{
  "$schema": "https://protora.vulcora.se/schemas/attestation/v1.json",
  "specimen": true,
  "notice": "SPECIMEN — this shows the SHAPE of a Protora corrective-patch attestation envelope, the representative example being the Qwen2.5-0.5B full un-strip. It contains no model weights, no corrective delta, and nothing about how a correction is computed. All hashes, ids, and the signature are illustrative placeholders.",
  "attestation": {
    "id": "att_9f2c0b7e-specimen",
    "issued": "2026-07-07T00:00:00Z",
    "engine_version": "stamped-on-delivery",
    "subject_model": {
      "name": "Qwen2.5-0.5B-Instruct · abliterated",
      "maker": "huihui-ai (community)",
      "base": "Qwen2.5-0.5B-Instruct",
      "base_maker": "Alibaba · Qwen",
      "parameters": "0.5B",
      "artifact": "huihui-ai/Qwen2.5-0.5B-Instruct-abliterated",
      "artifact_sha256": "0000000000000000000000000000000000000000000000000000000000000000"
    },
    "finding": {
      "id": "fnd_1a4d-specimen",
      "class": "safety-removal (abliteration)",
      "verdict": "SAFETY-REMOVAL WITNESSED",
      "glyph": "proven",
      "witness": {
        "kind": "replayable",
        "summary": "refusal rate on a harmful battery 0.92-0.96 -> 0.00; benign / benign-adapter / adversarial controls held far below threshold; behavioral witness confirmed",
        "replay_handle": "wit_qwen_refusal",
        "replay_bundle": "/specimens/witness-replay-qwen2.5-0.5b.json"
      }
    },
    "correction": {
      "action": "full un-strip — restore the removed safety",
      "removed_behavior": "the abliteration (removed safety refusals)",
      "preservation": {
        "claim": "only the removed behavior changed, to the published coverage",
        "kind": "coverage-bounded ceiling — NOT 'provably identical everywhere'",
        "controls": "beats a random-edit control of the same size"
      },
      "reversible": {
        "supported": true,
        "un_excise_handle": "unx_b920-specimen"
      }
    },
    "coverage": {
      "stamp": "two architectures (Qwen + Llama) · small model sizes · public abliterated releases · mechanism-proven, benign + adversarial controls held · larger models, more base families & live-scale batteries STAGED",
      "ceiling": "published, never exceeded"
    },
    "abstains": [
      "larger model sizes, more base families, and live-scale batteries are staged — not claimed today"
    ]
  },
  "patch_manifest": {
    "filename": "qwen2.5-0.5b.unstrip.v1.protora-patch",
    "version": "v1",
    "format": "protora-patch/1 (opaque corrective delta — payload NOT included in this specimen)",
    "delta_included": false,
    "delta_note": "The raw corrective delta ships only under contract — signed, bound, opt-in, and rate-limited. This specimen carries the envelope and the bound-attestation reference only; the corrective delta itself is not included. Where you need the fixed model, the default deliverable is the apply-and-return cleaned model.",
    "bound_attestation": "att_9f2c0b7e-specimen",
    "bound_attestation_sha256": "0000000000000000000000000000000000000000000000000000000000000000",
    "opt_in": true,
    "auditable": true,
    "audit_trail": "every action — proposed, approved, applied, rolled back — is recorded in a tamper-evident, customer-visible trail"
  },
  "signature": {
    "alg": "ed25519",
    "key_id": "protora-attest-2026",
    "value": "SPECIMEN_SIGNATURE_not_a_real_signature_base64",
    "verify": "confirm bound_attestation_sha256 matches the patch you hold, then verify this signature against the published key"
  },
  "gates": {
    "deploy_to_shipping_model": "trust-gated — waits for the measured track record, by rule",
    "raw_delta_self_serve": "gated — signed, bound, contracted, rate-limited until measured; default deliverable is the apply-and-return cleaned model"
  },
  "disclaimer": "Evidence, not certification. Protora produces evidence; it does not certify compliance or guarantee a model is clean. Preservation is a published ceiling, not an absolute guarantee."
}