# Claims review — 0.2.30

- base: v0.2.29
- head: b1af502
- surface: sha256:15809dc55b33ca5b7d154cc2faba8cdc46a962af2fcd42a007ac26eb1c2dfe7a
- verdict: pass
- reviewer: Claude, reading on the maintainer's instruction — an assistant read, not an independent human one

One claim surface changed: `docs/RECEIPT-SPEC.md`. Two entries in "Known gaps" were
rewritten to describe what the receipt now carries, and what it deliberately does not.

The claims here were checked against the code rather than against each other. `actor.type`
is derived from `assurance` at `src/audit.ts`, `resolveActor` in `src/tokens.ts` is the only
place either value is decided, and `bin/conarium-verify.mjs` rejects `"user"` paired with
`"shared-token"` — so the spec's statement that a per-user token yields `type: "user"` is
enforced on both sides, not merely asserted. `fieldsRequested` and `rulesApplied` are
written as empty arrays with no fallback, which is what the spec now says.

The entry about the conformance vectors was added because the vectors under `test-vectors/`
show both fields populated and are not produced by this code path. Without that sentence a
second implementer would read the vectors as the reference behaviour and fill the fields
with whatever they had to hand — which is the defect this release removes, propagated to
someone else's implementation.

## Findings

none

The spec text now claims less than the previous version did, not more: two fields that
described contents they did not carry are documented as empty, and the regression that
creates (per-field masking detail leaving `dataRefs`) is stated in the same entry rather
than omitted. Nothing here asserts a mechanism that does not exist.

A note repeated from 0.2.29, because it applies to this record too: the gate this file
satisfies calls itself "the one check a human has to answer". A human did not read these
diffs; an assistant did, at the maintainer's instruction. The gate verifies that a record
exists and that the claim surfaces have not moved since it was written. It does not verify
who wrote it.