AFI-Protocol · Gio2050 · Jul 19, 2026 · Jul 19, 2026 · Jul 19, 2026 · Jul 19, 2026
diff --git a/AFI_Full_Architecture.md b/AFI_Full_Architecture.md
diff --git a/ARCHITECTURE_STATUS.md b/ARCHITECTURE_STATUS.md
@@ -1,6 +1,6 @@
 # AFI Protocol — Architecture Status
 
-**Last updated:** 2026-07-18  
+**Last updated:** 2026-07-19  
 **Purpose:** Orchestration-focused status snapshot of how AFI scoring is implemented today. The organization-wide current-state map is [AFI_Full_Architecture.md](AFI_Full_Architecture.md).
 
 ---
@@ -27,11 +27,20 @@
   instantiation, manifest validation, and canonical (timestamp-free) hashing.
   Nothing the Factory emits is canonical until validated against the delegated
   `afi-config` contracts.
-- **Evidence**: the Reactor constructs `afi.scored-signal-evidence.v2` records
-  carrying a thin `afi.composition-ref.v1` composition reference (pipeline
-  identity, analyst-config hash, scorer and plugin-set references, hash-addressed
-  execution summaries); `afi-infra` validates and persists them at the sole
-  canonical persistence interface.
+- **Evidence**: the Reactor constructs `afi.scored-signal-evidence.v3` records —
+  the sole current canonical evidence contract — carrying a thin
+  `afi.composition-ref.v1` composition reference (pipeline identity,
+  analyst-config hash, scorer and plugin-set references, hash-addressed
+  execution summaries), exactly five credential-safe per-lane provider
+  invocation proofs (`afi.provider-invocation-proof.v1`, unique by category,
+  deterministically ordered; the `aiMl` proof nests the Tiny Brains invocation
+  proof `afi.aiml-invocation-proof.v1`), and record-level
+  `recordHash`/`replayHash` commitments; `afi-infra` validates, hash-verifies,
+  and persists them at the sole canonical persistence interface.
+- **Evaluation completeness**: a scored evaluation requires all five category
+  lanes to succeed (EV3-GOV) — every lane node in the registered manifest is
+  fail-fast, and a failed lane yields no scored evaluation, no scored signal,
+  and no evidence record (bounded operational diagnostics only).
 
 Implementation lives under:
 
@@ -53,7 +62,7 @@ Implementation lives under:
 | Graph orchestration | `afi-reactor/src/pipeline/` |
 | Pipeline authoring (templates, validation, hashing) | `afi-factory` |
 | Validators, scoring, decay | `afi-core` |
-| Schemas & registries (USS, `afi.pipeline.v1` family, evidence v2) | `afi-config/schemas/`, `afi-config/registries/` |
+| Schemas & registries (USS, `afi.pipeline.v1` family, evidence v3) | `afi-config/schemas/`, `afi-config/registries/` |
 | Canonical evidence store | `afi-infra` |
 | On-chain mint | `afi-token` |
 | Off-chain mint coordination | `afi-mint` |
@@ -75,7 +84,7 @@ Implementation lives under:
 | Registered strategy | An analyst-strategy registry entry binding a pipeline, scorer, UWR profile, and decay configuration (`afi-config/registries/analyst-strategies/`) |
 | Analysis category | One of the five canonical categories: `technical`, `pattern`, `sentiment`, `news`, `aiMl` |
 | Scorer terminal | The exactly-one scoring node terminating a valid pipeline; performs the sole `VALIDATED → SCORED` transition |
-| Composition reference | The thin `afi.composition-ref.v1` object carried on `afi.scored-signal-evidence.v2`, binding evidence to the executed composition by canonical hashes |
+| Composition reference | The thin `afi.composition-ref.v1` object carried on `afi.scored-signal-evidence.v3`, binding evidence to the executed composition by canonical hashes |
 | District 1 — Signal Evaluation | The **active** Signal Evaluation capability and authority domain (`district-one-signal-evaluation-capability-v0.1`, D1CAP-GOV): canonical input → five-category enrichment → deterministic join → analyst/scorer/UWR seam → District-2 handoff. Its current implementation is the live GraphExecutor pipeline (`afi-reactor/src/pipeline/`); implementations may be replaced through accepted authority without retiring the district |
 | District 2 — Evidence & Provenance | The active canonical data & provenance boundary: receives the scored evaluation result from District 1 and owns evidence construction, validation, and the canonical persistence handoff. Live law in `afi-reactor/src/evidence/provenance/` |
 | Pipehead | The bounded stage discipline of the Pipehead Addendum (one node → one validated category result → merge → one scorer seam), implemented today by the live pipeline nodes. District 1's former non-production Pipehead POC implementation was retired and deleted by Mission A (DSC-GOV) — an implementation retirement only, not a District retirement (D1CAP-GOV); git history preserves the former implementation |
diff --git a/scripts/check_stale_refs.py b/scripts/check_stale_refs.py
@@ -36,7 +36,7 @@
     ),
     "reactor_scored_signals_v1": (
         "Reactor-owned Mongo collection behind the removed writer; superseded by the "
-        "canonical afi.scored-signal-evidence.v2 evidence store (MongoDB "
+        "canonical afi.scored-signal-evidence.v3 evidence store (MongoDB "
         "'scored_signal_evidence') owned by afi-infra."
     ),
 }

diff --git a/specs/AFI_ANALYST_SHOP_MVP.md b/specs/AFI_ANALYST_SHOP_MVP.md
@@ -42,7 +42,7 @@ flowchart TB
     ID[Provider onboarding\nproviderId + beneficiary]
     ING[Ingest\nTelegram / TV / API → USS/CPJ]
     RX[afi-reactor\nenrich → UWR score → qualify\n→ submit evidence]
-    TSSD[(afi-infra canonical store\nafi.scored-signal-evidence.v1)]
+    TSSD[(afi-infra canonical store\nafi.scored-signal-evidence.v3)]
     MINT[afi-mint → Base Sepolia]
   end
   subgraph optional["Optional — Storefront & visibility"]
@@ -79,7 +79,7 @@ flowchart TB
 | A1 | Register as provider | `providerId`, API key, beneficiary address form | No |
 | A2 | Choose ingest source | Template: TradingView webhook URL, Telegram bot token, or REST | No |
 | A3 | Send test signal | USS/CPJ validation errors surfaced clearly | No |
-| A4 | Confirm scored | Canonical scored-signal evidence record (`afi.scored-signal-evidence.v1`) persisted by afi-infra, lifecycleState=SCORED | No |
+| A4 | Confirm scored | Canonical scored-signal evidence record (`afi.scored-signal-evidence.v3`) persisted by afi-infra, lifecycleState=SCORED | No |
 | A5 | Confirm mint (testnet) | `MintCoordinated` on Base Sepolia + stage=MINTED in TSSD record | No |
 
 **Done = shop is operational.** Analyst can mint-attributed signals on testnet.

diff --git a/specs/AFI_PROVIDER_BYOK_FOUNDATIONS.v0.1.md b/specs/AFI_PROVIDER_BYOK_FOUNDATIONS.v0.1.md
@@ -1,6 +1,6 @@
 # AFI Provider Adapter and BYOK Foundations v0.1
 
-**Status:** v0.1 foundation record of the provider-neutral adapter socket and secure bring-your-own-key (BYOK) credential boundary. Governed by `afi-governance/decisions/provider-byok-foundations-v0.1.md` (PBF-GOV). Documents the Wave-1 foundation delivered across `afi-config`, `afi-factory`, and `afi-reactor` on the existing configurable executor and Evidence V2. The activation of this foundation as the sole live enrichment-execution seam for all five categories is recorded by `afi-governance/decisions/five-lane-provider-runtime-v0.1.md` (FLPR-GOV) and reflected in `AFI_Full_Architecture.md`; this record intentionally describes the v0.1 foundation itself.
+**Status:** v0.1 foundation record of the provider-neutral adapter socket and secure bring-your-own-key (BYOK) credential boundary. Governed by `afi-governance/decisions/provider-byok-foundations-v0.1.md` (PBF-GOV). Documents the Wave-1 foundation delivered across `afi-config`, `afi-factory`, and `afi-reactor` on the existing configurable executor and the canonical evidence contract. The activation of this foundation as the sole live enrichment-execution seam for all five categories is recorded by `afi-governance/decisions/five-lane-provider-runtime-v0.1.md` (FLPR-GOV) and reflected in `AFI_Full_Architecture.md`; this record intentionally describes the v0.1 foundation itself.
 
 This foundation establishes the provider **socket** and the credential **boundary**. It does not complete all commercial provider integrations, and it deploys nothing.
 
@@ -44,9 +44,9 @@ Every boundary fails closed. The **SecretResolver** resolves only the exact auth
 
 Secret resolution occurs only at runtime, at the adapter edge. Factory cannot resolve secrets. Adapters receive only scoped credentials. Logs, errors, traces, canonical hashes, and Evidence exclude credentials (structural closure plus a redaction boundary). Deployment-specific secret backends (for example GCP Secret Manager) are pending a later staging wave; this foundation provisions none.
 
-## 6. Evidence V2 freeze
+## 6. Evidence and invocation provenance
 
-Evidence V2 (`afi.scored-signal-evidence.v2`) is unchanged: schema, semantics, canonical Mongo record shape, store version pin, and lifecycle status are all identical. The versioned pipeline composition may commit to a non-secret ProviderInstance reference through its existing artifact hash, but no provider credential, provider-invocation object, or new collection is persisted. Detailed provider/model **invocation provenance** is deferred to a later governed evidence decision that will determine Evidence V3 after real adapters reveal the true provenance fields. Evidence V2 does not contain provider-invocation provenance.
+The canonical scored-signal evidence contract is **`afi.scored-signal-evidence.v3`** (EV3-GOV, `afi-governance/decisions/evidence-v3-provider-provenance-v0.1.md` — the governed evidence decision this foundation reserved invocation provenance to). Every V3 record carries exactly five closed, credential-safe per-lane provider invocation proofs cryptographically bound to the scored result, plus record-level `recordHash`/`replayHash` commitments. Each proof records non-secret identity facts only — Provider, ProviderInstance, adapter, and the credential binding (explicit keyless posture or an opaque CredentialRef) — with normalized invocation input/output hashes; no provider credential, raw provider payload, or secret enters evidence. The versioned pipeline composition commits to a non-secret ProviderInstance reference through its existing artifact hash. This v0.1 foundation record establishes the socket and boundary those proofs describe.
 
 ## 7. Scoring, UWR, Tiny Brains
 

diff --git a/specs/AFI_RESEARCH_INSTITUTE_REFERENCE_SERVICES.v0.1.md b/specs/AFI_RESEARCH_INSTITUTE_REFERENCE_SERVICES.v0.1.md
@@ -231,7 +231,7 @@ content is not automatically written on-chain and is not automatically published
 
 The Institute is an operator, researcher, publisher, and service provider — not a
 protocol authority. Governance, config, and math retain their authority; the Gateway
-remains routes-not-writes; the Reactor constructs Evidence V2 and does not become a
+remains routes-not-writes; the Reactor constructs Evidence V3 and does not become a
 general external trust gateway; `afi-infra` remains the sole canonical writer;
 `afi-factory` authors pipeline artifacts and is not the ingress operator. The Institute
 being the MIT copyright holder of record across the organization's licenses is an

diff --git a/specs/AFI_REWARDS_VAULT_AND_CLAIMS.md b/specs/AFI_REWARDS_VAULT_AND_CLAIMS.md
@@ -40,7 +40,7 @@ The word "vault" is overloaded in the AFI codebase and recon. This spec is bound
 | Object | Custodies | Layer / role | Defined by | Reward authority? |
 |--------|-----------|--------------|------------|-------------------|
 | **RewardsVault** | **Reward tokens** (the per-epoch reward budget) | Layer 4 — this document | this spec | Pays **only** against committed `claimRoot`; **never mints**, **never decides** |
-| **Canonical evidence store** (`afi.scored-signal-evidence.v2`, carrying a composition reference per afi-governance `decisions/factory-configurable-pipelines-v1.md`; `VaultedSignalRecord`) | **Data** (scored-signal evidence and lifecycle records) | Layer 1 support; off-chain (MongoDB) | doctrine §7; `afi-infra/src/evidence/*`, `afi-infra/src/tssd/*` | **None.** Holds zero tokens. Unchanged by Settlement v1. |
+| **Canonical evidence store** (`afi.scored-signal-evidence.v3`, carrying a composition reference per afi-governance `decisions/factory-configurable-pipelines-v1.md` and per-lane provider invocation proofs per `decisions/evidence-v3-provider-provenance-v0.1.md`; `VaultedSignalRecord`) | **Data** (scored-signal evidence and lifecycle records) | Layer 1 support; off-chain (MongoDB) | doctrine §7; `afi-infra/src/evidence/*`, `afi-infra/src/tssd/*` | **None.** Holds zero tokens. Unchanged by Settlement v1. |
 | **xERC20 bridge lockbox** (`XERC20Lockbox`) | **Canonical AFI for bridging** (mint/burn xAFI, rate-limited) | Token posture (doctrine §10) | doctrine §10; `afi-xerc20/.../XERC20Lockbox.sol` | **None for rewards.** Bridge custody only. |
 
 **Naming MUST rules:**