# HXP-001 — Core Evidence Capsule 2.0

Status: Candidate Standard 0.1
Protocol: `helix-auth/2.0`
Profile: `.hlx/ie-1`

## Purpose

The capsule binds exact evidence, a physical-subject description, a deterministic evidence template, an issuance policy, signatures, provenance, and transparency material into a portable ZIP-compatible `.hlx` package. It proves integrity and authority; it does not by itself prove that a freshly observed object is the enrolled subject.

## Evidence root

`EvidenceRootV1 = SHA3-512("HELIX-EVIDENCE-ROOT-V1" || 0x00 || deterministic-CBOR(input))`.

The input contains the certificate identifier, subject descriptor, evidence profile, evidence template, canonical inventory, content hash, metadata hash, and issuance policy. ZIP order, compression, timestamps, comments, and container bytes are excluded. The evidence root therefore survives restapling and storage-layer changes.

## Package safety

Verifiers must reject absolute paths, drive paths, backslashes, empty path segments, `.` or `..`, control characters, duplicates, more than 256 entries, entries above 50 MiB, total expansion above 200 MiB, and declared compression ratios above 100:1. Unknown mandatory profile versions fail closed. Unknown optional files may be ignored only after inventory validation.

## Issuance

Issuance is resumable and idempotent. Evidence and metadata are frozen before signing. Every configured signature must complete before activation. The v2 checkpoint is sealed before the initial package is written. Physical commissioning is a later signed event and produces a new package version without changing the evidence root.

## Legacy

`helix-auth/1.0` remains readable. It is never upgraded in place. A v2 bridge may commit to the v1 signed manifest and exact evidence, but must emit `LEGACY_CREDENTIAL_VALIDITY_ONLY`, `INTRINSIC_MATCH_UNAVAILABLE`, and `PHYSICAL_BINDING_UNVALIDATED` until new evidence is enrolled.