spec: seed the 4.3 cycle with the covenant seal's carriage repair (#80)

[dhh1128]

Seeds the 4.3 cycle with a repair for finding #80. No ratified bytes are altered — this adds one unpinned seed document under spec/, in the shape PR #26 established. tools/verify_kernel.py passes 7/7.

Addresses #80 without closing it. R17.1 ruled the carriage this seed replaces, so the discharge is a superseding ruling and not this merge; the seed is that ruling's input. #80 closes when the drafting authority disposes of it.

Where the finding came from

Samuel Smith told Daniel on a call, 2026-08-18, that Custos uses KERI's type seals in the wrong way — the type field distinguishes how a seal's digest is derived, not what the seal means. The remark is oral, paraphrased, and Sam has not reviewed either the issue or this seed. The three limbs below are this repository's own work against published bytes, verified 2026-08-18 against upstream main: KERI spec 71cb54e, CESR spec 7a6adca, keripy 7da1e64a1.

The three limbs

The seal types the wrong axis. t answers "what procedure verifies this digest." The hash algorithm is already carried by the CESR code of d; t carries the derivation above it, and the substrate's only worked example is the Merkle-tree family, where the type decides how an inclusion proof is checked (spec-body.md:515). The covenant seal's d is an ordinary SAID of a clause set, derived the ordinary way — nothing about its derivation for t to say. Under the substrate's own reading the honest value names an ordinary digest, which makes the typed seal a digest seal with a decorative field.

The implementation reads t as a protocol identifier. keripy types the field as a Verser (structing.py:67-71, "t = type of digest as (Verser)"; coring.py:2451), a protocol-plus-version primitive whose four-character head is drawn from Protocols = Protocolage(keri="KERI", acdc="ACDC") (kering.py:21). A Custos value there is an application to join the substrate's protocol table — larger than allocating a seal type, and still not commitment semantics.

There is no type table to reserve in. This is the limb that falsifies committed text. §17 L3214-3219 places the reserved value "in a namespace of the same kind" as the CESR genus, "the typed seal structure's type table, externally stewarded." The two are not of a kind. CESR's genus namespace is specified, sized and built for other protocol stacks (spec-body.md:607, :615). The seal-type namespace has no table: CSMT occurs zero times in the CESR spec, and in the KERI spec only as an illustrative value at :518/:520. What CESR registers is the count code that frames the couple (:933) — the frame is allocated, the namespace it frames is not. §17 states a recognition question with no addressee.

The repair

Move the type off the seal and onto the artifact the seal commits to.

The substrate's own precedent is exact. A credential issuance is anchored by an untyped event seal (vdr/eventing.py:337); whether the anchored act is a registry inception, an issuance or a revocation is read off the anchored event's type field (vcp, iss, rev — kering.py:360). Nobody proposed a revocation seal type, because the seal was never where the kind was written.

So: the covenant is committed as an event of a Custos-defined type in the domain's designated governance event log, anchored by an ordinary source or event seal. This standard is better positioned for that shape than the substrate is — the sealed set is already clause identifiers into the designated GEL, and R15 already makes which registry that is a committed fact. The type then lives in a table this standard stewards: no reservation, no recognition question, no dependency on another project's custodians. The absorption KN-14 asked for becomes real, not because a value was reserved in someone else's namespace but because nothing needed to be.

Layers 2 and 3 of R17's split are untouched and deliberately not restated. §17's seal-type sentence is struck, leaving the genus reservation standing on its own terms (disposed at #45).

The naming discipline, and the one real cost

§10's discipline — consumers must not infer commitment semantics from context — is preserved one dereference out: the committed event names its kind in a field a consumer reads after resolving the seal. Not a weakening. A consumer that cannot resolve the event holds no clause set, no law head and no candidate successor, so it has nothing to fold; the class losing wire-visible discrimination is exactly the class that could never have acted on it.

The cost is confessed rather than argued away: a consumer holding the seal alone can no longer tell the commitment is a covenant.

One apparent cost is a gain. §10 claimed a typed seal with a reserved value lets "a governance-blind consumer parse the seal unharmed." The opposite is nearer the truth — an ordinary source seal is parsed by every conforming implementation, while an unrecognized type value is precisely what a fail-loud parser is entitled to reject, which §17 elsewhere praises the substrate for doing. The colorless base is better served by the ordinary seal.

What the seed leaves open

The covenant event's type value is not minted here. The repair moves the naming problem rather than dissolving it, and minting the value would legislate a decision surface the encoding round owns — the same reason R17's own seed declined to name a reserved seal type. It routes to #57.

R17's digest-precedence station obligation must be re-expressed in the governance-event form, or the corpus meant to discriminate against this defect will encode it.

Relates to #77 (the 4.3 docket — this is founding-input material), #57, #45.