# description
Per-label attestation envelope binding {sample-bytes, label-value, labeling-rubric, labeler-identity, calibration} to a cryptographic chain. Closes SYNTHESIS-acquisition Round 19 P2 [[ai-data-labeling-marketplaces]] L1 ship-first action. SIXTEENTH JSON Schema in IntelligencePro's catalog. The upstream training-data substrate that cycle-314 ip.pipeline.facet.v1 references via inputDatasets[].snapshotSha256 — every sample in a labeled training set can now carry per-label provenance independent of the labeling vendor. Designed for the labeling-marketplace + automated-labeling ecosystem: Scale AI (SAIL division acquired Meta partnership Mar-2025; Apr-2025 acqui-hire of Meta scale-team) + Surge AI ($1B val Oct-2024 + LM-tuned-labels stack) + Labelbox (Labelbox Boost auto-labeling + alpaca-style filtering) + Snorkel AI (weak-supervision + Snorkel Flow) + SuperAnnotate ($60M Series B Feb-2024) + Label Studio (HumanSignal $25M Mar-2024) + V7 Labs (medical + computer vision) + Encord (computer-vision RLHF) + Toloka (Yandex spin-out) + Appen (legacy + LLM-tuned pivot) + iMerit + Sama (Kenya + Uganda; Time investigation aftermath) + Hive AI + Datasaur (NLP) + LightTag (NLP) + Roboflow (CV) + CVAT (Intel; open-source) + Diffgram + AWS SageMaker Ground Truth + Google Vertex AI Data Labeling + Azure ML Data Labeling + Argilla (acquired by HF Aug-2024) + Lilac (acquired by Databricks Mar-2024) + Cleanlab (mislabel detection — Confident Learning paper). Also covers the LLM-as-a-judge labeler family (Anthropic Constitutional AI + OpenAI rule-based rewards + Cohere Aya + ContextualAI KTO) and synthetic-label pipelines (Nemotron-4 340B reward + Self-Rewarding Language Models + Magpie pipelines). Composes UPSTREAM as a primitive feeding ip.pipeline.facet.v1 inputDatasets[]. Composes DOWNSTREAM with ip.eval.run.attestation.v1 (cycle 308) via labelAttestationIds[] cross-ref — eval scores can now cite per-label provenance for the golden set.

# $comment
Discovery: https://ip.tekton.cc/.well-known/ip-knowledge.json (full descriptor) | Badge: https://ip.tekton.cc/api/badge/v1/attestation/label.attestation.v1/<subjectSha256> (shields.io endpoint) | Free dry-run: POST https://ip.tekton.cc/api/credentials/dry-run with body {kind:"label.attestation.v1", body:<candidate>} (no auth required, validates against this schema) | Verification recipe: https://ip.tekton.cc/docs/verification-recipe.md (3-layer trust model + curl trail) | Revocation: https://ip.tekton.cc/credentials/status/v1 (W3C BitstringStatusList v1.0; check bit at credentialStatus.statusListIndex)

# properties.schemaVersion.description
Semver of this schema. Bumps to 2.0.0 land at /credentials/label/v2 — v1 stays immutable (see /docs/schema-versioning.md for the cycle-726 canonical bump-mechanics + soft-change-detection contract).

# properties.labelId.description
Unique RFC 4122 UUID v4 or v7 — this label attestation's canonical identifier. Lets downstream training pipelines dedupe + reorder samples across shuffles + retries.

# properties.datasetId.description
Optional identifier of the dataset this label belongs to. Format ecosystem-conventional: 'hf://datasets/<owner>/<name>@<commit>', 'scale://project/<id>', 'labelbox://<workspace>/<dataset-id>', 'surge://project/<id>'. Pinning datasetId lets a downstream consumer scope label-quality stats per dataset.

# properties.sampleSha256.description
Sha256 of the canonical bytes of the sample being labeled. For text: sha256 of UTF-8 bytes. For image: sha256 of the canonical image bytes (PNG/JPEG/WebP). For audio: sha256 of the canonical audio file bytes (WAV/FLAC/MP3). For video: sha256 of the canonical container bytes. For multi-field structured samples: sha256 of the JCS-encoded sample object. THIS is the load-bearing anchor — a downstream consumer can confirm a labeled sample is the exact bytes the labeler saw.

# properties.sampleUri.description
Optional URI of the sample (s3://, hf://, https://, file://). Optional because sampleSha256 is sufficient anchor; sampleUri is for human discovery.

# properties.labelValueSha256.description
Sha256 of the canonical JCS-encoded label-value. Label-value format depends on task: classification → {category: 'cat'}; multi-label → {categories: ['cat','dog']}; NER → {spans: [{start, end, label}]}; QA → {answer, evidenceSpans}; ranking → {ranking: ['a','b','c']}; preference-pair (RLHF/DPO) → {chosenSha: '...', rejectedSha: '...'}; instruction-tuning → {response: '...'}; bbox → {boxes: [{x,y,w,h,label}]}. Pinning this defeats the silent-label-edit class — even if the labeling UI gets edited after the fact, the original signed sha proves what the labeler actually emitted.

# properties.labelValue.description
Optional inline label payload. When present, sha256(JCS-canonical(labelValue)) MUST equal labelValueSha256. Optional because sensitive labels (e.g., medical diagnosis, legal classification) may be stored separately while the sha-anchor remains attestable.

# properties.labelTaskKind.description
Label task family. Routes downstream consumers (an RLHF trainer cares about preference-pair / dpo-preference / kto-preference; a CV training pipeline cares about bounding-box / segmentation / keypoint). 'constitutional-critique' = Anthropic Constitutional AI critique-and-revise labels. 'rubric-grading' = Apollo Research + AISI-style rubric-based eval labels.

# properties.rubricSha256.description
Sha256 of the canonical bytes of the rubric/guidelines/policy doc the labeler was instructed to apply. Required because labels mean different things under different rubrics — the same image labeled 'safe' under permissive guidelines vs 'unsafe' under strict guidelines is not the same label. Pinning rubricSha256 defeats the silent-rubric-edit class (a vendor edits the guidelines AFTER labeling completes to make scores look better).

# properties.labelerDid.description
DID of the labeler. did:web for institutional / marketplace labelers (did:web:scale.com, did:web:surge.ai, did:web:labelbox.com, did:web:snorkel.ai, did:web:openai.com for OpenAI rule-based-reward labelers, did:web:anthropic.com for Constitutional AI labelers). did:key for individual / OSS labelers. The DID resolves to a JWKS that verifies the signature.

# properties.labelerKind.description
Labeler kind. 'human' = individual human annotator. 'llm' = LLM-as-judge (Constitutional AI / rule-based rewards / Nemotron 340B reward). 'ensemble-human-llm' = LLM proposes + human confirms (Scale AI Saturn pattern). 'weak-supervision' = Snorkel labeling functions. 'synthetic' = entirely model-generated label without human review. 'expert' = domain-credentialed labeler (e.g., MD for medical labels). 'crowd' = crowd-sourced workers (Toloka, Mechanical Turk, Appen).

# properties.labelerProvenance.properties.marketplaceId.description
Identifier of the labeling marketplace (e.g., 'scale-ai', 'surge-ai', 'labelbox', 'sama', 'toloka', 'amt').

# properties.labelerProvenance.properties.workerAnonymizedId.description
Anonymized worker identifier (hash + scope, never PII). Pinning worker-id lets downstream consumers analyze inter-rater variance and label-stitch attacks without storing PII.

# properties.labelerProvenance.properties.geographicScope.description
Geographic scope of the labeler workforce (ISO-3166 country code or region: 'US', 'KE', 'PH', 'IN', 'EU', 'global'). Sama's Time investigation aftermath made this audit-relevant.

# properties.labelerProvenance.properties.compensationContext.description
Compensation context. 'fair-wage-certified' = third-party verified (BSR / Partnership on AI Responsible Sourcing); 'vendor-claim' = self-attested by vendor; 'below-living-wage-flagged' = third-party flagged. Defeats compliance-washing for SOC 2 / ISO 42001 + EU AI Act Article 10(2) training-data governance audits.

# properties.labelerProvenance.description
Optional labeler-provenance object. Captures marketplace context + workforce ethics — increasingly load-bearing for EU AI Act Annex IV technical-documentation + ISO 42001 social-impact controls.

# properties.calibration.properties.interRaterAgreement.description
Cohen's kappa or Krippendorff's alpha across raters who labeled this sample. Range [-1, 1]; values > 0.6 considered substantial agreement; > 0.8 almost perfect. Low values signal rubric ambiguity or label noise.

# properties.calibration.properties.raterCount.description
Number of independent raters who labeled this sample (replicates).

# properties.calibration.properties.qualityScore.description
Labeling-platform-emitted quality score (e.g., Scale's confidence, Surge's quality-bucket). Format vendor-defined; intended for downstream filtering.

# properties.calibration.properties.confidentLearningFlag.description
True if Cleanlab Confident Learning (NeurIPS 2021 paper, NorthCutt et al.) flagged this label as likely mislabeled. Defeats train-on-noise.

# properties.calibration.description
Calibration signals. inter-rater agreement + Confident Learning flags are key audit signals for EU AI Act Article 10(2) training-data governance.

# properties.labeledAt.description
Epoch milliseconds when the label was emitted.

# properties.supersedes.description
Optional labelId of a prior label this attestation supersedes. When a label gets re-reviewed and changes (Cleanlab flagged → corrected; rater disagreement → adjudicated), the new attestation supersedes the old. Lets a downstream consumer walk the label history.

# properties.rubricCitations.items.properties.rationaleSnippet.description
Optional snippet of the rationale for invoking this clause.

# properties.rubricCitations.description
Array of rubric clauses the labeler explicitly invoked when emitting this label. Lets a downstream auditor walk: label → which clause → original rubric. Critical for Apollo Research + AISI rubric-based grading and Anthropic Constitutional AI critique-and-revise loops.

# properties.ipAttestationEventId.description
Optional: UUID of the ip.attestation.event.v1 wire row that envelopes this attestation for transport.

# properties.chain.properties.parentSha256.description
Sha256 of the canonical-JSON bytes of the parent attestation. For a label.attestation the parent is the ip.experiment.receipt.v1 of the labeler-model training run (when labelerKind is model-or-ensemble) — the upstream training-receipt that minted the labeling model's weights. For human-labeler attestations (labelerKind: human or panel) the parentKind enum extends to ip.governance.compliance.v1 (the program governing the labeling workflow). ⚠ Cycle 493 honest-disclosure: platform does NOT verify parent-existence at issuance; consumers walk the chain against their own registry per /docs/verification-recipe.md.

# properties.chain.properties.parentKind.description
Kind identifier of the parent attestation. label.attestation anchors to the experiment-receipt of the labeling model (model labelers) or the governance-compliance row covering the human-labeling workflow (human/panel labelers).

# properties.chain.properties.parentAttestationId.description
Optional UUID of the parent attestation — convenience for consumers that index by id rather than by sha256.

# properties.chain.description
Cycle 780 (sc-772-P0-1 partial close, batch 2/4): uniform upward chain link per the cycle-484 substrate. Pre-cycle-780 label.attestation had no chain.parentSha256, breaking the traversal contract that lets a downstream auditor walk label → training-receipt of the labeler / governance row of the labeling program. The block is OPTIONAL (not in required[]) so back-compat is preserved.

# properties.signature.description
Ed25519 signature (128 hex = 64 raw bytes) over the canonical-JSON bytes of (labelId ⊕ datasetId? ⊕ sampleSha256 ⊕ labelValueSha256 ⊕ labelTaskKind? ⊕ rubricSha256 ⊕ rubricVersionTag? ⊕ labelerDid ⊕ labelerKind? ⊕ labelerProvenance? ⊕ calibration? ⊕ labeledAt ⊕ supersedes? ⊕ rubricCitations? ⊕ ipAttestationEventId?). Verify against the publicKey published in the labelerDid's JWKS. RFC 8037 + JCS (RFC 8785). ⚠ INTEGRITY GAP (aa-824-P0-1, cycle 848 honest disclosure): `chain.*` and `extra` are presently OUTSIDE this signature pre-image. A wire-path or post-hoc rewrite of `chain.parentSha256` / `chain.parentKind` / `chain.parentAttestationId` does NOT invalidate this `signature`. Offline verifiers using `signature`+`publicKey` (the documented embedded-verification path) MUST treat `chain.*` as ADVISORY pointer-shape, NOT cryptographically bound to this attestation. For full-integrity verification including chain pointers, fetch the W3C DataIntegrityProof envelope from /credentials/<sha>/v1 and verify against the proof.cryptosuite=eddsa-jcs-2022 signature (which signs the FULL canonical-JSON body including chain). Cycle-484 added the chain block; cycles 778-784 swept it; the signature pre-image was not re-derived. Migration target: v2 schema slug ($id pin per cycle-462). See cycles 825-829 (5/5 wedge-tier ring) + cycle 830 (verification-recipe.md dual-path teaching) for the canonical write-up; cycle 848 fans this disclosure to the 12 remaining chain-bearing leaf schemas in one batch.

# properties.publicKey.description
Ed25519 public key (32 raw bytes = 64 hex) corresponding to the signature.

# properties.affectsIdentifiableIndividual.description
Cycle 538 (regulatory-compliance RC-480-F9 fan-out): flag signaling that the label is assigned to an identifiable real person (e.g., a face annotation, voice classification, medical-image labeling against a named patient). When true, GDPR Article 22 + EU AI Act Article 50 data-subject-rights obligations attach: the labeled individual MUST be able to appeal the AI label, find a human reviewer, and lodge a complaint. Triggers the dataSubjectSafeguards-required allOf branch below. Defaults to absent (treated as false for back-compat); issuers MUST set it explicitly to true whenever the label targets an identifiable individual.

# properties.dataSubjectSafeguards.description
Cycle 538 (RC-480-F9 fan-out from cycle 487): same-shape mirror of ip.governance.compliance.v1.dataSubjectSafeguards (cycle 390) + ip.synthetic.media.attestation.v1.dataSubjectSafeguards (cycle 487). Required when affectsIdentifiableIndividual=true. Labels of objects, scenes, or anonymized aggregates carry no Article 22 obligation; labels of identifiable people require the structured access points so the labeled individual can appeal, find a human reviewer, lodge a complaint, and learn the retention period.

# properties.dataSubjectSafeguards.properties.appealUrl.description
HTTPS URL where a labeled data subject submits an appeal of the AI label assigned to them. MUST be HTTPS (enforced: pattern ^https://), MUST accept POST. Operator's responsibility to honor GDPR Art 22(3) right-to-human-review within the regulatory timeline.

# properties.dataSubjectSafeguards.properties.humanReviewerDid.description
DID of the human reviewer (or team) responsible for hearing appeals against this label-attestation. did:web for institutional teams, did:key for individuals. Independent identification of the human-review channel.

# properties.dataSubjectSafeguards.properties.escalationPath.description
Human-readable description of the escalation hierarchy: first-line review → supervisor → external regulator. Mirrors ip.governance.compliance.v1's escalationPath.

# properties.dataSubjectSafeguards.properties.complaintIntakeUrl.description
HTTPS URL for filing a formal complaint about the labeling policy (distinct from an appeal of a specific label). GDPR Art 77.

# properties.dataSubjectSafeguards.properties.automatedDecisionScope.description
Honest classification of how this label affects the labeled individual. Same enum as ip.governance.compliance.v1 for cross-attestation comparability.

# properties.dataSubjectSafeguards.properties.retentionPeriodDays.description
How long the operator retains the label + provenance chain before deletion. GDPR Art 5(1)(e) storage limitation.

# allOf[].$comment
Cycle 538 (RC-480-F9 fan-out): when affectsIdentifiableIndividual=true the label targets an identifiable real person, attaching GDPR Article 22 + EU AI Act Article 50 obligations. dataSubjectSafeguards becomes REQUIRED so the labeled individual has structured access points. When the flag is absent or false, safeguards are optional — labels of objects/scenes/anonymized-aggregates don't trigger Art 22. Back-compat: pre-cycle-538 records (no affectsIdentifiableIndividual field) continue to validate without safeguards.