Step 4 PR 4 (keel-permit): corpus promotion + CHANGELOG 1.4.1

[sftimeless]

Summary

Step 4 PR 4 (keel-permit side) — promotes 17 new corpus fixtures from keel-verifier's local test corpus to the canonical public corpus at `test-vectors/verifier_claims/v0/fixtures/`. Matches the corpus-as-public-contract doctrine pattern established by Step 2 PR 4 (2026-05-21): public corpus is canonical; verifier consumes contract.

CHANGELOG bumped to 1.4.1 (corpus promotion is additive only — no v1.4.0 entries modified).

What's in this PR

17 fixture directories promoted from keel-verifier/tests/fixtures/ to keel-permit/test-vectors/verifier_claims/v0/fixtures/:

• 4 permit.decision.v1 negatives — bad signature, tampered decision, untrusted key, canonical payload mismatch
• 5 permit.revoked.v1 negatives — bad signature, project mismatch, effective_at != revoked_at, missing field, PII detected
• 5 permit.dispatch_absence_after_revocation.v1 negatives — post-revocation dispatch present, bridge record matches predicate, predicate out of grammar, missing checkpoint, missing sidecar
• 3 edges — pre-revocation dispatch supported, empty scope supported, occurred_at == effective_at disproves (the critical Lock A test from the multi-model §XII design pass)

Plus corpus.json updates, aggregate indices, and CHANGELOG 1.4.1 entry.

v0 immutability respected

This PR is ADDITIVE only:

• Existing claim_registry entries (PR 1 v1.4.0): UNCHANGED
• Existing pinned semantics: UNCHANGED
• Existing fixtures: UNCHANGED
• New fixtures + corpus index entries are append-only

Cross-repo parity verified (independently computed sha256)

• `keel.verifier_claim_registry.v0`: sha256:8da29094...
• `permit.decision.v1` semantic: sha256:4fad85a1...
• `permit.revoked_event.v1` semantic: sha256:5b7416b1...
• `permit.dispatch_absence_after_revocation.v1` semantic: sha256:529f17bf...
• `permit-revoked-event.schema.json`: sha256:634b9e87...

Verification performed (Codex)

• check_repo_integrity.py passed
• check_public_hygiene.py passed
• 17/17 new Step 4 fixtures match public verifier
• Corpus is now 99 records (was 82)
• Co-author trailers Claude + Codex on the commit

Related

• Step 4 PR 1 (merged 2026-05-22) — keel-permit v1.4.0 public contract
• Step 4 PR 2 (merged 2026-05-22) — keel-api emission
• Step 4 PR 3 (merged 2026-05-22) — keel-verifier adjudication code
• Companion: keel-verifier Step 4 PR 4 — parity + publish prep + PyPI 2.3.0

After this PR + the keel-verifier PR 4 merge: Christian tags v2.3.0 on keel-verifier, release.yml auto-creates GitHub Release with Sigstore + Rekor + SBOM (inherited from A.1), Christian uploads to PyPI manually with twine. Step 4 then fully closed end-to-end.

🤖 Generated via §XII multi-model design pass (Claude + Codex + ChatGPT + Perplexity)

Co-Authored-By: Claude noreply@anthropic.com
Co-Authored-By: Codex noreply@openai.com