# description
Leaderboard-tier attestation envelope — the THIRD tier in IntelligencePro's 5-tier cryptographic chain-of-custody wedge (R16 cross-cutting). **WHEN THIS SCHEMA SHIPS, 5 OF 5 WEDGE TIERS ARE COMPLETE**: pipeline (R14 D1, cycle 314) → experiment (R16 M1, cycle 317) → LEADERBOARD (R15 B1, THIS — cycle 318) → review (R16 R3, cycle 316) → governance (R14 G1, cycle 315). Closes SYNTHESIS-acquisition Round 15 P1 [[ai-evaluation-leaderboards]] B1 cp/bench-attest@v1 ship-first action. Per-leaderboard-submission receipt binding {leaderboardId, leaderboardVersionSha, benchmarkSha, modelId, modelVersionSha, scoreNumeric, scoreContextSha, scaffoldDelta, contaminationCheck, runnerDid, signature}. The LOAD-BEARING field is scoreNumeric + scoreContextSha — pins THE NUMBER the model claimed and the CONTEXT (which benchmark version + which split + which scaffold). Defeats the LMArena 2025-04 36-Llama-4-variants contamination pattern (where Meta tested 36 variants + asymmetric battle allocation) and the Berkeley RDI 2026 8-benchmarks-exploitable-to-~100% contamination class. Designed for: LMSYS LMArena (rebranded Jan-2026; $1.7B raise; lmarena.ai) + SWE-bench (Verified top Claude Mythos 93.9% / Pro Scale GPL+private 250-turn SEAL scaffold 57% / Multimodal -15-25pp) + HumanEval (saturated; LiveCodeBench replacement) + HF Open LLM Leaderboard (archived 2024-06 → OpenEvals/every-leaderboards + EuroEval successors) + MTEB v2 + MMTEB (Gemini Embedding leads English; NVIDIA Llama-Embed-Nemotron-8B leads multilingual; Cohere Embed v4 first multimodal) + HELM (Stanford CRFM; maintenance mode 2026-06-01) + ARC-AGI-2 (GPT-5.5 85%; human 66%) + MMLU-Pro (Qwen3.6 Plus 88.5%) + GPQA Diamond (Claude Mythos 94.6%) + HLE (Claude Mythos 64.7%) + FrontierMath (Epoch closed) + BFCL v4 + GAIA (Claude Sonnet 4.5 74.6% — Princeton HAL scaffold; 7pp scaffold delta documented) + OSWorld-Verified + LiveCodeBench + Artificial Analysis Intelligence Index v4.0 (10-eval composite). One JSON Schema × every leaderboard surface.

# $comment
Discovery: https://ip.tekton.cc/.well-known/ip-knowledge.json (full descriptor) | Badge: https://ip.tekton.cc/api/badge/v1/attestation/leaderboard.receipt.v1/<subjectSha256> (shields.io endpoint) | Free dry-run: POST https://ip.tekton.cc/api/credentials/dry-run with body {kind:"leaderboard.receipt.v1", body:<candidate>} (no auth required, validates against this schema) | Verification recipe: https://ip.tekton.cc/docs/verification-recipe.md (3-layer trust model + curl trail) | Revocation: https://ip.tekton.cc/credentials/status/v1 (W3C BitstringStatusList v1.0; check bit at credentialStatus.statusListIndex)

# properties.schemaVersion.description
Semver of this schema. Bumps to 2.0.0 land at /credentials/leaderboard-receipt/v2 — v1 stays immutable (see /docs/schema-versioning.md for the cycle-726 canonical bump-mechanics + soft-change-detection contract).

# properties.rmfFunctionHint.description
Cycle 487 (cycle-483 follow-up): non-required NIST AI RMF 1.0 function hint. Leaderboard receipts map to MEASURE (MEASURE-2.3 'compare AI system performance against benchmarks') — ranking against a held-out set is the canonical measure-against-benchmark action. Default 'measure'. Companion to ip.governance.compliance.v1.rmfFunction.

# properties.chain.properties.parentSha256.description
Sha256 of the canonical-JSON bytes of the parent ip.experiment.receipt.v1 (the training/eval run whose outputs this leaderboard receipt ranks). Lets a verifier walk upward from the leaderboard placement to the underlying experiment without re-querying. ⚠ Cycle 493 honest-disclosure (adversarial-auditor AA-485-P2-4): the platform does NOT verify parent-existence at issuance. A syntactically-valid 64-hex sha256 satisfies this pattern but the bytes may not resolve in any attestation store. Consumers walking the chain MUST resolve parentSha256 against their own attestation registry (the platform exposes no by-sha lookup as of cycle 493); see /docs/verification-recipe.md for the canonical walk. A dangling parentSha256 is an UNVERIFIED chain link, NOT a verified absence — distinguishing 'platform issued an unresolvable parent pointer' from 'parent was revoked and evicted' requires consumer-side state.

# properties.chain.properties.parentKind.description
Kind identifier of the parent attestation. Cycle 499 (EHO-493-F7 fan-out): pre-cycle-499 the enum was [experiment.receipt] only — but the wedge's canonical leaderboard flow is experiment → eval-run → leaderboard, with the eval-run carrying the actual benchmark numbers the leaderboard ranks. Allowing ip.eval.run.attestation.v1 as parentKind closes the structurally-broken chain the eval-harness audit (EHO-493-F7) flagged. experiment.receipt remains accepted for direct experiment→leaderboard flows that bypass eval-run (rare but valid).

# properties.chain.properties.parentAttestationId.description
Optional UUID of the parent attestation — convenience for consumers that index by id.

# properties.chain.description
Cycle 484 (RC-480-F2 P0 fix): uniform upward chain link. See ip.experiment.receipt.v1.chain.description for full rationale.

# properties.receiptId.description
Unique RFC 4122 UUID v4 or v7 — this leaderboard receipt's canonical identifier. Lets a consumer dedupe across retries + replays and link this attestation back to a ip.attestation.event.v1 wire row via ipAttestationEventId.

# properties.leaderboardId.description
Stable handle for the leaderboard surface. Examples: 'lmsys-lmarena' / 'swe-bench-verified' / 'swe-bench-pro' / 'swe-bench-multimodal' / 'hf-open-llm-leaderboard-archive' / 'openevals-every-leaderboards' / 'eurolen' / 'mteb-eng-v2' / 'mmteb' / 'helm-lite' / 'helm-capabilities' / 'helm-instruct' / 'arc-agi-2' / 'mmlu-pro' / 'gpqa-diamond' / 'hle' / 'frontiermath' / 'bfcl-v4' / 'gaia' / 'osworld-verified' / 'livecodebench' / 'artificial-analysis-intelligence-index-v4'. Lowercase + hyphen + digit so the value doubles as a URL slug. Communities own their own leaderboardId namespace.

# properties.leaderboardVersionSha256.description
Sha256 of the canonical leaderboard-spec artifact at submission time. For SWE-bench Verified: sha256 of the verified-task-set manifest. For HELM: sha256 of the HELM scenarios manifest at the build. For LMArena: sha256 of the active model-roster + sampling-policy. Pins WHICH VERSION of the leaderboard the model was evaluated against. Without this, leaderboard authors could silently amend the eval methodology between submissions.

# properties.benchmarkSha256.description
Sha256 of the canonical benchmark dataset bytes (or canonical-JSON manifest of multi-file benchmark). LOAD-BEARING contamination defense: pinned benchmark sha makes the LMArena 2025-04 36-Llama-4-variants pattern (Meta tested 36 variants + asymmetric battle allocation per Cohere+Stanford+MIT+Ai2) detectable. For held-out / private-test-set benchmarks (Scale-SEAL, ARC-AGI-2 private): sha256 of the held-out subset. Composes with ip.sandbox.run.attestation.v1 (cycle 307) taskSetSha256 — when leaderboard runs in sandbox, the two MUST match for consistency.

# properties.modelId.description
Identifier of the model that achieved the score. Format is ecosystem-conventional. Examples: 'claude-opus-4-7-2026-04-16', 'gpt-5.5-2026-04-14', 'gemini-3.1-pro-preview', 'llama-3.1-70b-instruct'. Opaque to the wire schema; semantic verification is downstream.

# properties.modelVersionSha256.description
Optional sha256 of the canonical model-weights artifact. Pins WHICH WEIGHTS achieved the score. For closed-API models: vendor-published version-binding manifest sha. For OSS: sha256 of safetensors / GGUF. Defeats the 'I cited the leaderboard but my model_id resolves to different weights today' failure mode (R17 P3 inference-saas vendor-silent-version-bump class).

# properties.experimentReceiptId.description
When the model that achieved this score was produced by a CP-attested training experiment, the receiptId of ip.experiment.receipt.v1 (cycle 317). Chains UPSTREAM to the experiment tier — the leaderboard score is CAUSALLY LINKED to the training run that produced the model. End-to-end chain: ip.pipeline.facet (314) → ip.experiment.receipt (317) → ip.leaderboard.receipt (THIS — 318).

# properties.experimentModelOutputShaEcho.description
Cycle 1183 (eval-harness-operator cycle-1182 P3): when experimentReceiptId is present, the issuer SHOULD echo back the referenced ip.experiment.receipt.v1's modelOutputSha256 here — the experiment-receipt contract says modelOutputSha256 is the sha256 of the OUTPUT model artifact the training run produced, and this leaderboard's modelVersionSha256 pins WHICH WEIGHTS achieved the score. When experimentModelOutputShaEcho AND modelVersionSha256 are both present, the dry-run validator (/api/credentials/dry-run) enforces experimentModelOutputShaEcho === modelVersionSha256 (keyword experimentModelOutputMismatch): the weights on the board MUST be EXACTLY the weights the cited experiment produced, else the upstream chain is broken (a fabricated board entry cites a real training run that produced a DIFFERENT model). Mirrors the cycle-661 sandboxTaskSetShaEcho === datasetSha cross-attestation contract. Optional + strictly additive: omitting the echo leaves the chain ADVISORY (experimentReceiptId still points upstream, but the model-binding is not dry-run-verifiable) — a relying party that needs the binding can require this field's presence. ⚠ like sandboxTaskSetShaEcho, this echo is currently OUTSIDE the cycle-318 signature pre-image documented on `signature`; a future v2-slug pre-image widening should fold it in so a forged echo invalidates the signature.

# properties.evalRunIds.description
Array of ip.eval.run.attestation.v1 runIds (cycle 308 — R20 EV1) that PRODUCED this leaderboard submission. A leaderboard receipt typically references 1+ eval-harness runs (Inspect AI, Promptfoo, lm-eval-harness, DeepEval, RAGAS) that scored the model. Composite leaderboards (Artificial Analysis Intelligence Index v4.0 = 10-eval composite of GDPval-AA / 𝜏²-Bench Telecom / Terminal-Bench Hard / SciCode / AA-LCR / AA-Omniscience / IFBench / HLE / GPQA / CritPt) carry N evalRunIds[].

# properties.sandboxRunIds.description
Array of ip.sandbox.run.attestation.v1 runIds (cycle 307 — R21 SB1) that the leaderboard score was derived from. For sandbox-based agent benchmarks (OSWorld, WebArena, AppWorld, SWE-Gym, Mind2Web, Terminal-Bench, τ²-Bench), this is the chain link. Berkeley RDI 2026 contamination defense composes here.

# properties.scoreNumeric.description
The leaderboard score itself, serialized as a string to preserve precision across domain edge cases (decimal places, percentages, win-rates, ELO ratings, composite indices). Examples: '93.9' (SWE-bench Verified pass-rate %), '1424' (LMArena ELO), '0.8460' (HELM accuracy), '64.7' (HLE), '0.74' (GAIA). String preserves canonical display form.

# properties.scoreContextSha256.description
Sha256 of the canonical context the score was emitted in. For benchmarks with multiple variants: sha256 of (variant + split + scaffold + sampling-params + temperature). For composite indices (Artificial Analysis): sha256 of the canonical weighting recipe. Required because the SAME scoreNumeric can mean different things in different contexts; pinning the context defeats the 'I cited 85% but on which split / with which scaffold' failure mode.

# properties.scaffoldDelta.description
Optional scaffold-delta metric per R15 P1: GAIA Claude Sonnet 4.5 documented a 7pp scaffold delta with Princeton HAL — bare-model vs scaffolded-model performance gap. When the leaderboard submission used a scaffold layer, this field surfaces the delta so downstream consumers can compare apples-to-apples across reports.

# properties.contaminationCheck.properties.method.description
Contamination-check methodology applied. 'asymmetric-battle-detected' added per R15 LMArena scandal (Meta's asymmetric battle allocation 2025-04). 'none' = no check (operator made-explicit).

# properties.contaminationCheck.properties.overlapRatio.description
When method is n-gram-match or embedding-similarity: fraction of benchmark items overlapping with model's training corpus. When method is canary-string: fraction surfaced verbatim (high = contamination).

# properties.contaminationCheck.properties.berkeleyRdi2026Resistant.description
True when the leaderboard's design is robust to Berkeley RDI 2026 contamination class (8 benchmarks exploitable to ~100% via prompt-tuning). Default false; vendor or independent verifier sets true with audit.

# properties.contaminationCheck.description
Optional contamination-check metadata. R15 P1 LMArena scandal + R21 P2 Berkeley RDI 2026 establish contamination as the load-bearing concern in leaderboard attestation.

# properties.submittedAt.description
Epoch milliseconds when the score was submitted to the leaderboard. Required because leaderboards evolve over time — a top-3 today is not necessarily top-3 next week.

# properties.validUntil.description
Optional epoch milliseconds when this leaderboard receipt's claim expires. For point-in-time leaderboard archives (HELM going maintenance-mode 2026-06-01), set to the archive date. For live leaderboards (LMArena), absent.

# properties.rank.description
Optional rank at submittedAt. Mutable downstream by new submissions; downstream consumers should treat as point-in-time, not a permanent attribute.

# properties.totalSubmissions.description
Optional total number of submissions on the leaderboard at submittedAt — context for the rank field.

# properties.judgesDigest.description
When this receipt is peer-attested by 3+ independent verifiers, the canonical digest of the judges manifest.

# properties.ipAttestationEventId.description
When this receipt was emitted as a ip.attestation.event.v1 row (R11 T1) to the platform's pipeline, the eventId of that wire row.

# properties.runnerDid.description
DID of the entity that submitted the score. did:web for institutional submitters (did:web:openai.com, did:web:anthropic.com, did:web:scale.com); did:key for individual researcher. LOAD-BEARING — leaderboards consume runnerDid as the identity anchor. When an institutional submitter is later found to have gamed the eval (LMArena Meta 36-variants Apr-2025), the DID is the verifiable trail.

# properties.signature.description
Ed25519 signature (128 hex chars = 64 raw bytes) over the canonical-JSON bytes of (receiptId ⊕ leaderboardId ⊕ leaderboardVersionSha256 ⊕ benchmarkSha256 ⊕ modelId ⊕ modelVersionSha256? ⊕ experimentReceiptId? ⊕ evalRunIds? ⊕ sandboxRunIds? ⊕ scoreNumeric ⊕ scoreContextSha256 ⊕ scaffoldDelta? ⊕ contaminationCheck? ⊕ submittedAt ⊕ validUntil? ⊕ rank? ⊕ totalSubmissions? ⊕ judgesDigest? ⊕ ipAttestationEventId? ⊕ runnerDid). Verify against the publicKey published in the runnerDid's JWKS. RFC 8037 (Ed25519 in JWS) canonicalization rules apply: JCS (RFC 8785) ordering on the inner object. ⚠ INTEGRITY GAP (aa-824-P0-1, cycle 827 honest disclosure): `chain.*` and `extra` are presently OUTSIDE this signature pre-image. A wire-path or post-hoc rewrite of `chain.parentSha256` / `chain.parentKind` / `chain.parentAttestationId` does NOT invalidate this `signature`. Offline verifiers using `signature`+`publicKey` (the documented embedded-verification path) MUST treat `chain.*` as ADVISORY pointer-shape, NOT cryptographically bound to this attestation. For full-integrity verification including chain pointers, fetch the W3C DataIntegrityProof envelope from /credentials/<sha>/v1 and verify against the proof.cryptosuite=eddsa-jcs-2022 signature (which signs the FULL canonical-JSON body including chain). Cycle-484 added the chain block; cycles 778-784 swept it; the signature pre-image was not re-derived. Migration target: v2 schema slug ($id pin per cycle-462). See cycles 825 + 826 for the prior disclosures in this fan-out.

# properties.publicKey.description
Ed25519 public key (32 raw bytes = 64 hex) corresponding to the signature above.

# properties.extra.description
Open extension slot — leaderboard-specific payload (LMArena vote counts + CI bounds, SWE-bench Verified per-task pass map, MTEB per-language sub-scores, HELM per-scenario breakdown). Consumers MUST ignore unknown keys.