Step 2. What the protocol defines

GRACE defines five specification layers. Each one carries a guarantee from step 1, and each maps to code rather than to intent.

Layer	Defines	Implemented in
SPEC-01	Prompt unit contract and the enumerated failure modes	@stratt/schema
SPEC-02	Blake3 fingerprint over canonical serialisation, four verification states	@stratt/fingerprint
SPEC-03	Dependency graph, cycle detection, domain isolation	@stratt/graph
SPEC-04	Gate checkpoints, four terminal states, protected agents	@stratt/graph and the CLI
SPEC-05	Execution traces, quality scoring, regression detection	@stratt/cli

The one to understand first

SPEC-02, because it is what makes the other four checkable rather than asserted.

A unit is hashed over a canonical serialisation, producing blake3: followed by 64 hex characters. That string is a claim about a specific sequence of bytes that anyone can re-derive, which converts “this was reviewed” from a statement about a process into a statement about an artefact.

The four verification states are where it does work no ordinary workflow does:

State	Meaning
unpublished	No fingerprint claimed
verified	The unit hashes to its recorded fingerprint
drift	The unit changed and the record did not
tampered	The record was changed to match a unit that was not approved

Git can tell you a file changed. It cannot separate a change that followed the approval path from a change that edited the approval to fit. drift and tampered are that distinction, and a chain’s fingerprint is the Merkle root over its steps, so a chain cannot verify while one of its units has quietly moved.

The layer-by-layer implementation map, including which package holds each failure-mode check, is STRATT Integration.

Step 3. Run a command