feat(evidence): canonical evidence-envelope schema (fix #8)

[fwh888]

Fix #8: Unified evidence schema for the "Adjudicated: signed evidence" tier

Problem

The trust ladder promises signed evidence behind the Adjudicated tier, but the spec has no unified evidence schema or registry. Evidence today is self-submitted free text in a 5,000-char slot — testimony, not exhibits.

Fix

Add a canonical evidence envelope (internet-court/evidence-envelope/1):

• integrations/evidence-envelope/SKILL.md — the schema, signer-role semantics, validation, and a worked example.

Canonical envelope fields (issue request #1):

• payload.contentHash + contentUri — digest and resolvable content
• provenance[] — chain proof, timestamp logs, receipts, checksums, verify URLs
• signatures[] — with role + counter-signature flag

Signer-role semantics (issue request #2):

• interested_party / transacting_agent = LOW weight (self-reported)
• neutral_witness = HIGH weight, must be counterSignature: true at transaction time
• adjudicator = FINAL
• Trust tier derived machine-readably: unverified → self-reported → witnessed → adjudicated

Compatibility: the envelope's recursiveHash feeds the existing
genlayer-intelligent-contracts evidenceBundleHash; Kleros IPFS upload can carry the envelope as contentUri.

Files

• integrations/evidence-envelope/SKILL.md (new)
• SKILL.md (register entry in the adjudication table)

[fwh888]

🔐 Cross-audit hardening (TriForge v3 + MiniMax M3)

Reviewed the envelope design with a multi-model audit — found 5 real gaps, now fixed with Security Constraints SC-1..SC-5:

#	Severity	Gap	Fix
SC-1	CRITICAL	role is self-asserted → role spoofing to adjudicator	role bound into signed payload + signer registry
SC-2	CRITICAL	replay in window across scopeIds	monotonic chainEpoch + consumed-hash registry
SC-3	HIGH	contentUri/contentHash decoupled → payload swap	witness re-fetch + re-hash at validation
SC-4	HIGH	hostile verifyUrl → forged chain state	≥2 independent sources + data self-verifiable
SC-5	MEDIUM	canonical-JSON ambiguity → hash collision	RFC 8785 JCS mandatory

Without SC-1..SC-5 the whole arbitration can be forged to adjudicated by any party (audit score 4/10); with them, evidence is machine-verifiable. Added as ## 6. Security Constraints in integrations/evidence-envelope/SKILL.md.

[fwh888]

🔍 2nd-pass audit (MiniMax M3) — added SC-6:

• Fixed digest algorithm — SHA-256 only (multi-algorithm reopens hash ambiguity)
• Media-type binding — contentType must match fetched bytes
• Witness independence — multi-source verifyUrl must not share DNS/CDN/provider (Sybil defense)
• Bounded replay store — consumed-hash registry partitioned per scopeId

Final state: SC-1..SC-6 cover role binding, replay, payload integrity, oracle independence, canonical JSON, and algorithm/media pinning. Evidence is machine-verifiable end-to-end.