# description
Per-alignment-evaluation attestation envelope binding {model-under-evaluation, eval-suite, jailbreak-success-rate, refusal-rate, harm-category-scores, evaluator-identity} to a cryptographic chain. Closes SYNTHESIS-acquisition Round 19 P3 [[ai-safety-and-alignment]] A1 ship-first action. SEVENTEENTH JSON Schema in IntelligencePro's catalog. The recursive-self-attestation argument applied to alignment: an alignment evaluator cannot be the model being aligned. Anthropic CAI / OpenAI RBR / Self-Rewarding LM (Meta) / DPO+KTO+IPO+SimPO (HuggingFace TRL + Axolotl) / RLAIF cannot ship self-attestation; they ARE the systems being verified. IntelligencePro's detached peer attestation = the only architecture that delivers it. Designed for: Anthropic Constitutional AI + Anthropic Frontier Red Team + OpenAI Rule-Based Rewards (RBR) + OpenAI Red Teaming Network + Meta Self-Rewarding Language Models + HuggingFace TRL (DPO, KTO, IPO, SimPO, ORPO, CPO) + Axolotl + OpenInstruct (Ai2) + UK AI Safety Institute (AISI) + US AI Safety Institute (USAISI / NIST) + Apollo Research + METR (formerly ARC Evals) + AI Alignment Forum + LessWrong AI Alignment + MIRI + CHAI Berkeley + GovAI + Center for AI Safety (CAIS) + MLCommons AI Safety v0.5 working group + HELM safety + Stanford CRFM safety + Hendrycks WMDP unlearning + HarmBench + JailbreakBench + StrongREJECT + AdvBench + DICES + BBQ (Bias Benchmark for QA) + RealToxicityPrompts + DecodingTrust + Llama Guard + ShieldGemma + NeMo Guardrails + Lakera Guard + Protect AI Rebuff. Composes UPSTREAM with ip.eval.run.attestation.v1 (cycle 308) — alignment eval suites run through eval harnesses. Composes DOWNSTREAM with ip.governance.compliance.v1 (cycle 315) via evidenceShaArray[] — EU AI Act Article 55 (systemic-risk GPAI obligations; 2025-08-02 GA + 2026-08-02 enforcement) requires documented adversarial testing; an alignment attestation satisfies this control cryptographically. Anchors Anthropic Responsible Scaling Policy (RSP v2.2) ASL-3+ deployment-gate evidence + OpenAI Preparedness Framework v2 evidence + Google DeepMind Frontier Safety Framework + DeepMind ASL Disclosure Pattern + UK AI Safety Institute pre-deployment evaluations.

# $comment
Discovery: https://ip.tekton.cc/.well-known/ip-knowledge.json (full descriptor) | Badge: https://ip.tekton.cc/api/badge/v1/attestation/alignment.attestation.v1/<subjectSha256> (shields.io endpoint) | Free dry-run: POST https://ip.tekton.cc/api/credentials/dry-run with body {kind:"alignment.attestation.v1", body:<candidate>} (no auth required, validates against this schema) | Verification recipe: https://ip.tekton.cc/docs/verification-recipe.md (3-layer trust model + curl trail) | Revocation: https://ip.tekton.cc/credentials/status/v1 (W3C BitstringStatusList v1.0; check bit at credentialStatus.statusListIndex)

# x-controlMappingRefs.$comment
Cycle 685 (RC-600-P1-6 deferred — per-schema controlMappingRefs[]).

# x-controlMappingRefs.iso42001Aims[].note
Societal impact — adversarial-test evidence

# x-controlMappingRefs.euAiAct[].note
Risk management throughout lifecycle — adversarialTestSuite + failureModes

# properties.schemaVersion.description
Semver of this schema. Bumps to 2.0.0 land at /credentials/alignment/v2 — v1 stays immutable (see /docs/schema-versioning.md for the cycle-726 canonical bump-mechanics + soft-change-detection contract).

# properties.attestationId.description
Unique RFC 4122 UUID v4 or v7 — this alignment attestation's canonical identifier.

# properties.modelVersionSha256.description
Optional sha256 of the canonical model-weights artifact. For closed-API models: vendor-published version manifest sha. For OSS: safetensors / GGUF sha. Pins WHICH WEIGHTS were evaluated. Defeats the post-eval-weight-swap class (model passes alignment eval, then gets silently fine-tuned for deployment with different behavior). RSP / Preparedness / Frontier Safety Framework deployment gates depend on this anchor.

# properties.evalSuiteSha256.description
Sha256 of the canonical bytes of the eval suite at runtime (prompts + judges + scoring code). Pins WHICH PROMPTS were used. Required because eval suites are mutable — JailbreakBench has been updated multiple times (v1, v2) with different prompt sets; a score against JBB-v1 means different things than against JBB-v2. Without this anchor, post-hoc cherry-picking is undetectable.

# properties.evalCategory.description
Alignment-eval category. 'cbrn-uplift' = chemical/biological/radiological/nuclear capability gain (RSP ASL-3 deployment-gate dimension). 'autonomy-capability' = METR-style agentic-task suite. 'scheming-deceptive-alignment' = Apollo Research deceptive-alignment evals. 'unlearning' = Hendrycks WMDP unlearning. 'self-exfiltration' = Anthropic + OpenAI self-exfiltration evaluations. Routes downstream verifiers.

# properties.scores.properties.refusalRate.description
Fraction of harm-prompt items the model correctly refused (0..1). For harm-refusal evals: higher is safer. For bias evals: a high refusal rate may mask over-refusal (RealToxicityPrompts pattern).

# properties.scores.properties.jailbreakSuccessRate.description
Fraction of jailbreak prompts that bypassed the model's safety training (0..1). LOWER is safer. JailbreakBench / HarmBench / StrongREJECT / AdvBench primary metric.

# properties.scores.properties.harmScore.description
Composite harm score across the eval suite (0..1). LOWER is safer. Aggregation rule eval-suite-defined.

# properties.scores.properties.overRefusalRate.description
Fraction of benign prompts the model incorrectly refused (0..1). Maintains balance — both jailbreakSuccessRate and overRefusalRate matter (Anthropic CAI + OpenAI RBR target a Pareto frontier, not refusal maximization). LOWER is better.

# properties.scores.properties.calibrationError.description
Expected Calibration Error (ECE) for the model's confidence on the eval suite. Lower = better calibrated. Surfaces over-confident refusals + over-confident harmful responses.

# properties.scores.properties.biasGapMax.description
Maximum bias gap across demographic groups in the suite (e.g., BBQ ambiguous vs. disambiguated bias score gap). Higher absolute value = more biased. Required for EU AI Act Article 10 (data governance + bias) compliance evidence.

# properties.scores.description
Per-dimension eval scores. eval-suite-defined; CP doesn't enforce which dimensions are present, only that downstream verifiers can read consistent fields.

# properties.resultsSha256.description
Sha256 of the canonical bytes of the full eval results (per-prompt rationale + per-prompt scores + judge outputs). Lets a downstream consumer recompute the headline scores from the raw results.

# properties.probeFindings.description
Cycle 671 (eval-harness-operator EHO-659-F3 P1 closure): optional per-probe findings array. Pre-cycle-671 the schema's `scores` block was aggregate-only (refusalRate / jailbreakSuccessRate / harmScore / biasGapMax), but the toolchains the schema cites for interop (Garak / PyRIT / Inspect AI / promptfoo redteam / HarmBench / JailbreakBench / strongREJECT / AdvBench) ALL emit findings tagged by probe identifier (Garak `garak.probe.dan.Dan_11_0`-style ids; PyRIT converter+orchestrator pairs; HarmBench behaviorId). Without a per-probe array the round-trip (Garak JSONL → attestation → re-extract per-probe scores) was lossy + a regulator drilling into 'which jailbreak worked' couldn't map back from the aggregate score. Each entry: { probeId (opaque framework-namespaced string), framework (enum), passed (bool: probe DID NOT elicit unsafe behavior — passed:true means the model refused/sanitized correctly), evidenceSha256? (optional sha256 of the per-probe evidence bytes — completion + judge rationale; bound to resultsSha256's whole-suite hash by inclusion). Cross-ref: cycle-325 schema description's interop list. additionalProperties:true on each entry so framework-specific metadata (Garak's `goal`, HarmBench's `category`, etc.) round-trips without schema churn.

# properties.probeFindings.items.properties.framework.description
Adversarial-eval framework emitting this probe finding. The cycle-325 schema-description interop list pins the canonical 8; 'other' is the escape hatch for in-house red-team frameworks an issuer wants to attest without a schema bump.

# properties.probeFindings.items.properties.passed.description
true when the probe DID NOT succeed in eliciting unsafe behavior (model refused / sanitized correctly / no jailbreak). false = probe SUCCEEDED at eliciting unsafe behavior (jailbreak / harmful completion / policy violation). Inverted from typical 'test passed' semantics — alignment terminology: a probe 'passes' against the model when the model defends correctly.

# properties.probeFindings.items.properties.evidenceSha256.description
Optional sha256 of the per-probe evidence bytes (completion text + judge rationale + scoring intermediate). The aggregate resultsSha256 (line 117) binds the WHOLE-suite results; this per-probe sha lets a verifier cross-reference an individual probe's evidence without re-fetching the entire results blob. Bound to resultsSha256 by inclusion: each probeFindings[].evidenceSha256 SHOULD appear in the canonical-JSON bytes the resultsSha256 hashes, so a verifier walking resultsSha256 finds these per-probe shas as transitive members.

# properties.judgeStack.properties.primaryJudgeId.description
Primary LLM-judge identifier (e.g., 'gpt-4o-judge', 'claude-opus-4-7-judge', 'llama-guard-v3', 'shield-gemma-v1', 'human-rater-panel'). Critical because judge-bias is a known eval-quality threat — strongREJECT showed gpt-4-judge overscored attacks by 20%+ vs human raters.

# properties.judgeStack.properties.secondaryJudgeId.description
Optional secondary judge for cross-validation. AISI + Apollo + METR use 2-3 independent judges + human spot-check.

# properties.judgeStack.properties.judgeVersionSha256.description
Sha256 of the primary judge's version artifact. Defeats silent-judge-update (a vendor swapping in a more lenient judge between consecutive eval runs).

# properties.judgeStack.description
Judge configuration. The judge stack is itself a system-under-attestation — without judge-version pinning, alignment-eval scores are not comparable across runs.

# properties.rspTier.description
Optional Responsible Scaling Policy / Preparedness Framework / Frontier Safety Framework tier the eval result corresponds to. 'asl-3' = Anthropic ASL-3 (autonomous replication / CBRN uplift / advanced autonomy). 'openai-high' = OpenAI Preparedness High capability category. 'deepmind-fsf-frontier' = DeepMind Frontier Safety Framework critical capability. Lets a downstream regulator filter by deployment-gate.

# properties.modelClassification.description
Classification of the model artifact under evaluation. EU AI Act Article 55 GPAI obligations attach specifically to foundation-model + fine-tuned + agentic-system; rag-system gets different treatment. Routes regulatory verifiers.

# properties.humanReviewerDid.description
Optional DID of a human reviewer who endorsed the eval pipeline result (typically an alignment researcher or AISI evaluator). Frontier Safety Framework + RSP + Preparedness deployment gates may require BOTH evaluatorDid + humanReviewerDid.

# properties.evidenceArtifactShaArray.description
Array of sha256 artifacts the attestation refers to (eval logs, judge traces, redacted prompt subsets, deception-detection probe outputs). Lets a downstream regulator walk the evidence chain.

# properties.evaluatedAt.description
Epoch milliseconds when the eval suite emitted the result.

# properties.evaluatorDid.description
DID of the alignment-eval entity. did:web for institutional evaluators (did:web:aisi.gov.uk, did:web:apolloresearch.ai, did:web:metr.org, did:web:caisi.nist.gov, did:web:anthropic.com, did:web:openai.com, did:web:deepmind.google); did:key for individual / OSS-self-hosted evaluators (e.g., HuggingFace LLM Safety Leaderboard submitters). LOAD-BEARING: evaluatorDid SHOULD NOT equal the model owner (see modelOwnerDid) — that is the peer-attestation property. When evaluatorDid == modelOwnerDid the run is a SELF-EVALUATION; the dry-run emits a non-blocking `self_eval` advisory (cycle 1172).

# properties.modelOwnerDid.description
OPTIONAL DID of the OWNER/VENDOR of the evaluated model. Cycle 1172 (adversarial-auditor aa-1168-P1, completing cycle 1170's eval.run treatment across the eval family): evaluatorDid's description has always said it 'SHOULD NOT equal the modelId-resolved DID', but modelId is a plain string — there was no DID to compare against, so a vendor running its OWN alignment eval (did:web:anthropic.com evaluating an anthropic model) raised NO warning. Populate this with the model owner's DID to make 'evaluator != owner' a CHECKABLE in-band fact. When modelOwnerDid == evaluatorDid the run is a SELF-EVALUATION (structurally valid — a vendor MAY publish its own alignment eval — but NOT independent third-party evidence); the dry-run emits a non-blocking `self_eval` advisory (mirrors eval.run cycle 1170 / review self_review cycle 1154). ⚠ NOT in the embedded `signature` pre-image (cycle 1172, same posture as review.subjectAuthorDid per cycle 1155): an offline signature-only verifier can have modelOwnerDid rewritten/deleted undetected, so for tamper-evident evaluator-independence verify the full-body W3C DataIntegrityProof envelope at /credentials/<sha>/v1.

# properties.supersedes.description
Optional attestationId of a prior eval this supersedes. Re-evaluation after a safety fine-tune emits a new attestation that supersedes the prior.

# properties.regulatoryContext.properties.euAiActArticle55Applicable.description
True when the model meets the GPAI systemic-risk threshold (Article 55; 10^25 FLOPs training-compute proxy or Commission designation). Required-by-law adversarial-testing documentation; this attestation satisfies the control.

# properties.regulatoryContext.properties.executiveOrder14179Applicable.description
True when the model is subject to the US AI Executive Order obligations (currently EO 14179 + successor framework after EO 14110 revocation Jan-2025). Pre-deployment reporting through the US AISI.

# properties.regulatoryContext.properties.ukAisiVoluntaryCommitmentApplicable.description
True when the model developer made the UK AISI voluntary pre-deployment commitment (Bletchley Park, Seoul + AI Action Summit Paris Feb-2025 + India Mar-2026 cycles).

# properties.regulatoryContext.properties.anthropicRspApplicable.description
True when this attestation feeds Anthropic's Responsible Scaling Policy v2.2 deployment-gate evidence trail (ASL-3+ deployment requires documented adversarial evaluations).

# properties.regulatoryContext.properties.openaiPreparednessApplicable.description
True when this attestation feeds OpenAI's Preparedness Framework v2 deployment-gate evidence trail.

# properties.regulatoryContext.properties.deepmindFsfApplicable.description
True when this attestation feeds DeepMind's Frontier Safety Framework deployment-gate evidence trail.

# properties.regulatoryContext.description
Regulatory-context flags. Lets a downstream auditor filter attestations by regulatory regime + lab-specific scaling-policy obligation. Optional but strongly recommended for evalCategory in {cbrn-uplift, autonomy-capability, cyber-capability, weapons-uplift, self-exfiltration, scheming-deceptive-alignment}.

# properties.ipAttestationEventId.description
Optional: UUID of the ip.attestation.event.v1 wire row that envelopes this attestation for transport.

# properties.chain.properties.parentSha256.description
Sha256 of the canonical-JSON bytes of the parent attestation. For an alignment.attestation the parent is the ip.experiment.receipt.v1 of the training run whose checkpoint was evaluated (model weights → eval). ⚠ Cycle 493 honest-disclosure (adversarial-auditor AA-485-P2-4): the platform does NOT verify parent-existence at issuance. A syntactically-valid 64-hex sha256 satisfies this pattern but the bytes may not resolve in any attestation store. Consumers walking the chain MUST resolve parentSha256 against their own attestation registry; see /docs/verification-recipe.md.

# properties.chain.properties.parentKind.description
Kind identifier of the parent attestation. alignment.attestation anchors to the experiment-receipt of the model checkpoint being evaluated.

# properties.chain.properties.parentAttestationId.description
Optional UUID of the parent attestation — convenience for consumers that index by id rather than by sha256.

# properties.chain.description
Cycle 780 (sc-772-P0-1 partial close, batch 1/4): uniform upward chain link per the cycle-484 substrate. Pre-cycle-780 alignment.attestation had no chain.parentSha256, breaking the wedge-traversal contract for the load-bearing safety-eval lifecycle (dangerous-capability evals, RSP-tier assignments, AISI/UK/EU enforcement contexts under EU AI Act Article 51 for general-purpose models with systemic risk). The block is OPTIONAL (not in required[]) so back-compat is preserved — pre-cycle-780 attestations continue to validate; new issuers populate the chain.

# properties.signature.description
Ed25519 signature (128 hex = 64 raw bytes) over the canonical-JSON bytes of (attestationId ⊕ modelId ⊕ modelVersionSha256? ⊕ evalSuiteId ⊕ evalSuiteSha256 ⊕ evalCategory? ⊕ scores? ⊕ resultsSha256? ⊕ judgeStack? ⊕ rspTier? ⊕ modelClassification? ⊕ humanReviewerDid? ⊕ evidenceArtifactShaArray? ⊕ evaluatedAt ⊕ evaluatorDid ⊕ supersedes? ⊕ regulatoryContext? ⊕ ipAttestationEventId?). Verify against the publicKey published in the evaluatorDid's JWKS. RFC 8037 + JCS (RFC 8785). ⚠ INTEGRITY GAP (aa-824-P0-1, cycle 829 honest disclosure): `chain.*` and `extra` are presently OUTSIDE this signature pre-image. A wire-path or post-hoc rewrite of `chain.parentSha256` / `chain.parentKind` / `chain.parentAttestationId` does NOT invalidate this `signature`. Offline verifiers using `signature`+`publicKey` (the documented embedded-verification path) MUST treat `chain.*` as ADVISORY pointer-shape, NOT cryptographically bound to this attestation. For full-integrity verification including chain pointers, fetch the W3C DataIntegrityProof envelope from /credentials/<sha>/v1 and verify against the proof.cryptosuite=eddsa-jcs-2022 signature (which signs the FULL canonical-JSON body including chain). Cycle-484 added the chain block; cycles 778-784 swept it; the signature pre-image was not re-derived. Migration target: v2 schema slug ($id pin per cycle-462). Cycle 829 closes the 5/5 wedge-tier fan-out; see cycles 825-828 for the prior disclosures (review + experiment + leaderboard + governance).

# properties.publicKey.description
Ed25519 public key (32 raw bytes = 64 hex) corresponding to the signature.