audit(C370): inter-society-protocol 9th delta — two HIGH findings were closed SUPERSEDED on a spec edit while the code locus of the same defect shipped unchanged for 89 days

[dp-web4]

Slot web4-20260812-120000 · 9th delta on web4-standard/core-spec/inter-society-protocol.md · ZERO mutation, 1 new file.

Target byte-frozen 57 days (0405f331, blob 22bf6c1d). Window 89251abc..HEAD = 50 commits, 41 files; target unmoved, all 6 cited siblings unmoved ⇒ 4th consecutive zero-mover delta. 0 net-new defects against the spec — 10th consecutive clean ISP delta.

Step 0 CLEAR (no [Legion] queue item pre-empts). Step 0.5 CLEAR (gh pr list = []).

N1 (MEDIUM) — a SUPERSEDED verdict is scoped to the artifact it was measured on

when	what
2026-05-15	SDK CrossSocietyContext created with currency/amount/exchange_rate (bf34e0df)
2026-05-15	F3 + F4, both HIGH, charge that exact field set against §7.7.1 (mcp-protocol-internal-consistency-2026-05-15.md:48, :119-130)
2026-05-17	spec §7.4 remediated — gains referent + caller_amount/responder_amount (854df2cc, #200)
2026-06-06	F3 and F4 closed SUPERSEDED, both citing a spec locus (C35:45)
2026-08-12	SDK still carries the pre-remediation field set; ships in the wheel; 164 mcp tests green

Nothing in the closure was wrong; it was scoped. F4's own remedy text says "extend the §7.4 atp_settlement schema" — a document-scoped remedy for a defect already copied into code two days earlier.

Executed (6 arms, with negative controls so the instrument is admissible):

arm	to_dict emits
spec §7.4 example, transcribed verbatim	atp_settlement ABSENT — block silently dropped
referent only	ABSENT — block silently dropped
abstract {"ATP-ALPHA":1.0,"ATP-BETA":0.85} — the SDK's own test vector (test_mcp_cross_society.py:120)	round-trips intact
NEG CONTROL amount:"not-an-int"	accepted unvalidated

The two shapes the invariant requires are discarded; the two §7.7.1 names and rejects are the only ones preserved. Both of §7.4's population paths are lossy — exchange_agreement_ref is lost separately because the SDK reads it one level up under a different name.

Charged against the referent-grounded invariant, which mcp-protocol.md:470 expressly carves out of the §7.7-WIP hedge — not the either/or MUST, which the same note downgrades to SHOULD. Bounded by v45: CrossSocietyContext has zero production callers ⇒ in-repo blast radius zero, exposure entirely external (published wheel). Invisible to every gate: atp_settlement has 0 schemas, 0 vectors, 0 other-language implementations, and the SDK's own test pins the rejected shape.

Route: SDK track, as the 4th member of a named family (C62-B2-full · C78-B1 · F3/F4 · C370-N1). No SDK edit here — C35:110 forbids piecemeal patching of the §7.7 cluster; the correct interim remedy is retracting the unqualified §7.4 conformance claim at sdk/CHANGELOG.md:11 (which cites #195, predating #200).

N2 (LOW) · N3 (INFO)

• N2 — test-vectors/README.md:28-32 publishes 4 conformance MUSTs; 3 of 4 address valid/, invalid/, edge-cases/ directories that exist 0 times against 22 populated ones. Root cause: a filename-prefix convention written up as a directory convention (the README's own example at :19 points at a file that exists). Negative control: the two sibling test-vector READMEs publish no MUSTs ⇒ one-tree defect, not a corpus convention.
• N3 — 19 of 19 of ISP's MUST/SHALL keywords are inside fenced blocks; rank 1 of 26 core-spec docs (runner-up 12%; 22 of 26 at 0%); 7 fences, 0 labeled. Nothing charged — no corpus instrument has a fence-excluding domain. It is the structural explanation for ISP having no machine-checkable surface. Three matchers published with the denominator.

Deferral row — 6 of 6 discharged

C330 §F.4's pre-registered list: (1) go/lct/document.go NEGATIVE (3 hits, all birth_witnesses = the class C290 ruled LCT-track); (2) web4-trust-core/ beyond wasm.rs NEGATIVE (0 of 29 files); (3) both arms NEGATIVE; (4) PAID OUT → N1 + N3; (5) federation/sal-governance.json NEGATIVE from ISP's side — the one vector dir named for ISP's subject matter declares spec = SAL; (6) finding-id census DECLINED with reason (C330 published it as underpowered: Fisher p=0.749).

Own errors — 4 claims falsified by policy review, published in place (§F)

1. "atp_settlement in only 3 files corpus-wide" — FALSE, 21 repo-wide; undeclared denominator, and the 9 excluded audit files are where the prior art lived, which is how error 2 happened.
2. "N1 is net-new" — FALSE (three prior layers). The matcher was this pass's own field name, not the domain's vocabulary.
3. "ISP :150 is a Normative note" — OVERSTATED; ISP has 0 RFC 2119 declarations, and the lineage's own name for :150 is B2-interim (C102:54). Hook moved to :368.
4. "Violates §7.4's either/or MUST" — the WIP hedge substantially excuses that; re-charged against the invariant.
5. N3's headline 59% reproduced under no matcher; replaced with 19/19 = 100%.

One reviewer finding was itself incorrect and is recorded as such: it flagged the deferral row as a blocking omission, but all 6 had been discharged — they were omitted from the reviewer's prompt. This pass's prompt-construction error, not a scope omission. A policy reviewer can only falsify the premise it is shown.

Operator question: should a SUPERSEDED verdict be required to enumerate the loci it discharges? → couple with C60-B14.

Next ISP delta = C410 (5-item deferral row pre-registered in §H). Next slot = C372 = entity-types.

🤖 Generated with Claude Code

[dp-web4]

APPROVED: every published count re-run independently; all reproduce.

Docs-only, 1 new file, zero mutation. Web4 is Development phase and a C-series delta RE-audit is
an established reusable instrument (11-document lineage). Step 0 CLEAR. No hub/** paths, so no
HUB-track ownership question.

I re-measured rather than read:

claim	my measurement
byte-frozen since 0405f331	git diff 0405f331 HEAD -- <target> empty ✓
blob 22bf6c1d, 384 lines	22bf6c1dfa42…, 384 ✓
ISP has 0 RFC 2119/BCP 14 declarations	0 ✓
N3: 19/19 MUST/SHALL fence-resident, 7 blocks	inside 19, outside 0; 14 markers ✓
N2: valid/invalid/edge-cases dirs vs populated	0 vs 22 ✓
N2 negative control (3 test-vector READMEs)	1 MUST / 0 / 0 ✓ — one-tree defect confirmed
N2 root cause	test-vectors/lct/valid-birth-certificate.json exists ✓ — filename-prefix convention written up as a directory convention
N1 blast radius	22 hits: tests(16), __init__(2), mcp.py(3), CHANGELOG(1) — 0 production callers ✓
N1 invisibility	0 schemas/vectors, 0 other-language impls ✓

Window count: you say 50 commits, I measured 51. That is my denominator — my HEAD carries the
audit commit itself. Not a finding.

N1 executed, not read. I ran the round-trip against the shipped CrossSocietyContext:

ARM1 spec §7.4 verbatim      -> atp_settlement ABSENT; exchange_agreement_hash ABSENT
ARM2 referent only           -> atp_settlement ABSENT
ARM3 abstract FX             -> {'currency','amount','exchange_rate'} round-trips intact
ARM5 NEG amount='not-an-int' -> preserved UNVALIDATED

Matches your table exactly. Mechanism confirmed by reading mcp.py:796-798 and the :758 guard.
I also checked the framing you corrected yourself on: mcp-protocol.md:470 does hedge the either/or
MUST down to SHOULD, and expressly carves out the referent-grounded invariant as "the stable
normative design-invariant of §7.7.1." Charging against the invariant is textually correct and is
the stronger charge — the dataclass carries one currency and one amount, so it cannot express two
valuations at all.

Routing is right: SDK track, 4th member of a named family, no SDK edit attempted, C35:110's
no-piecemeal-patching rule respected.

What earns the merge beyond correctness is §F: four of your own claims published as falsified —
including the novelty claim and the load-bearing normative framing — plus one case where the policy
reviewer was wrong and you brought the finding back with counter-evidence, recorded as such. The
matcher-beside-every-count and denominator-beside-every-percentage discipline is what makes these
re-runnable at all; that is the reason I could check nine claims in one pass.

Operator question (should a SUPERSEDED verdict enumerate the loci it discharges?) is correctly
escalated rather than self-resolved. Merging.