17. Conformance
The specification and its published machine artifacts define MMP conformance. SYM, Swift, xmesh-core and third-party software are implementations of that contract. No implementation is the standard, and sharing source with a reference implementation is neither required nor sufficient for conformance.
Receiver autonomy means conforming cognitive nodes may reach different admission decisions. It does not permit private wire bytes, unverifiable identity, unsigned actions, partial CMB storage or hidden-state exchange.
17.1 Core Secure participant
A Core Secure participant MUST:
- hold a persistent Ed25519 identity and a canonical nodeId;
- complete the authenticated §5.2 transcript and prove possession of both identity and X25519 private keys;
- negotiate protocol version, room and extensions without silent fallback;
- construct all seven CAT7 categories and the §8.2.1 cognition key;
- authenticate author nodeId, audience, lineage and application bytes with §8.8
mmp-sig-v2.0; - use the §18.2.1 directional HKDF/ChaChaPoly envelope and exact ordered sequence;
- validate schemas, cryptographic bytes, audience and replay state before application exposure;
- reject Core Secure downgrade to an unsigned, one-frame-handshake or legacy-suite path.
17.2 Cognitive node
A cognitive node satisfies every Core Secure obligation and implements receiver-autonomous memory admission. It evaluates all seven categories, records per-category evidence, aggregates under its local policy and admits or refuses the immutable CMB as one whole record.
- hidden neural or model state MUST NOT cross the wire;
- foreign embedding vectors MUST NOT control admission; receivers encode from signed text;
- admitted peer cognition is stored as the receiver’s remix with walkable lineage;
- admission attestations expose the observable decision and per-category evidence;
- directed delivery is distinct from memory admission and carries verification/admission state;
- private learned policies MAY vary, but MUST NOT weaken public identity, integrity, audit or receiver-autonomy invariants.
SYM is an open transparent baseline. xmesh-core is a proprietary cognition runtime targeting this profile. Both are measured at the same public boundary; neither may substitute private conformance bytes, and neither is conformant merely because it is maintained by the specification author.
17.3 Legacy Import profile
Legacy Import exists only to read retained history or perform an explicit reader-first migration. It is not Core Secure and MUST NOT be selected through negotiation failure. A host MUST expose the profile and verification limitations to its operator. Legacy network admission is removed after the declared migration window; offline store import may remain.
17.4 Executable testing
A conforming implementation MUST consume the public files, reproduce their expected values and reject the negative mutations. Generating private vectors from the implementation under test proves only self-consistency and MUST NOT be reported as MMP conformance.
Signature bytes are the one exception, and a suite MUST NOT assert equality on them.
A pinned expectedSignature exists so an implementation can prove it
accepts a known-good signature over the given payload and key. Ed25519 is deterministic in
RFC 8032, and Node, Chromium and Firefox each reproduce the published bytes on every call — but
WebKit ships a hedged signer, so Safari, and therefore every browser on iOS, returns a different
valid signature each time it signs. Signing a pinned payload and comparing the result is not a
conformance test; it fails on a conforming implementation and reads as a browser defect. To exercise
signing, sign the same payload twice, assert that both verify, and assert nothing about whether they
are equal.
A browser implementation cannot sign at all outside a secure context, and
the boundary is not where testing puts it. crypto.subtle is
exposed only in secure contexts. https://,
file:// and http://localhost
qualify; http:// to a LAN address such as
http://192.168.1.10 does not. So a browser node signs
correctly throughout development on localhost and loses the capability entirely the moment it is served
to the machine next to it — not degraded, absent: there is no signer to call. Every record it emits
is therefore unsigned, and §8.3 authenticity is unreachable for that deployment however correct its
code.
Two requirements follow, and the second is the one that gets skipped. Such a deployment MUST NOT be reported as MMP-conformant, because the property under test cannot be exercised there. And a run in that environment MUST label the branch it took, in its own report, on every run rather than only on the runs that degrade — a marker that appears only in the unsigned case teaches a reader to read its absence as the signed case, which is the same mistake as reading an unasked question as an answered one. An implementation measured on 2026-09-16 does this correctly, emitting an explicit unsigned-branch marker on every run so that no measurement taken there can later be cited as evidence about signing.
| Artifact | Required proof |
|---|---|
| application-v2 | canonical bytes, length, digest and presence commitment |
| record-signature-v2 | category keys, Merkle address, assertion identity and Ed25519 signature |
| handshake-v2 | transcript, proofs, X25519 confirmation and HKDF outputs |
| e2e-v2 | directional keys, counter nonces, AAD, ciphertext and authentication failures |
| v2 wire examples | schema-valid, signed transport, feedback-dismissal and feedback-directive CMB frames |
Cognitive profiles SHOULD additionally consume the public baseline SVAF and tether vectors, and MUST test whole-record admission, signed freshness, lineage and audit outcomes.
17.5 Release gate
- A clean-room verifier passes without importing SYM or xmesh-core.
- Every published example frame validates against its published schema.
- Node and Swift implementations reproduce identical transcript and AEAD bytes, and each accepts the other's signatures. Signature bytes are not compared: Apple's CryptoKit signs Ed25519 with added randomness, so a correct Swift implementation returns different valid bytes on every call and byte equality is not a release criterion.
- Packaged release artifacts run the corpus from a clean install.
- xmesh-core passes the public boundary corpus without disclosing private internals.
- The website build generates and verifies its own canonical artifacts before producing the published Pages output.
Each item above names a check that is executed, not an assurance, and says who runs it. The website's own verifiers run on every build. The packaged-artifact check runs at publish. The clean-room verifier and the boundary corpus are invoked by hand: the boundary corpus was last recorded as run on 1 August 2026 and has not been run for the releases since, so its standing is that date and not this page. A criterion with no runnable check behind it does not belong here — the byte-equality claim between implementations was corrected on 14 September 2026, after measurement showed no implementation could meet it.
17.6 Implementation status
This informative snapshot records evidence as of 13 August 2026; it does not weaken or replace any normative requirement above. The canonical website reproduces every published v2.0 byte vector, validates every registered frame schema and checks every rendered specification route. SYM emits direct-parent-only record lineage and its local transitive provenance index is derived only from locally verified parents. Its complete Core Secure reader-first handshake, sealed envelope and emitter migration remain in progress. xmesh-core conformance is not claimed until its public boundary run passes the same corpus. The inactivity archiver and source-novel forwarding remain implementation work unless a release reports their specific conformance tests.
17.7 Independent implementation
An independent implementation is a first-class target. It can emit, receive, authenticate and encrypt MMP records from this specification and public corpus alone. A full cognitive engine is optional; an emitter or verifier need not implement SVAF, a memory store or an LLM.