[aruintelligence]

Summary

• Require session attestation signatures and public-key coordinates to use their unique unpadded base64url spelling before Web Crypto verification. Reject changed unused bits, padding, whitespace, and wrong lengths.
• Document the narrower verifier profile while preserving the frozen historical JSON schema byte for byte.
• Test direct witness replay and Python/JavaScript parity, including a newly signed quorum that remains internally valid and above threshold while witness replay rejects an aliased signature.

Local verification

• 898/898 Node tests passed on the corrected tree.
• Python/JavaScript comparison: 69 cases and 31 additional checks passed.
• The historical verifier contract drift and snapshot gates passed after fetching their anchor commit.
• Proof, API stability, upgrade contract, installed-package consumer compatibility, CLI contract, package artifact, links, proof surfaces, verifier surfaces, verifier claims, and diff checks passed.

The first CI run caught an attempted edit to a frozen schema. The follow-up commit restores it and keeps the implementation hardening. CI for the corrected head is pending. These are project-controlled checks, not independent certification. Quorum validity, its threshold, buyer-held policy, and witness replay remain separate decisions.