A frozen delivery policy can require verification stages and a maximum fidelity-loss severity. These fields belong to the immutable delivery-policy.v1 definition bound to the environment. Callers cannot set them in render or operation requests.
{
"schemaVersion": "delivery-policy.v1",
"allowedOperations": ["xlsx.transform"],
"allowedFormats": ["xlsx"],
"requiredVerificationStages": [
"valid",
"preserved",
"intendedChangeVerified"
],
"maximumLossSeverity": "none",
"holdUntilRelease": true
}The worker evaluates this policy after the operation runs. The operation can return ok: true under the default lossPolicy: "collect". Managed execution still blocks when evidence is missing, a required stage is not pass, a loss exceeds the ceiling, or the verification output hash does not match the produced artifact bytes.
maximumLossSeverity: "none" rejects any nonempty loss ledger. The other values admit that severity and lower severities: substituted, then degraded, then dropped.
Require deliveryReady only when the operation or profile supplies the renderer and app evidence. A policy does not create evidence. It rejects results that lack it.
Optional profile-verified releases
Existing release requests retain their current v2/v3 authority path. To request profile-bound V4 authority, include a profile id, profile version, profile hash, and one persisted verification report for every artifact in the release manifest. Profile-bound releases require exactly one approved decision authority. The release transaction checks that every report:
- passed the required profile;
- names the same artifact id and SHA-256 hash as the release;
- belongs to the same execution receipt and frozen policy version;
- has not reached its evidence expiry.
The profile-bound release receipt returns the required profile identity and earliest evidence expiry. The download authority reads the persisted release binding and always enforces its profile, report, artifact, policy, approval, active-release, and expiry checks before creating a short-lived URL. Omitting profileVerification cannot bypass a stored profile binding. Add profileVerification=true when the caller also requires an unbound legacy release to fail instead of using its existing authority path.