Receipts, Not Promises: Fail-Closed Governance for High-Stakes AI (Kingdom Conformance RFC v1.3.6, Public Draft)

Receipts, not promises. This Zenodo record publishes Kingdom Conformance RFC v1.3.6 (Public Draft) — a procurement-ready standard for replay-verifiable conformance receipts and deterministic validation of high-stakes AI and other machine-assisted decision artifacts. “Kingdom Conformance” is a project label (files prefixed Kingdom_Conformance_*) and does not change the technical scope. The RFC is intended for AI safety, AI governance, assurance, incident response, audit, and procurement teams who need independently replay-verifiable receipts—not unverifiable assurances. Normative scope Only the RFC PDF is normative. All other files in this record are supporting artifacts (templates, interop evidence, test vectors, verifier kits, and reviewer/auditor packets). Fail-closed posture: HOLD blocks sensitive side effects by default when evidence is missing, stale, inconsistent, unverifiable, or nondeterministic. What the standard specifies (high level) A deterministic validator output contract producing PASS / FAIL / HOLD outcomes with structured reason codes (where applicable). Replay semantics for verifying outcomes from receipts and referenced evidence within freshness bounds. Procurement-ready language and acceptance tests for fail-closed gating of sensitive operations. Interoperability foundations via minimal schemas/registry seeds and stewardship/change-control expectations. Interoperability evidence (included) This record includes a reference verifier test-vector suite and an independent minimal verifier kit, plus corresponding run logs, demonstrating replay of the published vectors across two implementations (including negative cases and freshness-boundary cases). Included artifacts: S2 (reference verifier + vectors), S8 (independent verifier), S6 + run logs (interop evidence), S7 (schemas/registry seeds), S9 (stewardship/change-control). Security considerations (snapshot) Threat model snapshot includes: forged receipts/permits; stale or substituted evidence beyond freshness bounds; and time-of-check/time-of-use (TOCTOU) drift. Public-safe by design The RFC and artifacts avoid exploit guidance and do not require disclosure of confidential implementation details by default. License / rights notice Text and supporting artifacts are licensed under CC BY 4.0 unless a file states otherwise. Patent rights are not licensed by this publication. Vendor-neutral does not mean IP-unencumbered; implementers are responsible for obtaining any necessary rights. This record is not legal advice. Integrity / verification Use SHA256SUMS.txt to verify file integrity (SHA-256) after download. How to cite Use the Zenodo “Cite as” entry after publication. Contact security@meridianverity.com