datetime import datetime, timezone
+from pathlib import Path
+
+try:
+    import fcntl  # POSIX advisory locking (Linux/macOS)
+except ImportError:  # pragma: no cover
+    fcntl = None
+
+try:
+    import jsonschema
+except ImportError:
+    print("ERR: jsonschema not installed", file=sys.stderr)
+    sys.exit(2)
+
+ROOT = Path(__file__).resolve().parents[1]
+SCHEMA = ROOT / "schemas" / "model-plane" / "InferenceReceipt.schema.json"
+
+_UNSET = object()  # distinguishes "estimate it" from an explicit None (record null)
+
+
+def sha256(s: str) -> str:
+    return "sha256:" + hashlib.sha256(s.encode("utf-8")).hexdigest()
+
+
+def canonical(obj: dict) -> str:
+    return json.dumps(obj, sort_keys=True, separators=(",", ":"))
+
+
+def _last_entry(f) -> dict | None:
+    """Last non-blank ledger entry, constant memory (deque(maxlen=1) over the file)."""
+    f.seek(0)
+    tail = deque((line for line in f if line.strip()), maxlen=1)
+    return json.loads(tail[0]) if tail else None
+
+
+def emit_receipt(ledger: Path, *, base_model_digest: str, task: str, input_text: str,
+                 output_text: str, provider_daemon: str = "inferenced", tier: str = "T1",
+                 tokenizer_digest: str | None = None, compute_device: str = "cpu",
+                 input_token_count=_UNSET, output_token_count=_UNSET) -> dict:
+    """Append one on-device InferenceReceipt to the hash-chained ledger, return it.
+
+    Read-tail + append happen under an exclusive advisory lock so concurrent emitters
+    cannot race into duplicate ledgerSeq or a broken chain (single-writer per entry).
+    """
+    ledger.parent.mkdir(parents=True, exist_ok=True)
+    with ledger.open("a+", encoding="utf-8") as f:
+        if fcntl is not None:
+            fcntl.flock(f, fcntl.LOCK_EX)
+        try:
+            prev = _last_entry(f)
+            seq = (prev["ledgerSeq"] + 1) if prev else 0
+            receipt = {
+                "id": f"urn:srcos:inference-receipt:{task}-{seq}",
+                "type": "InferenceReceipt",
+                "specVersion": "2.1.0",
+                "issuedAt": datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+                "providerDaemon": provider_daemon,
+                "tier": tier,
+                "baseModelDigest": base_model_digest,
+                "tokenizerDigest": tokenizer_digest,
+                "task": task,
+                "inputHash": sha256(input_text),
+                # real provider token counts when supplied; explicit None -> null (e.g.
+                # embeddings have no output tokens); _UNSET -> a whitespace estimate.
+                "inputTokenCount": len(input_text.split()) if input_token_count is _UNSET else input_token_count,
+                "outputHash": sha256(output_text),
+                "outputTokenCount": len(output_text.split()) if output_token_count is _UNSET else output_token_count,
+                "dataResidencyClass": "on_device_only",
+                "escalatedFrom": None,
+                "escalationChain": [],
+                "computeDevice": compute_device,
+                "ledgerSeq": seq,
+            }
+            if seq >= 1:
+                # hash-chain: bind this entry to the canonical prior entry (SEAM-011)
+                receipt["ledgerPrevHash"] = sha256(canonical(prev))
+            f.write(canonical(receipt) + "\n")
+            f.flush()
+        finally:
+            if fcntl is not None:
+                fcntl.flock(f, fcntl.LOCK_UN)
+    return receipt
+
+
+def verify_ledger(ledger: Path, validator: "jsonschema.Draft202012Validator") -> tuple[bool, str]:
+    if not ledger.exists():
+        return False, f"ledger not found: {ledger}"
+    try:
+        lines = [l for l in ledger.read_text(encoding="utf-8").splitlines() if l.strip()]
+    except OSError as exc:
+        return False, f"cannot read ledger: {exc}"
+    prev = None
+    for i, line in enumerate(lines):
+        try:
+            r = json.loads(line)
+        except json.JSONDecodeError as exc:
+            return False, f"entry {i} is not valid JSON: {exc}"
+        errs = sorted(validator.iter_errors(r), key=lambda e: list(e.path))
+        if errs:
+            return False, f"entry {i} schema-invalid: {errs[0].message}"
+        if r["ledgerSeq"] != i:
+            return False, f"entry {i} has ledgerSeq {r['ledgerSeq']} (expected {i})"
+        if i >= 1:
+            expect = sha256(canonical(prev))
+            if r.get("ledgerPrevHash") != expect:
+                return False, f"entry {i} chain broken: ledgerPrevHash != hash(entry {i-1})"
+        prev = r
+    return True, f"{len(lines)} receipts: schema-conformant + unbroken hash-chain"
+
+
+def _selftest() -> int:
+    import tempfile
+    schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    jsonschema.Draft202012Validator.check_schema(schema)
+    validator = jsonschema.Draft202012Validator(schema)
+    # A REAL model content-address (from the local ollama manifest); the completion is
+    # synthetic self-test data — no model is run here.
+    digest = "sha256:aabd4debf0c8f08881923f2c25fc0fdeed24435271c2b3e92c4af36704040dbc"
+    with tempfile.TemporaryDirectory() as d:
+        ledger = Path(d) / "ledger.jsonl"
+        for i in range(3):
+            emit_receipt(ledger, base_model_digest=digest, task="selftest",
+                         input_text=f"selftest prompt {i}", output_text=f"selftest completion {i}")
+        ok, msg = verify_ledger(ledger, validator)
+        if not ok:
+            print(f"FAIL selftest: {msg}", file=sys.stderr)
+            return 1
+        print(f"OK emitter: {msg}")
+        # Tamper-evidence (teeth both ways): mutate entry 1, chain must break.
+        lines = ledger.read_text(encoding="utf-8").splitlines()
+        e1 = json.loads(lines[1]); e1["outputHash"] = sha256("tampered")
+        lines[1] = canonical(e1); ledger.write_text("\n".join(lines) + "\n", encoding="utf-8")
+        ok, msg = verify_ledger(ledger, validator)
+        if ok:
+            print("FAIL selftest: tamper NOT detected — chain has no teeth", file=sys.stderr)
+            return 1
+        print(f"OK tamper-evidence: mutation detected — {msg}")
+    return 0
+
+
+def main(argv: list[str]) -> int:
+    if len(argv) >= 2 and argv[1] == "--selftest":
+        return _selftest()
+    print("usage: inference_receipt_emitter.py --selftest", file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main(sys.argv))