Portable Certification Container

Problem

The same data can be serialized in different ways — key ordering, number formatting, whitespace, Unicode escaping — so two systems produce “identical” data with different bytes, and different hashes. There is no standard for proving that two systems produced byte-identical results from the same input. Without that guarantee, certification and audit trails are meaningless.

What Shipped

PCC defines a complete deterministic pipeline from raw input bytes through parsing, validation, normalization, and hashing to a final certification report. The pipeline runs nine phases, anchored by a single SHA-256 manifest hash that binds every normative artifact into a Merkle-like integrity chain — verification needs no network, no certificate authority, and no trusted third party. Authority is split between a prose specification and machine-verifiable JSON artifacts, and the artifacts prevail where the two conflict. Determinism is enforced by hard constraints: integer-only numbers, a strict parse gate with deterministic error precedence, a profiled JSON Schema Draft 2020-12 subset, and conformance defined as byte-identical output across a test-vector suite.

Proof

The guarantee is absolute within scope: given identical inputs and identical normative artifacts, any conforming implementation produces a byte-identical report. PCC was produced through an automated iterative audit methodology — designs submitted to independent AI auditors in blind sessions, findings resolved without feature creep, repeated until convergence. The same methodology has been applied across 10+ system designs.

Status

Version 4.0. Commercially licensable.