Something went wrong. Try again.
Architecture research toward an agent-native operating system; rigorous, pre-prototype, and intentionally self-aware.
Something went wrong. Try again.
Commits on master
david.boston 7f173e88 Adopt G-5 (predeclared auditable review-closure procedure) into D-012-PACKET — owner-approved 2026-09-15. Learned from the D-012 correction loop itself (rev5->rev16, twelve adversarial rounds; reviewer silence is not a stable stopping rule). Draft adversarially reviewed by reviewer:g5-draft-reviewer (verdict ADOPT-WITH-AMENDMENTS: 3 HIGH, 4 MEDIUM); the reviewer's replacement text is adopted verbatim as v2: versioned review-coverage manifest frozen before the first adversarial round; two-sided inventories (implementation-derived + contract-derived) with the reviewer's first duty being the omission attack; seven minimum Full-tier dimensions including resource/termination bounds and output/authority/information-flow; severity-precedence disposition (Critical/High always FIXED or REBUTTED; RECORD only for bounded Medium/Low with reviewer endorsement and owner approval, consumers/composition/trigger/expiry recorded); two-sided guarantee audit with OPEN-pending-versioned-amendment when a guarantee under-determines its relation; explicit precedence over external gates; prospective application — no retrospective savings claim, first applied to the hosted-proof loop. ADR-012 and DECISIONS.md note the adoption. david.boston committed david.boston 313c66de D-012 records reconciled to the coherent rev17 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769... unchanged since rev11, M-B ec76f0ed..., tests 7106e9b0..., design record ae8bdc64...), 68/68 tests, run result at head d5e9d31f4, and the full adversarial chain through reviewer:d012-rev16-verifier (PASS at rev16; its LOW docs item addressed at rev17). D-012 review loop closed. david.boston committed david.boston d5e9d31f D-012 rev17 docs-only correction (reviewer:d012-rev16-verifier LOW): the replay-index invariant text overstated the guarantee — rev15/rev16 deliberately permit non-binding catastrophic residues at lock release, and the probe demonstrates two entries simultaneously referencing one attempt whose durable binding is only one of them. The absolute 'bidirectional / durably CONSUMED with that digest' wording is replaced with the classified invariant the code actually implements: an entry is BINDING iff its referenced attempt is durably in a binding state AND that attempt's durable binding equals the entry's key; ALLOCATED/ABANDONED entries and alternate-digest entries are non-binding residues, conservatively rejected and lazily reconciled. Sole-writer and shared-lock claims preserved. No behavioral change; docs-only. 68/68 tests. david.boston committed david.boston 1d970de7 D-012 records reconciled to the coherent rev16 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769... unchanged since rev11, M-B 16117c54..., tests efe8fe1c..., design record ae8bdc64...), 68/68 tests, run result at head 5c44a5007, and the full adversarial chain through reviewer:d012-rev15-verifier. david.boston committed david.boston 5c44a500 D-012 rev16 correction (reviewer:d012-rev15-verifier MEDIUM): stale-entry reconciliation now requires the referenced attempt's durable binding to EQUAL the looked-up digest. Previously a residue entry (digest B1 -> attempt T1, ALLOCATED, from a failed commit whose compensation failed) became permanently false-binding if T1 legitimately retried with a different digest B2: the entry then pointed at a CONSUMED record, passed the state check, and B1 was rejected as replay forever despite T1's durable record showing B2. Now: a binding-state record whose binding differs from the looked-up digest is stale residue, released only after verifying the attempt's actual digest holds the canonical index entry (otherwise the unverifiable index fails CLOSED); genuine replay still requires binding-state AND binding equality; ALLOCATED/ABANDONED entries remain non-binding residue. Also: commit-boundary error objects are front-loaded (an allocation failure at the boundary can no longer prevent the typed outcome) and exception handlers narrowed from BaseException to Exception — asynchronous process-control exceptions may propagate untyped but under the reserve-first order can leave at most a non-binding self-reconciling residue, the conservative direction; the absolute typed-guarantee claim is scoped accordingly per the reviewer's residual-risk note. Injection-machinery classes hoisted to module level. Alternate-digest retry probe added and mutation-checked against the state-only guard. 68/68 tests. david.boston committed david.boston b380bcdb D-012 records reconciled to the coherent rev15 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769... unchanged since rev11, M-B b66fc0d3..., tests 37d5c3f4..., design record ae8bdc64...), 67/67 tests, run result at head 16644aaa9, and the full adversarial chain through reviewer:d012-rev14-verifier. david.boston committed david.boston 16644aaa D-012 rev15 correction (reviewer:d012-rev14-verifier MEDIUM): the two-sided replay commit was lock-atomic but not EXCEPTION-atomic — the CONSUMED attempt write and the _consumed_bindings insertion were separate potentially-allocating operations, so a failure between them (e.g. MemoryError during dict growth) left an attempt durably CONSUMED with no global replay entry, defeating global uniqueness. The commit is now exception-atomic by construction: (1) allocation is front-loaded (the CONSUMED record and index entry are prepared before the first durable write); (2) the index reservation goes FIRST — its failure leaves the attempt retryable ALLOCATED with nothing written; (3) a failure of the durable attempt write triggers allocation-free compensation (existing-key deletion) restoring the neither-side state; (4) a residue surviving even compensation failure (catastrophic only) is NON-BINDING — the duplicate check now verifies the recorded attempt's durable state, so an ALLOCATED/ABANDONED-side entry causes conservative rejection until the next consumer reconciles it away, never duplicate admission; compensation failure itself is swallowed into the typed FAIL_CLOSED outcome (guaranteed typed boundary), with the fixed detail distinguishing released vs self-reconciling reservations. Failure-injection probe added covering all three boundaries plus reconciliation and genuine-replay retention; guards mutation-checked against the rev14 commit shape and the reconciliation removal. 67/67 tests. david.boston committed david.boston 06b3f00c D-012 records reconciled to the coherent rev14 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769..., M-B 1651f216..., tests 3df54c7d..., design record ae8bdc64...), 66/66 tests, run result at head 0e5928273, and the full adversarial chain through reviewer:d012-rev13-verifier. david.boston committed david.boston 0e592827 D-012 rev14 correction (reviewer:d012-rev13-verifier HIGH): the rev13 guard (authority exists + live ALLOCATED attempt) was satisfiable by any ordinary allocation, so a caller could allocate once and then directly reserve arbitrary global digests via register_binding — denying later legitimate consumption (replay poison) or leaving orphan reservations after pre-consumption recovery. Per the verifier's correction direction, replay-index insertion is no longer an independently callable operation: the public register_binding method is REMOVED, and the global replay check + binding insertion + CONSUMED transition are ONE atomic unit inside consume (both locks held, final-point authorization already passed). The lock-release invariant is now bidirectional by construction: every _consumed_bindings entry corresponds to an attempt durably in CONSUMED with that digest, and no public call can create one side alone. Standalone-API-absence probe added (live allocation reserves nothing; only consume creates a binding; no orphan via recovery; global replay still enforced) and mutation-checked against a restored rev13-style register_binding. 66/66 tests. david.boston committed david.boston e63f9dd2 D-012 records reconciled to the coherent rev13 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769..., M-B 706f070f..., tests f90e0d89..., design record ae8bdc64...), 66/66 tests, run result at head 19ddfc878, and the full adversarial chain through reviewer:d012-rev12-verifier. david.boston committed david.boston 19ddfc87 D-012 rev13 correction (reviewer:d012-rev12-verifier finding, F1 completion): register_binding is a publicly named method and was the one remaining path that could forge a global replay reservation — it validated only the digest and inserted unvalidated authority_id/attempt_id into durable state (a constrained caller could reserve a digest with no consumed attempt, causing later legitimate consumption to be rejected as replay, and retained behavioral objects became executable on a later duplicate via the interpolated replay message). register_binding is now independently safe: every durable field validated as an exact nonempty string before any hashing/membership; the digest can only be reserved against an EXISTING registered authority whose live ALLOCATED attempt matches (no reservation without an in-flight consumption); the replay rejection detail is fixed (no retained value is ever formatted). Standalone-safety probe added and mutation-checked against the reverted form. 66/66 tests. david.boston committed david.boston 2b211cc9 D-012 records reconciled to the coherent rev12 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769..., M-B 91a42b65..., tests 59533275..., design record ae8bdc64...), 65/65 tests, run result at head 247100ee8, and the full adversarial chain through reviewer:d012-rev11-verifier. david.boston committed david.boston 247100ee D-012 rev12 corrections (reviewer:d012-rev11-verifier findings, all in unchanged M-B): (Finding 1 HIGH) closed identifier/digest/outcome grammar — _validated_token requires exact nonempty strings for authority_id, namespace, attempt_id (allocate/consume/dispatch/record_outcome/recovery_class), and binding_digest (register_binding), BEFORE any dict membership/hashing can dispatch caller hash/equality/str behavior; no caller-owned mutable object is retained as a durable key, closing the mutable-hash replay bypass; record_outcome requires the exact trusted enum string (equality-based membership cannot execute on a behavioral outcome); the policy decision must be the exact trusted ADMIT string before comparison (both creation and _authorization_checks). (Finding 2 HIGH) the malformed-time rejection detail is fixed — type(value).__name__ (metaclass attribute dispatch) removed from _validated_instant. (Finding 3 MEDIUM) caught provider/iterator exceptions are chained, never formatted — a behavioral __str__ can neither defeat typed FAIL_CLOSED normalization nor reenter during error handling (pair materialization, policy admission fallback, currentness). 65/65 tests; all three probes mutation-checked against the reverted code. david.boston committed david.boston 43c43170 D-012 records reconciled to the coherent rev11 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A ec1a2769..., M-B 735302a9..., tests 188c9cac..., design record ae8bdc64...), 61/61 tests, run result at head 658622cbc, and the full adversarial chain through reviewer:d012-rev10-verifier. david.boston committed david.boston 658622cb D-012 rev11 correction (reviewer:d012-rev10-verifier finding): the scalar whitelist used equality-based tuple membership () and formatted into the rejection detail — both can dispatch caller-controlled metaclass behavior (__eq__/__getattribute__), letting a crafted class pass the whitelist (retaining a caller-owned mutable object inside an 'immutable' generation) or reenter add() during rejection. Intake decisions are now class-identity () only, with a statically selected trusted tag per branch and a fixed rejection detail — no caller behavior can execute anywhere on the intake path. Metaclass probe test added and mutation-checked against the reverted rev10 code. 61/61 tests. david.boston committed david.boston eeefdb61 D-012 records reconciled to the coherent rev10 tuple: packet, ADR-012, DECISIONS.md, and README bind the same live identities (M-A dc13f113…, M-B 735302a9…, tests 1fa1085d…, design record ae8bdc64…), 60/60 tests, run result at head e0ed4a8cb, and the full adversarial chain through reviewer:d012-rev9-verifier. david.boston committed david.boston e0ed4a8c D-012 rev10 corrections (reviewer:d012-rev9-verifier findings): (Finding 1 HIGH) NO copy protocol executes during M-A intake — generic copy.deepcopy (which invoked caller __deepcopy__/__reduce__ behavior before exact-type rejection, enabling hook-driven normalization of unsupported values and a reentrant add() that could silently overwrite an immutable generation identity under the reentrant lock) is removed; _frozen is now a single controlled traversal that exact-type-checks every node before touching it, rejects cycles and nesting beyond depth 64 with typed FAIL_CLOSED, and produces the owned frozen canonical form used for every later check; parent and scope are derived from the owned form; the duplicate precondition is re-verified immediately before commit as defense in depth; import copy removed. (Finding 2 LOW) README onboarding no longer calls the superseded v14 packet 'current' — it links ADR-011/ADR-012 as governing and labels the v14 packet historical. 60/60 tests; copy-protocol probe mutation-checked against the reverted rev9 intake. david.boston committed david.boston 0d99fcdb D-012 records reconciled to the coherent rev9 tuple: packet, ADR-012, and DECISIONS.md bind the same live identities (M-A 987032fa…, M-B 735302a9…, tests 1faf9afe…, design record ae8bdc64…), 58/58 tests, run result at head 40c568acc, and the full adversarial chain through reviewer:d012-rev8-verifier; root README already carries the governing status from the rev9 source commit. david.boston committed david.boston 40c568ac D-012 rev9 corrections (reviewer:d012-rev8-verifier findings): (Finding 1 HIGH) the registered expiry is now an immutable CEILING for authorization — _current_bound() validates the observed bound (typed FAIL_CLOSED on removal, widening beyond the registered bound, or malformed values) BEFORE every comparison, pre- and post-callback, so a currentness callback cannot extend authority beyond its registration bound and a poisoned projection causes typed FAIL_CLOSED on every retry rather than an untyped comparison error; narrowing to a stricter bound remains permitted. (Finding 2 HIGH) non-finite floats (NaN, ±inf) are rejected from the policy value grammar — they are not reflexively comparable and could let identical policy bodies evade the same-scope fork guard and compatibility equality. (Finding 3 MEDIUM) single-snapshot intake: M-A materializes the caller's composite exactly once (deep-copy first, validation+freezing on the owned copy only, copy failures typed FAIL_CLOSED); M-B materializes the generation pair exactly once into an owned immutable two-string snapshot used for both the creation check and the stored authority (malformed pairs typed FAIL_CLOSED). (Finding 4 LOW) root README status updated to the governing record: D-011 RESOLVED (TRUSTED_RUNTIME), D-012 RESOLVED (rev9), v14/v13 implementation history explicitly labeled retained/historical. 58/58 tests; new guards mutation-checked. david.boston committed david.boston ca44cb90 D-012 records reconciled to the coherent rev8 tuple: packet, ADR-012, and DECISIONS.md bind the same live identities (M-A b9de97d4…, M-B 3c361874…, tests 74207427…, design record ae8bdc64… with the byte-identical retained body and the sixth H1 attack recorded UNRESOLVED-ENUMERATION), 53/53 tests, run result at head b11f55523, and the full adversarial chain through reviewer:d012-rev7-verifier. david.boston committed david.boston b11f5552 D-012 rev8 corrections (reviewer:d012-rev7-verifier findings): (H1) frozen encoding is now type-exact and INJECTIVE — every stored value carries an explicit type tag, so dict vs list-of-pairs, bool vs int vs float, and list vs tuple remain distinct policy structures (changed bodies classify RE_EVALUATE, never silently unchanged); only exact built-in types accepted, all scalar/container subclasses typed FAIL_CLOSED; parent-chain navigation untags the storage encoding. (H2) fork detection derives solely from the validated owned snapshot — the caller's objects are never re-read after the payload snapshot, closing the snapshot/comparison TOCTOU in both directions. (H3) post-callback temporal re-validation: a currentness callback that replaces a registered expiry bound with NaN/None/malformed values is typed FAIL_CLOSED (bound removal refused), and a callback that reentrantly commits at a later instant makes the outer earlier operation typed-fail without rolling back the monotonic clock. (M1) DESIGN-CONVERGENCE provenance corrected: body restored byte-identical to the retained record (mechanically verified) and the footer now states precisely what changed, records the six-vs-five H1 attack enumeration defect, and marks the sixth attack UNRESOLVED-ENUMERATION pending reconstruction from primary sources. (L1) embedded module/test metadata names the correction-generation history through rev8. 53/53 tests; new guards mutation-checked. david.boston committed david.boston 016d64b7 D-012 records reconciled to the coherent rev7 tuple: packet, ADR-012, and DECISIONS.md bind the same live identities (M-A e26c6f79…, M-B 6f8e3572…, tests 645a44c0…, design record 2d6be6be…), 48/48 tests, run result at head 1b1338ddd, the full adversarial chain through reviewer:d012-final-reviewer2, and the committed in-repo D-012-DESIGN-CONVERGENCE.md identity; preregistration rev3 remains explicitly labeled historical. david.boston committed david.boston 1b1338dd D-012 rev7 corrections (reviewer:d012-final-reviewer2 findings): (1) HIGH: the cross-registry composition protocol is REQUIRED — _generation_lock refuses fail-closed any generation registry that does not expose _lock, eliminating the silent no-lock path that reopened the admit-to-commit revocation race for 'conforming projections'. (2) HIGH: closed value grammar for registry-owned generation data (None/bool/int/float/str + dict/list/tuple, str keys; sets/bytes/custom mutables typed FAIL_CLOSED) plus deep-copy at add(), so caller aliases and nested mutables cannot mutate stored policy bodies after compatibility approval; fork-sibling scope comparison uses the frozen form. (3) HIGH: closed time domain — now/expires_at must be nonnegative exact ints (bool rejected), typed FAIL_CLOSED otherwise; per-authority monotonic guard rejects logical-time regression; exclusive boundary preserved (now==expires_at rejected). (4) MEDIUM: D-012-DESIGN-CONVERGENCE.md committed into the repo (byte-preserved body + provenance footer) so the ratified T-1/T-2/T-3a trigger is reproducible without session state. (5) LOW: the cross-registry race probe is parameterized across allocate/consume/dispatch. 48/48 tests; new guards mutation-verified. david.boston committed david.boston 8261433a D-012 record reconciliation to the coherent rev6 tuple: packet status RESOLVED with preregistration (rev3) explicitly labeled historical and the live rev6 identity governing; all three records (packet, ADR-012, DECISIONS.md) bind the same fresh model/test identities (M-A 9037ea07…, M-B 87da4fdd…, tests 2c1677a5…), 41/41 tests, run result at head 805540e1d, the full adversarial chain through reviewer:d012-rev5-verify2, and the ratified T-3a/T-3b split. Resolves the rev5 re-verification finding that live status/revision/hash/test-count fields disagreed across records. david.boston committed david.boston 805540e1 D-012 rev6 corrections (race windows from reviewer:d012-rev5-verify2): (1) M-A Registry gains an RLock serializing add/revoke/record_compatibility/admit; M-B composes the M-A lock UNDER its own lock (consistent order M-B->M-A) and holds both through authority creation and every final-point commit, so a concurrent generation revoke() is linearized entirely before the decision (typed REJECT) or entirely after the commit — never between admit() and the binding/state write. (2) Full post-callback revalidation in _authorization_checks: after the currentness callback returns, the attempt record is re-read fresh and every commit precondition re-validated under the same locks (revocation, expiry, attempt existence/expected state/live-slot identity, bound generation pair); commit never uses the pre-callback snapshot. New falsifiable tests: no-mutation postconditions after reentrant revocation (consume/dispatch), reentrant recovery mid-currentness (consume/dispatch), expiry-shrink mid-currentness (boundary instant), and the cross-registry linearizability probe. Mutation-verified: race probe fails without fix 1; recovery tests fail without fix 2. 41/41 tests. david.boston committed david.boston 044ca55f D-012 rev5 corrections: post-callback authority-state revalidation in _authorization_checks (reentrant revocation during currentness evaluation blocks consume/dispatch -- reviewer's focused cases); attempts' bound generation pair governs their extensions (accidental authority-pair reassignment cannot rebind); revoke() atomic under the registry lock. Tests 37/37 incl. both focused reentrant cases. Run result regenerated (37/0/0). david.boston committed david.boston 7b5897d9 D-012 rev5: atomic final-point transitions (authorization checks INSIDE the registry lock for allocate/consume/dispatch; revoke() under the lock -- no in-flight extension commits after revocation); attempts bind their generation pair; currentness callable validated/normalized to typed FAIL_CLOSED; new coverage: two-thread allocate race (single winner), generation-varying replay, duplicate-authority FAIL_CLOSED, currentness exception normalization, tombstone exhaustiveness. 34/34 tests. Machine-readable run result regenerated (head e709de506). david.boston committed david.boston e709de50 D-012 rev4 models per final review reviewer:d012-final-reviewer: registry-owned frozen immutable generation records (mutation attacks fail closed by construction); same-generation pairs preregistered admissible; M-A/M-B composition MANDATORY (admit() composes at authority creation and every extending final point -- non-ADMIT M-A outcomes typed-REJECT); currentness REQUIRED, validated callable, provider exceptions typed FAIL_CLOSED; successful completion releases the live slot (one-use attempts, not one-use authorities); atomic transitions under the registry RLock. Packet frozen identities + machine-readable run result (28/28). ADR-012 evidence reconciled to rev4. david.boston committed david.boston 2619b375 D-012 ratification: T-3 split (T-3a identity-pilot owner request / T-3b compiler-verifier assurance + malicious-candidate matrix reopening at recursive-proof milestone or candidate self-build promotion, blocking promotion until resolved) owner-ratified and adopted into ADR-012, packet, and register. Models rev3 (24/24 tests) with evaluator binding, mandatory currentness composition, durable post-dispatch retention. david.boston committed david.boston 8eb709c9 D-012 packet rev3 + models rev3 per resolution review reviewer:d012-resolution-reviewer: evaluator identity bound into generations (changed evaluator -> INVALIDATE); preregistered precedence (FAIL_CLOSED > REJECT > INVALIDATE > RE_EVALUATE); M-B currentness REQUIRED and composed with the G-3 registry at the final point (unknown/revoked generations fail closed); post-dispatch facts retained regardless of later revocation/expiry (D-004 retention) with a durable post-dispatch crash cut; one live attempt per authority with ABANDONED tombstoning; P0 ordering deviation resolved (models evaluated under the CONSTRAINED posture per owner P0-1, hostile attacks recorded as TA-1 residuals); T-3 split into T-3a/T-3b documented. 24/24 tests pass. david.boston committed david.boston e0122299 D-012 amendment: split the overloaded T-3 trigger -- T-3a (owner request) activates the identity pilot; T-3b (recursive-proof milestone begins, or any candidate self-build promotion) reopens compiler/verifier assurance and the malicious-candidate matrix. Adversarial-review gap closed; register-line fidelity: 3 of 5 concerns resolved, 2 deferred with precise reopening conditions and the trusted-assumption register TA-1..TA-4. david.boston committed david.boston 00931747 ADR-012: D-012 RESOLVED -- promotion-evidence governance contracts G-1..G-4 adopted. Lean governance resolution per owner Option A: pre-freeze TEST_ONLY assembly gate permanent; whole-file identity retained with deferred protected-worker pilot (triggers T-1/T-2/T-3); immutable policy generations with typed compatibility outcomes (M-A); final-point fresh one-use admission with global replay registry and durable D-004 crash cuts (M-B); owner P0: constrained orchestrator, TCB pricing deferred, lean caps. Models 17/17 tests; adversarial review findings addressed in rev2. DECISIONS.md register updated. david.boston committed david.boston 93b86951 D-012 packet rev2 + executable governance models M-A/M-B (rev2): policy-generation immutable registry with typed outcome table (succession/divegence/rollback/fork/revocation classes); global-replay admission/replay model with durable D-004 crash-cut tombstones, cross-authority/namespace/generation replay rejection, exclusive expiry bound, final-point currentness composition. Addresses adversarial review reviewer:d012-packet-reviewer (6 HIGH findings: crash-cut fail-open, global replay domain, divergence fail-open, generation mutability, typed outcomes, P0 ordering + trusted-assumption register added). 17/17 model tests pass. david.boston committed david.boston 15aaf44f ADR-011: D-011 RESOLVED -- TRUSTED_RUNTIME selected. Mechanical _select_validated over the G6-authorized v15-evidence-003 production bundle (sha256 327ae3eb..., _inner_validate True, exposure sets 48/28/24, unique strict subset, independent decision review 7/7 CONFIRMED). Evidence chain and D-012 inputs (pin granularity, pre-freeze assembly gate) recorded in the ADR. DECISIONS.md register updated. david.boston committed david.boston 27fe5a1e D-011 v15 Stage B ceremony rebuild (post contract amendments): artifacts rebind checkpoint A'''' 654c95d66 (tree e0c99ffe), source_map 06ece731, manifest module 22d36dd1 (213528 B), boundary manifest b93b02af (2659529 B); source-change ordinal 9 CONTRACT_AMENDMENTS_OWNER_OPTION1 (EXECUTION-ASSURANCE owner mapping restored; mutant-pair context compared modulo the runner's per-job envelope path via _pair_comparable_context with environment/case/source equality unmasked; PAIR branch lineage follows context). Engine pins unchanged (PRIMARY 89b1960b, ORACLE 37418055). TEST_ONLY seal chain; freeze payload OPEN/UNQUALIFIED/INACTIVE/FROZEN_FOR_EVIDENCE. david.boston committed david.boston 654c95d6 D-011 v15 contract amendments (owner-authorized option 1, relayed): (1) restore EXECUTION-ASSURANCE -> ASSURANCE_EXECUTOR in _owner_role (v13->v14 regression; _inner_validate requires the id); (2) controlled_mutation_context_pair compares execution contexts modulo the runner's per-job envelope path via _pair_comparable_context (the old byte-equality contract rejected all 22 real v15 witness pairs; environment/case/source equality still enforced unmasked) -- the three context-derived fields drop from paired_fields; (3) _mutation_contract PAIR branch checked_execution_lineage follows lineage (old code accepted cross-lineage pairs both directions). Boundary manifest regenerated b93b02af... (only the module self-hash changed). Adversarial review general-purpose:pair-fix-review: CORRECT+SCOPED, no blocking defects; residuals R1-R5 recorded in session ledger. david.boston committed david.boston 0a22837e D-011 v15 oracle engine fix (owner-authorized): effect_flow per-event gate replaced -- the union-of-shapes key gate (all ten EFFECT+FLOW keys on every event) denied every legitimate per-action event shape, contradicting the module's own flow_keys prelude and failing the corpus case CASE-MINIMAL_MEDIATION_CORE-EFFECT_F (v15-evidence-001 halt, v15-halt-classification-001.json). New gate mirrors the primary's per-action type guards exactly, wrapped fail-closed for engine totality (M3.5 fuzz-gate law). Pins updated (oracle sha 37418055..., oid 92ce92cc..., ast 34d9a777...); boundary manifest regenerated (06b8a211...). Validated: 114/114 corpus role agreement, 380/380 totality probes raise-free both engines, suites green except pre-existing stale pins. Adversarial pre-commit review: general-purpose:oracle-fix-review. david.boston committed david.boston b8bf6c45 D-011 v15 Stage B ceremony rebuild: artifacts rebind completed v15 source (checkpoint A″ edf85f3a0, source_map 2570987f, boundary manifest a97334f3); supersedes the intermediate pre-completion freeze in history; TEST_ONLY seal chain; freeze payload OPEN/UNQUALIFIED/INACTIVE/FROZEN_FOR_EVIDENCE. david.boston committed david.boston edf85f3a D-011 v15 production-context completion (Gaps A/B/C): reconciliation sub-protocol context follows the checked-execution boundary decision (d011_manifest emission/validation + d011_execution request builders gate-check lineage, default TEST_ONLY, accept PRODUCTION_EXTERNAL); new deterministic frozen placement-cell (1392 = 1296 COMPROMISE + 96 OMISSION/RESTORED) and BFS (21) production builders emit born-lineage records validated by the frozen _placement_contract/_bfs_contract (no engine/checker calls; unique strict-subset profile TRUSTED_RUNTIME); negative+positive tests added; boundary manifest regenerated via the pure generation path canonical(manifest_spec()) sha256 a97334f339ece0397a6dc41581154b2ece8e0d67596058676092b12f74bb02ea. TEST_ONLY discipline unchanged; engines and all other modules untouched; promotion_by_relabel_or_rehash stays 0; no relabel path. david.boston committed david.boston 49d7dc0b D-011 v15 Stage B ceremony: fourteen -V15 artifacts + supersession (TEST_ONLY seal chain) binding checkpoint A' 90ab0b041/tree 0e40f980, v15 source_map 22edfeb9, unchanged engine pins; deterministic builder test_d011_stage_b_v15.py; v14 artifacts byte-untouched. F-validation: all bindings verified independently. david.boston committed david.boston 90ab0b04 D-011 v15: production checked-execution adapter — boundary policy admits PRODUCTION_EXTERNAL via consulted adapter+owner-authorization records; invocation-binding emission/validation follows the boundary decision; mutation-pair/child lineage follows context. TEST_ONLY discipline unchanged; engines untouched; boundary manifest regenerated through the pure generation path (sha256 d26869ef...). david.boston committed david.boston ba43f502 D-011 OPEN disposition v2: G7 production run complete (15/15, 3880/3880, full Ed25519 signature verification); frozen-rule application mechanically executed and independently reviewed — selector structurally unreachable in v14 (boundary gate accepts TEST_ONLY, selector demands PRODUCTION_EXTERNAL); concrete discriminating need: v15 production checked-execution adapter + new ceremony. D-011 remains OPEN/UNQUALIFIED/INACTIVE. david.boston committed david.boston 287eb28a D-011 OPEN disposition: v14 implementation complete (TEST_ONLY), production qualification operator-gated. Concrete discriminant: exactly one profile's exposure set must be a strict subset of every other's in genuine production evidence (G6/G7). All development evidence preserved and staged. Independently reviewed (implementation-closure review PASS-with-findings). D-011 remains OPEN/UNQUALIFIED/INACTIVE. david.boston committed david.boston 2f73ce6f M4: activation/supersession S artifact (TEST_ONLY) — v14 Stage B ceremony documented as structurally complete; supersedes v13 lineage (history retained, no legacy fallback); D-011 remains OPEN/UNQUALIFIED/INACTIVE; no production evidence/qualification/selection claimed. S sha256 486398f08d0ed88e4aa44d13baf98dd00ca1c2d43ab16b4326cb6048d438115c. TEST_ONLY. david.boston committed david.boston 527e78d3 M4: fourteen Stage B ceremony artifacts (TEST_ONLY) — PREFREEZE SEMANTIC/PROVENANCE/AGGREGATE, LOCK-V14, 9 ROLE-V14 attestations, STAGE-B-FREEZE. Seal chain walked through all 6 stages to SEMANTIC_QUALIFICATION. PREFREEZE context sha 0b4b924f, ACTIVATED context sha 12e5d1a1. Phase-aware validation passes both phases. Ceremony builder in test_d011_stage_b.py (+467 lines, deterministic, idempotent, boolean-free). All TEST_ONLY: PRODUCTION_AUTHORITY_AVAILABLE=False, TEST_ONLY_LOCAL_SIGNER only. Content honestly reflects actual implementation (real module sha256s, real engine pins, real rehearsal facts). Checkpoint A binding: commit a897f4e50, tree b63386451197f531b702f7f18f94cb964358b9c9. TEST_ONLY; no qualification claim. david.boston committed david.boston a897f4e5 M3.5 closure: margin policy dual-mode (margin<=0 = explicit halt-on-overshoot testing hook, margin>0 = calibration note); hermetic capacity-gate test fix (removed non-hermetic STORE_ROOT assertion). Implementation-closure review: PASS-with-findings (6/6 modules PASS, 5 engine fixes PASS, fuzz gate non-vacuous 7398 runs, rehearsal reconciles exactly with Basis B ledger). All gates green: rehearsal 27, pilot 39, basisb 10, producers 12, execution 24, domain fast 31. TEST_ONLY. david.boston committed david.boston 102fab4b M3.5: placement-attack state-key law (operator-authorized, 5th engine fix) + ORACLE/PRIMARY identity re-pin + boundary-manifest regeneration + attempt-5 partial preservation. Both engines' placement attack surface now enforces the state-key law (attack_schema_deny prelude: per-target required payload-key fields are non-empty strings, else DENY_SCHEMA with unmutated state; head no-ops in attack/apply_attack for direct callers). Bonus finding: PRIMARY was ALSO vulnerable (schema gate caught deletion but not non-string payload VALUES). Sweep: 710 retained placement requests, was 2 raises -> 0 raises/0 non-canonical; differential disagreements 272->214 (residual pre-existing ORACLE schema-lightness, out of scope). New oracle identity aec37ac6/a383e317 (sha/blob), AST 39495c4a; new primary identity 0f6f4bad/8230e495, AST 833f2fc0. Boundary manifest regenerated + validated. Rehearsal attempt-5 partial preserved at m3-rehearsal-14-attempt5-halted-seg00-r059 (13,808 files). TEST_ONLY. david.boston committed david.boston 0b3392da Preserve rehearsal launch6 partial (attempt6-stale-engines-partial): 1,895 files written by the pre-final-totality-batch launcher process (killed at +2.5h; its loaded engine bytes predate the final totality fixes, so its results carry stale engine identities and are retained as an attempt record only, not evidence) david.boston committed david.boston 87a22622 M3.5: FINAL fuzz-guided engine-totality batch (operator-authorized) — 12 fuzz sites + 21 same-shape siblings fixed across both engines (PRIMARY f013 cap_rights/parent_cap_rights iterables + child_budget/parent_budget numerics + effect_flow evidence/sink_id/effect_id + d010 _kf port; ORACLE placement responsibility); permanent EngineFamilyTotalityFuzzGateTests (7398-run matrix, non-vacuous vs HEAD control); ORACLE+PRIMARY identity re-pin + boundary-manifest regeneration (manifest_spec validated); OracleStateKeyTypeTests fixture path repointed post-rename. Fuzz re-run: 1172 runs, 0 raises; valid-input equivalence vs HEAD: 0 mismatches. TEST_ONLY. david.boston committed