HBCE Baseline v1.1 (Draft)
Draft document. Not normative. v1.0 remains the active baseline. This page defines the planned expansion path.
Purpose
Baseline v1.1 proposes extensions that increase interoperability, audit reproducibility and industrial adoption readiness, while preserving the v1.0 invariants.
Invariant continuity
v1.1 MUST preserve the v1.0 invariants:
- HASH-ONLY public layer (GDPR-min posture)
- APPEND-ONLY trajectory
- DETERMINISTIC verification
- FAIL-CLOSED enforcement
- NO public data custody
Proposed extensions (v1.1)
1) Evidence Pack (manifested)
Standardize a minimal evidence pack format: manifest + artifacts list + hashes + signature references. Purpose: portable audit bundles.
2) Receipt strengthening
Define mandatory receipt fields (baseline id, profile id, canonical hash, registry reference, policy outcome). Purpose: human-readable + machine-checkable receipts.
3) Profile binding labels
Require explicit profile labels (BASE / IND / GOV) inside manifests and receipts. Purpose: unambiguous interoperability.
4) Operator gating refinement
Clarify operator-bound execution requirements and minimum operator metadata (hash-only public posture preserved). Purpose: improved responsibility continuity.
5) Deterministic canonicalization statement
Provide a single canonicalization rule reference (e.g., JCS or equivalent deterministic JSON canonicalization). Purpose: prevent cross-implementation divergence.
6) Backward-audit guarantee
Ensure that v1.0 evidence remains verifiable under v1.1 verification tooling. Purpose: continuity and non-breaking upgrades.
Draft acceptance criteria
- Independent implementations can verify the same evidence with the same PASS/FAIL results.
- Evidence packs remain hash-only on public surfaces.
- Receipts are reproducible and portable.
- No change introduces silent fallback behavior (fail-closed preserved).
Status
- Document: Draft
- Current baseline: v1.0 (active)
- Target: v1.1 (proposed)
- Compatibility: backward-auditable