# uibc-core

> uibc-core is a reference implementation of UIBC (Uniform Identity-Behavior
> Chain): verifiable evidence packages for AI agents, built on the LGD
> principles - Registry (有籍), Evidence (有证), Gates (有门禁).
> Status: PROPOSAL v0.2.x. Verification results are scoped proofs, not
> absolute trust claims.

Core idea: every AI agent action can be sealed into a submission.uibc
package (identity + lifecycle events + content-hashed evidence +
evidence root + optional HMAC seal), then verified offline by anyone:
`uibc verify pkg.uibc --key owner.key` exits 0 on PASS, 1 on FAIL.

Run the full suite from a clean clone (no install needed):
- python -m unittest discover tests           # 115 unit tests (incl. 11 MCP / 9 registry / 15 A2A / 9 runtime)
- python -m unittest tests.stress_test        # 7 stress scenarios
- python independent_verifier/cross_check.py  # cross-implementation check

What is verifiable today:
- Package structure, identity consistency (S1/S2)
- Lifecycle state machine L1-L7 with hash-chained events (S3)
- Evidence content hashes and evidence root (S4/S5)
- Owner seal signature, strict/open modes (S6; HMAC-SHA256 v0.2, Ed25519 v0.3 target)
- Gate decisions ALLOW(0)/DENY(2)/HOLD(3) with revocation/dispute overlays
- Certificates binding a verified package (cert-issue / cert-verify)
- Memory migration verification: Fact/Attribution/Citation/Version Preservation
- Golden fixtures: 8 attack/mutation categories, cross-checked by two
  independent implementations (70 checks, 0 disagreements)

Key files:
- README.md - 5-minute quickstart, test commands, CLI reference
- CITATION.cff / CITATION.bib - how to cite this software, the competition, and a result
- docs/citation-kit.md - citation positions, author/ORCID conventions, reproduction badges
- ai/index.md - AI discovery layer (concepts, vocabulary, verification, faq)
- docs/LGD-MedAI_问题应对手册.md - medical-AI problem-response handbook (17 problem classes, 5 KPIs, 9-jurisdiction mapping, honest boundaries)
https://zhaoxinghua09-cell.github.io/uibc-core/ - rendered site mirror (landing page, handbook, AI index)
- ai/manifest.json - machine manifest of all entry points
- docs/SPEC-PROPOSAL-v0.1.md - the spec (PROPOSAL)
- lgd-core/ - LGD Core Specification v0.1: machine-checkable three-laws spec (manifest schema + validator + 16 tests); dual-layer license (code Apache-2.0, theory text all rights reserved)
- docs/governance.md - Dispute/Correction/Revocation/Accountability/Continuity/Provenance
- docs/api-scope.md - what is public (read-only) vs local (writes)
- docs/adoption-guide.md - minimal adoption path for a small team
- fixtures/EXPECTED.md - attack fixtures with expected-vs-observed
- tests/ - 115 unit tests + 7 stress scenarios (run: python -m unittest discover tests)
- independent_verifier/ - second, spec-derived implementation + cross-check
- registry/ - append-only certificate/revocation/dispute registries + static query page (registry/index.html)
- registry_server/ - read-only HTTP access to the three registries (zero deps)
- mcp_server/ - read-only MCP server exposing verify/gate/identity (PROPOSAL)
- adapters/a2a/ - JSON-RPC 2.0 HTTP adapter: card / uibc/verify / uibc/gate / uibc/inspect
- examples/showcase.py - one agent, one full verifiable lifecycle (transcript: examples/SHOWCASE.md)
- uibc_core/runtime.py - one-line runtime hooks: record_action / seal / event / snapshot
- README.en.md - English documentation

Known boundaries (recorded, not hidden):
- HMAC is symmetric: third-party verification needs Ed25519 (v0.3)
- Key substitution is detectable only with the owner key (out-of-band pinning)
- Evidence root algorithm is provisional pending canonical-JSON ratification
- Timestamps are not independently anchored

LGD (Lifecycle Governance Doctrine / 全程治理论):
> LGD is the governance doctrine behind uibc-core. Core proposition: "Whatever
> acts autonomously must have a Registry, Evidence, a Gate, an Authority, and
> a Lifecycle." It applies the same entity-level state machine to digital
> agents and physical medical devices, with medical AI as the reference domain.
> Handbook: docs/LGD-MedAI_问题应对手册.md
> 中文：凡自治之物，有籍·有证·有门禁；同一状态机治理医疗 AI 与物理医械。