[aruintelligence]

Summary

• Bind direct browser receipt, evidence, session attestation, and witness bundle checks to validated call-time JSON copies before asynchronous Web Crypto work.
• Embed detached inputs in newly created evidence and witness artifacts. Preserve the live receipt's object identity while rejecting an edit made during its hash.
• Cover mutations during verification and creation, including a hidden malformed field removed before the pending replay resolves, and document the scope of this protection.

Local verification

• 911/911 tests passed
• Proof, API stability, installed-package consumer compatibility, CLI contract, package artifact, local links, proof surfaces, and git diff --check passed

These are local results. GitHub CI is pending. The work checks internal consistency of supplied browser artifacts; it does not establish independent certification, trustworthy declarations, or a trusted clock. Quorum valid and threshold_met remain distinct.