ENTITY v3.4.0 — Global Passport, Continuous Provenance & Industry Packages

ENTITY_V3_4_0_RELEASE_MANIFEST.json

@@ -0,0 +1,266 @@
+{
+  "base_commit": "9c79f987207592cb6791e1a8956f23351cdfb2d3",
+  "base_release_manifest_sha256": "1e4fa980507f20168be44b7644a3ccfaa6cd369c08d05ff7c7c2fcb2956ff85c",
+  "base_release_snapshot_sha256": "a5b19ae2e698b7170dc060d468f0b6f27fe462204c80d0f3b61ba6ffc7779642",
+  "continuous_provenance_ingest": {
+    "files": 20,
+    "historical_provenance_before_v3_4_claimed": false,
+    "inventory_sha256": "33039e5124a6d1a7c8fc295a51dbb21d4b5de01f5a24e3fc0722b2dbf0989823"
+  },
+  "external_remaining": [
+    "unrelated third-party independent v3.4 implementation and live interoperability",
+    "independent external security/cryptographic review",
+    "deployment-specific legal/regulatory classification, licensing, recognition or approval where required",
+    "real external issuers, buyers, repeat transactions and market liquidity",
+    "standards/profile governance adoption outside BTG"
+  ],
+  "implementation_package_registry_sha256": "d59e93c0569b0c21bbb214da1afb567ad02324f581e1a2bfb2460a9c38ca7295",
+  "overlay_files": [
+    {
+      "path": "RELEASE_NOTES_v3.4.0.md",
+      "sha256": "b1b036ffeb9a4e8f86e88874d59cf854acf7fa62ef05543d72db416abec3361b"
+    },
+    {
+      "path": "docs/qualification/ENTITY_V3_4_0_CONTINUOUS_PROVENANCE_INGEST_2026-09-24.json",
+      "sha256": "82b28e63e11bc1b77dfae2879259f272a4fdba5c65a539eb93abb53e6ce5cc46"
+    },
+    {
+      "path": "docs/qualification/ENTITY_V3_4_0_RELEASE_QUALIFICATION_2026-09-24.json",
+      "sha256": "e5b3aabf30770cd09fe7e0c141039745e3a7a04fc4a53620724a1e1e1bf13a3c"
+    },
+    {
+      "path": "docs/qualification/ENTITY_V3_4_0_RELEASE_QUALIFICATION_2026-09-24.md",
+      "sha256": "ccd46a522140723756203f52c9f0170a1ceaf46316c756e88c47dcc47bf96749"
+    },
+    {
+      "path": "profiles/registry.json",
+      "sha256": "d59e93c0569b0c21bbb214da1afb567ad02324f581e1a2bfb2460a9c38ca7295"
+    },
+    {
+      "path": "protocol/v3/ENTITY_GLOBAL_PASSPORT.schema.json",
+      "sha256": "4fbfed9be1b1484bc5d28b8101d1c908b2ccced13e4e99ec896c5b054892ebdd"
+    },
+    {
+      "path": "protocol/v3/ENTITY_V3_4_GLOBAL_PASSPORT_CLEANROOM_KIT.min.json",
+      "sha256": "5869a3fd0ed6cb9f65bf4b20c3bd64933cad82f4aef05c5809e2e05af921f230"
+    },
+    {
+      "path": "sdk/global_passport_sdk/README.md",
+      "sha256": "9981c36e7b44de00a2a2627376620da3716eebe7f64ff260f1fd0a1290838be4"
+    },
+    {
+      "path": "sdk/global_passport_sdk/canonical_global_passport_sdk.py",
+      "sha256": "50d40713fe7f8462f54388bd7650705fd3f17027f7692a7cf87bf3ad59230e64"
+    },
+    {
+      "path": "src/38_Global_Passports/continuous_ingestion.py",
+      "sha256": "6ebe6ff361ad42e6703d78fafbf2970bc6ffcce5da64b326df3cb51d6cb44b62"
+    },
+    {
+      "path": "src/38_Global_Passports/global_passport.py",
+      "sha256": "78377698ed2021862757dd3f5bc8622e959c21fe43dc8085a6b83c502e047dfa"
+    },
+    {
+      "path": "src/38_Global_Passports/global_passport_profile.py",
+      "sha256": "bc55797c9297ab567b04dc31a31021927df821ff4ad404a562df22d78c1cc1fb"
+    },
+    {
+      "path": "src/38_Global_Passports/industry_profiles.py",
+      "sha256": "a409c74d4a5535191eac102c18f04df24a9ea89c467939355da03a7b73111d25"
+    },
+    {
+      "path": "src/38_Global_Passports/passport_conformance.py",
+      "sha256": "7be41341e74bb7f841e47e53097482daf31030adb1c8115126a6417850c01473"
+    },
+    {
+      "path": "src/38_Global_Passports/profile_registry.py",
+      "sha256": "3c94afc44c515a9313559a114ed073dad5bb6fc91b083cea57191cbdbbbe36ca"
+    },
+    {
+      "path": "src/39_Implementation_Packages/industry_packages.py",
+      "sha256": "cd75a4aa24daf798e97632a8fca2ed0f2c1ce031bcefc3938ff066b830f7d8a1"
+    },
+    {
+      "path": "tests/test_v3_global_passports.py",
+      "sha256": "922f11f692a5992b1211632a0b625ba51c2d30a4d71dc49e91ae323b109dbe6b"
+    },
+    {
+      "path": "tools/build_v3_4_0_release.py",
+      "sha256": "f51f2cefa916c29eb671b5cfae70833355622221515aa9c2a74732c5333603fc"
+    },
+    {
+      "path": "tools/build_v3_4_cleanroom_kit.py",
+      "sha256": "f8a42497336233c358f2582386365790783c221646cc3f15b5600d888503a009"
+    },
+    {
+      "path": "tools/build_v3_4_industry_packages.py",
+      "sha256": "49585a6cf986214b2472805b8959bfef7d7f71354d70402205034958d67d3af7"
+    },
+    {
+      "path": "tools/build_v3_4_qualification.py",
+      "sha256": "cb5ac3b9e4a20299aa6c68b4012b79e373a6a5553c7041108ed27fe1bbc9ed99"
+    },
+    {
+      "path": "tools/entity_v3_4_cli.py",
+      "sha256": "01bc1becab44cceedd5b35a50733fab7dbc0128fbdc32c4769b9fbeaff62d55d"
+    },
+    {
+      "path": "tools/ingest_v3_4_release.py",
+      "sha256": "ddea429260f673daef32a62c97948aaac924e25e752f3bfbb0691cac3bb649e9"
+    },
+    {
+      "path": "tools/run_v3_4_0_release_gate.ps1",
+      "sha256": "716cdaa545044a282825f56004eeb0973b9f590b205e3b7839442189b627ce13"
+    },
+    {
+      "path": "tools/verify_v3_4_0_release_manifest.py",
+      "sha256": "ed1398bd1629d56eb4bc4ec9ebb53ea6a2da60c8f0722f6f27942e92521f93ea"
+    },
+    {
+      "path": "tools/verify_v3_4_global_passport_release.py",
+      "sha256": "7c94147c3f65605192e12dc0a161de40293260e6bdbac91e4ff3d595092087fe"
+    },
+    {
+      "path": "tools/verify_v3_4_implementation_packages.py",
+      "sha256": "c20ddf9b2f750f1a6a7905b0930fce979069279d7551dc81ac647820ff1e556f"
+    }
+  ],
+  "overlay_snapshot_sha256": "b3d679da48ba598c13ec014ca68ca35c8c1bb88b20004320da4eab589b5fff31",
+  "permanent_truth_boundaries": [
+    "cryptographic verification proves integrity/attribution, not objective external truth",
+    "protocol verification proves ENTITY semantic validity, not objective external truth",
+    "evidence and attestations remain attributable and contestable",
+    "profile composition does not create sovereign authority",
+    "external standards are mapped, not redefined or made subordinate to ENTITY",
+    "profile/package validation does not establish regulatory compliance",
+    "protocol records do not determine legal title or accounting fair value",
+    "provider custody does not create ENTITY authority",
+    "information itself need not be scarce; economic scarcity resides in explicitly bounded rights or interests"
+  ],
+  "qualification": {
+    "base_commit": "9c79f987207592cb6791e1a8956f23351cdfb2d3",
+    "base_release": "v3.3.0",
+    "base_release_manifest_sha256": "1e4fa980507f20168be44b7644a3ccfaa6cd369c08d05ff7c7c2fcb2956ff85c",
+    "claim_boundary": "Six native implementations are BTG-controlled controlled-interoperability evidence; they are not unrelated third-party independence.",
+    "cli_deployment_smoke": {
+      "legal_compliance_claimed": false,
+      "objective_truth_claimed": false,
+      "passport_valid": true,
+      "valid": true
+    },
+    "date": "2026-09-24",
+    "external_remaining": [
+      "unrelated third-party independent v3.4 implementation and live interoperability",
+      "independent external security/cryptographic review",
+      "deployment-specific legal/regulatory classification, licensing, recognition or approval where required",
+      "real external issuers, buyers, repeat transactions and market liquidity",
+      "standards/profile governance adoption outside BTG"
+    ],
+    "global_passport_conformance": {
+      "expected_result_sha256": "ac7504cce70576008cff069607619660a4b9bf0cad43b3f3de81078f1e80d9ba",
+      "invalid": 12,
+      "schema_sha256": "4fbfed9be1b1484bc5d28b8101d1c908b2ccced13e4e99ec896c5b054892ebdd",
+      "sealed_kit_sha256": "5869a3fd0ed6cb9f65bf4b20c3bd64933cad82f4aef05c5809e2e05af921f230",
+      "total": 24,
+      "valid": 12
+    },
+    "implementation_packages": {
+      "developer_configures_not_redesigns": true,
+      "domain_repositories": {
+        "ai": "blackmore-technology-group/ENTITY-AI",
+        "defence-public": "blackmore-technology-group/ENTITY-DEFENCE",
+        "finance": "blackmore-technology-group/ENTITY-FINANCE",
+        "healthcare": "blackmore-technology-group/ENTITY-HEALTHCARE",
+        "manufacturing": "blackmore-technology-group/ENTITY-MANUFACTURING",
+        "robotics": "blackmore-technology-group/ENTITY-ROBOTICS"
+      },
+      "packages": {
+        "ai": "4877cb5bc76ef0803eace931ca1a9cba516c01ba94a2e0b4bc71bcb5dc1b0440",
+        "defence-public": "7edc52344822e370f937b12d05258b5cb3283756dadb5c1885dd93f126cf9887",
+        "finance": "768dd87fd5a29c7e2679fc2b0d4b172b8613712b148336d8fba91a3b92d0d466",
+        "healthcare": "b4e901ce37f696fa10666839cb8d3cacbd1fe663070667ca1767a6245e7cf939",
+        "manufacturing": "bc29a0de024cea22552078ff1913fa3df2b189436cb853cc2f4e08974325c4bc",
+        "robotics": "3a0e68fa6c63b2ef9cf79ccf463335af72d49ffb3cd028c88b6a998d8678f38f"
+      },
+      "profiles_are_executable_implementation_assets": true,
+      "publication_model": "core registry plus six dedicated domain repositories",
+      "registry_sha256": "d59e93c0569b0c21bbb214da1afb567ad02324f581e1a2bfb2460a9c38ca7295"
+    },
+    "permanent_truth_boundaries": [
+      "cryptographic verification proves integrity/attribution, not objective external truth",
+      "protocol verification proves ENTITY semantic validity, not objective external truth",
+      "evidence and attestations remain attributable and contestable",
+      "profile composition does not create sovereign authority",
+      "external standards are mapped, not redefined or made subordinate to ENTITY",
+      "profile/package validation does not establish regulatory compliance",
+      "protocol records do not determine legal title or accounting fair value",
+      "provider custody does not create ENTITY authority",
+      "information itself need not be scarce; economic scarcity resides in explicitly bounded rights or interests"
+    ],
+    "qualified_source_commit": "854529e6cb88e77f29cce581beb74b530768224c",
+    "regression": {
+      "environment": "_venv_entity_v3",
+      "passed": 177,
+      "runner": "python -m unittest discover -s tests -p 'test_*.py' -v",
+      "total": 177
+    },
+    "schema": "entity-v3-4-0-release-qualification-v1",
+    "six_language_controlled_interoperability": {
+      "implementations": {
+        "csharp": "2cf64646cb70c8d89698f3f474a0a2a532c83b2d",
+        "go": "d878229a5256bf7c06a1da84dfb9ba0297f0c946",
+        "java": "da2520429f8dab7a2752b2b6b6fc653c6ae173b6",
+        "rust": "5420f724495722019b1f8624f02fe8a02df7bfbf",
+        "swift": "2f40118999beceb6c34f2ea1c583dd12cfe81368",
+        "typescript": "48e7f606740819379eee2e0fa663d41044b1d899"
+      },
+      "independent_third_party_interoperability": false,
+      "result_sha256": "ac7504cce70576008cff069607619660a4b9bf0cad43b3f3de81078f1e80d9ba",
+      "status": "PASS"
+    },
+    "status": "BTG_INTERNAL_QUALIFIED_GLOBAL_PASSPORT_CONTINUOUS_PROVENANCE_RELEASE_CANDIDATE",
+    "targeted_global_passport_tests": {
+      "passed": 33,
+      "total": 33
+    },
+    "v3_4_invariants": [
+      "CORE_PRIMITIVES_UNCHANGED",
+      "MARKET_ENGINE_PRESERVED",
+      "GLOBAL_PASSPORT_BINDS_EXISTING_RIGHTS",
+      "PROFILE_COMPOSITION_DOES_NOT_CREATE_AUTHORITY",
+      "EXTERNAL_STANDARDS_MAPPED_NOT_REDEFINED",
+      "PASSPORT_IS_NOT_OBJECTIVE_TRUTH",
+      "LEGAL_COMPLIANCE_NOT_IMPLIED",
+      "CONTINUOUS_PROVENANCE",
+      "CUSTODY_IS_NOT_AUTHORITY",
+      "ECONOMIC_VALUE_NOT_INVENTED",
+      "INDUSTRY_PACKAGES_DO_NOT_CREATE_SILOS"
+    ],
+    "version": "3.4.0"
+  },
+  "qualified_source_commit": "854529e6cb88e77f29cce581beb74b530768224c",
+  "release_chain": {
+    "v3.3.0_protected_base": "9c79f987207592cb6791e1a8956f23351cdfb2d3",
+    "v3.4.0_qualified_source": "854529e6cb88e77f29cce581beb74b530768224c"
+  },
+  "release_date": "2026-09-24",
+  "release_snapshot_sha256": "3ff0e51ca2daabf50bc517e9c6e3438e8c150f1560cca6c99621621e3c855a90",
+  "repository": "blackmore-technology-group/ENTITY",
+  "schema": "entity-v3-4-0-release-manifest-v1",
+  "six_language_controlled_interoperability": {
+    "implementations": {
+      "csharp": "2cf64646cb70c8d89698f3f474a0a2a532c83b2d",
+      "go": "d878229a5256bf7c06a1da84dfb9ba0297f0c946",
+      "java": "da2520429f8dab7a2752b2b6b6fc653c6ae173b6",
+      "rust": "5420f724495722019b1f8624f02fe8a02df7bfbf",
+      "swift": "2f40118999beceb6c34f2ea1c583dd12cfe81368",
+      "typescript": "48e7f606740819379eee2e0fa663d41044b1d899"
+    },
+    "independent_third_party_interoperability": false,
+    "result_sha256": "ac7504cce70576008cff069607619660a4b9bf0cad43b3f3de81078f1e80d9ba",
+    "status": "PASS"
+  },
+  "status": "BTG_INTERNAL_QUALIFIED_GLOBAL_PASSPORT_CONTINUOUS_PROVENANCE_RELEASE_CANDIDATE",
+  "supersedes": "v3.3.0",
+  "version": "3.4.0"
+}

RELEASE_NOTES_v3.4.0.md

@@ -0,0 +1,52 @@
+# ENTITY v3.4.0 — Global Passport & Continuous Provenance
+
+ENTITY v3.4.0 turns the existing sovereign authority, rights, evidence and economic architecture into a more directly deployable developer surface without changing the five core primitives:
+
+**ENTITY → AUTHORITY → RIGHT → EVENT → VALUE**
+
+The release introduces one universal **ENTITY Global Passport** that can carry a composable stack of jurisdiction, industry, privacy, trust and technical profiles. Industry packages populate that passport; they do not create incompatible industry-specific passports.
+
+## Primary additions
+
+1. Global Passport Envelope.
+2. Fail-closed Composable Profile Stack.
+3. Signed, immutable Versioned Global Profile Registry.
+4. Versioned Standards Mapping Framework.
+5. Continuous Provenance and Passport Derivation.
+6. Executable Industry Implementation Packages and deployment SDK/CLI.
+
+The operational adoption concept is simple: **give this digital or physical asset an ENTITY Passport.**
+## Executable implementation packages
+
+The first v3.4 package families are:
+
+- Healthcare — HL7 FHIR and DICOM mappings.
+- Finance — ISO 20022, FIX and LEI mappings.
+- Manufacturing — OPC UA and Asset Administration Shell mappings.
+- AI — NIST AI RMF, SPDX 3 and CycloneDX mappings.
+- Robotics — ROS 2 and Open-RMF mappings.
+- Defence-public — public/unclassified asset, originator, custody and provenance patterns; classified material is explicitly rejected by this package.
+
+Packages include pre-engineered object types, profile composition, rights defaults, evidence expectations, privacy defaults, mapping rules, templates, configuration schemas, positive/negative conformance fixtures and quick-start material. Developers configure organization-specific facts rather than redesigning ENTITY.
+
+The deployment model is:
+
+**Select package → configure organization facts → connect systems/data → ingest → verify passport → run conformance → deploy.**
+
+External standards remain externally authoritative. ENTITY mappings state correspondence under a mapping version; they do not redefine those standards or claim normative equivalence.
+## Qualification
+
+- Full ENTITY regression: **177/177 PASS**.
+- v3.4 Global Passport/package targeted tests: **33/33 PASS**.
+- Sealed v3.4 conformance campaign: **24/24 PASS** — 12 valid and 12 invalid vectors.
+- Sealed kit SHA-256: `5869a3fd0ed6cb9f65bf4b20c3bd64933cad82f4aef05c5809e2e05af921f230`.
+- Global Passport schema SHA-256: `4fbfed9be1b1484bc5d28b8101d1c908b2ccced13e4e99ec896c5b054892ebdd`.
+- Canonical cross-language result SHA-256: `ac7504cce70576008cff069607619660a4b9bf0cad43b3f3de81078f1e80d9ba`.
+- Rust, TypeScript, Go, C#, Java and Swift BTG-controlled native implementations all passed the same campaign in protected repositories.
+- Clean CLI deployment smoke test passed through initialization, package planning, ingestion and Global Passport verification.
+
+## Permanent boundaries
+
+A passport is not proof that an external assertion is objectively true. Cryptographic verification proves integrity and attribution within its scope. Profiles do not create sovereign authority. Package validation does not establish regulatory compliance. Provider custody does not create ENTITY authority. Market observations do not become accounting fair value. Information bytes remain nonrival; economic scarcity resides in explicitly bounded rights or interests.
+
+The six native implementations are **BTG-controlled interoperability evidence**, not unrelated third-party independence. Unrelated external implementation/live interoperability, independent security review, deployment-specific legal/regulatory treatment, and real external market adoption remain external milestones.