← Research archive
Technical note published Sep 4, 2026

Frozen Evidence Identity: Canonical URL Plus SHA-256

KESPA corrected its scale claim/evidence verifier so frozen evidence is identified by canonical URL plus SHA-256 rather than URL alone. The change addressed 17 authoritative URLs that legitimately mapped to multiple frozen excerpts, 16 of which were referenced by generated candidates, while preserving strict contamination controls.

evidence-verification provenance sha256 integrity claim-verifier
MARKDOWN

README.md

2,475 bytes SHA-256 c573212727ad7cba…

KESPA-NOTE-009 — Frozen Evidence Identity: Canonical URL + SHA-256

Date: 2026-09-04 Status: Published technical note Project: KESPA AI / NexLabs Studios

Problem

The scale verifier originally resolved frozen evidence by canonical URL.

That became ambiguous once KESPA encountered authoritative pages that legitimately produced more than one bounded frozen evidence excerpt.

The historical scale dataset contained:

  • 17 authoritative URLs mapping to multiple frozen excerpts;
  • 16 of those URLs referenced by generated candidates.

URL alone was therefore not a sufficiently precise evidence identifier.

Correction

The scale claim/evidence verifier changed its lookup identity from:

canonical URL

to:

canonical URL + SHA-256

The URL identifies the source location.

The hash identifies the exact frozen evidence content used by the candidate.

Together they preserve excerpt-level identity without pretending that every URL can map to only one evidence record.

Why this matters

Consider one authoritative documentation page containing several sections.

Two claims may legitimately use different frozen excerpts from the same page.

With URL-only matching, a verifier can resolve the wrong excerpt even though the source URL itself is correct.

Using:

source location + frozen content hash

makes the evidence binding substantially more precise and auditable.

Scope of the change

The historical record explicitly limits the correction to the new scale verifier.

It did not mutate:

  • candidates;
  • frozen evidence;
  • production Chroma;
  • Brain;
  • the database.

The canonical pilot verifier was left untouched.

Contamination guard

The same correction preserved the strict deadlock 1213 contamination guard.

The only exception was where the approved blueprint explicitly permitted the deadlock-1213 topic itself.

That is an important distinction: fixing evidence identity did not weaken the general contamination boundary.

Research significance

KESPA's evidence pipeline treats provenance as more than a source URL.

A defensible frozen evidence record needs to answer both:

1. Where did this come from?

2. Which exact frozen content was used?

This correction moved the verifier closer to that contract.

Limitation

SHA-256 proves identity of frozen bytes, not factual quality.

Authority, relevance, scope fit, independence, and claim support still require their own checks.

TEXT

SHA256SUMS.txt

393 bytes SHA-256 b4e76a9c8f220847… 
c573212727ad7cbaf64bea046a6ed7f934f1cfd0d28a680b25a206b90b589322  README.md
243a5defba427156590a6f8ce2160c28bf8ab15308f7b8dde6c5e818feba4394  note.json
2d385cc96b25de727e0f703e17f8105e4953d80d8473c822d1d04e4c757f7c52  metrics.csv
c877de6028a21ef5cea9629ddd1b9219650ad3ed8a64e2840a8ce2ddebff2a8b  methodology.md
dfb0606c9b342cb1c19520bbcc6916ff0bec7b651b18950ca9a75731de79feec  provenance.json
MARKDOWN

methodology.md

883 bytes SHA-256 c877de6028a21ef5…

Methodology

Failure mode

The scale verifier attempted to resolve candidate evidence references using canonical URL alone.

The scale corpus contained authoritative URLs associated with multiple distinct frozen excerpts, making URL-only resolution ambiguous.

Identity correction

The verifier was changed to resolve evidence using the pair:

canonical_url + evidence_sha256

This retains source-location provenance while selecting the exact frozen evidence content.

Integrity boundary

The correction was implemented in new scale-verifier files only.

The historical record states that the canonical pilot verifier was not changed and that no candidate/evidence, Chroma, Brain, or database mutation occurred.

Contamination handling

The existing deadlock-1213 contamination guard remained strict except for blueprint scopes that explicitly authorized that topic.

CSV

metrics.csv

468 bytes SHA-256 2d385cc96b25de72… 
metric,value,unit_or_status
authoritative_urls_with_multiple_excerpts,17,urls
multi_excerpt_urls_referenced_by_candidates,16,urls
previous_identity_key,canonical URL,design
corrected_identity_key,canonical URL + SHA-256,design
canonical_pilot_verifier_changed,NO,boundary
candidate_mutation,NO,boundary
evidence_mutation,NO,boundary
production_chroma_write,NO,boundary
brain_write,NO,boundary
database_write,NO,boundary
deadlock_1213_guard_broadly_relaxed,NO,boundary
JSON

note.json

2,133 bytes SHA-256 243a5defba427156… 
{
    "schema": "kespa.public_technical_note.v1",
    "id": "KESPA-NOTE-009",
    "title": "Frozen Evidence Identity: Canonical URL Plus SHA-256",
    "date": "2026-09-04",
    "status": "published",
    "purpose": "Document an integrity correction in the scale claim/evidence verifier after URL-only evidence identity proved insufficient for authoritative sources that legitimately produced multiple distinct frozen excerpts.",
    "observed_problem": {
        "authoritative_urls_with_multiple_frozen_excerpts": 17,
        "such_urls_referenced_by_candidates": 16,
        "previous_identity_key": "canonical URL only",
        "corrected_identity_key": "canonical URL + evidence SHA-256"
    },
    "correction": {
        "scale_verifier_only": true,
        "canonical_pilot_verifier_changed": false,
        "candidate_mutation": false,
        "evidence_mutation": false,
        "production_chroma_write": false,
        "brain_write": false,
        "database_write": false
    },
    "contamination_guard": {
        "deadlock_1213_guard_default": "strict",
        "exception": "Only permitted where the approved blueprint explicitly allows the deadlock-1213 topic.",
        "guard_broadly_relaxed": false
    },
    "interpretation": [
        "A URL is not always a unique evidence record.",
        "Multiple valid frozen excerpts can originate from the same canonical authoritative page.",
        "Binding verification to URL plus content hash preserves excerpt-level provenance without conflating distinct evidence records.",
        "The change corrected evidence resolution without changing the underlying candidate or evidence payloads."
    ],
    "limitations": [
        "The source record documents the integrity correction but does not include a separate full user-environment validation result for this specific verifier revision.",
        "The 17/16 counts describe the observed scale dataset at that point in time, not a universal property of future evidence corpora.",
        "SHA-256 identifies frozen content bytes; it does not by itself establish that the evidence is authoritative, relevant, or factually sufficient.",
        "This note intentionally does not republish raw third-party evidence excerpts."
    ]
}
JSON

provenance.json

1,195 bytes SHA-256 dfb0606c9b342cb1… 
{
    "schema": "kespa.public_provenance.v1",
    "research_id": "KESPA-NOTE-009",
    "source_basis": "Historical KESPA changelog/Jira export supplied for public research reconstruction.",
    "source_observations": [
        "The scale verifier was changed to resolve frozen evidence using canonical URL plus SHA-256 rather than URL alone.",
        "17 authoritative URLs legitimately mapped to multiple frozen evidence excerpts.",
        "16 of those URLs were referenced by candidates.",
        "Only new scale-verifier files changed; the canonical pilot verifier remained untouched.",
        "No candidate/evidence mutation and no Chroma, Brain, or database writes were recorded.",
        "The deadlock-1213 contamination guard remained strict except where explicitly permitted by the approved blueprint."
    ],
    "verification_note": "The supplied changelog documents the correction and safety boundary but does not record a separate full user-environment validation result for this specific verifier revision; this public entry is therefore marked published rather than verified.",
    "publication_note": "Raw third-party evidence excerpts, private candidate payloads, and implementation code are not republished."
}