From 15f1e7dc295bff3656b558cf54706ec0fbb7f1e4 Mon Sep 17 00:00:00 2001
From: Imran Siddique <imran.siddique@opaque.co>
Date: Fri, 11 Sep 2026 12:22:27 -0700
Subject: [PATCH] docs(registry): say why the two witness fields cannot move
 for the September 7 capture

The page reported witness_time_established and grade_cryptographically_bound as
false for that capture without saying why they stay false. The witness signature
covers the protected header the fields are read from, so a receipt carrying a CWT
iat or a signed grade is a separately signed receipt. A witness shipping support
for them changes a later receipt and leaves the archived one alone.

Stated that way the line has no shelf life and needs no pass at deploy time.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DLHonYjqypEL2Zjd8VGmb6
---
 registry/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/registry/index.html b/registry/index.html
index 5da59ff..d61f7b0 100644
--- a/registry/index.html
+++ b/registry/index.html
@@ -152,7 +152,7 @@ <h3>A signed checkpoint commits to the history</h3>
   <span class="label">Independent witnesses</span>
   <h2>One checkpoint, one verified external receipt</h2>
   <p>Checkpoint 1's signing-body digest is included under a Merkle root signed by a separately operated witness. The returned receipt and two independently fetched copies agree; verification runs offline against an explicitly pinned witness key. This was demonstrated on September 7, 2026, ahead of the September 9 briefing.</p>
-  <p>The response reports <code>countersigned-observed</code>. Whether a receipt carries a witness time or a signed grade is a property of that receipt rather than of the profile, so the verifier reports <code>witness_time_established</code> and <code>grade_cryptographically_bound</code> instead of asserting either. Both are false for the September 7 capture. The receipt does not certify registry continuity. It authenticates inclusion of the signing-body digest, with the registry signature checked separately.</p>
+  <p>The response reports <code>countersigned-observed</code>. Whether a receipt carries a witness time or a signed grade is a property of that receipt rather than of the profile, so the verifier reports <code>witness_time_established</code> and <code>grade_cryptographically_bound</code> instead of asserting either. Both are false for the September 7 capture and stay false for it: that receipt's protected header is algorithm and tree profile only, and the witness signature covers that header, so a receipt carrying either field is a separately signed receipt rather than this one re-read. The receipt does not certify registry continuity. It authenticates inclusion of the signing-body digest, with the registry signature checked separately.</p>
   <p>No recurring witness submission, reciprocal witnessing, or second witness is claimed. Parallel independent witnesses remain a deployment choice; original records stay with their holders.</p>
   <a class="button" href="https://github.com/agentrust-io/trace-registry/tree/main/docs/evidence/witness-2026-09-07">Receipt, key provenance and offline verification</a>
 </section>