Worked example: Case D (post-commit divergence) for horizon-shield#51 pilot

docs/spec/execution-join-ref-v1.md

@@ -319,3 +319,8 @@ and remains, entirely valid. See `post-commit-divergence-001`.
   a retroactive one" posture follows the same non-collapsing precedent
   `peer-reconciliation-ref-v1.md`'s `supersedes` mechanism and tri-state
   comparator already set in this repo.
+- Composed onto a different domain's shape, same day: `examples/conformance/
+  execution-join-ref/horizon-shield-pilot-case-d/` proposes `post_commit_
+  consistency` as a fourth, complementary case for the live pilot scoped in
+  `ogasurfproject-jpg/horizon-shield#51` — the JCCDB cost database an
+  accepted estimate was audited against changing after acceptance.

examples/conformance/execution-join-ref/horizon-shield-pilot-case-d/NOTICE.md

@@ -0,0 +1,30 @@
+The object shapes this worked example adopts (`request_occurrence`, `task`,
+`execution-receipt`) are defined in, and cited from, the following files of
+`ogasurfproject-jpg/horizon-shield`, commit `4d720ace` (MIT License,
+Copyright (c) 2026 The HORIZONs Co., Ltd.):
+
+- `workers/hs-ledger/nenrin/musubi-v0/ca2a-companion-v0/COMPANION_v0.md`
+  (section 4, "Request occurrence" and `execution-receipt.v0`)
+- `workers/hs-ledger/nenrin/musubi-v0/ca2a-companion-v0/PILOT_v0.md`
+  (section 3, `task`)
+
+Field names and JCS object shapes (`type`, `caller`, `responder`, `lineage`,
+`capability`, `occurrence_id`, `task_sha256`, `service`, `amount`, `unit`,
+`nonce`, `request_sha256`, `seen_block`, `outcome`) are reproduced from
+those documents, not invented. No code (`.py`) from that repository is
+vendored or imported here — this worked example's `verify.py` is written
+from scratch against the documented shapes, and intentionally declares
+(rather than reimplements) the authority/payment/acceptance checks those
+files' own reference verifiers (`companion_v0_1.py`, `pilot_v0.py`) perform.
+
+Scoping context: `ogasurfproject-jpg/horizon-shield#51` (2026-10-18),
+which freezes the pilot's inputs and explicitly invites this: *"Any other
+project that wants to run its approach on the same workflow is welcome; the
+inputs below do not change for that."*
+
+`post_commit_consistency` is this repo's own invariant
+(`docs/spec/execution-join-ref-v1.md`, "Post-commit divergence (v1.1)"),
+built the same day for a different domain (astrogilda/
+`probityai/agent-evidence#26`, file-write approvals) — composed here onto
+the pilot's shape as a worked example, not adopted from any external
+source.

examples/conformance/execution-join-ref/horizon-shield-pilot-case-d/README.md

@@ -0,0 +1,69 @@
+# Case D: post-commit divergence, composed onto the HORIZON SHIELD pilot
+
+Proposed fourth case for the live pilot scoped in
+[`ogasurfproject-jpg/horizon-shield#51`](https://github.com/ogasurfproject-jpg/horizon-shield/issues/51)
+(aeoess, ogasurfproject-jpg, babyblueviper1 — one paid audit call, three sets
+of receipts). The issue explicitly welcomes this: *"Any other project that
+wants to run its approach on the same workflow is welcome; the inputs below
+do not change for that."*
+
+**This is a worked example, not a PR to their repos.** It adopts the
+`request_occurrence`/`task`/`execution-receipt` object shapes frozen in
+`COMPANION_v0.md` / `PILOT_v0.md` at the pinned commit (see `NOTICE.md`), and
+composes `execution-join-ref-v1`'s `post_commit_consistency` invariant
+(this repo, `docs/spec/execution-join-ref-v1.md`, "Post-commit divergence
+(v1.1)", PR#137, 2026-10-18) on top of them. No code or spec of theirs is
+modified.
+
+## What the pilot's own cases A/B/C cover
+
+All three are about the moment of the chain of receipts itself:
+
+- **A. within** — paid, executed, accepted, all at the call.
+- **B. acceptance fails** — a deliberately mismatched deliverable under the
+  same occurrence.
+- **C. budget exceeded** — a second call takes the running total over the
+  issuer's budget.
+
+## The gap case D fills
+
+None of A/B/C answer: what if the JCCDB cost database the estimate was
+audited against — or the deliverable itself — changes **after** A already
+closed validly? The original payment, execution, and acceptance records are
+not wrong; nobody misstated anything when they signed. What's needed is a
+**separate, later** record naming the divergence, without collapsing the two
+states into one. That is exactly what `post_commit_consistency` /
+`POST_COMMIT_DIVERGENCE` was built for earlier the same day, in a different
+domain (file-write approvals, for astrogilda/`probityai/agent-evidence#26`) —
+the same primitive, reused here as a worked example of its domain-generality.
+
+## Explicit scope limit
+
+This worked example computes exactly **one** invariant:
+`post_commit_consistency` (does a later, independent observation of the
+audited output still match the `response_sha256` the execution-receipt
+committed to at settlement?). It does **not** reimplement:
+
+- **Authority and payment** (MUSUBI / APS) — budget, delegation, payment
+  rail. Declared `true` in both vectors, not recomputed.
+- **Acceptance** (babyblueviper1's work-acceptance-record) — criteria
+  committed before the call, checked after, signed by the checker key.
+  Declared `true` in both vectors, not recomputed.
+
+This is a fourth, complementary check, additive to the three roles the
+pilot's own participants already cover — not a competing implementation of
+any of them.
+
+## Reproduce
+
+```
+python3 verify.py
+```
+
+2/2 vectors pass: `case-a-within-paid-accepted-001` (happy path, shows the
+new invariant does not interfere) and
+`case-d-jccdb-snapshot-divergence-001` (the new case — `canonical_envelope`,
+`chain_integrity`, `authority_and_payment`, `acceptance` all stay `true`;
+only `post_commit_consistency` fails, `POST_COMMIT_DIVERGENCE`).
+
+See `NOTICE.md` for the exact source pin of the object shapes this adopts.

examples/conformance/execution-join-ref/horizon-shield-pilot-case-d/vectors.json

@@ -0,0 +1,137 @@
+{
+  "description": "Worked example composing execution-join-ref-v1's post_commit_consistency invariant (PR#137, 2026-10-18) onto the request_occurrence/task/execution-receipt shape frozen in ogasurfproject-jpg/horizon-shield#51 (pilot scoping, 2026-10-18) and defined in COMPANION_v0.md / PILOT_v0.md at commit 4d720ace (MIT). This is NOT an alternative implementation of authority, payment, or acceptance -- those three roles are covered by MUSUBI/APS (authority_and_payment) and babyblueviper1's work-acceptance-record (acceptance) in the pilot itself, and are declared here, not recomputed. The only invariant this worked example computes is post_commit_consistency: does a LATER, independent observation of the audited output (the JCCDB cost database snapshot, or the deliverable) still match the response_sha256 the execution-receipt committed to at settlement time? Case A (within/paid/accepted, matches the pilot's own happy path) shows the new invariant does not interfere with it. Case D (new, proposed) is the gap after A closes validly: the JCCDB snapshot the estimate was audited against changes after acceptance. The original request/execution/payment/acceptance records remain exactly as valid as they were -- nobody misstated anything at settlement time -- a separate, later post_commit_observation names the divergence without collapsing the two into one state, the same principle execution-join-ref-v1's own post-commit-divergence-001 demonstrates.",
+  "pinned_source": {
+    "repo": "ogasurfproject-jpg/horizon-shield",
+    "commit": "4d720ace",
+    "files": [
+      "workers/hs-ledger/nenrin/musubi-v0/ca2a-companion-v0/COMPANION_v0.md",
+      "workers/hs-ledger/nenrin/musubi-v0/ca2a-companion-v0/PILOT_v0.md"
+    ],
+    "license": "MIT",
+    "issue": "ogasurfproject-jpg/horizon-shield#51"
+  },
+  "vectors": [
+    {
+      "id": "case-a-within-paid-accepted-001",
+      "description": "Analogue of the pilot's own Case A (within/paid/accepted). authority_and_payment and acceptance are declared true (out of scope for this worked example -- MUSUBI/APS and invinoveritas's job). post_commit_consistency is computed: the post_commit_observation's observed_hash matches the execution-receipt's response_sha256 exactly, demonstrating the new invariant does not break the happy path.",
+      "expected": "PASS",
+      "task": {
+        "type": "musubi.ca2a.task.v0",
+        "service": "horizon-shield.estimate-audit",
+        "amount": 10,
+        "unit": "testnet-usdc-minor",
+        "nonce": "a3f1c2e9d4b7a8f0c1e2d3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4"
+      },
+      "request_occurrence": {
+        "type": "musubi.ca2a.request.v0",
+        "caller": "giskard09-pilot-caller",
+        "responder": "ogasurfproject-jpg-horizon-shield",
+        "lineage": "giskard09-pilot-root-credential",
+        "capability": "horizon-shield.estimate-audit",
+        "occurrence_id": "b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+        "task_sha256": "f49e7b91ff2f1240582da1d1f89430983b7743ddf1804c02642956737fe7c530"
+      },
+      "execution_receipt": {
+        "type": "musubi.ca2a.execution-receipt.v0",
+        "caller": "giskard09-pilot-caller",
+        "lineage": "giskard09-pilot-root-credential",
+        "capability": "horizon-shield.estimate-audit",
+        "request_sha256": "4edaf6c7461a7439a5af474875129c7d3f3456209700b0d6575d1473e9ef58c6",
+        "seen_block": {
+          "height": 920000,
+          "hash": "0000000000000000000000000000000000000000000000000000000000000000"
+        },
+        "outcome": {
+          "kind": "result",
+          "stage": "settled",
+          "response_sha256": "f15c6e0cd0bc7f37933cf910df361ee6e6f5bfb77ad5c97c7d1cf2d0b6946394"
+        },
+        "attestation_sha256": null
+      },
+      "post_commit_observation": {
+        "type": "execution-join-ref.post-commit-observation.v1",
+        "request_sha256": "4edaf6c7461a7439a5af474875129c7d3f3456209700b0d6575d1473e9ef58c6",
+        "observed_hash": "f15c6e0cd0bc7f37933cf910df361ee6e6f5bfb77ad5c97c7d1cf2d0b6946394",
+        "observed_at_ms": 1783300000000,
+        "observer_id": "giskard09-post-commit-monitor"
+      },
+      "post_commit_ref": "8ed53b9497d009192afeb7703199fd1dfdeb57e87afd935591fb9408c3ee92d2",
+      "declared": {
+        "authority_and_payment": true,
+        "acceptance": true
+      },
+      "checks": {
+        "canonical_envelope": true,
+        "chain_integrity": true,
+        "authority_and_payment": true,
+        "acceptance": true,
+        "post_commit_consistency": true
+      }
+    },
+    {
+      "id": "case-d-jccdb-snapshot-divergence-001",
+      "description": "Proposed Case D: the gap after Case A already closed validly. Same request_occurrence, task, and execution_receipt as Case A -- the original call was genuinely within, paid, and accepted; authority_and_payment and acceptance stay declared true, unaffected. ~24h later, an independent post_commit_observation recomputes the JCCDB cost database snapshot the estimate was audited against (same original fixture_quote_sha256, different jccdb_snapshot_sha256) and gets a different response_sha256 than the one the execution-receipt committed to at settlement. post_commit_consistency fails -- POST_COMMIT_DIVERGENCE -- while every other invariant, including the original execution-receipt's own validity, remains true. Nothing about the original call was ever false; the database it was checked against moved afterward.",
+      "expected": "FAIL",
+      "failure_mode": "post_commit_consistency",
+      "failure_code": "POST_COMMIT_DIVERGENCE",
+      "failure_detail": "execution_receipt.outcome.response_sha256=f15c6e0cd0bc… (committed at seen_block.height=920000). post_commit_observation at observed_at_ms=1783386400000 (~24h later) recomputes response_sha256=4f7cd5302242… for the same request_sha256=4edaf6c7461a… -- same fixture_quote_sha256, different jccdb_snapshot_sha256. The cost database the estimate was audited against changed after acceptance; the original acceptance was not wrong when it was made.",
+      "task": {
+        "type": "musubi.ca2a.task.v0",
+        "service": "horizon-shield.estimate-audit",
+        "amount": 10,
+        "unit": "testnet-usdc-minor",
+        "nonce": "a3f1c2e9d4b7a8f0c1e2d3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4"
+      },
+      "request_occurrence": {
+        "type": "musubi.ca2a.request.v0",
+        "caller": "giskard09-pilot-caller",
+        "responder": "ogasurfproject-jpg-horizon-shield",
+        "lineage": "giskard09-pilot-root-credential",
+        "capability": "horizon-shield.estimate-audit",
+        "occurrence_id": "b1a2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2",
+        "task_sha256": "f49e7b91ff2f1240582da1d1f89430983b7743ddf1804c02642956737fe7c530"
+      },
+      "execution_receipt": {
+        "type": "musubi.ca2a.execution-receipt.v0",
+        "caller": "giskard09-pilot-caller",
+        "lineage": "giskard09-pilot-root-credential",
+        "capability": "horizon-shield.estimate-audit",
+        "request_sha256": "4edaf6c7461a7439a5af474875129c7d3f3456209700b0d6575d1473e9ef58c6",
+        "seen_block": {
+          "height": 920000,
+          "hash": "0000000000000000000000000000000000000000000000000000000000000000"
+        },
+        "outcome": {
+          "kind": "result",
+          "stage": "settled",
+          "response_sha256": "f15c6e0cd0bc7f37933cf910df361ee6e6f5bfb77ad5c97c7d1cf2d0b6946394"
+        },
+        "attestation_sha256": null
+      },
+      "post_commit_observation": {
+        "type": "execution-join-ref.post-commit-observation.v1",
+        "request_sha256": "4edaf6c7461a7439a5af474875129c7d3f3456209700b0d6575d1473e9ef58c6",
+        "observed_hash": "4f7cd5302242f7147c9e65461664e0d3cab26acf9ba2ad9ab9dc45a0984bb1a7",
+        "observed_at_ms": 1783386400000,
+        "observer_id": "giskard09-post-commit-monitor"
+      },
+      "post_commit_ref": "50707244f134df7828556ec8802ea25f7e65f84048481fae3670767603a46243",
+      "declared": {
+        "authority_and_payment": true,
+        "acceptance": true
+      },
+      "checks": {
+        "canonical_envelope": true,
+        "chain_integrity": true,
+        "authority_and_payment": true,
+        "acceptance": true,
+        "post_commit_consistency": false
+      }
+    }
+  ],
+  "provenance": {
+    "authored_by": "giskard09 (argentum-core)",
+    "verification_mode": "asserted",
+    "independently_reproduced_by": []
+  }
+}