Regulatory report canary

contracts/regulatory-report-canary-receipt.v1.json is the first internal regulatory-report canary for Crisis Monitor. It covers one versioned synthetic aggregate fixture only. It contains no incident text, user data, account data, cookies, tokens, contact details or provider payloads.

The contract lock pins QazStack v1.54.9 at fc2c2d3e75edc7ae8dd7ef97280466e8949a1ed3; an optional verifier argument checks the exact schema digest. The check preserves the source period, minimized input digest, data rights, deterministic methodology, model state, limitations and unresolved risks. compliant and automatic signatures are prohibited.

Run the local conformance check:

python scripts/verify_regulatory_report_canary.py \
  --qazstack-schema /path/to/qazstack/schemas/qazstack-regulatory-report-receipt-v1.json

This does not create an operational archive receipt. It stays pending_qazlake_append_approve_readback until the QazLake runtime has accepted the sanitized payload, an independent reviewer has approved it, and a readback receipt binds the same digests. External and statutory reports require an authorized human signatory; this system never supplies legal approval.