# description
Per-cited-case attestation envelope binding {cited-source-database, source-document-sha, claimed-holding-sha, agent-DID, runner-DID} to a cryptographic chain that defeats the LOAD-BEARING hallucinated-citation crisis. Closes SYNTHESIS-acquisition Round 21 P1 [[patent-and-legal-databases]] LP1 ship-first action. The legal-citation hallucination crisis has produced concrete court-imposed market signal: 1,227+ documented incidents; $145K Q1-2026 sanctions; Sixth Circuit Mar-2026 $15K per attorney + fees ruling; 300+ federal-judge standing orders mandating AI-citation disclosure; DoNotPay FTC final order Jan-2025 $193K + advertising restrictions. CP's wedge: this envelope is designed to be admitted as evidence under Federal Rule of Evidence 902(13) (self-authenticating records generated by an electronic process) + ABA Model Rule 3.3 (candor toward the tribunal) WITHOUT requiring a foundation witness. Rides ABOVE Lexis Protégé's Shepard's Verify Trust Markers (launched 2026-05-07; vendor-self-signed via Lexis CA) as the independent peer-attested layer. Designed for Harvey AI ($11B val Mar-2026 / $190M ARR / 700+ logos / AmLaw-100 majority) + Westlaw CoCounsel (Thomson-Casetext acq $650M) + Lexis+ AI / Protégé + Spellbook ($50M Series B Oct-2025) + Eve.legal ($103M Series B Sep-2025 @ $1B / 450+ plaintiff firms / $3.5B settlements) + Robin AI + Paxton + LegalOn + CourtListener (Free Law Project OSS; 9M+ decisions). One JSON Schema × every legal-research database + every AI legal-citation generator.

# $comment
Discovery: https://ip.tekton.cc/.well-known/ip-knowledge.json (full descriptor) | Badge: https://ip.tekton.cc/api/badge/v1/attestation/legal.citation.attestation.v1/<subjectSha256> (shields.io endpoint) | Free dry-run: POST https://ip.tekton.cc/api/credentials/dry-run with body {kind:"legal.citation.attestation.v1", body:<candidate>} (no auth required, validates against this schema) | Verification recipe: https://ip.tekton.cc/docs/verification-recipe.md (3-layer trust model + curl trail) | Revocation: https://ip.tekton.cc/credentials/status/v1 (W3C BitstringStatusList v1.0; check bit at credentialStatus.statusListIndex)

# properties.schemaVersion.description
Semver of this schema. Bumps to 2.0.0 land at /credentials/legal-citation/v2 — v1 stays immutable (see /docs/schema-versioning.md for the cycle-726 canonical bump-mechanics + soft-change-detection contract).

# properties.attestationId.description
Unique RFC 4122 UUID v4 or v7 — this attestation's canonical identifier. Lets a consumer dedupe across retries + replays and link this attestation back to a ip.attestation.event.v1 wire row via ipAttestationEventId.

# properties.citationId.description
Bluebook-format or jurisdiction-standard citation string. Examples: '410 U.S. 113 (1973)' (US Supreme Court), 'Smith v. Jones, 2024 WL 1234567 (S.D.N.Y. 2024)' (US federal), '[2024] EWCA Civ 123' (UK Court of Appeal), 'BGH X ZR 1/24' (German Federal Court). Format is jurisdiction-conventional; CP doesn't enforce a single citation style — semantic verification is downstream.

# properties.citedSource.description
Classification of the cited source. Different evidentiary weight applies: case-law + statute + regulation have direct binding force in their jurisdiction; secondary-source + scholarly-article are persuasive only. Lets the verifier route the attestation to the right downstream weight.

# properties.sourceDb.description
Stable handle for the legal-research database where the cited document was retrieved. Examples: 'westlaw', 'lexis', 'google-patents', 'uspto-patentsview', 'epo-espacenet', 'wipo-patentscope', 'courtlistener', 'pacer', 'bloomberg-law', 'harvey-corpus', 'cocounsel-corpus', 'eu-eur-lex', 'uk-bailii'. Different databases have different canonical-text guarantees + access controls; downstream verifiers route attestation to the right re-fetch path.

# properties.sourceDocSha256.description
Sha256 of the canonical bytes of the source document at the time of retrieval. Required because legal documents are sometimes edited (typo corrections, withdrawn rulings, amended statutes) and the citation MUST be pinned to the bytes that justified the agent's claim. The verifier re-fetches from sourceDb, computes sha256, and compares. When the bytes diverge, the consumer knows the underlying source changed since the citation was attested.

# properties.claimedHoldingSha256.description
Sha256 of the canonical text of the holding / proposition the agent claimed the source supports. This is the LOAD-BEARING field: the hallucination crisis manifests when an LLM generates a plausible-looking citation + claim, but the actual document doesn't support the claim. By binding claimedHoldingSha256, the attestation lets a downstream verifier (regulator, opposing counsel, judge) re-fetch sourceDocSha256 + textually verify the claimedHolding appears or is reasonably derivable from it.

# properties.claimedHoldingText.description
Optional human-readable text of the holding/proposition. When present, must satisfy sha256(canonical(claimedHoldingText)) === claimedHoldingSha256. Lets a consumer read the claim without de-referencing — useful for in-line audit displays + Shepard's-style cross-reference.

# properties.extractionMethod.description
How the cited holding was extracted from the source document. 'llm-extracted' = an LLM read the source + emitted the claim (highest hallucination risk; this attestation is the audit trail). 'human-verified' = a human attorney verified the claim against the source (lower risk; equivalent to traditional citation practice). 'rule-based-parser' = headnote/syllabus parsing tool. 'vendor-api' = Westlaw KeyCite + Shepard's. 'manual' = unspecified workflow.

# properties.verifiedAt.description
Epoch milliseconds when the cited holding was verified against the source. Required because legal citation validity has temporal dimension — a case can be overruled, a statute repealed, a regulation rescinded. The verifier consults Shepard's / KeyCite / equivalent at verifiedAt and the result here reflects the LAW AS OF THAT INSTANT.

# properties.verificationStatus.description
Shepard's-style / KeyCite-style verification result at verifiedAt. 'good-law' = no negative treatment. 'overruled' = a higher court has overturned. 'superseded' = a statute amended the precedent. 'questioned' = a subsequent decision questioned without overruling. 'distinguished' / 'limited' = scope narrowed. 'withdrawn' = the case was withdrawn from publication. 'not-checked' = no Shepard's/KeyCite walk was performed (vendor-API access not available). When verificationStatus !== 'good-law', downstream consumers MUST surface the negative treatment to the human end-user.

# properties.agentDid.description
DID of the AI agent that generated the citation. did:web for institutional agents (did:web:harvey.ai, did:web:thomsonreuters.com); did:key for individual researcher submissions. Distinct from issuerDid below — agentDid is the DRAFTER, issuerDid is the VERIFIER. In the strongest evidentiary chain, the agent that DRAFTED a brief is distinct from the verifier that ATTESTED to the citation correctness; this attestation surfaces both.

# properties.issuerDid.description
DID of the entity issuing this attestation (the VERIFIER — the entity that confirmed the citation is accurate). did:web for institutional verifier (CourtListener, Free Law Project, Lexis, Westlaw, Harvey AI verification team); did:key for individual attorney peer-review submission. When issuerDid === agentDid, the attestation is self-attested and downstream consumers (especially courts) may discount accordingly under FRE 902(13)'s 'process' requirement.

# properties.fre902_13Asserted.description
True when this attestation is intended to satisfy Federal Rule of Evidence 902(13) (self-authenticating records generated by an electronic process). When true, the issuerDid + the cryptographic signature stack must satisfy FRE 902(13)'s 'process or system' requirement — i.e., the verification methodology must be reproducible by an independent third party. Helps audit-tooling route the attestation to the right rule-of-evidence framework.

# properties.abaRule33Asserted.description
True when this attestation is intended to support the drafting attorney's compliance with ABA Model Rule 3.3 (candor toward the tribunal). When true, the agent + attorney workflow includes citation-verification as a duty-of-candor primitive. Helps state-bar disciplinary committees evaluate AI-citation workflows.

# properties.courtJurisdiction.description
Optional jurisdiction the citation is being used IN (distinct from the citation's jurisdiction OF ORIGIN). Examples: 'US-S.D.N.Y.', 'US-Federal-Circuit', 'UK-EWCA', 'EU-CJEU', 'DE-BGH', 'CA-FCA'. Lets a regulator-facing tool route the attestation to the right court-rule + standing-order corpus (the 300+ federal-judge standing orders are largely jurisdiction-specific).

# properties.judgesDigest.description
When this attestation results from a multi-judge peer review (3+ independent verifiers per CP's standard peer-review economy), the canonical digest of the judges manifest. Chains to the same judgesDigest field used in CP's brief/artifact/eval-result/sandbox-run/eval-run/synthetic-media manifests (cycle 303 derivationRecipes documentation applies).

# properties.ipAttestationEventId.description
When this attestation was emitted as a ip.attestation.event.v1 row (R11 T1) to the platform's Kafka/Tinybird/ClickHouse pipeline, the eventId of that wire row. Lets a consumer cross-reference a legal-citation attestation back to the per-event audit log without re-deriving any hash.

# properties.shepardsVerifyTrustMarkerRef.description
When Lexis Protégé's Shepard's Verify Trust Markers (launched 2026-05-07) emitted a vendor-self-signed marker for this citation, the URL or canonical reference. CP rides ABOVE the Shepard's Verify Trust Markers as the independent peer attestation — both can coexist on the same citation.

# properties.signature.description
Ed25519 signature (128 hex chars = 64 raw bytes) over the canonical-JSON bytes of (attestationId ⊕ citationId ⊕ citedSource ⊕ sourceDb ⊕ sourceDocSha256 ⊕ claimedHoldingSha256 ⊕ claimedHoldingText? ⊕ extractionMethod? ⊕ verifiedAt ⊕ verificationStatus? ⊕ agentDid? ⊕ issuerDid ⊕ fre902_13Asserted? ⊕ abaRule33Asserted? ⊕ courtJurisdiction? ⊕ judgesDigest? ⊕ ipAttestationEventId? ⊕ shepardsVerifyTrustMarkerRef?). Verify against the publicKey published in the issuerDid's JWKS. RFC 8037 (Ed25519 in JWS) canonicalization rules apply: JCS (RFC 8785) ordering on the inner object. ⚠ INTEGRITY GAP (aa-824-P0-1, cycle 848 honest disclosure): `chain.*` and `extra` are presently OUTSIDE this signature pre-image. A wire-path or post-hoc rewrite of `chain.parentSha256` / `chain.parentKind` / `chain.parentAttestationId` does NOT invalidate this `signature`. Offline verifiers using `signature`+`publicKey` (the documented embedded-verification path) MUST treat `chain.*` as ADVISORY pointer-shape, NOT cryptographically bound to this attestation. For full-integrity verification including chain pointers, fetch the W3C DataIntegrityProof envelope from /credentials/<sha>/v1 and verify against the proof.cryptosuite=eddsa-jcs-2022 signature (which signs the FULL canonical-JSON body including chain). Cycle-484 added the chain block; cycles 778-784 swept it; the signature pre-image was not re-derived. Migration target: v2 schema slug ($id pin per cycle-462). See cycles 825-829 (5/5 wedge-tier ring) + cycle 830 (verification-recipe.md dual-path teaching) for the canonical write-up; cycle 848 fans this disclosure to the 12 remaining chain-bearing leaf schemas in one batch.

# properties.publicKey.description
Ed25519 public key (32 raw bytes = 64 hex) corresponding to the signature above. Verifier MAY prefer to resolve via issuerDid's JWKS — this field exists for offline / embedded verification when network resolution is unavailable.

# properties.extra.description
Open extension slot — jurisdiction-specific or workflow-specific payload (e.g., docket numbers, parallel citation, pin-cite, Bluebook pin-rule). Consumers MUST ignore unknown keys (forward-compat policy mirrors ip.attestation.event.v1 + ip.sandbox.run + ip.eval.run + ip.synthetic.media).

# properties.chain.properties.parentSha256.description
Sha256 of the canonical-JSON bytes of the parent attestation. For a legal.citation.attestation the typical parent is the ip.pipeline.facet.v1 attesting WHERE the legal-research database content came from (dominant path — the FRE 902(13) self-authenticating-record claim requires an upstream provenance link to the corpus the model retrieved against: Westlaw / Lexis / CourtListener / etc.), OR the ip.experiment.receipt.v1 that minted the legal LLM checkpoint (Harvey / Spellbook / Paxton model identity). ⚠ Cycle 493 honest-disclosure: the platform does NOT verify parent-existence at issuance. Consumers walking the chain MUST resolve parentSha256 against their own attestation registry; see /docs/verification-recipe.md.

# properties.chain.properties.parentKind.description
Kind identifier of the parent attestation. legal.citation typically points at pipeline-facet (the upstream legal-research database — Westlaw / Lexis / CourtListener / Bloomberg Law / Casetext / etc.; required for the Federal Rule of Evidence 902(13) self-authenticating-record path WITHOUT a foundation witness) or experiment-receipt (the legal LLM checkpoint when scope is the model identity rather than the corpus).

# properties.chain.properties.parentAttestationId.description
Optional UUID of the parent attestation — convenience for consumers that index by id rather than by sha256.

# properties.chain.description
Cycle 782 (sc-772-P0-1 partial close, continuing the cycle 778-781 sweep): uniform upward chain link per the cycle-484 substrate. ip.legal.citation.attestation.v1 is the highest-regulatory-load remaining leaf — 1,227+ documented hallucinated-citation incidents + $145K Q1-2026 sanctions + Sixth Circuit $15K/attorney ruling + 300+ federal-judge standing orders. The wedge claim 'defeats the hallucinated-citation crisis' depends on the verifier mechanically walking from the citation attestation up to a SIGNED provenance attestation of the source database. Block is OPTIONAL (not in required[]) so back-compat preserved.