# External reproduction record

Complete this separately from the unsigned machine report. Publish it through
an identity/channel a reader already trusts. A signature attributes a statement
to a key; authenticating the reviewer and their independence is a separate task.

1. **Who ran it?** Reviewer, organization if applicable, public source/review URL,
   relationship to Money Musk and relevant conflicts. Do not publish private
   identity documents, account tokens, private keys or personal file paths.
2. **What was run?** Exact repository commit, kit/source digest, dependency
   versions and profile. Explain changes. Running the reference establishes
   reproduction by that operator, not an independent implementation.
3. **Where was authority enforced?** Resource, final effect boundary, which
   process owns credentials, and whether a delegate has any alternative path.
   A file-library refusal is not an OS sandbox or a robot emergency stop.
4. **Which network conditions?** Record preparation separately from execution.
   State whether Money Musk services were unavailable, sockets were denied,
   local communication was available and whether restrictions were reproduced.
5. **What actually happened?** Include every case, failed/unsupported results,
   file/evidence verification, controlled-clock versus real-clock observations,
   delivered revocation versus undelivered expiry, and crashes/unknown outcomes.
6. **What was independently implemented?** Name external authors, repository,
   language and exact supported signed formats. Compare behavior against the
   published HAP-1 and Draft Desk specifications. A copied runtime or a wrapper
   around it is not a new independent executor.
7. **What remains unproven?** State compromised OS/keys, rollback, trusted clocks,
   human consent, physical devices, independent audit and deployment limits.

Start with this source kit. Use `profile.json` as a common list of cases and
`draft-desk/SPEC.md` for the file/evidence contract. An independent implementation
can reproduce the same HAP-1 signed inputs/outputs in its own runner; this v0.1
kit does not dynamically load outside code or certify its compatibility.

Retain a separate key pin before receiving a bundle. Never treat a key embedded
in an evidence package as independent authentication. A valid snapshot proves
only the relationships its verifier checks; it is not an exhaustive history.

Record additional cases chosen independently of this public test list. In
particular test scope/payload substitution, replay after reboot, competing
allowances, corrupted/missing storage, old backups, delayed revocation, key
rotation/recovery and deliberate attempts to access the real resource directly.
Use synthetic data and isolated resources. Submit findings, exact reproduction,
affected revision and retest results; do not convert failures into a badge.

Reference results, outside operation, outside implementation, security review
and sustained adoption are separate claims. This kit cannot confirm a
"world-first" or "world's layer" claim.