diff --git a/docs/superpowers/plans/2026-08-30-public-benchmark-evaluation-audit.md b/docs/superpowers/plans/2026-08-30-public-benchmark-evaluation-audit.md new file mode 100644 index 0000000..4c5853b --- /dev/null +++ b/docs/superpowers/plans/2026-08-30-public-benchmark-evaluation-audit.md @@ -0,0 +1,6887 @@ +# Public Benchmark Evaluation and Audit Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Build the immutable hard-score, blind-judge, statistical inference, human-audit, sensitivity, and reporting layer for the approved three-model public benchmark. + +**Architecture:** Slice 2 constructs and verifies the serial Git-native review DAG `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1`, then consumes only verified, sealed generation evidence and strict scored-attempt projections supplied by Slice 1. It owns the strict statement/envelope/bundle/tag-binding schemas, stable tag trust projections, raw Git-object archive, and the content-addressed hard-score/judge/audit/analysis DAG. Each model outcome remains independent with fixed denominators, scenario-clustered uncertainty, and fail-closed audit sensitivity; legacy v1 behavior remains separate and byte-compatible. + +**Tech Stack:** Python 3.11+, Pydantic 2 strict frozen models, NumPy Generator(PCG64), a new strict +CanonicalJSONV1 validator/encoder at the registry/attestation boundary (the existing capsule encoder +alone is insufficient), SHA-256, pytest, Ruff, mypy, uv. + +--- + +## Authoritative design and scope + +Implement against the normative +[Public Three-Model Benchmark Pipeline Design](../specs/2026-08-30-public-three-model-benchmark-design.md) +at full SHA `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`, especially Sections 6.2–6.6, +7.1, 7.7, 9–11, 13.1, and 14.1. Governance-only successor +`d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad` records the maintainer/user's exact 2026-08-31 +approval message `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. Prior approval +metadata is historical only and confers no authority on this amendment. Implementation starts only +from the synchronized five-plan `PLAN_BASE_SHA` recorded at handoff. Any later normative amendment +re-blocks the affected tasks until separately approved. + +This is Slice 2. Its Task 1 CanonicalJSON/attachment bootstrap runs first and must be GREEN before +Foundations Task 2 imports those owner objects. Evaluation Tasks 2–15 start only after Slice 1 +exposes these public, tested interfaces: + +~~~python +from laconian_eval.capsule.scorable import ScoredAttemptV2 +from laconian_eval.capsule.sidecars import VerifiedScoredCapsuleV2 + + +def load_verified_scored_capsule( + capsule_path: Path, + scored_sidecar_path: Path, +) -> VerifiedScoredCapsuleV2: + """Verify Slice 1 seal and sidecar bindings before exposing scored evidence.""" +~~~ + +VerifiedScoredCapsuleV2 must contain the verified SealV1 capsule SHA-256, resolved-manifest SHA-256, +plan SHA-256, ordered PlanRowV1 rows, exact ordered ScoredAttemptV2 terminal rows, and captured +ResponseCase objects keyed by case_uid. Slice 2 must not accept an unsealed capsule, a nullable +capsule hash, externally supplied case text, or an unverified scored sidecar. + +Dependency direction is locked: `laconian_eval.benchmark` may import Slice 1 capsule interfaces but +must never import `laconian_eval.campaign`. It owns `LayerRootIndexV1`, +`GenerationContextExpectationV1`, `GenerationContextIndexV1`, `JudgeAttemptEvidenceV1`, +`JudgeAttemptRootIndexV1`, `ProviderEvidenceIndexV1`, +`BenchmarkProviderEvidenceProjectionV1`, and `VerifiedBenchmarkProviderEvidenceV1`. The strict index +boundaries are phase-specific: Runtime's campaign-side adapter verifies and wraps the external +generation-context expectation before pre-judge work, while the post-judge provider index carries +the already-verified plaintext campaign seed, peeled input +commit, separate audit/protocol reviewer registries, protocol digests, the exact four layer-root +indexes, and the seal-time-verified judge-attempt root into Slice 2; the verified projection is +reconstructed only from the externally supplied Runtime-verified expectation wrapper, that explicit +index, and the four retained layer roots. Serialized provider-index fields alone never mint the +wrapper or a verified projection. Slice 3 +and Slice 4 may import the benchmark types and construct the expectation/context/provider records from a verified +`CampaignRegistryV1`; Slice 4 then binds the projection digest into the provenance-rich campaign +inventory. Slice 2 loaders accept the strict campaign-registry, tag-binding, attestation, workflow, +and archive/closure roots needed to verify identity, but never treat registry or inventory bytes as +an authority capability. + +Slice 2 additionally owns `TagOperatorRegistryV1`, `TagRulesetPolicyV1`, +`TagCreationRuleSuiteReceiptV1`, `WorkflowInventoryV1`, `ProtocolReviewStatementV1`, +mode-discriminated `VerifiedProtocolAttestationV1`, `ProtocolAttestationBundleV1`, +`ProtocolAttestationTagBindingV1`, REST/GraphQL/local signature projections and receipts, raw +Git-object SHA-256 verification, and `ProtocolReviewObjectArchiveV1`. Runtime consumes only their +verified roots/bindings and never redefines these types. Slice 2 performs no live GitHub mutation; +registered humans/verifier construct the reviewed commits/tags before preflight. + +Out of scope for this slice: + +- live provider dispatch, retry, batch, spend-ledger, and campaign-state machinery; +- GitHub API calls, workflow YAML, environment configuration, publication PRs, tags, and releases; +- documentation/social promotion after RELEASED; +- changes to legacy RawAttempt/ScoredAttempt/RunSummary v1 behavior. + +### Approved 05e3d7b synchronization boundary + +The constructive-liveness, credential-finality, and exact-wire amendment leaves the Slice 2 +estimand, workload, statistical gates, audit method, seven-command replay surface, workflow tuple, +and protocol-review topology unchanged. Its Evaluation-owned normative delta is nevertheless +mandatory: the `security_evidence` statement now has fourteen ordered subjects. Relative to the +previous approved statement it inserts `publication_branch_ruleset_policy_sha256` immediately +after `publication_correction_protocol_sha256`, then +`broker_token_delivery_isolation_policy_sha256` and `broker_signing_keys_root_sha256` immediately +after `state_writer_git_identity_sha256`. A statement with the former eleven-member inventory is +invalid even when every retained digest is otherwise correct. + +Task 3 therefore owns and exports the single `ProtocolSubjectKindV1` Literal and immutable +`PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1` mapping used by the statement validator, synthetic DAG, +Runtime preflight, and Publication reconstruction. Runtime and Publication import those exact +objects by identity; neither slice copies the tuple or adds an alias. They supply and independently +verify the C0-owned security-policy/key roots, while Evaluation validates their exact kind/order and +binds them into the signed statement, envelope, bundle, tag binding, archive, context, and every +downstream attachment root. + +Task 1 likewise remains the sole owner of `CanonicalJSONV1Error`, `canonical_json_v1`, and +`parse_canonical_json_v1`. These three names are package exports so the new Runtime/Publication +wire schemas consume the same strict bytes rather than defining a second encoder. Their +subsystem-specific LF domain helpers remain in their owning modules; the NUL-domain +`canonical_json_v1_digest` stays internal to `attachments.py` and must not be used for the +amendment's LF-domain broker/publication records. + +All new publication terminal-containment, publisher/security-attestor/release-finalizer broker, +initial-receipt append, release-preauthorization, external-effect, and reconciliation schemas remain +owned by Runtime or Publication. Slice 2 neither defines nor re-exports them. The exact downstream +identity/export tests below enforce both sides of this boundary before either later slice can be +GREEN. + +## Locked file structure + +Create: + +- src/laconian_eval/benchmark/__init__.py — public Slice 2 exports only. +- src/laconian_eval/benchmark/attachments.py — strict CanonicalJSONV1, attachment digests, rational values, and no-replace writers. +- src/laconian_eval/benchmark/seeds.py — normative 128-bit domain-derived seeds. +- src/laconian_eval/benchmark/context.py — campaign-neutral layer-root indexes, the downstream `BenchmarkProtocolBindingsV1` projection, and sealed generation expectation/context types. +- src/laconian_eval/benchmark/protocol_review.py — strict operator/ruleset/workflow registries, statements, verified envelopes, bundle/tag binding, Git-object projections, creation-suite receipts, and network-free raw-object archive verification. +- src/laconian_eval/benchmark/hard_score.py — HardScoreRequestSetV1 models and builder. +- src/laconian_eval/benchmark/judge.py — blind requests, strict judgments, campaign-neutral judge-attempt roots, prompt rendering, and JudgeAttachmentV1. +- src/laconian_eval/benchmark/bootstrap.py — frozen PCG64 scenario vectors and type-7 percentile intervals. +- src/laconian_eval/benchmark/aggregation.py — H/S projections, fixed denominators, paired estimands, and model analysis inputs. +- src/laconian_eval/benchmark/outcomes.py — fixed outcome precedence and reason accumulation. +- src/laconian_eval/benchmark/provider_evidence.py — benchmark-owned provider index, exact-root verification, and sealed 36-chain projection. +- src/laconian_eval/benchmark/audit_sampling.py — exact 144-record design, blind packet, and atomic sample-root writer/loader. +- src/laconian_eval/benchmark/audit_commit_reveal.py — canonical labels, commitments, reveals, adjudication, and provenance verification. +- src/laconian_eval/benchmark/audit_metrics.py — design weights, Hajek estimates, authorizing two-sided design-weighted Wilson intervals, confusion tables, and audit gates. +- src/laconian_eval/benchmark/sensitivity.py — model/arm false-fail bounds, exact search, certificates, and verifier. +- src/laconian_eval/benchmark/reporting.py — verified audit/analysis root loaders and atomic machine-analysis/Markdown artifact writers. +- src/laconian_eval/replay/ — seven fixed secret-free offline non-evidentiary handlers reached only through the existing `laconian_eval.cli:main` dispatcher. +- tests/benchmark/__init__.py +- tests/benchmark/helpers.py — deterministic 36-capsule/1,440-row synthetic evidence builders. +- tests/benchmark/test_attachments.py +- tests/benchmark/test_seeds.py +- tests/benchmark/test_context.py +- tests/benchmark/test_protocol_review.py — canonical schemas, serial DAG, Git bytes/OIDs/raw SHA-256, stable projections, archive replay, and hostile vectors. +- tests/benchmark/test_hard_score.py +- tests/benchmark/test_judge.py +- tests/benchmark/test_bootstrap.py +- tests/benchmark/test_aggregation.py +- tests/benchmark/test_outcomes.py +- tests/benchmark/test_provider_evidence.py +- tests/benchmark/test_audit_sampling.py +- tests/benchmark/test_audit_commit_reveal.py +- tests/benchmark/test_audit_metrics.py +- tests/benchmark/test_sensitivity_direct.py +- tests/benchmark/test_sensitivity_certificate.py +- tests/benchmark/test_reporting.py +- tests/benchmark/test_synthetic_analysis.py +- tests/benchmark/test_cli.py — existing dispatcher compatibility and seven-handler import/call graph. + +Modify: + +- pyproject.toml — add NumPy and route the benchmark script to compatible `laconian_eval.cli:main` + while preserving the existing legacy `entrypoint` path. +- uv.lock — lock the NumPy dependency. +- benchmarks/methodology.md — replace the no-interval limitation with the frozen public method. +- evals/README.md — document the new derived evidence layers. +- tests/test_public_contract.py — pin cumulative Slice 2 names, seven commands, methodology, and evidence-language requirements. + +Do not put these models into src/laconian_eval/models.py or extend legacy +src/laconian_eval/reporting.py. The public campaign schemas have different denominators and +integrity requirements and must not silently reinterpret walking-skeleton artifacts. + +### Task 1: Add canonical attachment primitives and the normative NumPy dependency + +**Files:** + +- Create: src/laconian_eval/benchmark/__init__.py +- Create: src/laconian_eval/benchmark/attachments.py +- Create: tests/benchmark/__init__.py +- Create: tests/benchmark/test_attachments.py +- Modify: pyproject.toml +- Modify: uv.lock + +- [ ] **Step 1: Write the failing strict-model and digest tests** + +Add these tests: + +~~~python +def test_rational_v1_normalizes_sign_and_reduces_exactly() -> None: + assert RationalV1(numerator=6, denominator=8).model_dump(mode="json") == { + "numerator": 3, + "denominator": 4, + } + with pytest.raises(ValidationError): + RationalV1(numerator=1, denominator=0) + + +def test_attachment_digest_is_domain_separated_and_excludes_only_its_id() -> None: + payload = { + "schema_version": "1", + "parent_sha256": "a" * 64, + "rows": [{"ordinal": 0, "value": 7}], + } + expected = hashlib.sha256( + b"laconian-test-attachment-v1\0" + canonical_json(payload) + ).hexdigest() + assert attachment_digest("laconian-test-attachment-v1", payload) == expected + assert attachment_digest("laconian-other-v1", payload) != expected + + +def test_canonical_json_v1_is_strict_and_has_no_terminal_newline() -> None: + assert canonical_json_v1({"é": 1, "a": [2], "verified": True}) == ( + b'{"a":[2],"verified":true,"\xc3\xa9":1}' + ) + with pytest.raises(CanonicalJSONV1Error): + canonical_json_v1({"e\\u0301": 1}) + for forbidden in (1.0, float("nan")): + with pytest.raises(CanonicalJSONV1Error): + canonical_json_v1({"value": forbidden}) + for forbidden_bytes in (b'{"a":1}\n', b'{ "a":1}', b'{"a":1,"a":1}', b'{"e\\u0301":1}'): + with pytest.raises(CanonicalJSONV1Error): + parse_canonical_json_v1(forbidden_bytes) + + +def test_canonical_json_v1_package_exports_are_owner_identical() -> None: + import laconian_eval.benchmark as benchmark + from laconian_eval.benchmark import attachments + + assert benchmark.CanonicalJSONV1Error is attachments.CanonicalJSONV1Error + assert benchmark.canonical_json_v1 is attachments.canonical_json_v1 + assert benchmark.parse_canonical_json_v1 is attachments.parse_canonical_json_v1 + assert benchmark.attachment_digest is attachments.attachment_digest + assert benchmark.write_attachment_json is attachments.write_attachment_json + + +def test_write_attachment_is_canonical_fsynced_and_never_overwrites( + tmp_path: Path, + monkeypatch: pytest.MonkeyPatch, +) -> None: + target = tmp_path / "attachment.json" + calls: list[int] = [] + monkeypatch.setattr(os, "fsync", lambda descriptor: calls.append(descriptor)) + write_attachment_json(target, {"z": 1, "a": 2}) + assert target.read_bytes() == b'{"a":2,"z":1}\n' + assert len(calls) == 2 + with pytest.raises(FileExistsError): + write_attachment_json(target, {"a": 3}) + assert target.read_bytes() == b'{"a":2,"z":1}\n' +~~~ + +- [ ] **Step 2: Run the RED tests** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_attachments.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.attachments` and +`canonical_json_v1` do not exist. + +- [ ] **Step 3: Implement the strict primitives** + +Use CapsuleModel and the existing canonical encoder: + +~~~python +from __future__ import annotations + +import hashlib +import json +import math +import os +import unicodedata +from collections.abc import Mapping +from pathlib import Path +from typing import NoReturn, Self, cast + +from pydantic import model_validator + +from laconian_eval.capsule.canonical import canonical_json, stable_digest +from laconian_eval.capsule.schema import CapsuleModel + + +class CanonicalJSONV1Error(ValueError): + pass + + +def _canonical_json_v1_tree(value: object) -> object: + # JSON booleans remain booleans; "integers only" excludes non-integer numbers, + # not the `verified: true` member required by SignatureEvidenceV1. + if value is None or type(value) in (bool, int): + return value + if type(value) is str: + if unicodedata.normalize("NFC", value) != value: + raise CanonicalJSONV1Error("strings must already be NFC") + return value + if type(value) is list: + return [_canonical_json_v1_tree(item) for item in cast(list[object], value)] + if type(value) is tuple: + return [_canonical_json_v1_tree(item) for item in cast(tuple[object, ...], value)] + if type(value) is dict: + raw_mapping = cast(dict[object, object], value) + if not all(type(key) is str for key in raw_mapping): + raise CanonicalJSONV1Error("object keys must be strings") + mapping = cast(dict[str, object], raw_mapping) + items = sorted(mapping.items(), key=lambda item: item[0].encode("utf-8")) + canonical_mapping: dict[str, object] = {} + for key, item in items: + canonical_key = _canonical_json_v1_tree(key) + if not isinstance(canonical_key, str): + raise AssertionError("canonical string key changed type") + canonical_mapping[canonical_key] = _canonical_json_v1_tree(item) + return canonical_mapping + raise CanonicalJSONV1Error("only null, strings, integer JSON, arrays, and objects are allowed") + + +def canonical_json_v1(value: object) -> bytes: + """UTF-8 CanonicalJSONV1: NFC strings, bytewise keys, integer JSON, no LF.""" + return json.dumps( + _canonical_json_v1_tree(value), + ensure_ascii=False, + separators=(",", ":"), + ).encode("utf-8") + + +def parse_canonical_json_v1(data: bytes) -> object: + def reject_number(_: str) -> NoReturn: + raise CanonicalJSONV1Error("only integer JSON numbers are allowed") + + def unique_object(pairs: list[tuple[str, object]]) -> dict[str, object]: + if len({key for key, _ in pairs}) != len(pairs): + raise CanonicalJSONV1Error("duplicate object key") + return dict(pairs) + + try: + text = data.decode("utf-8", errors="strict") + parsed = json.loads( + text, + parse_float=reject_number, + parse_constant=reject_number, + object_pairs_hook=unique_object, + ) + except (UnicodeError, json.JSONDecodeError) as error: + raise CanonicalJSONV1Error("invalid CanonicalJSONV1 bytes") from error + canonical = canonical_json_v1(parsed) + if canonical != data: + raise CanonicalJSONV1Error("noncanonical CanonicalJSONV1 bytes") + return parsed + + +def canonical_json_v1_digest(domain: str, value: object) -> str: + if unicodedata.normalize("NFC", domain) != domain or not domain: + raise CanonicalJSONV1Error("digest domain must be nonempty NFC") + return hashlib.sha256(domain.encode("utf-8") + b"\0" + canonical_json_v1(value)).hexdigest() + + +class RationalV1(CapsuleModel): + numerator: int + denominator: int + + @model_validator(mode="after") + def reduce_fraction(self) -> Self: + if type(self.numerator) is not int or type(self.denominator) is not int: + raise ValueError("rational components must be exact integers") + if self.denominator <= 0: + raise ValueError("rational denominator must be positive") + divisor = math.gcd(self.numerator, self.denominator) + normalized_numerator = self.numerator // divisor + normalized_denominator = self.denominator // divisor + if normalized_denominator != self.denominator: + object.__setattr__(self, "numerator", normalized_numerator) + object.__setattr__(self, "denominator", normalized_denominator) + return self + + +def attachment_digest(domain: str, payload_without_id: Mapping[str, object]) -> str: + return stable_digest(domain, dict(payload_without_id)) + + +def write_attachment_json(path: Path, payload: Mapping[str, object]) -> None: + encoded = canonical_json(dict(payload)) + b"\n" + path.parent.mkdir(parents=True, exist_ok=True) + descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600) + try: + view = memoryview(encoded) + while view: + written = os.write(descriptor, view) + if written <= 0: + raise OSError("short attachment write") + view = view[written:] + os.fsync(descriptor) + finally: + os.close(descriptor) + parent = os.open(path.parent, os.O_RDONLY) + try: + os.fsync(parent) + finally: + os.close(parent) +~~~ + +Export `CanonicalJSONV1Error`, `canonical_json_v1`, `parse_canonical_json_v1`, `RationalV1`, +`attachment_digest`, and `write_attachment_json` from `benchmark/__init__.py`. Do not export +`canonical_json_v1_digest`: its NUL-domain contract is intentionally not the LF-domain helper used +by protocol-review, broker, publication, or release records. + +- [ ] **Step 4: Add and lock NumPy** + +Add this runtime dependency: + +~~~toml +"numpy>=2,<3", +~~~ + +Run: + +~~~bash +uv lock +~~~ + +Expected: uv.lock gains one locked NumPy distribution compatible with the supported Python range. + +- [ ] **Step 5: Run the GREEN tests and static checks** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_attachments.py +uv run ruff check src/laconian_eval/benchmark/attachments.py tests/benchmark/test_attachments.py +uv run mypy src/laconian_eval/benchmark/attachments.py +~~~ + +Expected: all commands pass. + +- [ ] **Step 6: Commit** + +~~~bash +git add pyproject.toml uv.lock src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/attachments.py tests/benchmark/__init__.py tests/benchmark/test_attachments.py +git commit -m "feat: add benchmark attachment primitives" +~~~ + +### Task 2: Freeze campaign seed derivation + +**Files:** + +- Create: src/laconian_eval/benchmark/seeds.py +- Create: tests/benchmark/test_seeds.py +- Modify: src/laconian_eval/benchmark/__init__.py + +- [ ] **Step 1: Write the failing seed golden and boundary tests** + +~~~python +def test_seed128_matches_first_128_sha256_bits() -> None: + material = ( + b"laconian-bootstrap-v1" + + b"\0" + + b"campaign-seed-2026" + + b"\0" + + b"a" * 40 + + b"\0" + + b"b" * 64 + ) + expected = int.from_bytes(hashlib.sha256(material).digest()[:16], "big") + assert ( + derive_seed128( + "laconian-bootstrap-v1", + "campaign-seed-2026", + "a" * 40, + "b" * 64, + ) + == expected + ) + + +@pytest.mark.parametrize( + "arguments", + [ + ("", "seed", "a" * 40, "b" * 64), + ("domain", "", "a" * 40, "b" * 64), + ("domain", "seed", "A" * 40, "b" * 64), + ("domain", "seed", "a" * 40, "B" * 64), + ("bad\0domain", "seed", "a" * 40, "b" * 64), + ], +) +def test_seed128_rejects_noncanonical_material(arguments: tuple[str, str, str, str]) -> None: + with pytest.raises(ValueError): + derive_seed128(*arguments) +~~~ + +- [ ] **Step 2: Run the RED test** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_seeds.py +~~~ + +Expected: import fails because derive_seed128 is absent. + +- [ ] **Step 3: Implement the exact derivation** + +~~~python +import hashlib +import re + +_COMMIT = re.compile(r"[0-9a-f]{40}\Z") +_SHA256 = re.compile(r"[0-9a-f]{64}\Z") + + +def derive_seed128( + domain: str, + campaign_seed: str, + input_tag_commit: str, + judge_protocol_sha256: str, +) -> int: + values = (domain, campaign_seed, input_tag_commit, judge_protocol_sha256) + if any(type(value) is not str or not value for value in values): + raise ValueError("seed material must be nonempty strings") + if any("\0" in value for value in values): + raise ValueError("seed material must not contain NUL") + if _COMMIT.fullmatch(input_tag_commit) is None: + raise ValueError("input tag commit must be lowercase SHA-1") + if _SHA256.fullmatch(judge_protocol_sha256) is None: + raise ValueError("judge protocol hash must be lowercase SHA-256") + encoded = b"\0".join(value.encode("utf-8", errors="strict") for value in values) + return int.from_bytes(hashlib.sha256(encoded).digest()[:16], "big", signed=False) +~~~ + +- [ ] **Step 4: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_seeds.py +uv run ruff check src/laconian_eval/benchmark/seeds.py tests/benchmark/test_seeds.py +uv run mypy src/laconian_eval/benchmark/seeds.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/seeds.py tests/benchmark/test_seeds.py +git commit -m "feat: freeze benchmark seed derivation" +~~~ + +### Task 3: Build sealed HardScoreRequestSetV1 attachments + +**Files:** + +- Create: `src/laconian_eval/benchmark/context.py` +- Create: `src/laconian_eval/benchmark/protocol_review.py` +- Create: `src/laconian_eval/benchmark/hard_score.py` +- Create: `tests/benchmark/helpers.py` +- Create: `tests/benchmark/test_context.py` +- Create: `tests/benchmark/test_protocol_review.py` +- Create: `tests/benchmark/test_hard_score.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` + +This task owns the complete `protocol_review.py` and pre-judge `context.py` contracts. Implement +`TagOperatorRegistryV1`, `TagRulesetPolicyV1`, `TagCreationRuleSuiteReceiptV1`, +`WorkflowInventoryV1`, `ProtocolReviewStatementV1`, mode-discriminated +`VerifiedProtocolAttestationV1`, `ProtocolAttestationBundleV1`, +`ProtocolAttestationTagBindingV1`, stable REST/GraphQL/local projections and observation receipts, +`GitObjectSHA256V1`, and `ProtocolReviewObjectArchiveV1` before the context imports them. Then implement: +`LayerKindV1`, both discriminated layer-member models, `LayerRootIndexV1`, both reviewer registries +and canonical digest helpers, the complete `protocol_review.py` contract, `GenerationContextIndexV1`, +`GenerationContextExpectationV1`, both verified context wrappers, +`write_layer_root_index`, `load_layer_root_index`, +`write_generation_context_index`, and `load_verified_generation_context_index`. Implement and test +their exact schemas and validators in `context.py` before importing that module from `hard_score.py`. +Task 4's judge builder also imports the same context module. Task 8 creates the downstream +`provider_evidence.py`, which imports `context.py`, `hard_score.py`, and `judge.py`; `context.py` +must never import any of those downstream modules or `laconian_eval.campaign`. Do not create a +second context type, weaken a field in a later task, or defer these tests past this commit. + +- [ ] **Step 1: Add deterministic sealed-capsule fixtures** + +In tests/benchmark/helpers.py, build one verified 40-row model/scenario fixture plus a full strict +`GenerationContextExpectationV1`, its Runtime-style verified wrapper, and +`VerifiedGenerationContextIndexV1`: two locales × four +arms × five repetitions. Give each row a unique ordinal, plan_item_id, terminal ScoredAttemptV2, +and exact captured case. Include one provider rejection, one deterministic format failure, and 38 +hard passes. The fixture must expose a nonnull generation capsule hash and must fail construction +if Slice 1 returns an unsealed capsule. The expectation fixture binds campaign ID, campaign-registry +self digest, both reviewer registry digests, attestation root, predecessor authority root, generation layer, expected context +digest, and workflow root; its in-memory wrapper separately binds the reconstructed final authority +root. The context fixture binds the exact generation layer, +campaign/input identities, tagged hard-scorer source/protocol, judge protocol, requested tier, +statistics protocol and singular `audit_protocol_sha256`, both reviewer registries, all three verified envelopes, and their shared +verified C0 workflow root. + +- [ ] **Step 2: Write the failing request-set contract tests** + +First create `tests/benchmark/test_context.py` with these exact pre-judge contract tests: + +- `test_layer_root_index_binds_kind_campaign_ordered_paths_hashes_and_self_digest`. +- `test_layer_root_index_rejects_noncanonical_path_order_alias_or_wrong_kind`. +- `test_generation_layer_member_binds_capsule_and_scored_sidecar_paths_and_hashes`. +- `test_generation_context_index_binds_verified_plaintext_seed_commit_and_36_generation_parents`. +- `test_generation_context_binds_default_tier_code_protocol_registries_and_workflow_root`. +- `test_generation_context_binds_statistical_protocol_for_later_authority_checked_analysis`. +- `test_generation_context_binds_exact_runtime_registry_audit_protocol_for_all_downstream_evidence`. +- `test_reviewer_registry_hash_recomputes_from_exact_canonical_bindings_including_signing_mode`. +- `test_audit_and_protocol_reviewer_registries_have_separate_canonical_bytes_and_digests`. +- `test_protocol_reviewer_registry_requires_three_ordered_distinct_role_bound_identities`. +- `test_protocol_reviewer_registry_requires_null_github_fingerprint_and_exact_keyed_fingerprints`. +- `test_protocol_reviewer_registry_freezes_four_ascii_author_committer_fields_and_raw_headers`. +- `test_protocol_review_statement_has_exact_fields_and_forbids_commit_envelope_bundle_or_t1_values`. +- `test_security_statement_has_exact_approved_fourteen_subjects`. +- `test_protocol_subject_and_signature_exports_are_owner_identical`. +- `test_verified_protocol_attestation_embeds_byte_identical_statement_and_mode_discriminated_evidence`. +- `test_protocol_bundle_embeds_three_ordered_envelopes_and_no_b0_or_t1_identity`. +- `test_tag_binding_binds_t0_c0_three_reviewers_b0_t1_bundle_closure_operator_and_policy`. +- `test_operator_registry_has_one_exact_user_and_ascii_tagger_identity`. +- `test_input_and_companion_tag_messages_have_exact_fields_canonical_bytes_and_no_self_reference`. +- `test_bundle_builder_identity_has_exact_literal_ascii_name_email_and_lf_self_digest`. +- `test_two_stable_rulesets_allow_only_operator_creation_bypass_and_no_update_delete_bypass`. +- `test_ruleset_observation_receipt_has_exact_ordered_fields_lf_digest_and_no_creation_claim`. +- `test_t0_and_t1_creation_suites_are_unique_nonreplayable_and_bind_all_zero_before_exact_after`. +- `test_stable_rest_graphql_and_local_projections_exclude_transport_metadata`. +- `test_workflow_inventory_has_exact_three_fields_and_fifteen_ordered_members`. +- `test_object_archive_contains_raw_bytes_for_every_closure_object_and_replays_without_network`. +- `test_archive_receipt_wrapper_has_exact_kind_order_paths_hash_binding_and_no_self_digest`. +- `test_serial_git_dag_golden_bytes_oids_raw_sha256_paths_parents_deltas_headers_and_messages`. +- `test_protocol_review_rejects_float_bool_numeric_string_non_nfc_duplicate_key_reordered_array_extra_or_missing_field`. +- `test_protocol_review_rejects_self_reference_wrong_parent_path_role_order_tree_delta_header_signature_tag_or_cross_campaign_replay`. +- `test_protocol_review_stable_identity_ignores_request_id_etag_timestamp_and_api_order`. +- `test_protocol_review_digest_uses_exact_lf_separator_and_rejects_nul_missing_or_double_lf`. +- `test_protocol_attestations_bind_both_registry_digests_role_identity_and_workflow_root`. +- `test_generation_context_and_all_three_attestations_bind_same_c0_workflow_root`. +- `test_generation_context_expectation_binds_campaign_registry_reviewers_predecessor_generation_root_and_context`. +- `test_context_loader_rejects_campaign_registry_substitution_even_when_expectation_and_context_are_rehashed`. +- `test_runtime_adapter_constructs_expectation_wrapper_only_after_bound_digest_predecessor_and_final_root_verify`. +- `test_context_loader_rejects_forged_context_with_rehashed_index_against_external_expectation`. +- `test_generation_context_loader_rejects_seed_commit_code_protocol_member_or_workflow_substitution`. +- `test_runtime_adapter_can_import_public_context_contract_without_provider_or_campaign_imports`. + +The tests must statically prove the acyclic import direction, inspect the public builder/loader +signatures for the absence of raw identity overrides, and mutate each bound value even when the +substituted object is internally rehashed. + +~~~python +SECURITY_SUBJECT_KINDS_V1: tuple[ProtocolSubjectKindV1, ...] = ( + "provider_request_contract_sha256", + "retry_spend_protocol_sha256", + "campaign_state_schema_sha256", + "workflow_endpoint_policy_sha256", + "artifact_security_protocol_sha256", + "publication_correction_protocol_sha256", + "publication_branch_ruleset_policy_sha256", + "identity_registry_bundle_sha256", + "state_writer_git_identity_sha256", + "broker_token_delivery_isolation_policy_sha256", + "broker_signing_keys_root_sha256", + "tag_operator_registry_sha256", + "tag_ruleset_policy_root", + "invalid_event_dismissal_policy_sha256", +) + + +def _security_statement_payload( + subject_kinds: tuple[ProtocolSubjectKindV1, ...], +) -> dict[str, object]: + subjects = [ + {"kind": kind, "sha256": f"{ordinal:064x}"} + for ordinal, kind in enumerate(subject_kinds, start=1) + ] + payload: dict[str, object] = { + "schema_version": "ProtocolReviewStatementV1", + "role": "security_evidence", + "protocol_registry_sha256": "a" * 64, + "reviewer_numeric_account_id": 101, + "reviewer_login": "security-reviewer", + "verification_mode": "ssh_sha256", + "signing_fingerprint": "SHA256:" + "A" * 43, + "input_tag_ref": "refs/tags/benchmark-input-20260831.1", + "input_tag_oid": "b" * 40, + "input_tag_object_sha256": "c" * 64, + "peeled_c0_oid": "d" * 40, + "peeled_c0_sha256": "e" * 64, + "workflow_root": "f" * 64, + "subjects": subjects, + "subject_root": protocol_review_digest( + "laconian-protocol-review-subjects-root-v1", + subjects, + ), + "signed_at": "2026-08-31T00:00:00Z", + } + payload["statement_sha256"] = protocol_review_digest( + "laconian-protocol-review-statement-v1", + payload, + ) + return payload + + +def test_security_statement_has_exact_approved_fourteen_subjects() -> None: + statement = ProtocolReviewStatementV1.model_validate( + _security_statement_payload(SECURITY_SUBJECT_KINDS_V1) + ) + assert tuple(item.kind for item in statement.subjects) == SECURITY_SUBJECT_KINDS_V1 + assert PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1["security_evidence"] == ( + SECURITY_SUBJECT_KINDS_V1 + ) + + former_eleven = tuple( + kind + for kind in SECURITY_SUBJECT_KINDS_V1 + if kind + not in { + "publication_branch_ruleset_policy_sha256", + "broker_token_delivery_isolation_policy_sha256", + "broker_signing_keys_root_sha256", + } + ) + mutations: tuple[tuple[ProtocolSubjectKindV1, ...], ...] = ( + former_eleven, + SECURITY_SUBJECT_KINDS_V1[:-1], + (*SECURITY_SUBJECT_KINDS_V1, "invalid_event_dismissal_policy_sha256"), + ( + *SECURITY_SUBJECT_KINDS_V1[:6], + SECURITY_SUBJECT_KINDS_V1[7], + SECURITY_SUBJECT_KINDS_V1[6], + *SECURITY_SUBJECT_KINDS_V1[8:], + ), + ) + for mutated in mutations: + with pytest.raises(ValidationError): + ProtocolReviewStatementV1.model_validate(_security_statement_payload(mutated)) + + +def test_protocol_subject_and_signature_exports_are_owner_identical() -> None: + from collections.abc import MutableMapping + from typing import cast, get_args + + import laconian_eval.benchmark as benchmark + from laconian_eval.benchmark import protocol_review + + role_order: tuple[ProtocolReviewRoleV1, ...] = ( + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", + ) + assert benchmark.ProtocolSubjectKindV1 is protocol_review.ProtocolSubjectKindV1 + assert benchmark.PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1 is ( + protocol_review.PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1 + ) + assert get_args(benchmark.ProtocolSubjectKindV1) == tuple( + kind + for role in role_order + for kind in benchmark.PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1[role] + ) + assert len(benchmark.PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1["security_evidence"]) == 14 + mutable_alias = cast( + MutableMapping[ProtocolReviewRoleV1, tuple[ProtocolSubjectKindV1, ...]], + benchmark.PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1, + ) + with pytest.raises(TypeError): + mutable_alias["security_evidence"] = () + assert benchmark.GitHubVerifiedCommitEvidenceV1 is ( + protocol_review.GitHubVerifiedCommitEvidenceV1 + ) + assert benchmark.SSHVerifiedCommitEvidenceV1 is protocol_review.SSHVerifiedCommitEvidenceV1 + assert benchmark.OpenPGPVerifiedCommitEvidenceV1 is ( + protocol_review.OpenPGPVerifiedCommitEvidenceV1 + ) + common_signature_fields = ( + "schema_version", + "verification_mode", + "commit_oid", + "commit_object_sha256", + "parent_commit_oid", + "statement_path", + "github_rest_verification", + "github_graphql_signature", + ) + assert tuple(benchmark.GitHubVerifiedCommitEvidenceV1.model_fields) == common_signature_fields + keyed_signature_fields = ( + *common_signature_fields, + "fingerprint", + "keyring_sha256", + "local_signature_verification", + ) + assert tuple(benchmark.SSHVerifiedCommitEvidenceV1.model_fields) == keyed_signature_fields + assert tuple(benchmark.OpenPGPVerifiedCommitEvidenceV1.model_fields) == keyed_signature_fields + + +def test_hard_score_request_set_covers_all_40_plan_rows_and_only_hard_passes() -> None: + fixture = sealed_scored_scenario() + attachment = build_hard_score_request_set( + context=fixture.context, + expectation=fixture.expectation, + boundary_ordinal=fixture.boundary_ordinal, + ) + assert tuple(row.ordinal for row in attachment.records) == tuple(range(40)) + assert tuple(row.plan_item_id for row in attachment.records) == tuple( + row.plan_item_id for row in fixture.evidence.plan + ) + assert len(attachment.ordered_judge_request_ids) == 38 + assert attachment.ordered_judge_request_ids == tuple( + row.judge_request_id for row in attachment.records if row.hard_pass + ) + assert all(row.judge_request_id is None for row in attachment.records if not row.hard_pass) + + +def test_zero_hard_pass_set_is_still_sealed() -> None: + fixture = sealed_scored_scenario(all_hard_fail=True) + attachment = build_hard_score_request_set( + context=fixture.context, + expectation=fixture.expectation, + boundary_ordinal=fixture.boundary_ordinal, + ) + assert attachment.ordered_judge_request_ids == () + assert attachment.hard_score_request_set_sha256 == recompute_hard_score_request_set_sha256( + attachment + ) + + +@pytest.mark.parametrize("mutation", ["missing", "duplicate", "reordered", "wrong_capsule"]) +def test_hard_score_request_set_rejects_nonbijective_or_unbound_evidence(mutation: str) -> None: + with pytest.raises(HardScoreError): + build_mutated_hard_score_request_set(mutation) +~~~ + +Also add `test_hard_score_builder_has_no_raw_identity_or_protocol_scalar_parameters`, +`test_hard_score_derives_campaign_model_scenario_and_three_code_protocol_hashes_from_context`, and +`test_hard_score_builder_and_verifier_reject_context_member_source_protocol_or_workflow_root_substitution`, +plus `test_hard_score_rejects_forged_rehashed_context_against_external_expected_digest`. +Inspect the public signatures, mutate each of campaign ID, model, scenario, hard-scorer source, +hard-score protocol, judge protocol, singular audit protocol, generation member, and workflow root independently, and require +failure even when the substituted context/index is internally rehashed. + +- [ ] **Step 3: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_protocol_review.py tests/benchmark/test_context.py tests/benchmark/test_hard_score.py +~~~ + +Expected: imports fail because `protocol_review.py`, `context.py`, and `hard_score.py` do not exist. + +- [ ] **Step 4: Define the exact schemas** + +Implement the strict frozen context schemas in `context.py` before the hard-score schemas below. +The exact normative `context.py` schema and loader contract is frozen in the dedicated subsection +immediately below; Task 8 only imports it and does not redefine it. + +#### Frozen `protocol_review.py` and `context.py` contracts + +`laconian_eval.benchmark.protocol_review` alone defines and exports: + +~~~python +def protocol_review_digest(domain: str, value: object) -> str: + if ( + unicodedata.normalize("NFC", domain) != domain + or not domain + or "\n" in domain + or "\0" in domain + ): + raise CanonicalJSONV1Error( + "protocol-review digest domain must be nonempty NFC without LF or NUL" + ) + return hashlib.sha256(domain.encode("utf-8") + b"\n" + canonical_json_v1(value)).hexdigest() +~~~ + +Every protocol-review statement/envelope/root, operator/ruleset/workflow registry, GitHub/local +projection or receipt, creation suite, bundle, tag binding, closure, and archive digest uses this +exact LF preimage. The pre-existing `canonical_json_v1_digest`, `attachment_digest`, and legacy +attachment domains remain NUL-bound and are not silently changed. Golden tests independently hash +`UTF8(domain + "\n") || CanonicalJSONV1(payload)` and reject NUL, missing LF, doubled LF, or any +alternate separator. +The negative vector separately rejects a NUL embedded in `domain` and independently compares +preimages using a NUL separator, no separator, or two LF separators; only exactly one LF between +the accepted domain and CanonicalJSONV1 bytes can pass. + +The protocol-review implementation is strict and noncyclic. C0 contains the reviewer/operator +registries, stable two-ruleset policy, dismissal policy, and exact 15-member workflow inventory, but +the entire `benchmarks/protocol-reviews//` subtree is absent. The registered operator creates +unsigned annotated T0 peeling to C0. Rstat, Rjudge, and Rsecurity then form a one-parent serial chain, +each adding only its one fixed-path statement blob and using the closed signed-commit header/message +grammar. After independently verifying all three signatures, the verifier creates one-parent B0, +whose only delta is the three envelopes plus `bundle.json`; the same operator then creates unsigned +annotated T1 peeling to B0. Lightweight/nested tags, alternate suffixes/namespaces, merge parents, +extra tree deltas or headers, tag signatures, and repair-in-place are invalid. + +`GitObjectSHA256V1` always hashes `type SP decimal-size NUL raw-content`, while the repository OID is +the distinct raw Git SHA-1. Golden vectors fix exact bytes, both hashes, tree modes, parent order, +identity/timestamps/timezone, signature continuation lines, and messages for T0, every C0 closure +object, all reviewers, B0, and T1. `ProtocolReviewObjectArchiveV1` stores the raw content bytes of +every closure object plus every safe raw/canonical API blob and its strict receipt binding. Its +network-free importer reconstructs both hashes, every tree/commit/tag and exact delta, stable +REST/GraphQL/local signature projections, ruleset observations, and the two unique creation suites. + +`ProtocolAttestationTagBindingV1` is constructed only after T1 exists and binds both tags and peeled +commits, the ordered reviewer commit identities, B0, bundle/envelope roots, object-closure root, +operator registry and stable policy root. It is persisted first in secret-free preflight/campaign +authority and is forbidden from C0, statements, reviewer commits, B0, T0, and T1. Every downstream +generation context, hard-score/judge/provider/audit/analysis/report/archive record carries the exact +campaign registry, tag binding, attestation root, workflow root, and applicable archive/closure roots; +substitution from another otherwise-valid pair fails closed. + +`protocol_review.py` is the sole owner of `InputTagMessageV1`, +`ProtocolAttestationTagMessageV1`, `ProtocolBundleBuilderGitIdentityV1`, +`TagRulesetObservationReceiptV1`, and `ArchivedApiReceiptBindingV1`. Their golden vectors pin exact +schema-order field inventories, strict canonical bytes, LF-domain preimages, raw T0/T1/B0 bytes and +both Git hashes, observation ordering/pagination/hash arrays, and archive wrapper kind/path/hash +bindings. Negative vectors independently exercise missing/extra/reordered fields, a NUL or alternate +digest separator, future/self references, nonliteral builder identity, mismatched embedded receipt +kind/digest, unequal path arrays, reused or unreferenced paths, and reordered receipt wrappers. + +The strict top-level field inventories are copied literally from the approved specification and no +compatibility alias is exported: + +- `TagOperatorRegistryV1`: `schema_version,repository_id,operators,tag_operator_registry_sha256`; + exactly one strict operator projection and stored entry digest. +- `TagRulesetPolicyV1`: `schema_version,repository_id,rulesets,tag_ruleset_policy_root`; exactly the + stable `creation_authorizer` and `immutability` projections, with only the frozen `User/always` + creation bypass and an empty update/delete bypass list. +- `TagCreationRuleSuiteReceiptV1`: `schema_version,repository_id,rule_suite_id,operation,ref, + before_sha,after_sha,actor_account_id,actor_login,pushed_at,overall_result,evaluation_result, + rule_evaluations,creation_authorizer_ruleset_id,creation_bypass_grant,tag_ruleset_policy_root, + request_ids,api_version,raw_response_sha256,canonical_response_sha256,observed_at, + tag_creation_rule_suite_receipt_sha256`; T0 and T1 require different unique create suites with + all-zero `before_sha`, exact tag-object `after_sha`, top-level `bypass`/`fail`, and no replay. +- `InputTagMessageV1`: `schema_version,input_tag_ref,companion_tag_ref,peeled_c0_oid, + protocol_reviewer_registry_sha256,tag_operator_registry_sha256,tag_ruleset_policy_root, + workflow_root`; its strict CanonicalJSON bytes are the complete T0 message before the one raw-tag + LF, and it contains no future commit/object/envelope/bundle/root/receipt value. +- `ProtocolAttestationTagMessageV1`: `schema_version,input_tag_ref,input_tag_oid, + input_tag_object_sha256,companion_tag_ref,bundle_commit_oid,bundle_commit_object_sha256, + protocol_attestation_bundle_sha256,protocol_attestations_root,tag_operator_registry_sha256, + tag_ruleset_policy_root`; its strict CanonicalJSON bytes are the complete T1 message before the + one raw-tag LF, and it contains no T1 OID, T1 raw-object digest, or self digest. +- `ProtocolBundleBuilderGitIdentityV1`: `schema_version,name_ascii,email_ascii, + protocol_bundle_builder_git_identity_sha256`, with literal + `name_ascii="Laconian Protocol Bundle Builder"` and literal + `email_ascii="laconian-protocol-bundle-builder@users.noreply.github.com"`; its digest is + `protocol_review_digest("laconian-protocol-bundle-builder-git-identity-v1", identity without + exactly protocol_bundle_builder_git_identity_sha256)`. B0 reproduces these author and committer + bytes exactly, with identical whole-second epoch and `+0000`. +- `TagRulesetObservationReceiptV1`: `schema_version,repository_id,ruleset_ids, + tag_ruleset_policy_root,observed_at,request_ids,etags,raw_response_sha256s, + canonical_response_sha256s,pagination_root,tag_ruleset_observation_receipt_sha256`; the two IDs + are in stable semantic order and its self digest is + `protocol_review_digest("laconian-tag-ruleset-observation-receipt-v1", receipt without exactly + tag_ruleset_observation_receipt_sha256)`. It contains no creation actor or historical rule-suite + claim, and transport metadata cannot enter the sealed policy root. +- `WorkflowInventoryV1`: `schema_version,members,workflow_root`; exactly 15 ordered C0-derived + `{path,sha256}` members. `sha256` hashes the exact workflow file bytes; repository blob OIDs and + raw-Git-object digests belong only to the separate Git closure inventory and are forbidden here. +- `ProtocolAttestationBundleV1`: `schema_version,protocol_registry_sha256,input_tag_ref, + input_tag_oid,input_tag_object_sha256,peeled_c0_oid,peeled_c0_sha256,workflow_root,attestations, + protocol_attestations_root,protocol_attestation_bundle_sha256`. +- `ProtocolAttestationTagBindingV1`: `schema_version,input_tag_ref,input_tag_oid, + input_tag_object_sha256,peeled_c0_oid,peeled_c0_sha256,reviewer_commits,bundle_commit_oid, + bundle_commit_object_sha256,companion_tag_ref,companion_tag_oid,companion_tag_object_sha256, + protocol_registry_sha256,workflow_root,protocol_attestations_root, + protocol_attestation_bundle_sha256,object_closure_root,tag_operator_registry_sha256, + tag_ruleset_policy_root,protocol_attestation_tag_binding_sha256`. +- `ProtocolReviewObjectArchiveV1`: `schema_version,object_closure_root,objects,api_blobs, + api_receipts,protocol_review_object_archive_sha256`; every object entry stores exact raw content + bytes, and every safe raw/canonical API blob is referenced exactly once by a strict receipt. +- `ArchivedApiReceiptBindingV1`: `receipt_kind,receipt_sha256,receipt,raw_blob_paths, + canonical_blob_paths`; `receipt_kind` is the closed discriminator `github_signature | + tag_ruleset_observation | t0_creation_suite | t1_creation_suite`, the embedded strict receipt + schema and recomputed digest must match it, and the wrapper has no self field. Kind order is the + displayed order; repeated observations sort by `(observed_at,receipt_sha256)`. Equal-cardinality + path arrays bind index-for-index to the embedded raw/canonical hash arrays (singular creation + hashes are normalized to one-element arrays only here), and the complete wrapper is bound by the + archive LF digest. + +The five security-critical projection schemas referenced above are literal, not names left for an +implementer to infer. `CanonicalGitAsciiName` is 1–80 ASCII bytes in nonempty non-space tokens +joined by one space and excludes `<`, `>`, controls, repeated/edge whitespace; `CanonicalGitAsciiEmail` +is 3–254 printable non-space ASCII bytes with one `@`, nonempty sides, no edge/doubled dot, `<`, +`>`, or controls. `BoundedCanonicalText` is NFC UTF-8 text of 1..1,048,576 bytes with no NUL/CR +(LF is preserved). These aliases and validators are owned in the same module: + +~~~python +class TagOperatorProjectionV1(CapsuleModel): + operator_account_id: StrictPositiveInt + operator_login: BoundedNonBlankString + tagger_name: CanonicalGitAsciiName + tagger_email: CanonicalGitAsciiEmail + tag_operator_sha256: Sha256 + + +class GitHubCommitVerificationProjectionV1(CapsuleModel): + schema_version: Literal["GitHubCommitVerificationProjectionV1"] + repository_id: StrictPositiveInt + commit_oid: GitObjectId + api_version: Literal["2022-11-28"] + endpoint: BoundedNonBlankString + verified: Literal[True] + reason: Literal["valid"] + payload: BoundedCanonicalText + signature: BoundedCanonicalText + verified_at: CanonicalTimestamp + rest_projection_sha256: Sha256 + + +class GitHubSignatureProjectionV1(CapsuleModel): + schema_version: Literal["GitHubSignatureProjectionV1"] + repository_id: StrictPositiveInt + commit_oid: GitObjectId + query_sha256: Sha256 + signer_database_id: StrictPositiveInt + signer_login: BoundedNonBlankString + is_valid: Literal[True] + state: Literal["VALID"] + graphql_projection_sha256: Sha256 + + +class GitHubSignatureObservationReceiptV1(CapsuleModel): + schema_version: Literal["GitHubSignatureObservationReceiptV1"] + repository_id: StrictPositiveInt + commit_oid: GitObjectId + rest_projection_sha256: Sha256 + graphql_projection_sha256: Sha256 + observed_at: CanonicalTimestamp + request_ids: tuple[BoundedNonBlankString, BoundedNonBlankString] + etags: tuple[BoundedNonBlankString, BoundedNonBlankString] + raw_response_sha256s: tuple[Sha256, Sha256] + canonical_response_sha256s: tuple[Sha256, Sha256] + tls_endpoint_identity: Literal["api.github.com:443"] + github_signature_observation_receipt_sha256: Sha256 + + +class LocalSignatureVerificationReceiptV1(CapsuleModel): + verified: Literal[True] + signed_payload_sha256: Sha256 + signature_sha256: Sha256 + verifier_tool_sha256: Sha256 + verification_receipt_sha256: Sha256 +~~~ + +`TagOperatorProjectionV1.tag_operator_sha256` uses +`protocol_review_digest("laconian-tag-operator-v1", entry without exactly tag_operator_sha256)`; +the registry uses `laconian-tag-operator-registry-v1`. The REST projection endpoint is exactly +`GET /repos/{owner}/{repo}/git/commits/{commit_oid}` and its digest domain is +`laconian-github-commit-verification-projection-v1`; `payload` and `signature` byte-equal the values +reconstructed from the raw signed commit. The GraphQL projection requires +`query_sha256 == GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1`, uses domain +`laconian-github-signature-projection-v1`, and contains no payload/signature/time/type/email/ +`wasSignedByGitHub` fields. The observation receipt arrays are REST then GraphQL in that exact +order and use domain `laconian-github-signature-observation-receipt-v1`; transport fields enter no +stable projection, statement, envelope, bundle, tag binding, registry, seed, or plan. The local +five-field record uses `laconian-local-signature-verification-receipt-v1` and omits exactly its self +digest. + +`GITHUB_COMMIT_SIGNER_QUERY_V1` is the exact 357-byte LF-terminated owner query repeated by +Publication Task 2's transport table, and `GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1` is literal +`141ec2ce356c197073e0aeece28a804b56b8c31a615a3d36995c72ce2c9b3d7b`. Evaluation owns both +constants in `protocol_review.py`; Publication imports them by identity and may not copy or alter +the query. The owner bytes are exactly: + +~~~graphql +query ProtocolCommitSignature($owner: String!, $name: String!, $oid: GitObjectID!) { + repository(owner: $owner, name: $name) { + databaseId + object(oid: $oid) { + ... on Commit { + oid + signature { + isValid + state + signer { + databaseId + login + } + } + } + } + } +} +~~~ + +Golden tests hash those UTF-8 bytes plus exactly the displayed final LF independently. GitHub-only evidence forbids +`fingerprint`, `keyring_sha256`, and local receipt fields; SSH/OpenPGP evidence requires all three, +byte-matches the frozen registry fingerprint/keyring, reconstructs the signed payload/signature +hashes from the raw commit, and still requires both REST and GraphQL projections. Every class is +strict/frozen/extra-forbid, each self digest omits only its named self field, and missing/extra, +transport-field injection, tuple reordering, null signer, wrong endpoint/query, and alternate-domain +preimages are negative vectors. + +The following neutral integration surface is also owned only by +`laconian_eval.benchmark.protocol_review`. Runtime imports these exact objects by identity; it does +not invoke an unnamed parser, DAG verifier, bundle/binding constructor, or archive importer: + +~~~python +BENCHMARK_WORKFLOW_PATHS_V1: tuple[RelativePosixPath, ...] = ( + ".github/workflows/audit-pr-validate.yml", + ".github/workflows/benchmark-analysis.yml", + ".github/workflows/benchmark-audit.yml", + ".github/workflows/benchmark-batch.yml", + ".github/workflows/benchmark-collect-complete.yml", + ".github/workflows/benchmark-dismiss-hold.yml", + ".github/workflows/benchmark-docs-validate.yml", + ".github/workflows/benchmark-evidence.yml", + ".github/workflows/benchmark-finalize-invalid.yml", + ".github/workflows/benchmark-hard-score.yml", + ".github/workflows/benchmark-preflight.yml", + ".github/workflows/benchmark-publication-state.yml", + ".github/workflows/benchmark-publish.yml", + ".github/workflows/benchmark-release.yml", + ".github/workflows/publication-pr-validate.yml", +) + + +def build_workflow_inventory( + *, c0_workflow_bytes: Mapping[RelativePosixPath, bytes] +) -> WorkflowInventoryV1: ... + + +def parse_protocol_git_object( + *, oid: GitObjectId, object_type: Literal["blob", "tree", "commit", "tag"], raw_content: bytes +) -> ParsedProtocolGitObjectV1: ... + + +def verify_protocol_review_prefix( + *, + input_tag_ref: InputTagRef, + objects: tuple[ParsedProtocolGitObjectV1, ...], + protocol_reviewer_registry: ProtocolReviewerRegistryV1, + tag_operator_registry: TagOperatorRegistryV1, + tag_ruleset_policy: TagRulesetPolicyV1, + signature_observations: tuple[ + GitHubSignatureObservationReceiptV1, + GitHubSignatureObservationReceiptV1, + GitHubSignatureObservationReceiptV1, + ], + input_tag_creation_suite: TagCreationRuleSuiteReceiptV1, +) -> VerifiedProtocolReviewPrefixV1: ... + + +def verify_protocol_review_dag( + *, + input_tag_ref: InputTagRef, + companion_tag_ref: CompanionTagRef, + objects: tuple[ParsedProtocolGitObjectV1, ...], + protocol_reviewer_registry: ProtocolReviewerRegistryV1, + tag_operator_registry: TagOperatorRegistryV1, + tag_ruleset_policy: TagRulesetPolicyV1, + signature_observations: tuple[GitHubSignatureObservationReceiptV1, ...], + tag_creation_suites: tuple[TagCreationRuleSuiteReceiptV1, TagCreationRuleSuiteReceiptV1], +) -> VerifiedProtocolReviewDagV1: ... + + +def build_protocol_attestation_bundle( + *, verified_prefix: VerifiedProtocolReviewPrefixV1 +) -> ProtocolAttestationBundleV1: ... + + +def build_protocol_attestation_tag_binding( + *, + verified_dag: VerifiedProtocolReviewDagV1, + bundle: ProtocolAttestationBundleV1, +) -> ProtocolAttestationTagBindingV1: ... + + +def build_protocol_review_object_archive( + *, + verified_dag: VerifiedProtocolReviewDagV1, + api_blobs: tuple[ArchivedApiBlobV1, ...], + api_receipts: tuple[ArchivedApiReceiptBindingV1, ...], +) -> ProtocolReviewObjectArchiveV1: ... + + +def load_verified_protocol_review_object_archive( + archive: ProtocolReviewObjectArchiveV1, +) -> VerifiedProtocolReviewDagV1: ... +~~~ + +`ParsedProtocolGitObjectV1`, `VerifiedProtocolReviewPrefixV1`, and +`VerifiedProtocolReviewDagV1` are frozen in-memory dataclasses, not additional serialized authority +schemas. The parser recomputes both the raw Git SHA-1 OID and `GitObjectSHA256V1`. The prefix +verifier accepts exactly the T0/C0/Rstat/Rjudge/Rsecurity closure, the one T0 creation suite, and +the three signature observations; it forbids any B0/T1 object, companion-tag value, envelope, +bundle, or future-object digest. Only that verified prefix can construct the three envelopes and +`ProtocolAttestationBundleV1`, after which the deterministic B0 commit and operator-created T1 may +be built. The complete DAG verifier internally repeats the prefix verification over its exact +prefix, reconstructs the bundle, and requires the supplied B0/T1 closure and both creation suites +to match it byte-for-byte. It accepts the literal tuple order above and no callback, porcelain +result, precomputed trust Boolean, or caller-supplied parent/path/delta. Add a RED/GREEN vector that +constructs B0 from the prefix API while B0/T1 do not yet exist, plus negative vectors for every +future B0/T1 value smuggled into the prefix. `ArchivedApiBlobV1` contains one canonical relative archive +path, byte length, SHA-256, and immutable bytes; its path and digest must match exactly one receipt +wrapper. The archive importer repeats the same parser and DAG verification network-free rather than +trusting the archive's stored roots. Tests inspect all signatures and assert package re-exports are +the identical owner objects. + +`LayerKindV1` is the closed literal `generation|hard-score|judge-request|judge`. +`GenerationLayerRootMemberV1` binds ordinal, model, scenario, both canonical relative paths, the +SealV1 capsule hash, and the scored-sidecar file hash. `AttachmentLayerRootMemberV1` binds ordinal, +model, scenario, one canonical relative path, and its attachment hash. A discriminated +`LayerRootMemberV1` union and `LayerRootIndexV1` require exactly 36 members in canonical +`(generation_model UTF-8 bytes, scenario_uid raw digest bytes)` order, ordinals `0..35`, a matching +member kind, unique safe paths under the kind's fixed subtree, and the domain-separated self digest. + +`AuditReviewerRegistryV1` contains exactly two distinct ordered audit reviewers, including audit +role. `ProtocolReviewerRegistryV1` contains exactly three distinct entries in role order +`statistical_method`, `blind_judge_audit_protocol`, `security_evidence`. Both use the closed +`github_verified_commit | ssh_sha256 | openpgp_fingerprint` vocabulary. GitHub mode requires null +fingerprint; keyed modes require an exact fingerprint; `security_evidence` always requires nonnull +fingerprint and therefore cannot use GitHub mode. Registry and attestation bytes use Task 1 +`CanonicalJSONV1` with no terminal newline and distinct domains. + +Each `ProtocolReviewerBindingV1` has exactly `role`, `reviewer_numeric_account_id`, +`reviewer_login`, `verification_mode`, `signing_fingerprint`, `author_name_ascii`, +`author_email_ascii`, `committer_name_ascii`, and `committer_email_ascii`. All four identity strings +are nonempty canonical printable ASCII satisfying the closed Git name/email grammar. The raw R* +commit must reproduce the frozen author and committer bytes exactly; environment or Git-config +identity, Unicode/control bytes, alternate email/name, or author/committer mismatch is rejected. + +`ProtocolReviewSubjectV1` is exactly `{kind, sha256}`. `ProtocolReviewStatementV1` has exactly, in +schema order, `schema_version`, `role`, `protocol_registry_sha256`, +`reviewer_numeric_account_id`, `reviewer_login`, `verification_mode`, `signing_fingerprint`, +`input_tag_ref`, `input_tag_oid`, `input_tag_object_sha256`, `peeled_c0_oid`, `peeled_c0_sha256`, +`workflow_root`, `subjects`, `subject_root`, `signed_at`, and `statement_sha256`. It contains no +reviewer-commit OID, signature evidence, envelope/bundle value, or future T1 value. +`VerifiedProtocolAttestationV1` has exactly `schema_version`, the complete canonical `statement`, +closed mode-discriminated `signature_evidence`, and `attestation_sha256`; it never repeats or +flattens statement fields. Every signature variant binds the exact reviewer commit/parent/path/raw +Git-object SHA-256 plus stable REST and GraphQL projections; keyed variants additionally bind the +frozen fingerprint/keyring and exact five-field local verification receipt. The three complete +envelopes hash in registry role order to `protocol_attestations_root`. + +Exact subject inventories are owned by tasks: Task 4 owns `hard_score_protocol_sha256`, +`judge_prompt_sha256`, `judge_schema_sha256`; Task 5 owns `corpus_case_root`, +`estimand_protocol_sha256`, `statistical_protocol_sha256`; Task 6 owns +`bootstrap_protocol_sha256`; Task 7 owns `outcome_classification_protocol_sha256`; Task 8 owns +`audit_sampling_protocol_sha256`; Task 9 owns `audit_commit_reveal_protocol_sha256` and +`audit_adjudication_protocol_sha256`; Tasks 11–12 own `false_fail_sensitivity_protocol_sha256`. +The security role owns exactly `provider_request_contract_sha256`, `retry_spend_protocol_sha256`, +`campaign_state_schema_sha256`, `workflow_endpoint_policy_sha256`, +`artifact_security_protocol_sha256`, `publication_correction_protocol_sha256`, +`publication_branch_ruleset_policy_sha256`, `identity_registry_bundle_sha256`, +`state_writer_git_identity_sha256`, `broker_token_delivery_isolation_policy_sha256`, +`broker_signing_keys_root_sha256`, `tag_operator_registry_sha256`, `tag_ruleset_policy_root`, and +`invalid_event_dismissal_policy_sha256`. Runtime/Publication supply and independently verify their +owned C0 subject values; Evaluation owns the exact kind/order contract and signed binding. No role +may omit, reorder, duplicate, add, or borrow a subject. + +`GenerationContextIndexV1` is strict, frozen, extra-forbid, and contains exactly: schema version, +campaign ID, plaintext 64-hex campaign seed and its domain digest, +peeled 40-hex input commit, +hard-scorer source hash, hard-score protocol hash, judge protocol hash, literal requested tier +`default`, literal wire field `service_tier`, statistics protocol hash, audit protocol hash, frozen +C0 workflow-inventory root, +two ordered audit-reviewer bindings and their recomputed registry digest, the complete three-role +protocol-reviewer registry, three ordered protocol attestation bindings and their recomputed root, +the generation layer-root-index digest, the ordered 36 unique generation-capsule hashes, and its +own domain-separated digest. Its validator requires all three embedded statements to repeat the context's +same workflow root and both recomputed registry digests and to match the corresponding role-bound +account ID/login. No self-asserted verification Boolean is accepted. + +`GenerationContextExpectationV1` is strict/frozen/extra-forbid and binds exactly campaign ID, +`campaign_registry_sha256`, both registry digests, `protocol_attestations_root`, predecessor authority root, full generation-layer +root, `expected_context_index_sha256`, `workflow_root`, and its own domain-separated digest. Runtime +reconstructs it privately from current authority and keeps the verified wrapper only in memory. +Serialized expectation bytes may be ordinary offline replay evidence but never a capability. The +context payload additionally binds hard-scorer source, hard-score/judge/statistical/audit protocol +roots, provider-projection root, and ordered capsule roots. `GENERATION_SET_SEALED` later requires +the ordered 36 capsule hashes plus `generation_context_expectation_sha256` and +`verified_generation_context_root`; the expectation digest does not contain itself. + +~~~python +import re +from collections.abc import Mapping +from types import MappingProxyType + +LayerKindV1 = Literal["generation", "hard-score", "judge-request", "judge"] + + +class GenerationLayerRootMemberV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + member_kind: Literal["generation"] + ordinal: int = Field(ge=0, lt=36) + generation_model: str + scenario_uid: str = Field(pattern="^[0-9a-f]{64}$") + capsule_relative_path: str + generation_capsule_sha256: str = Field(pattern="^[0-9a-f]{64}$") + scored_sidecar_relative_path: str + scored_sidecar_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class AttachmentLayerRootMemberV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + member_kind: Literal["hard-score", "judge-request", "judge"] + ordinal: int = Field(ge=0, lt=36) + generation_model: str + scenario_uid: str = Field(pattern="^[0-9a-f]{64}$") + relative_path: str + attachment_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +LayerRootMemberV1 = Annotated[ + GenerationLayerRootMemberV1 | AttachmentLayerRootMemberV1, + Field(discriminator="member_kind"), +] + + +class LayerRootIndexV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-layer-root-index-v1"] + layer_kind: LayerKindV1 + campaign_id: str + members: tuple[LayerRootMemberV1, ...] = Field(min_length=36, max_length=36) + layer_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_closed_layer_index(self) -> Self: + if tuple(member.ordinal for member in self.members) != tuple(range(36)): + raise ValueError("layer members require ordinals 0..35") + keys = tuple( + (member.generation_model.encode("utf-8"), bytes.fromhex(member.scenario_uid)) + for member in self.members + ) + if keys != tuple(sorted(keys)) or len(set(keys)) != 36: + raise ValueError("layer members require unique canonical model/scenario order") + if any(member.member_kind != self.layer_kind for member in self.members): + raise ValueError("layer member kind mismatch") + paths = tuple( + path + for member in self.members + for path in ( + (member.capsule_relative_path, member.scored_sidecar_relative_path) + if isinstance(member, GenerationLayerRootMemberV1) + else (member.relative_path,) + ) + ) + if len(set(paths)) != len(paths): + raise ValueError("layer paths must be unique") + if any( + path.startswith("/") + or "\\" in path + or any(part in {"", ".", ".."} for part in path.split("/")) + for path in paths + ): + raise ValueError("layer paths must be canonical safe POSIX-relative paths") + expected_prefix = { + "generation": "generation/", + "hard-score": "hard-score/", + "judge-request": "judge-requests/", + "judge": "judge/", + }[self.layer_kind] + if any(not path.startswith(expected_prefix) for path in paths): + raise ValueError("layer member path is outside its fixed subtree") + expected = stable_digest( + "laconian-benchmark-layer-root-index-v1", + self.model_dump(mode="json", exclude={"layer_root_index_sha256"}), + ) + if self.layer_root_index_sha256 != expected: + raise ValueError("layer root index self digest mismatch") + return self + + +SignatureVerificationModeV1 = Literal["github_verified_commit", "ssh_sha256", "openpgp_fingerprint"] +ProtocolReviewRoleV1 = Literal[ + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", +] + + +def validate_signature_mode_fingerprint( + mode: SignatureVerificationModeV1, + fingerprint: str | None, + *, + require_keyed: bool = False, +) -> None: + if mode == "github_verified_commit": + if fingerprint is not None or require_keyed: + raise ValueError("GitHub verification requires null fingerprint") + elif mode == "ssh_sha256": + if fingerprint is None or re.fullmatch(r"SHA256:[A-Za-z0-9+/]{43}", fingerprint) is None: + raise ValueError("SSH verification requires an exact SHA256 fingerprint") + elif fingerprint is None or re.fullmatch(r"(?:[0-9A-F]{40}|[0-9A-F]{64})", fingerprint) is None: + raise ValueError("OpenPGP verification requires an uppercase primary-key fingerprint") + + +class ReviewerAccountBindingV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + reviewer_id: str + reviewer_numeric_account_id: int = Field(gt=0) + reviewer_login: str + verification_mode: SignatureVerificationModeV1 + signing_fingerprint: str | None = Field( + pattern=r"^(?:[0-9A-F]{40}|[0-9A-F]{64}|SHA256:[A-Za-z0-9+/]{43})$", + ) + role: Literal["audit_reviewer"] + + @model_validator(mode="after") + def validate_verification_mode(self) -> Self: + validate_signature_mode_fingerprint(self.verification_mode, self.signing_fingerprint) + return self + + +class AuditReviewerRegistryV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-reviewer-registry-v1"] + reviewers: tuple[ReviewerAccountBindingV1, ReviewerAccountBindingV1] + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_audit_reviewer_registry(self) -> Self: + keys = tuple(item.reviewer_id.encode("utf-8") for item in self.reviewers) + if keys != tuple(sorted(keys)) or len(set(keys)) != 2: + raise ValueError("audit reviewer IDs must be distinct and bytewise ordered") + if ( + len({item.reviewer_numeric_account_id for item in self.reviewers}) != 2 + or len({item.reviewer_login for item in self.reviewers}) != 2 + ): + raise ValueError("audit reviewer identities must be distinct") + if self.audit_reviewer_registry_sha256 != compute_audit_reviewer_registry_sha256( + self.reviewers + ): + raise ValueError("audit reviewer registry digest mismatch") + return self + + +class ProtocolReviewerBindingV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + role: ProtocolReviewRoleV1 + reviewer_numeric_account_id: int = Field(gt=0) + reviewer_login: str + verification_mode: SignatureVerificationModeV1 + signing_fingerprint: str | None = Field( + pattern=r"^(?:[0-9A-F]{40}|[0-9A-F]{64}|SHA256:[A-Za-z0-9+/]{43})$", + ) + author_name_ascii: str + author_email_ascii: str + committer_name_ascii: str + committer_email_ascii: str + + @model_validator(mode="after") + def validate_frozen_git_identities(self) -> Self: + validate_git_identity_ascii(self.author_name_ascii, self.author_email_ascii) + validate_git_identity_ascii(self.committer_name_ascii, self.committer_email_ascii) + return self + + +class ProtocolReviewerRegistryV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-protocol-reviewer-registry-v1"] + reviewers: tuple[ + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ] + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_protocol_reviewer_registry(self) -> Self: + expected_roles: tuple[ProtocolReviewRoleV1, ...] = ( + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", + ) + if tuple(reviewer.role for reviewer in self.reviewers) != expected_roles: + raise ValueError("protocol reviewer role order mismatch") + if ( + len({reviewer.reviewer_numeric_account_id for reviewer in self.reviewers}) != 3 + or len({reviewer.reviewer_login for reviewer in self.reviewers}) != 3 + ): + raise ValueError("protocol reviewer identities must be distinct") + for reviewer in self.reviewers: + validate_signature_mode_fingerprint( + reviewer.verification_mode, + reviewer.signing_fingerprint, + require_keyed=reviewer.role == "security_evidence", + ) + expected = compute_protocol_reviewer_registry_sha256(self.reviewers) + if self.protocol_reviewer_registry_sha256 != expected: + raise ValueError("protocol reviewer registry digest mismatch") + return self + + +ProtocolSubjectKindV1 = Literal[ + "corpus_case_root", + "estimand_protocol_sha256", + "statistical_protocol_sha256", + "bootstrap_protocol_sha256", + "outcome_classification_protocol_sha256", + "false_fail_sensitivity_protocol_sha256", + "hard_score_protocol_sha256", + "judge_prompt_sha256", + "judge_schema_sha256", + "audit_sampling_protocol_sha256", + "audit_commit_reveal_protocol_sha256", + "audit_adjudication_protocol_sha256", + "provider_request_contract_sha256", + "retry_spend_protocol_sha256", + "campaign_state_schema_sha256", + "workflow_endpoint_policy_sha256", + "artifact_security_protocol_sha256", + "publication_correction_protocol_sha256", + "publication_branch_ruleset_policy_sha256", + "identity_registry_bundle_sha256", + "state_writer_git_identity_sha256", + "broker_token_delivery_isolation_policy_sha256", + "broker_signing_keys_root_sha256", + "tag_operator_registry_sha256", + "tag_ruleset_policy_root", + "invalid_event_dismissal_policy_sha256", +] + + +PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1: Mapping[ + ProtocolReviewRoleV1, + tuple[ProtocolSubjectKindV1, ...], +] = MappingProxyType( + { + "statistical_method": ( + "corpus_case_root", + "estimand_protocol_sha256", + "statistical_protocol_sha256", + "bootstrap_protocol_sha256", + "outcome_classification_protocol_sha256", + "false_fail_sensitivity_protocol_sha256", + ), + "blind_judge_audit_protocol": ( + "hard_score_protocol_sha256", + "judge_prompt_sha256", + "judge_schema_sha256", + "audit_sampling_protocol_sha256", + "audit_commit_reveal_protocol_sha256", + "audit_adjudication_protocol_sha256", + ), + "security_evidence": ( + "provider_request_contract_sha256", + "retry_spend_protocol_sha256", + "campaign_state_schema_sha256", + "workflow_endpoint_policy_sha256", + "artifact_security_protocol_sha256", + "publication_correction_protocol_sha256", + "publication_branch_ruleset_policy_sha256", + "identity_registry_bundle_sha256", + "state_writer_git_identity_sha256", + "broker_token_delivery_isolation_policy_sha256", + "broker_signing_keys_root_sha256", + "tag_operator_registry_sha256", + "tag_ruleset_policy_root", + "invalid_event_dismissal_policy_sha256", + ), + } +) + + +class ProtocolReviewSubjectV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + kind: ProtocolSubjectKindV1 + sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class GitHubVerifiedCommitEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["GitHubVerifiedCommitEvidenceV1"] + verification_mode: Literal["github_verified_commit"] + commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + commit_object_sha256: str = Field(pattern="^[0-9a-f]{64}$") + parent_commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + statement_path: str + github_rest_verification: GitHubCommitVerificationProjectionV1 + github_graphql_signature: GitHubSignatureProjectionV1 + + +class SSHVerifiedCommitEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["SSHVerifiedCommitEvidenceV1"] + verification_mode: Literal["ssh_sha256"] + commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + commit_object_sha256: str = Field(pattern="^[0-9a-f]{64}$") + parent_commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + statement_path: str + github_rest_verification: GitHubCommitVerificationProjectionV1 + github_graphql_signature: GitHubSignatureProjectionV1 + fingerprint: str = Field(pattern=r"^SHA256:[A-Za-z0-9+/]{43}$") + keyring_sha256: str = Field(pattern="^[0-9a-f]{64}$") + local_signature_verification: LocalSignatureVerificationReceiptV1 + + +class OpenPGPVerifiedCommitEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["OpenPGPVerifiedCommitEvidenceV1"] + verification_mode: Literal["openpgp_fingerprint"] + commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + commit_object_sha256: str = Field(pattern="^[0-9a-f]{64}$") + parent_commit_oid: str = Field(pattern="^[0-9a-f]{40}$") + statement_path: str + github_rest_verification: GitHubCommitVerificationProjectionV1 + github_graphql_signature: GitHubSignatureProjectionV1 + fingerprint: str = Field(pattern=r"^(?:[0-9A-F]{40}|[0-9A-F]{64})$") + keyring_sha256: str = Field(pattern="^[0-9a-f]{64}$") + local_signature_verification: LocalSignatureVerificationReceiptV1 + + +SignatureEvidenceV1 = Annotated[ + GitHubVerifiedCommitEvidenceV1 | SSHVerifiedCommitEvidenceV1 | OpenPGPVerifiedCommitEvidenceV1, + Field(discriminator="verification_mode"), +] + + +class ProtocolReviewStatementV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["ProtocolReviewStatementV1"] + role: ProtocolReviewRoleV1 + protocol_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + reviewer_numeric_account_id: int = Field(gt=0) + reviewer_login: str + verification_mode: SignatureVerificationModeV1 + signing_fingerprint: str | None = Field( + pattern=r"^(?:[0-9A-F]{40}|[0-9A-F]{64}|SHA256:[A-Za-z0-9+/]{43})$", + ) + input_tag_ref: str + input_tag_oid: str = Field(pattern="^[0-9a-f]{40}$") + input_tag_object_sha256: str = Field(pattern="^[0-9a-f]{64}$") + peeled_c0_oid: str = Field(pattern="^[0-9a-f]{40}$") + peeled_c0_sha256: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + subjects: tuple[ProtocolReviewSubjectV1, ...] + subject_root: str = Field(pattern="^[0-9a-f]{64}$") + signed_at: str + statement_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_role_subjects_and_digest(self) -> Self: + expected_subjects = PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1[self.role] + if tuple(item.kind for item in self.subjects) != expected_subjects: + raise ValueError("protocol statement subject inventory/order mismatch") + validate_signature_mode_fingerprint( + self.verification_mode, + self.signing_fingerprint, + require_keyed=self.role == "security_evidence", + ) + expected_subject_root = protocol_review_digest( + "laconian-protocol-review-subjects-root-v1", + [item.model_dump(mode="json") for item in self.subjects], + ) + if self.subject_root != expected_subject_root: + raise ValueError("protocol statement subject root mismatch") + expected = protocol_review_digest( + "laconian-protocol-review-statement-v1", + self.model_dump(mode="json", exclude={"statement_sha256"}), + ) + if self.statement_sha256 != expected: + raise ValueError("protocol statement digest mismatch") + return self + + +class VerifiedProtocolAttestationV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["VerifiedProtocolAttestationV1"] + statement: ProtocolReviewStatementV1 + signature_evidence: SignatureEvidenceV1 + attestation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +def canonical_reviewer_registry_bytes( + reviewers: tuple[ReviewerAccountBindingV1, ReviewerAccountBindingV1], +) -> bytes: + return canonical_json_v1( + { + "schema_version": "benchmark-reviewer-registry-v1", + "reviewers": [item.model_dump(mode="json") for item in reviewers], + } + ) + + +def compute_audit_reviewer_registry_sha256( + reviewers: tuple[ReviewerAccountBindingV1, ReviewerAccountBindingV1], +) -> str: + return hashlib.sha256(canonical_reviewer_registry_bytes(reviewers)).hexdigest() + + +def canonical_protocol_reviewer_registry_bytes( + reviewers: tuple[ + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ], +) -> bytes: + return canonical_json_v1( + { + "schema_version": "benchmark-protocol-reviewer-registry-v1", + "reviewers": [item.model_dump(mode="json") for item in reviewers], + } + ) + + +def compute_protocol_reviewer_registry_sha256( + reviewers: tuple[ + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ProtocolReviewerBindingV1, + ], +) -> str: + return hashlib.sha256(canonical_protocol_reviewer_registry_bytes(reviewers)).hexdigest() + + +def compute_protocol_attestations_root( + attestations: tuple[ + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + ], +) -> str: + expected_roles: tuple[ProtocolReviewRoleV1, ...] = ( + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", + ) + if tuple(item.statement.role for item in attestations) != expected_roles: + raise ValueError("protocol attestation root role order mismatch") + return protocol_review_digest( + "laconian-verified-protocol-attestations-root-v1", + [item.model_dump(mode="json") for item in attestations], + ) + + +class BenchmarkProtocolBindingsV1(BaseModel): + """One centrally owned immutable projection repeated by every downstream attachment.""" + + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + campaign_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestation_tag_binding_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestation_bundle_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_review_object_archive_sha256: str = Field(pattern="^[0-9a-f]{64}$") + object_closure_root: str = Field(pattern="^[0-9a-f]{64}$") + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + hard_scorer_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + corpus_case_root: str = Field(pattern="^[0-9a-f]{64}$") + estimand_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + bootstrap_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + outcome_classification_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + false_fail_sensitivity_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + + +def protocol_bindings_from_context( + context: "GenerationContextIndexV1", +) -> BenchmarkProtocolBindingsV1: + return BenchmarkProtocolBindingsV1.model_validate( + {name: getattr(context, name) for name in BenchmarkProtocolBindingsV1.model_fields} + ) + + +class GenerationContextIndexV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-generation-context-index-v1"] + campaign_id: str + campaign_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestation_tag_binding_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestation_bundle_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_review_object_archive_sha256: str = Field(pattern="^[0-9a-f]{64}$") + object_closure_root: str = Field(pattern="^[0-9a-f]{64}$") + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + campaign_seed: str = Field(pattern="^[0-9a-f]{64}$") + campaign_seed_sha256: str = Field(pattern="^[0-9a-f]{64}$") + input_tag_commit: str = Field(pattern="^[0-9a-f]{40}$") + hard_scorer_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_requested_service_tier: Literal["default"] + judge_service_tier_wire_field: Literal["service_tier"] + corpus_case_root: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + estimand_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + bootstrap_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + outcome_classification_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + false_fail_sensitivity_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + audit_reviewer_registry: AuditReviewerRegistryV1 + protocol_reviewer_registry: ProtocolReviewerRegistryV1 + protocol_attestations: tuple[ + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + ] + generation_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_projection_root: str = Field(pattern="^[0-9a-f]{64}$") + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_closed_generation_context(self) -> Self: + expected_seed_sha256 = stable_digest( + "laconian-campaign-seed-v1", + { + "schema_version": "1", + "algorithm": "public-hex-seed-v1", + "campaign_seed": self.campaign_seed, + }, + ) + if self.campaign_seed_sha256 != expected_seed_sha256: + raise ValueError("generation context campaign seed digest mismatch") + if len(set(self.ordered_generation_capsule_sha256s)) != 36: + raise ValueError("generation context requires 36 unique capsule parents") + reviewers = self.audit_reviewer_registry.reviewers + reviewer_keys = tuple(reviewer.reviewer_id.encode("utf-8") for reviewer in reviewers) + if ( + reviewer_keys != tuple(sorted(reviewer_keys)) + or len(set(reviewer_keys)) != 2 + or len({reviewer.reviewer_numeric_account_id for reviewer in reviewers}) != 2 + or len({reviewer.reviewer_login for reviewer in reviewers}) != 2 + ): + raise ValueError("generation context requires two ordered distinct reviewers") + if self.audit_reviewer_registry_sha256 != compute_audit_reviewer_registry_sha256(reviewers): + raise ValueError("generation context reviewer registry digest mismatch") + expected_roles: tuple[ProtocolReviewRoleV1, ...] = ( + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", + ) + protocol_reviewers = self.protocol_reviewer_registry.reviewers + if tuple(item.statement.role for item in self.protocol_attestations) != expected_roles: + raise ValueError("generation context requires the ordered protocol review roles") + if tuple(reviewer.role for reviewer in protocol_reviewers) != expected_roles: + raise ValueError("generation context protocol reviewer role order mismatch") + if ( + len({item.attestation_sha256 for item in self.protocol_attestations}) != 3 + or len({reviewer.reviewer_numeric_account_id for reviewer in protocol_reviewers}) != 3 + or len({reviewer.reviewer_login for reviewer in protocol_reviewers}) != 3 + ): + raise ValueError("generation context requires three distinct protocol reviewers") + if self.protocol_reviewer_registry.protocol_reviewer_registry_sha256 != ( + compute_protocol_reviewer_registry_sha256(protocol_reviewers) + ): + raise ValueError("generation context protocol reviewer registry digest mismatch") + for attestation, reviewer in zip( + self.protocol_attestations, + protocol_reviewers, + strict=True, + ): + if ( + attestation.statement.role != reviewer.role + or attestation.statement.reviewer_numeric_account_id + != reviewer.reviewer_numeric_account_id + or attestation.statement.reviewer_login != reviewer.reviewer_login + or attestation.statement.protocol_registry_sha256 + != self.protocol_reviewer_registry.protocol_reviewer_registry_sha256 + or attestation.statement.workflow_root != self.workflow_root + ): + raise ValueError("generation context protocol attestation identity mismatch") + if self.protocol_attestations_root != ( + compute_protocol_attestations_root(self.protocol_attestations) + ): + raise ValueError("generation context protocol review root mismatch") + expected = stable_digest( + "laconian-benchmark-generation-context-index-v1", + self.model_dump(mode="json", exclude={"generation_context_index_sha256"}), + ) + if self.generation_context_index_sha256 != expected: + raise ValueError("generation context self digest mismatch") + return self + + +class GenerationContextExpectationV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-generation-context-expectation-v1"] + campaign_id: str + campaign_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + predecessor_authority_root_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_layer_root: str = Field(pattern="^[0-9a-f]{64}$") + expected_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_self_digest(self) -> Self: + expected = stable_digest( + "laconian-benchmark-generation-context-expectation-v1", + self.model_dump( + mode="json", + exclude={"generation_context_expectation_sha256"}, + ), + ) + if self.generation_context_expectation_sha256 != expected: + raise ValueError("generation context expectation self digest mismatch") + return self + + +@dataclass(frozen=True, slots=True) +class VerifiedGenerationContextExpectationV1: + expectation: GenerationContextExpectationV1 + bound_generation_complete_authority_root_sha256: str + + +@dataclass(frozen=True, slots=True) +class VerifiedGenerationContextIndexV1: + expectation: VerifiedGenerationContextExpectationV1 + index: GenerationContextIndexV1 + root_index: LayerRootIndexV1 + generation_evidence: tuple[VerifiedScoredCapsuleV2, ...] + + +def write_layer_root_index(root: Path, index: LayerRootIndexV1) -> None: + """Write the kind-specific fixed index.json canonically with no replacement.""" + + +def load_layer_root_index(root: Path, *, expected_kind: LayerKindV1) -> LayerRootIndexV1: + """Load the fixed layer subtree, reject aliases/extras, and recompute its digest.""" + + +def write_generation_context_index( + generation_index_path: Path, + index: GenerationContextIndexV1, +) -> None: + """No-replace write the Slice 3 adapter's canonical pre-judge context file.""" + + +def load_verified_generation_context_index( + *, + generation_index_path: Path, + generation_root: Path, + expectation: VerifiedGenerationContextExpectationV1, +) -> VerifiedGenerationContextIndexV1: + """Verify context against its expectation and all layer/capsule parents.""" +~~~ + +The two registry byte contracts are exact and independent: +`canonical_json_v1({"schema_version": "benchmark-reviewer-registry-v1", "reviewers": +[item.model_dump(mode="json") for item in audit_reviewers]})` for the two +bytewise-reviewer-ID-ordered audit bindings, and +`canonical_json_v1({"schema_version": "benchmark-protocol-reviewer-registry-v1", "reviewers": +[item.model_dump(mode="json") for item in protocol_reviewers]})` for the three fixed-role protocol +bindings. Neither byte string has a terminal newline. Each digest +is raw SHA-256 over its own freshly +regenerated bytes. The attestation root is +`protocol_review_digest("laconian-verified-protocol-attestations-root-v1", +[item.model_dump(mode="json") for item in protocol_attestations])` over the three complete +attestations in fixed role order. Tests reject any cross-population reuse, reordered identity, string/Boolean numeric ID, +login rename, omitted protocol fingerprint, or digest copied without exact byte equality. + +`context.py` intentionally provides no raw-file-to-verified-expectation loader. The fixed +campaign-side module `laconian_eval.campaign.runtime` owns that trust transition: it +reconstructs the predecessor and final `GENERATION_COMPLETE` authority roots read-only, parses the +fixed expectation child canonically, recomputes its self digest, verifies every expectation field +against the campaign registry and generation-layer roots, including exact equality of +`campaign_registry_sha256` to the freshly verified registry self digest, requires the final authority root to bind +that exact expectation digest, +and only then constructs `VerifiedGenerationContextExpectationV1` in memory. Its three stage +functions `Runtime.hard_score`, `Runtime.prepare_judge`, and `Runtime.seal_judge` import and +call the benchmark loaders/builders with that wrapper. These are the Runtime-owned first three of +the seven live boundaries frozen in Task 15; Publication's four exact `evaluation_stage` boundaries +reconstruct/reuse the same wrapper for provider/audit/analysis loading. `context.py`, +`hard_score.py`, and `judge.py` never import the +campaign module. Runtime Task 7 must own adapter tests for wrong predecessor/final +root, copied expectation bytes, a forged internally rehashed context, and a context digest not bound +by the retained transition; the wrapper's final-root field must be exactly 64 lowercase hexadecimal +characters and equal the freshly reconstructed final root. Publication invokes the campaign-side +stage functions; it never treats a standalone expectation path or a raw digest as authorization. + +The loader accepts only the exact `GENERATION/generation-context.json` file and the exact +`GENERATION/generation/index.json` root index, revalidates both, verifies every retained +capsule/sidecar pair with `load_verified_scored_capsule`, and requires the ordered vector and every +model/scenario identity to match. Before reading context authority fields it derives the expected +digest only from `expectation.expectation.expected_context_index_sha256`, requires the parsed +context self digest to equal that value, and requires campaign, both reviewer registries, +campaign-registry, attestation, workflow, and generation-root digests to match the expectation. There is no raw expected-digest +argument, argv option, environment value, or value read from the context/index under test. Runtime +Task 7 is the sole producer adapter; it constructs this +campaign-neutral record from verified `CampaignRegistryV1` and the class-bound C0 inventory peeled +from T0 and verified through the paired T1/tag-binding closure, +including the statistics protocol later consumed by analysis, but no campaign type crosses into +`context.py`. + +The singular `audit_protocol_sha256` is not an additional attestation subject and does not alter the +three approved role inventories above. Runtime derives it from the exact verified-C0 +`benchmarks/protocols/public-three-model-v1/audit.json` member and supplies it through its verified +registry adapter. `GenerationContextIndexV1` and `BenchmarkProtocolBindingsV1` store that exact value; +their validators reject a caller scalar, a second audit-digest alias, or any value that differs from +the Runtime registry binding. Every downstream object that carries `protocol_bindings` therefore +inherits this singular audit-protocol authority without redefining its source. + +Then define the hard-score schemas: + +~~~python +HardReasonCode = Literal[ + "hard_pass", + "provider_rejected", + "retry_exhausted", + "blank_output", + "required_literal", + "forbidden_literal", + "json_object", + "json_key_set", + "yaml_mapping", + "yaml_key_set", + "min_sentences", + "max_sentences", +] + + +class HardScoreRecordV1(CapsuleModel): + ordinal: StrictNonNegativeInt + plan_item_id: Sha256 + attempt_id: Sha256 + response_id: Sha256 | None + terminal_reason: TerminalReason + hard_pass: StrictBool + reason_codes: tuple[HardReasonCode, ...] = Field(min_length=1) + judge_request_id: Sha256 | None + + +class HardScoreRequestSetV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + generation_model: BoundedNonBlankString + scenario_uid: Sha256 + generation_capsule_sha256: Sha256 + manifest_sha256: Sha256 + plan_sha256: Sha256 + hard_scorer_source_sha256: Sha256 + hard_score_protocol_sha256: Sha256 + judge_protocol_sha256: Sha256 + protocol_bindings: BenchmarkProtocolBindingsV1 + records: tuple[HardScoreRecordV1, ...] = Field(min_length=1, max_length=40) + ordered_judge_request_ids: tuple[Sha256, ...] + hard_score_request_set_sha256: Sha256 +~~~ + +Hard-pass rows require a nonnull response_id, reason_codes exactly ("hard_pass",), and a nonnull +judge_request_id. Hard-fail rows require judge_request_id null and sorted unique reason codes. +Provider failures retain response_id null; successful deterministic failures retain their persisted +response_id. Records must have ordinals 0..39 and exact plan order. + +Derive each judge request without a circular attachment dependency: + +~~~python +def derive_judge_request_id( + *, + campaign_id: str, + generation_capsule_sha256: str, + plan_item_id: str, + response_id: str, + judge_protocol_sha256: str, +) -> str: + return stable_digest( + "laconian-judge-request-v1", + { + "campaign_id": campaign_id, + "generation_capsule_sha256": generation_capsule_sha256, + "plan_item_id": plan_item_id, + "response_id": response_id, + "judge_protocol_sha256": judge_protocol_sha256, + }, + ) +~~~ + +Derive hard_score_request_set_sha256 over every preceding field using domain +laconian-hard-score-request-set-v1; exclude only hard_score_request_set_sha256 itself. + +- [ ] **Step 5: Implement the builder and verifier** + +~~~python +def build_hard_score_request_set( + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + boundary_ordinal: int, +) -> HardScoreRequestSetV1: + """Derive every identity from one verified context member and build its exact 40 rows.""" + + +def recompute_hard_score_request_set_sha256( + attachment: HardScoreRequestSetV1, +) -> str: + """Revalidate the model, omit only its self hash, and recompute the domain digest.""" + + +def verify_hard_score_request_set( + attachment: HardScoreRequestSetV1, + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + boundary_ordinal: int, +) -> None: + """Rebuild from verified context and require canonical equality of all identities.""" +~~~ + +Map existing CheckResult names to the closed HardReasonCode enum. Unknown check names are an +integrity error, never free-form reason text. +`boundary_ordinal` selects exactly one aligned generation root member and verified scored capsule; +both functions first require the separately supplied verified Runtime-bound expectation to equal +the wrapper retained by the context and derive the expected digest from it internally. The wrapper +is threaded only by the in-process campaign-stage caller; neither a digest nor an expectation path +is exposed as a benchmark CLI option. +The builder derives campaign ID, generation model, scenario UID, hard-scorer source hash, +hard-score protocol hash, and judge protocol hash from that class-bound context and never accepts +them as scalar arguments. The verifier class-bound revalidates the context, root index, selected +member, and capsule/sidecar, invokes the builder, and canonical-byte compares the result. No source +hash, protocol hash, campaign/model/scenario identity, or workflow root comes from a CLI option, +environment value, attachment-under-test, or caller inference. + +Before GREEN, re-export the Task 3 owner objects from `laconian_eval.benchmark`, including +`ProtocolSubjectKindV1`, `PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1`, +`GitHubVerifiedCommitEvidenceV1`, `SSHVerifiedCommitEvidenceV1`, +`OpenPGPVerifiedCommitEvidenceV1`, and `SignatureEvidenceV1`. Import each name directly from +`protocol_review`; do not rebuild the Literal, mapping, or union in `__init__.py`. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_protocol_review.py tests/benchmark/test_context.py tests/benchmark/test_hard_score.py +uv run ruff check src/laconian_eval/benchmark/protocol_review.py src/laconian_eval/benchmark/context.py src/laconian_eval/benchmark/hard_score.py tests/benchmark +uv run mypy src/laconian_eval/benchmark/protocol_review.py src/laconian_eval/benchmark/context.py src/laconian_eval/benchmark/hard_score.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/protocol_review.py src/laconian_eval/benchmark/context.py src/laconian_eval/benchmark/hard_score.py tests/benchmark/helpers.py tests/benchmark/test_protocol_review.py tests/benchmark/test_context.py tests/benchmark/test_hard_score.py +git commit -m "feat: seal hard-score request sets" +~~~ + +### Task 4: Freeze the blind-judge request, result, and attachment schemas + +**Files:** + +- Create: `src/laconian_eval/benchmark/judge.py` +- Create: `tests/benchmark/test_judge.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write schema and blinding tests** + +Create tests named: + +- `test_blind_request_schema_exposes_only_allowed_fields`; assert its dumped keys equal exactly + `judge_request_id`, `blind_id`, `prompt`, `locale`, `rubric`, + `material_warning_requirement`, `material_warning_severity`, and `candidate_response`. +- `test_candidate_text_remains_delimited_untrusted_data`. +- `test_judgment_overall_pass_is_derivable_and_malformed_rows_fail_closed`. +- `test_judge_attachment_binds_capsule_and_request_set_with_exact_coverage`. +- `test_zero_request_judge_attachment_is_sealed_without_calls`. +- `test_judge_attempt_evidence_binds_request_blind_response_usage_delivery_terminal_and_parents`. +- `test_judge_attempt_root_requires_exact_36_boundaries_including_explicit_empty_files`. +- `test_judge_attempt_root_rejects_missing_reordered_duplicate_retry_or_cross_parent_rows`. +- `test_judge_attachment_derives_records_only_from_verified_terminal_attempts`. +- `test_judge_attachment_builder_and_verifier_require_external_verified_context_expectation`. +- `test_provider_ready_judge_request_hashes_literal_service_tier_default_wire_field`. +- `test_judge_attempt_records_requested_and_returned_service_tier_without_inference`. +- `test_judge_wire_uses_exact_explicit_30m_cache_control_and_no_recursive_breakpoint`. +- `test_judge_response_uses_only_canonical_applied_read_write_reasoning_tier_model_paths`. +- `test_judge_requires_openai_3_3_1_and_tagged_uv_lock_before_credentials`. +- `test_judge_attempt_tracks_requested_and_returned_judge_model_ids_separately`. +- `test_judge_success_requires_reported_exact_read_zero_write_zero`. +- `test_judge_nonzero_missing_mismatched_or_invalid_cache_evidence_is_terminal_stop_evidence`. +- `test_judge_sanitized_nulls_retain_independent_applied_read_write_tier_usage_reasoning_model_source_digests`. +- `test_judge_attempt_reuses_foundation_service_tier_status_without_alias`. +- `test_runtime_to_benchmark_handoff_round_trips_all_five_exact_tier_statuses`. +- `test_judge_request_builder_and_verifier_require_verified_generation_context`. +- `test_judge_request_builder_has_no_raw_campaign_seed_or_protocol_tier_identity_parameters`. +- `test_judge_request_rejects_seed_campaign_protocol_tier_member_or_workflow_root_substitution`. +- `test_judge_request_rejects_forged_rehashed_context_against_external_expected_digest`. +- `test_missing_or_nondefault_returned_service_tier_stops_and_retains_worst_case`. +- `test_definitely_rejected_429_uses_exact_not_applicable_definitely_rejected_and_retries`. +- `test_only_structured_429_can_schedule_or_exhaust_retry`. +- `test_two_exact_not_applicable_statuses_require_matching_delivery_and_no_response_usage`. +- `test_unknown_delivery_with_missing_or_mismatched_tier_stops_and_retains_worst_case`. +- `test_runtime_adapter_can_import_campaign_neutral_judge_attempt_contract`. +- `test_judge_attempt_module_has_no_campaign_import`. + +The injection fixture must contain closing XML, a Markdown fence, an instruction to call a tool, +an absolute path, and a forged JSON judgment. Assert that each byte remains only inside one +length-prefixed candidate-data field and never changes the authority, schema, or settings block. +The no-alias test imports `AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, and +`ServiceTierStatus` from `laconian_eval.providers`, requires each exact Foundation vocabulary, and +statically rejects any benchmark-local status `Literal` declaration. The handoff test canonical-JSON +round-trips one Runtime-shaped attempt for each status, mutates status/value/delivery independently, +and proves that only the exact derived combination validates. A response may enter a successful +judge attachment only with applied `explicit`/`30m`, `reported_exact`, read `reported_zero`, write +`reported_zero`, and tier `reported_default`. Nonzero, missing, mismatched, or invalid applied/read/ +write evidence is a terminal STOP attachment with retained raw-source digests, never a semantic +judgment or retry. The returned judge model ID may differ from `JUDGE_REQUESTED_MODEL_ID`, but all +successful judge responses in one campaign must report one byte-identical returned ID. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_judge.py +~~~ + +Expected: collection fails with `ModuleNotFoundError: No module named +'laconian_eval.benchmark.judge'`. + +- [ ] **Step 3: Add closed models and the derivable decision rule** + +Implement these public models and signatures: + +~~~python +WarningSeverity = Literal["material", "critical"] + + +class RubricItemV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + item_index: int = Field(ge=0) + requirement: str = Field(min_length=1, max_length=2_000) + + +class BlindJudgeRequestV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + judge_request_id: str + blind_id: str + prompt: str = Field(min_length=1, max_length=20_000) + locale: str + rubric: tuple[RubricItemV1, ...] + material_warning_requirement: str | None = Field(default=None, min_length=1, max_length=2_000) + material_warning_severity: WarningSeverity | None + candidate_response: str = Field(min_length=1, max_length=40_000) + + +class RubricItemJudgmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + item_index: int = Field(ge=0) + passed: bool + evidence: str = Field(min_length=1, max_length=1_000) + + +class WarningJudgmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + passed: bool + evidence: str = Field(min_length=1, max_length=1_000) + + +class StructuredJudgmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + judge_request_id: str + blind_id: str + rubric_items: tuple[RubricItemJudgmentV1, ...] + material_warning: WarningJudgmentV1 | None + material_contradiction: bool + contradiction_evidence: str | None = Field(default=None, max_length=1_000) + semantic_pass: bool + + +def derive_semantic_pass( + *, + rubric_items: Sequence[RubricItemJudgmentV1], + material_warning_requirement: str | None, + material_warning: WarningJudgmentV1 | None, + material_contradiction: bool, +) -> bool: + return ( + all(item.passed for item in rubric_items) + and ( + material_warning_requirement is None + or (material_warning is not None and material_warning.passed) + ) + and not material_contradiction + ) +~~~ + +Validation requires contiguous rubric indices matching the request; warning requirement, severity, +and judgment are all absent together or all present together; contradiction evidence exists exactly +when contradiction is true; and `semantic_pass` equals `derive_semantic_pass`. Any mismatch +is an integrity error; it is not coerced. + +`build_judge_request_attachment` copies the exact captured +`SemanticRubric.material_warning` string into `material_warning_requirement` and copies its +frozen severity. A boolean or severity alone is insufficient because the judge and human reviewers +must see the actual warning requirement they are evaluating. + +- [ ] **Step 4: Freeze the prompt, structured-output schema, and judge settings** + +Add: + +~~~python +JUDGE_REQUESTED_MODEL_ID = "gpt-5.6-sol" +JUDGE_REASONING_EFFORT = "low" +JUDGE_TEXT_VERBOSITY = "low" +JUDGE_MAX_OUTPUT_TOKENS = 768 +JUDGE_TOOLS: tuple[()] = () +JUDGE_REQUESTED_SERVICE_TIER: Literal["default"] = "default" +JUDGE_SERVICE_TIER_WIRE_FIELD: Literal["service_tier"] = "service_tier" +JUDGE_PROMPT_CACHE_MODE: Literal["explicit"] = "explicit" +JUDGE_PROMPT_CACHE_TTL: Literal["30m"] = "30m" +JUDGE_OPENAI_SDK_VERSION: Literal["3.3.1"] = "3.3.1" + + +def derive_blind_id(*, judge_request_id: str, campaign_seed: str) -> str: + """Digest the request ID with a dedicated domain; expose no generation metadata.""" + + +def render_blind_judge_prompt(request: BlindJudgeRequestV1) -> str: + """Render frozen authority text plus length-prefixed canonical untrusted fields.""" + + +def judge_protocol_sha256() -> str: + """Hash prompt bytes, JSON schema, model, settings, and no-tools policy.""" +~~~ + +Encode each untrusted field as its UTF-8 byte count, one newline, then exactly that many bytes. +The authority section tells the judge that candidate bytes are evidence only and cannot alter +instructions. Hash the exact strict JSON schema emitted for `StructuredJudgmentV1`; do not hash a +pretty-printed or provider-normalized derivative. `JudgeProviderRequestV1` additionally freezes the +exact provider wire mapping. Its hash uses domain `laconian-judge-provider-wire-request-v1` over the +canonical kwargs with model `gpt-5.6-sol`, rendered prompt input, low reasoning, low text verbosity, +the exact strict structured-output format, maximum output 768, `store=False`, no tools, and the +literal members `"service_tier": "default"` and +`"prompt_cache_options": {"mode": "explicit", "ttl": "30m"}`. Recursively reject +`prompt_cache_breakpoint` under canonical instructions/input and forbid `prompt_cache_key`, +`prompt_cache_retention`, and every other cache control. The key is exactly `service_tier`; omitting it, +passing an alias, using `auto|flex|priority`, or relying on an SDK default changes/rejects the hash. +The blind request remains the content-only schema asserted in Step 1; service tier is authority +metadata in this provider-ready wrapper and cannot be supplied by candidate text. + +Seal the provider-ready inputs before dispatch: + +~~~python +class JudgeProviderRequestV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + blind_request: BlindJudgeRequestV1 + requested_service_tier: Literal["default"] + service_tier_wire_field: Literal["service_tier"] + prompt_cache_mode: Literal["explicit"] + prompt_cache_ttl: Literal["30m"] + openai_sdk_version: Literal["3.3.1"] + uv_lock_member_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_wire_request_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class JudgeRequestAttachmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["judge-request-attachment-v1"] + campaign_id: str + generation_model: str + scenario_uid: str + generation_capsule_sha256: str + hard_score_request_set_sha256: str + judge_protocol_sha256: str + protocol_bindings: BenchmarkProtocolBindingsV1 + campaign_seed_sha256: str + requested_service_tier: Literal["default"] + service_tier_wire_field: Literal["service_tier"] + prompt_cache_mode: Literal["explicit"] + prompt_cache_ttl: Literal["30m"] + requests: tuple[JudgeProviderRequestV1, ...] + judge_request_attachment_sha256: str + + +def build_judge_request_attachment( + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + boundary_ordinal: int, + request_set: HardScoreRequestSetV1, +) -> JudgeRequestAttachmentV1: + """Derive authority from context and build ordered blind inputs from its sealed member.""" + + +def verify_judge_request_attachment( + attachment: JudgeRequestAttachmentV1, + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + boundary_ordinal: int, + request_set: HardScoreRequestSetV1, +) -> None: + """Rebuild from verified context and require exact request, blind, tier, parent, and bytes.""" +~~~ + +Request IDs inside `JudgeProviderRequestV1.blind_request` must exactly equal the hard-score set's +ordered IDs. Both attachment-level tier fields and every wrapper must equal the frozen constants, +and every wire-request hash is independently regenerated from the rendered prompt/settings. The request attachment digest +excludes only its own field and uses domain `laconian-judge-request-attachment-v1`. A zero-request +hard-score set produces a sealed empty request attachment and no provider input rows. +Before credentials, verify installed OpenAI SDK `3.3.1`, the C0-derived `uv.lock` member hash, and +typed support for the frozen wire/response members. Judge evidence reads only +`response.service_tier`, `response.prompt_cache_options.mode/ttl`, +`response.usage.input_tokens`, `response.usage.input_tokens_details.cached_tokens`, +`response.usage.input_tokens_details.cache_write_tokens`, `response.usage.output_tokens`, +`response.usage.output_tokens_details.reasoning_tokens`, `response.usage.total_tokens`, and +`response.model`, retaining an independent source digest for each dimension. +The boundary ordinal selects the same generation member used by the hard-score set. Both functions +first require the separately supplied verified Runtime-bound expectation to equal the wrapper held +by the context, derive its expected context digest, and require that digest to equal the context +index. They then class-bound revalidate `VerifiedGenerationContextIndexV1`, derive the evidence object, campaign ID, +plaintext seed, seed digest, judge protocol, requested literal tier, and exact wire-field name from +that context, and recompute every blind ID. They reject a context/request-set member mismatch even +when the attacker recomputes both self hashes; an independently rehashed forged context also fails +against the retained expectation. No overload accepts a raw seed, campaign ID, protocol +hash, tier, wire field, generation model, scenario, or independently supplied evidence object. + +- [ ] **Step 5: RED-test the judge SDK contract before credentials** + +Implement `test_judge_requires_openai_3_3_1_and_tagged_uv_lock_before_credentials` as a focused +precredential test with credential-read, client-construction, and provider-call spies initialized to +zero. Import Foundation's exact `BenchmarkSDKContractError` and +`require_benchmark_sdk_contract` from `laconian_eval.providers`, assert object identity with +`laconian_eval.providers.openai`, and monkeypatch only that owner's internal version/model lookup +seams. Independently expose installed version `3.3.0`, a wrong C0 `uv.lock` SHA-256, a missing typed +request field, and a missing canonical response path. Each case must raise the shared closed SDK +contract error before any spy increments; `judge.py` defines no wrapper or local error. + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_judge.py::test_judge_requires_openai_3_3_1_and_tagged_uv_lock_before_credentials +~~~ + +Expected: FAIL because the shared Foundation validator is not yet wired into the judge boundary; +credential reads, client constructions, and provider calls all remain exactly zero. + +- [ ] **Step 6: Implement and GREEN the judge precredential gate** + +In `judge.py`, import Foundation's exact `require_benchmark_sdk_contract` object without wrapping or +re-exporting it from `laconian_eval.benchmark`. The focused judge test calls that identical object +with fixture C0 `uv.lock` bytes and the fixture's independently retained member SHA-256 before +invoking the fake credential/client/provider boundary. The live Runtime adapter owns those two C0 +arguments and performs the identical call immediately before judge credentials; the neutral +generation context and judge attachment retain only the expected member hash and never serialize +lock bytes. No CLI, environment, judge attachment, or caller scalar may override either value. +Foundation alone owns the installed-version/lock-entry/typed-request/canonical-response checks, +constants, error, and implementation. Static tests reject a copied validator/constant, a +catch-and-continue path, or any credential/client access before the literal `None` return. + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_judge.py::test_judge_requires_openai_3_3_1_and_tagged_uv_lock_before_credentials +~~~ + +Expected: PASS; all invalid-contract cases fail closed and all three spies remain exactly zero. + +- [ ] **Step 7: Add capsule-bound judge attachments and exact coverage verification** + +~~~python +from itertools import pairwise + +from laconian_eval.providers import ( + AppliedCacheControlStatus, + CacheReadStatus, + CacheWriteStatus, + ProviderMetadataString, + ServiceTierStatus, +) + +JudgeAttemptDispositionV1 = Literal[ + "success", + "retry_scheduled", + "retry_exhausted", + "provider_rejected", + "authentication_stopped", + "ambiguous_delivery", + "service_tier_unverified", + "service_tier_mismatch", + "cache_control_policy_incident", + "cache_read_policy_incident", + "cache_write_policy_incident", +] +JudgeDeliveryCertaintyV1 = Literal[ + "definitely_not_sent", + "definitely_rejected", + "response_received", + "unknown", +] +JudgeUsageAvailabilityV1 = Literal["complete", "partial", "unavailable"] +ReasoningAccountingStatusV1 = Literal["reported", "not_reported", "not_applicable", "invalid"] +JudgeCostAvailabilityV1 = Literal[ + "trusted_usage", + "definitely_rejected_zero", + "retained_worst_case", +] + + +class JudgeAttemptUsageV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + input_tokens: int | None = Field(default=None, ge=0) + output_tokens: int | None = Field(default=None, ge=0) + total_tokens: int | None = Field(default=None, ge=0) + cache_read_tokens: int | None = Field(default=None, ge=0) + cache_write_tokens: int | None = Field(default=None, ge=0) + ordinary_uncached_input_tokens: int | None = Field(default=None, ge=0) + reasoning_tokens: int | None = Field(default=None, ge=0) + availability: JudgeUsageAvailabilityV1 + cache_read_status: CacheReadStatus + cache_write_status: CacheWriteStatus + reasoning_accounting: ReasoningAccountingStatusV1 + + @model_validator(mode="after") + def validate_usage(self) -> Self: + core = (self.input_tokens, self.output_tokens, self.total_tokens) + present = sum(value is not None for value in core) + if self.availability == "unavailable" and any( + value is not None + for value in ( + *core, + self.cache_read_tokens, + self.cache_write_tokens, + self.reasoning_tokens, + ) + ): + raise ValueError("unavailable judge usage has counts") + if self.availability == "partial" and present not in (1, 2): + raise ValueError("partial judge usage requires one or two core counts") + if self.availability == "complete" and ( + present != 3 or self.total_tokens != self.input_tokens + self.output_tokens # type: ignore[operator] + ): + raise ValueError("complete judge usage is inconsistent") + for status, value in ( + (self.cache_read_status, self.cache_read_tokens), + (self.cache_write_status, self.cache_write_tokens), + ): + if (status in {"reported_zero", "reported_nonzero"}) != (value is not None): + raise ValueError("judge cache status/value mismatch") + if status == "reported_zero" and value != 0: + raise ValueError("judge reported_zero requires zero") + if status == "reported_nonzero" and (value is None or value <= 0): + raise ValueError("judge reported_nonzero requires positive value") + if ( + self.cache_read_tokens is not None or self.cache_write_tokens is not None + ) and self.input_tokens is None: + raise ValueError("judge cache components require input tokens") + if ( + self.input_tokens is not None + and (self.cache_read_tokens or 0) + (self.cache_write_tokens or 0) > self.input_tokens + ): + raise ValueError("judge cache components exceed input") + if self.input_tokens is not None and self.ordinary_uncached_input_tokens != ( + self.input_tokens - (self.cache_read_tokens or 0) - (self.cache_write_tokens or 0) + ): + raise ValueError("judge ordinary uncached input mismatch") + if self.reasoning_tokens is not None and ( + self.output_tokens is None or self.reasoning_tokens > self.output_tokens + ): + raise ValueError("judge reasoning tokens exceed output") + return self + + +class JudgeAttemptEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["judge-attempt-evidence-v1"] + campaign_id: str + boundary_ordinal: int = Field(ge=0, lt=36) + generation_model: str + scenario_uid: str = Field(pattern="^[0-9a-f]{64}$") + generation_capsule_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_request_set_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_request_attachment_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_bindings: BenchmarkProtocolBindingsV1 + judge_request_id: str = Field(pattern="^[0-9a-f]{64}$") + blind_id: str = Field(pattern="^[0-9a-f]{64}$") + blind_request_sha256: str = Field(pattern="^[0-9a-f]{64}$") + attempt_number: int = Field(ge=1, le=6) + judge_attempt_id: str = Field(pattern="^[0-9a-f]{64}$") + retry_of_judge_attempt_sha256: str | None = Field( + default=None, + pattern="^[0-9a-f]{64}$", + ) + retry_authorization_sha256: str | None = Field(default=None, pattern="^[0-9a-f]{64}$") + structured_retry_status: Literal[429] | None = None + batch_plan_sha256: str = Field(pattern="^[0-9a-f]{64}$") + consumed_batch_receipt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + reservation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + retry_evidence_sha256: str | None = Field(default=None, pattern="^[0-9a-f]{64}$") + spend_event_sha256: str = Field(pattern="^[0-9a-f]{64}$") + delivery_evidence_sha256: str = Field(pattern="^[0-9a-f]{64}$") + delivery_certainty: JudgeDeliveryCertaintyV1 + terminal: bool + disposition: JudgeAttemptDispositionV1 + requested_service_tier: Literal["default"] + service_tier_wire_field: Literal["service_tier"] + applied_prompt_cache_mode: ProviderMetadataString | None + applied_prompt_cache_ttl: ProviderMetadataString | None + applied_cache_control_status: AppliedCacheControlStatus + provider_wire_request_sha256: str = Field(pattern="^[0-9a-f]{64}$") + service_tier_status: ServiceTierStatus + returned_service_tier: ProviderMetadataString | None = None + cost_availability: JudgeCostAvailabilityV1 + provider_request_id: str | None = Field( + default=None, + pattern=r"^[\x21-\x7E]{1,512}$", + ) + requested_judge_model_id: Literal["gpt-5.6-sol"] + returned_judge_model_id: ProviderMetadataString | None + applied_cache_control_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + cache_read_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + cache_write_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + service_tier_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + usage_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + reasoning_tokens_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + returned_judge_model_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + raw_response_sha256: str | None = Field(default=None, pattern="^[0-9a-f]{64}$") + usage: JudgeAttemptUsageV1 + judgment: StructuredJudgmentV1 | None + terminal_evidence_sha256: str | None = Field(default=None, pattern="^[0-9a-f]{64}$") + judge_attempt_evidence_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_attempt(self) -> Self: + expected_service_tier_status: ServiceTierStatus + if self.returned_service_tier == "default": + expected_service_tier_status = "reported_default" + elif self.returned_service_tier is not None: + expected_service_tier_status = "mismatch" + elif self.delivery_certainty == "definitely_not_sent": + expected_service_tier_status = "not_applicable_definitely_not_sent" + elif self.delivery_certainty == "definitely_rejected": + expected_service_tier_status = "not_applicable_definitely_rejected" + else: + expected_service_tier_status = "missing" + if self.service_tier_status != expected_service_tier_status: + raise ValueError("judge service-tier status mismatch") + expected_not_applicable = { + "definitely_not_sent": "not_applicable_definitely_not_sent", + "definitely_rejected": "not_applicable_definitely_rejected", + }.get(self.delivery_certainty) + if expected_not_applicable is not None and ( + self.usage.availability != "unavailable" + or self.usage.cache_read_status != expected_not_applicable + or self.usage.cache_write_status != expected_not_applicable + or self.applied_cache_control_status != expected_not_applicable + or self.usage.reasoning_accounting != "not_applicable" + or self.provider_request_id is not None + or self.returned_judge_model_id is not None + or self.raw_response_sha256 is not None + or self.judgment is not None + ): + raise ValueError("not-applicable judge tier requires no response or usage") + expected_attempt_id = stable_digest( + "laconian-judge-attempt-id-v1", + { + "judge_request_id": self.judge_request_id, + "attempt_number": self.attempt_number, + "batch_plan_sha256": self.batch_plan_sha256, + "consumed_batch_receipt_sha256": self.consumed_batch_receipt_sha256, + }, + ) + if self.judge_attempt_id != expected_attempt_id: + raise ValueError("judge attempt ID mismatch") + if self.attempt_number == 1 and ( + self.retry_of_judge_attempt_sha256 is not None + or self.retry_authorization_sha256 is not None + ): + raise ValueError("judge retry lineage shape mismatch") + if self.attempt_number > 1 and ( + self.retry_of_judge_attempt_sha256 is None or self.retry_authorization_sha256 is None + ): + raise ValueError("judge retry lineage shape mismatch") + if (self.disposition in {"retry_scheduled", "retry_exhausted"}) != ( + self.structured_retry_status == 429 + ): + raise ValueError("only a structured 429 may schedule or exhaust a retry") + if self.disposition == "success": + if ( + not self.terminal + or self.delivery_certainty != "response_received" + or self.service_tier_status != "reported_default" + or self.returned_service_tier != "default" + or self.cost_availability != "trusted_usage" + or self.usage.availability != "complete" + or self.applied_prompt_cache_mode != "explicit" + or self.applied_prompt_cache_ttl != "30m" + or self.applied_cache_control_status != "reported_exact" + or self.usage.cache_read_status != "reported_zero" + or self.usage.cache_write_status != "reported_zero" + or (self.usage.cache_write_tokens or 0) != 0 + or self.provider_request_id is None + or self.returned_judge_model_id is None + or self.raw_response_sha256 is None + or self.judgment is None + or self.judgment.judge_request_id != self.judge_request_id + or self.judgment.blind_id != self.blind_id + or self.terminal_evidence_sha256 is None + or self.retry_evidence_sha256 is not None + ): + raise ValueError("invalid successful judge attempt") + elif self.disposition == "retry_scheduled": + if ( + self.terminal + or self.attempt_number >= 6 + or self.delivery_certainty != "definitely_rejected" + or self.service_tier_status != "not_applicable_definitely_rejected" + or self.cost_availability != "definitely_rejected_zero" + or self.usage.availability != "unavailable" + or self.retry_evidence_sha256 is None + or self.terminal_evidence_sha256 is not None + or any( + value is not None + for value in ( + self.returned_service_tier, + self.provider_request_id, + self.returned_judge_model_id, + self.raw_response_sha256, + self.judgment, + ) + ) + ): + raise ValueError("invalid scheduled judge retry") + elif self.disposition in {"service_tier_unverified", "service_tier_mismatch"}: + tier_shape_valid = ( + ( + self.delivery_certainty == "response_received" + and self.returned_service_tier is None + and self.service_tier_status == "missing" + ) + if self.disposition == "service_tier_unverified" + else ( + self.returned_service_tier not in {None, "default"} + and self.service_tier_status == "mismatch" + ) + ) + if ( + not self.terminal + or self.delivery_certainty not in {"response_received", "unknown"} + or not tier_shape_valid + or self.cost_availability != "retained_worst_case" + or ( + self.delivery_certainty == "response_received" + and (self.provider_request_id is None or self.raw_response_sha256 is None) + ) + or self.judgment is not None + or self.terminal_evidence_sha256 is None + or self.retry_evidence_sha256 is not None + ): + raise ValueError("invalid judge service-tier incident") + elif self.disposition in { + "cache_control_policy_incident", + "cache_read_policy_incident", + "cache_write_policy_incident", + }: + cache_incident = ( + self.applied_cache_control_status != "reported_exact" + if self.disposition == "cache_control_policy_incident" + else self.usage.cache_read_status != "reported_zero" + if self.disposition == "cache_read_policy_incident" + else self.usage.cache_write_status != "reported_zero" + ) + if ( + not self.terminal + or self.delivery_certainty != "response_received" + or self.service_tier_status != "reported_default" + or self.returned_service_tier != "default" + or not cache_incident + or self.cost_availability != "retained_worst_case" + or self.provider_request_id is None + or self.raw_response_sha256 is None + or self.judgment is not None + or self.terminal_evidence_sha256 is None + or self.retry_evidence_sha256 is not None + ): + raise ValueError("invalid judge cache policy incident") + else: + expected_delivery = { + "retry_exhausted": "definitely_rejected", + "authentication_stopped": "definitely_rejected", + "ambiguous_delivery": "unknown", + }.get(self.disposition) + if ( + not self.terminal + or self.terminal_evidence_sha256 is None + or self.retry_evidence_sha256 is not None + or (expected_delivery is not None and self.delivery_certainty != expected_delivery) + or ( + self.disposition == "provider_rejected" + and self.delivery_certainty + not in {"definitely_not_sent", "definitely_rejected"} + ) + or ( + self.delivery_certainty in {"definitely_not_sent", "definitely_rejected"} + and self.cost_availability != "definitely_rejected_zero" + ) + or ( + self.disposition == "ambiguous_delivery" + and ( + self.service_tier_status != "missing" + or self.cost_availability != "retained_worst_case" + ) + ) + or any( + value is not None + for value in ( + self.returned_service_tier, + self.provider_request_id, + self.returned_judge_model_id, + self.raw_response_sha256, + self.judgment, + ) + ) + ): + raise ValueError("invalid terminal judge failure") + expected = stable_digest( + "laconian-judge-attempt-evidence-v1", + self.model_dump(mode="json", exclude={"judge_attempt_evidence_sha256"}), + ) + if self.judge_attempt_evidence_sha256 != expected: + raise ValueError("judge attempt evidence digest mismatch") + return self + + +class JudgeAttemptBoundaryV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["judge-attempt-boundary-v1"] + boundary_ordinal: int = Field(ge=0, lt=36) + campaign_id: str + generation_model: str + scenario_uid: str = Field(pattern="^[0-9a-f]{64}$") + generation_capsule_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_request_set_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_request_attachment_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + ordered_judge_request_ids: tuple[str, ...] = Field(max_length=40) + attempts: tuple[JudgeAttemptEvidenceV1, ...] = Field(max_length=240) + judge_attempt_boundary_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_boundary(self) -> Self: + if len(set(self.ordered_judge_request_ids)) != len(self.ordered_judge_request_ids): + raise ValueError("judge boundary request IDs must be unique") + parent_fields = ( + "boundary_ordinal", + "campaign_id", + "generation_model", + "scenario_uid", + "generation_capsule_sha256", + "hard_score_request_set_sha256", + "judge_request_attachment_sha256", + "judge_protocol_sha256", + ) + if any( + any(getattr(attempt, field) != getattr(self, field) for field in parent_fields) + for attempt in self.attempts + ): + raise ValueError("judge boundary attempt parent mismatch") + grouped_ids: list[str] = [] + for attempt in self.attempts: + if not grouped_ids or grouped_ids[-1] != attempt.judge_request_id: + grouped_ids.append(attempt.judge_request_id) + if tuple(grouped_ids) != self.ordered_judge_request_ids: + raise ValueError("judge boundary request history order mismatch") + for request_id in self.ordered_judge_request_ids: + history = tuple( + attempt for attempt in self.attempts if attempt.judge_request_id == request_id + ) + if tuple(attempt.attempt_number for attempt in history) != tuple( + range(1, len(history) + 1) + ): + raise ValueError("judge boundary attempt-number gap") + if sum(attempt.terminal for attempt in history) != 1 or not history[-1].terminal: + raise ValueError("judge boundary requires one final terminal attempt") + for previous, current in pairwise(history): + if ( + previous.disposition != "retry_scheduled" + or current.retry_of_judge_attempt_sha256 + != previous.judge_attempt_evidence_sha256 + or current.retry_authorization_sha256 != previous.retry_evidence_sha256 + ): + raise ValueError("judge boundary retry chain mismatch") + expected = stable_digest( + "laconian-judge-attempt-boundary-v1", + self.model_dump(mode="json", exclude={"judge_attempt_boundary_sha256"}), + ) + if self.judge_attempt_boundary_sha256 != expected: + raise ValueError("judge attempt boundary digest mismatch") + return self + + +class JudgeAttemptRootMemberV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + ordinal: int = Field(ge=0, lt=36) + generation_model: str + scenario_uid: str = Field(pattern="^[0-9a-f]{64}$") + relative_path: str + judge_request_attachment_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_attempt_boundary_sha256: str = Field(pattern="^[0-9a-f]{64}$") + request_count: int = Field(ge=0, le=40) + attempt_count: int = Field(ge=0, le=240) + + +class JudgeAttemptRootIndexV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["judge-attempt-root-index-v1"] + campaign_id: str + judge_request_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + members: tuple[JudgeAttemptRootMemberV1, ...] = Field(min_length=36, max_length=36) + judge_attempt_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_root_index(self) -> Self: + if tuple(member.ordinal for member in self.members) != tuple(range(36)): + raise ValueError("judge attempt root requires ordinals 0..35") + keys = tuple( + (member.generation_model.encode("utf-8"), bytes.fromhex(member.scenario_uid)) + for member in self.members + ) + if keys != tuple(sorted(keys)) or len(set(keys)) != 36: + raise ValueError("judge attempt root order mismatch") + if any( + member.relative_path != f"judge-attempts/{member.ordinal:03d}.json" + for member in self.members + ): + raise ValueError("judge attempt root member path mismatch") + if ( + len({member.judge_request_attachment_sha256 for member in self.members}) != 36 + or len({member.judge_attempt_boundary_sha256 for member in self.members}) != 36 + ): + raise ValueError("judge attempt root parents must be unique") + expected = stable_digest( + "laconian-judge-attempt-root-index-v1", + self.model_dump(mode="json", exclude={"judge_attempt_root_index_sha256"}), + ) + if self.judge_attempt_root_index_sha256 != expected: + raise ValueError("judge attempt root digest mismatch") + return self + + +@dataclass(frozen=True, slots=True) +class VerifiedJudgeAttemptRootV1: + index: JudgeAttemptRootIndexV1 + boundaries: tuple[JudgeAttemptBoundaryV1, ...] + + +def write_judge_attempt_root( + attempt_root: Path, + *, + index: JudgeAttemptRootIndexV1, + boundaries: Sequence[JudgeAttemptBoundaryV1], +) -> None: + """Write the fixed complete ATTEMPTS tree canonically with no replacement.""" + + +def load_verified_judge_attempt_root( + attempt_root: Path, + *, + expected_request_root_index_sha256: str, + request_attachments: Sequence[JudgeRequestAttachmentV1], +) -> VerifiedJudgeAttemptRootV1: + """Verify the fixed 36 boundaries, retry chains, terminal coverage, and every parent.""" + + +class JudgeRecordV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + judge_request_id: str + blind_id: str + raw_judge_attempt_sha256: str + returned_judge_model_id: ProviderMetadataString + requested_service_tier: Literal["default"] + service_tier_status: Literal["reported_default"] + returned_service_tier: Literal["default"] + judgment: StructuredJudgmentV1 + + +class JudgeAttachmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["judge-attachment-v1"] + campaign_id: str + generation_model: str + scenario_uid: str + generation_capsule_sha256: str + hard_score_request_set_sha256: str + judge_request_attachment_sha256: str + judge_protocol_sha256: str + protocol_bindings: BenchmarkProtocolBindingsV1 + requested_judge_model_id: Literal["gpt-5.6-sol"] + requested_service_tier: Literal["default"] + service_tier_wire_field: Literal["service_tier"] + records: tuple[JudgeRecordV1, ...] + judge_attachment_sha256: str + + +def build_judge_attachment( + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + request_set: HardScoreRequestSetV1, + request_attachment: JudgeRequestAttachmentV1, + attempt_root: VerifiedJudgeAttemptRootV1, + boundary_ordinal: int, +) -> JudgeAttachmentV1: + """Derive records only from verified terminal attempts, including sealed empty boundaries.""" + + +def verify_judge_attachment( + attachment: JudgeAttachmentV1, + *, + context: VerifiedGenerationContextIndexV1, + expectation: VerifiedGenerationContextExpectationV1, + request_set: HardScoreRequestSetV1, + request_attachment: JudgeRequestAttachmentV1, +) -> None: + """Verify exact ordered coverage, bindings, model identity, decisions, and self hash.""" +~~~ + +`JudgeAttemptEvidenceV1` is the campaign-neutral Slice 3→Slice 2 handoff: it imports no campaign, +controller, batch, spend, or authority model. Runtime Task 7 imports this benchmark type and writes +it; Runtime's `Runtime.seal_judge` never reads a controller-private attempt object or reconstructs +evidence from a directory name. `blind_request_sha256` is raw SHA-256 of the exact canonical +`BlindJudgeRequestV1` bytes already sealed in the request attachment. `judge_attempt_id` is +`stable_digest("laconian-judge-attempt-id-v1", {"judge_request_id": judge_request_id, +"attempt_number": attempt_number, "batch_plan_sha256": batch_plan_sha256, +"consumed_batch_receipt_sha256": consumed_batch_receipt_sha256})`. +`judge_attempt_evidence_sha256` uses domain `laconian-judge-attempt-evidence-v1` over every preceding +field and excludes only itself. Thus the evidence binds the exact request/blind identity, all four +upstream benchmark parents, runtime batch/receipt/reservation/retry/spend/delivery/terminal parents, +provider wire-request/service-tier identity, response identity, complete usage/cost-availability +evidence, parsed judgment, and retry lineage without +depending on a campaign class. + +Validate the attempt truth table exactly. A `success` is terminal, has delivery +`response_received`, nonnull provider request ID, a nonnull returned model ID recorded separately +from `requested_judge_model_id="gpt-5.6-sol"`, raw response +hash, returned service tier exactly `default`, judgment, and terminal-evidence hash, and its judgment +request/blind IDs equal the sealed request. It repeats the literal requested tier/wire-field and exact +provider-wire-request hash from `JudgeProviderRequestV1`, and records +`service_tier_status="reported_default"`, `applied_cache_control_status="reported_exact"`, and +cache read/write statuses both `reported_zero`. Across successful judge responses the returned model +ID must be one consistent value but need not equal the requested ID. `retry_scheduled` is nonterminal, has delivery +`definitely_rejected`, `structured_retry_status=429`, nonnull retry evidence, +`service_tier_status="not_applicable_definitely_rejected"`, +unavailable usage whose applied/read/write statuses are all +`not_applicable_definitely_rejected` and reasoning status is `not_applicable`, zero definitely +rejected cost, null terminal evidence, and no provider request/model/response/judgment fields. A +structured pre-response 429 with that exact evidence is therefore retryable even though no Responses +object or returned service tier exists, except that attempt six cannot schedule a seventh call. +`retry_exhausted` also requires the same structured 429; +every nonretry disposition requires null `structured_retry_status`. Every other +ordinary failure disposition is terminal with nonnull terminal evidence and no accepted response or judgment: +`retry_exhausted` requires `definitely_rejected`, `authentication_stopped` requires +`definitely_rejected`, `ambiguous_delivery` requires `unknown`, and `provider_rejected` permits only +`definitely_not_sent|definitely_rejected`; all ordinary failures have null retry evidence. Definite +non-send/rejection respectively uses `not_applicable_definitely_not_sent` or +`not_applicable_definitely_rejected` only with no response or usage and zero cost, while unknown +delivery with no returned tier is terminal `ambiguous_delivery`, uses `missing`, and retains +worst-case cost. A received response with absent returned service tier is terminal +`service_tier_unverified`; a returned tier other than literal `default` under received or unknown +delivery is terminal `service_tier_mismatch`. The two tier dispositions respectively record +`missing` or `mismatch`, preserve +every provider request ID, response hash, returned tier, and usage field that exists, and require +`cost_availability="retained_worst_case"`, null accepted judgment/retry evidence, and STOP/terminal +evidence. A `response_received` incident requires its provider request ID and raw response hash; +unknown delivery may lack both. A nonzero cache read or write, applied-control +missing/mismatch/invalid, or read/write missing/invalid is terminal STOP evidence, preserves every +usage/charge/source digest, and cannot become success. A nonzero write is charged before STOP. +Attempt one has null retry parent/authorization; attempt n>1 must point +to the immediately preceding evidence hash for the same request and carry the exact retry +authorization emitted by that preceding row. Only a preceding `retry_scheduled` row permits it, and +the prior row's `retry_evidence_sha256` must equal the next row's `retry_authorization_sha256`. There +is exactly one terminal row per nonempty request history and +no later row. A completed root accepted by Runtime's `Runtime.seal_judge` requires that terminal +row to be `success`; +a stopped, tier-mismatched/unverified, policy-incident, ambiguous, failed, missing, duplicated, or +nonterminal-only request cannot be converted to a judge record. + +`JudgeAttemptUsageV1` preserves cached-read, cache-write, and uncached evidence independently. +Complete core usage requires all three core counts and `total_tokens == input_tokens + +output_tokens`; partial has one or two; unavailable has none. Each accounting status is closed: +`reported` requires its corresponding count, while `not_reported|not_applicable|invalid` requires +null. When present, cached-read plus cache-write cannot exceed input; reported reasoning cannot +exceed output. Missing/invalid cache-write detail remains missing/invalid for retained-worst-case +cost and integrity limitations, and nonzero writes remain policy-incident evidence; neither is +folded into cached or uncached input or used in the visible-token objective. Failure attempts may +retain usage when the provider supplied it. + +Import `ServiceTierStatus` from `laconian_eval.providers`; do not redeclare or normalize a +benchmark-only alias. Its exact five-state vocabulary is `reported_default`, +`not_applicable_definitely_not_sent`, `not_applicable_definitely_rejected`, `missing`, and +`mismatch`. `reported_default` requires returned tier `default`; `mismatch` requires a nonnull +different tier; `missing` requires a null tier under `response_received|unknown`; and each exact +`not_applicable_*` state requires its named delivery certainty plus no response object and completely +unavailable/not-applicable usage. The status is never inferred from the requested tier, SDK defaults, +HTTP status alone, or cost accounting. + +The only valid attempt-root layout is +`ATTEMPTS/judge-attempts/index.json` plus exactly +`ATTEMPTS/judge-attempts/000.json` through `035.json`. Every file is canonical JSON. Each boundary +copies one corresponding request attachment's campaign/model/scenario and generation/hard/request/ +protocol parents, exact ordered request IDs, all attempt histories in request order then increasing +attempt number, and a domain `laconian-judge-attempt-boundary-v1` self digest. Empty request +attachments still require their own boundary file with empty request and attempt tuples. The root +index has ordinals 0..35 in the same canonical `(generation_model UTF-8 bytes, scenario_uid raw +SHA-256 bytes)` order as the verified request-root index; each member path is exactly +`judge-attempts/.json` and binds the request attachment, boundary digest, request count, +and attempt count. Its self digest uses domain `laconian-judge-attempt-root-index-v1` and excludes +only itself. + +`write_judge_attempt_root` class-bound revalidates the index and all 36 boundaries, requires exact +index/boundary equality, and writes the 37-file tree with descriptor-relative no-replace/fsync +semantics. `load_verified_judge_attempt_root` descriptor-opens the fixed allowlist, rejects +symlinks, aliases, duplicate inodes, extra/missing files, noncanonical bytes, count/hash/order +mismatches, and requires the explicit expected request-root-index digest plus all 36 already +verified `JudgeRequestAttachmentV1` objects. It recomputes blind/request hashes, every attempt ID, +self digest, retry chain, truth-table state, boundary digest, and root digest, including explicit +empty boundaries. It returns the verified wrapper only after a final descriptor identity recheck. +Runtime Task 7 owns construction from its verified controller records and must fresh-reload the +complete root before handing it to Slice 2. + +`build_judge_attachment` accepts only the externally expectation-anchored generation context, the +matching expected context digest, the verified attempt-root wrapper, and one boundary ordinal, +selects each request's sole terminal success, and constructs `JudgeRecordV1` with +`raw_judge_attempt_sha256 == judge_attempt_evidence_sha256`. It has no overload accepting arbitrary +records or raw provider output. Immediately after building, Runtime's `Runtime.seal_judge` +canonical-byte compares each record, including the derived accepted-only +`service_tier_status="reported_default"`, to its source terminal attempt +before discarding controller-private input authority; +`verify_judge_attachment` first repeats the context/expectation equality check, then rechecks the +self-contained request/blind/decision/attempt-hash bindings and self digest used by the later +four-root provider-evidence loader. + +The record IDs must equal the request set's ordered judge-request IDs exactly: no missing, +duplicate, extra, or reordered record is accepted. The attachment and every record copy the +literal requested tier `default`; every record's returned tier must also be exactly `default` and +its source attempt's provider-wire hash must equal the corresponding request wrapper. The attachment digest excludes only +`judge_attachment_sha256` and uses domain `laconian-judge-attachment-v1`. + +- [ ] **Step 8: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_judge.py +uv run ruff check src/laconian_eval/benchmark/judge.py tests/benchmark/test_judge.py +uv run mypy src/laconian_eval/benchmark/judge.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/judge.py tests/benchmark/helpers.py tests/benchmark/test_judge.py +git commit -m "feat: freeze blind semantic judge attachments" +~~~ + +### Task 5: Build the fixed-denominator H/S table and visible-token eligibility + +**Files:** + +- Create: `src/laconian_eval/benchmark/aggregation.py` +- Create: `tests/benchmark/test_aggregation.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write denominator, failure, and token-accounting tests** + +Create tests named: + +- `test_h_and_s_use_120_planned_key_denominators`. +- `test_provider_rejections_are_zero_but_missing_or_ambiguous_keys_invalidate`. +- `test_planned_observation_provider_failures_require_null_response_and_zero_h_s`. +- `test_planned_observation_success_requires_response_and_exact_h_s_reason_matrix`. +- `test_cache_write_counts_accounting_and_cost_basis_remain_distinct`. +- `test_missing_cache_write_detail_retains_worst_case_cost_and_integrity_limitation`. +- `test_cache_write_evidence_never_changes_visible_output_or_pair_eligibility`. +- `test_visible_tokens_subtract_reasoning_and_never_fall_back_to_billed_output`. +- `test_eligible_pairs_and_token_pairs_are_distinct`. + +The first fixture must contain exactly 12 scenarios, two locales, and five repetitions for one arm, +then assert `hard_pass_rate == Fraction(sum_h, 120)` and +`semantic_success_rate == Fraction(sum_s, 120)`. The token test covers missing reasoning usage, +reasoning greater than output, and a valid zero-visible-token response. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_aggregation.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.aggregation` does not exist. + +- [ ] **Step 3: Materialize one row per planned observation** + +Import `AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, and +`ServiceTierStatus` from the Foundations owner without aliases, then implement: + +~~~python +TerminalZeroReason = Literal[ + "provider_rejected", + "retry_exhausted", + "blank_response", + "hard_fail", +] + +ArmName = Literal["baseline", "caveman", "if", "concise"] +GateName = Literal["hard", "semantic"] +CachePolicyStatusV1 = Literal[ + "conformant_zero_write", + "terminal_no_usage", + "missing_write_detail", + "forbidden_nonzero_write", +] +CostAvailabilityV1 = Literal[ + "trusted_usage", + "definitely_rejected_zero", + "retained_worst_case", + "unavailable", +] +CacheIntegrityLimitationV1 = Literal[ + "cache_write_detail_missing", + "forbidden_cache_write_observed", +] + + +class InferenceIntegrityError(ValueError): + """Evidence cannot be mapped bijectively to the frozen planned population.""" + + +class PlannedObservationV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + generation_model: str + scenario_uid: str + case_id: str + locale: str + repetition: int = Field(ge=0, lt=5) + arm: Literal["baseline", "caveman", "if", "concise"] + response_id: str | None + hard_pass: bool + semantic_success: bool + terminal_zero_reason: TerminalZeroReason | None + input_tokens: int | None = Field(default=None, ge=0) + output_tokens: int | None = Field(default=None, ge=0) + reasoning_tokens: int | None = Field(default=None, ge=0) + cache_read_tokens: int | None = Field(default=None, ge=0) + cache_write_tokens: int | None = Field(default=None, ge=0) + ordinary_uncached_input_tokens: int | None = Field(default=None, ge=0) + applied_cache_control_status: AppliedCacheControlStatus + cache_read_status: CacheReadStatus + cache_write_status: CacheWriteStatus + service_tier_status: ServiceTierStatus + cache_policy_status: CachePolicyStatusV1 + total_tokens: int | None = Field(default=None, ge=0) + visible_output_tokens: int | None = Field(default=None, ge=0) + reconciled_cost_usd: Decimal | None = Field(default=None, ge=0) + cost_availability: CostAvailabilityV1 + latency_ms: int | None = Field(default=None, ge=0) + + @model_validator(mode="after") + def validate_terminal_projection(self) -> Self: + provider_failure = self.terminal_zero_reason in { + "provider_rejected", + "retry_exhausted", + } + successful_zero = self.terminal_zero_reason in {"blank_response", "hard_fail"} + if provider_failure: + if self.response_id is not None or self.hard_pass or self.semantic_success: + raise ValueError("provider failure projection mismatch") + return self + if self.response_id is None: + raise ValueError("provider success requires response_id") + if successful_zero: + if self.hard_pass or self.semantic_success: + raise ValueError("successful zero projection mismatch") + return self + if not self.hard_pass: + raise ValueError("hard failure requires terminal_zero_reason") + return self + + @model_validator(mode="after") + def validate_cache_and_cost_projection(self) -> Self: + cache_fields = ( + (self.cache_read_status, self.cache_read_tokens), + (self.cache_write_status, self.cache_write_tokens), + ) + for status, value in cache_fields: + if status == "reported_zero" and value != 0: + raise ValueError("reported_zero requires zero") + if status == "reported_nonzero" and (value is None or value <= 0): + raise ValueError("reported_nonzero requires a positive count") + if status not in {"reported_zero", "reported_nonzero"} and value is not None: + raise ValueError("missing/invalid/not-applicable cache status forbids a count") + complete_cache_detail = all( + status in {"reported_zero", "reported_nonzero"} for status, _ in cache_fields + ) + if complete_cache_detail and self.input_tokens is not None: + assert self.cache_read_tokens is not None + assert self.cache_write_tokens is not None + expected_ordinary_uncached = ( + self.input_tokens - self.cache_read_tokens - self.cache_write_tokens + ) + if ( + expected_ordinary_uncached < 0 + or self.ordinary_uncached_input_tokens != expected_ordinary_uncached + ): + raise ValueError("uncached input projection mismatch") + elif self.ordinary_uncached_input_tokens is not None: + raise ValueError("uncached input requires complete cache detail") + if (self.cost_availability == "unavailable") != (self.reconciled_cost_usd is None): + raise ValueError("cost availability/value mismatch") + if ( + self.response_id is not None + and self.cache_write_status in {"missing", "invalid"} + and ( + self.cache_policy_status != "missing_write_detail" + or self.cost_availability != "retained_worst_case" + ) + ): + raise ValueError("missing cache-write detail must retain worst-case cost") + if self.response_id is not None and self.cache_write_status.startswith("not_applicable_"): + raise ValueError("explicit cache policy requires write accounting on success") + if self.cache_write_status in {"reported_zero", "reported_nonzero"}: + expected_status = ( + "conformant_zero_write" + if self.cache_write_status == "reported_zero" + else "forbidden_nonzero_write" + ) + if self.cache_policy_status != expected_status: + raise ValueError("cache-write policy status mismatch") + elif self.response_id is None and self.cache_policy_status != "terminal_no_usage": + raise ValueError("response-free terminal row requires terminal_no_usage") + if self.cost_availability == "definitely_rejected_zero" and ( + self.response_id is not None or self.reconciled_cost_usd != 0 + ): + raise ValueError("definitely rejected zero-cost projection mismatch") + return self + + +class PairDenominatorsV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + planned_pairs: Literal[120] = 120 + eligible_pairs: int = Field(ge=0, le=120) + token_pairs: int = Field(ge=0, le=120) + eligible_scenarios: int = Field(ge=0, le=12) + + +class AggregatedModelV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + generation_model: str + rows: tuple[PlannedObservationV1, ...] + denominators_by_gate: Mapping[Literal["hard", "semantic"], PairDenominatorsV1] + integrity_limitations: tuple[CacheIntegrityLimitationV1, ...] + + +def aggregate_verified_evidence( + *, + evidence: Sequence[VerifiedScoredCapsuleV2], + hard_sets: Sequence[HardScoreRequestSetV1], + judge_attachments: Sequence[JudgeAttachmentV1], +) -> tuple[AggregatedModelV1, ...]: + """Verify all joins and emit one canonical 120-key arm table per generation model.""" +~~~ + +Require a bijection over the canonical 120 keys in every model/arm. Provider rejection, +retry exhaustion, blank response, and deterministic hard failure produce `H = S = 0`. +Missing keys, unknown delivery, authentication stop, inconsistent returned model, duplicate key, +or unverifiable provenance raise `InferenceIntegrityError`; they are never zero-imputed. + +Import `Self` and `model_validator` and class-bound revalidate every projected row. The terminal +matrix is exact: `provider_rejected` and `retry_exhausted` require `response_id=None` and +`H=S=0`; `blank_response` and `hard_fail` require a nonnull persisted response ID and `H=S=0`; +and `terminal_zero_reason=None` requires a nonnull response ID and `H=1`, while `S` may be either +the verified judge pass or fail. No other combination is valid. The two matrix tests must mutate +each of `response_id`, `hard_pass`, `semantic_success`, and `terminal_zero_reason` independently +and assert validation failure rather than relying only on the aggregation builder. + +- [ ] **Step 4: Freeze token and pair eligibility formulas** + +For every terminal success with complete usage, calculate exactly: + +~~~python +visible_output_tokens = output_tokens - reasoning_tokens +~~~ + +Reject negative values. If either provider value is absent, leave visible tokens unavailable; do +not substitute billed output, total tokens, tokenizer estimates, or character counts. Preserve +provider cache reads and cache writes as separate accounting statuses and counts. Derive +`ordinary_uncached_input_tokens = input_tokens - cache_read_tokens - cache_write_tokens` only when both +cache details are reported; never infer a zero cache-write count from omission or fold writes into +cached/uncached input. Keep input, uncached input, cached reads, cache writes, visible output, +reasoning output, provider output, total, reconciled cost, cost availability, latency, and characters +as distinct fields. + +The frozen explicit/no-breakpoint policy expects a reported zero write count. A terminal success +with missing write detail must retain the runtime ledger's worst-case amount with +`cost_availability="retained_worst_case"`, set `cache_policy_status="missing_write_detail"`, and add +`cache_write_detail_missing` to `AggregatedModelV1.integrity_limitations`. A reported nonzero write +remains immutable billable evidence, sets `forbidden_nonzero_write`, retains its reconciled charge, +and adds `forbidden_cache_write_observed`; it is not rewritten to zero. Both conditions propagate to +the campaign limitations and operational-integrity outcome instead of disappearing. Cache-write, +uncached-input, and cost fields are descriptive only and never enter visible-output computation, +pair eligibility, delta, bootstrap quality/brevity, or sensitivity assignment logic. + +For a selected gate, a primary pair is eligible only when matched `if` and `concise` rows both pass +that gate. It is a token pair only when it is eligible and both visible-token values exist. Compute +`delta = visible_tokens(concise) - visible_tokens(if)`, so a positive value favors `if`. + +- [ ] **Step 5: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_aggregation.py +uv run ruff check src/laconian_eval/benchmark/aggregation.py tests/benchmark/test_aggregation.py +uv run mypy src/laconian_eval/benchmark/aggregation.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/aggregation.py tests/benchmark/helpers.py tests/benchmark/test_aggregation.py +git commit -m "feat: aggregate fixed-denominator benchmark evidence" +~~~ + +### Task 6: Implement the frozen scenario-cluster bootstrap + +**Files:** + +- Create: `src/laconian_eval/benchmark/bootstrap.py` +- Create: `tests/benchmark/test_bootstrap.py` +- Modify: `src/laconian_eval/benchmark/aggregation.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` + +- [ ] **Step 1: Write RNG, clustering, quantile, and invalidity tests** + +Create tests named: + +- `test_cluster_vectors_keep_locales_repetitions_and_matched_arms_together`. +- `test_type7_quantile_matches_frozen_golden_vector`. +- `test_cluster_bootstrap_recomputes_complete_estimator_per_replicate`. +- `test_fewer_than_9990_valid_replicates_is_inconclusive`. +- `test_bootstrap_interval_names_the_fixed_campaign_conditional_scenario_target`. +- `test_twelve_cluster_percentile_coverage_is_labelled_nominal_and_approximate`. + +Commit literal golden scenario-index bytes and literal expected 0.025/0.975 quantiles in the test; +do not generate the expected values by calling the implementation under test. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_bootstrap.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.bootstrap` does not exist. + +- [ ] **Step 3: Freeze bootstrap vectors and type-7 quantiles** + +Implement: + +~~~python +BOOTSTRAP_REPLICATES = 10_000 +BOOTSTRAP_CLUSTER_COUNT = 12 +BOOTSTRAP_MIN_VALID = 9_990 + + +class BootstrapVectorsV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + seed: int = Field(ge=0, lt=2**128) + scenario_uids: tuple[str, ...] + replicates: Literal[10_000] = 10_000 + index_dtype: Literal["uint8"] = "uint8" + indices_sha256: str + + +class BootstrapIntervalV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + point: float | None + lower: float | None + upper: float | None + valid_replicates: int = Field(ge=0, le=10_000) + total_replicates: Literal[10_000] = 10_000 + available: bool + inferential_target: Literal["scenario-superpopulation-conditional-on-fixed-campaign"] = ( + "scenario-superpopulation-conditional-on-fixed-campaign" + ) + coverage: Literal["nominal-95-percent-approximate-12-cluster-percentile"] = ( + "nominal-95-percent-approximate-12-cluster-percentile" + ) + + +def make_cluster_vectors( + *, seed: int, scenario_uids: Sequence[str] +) -> tuple[BootstrapVectorsV1, NDArray[np.uint8]]: + ordered = tuple(sorted(scenario_uids, key=lambda value: value.encode("utf-8"))) + if len(ordered) != 12 or len(set(ordered)) != 12: + raise ValueError("exactly twelve distinct scenario UIDs are required") + generator = np.random.Generator(np.random.PCG64(seed)) + indices = generator.integers(0, 12, size=(10_000, 12), dtype=np.uint8) + return seal_vector_metadata(seed, ordered, indices), indices + + +def type7_quantile(values: NDArray[np.float64], q: float) -> float: + ordered = np.sort(values) + h = (len(ordered) - 1) * q + j = math.floor(h) + g = h - j + return float(ordered[j] + g * (ordered[min(j + 1, len(ordered) - 1)] - ordered[j])) +~~~ + +The index digest uses canonical C-order bytes and binds dtype, shape, seed, and ordered scenario +UIDs. Loading rejects a digest mismatch rather than regenerating vectors implicitly. + +- [ ] **Step 4: Recompute each complete estimator inside each replicate** + +Expose: + +~~~python +def cluster_percentile_interval( + *, + point: float | None, + rows: Sequence[PlannedObservationV1], + indices: NDArray[np.uint8], + estimator: Callable[[Sequence[PlannedObservationV1]], float | None], +) -> BootstrapIntervalV1: + """Rebuild sampled scenario blocks and return frozen type-7 percentile endpoints.""" + + +def median_visible_delta(rows: Sequence[PlannedObservationV1], *, gate: GateName) -> float | None: + """Return median concise-minus-if visible tokens among jointly eligible token pairs.""" + + +def arm_pass_proportion( + rows: Sequence[PlannedObservationV1], *, arm: ArmName, gate: GateName +) -> float: + """Return the selected gate successes over the fixed 120 planned observations.""" + + +def paired_pass_rate_difference(rows: Sequence[PlannedObservationV1], *, gate: GateName) -> float: + """Return mean if-minus-concise success over all 120 matched planned keys.""" +~~~ + +Each sampled scenario block carries both locales, all repetitions, and every matched arm. Duplicate +sampled scenarios duplicate the whole block. Re-run pair eligibility and the median or mean after +sampling; do not resample already-computed deltas. Preserve ties. Quantiles use only finite valid +replicates. When valid count is below 9,990, return `available=False` with null endpoints. + +The inferential target is variation across exchangeable scenarios represented by the preregistered +12-scenario corpus, conditional on the exact three generation models, provider versions, input-tag +commit, cases, locales, arms, repetitions, judge protocol, and completed campaign evidence. It does +not authorize inference to new models, provider versions, time periods, prompts, or task domains. +With only 12 independent clusters, the percentile endpoints are a nominal 95% approximate interval, +not an exact finite-sample 95% coverage guarantee. Persist both closed labels above in every interval +and render them adjacent to each inferential result. + +- [ ] **Step 5: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_bootstrap.py tests/benchmark/test_aggregation.py +uv run ruff check src/laconian_eval/benchmark/bootstrap.py src/laconian_eval/benchmark/aggregation.py tests/benchmark +uv run mypy src/laconian_eval/benchmark/bootstrap.py src/laconian_eval/benchmark/aggregation.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/aggregation.py src/laconian_eval/benchmark/bootstrap.py tests/benchmark/test_bootstrap.py +git commit -m "feat: add frozen scenario-cluster bootstrap" +~~~ + +### Task 7: Encode strict model-outcome precedence + +**Files:** + +- Create: `src/laconian_eval/benchmark/outcomes.py` +- Create: `tests/benchmark/test_outcomes.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` + +- [ ] **Step 1: Write precedence, multi-reason, and boundary tests** + +Create tests named: + +- `test_outcome_precedence_is_operational_invalid_then_negative_quality_then_brevity_then_supported`. +- `test_all_applicable_negative_reasons_are_retained`. +- `test_boundary_values_are_inconclusive_because_thresholds_are_strict`. + +Use table rows where every lower-priority condition is simultaneously true, plus exact endpoints +`-0.05` and `0.0` to prove that equality never satisfies a strict interval decision. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_outcomes.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.outcomes` does not exist. + +- [ ] **Step 3: Implement the closed outcome contract** + +~~~python +class ModelOutcome(str, Enum): + OPERATIONALLY_INVALID = "operationally-invalid" + NEGATIVE_QUALITY = "negative-quality" + NEGATIVE_BREVITY = "negative-brevity" + SUPPORTED = "supported" + INCONCLUSIVE = "inconclusive" + + +class OutcomeEvidenceV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + integrity_valid: bool + integrity_reasons: tuple[str, ...] + coverage_valid: bool + hard_quality: BootstrapIntervalV1 + semantic_sensitivity_min_lower: float | None + semantic_sensitivity_max_upper: float | None + token_sensitivity_min_lower: float | None + token_sensitivity_max_upper: float | None + audit_gate_passed: bool + sensitivity_complete: bool + + +class ModelOutcomeV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + outcome: ModelOutcome + reasons: tuple[str, ...] + + +def classify_model_outcome(evidence: OutcomeEvidenceV1) -> ModelOutcomeV1: + """Apply the frozen precedence and retain all applicable negative reasons.""" +~~~ + +Apply this exact order: + +1. Any protocol, identity, security, missing-ledger, inconsistent-model, ambiguous-delivery, or + provenance failure returns `operationally-invalid`; do not issue a performance classification. +2. A hard-quality upper endpoint strictly below -0.05 establishes hard negative quality. Semantic + negative quality additionally requires a complete sensitivity proof whose maximum semantic + upper endpoint is strictly below -0.05. +3. With integrity, coverage, quality, model-specific audit, and complete sensitivity all passing, + maximum token upper endpoint strictly below zero returns `negative-brevity`. +4. Under the same gates, minimum token lower endpoint strictly above zero returns `supported`. +5. Every other statistically valid case returns `inconclusive`. + +Collect every applicable negative reason before selecting the highest-precedence outcome. Audit +failure makes semantic conclusions inconclusive, but does not suppress valid hard-quality +inferiority. Never aggregate the three generation-model outcomes into a family decision. + +- [ ] **Step 4: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_outcomes.py +uv run ruff check src/laconian_eval/benchmark/outcomes.py tests/benchmark/test_outcomes.py +uv run mypy src/laconian_eval/benchmark/outcomes.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/outcomes.py tests/benchmark/test_outcomes.py +git commit -m "feat: classify benchmark model outcomes" +~~~ + +### Task 8: Seal benchmark provider indexes and select the exact 144-record human-audit sample + +**Files:** + +- Create: `src/laconian_eval/benchmark/audit_sampling.py` +- Create: `src/laconian_eval/benchmark/provider_evidence.py` +- Create: `tests/benchmark/test_provider_evidence.py` +- Create: `tests/benchmark/test_audit_sampling.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +`provider_evidence.py` is the downstream post-judge bridge and imports `context.py`; the exact path +lines above deliberately contain no commentary so task/staging audits can resolve them literally. + +- [ ] **Step 1: Write exact-quota and blinding tests** + +Create tests named: + +- `test_generation_context_and_provider_index_bind_default_judge_service_tier_and_wire_field`. +- `test_generation_and_provider_indexes_bind_two_ordered_numeric_reviewer_accounts`. +- `test_protocol_attestations_bind_both_registry_digests_and_exact_role_identity`. +- `test_adapter_rejects_protocol_attestation_not_verified_against_role_fingerprint`. +- `test_provider_index_projection_and_loader_reject_workflow_root_substitution`. +- `test_provider_index_projection_and_loader_bind_authority_checked_statistical_protocol`. +- `test_provider_index_projection_and_loader_bind_exact_registry_audit_protocol`. +- `test_benchmark_neutral_records_do_not_duplicate_runtime_workflow_inventory_type`. +- `test_generation_and_provider_indexes_bind_exact_three_role_protocol_review_root`. +- `test_prepare_judge_requires_generation_context_index_before_provider_index_exists`. +- `test_provider_evidence_index_binds_plaintext_seed_commit_registry_and_four_layer_indexes`. +- `test_provider_index_copies_expectation_digest_and_bound_final_authority_root_without_serializing_capability`. +- `test_provider_writer_requires_the_same_live_expectation_wrapper_and_final_root`. +- `test_verified_provider_loader_requires_external_live_expectation_wrapper_and_never_mints_one`. +- `test_verified_provider_loader_rejects_expectation_predecessor_or_final_authority_mismatch`. +- `test_provider_evidence_index_rejects_wrong_seed_hash_self_hash_or_parent_vector`. +- `test_provider_loader_rejects_registry_binding_or_protocol_attestation_root_substitution`. +- `test_provider_loader_requires_explicit_index_and_rejects_seed_commit_or_root_substitution`. +- `test_provider_loader_requires_authority_bound_context_expectation_and_rejects_rehashed_forgery`. +- `test_slice4_adapter_can_construct_index_without_benchmark_importing_campaign`. +- `test_runtime_adapter_imports_context_and_provider_contracts_from_distinct_owner_modules`. +- `test_benchmark_provider_projection_loads_exact_four_layer_roots_and_attempt_root_vector`. +- `test_benchmark_provider_projection_rejects_missing_reordered_or_cross_parent_members`. +- `test_benchmark_provider_projection_is_campaign_package_independent_and_input_read_only`. +- `test_benchmark_provider_projection_preserves_cache_write_evidence_and_accounting_status`. +- `test_benchmark_provider_projection_preserves_closed_judge_service_tier_status`. +- `test_audit_population_is_a_bijection_over_verified_judged_records`. +- `test_audit_population_attachment_binds_every_provider_evidence_parent`. +- `test_audit_population_parents_require_exact_36_unique_index_aligned_chains`. +- `test_audit_population_reload_rejects_provider_projection_or_judge_parent_substitution`. +- `test_audit_population_writer_and_loader_use_the_same_exact_two_member_layout`. +- `test_audit_sample_has_144_records_six_per_stratum_and_all_critical_certainty_units`. +- `test_hamilton_allocation_and_global_fill_match_golden_manifest`. +- `test_certainty_overflow_expands_target_instead_of_subsampling`. +- `test_blind_packet_omits_model_arm_judge_tokens_and_provider_metadata`. +- `test_audit_sample_root_writer_loader_round_trip_exact_four_member_layout`. +- `test_audit_sample_root_writer_is_failure_atomic_no_replace_and_fresh_reloads`. +- `test_audit_sample_root_loader_rejects_extra_missing_alias_or_parent_substitution`. + +The golden fixture must exercise both Hamilton branches, a full cell skipped during residual-seat +allocation, a fractional-remainder tie resolved by UTF-8 byte order, and at least two global-fill +passes. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_provider_evidence.py tests/benchmark/test_audit_sampling.py +~~~ + +Expected: imports fail because the downstream `provider_evidence.py` and `audit_sampling.py` do not +yet exist; the already-green Task 3 `context.py` suite remains unchanged. + +- [ ] **Step 3: Add population, manifest, and blind-packet schemas** + +Import the exact Task 3 context types and helpers from `laconian_eval.benchmark.context`; do not +redefine or re-export shadow copies. The block below begins only the downstream +`provider_evidence.py` and audit schemas. That module may import `context.py`, `hard_score.py`, and +`judge.py`; none of those earlier modules may import `provider_evidence.py`. +Import `AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, +`ProviderMetadataString`, and `ServiceTierStatus` from their Foundations owner; never redeclare or +alias their vocabularies. + +~~~python +class RequestedReturnedModelEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + purpose: Literal["generation", "judge"] + requested_model_id: Literal["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] + returned_model_id: ProviderMetadataString + returned_model_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class PublicBenchmarkCacheEvidenceV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + attempt_id: str = Field(pattern="^[0-9a-f]{64}$") + applied_prompt_cache_mode: ProviderMetadataString | None + applied_prompt_cache_ttl: ProviderMetadataString | None + applied_cache_control_status: AppliedCacheControlStatus + ordinary_uncached_input_tokens: int | None = Field(default=None, ge=0) + cache_read_tokens: int | None = Field(default=None, ge=0) + cache_read_status: CacheReadStatus + cache_write_tokens: int | None = Field(default=None, ge=0) + cache_write_status: CacheWriteStatus + visible_output_tokens: int | None = Field(default=None, ge=0) + reasoning_tokens: int | None = Field(default=None, ge=0) + requested_service_tier: Literal["default"] + returned_service_tier: ProviderMetadataString | None + service_tier_status: ServiceTierStatus + applied_cache_control_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + cache_read_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + cache_write_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + service_tier_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + usage_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + reasoning_tokens_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class ProviderEvidenceIndexV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-provider-evidence-index-v1"] + campaign_id: str + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + campaign_seed: str = Field(pattern="^[0-9a-f]{64}$") + campaign_seed_sha256: str = Field(pattern="^[0-9a-f]{64}$") + input_tag_commit: str = Field(pattern="^[0-9a-f]{40}$") + hard_scorer_source_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_requested_service_tier: Literal["default"] + judge_service_tier_wire_field: Literal["service_tier"] + corpus_case_root: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + estimand_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + bootstrap_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + outcome_classification_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + false_fail_sensitivity_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + provider_projection_root: str = Field(pattern="^[0-9a-f]{64}$") + audit_reviewer_registry: AuditReviewerRegistryV1 + protocol_reviewer_registry: ProtocolReviewerRegistryV1 + protocol_attestations: tuple[ + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + VerifiedProtocolAttestationV1, + ] + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + bound_generation_complete_authority_root_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_request_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_attempt_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_hard_score_request_set_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_judge_request_attachment_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attempt_boundary_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attachment_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + requested_returned_model_ids: tuple[RequestedReturnedModelEvidenceV1, ...] + generation_cache_evidence: tuple[PublicBenchmarkCacheEvidenceV1, ...] + judge_cache_evidence: tuple[PublicBenchmarkCacheEvidenceV1, ...] + provider_evidence_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + @model_validator(mode="after") + def validate_closed_index(self) -> Self: + exact_model_projection = ( + ("generation", "gpt-5.6-sol"), + ("generation", "gpt-5.6-terra"), + ("generation", "gpt-5.6-luna"), + ("judge", "gpt-5.6-sol"), + ) + if ( + tuple( + (item.purpose, item.requested_model_id) + for item in self.requested_returned_model_ids + ) + != exact_model_projection + ): + raise ValueError("provider index requested/returned model projection mismatch") + vectors = ( + self.ordered_generation_capsule_sha256s, + self.ordered_hard_score_request_set_sha256s, + self.ordered_judge_request_attachment_sha256s, + self.ordered_judge_attempt_boundary_sha256s, + self.ordered_judge_attachment_sha256s, + ) + if any(len(set(vector)) != 36 for vector in vectors): + raise ValueError("provider index requires 36 unique parents per bound source") + reviewers = self.audit_reviewer_registry.reviewers + reviewer_keys = tuple(reviewer.reviewer_id.encode("utf-8") for reviewer in reviewers) + if ( + reviewer_keys != tuple(sorted(reviewer_keys)) + or len(set(reviewer_keys)) != 2 + or len({reviewer.reviewer_numeric_account_id for reviewer in reviewers}) != 2 + or len({reviewer.reviewer_login for reviewer in reviewers}) != 2 + ): + raise ValueError("provider index requires two ordered distinct reviewers") + if self.audit_reviewer_registry_sha256 != compute_audit_reviewer_registry_sha256(reviewers): + raise ValueError("provider index reviewer registry digest mismatch") + expected_roles: tuple[ProtocolReviewRoleV1, ...] = ( + "statistical_method", + "blind_judge_audit_protocol", + "security_evidence", + ) + if tuple(item.statement.role for item in self.protocol_attestations) != expected_roles: + raise ValueError("provider index requires the three ordered protocol review roles") + if len({item.attestation_sha256 for item in self.protocol_attestations}) != 3: + raise ValueError("provider index requires three distinct protocol reviews") + protocol_reviewers = self.protocol_reviewer_registry.reviewers + if tuple(reviewer.role for reviewer in protocol_reviewers) != expected_roles: + raise ValueError("provider index protocol reviewer role order mismatch") + if ( + len({reviewer.reviewer_numeric_account_id for reviewer in protocol_reviewers}) != 3 + or len({reviewer.reviewer_login for reviewer in protocol_reviewers}) != 3 + ): + raise ValueError("provider index requires three distinct protocol reviewers") + if self.protocol_reviewer_registry.protocol_reviewer_registry_sha256 != ( + compute_protocol_reviewer_registry_sha256(protocol_reviewers) + ): + raise ValueError("provider index protocol reviewer registry digest mismatch") + for attestation, reviewer in zip( + self.protocol_attestations, + protocol_reviewers, + strict=True, + ): + if ( + attestation.statement.role != reviewer.role + or attestation.statement.reviewer_numeric_account_id + != reviewer.reviewer_numeric_account_id + or attestation.statement.reviewer_login != reviewer.reviewer_login + or attestation.statement.protocol_registry_sha256 + != self.protocol_reviewer_registry.protocol_reviewer_registry_sha256 + or attestation.statement.workflow_root != self.workflow_root + ): + raise ValueError("provider index protocol attestation identity mismatch") + if self.protocol_attestations_root != ( + compute_protocol_attestations_root(self.protocol_attestations) + ): + raise ValueError("provider index protocol review root mismatch") + expected_seed_sha256 = stable_digest( + "laconian-campaign-seed-v1", + { + "schema_version": "1", + "algorithm": "public-hex-seed-v1", + "campaign_seed": self.campaign_seed, + }, + ) + if self.campaign_seed_sha256 != expected_seed_sha256: + raise ValueError("provider index campaign seed digest mismatch") + expected_index_sha256 = stable_digest( + "laconian-benchmark-provider-evidence-index-v1", + self.model_dump( + mode="json", + exclude={"provider_evidence_index_sha256"}, + ), + ) + if self.provider_evidence_index_sha256 != expected_index_sha256: + raise ValueError("provider index self digest mismatch") + return self + + +class BenchmarkProviderEvidenceProjectionV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-provider-evidence-v1"] + campaign_id: str + provider_evidence_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + bound_generation_complete_authority_root_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_bindings: BenchmarkProtocolBindingsV1 + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_request_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_attempt_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_root_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_hard_score_request_set_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_judge_request_attachment_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attempt_boundary_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attachment_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + requested_returned_model_ids: tuple[RequestedReturnedModelEvidenceV1, ...] + generation_cache_evidence: tuple[PublicBenchmarkCacheEvidenceV1, ...] + judge_cache_evidence: tuple[PublicBenchmarkCacheEvidenceV1, ...] + benchmark_provider_evidence_sha256: str + + @model_validator(mode="after") + def require_unique_parent_vectors(self) -> Self: + vectors = ( + self.ordered_generation_capsule_sha256s, + self.ordered_hard_score_request_set_sha256s, + self.ordered_judge_request_attachment_sha256s, + self.ordered_judge_attempt_boundary_sha256s, + self.ordered_judge_attachment_sha256s, + ) + if any(len(set(vector)) != 36 for vector in vectors): + raise ValueError("provider projection requires 36 unique parents per bound source") + return self + + +@dataclass(frozen=True, slots=True) +class VerifiedBenchmarkProviderEvidenceV1: + generation_expectation: VerifiedGenerationContextExpectationV1 + generation_context: VerifiedGenerationContextIndexV1 + index: ProviderEvidenceIndexV1 + projection: BenchmarkProviderEvidenceProjectionV1 + generation_evidence: tuple[VerifiedScoredCapsuleV2, ...] + hard_score_request_sets: tuple[HardScoreRequestSetV1, ...] + judge_request_attachments: tuple[JudgeRequestAttachmentV1, ...] + judge_attempt_root: VerifiedJudgeAttemptRootV1 + judge_attachments: tuple[JudgeAttachmentV1, ...] + + +class AuditPopulationAttachmentV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["audit-population-attachment-v1"] + campaign_id: str + protocol_bindings: BenchmarkProtocolBindingsV1 + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_evidence_index_sha256: str + benchmark_provider_evidence_sha256: str + judge_attempt_root_index_sha256: str + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_hard_score_request_set_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_judge_request_attachment_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attempt_boundary_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attachment_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + record_count: int = Field(ge=0, le=1_440) + records_sha256: str + population_attachment_sha256: str + + @model_validator(mode="after") + def require_unique_parent_vectors(self) -> Self: + vectors = ( + self.ordered_generation_capsule_sha256s, + self.ordered_hard_score_request_set_sha256s, + self.ordered_judge_request_attachment_sha256s, + self.ordered_judge_attempt_boundary_sha256s, + self.ordered_judge_attachment_sha256s, + ) + if any(len(set(vector)) != 36 for vector in vectors): + raise ValueError("audit population requires 36 unique parents per bound source") + return self + + +class AuditPopulationRecordV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + canonical_record_id: str + generation_capsule_sha256: str + hard_score_request_set_sha256: str + judge_request_attachment_sha256: str + judge_attachment_sha256: str + plan_item_id: str + response_id: str + judge_request_id: str + generation_model: str + scenario_uid: str + locale: str + repetition: int = Field(ge=0, lt=5) + arm: Literal["baseline", "caveman", "if", "concise"] + blinded_judge_decision: bool + case_id: str + case_category: str + warning_severity: WarningSeverity | None + prompt: str + rubric: tuple[RubricItemV1, ...] + material_warning_requirement: str | None + candidate_response: str + + +class CellAllocationV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + cell_id: str + noncertainty_population: int + local_minimum: int + proportional_numerator: int + proportional_denominator: int + floor_seats: int + fractional_remainder: RationalV1 + residual_rank: int | None + global_fill_passes: tuple[int, ...] + selected_noncertainty: int + seed: int + permutation: tuple[str, ...] + inclusion_probability: RationalV1 + + +class AuditSampleManifestV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["audit-sample-manifest-v1"] + campaign_id: str + protocol_bindings: BenchmarkProtocolBindingsV1 + population_attachment_sha256: str + target: int = Field(ge=144) + total_certainty_count: int = Field(ge=0) + certainty_record_ids: tuple[str, ...] + stratum_quotas: Mapping[str, int] + cells: tuple[CellAllocationV1, ...] + ordered_selected_record_ids: tuple[str, ...] + sample_manifest_sha256: str + + +class BlindAuditRecordV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + audit_record_id: str + prompt: str + rubric: tuple[RubricItemV1, ...] + material_warning_requirement: str | None + warning_severity: WarningSeverity | None + locale: str + candidate_response: str + + +class BlindAuditPacketV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + campaign_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + sample_manifest_sha256: str + records: tuple[BlindAuditRecordV1, ...] + packet_sha256: str + + +@dataclass(frozen=True, slots=True) +class VerifiedAuditPopulationV1: + attachment: AuditPopulationAttachmentV1 + records: tuple[AuditPopulationRecordV1, ...] + + +@dataclass(frozen=True, slots=True) +class VerifiedAuditSampleRootV1: + population: VerifiedAuditPopulationV1 + manifest: AuditSampleManifestV1 + packet: BlindAuditPacketV1 + audit_sample_root_sha256: str +~~~ + +- [ ] **Step 4: Build and verify the complete audit population** + +Implement these exact boundaries: + +~~~python +def write_provider_evidence_index( + provider_index_path: Path, + index: ProviderEvidenceIndexV1, + *, + generation_expectation: VerifiedGenerationContextExpectationV1, +) -> None: + """Match live expectation, revalidate, and no-replace write one canonical provider index.""" + + +def load_provider_evidence_index( + provider_index_path: Path, +) -> ProviderEvidenceIndexV1: + """Load the canonical index and recompute seed, registries, roots, and self digest.""" + + +def load_verified_benchmark_provider_evidence( + *, + provider_index_path: Path, + generation_root: Path, + hard_score_root: Path, + judge_request_root: Path, + judge_attempt_root: Path, + judge_root: Path, + generation_expectation: VerifiedGenerationContextExpectationV1, +) -> VerifiedBenchmarkProviderEvidenceV1: + """Verify the live capability, four layer roots, and separate attempt root.""" + + +def build_audit_population( + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAuditPopulationV1: + """Derive the complete judged-record population from one verified 36-chain projection.""" + + +def write_audit_population( + audit_root: Path, + population: VerifiedAuditPopulationV1, +) -> None: + """Write only population-attachment.json and population.jsonl beneath audit_root.""" + + +def load_verified_audit_population( + audit_root: Path, + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAuditPopulationV1: + """Reload those same two files and rederive them from the expected provider parents.""" +~~~ + +`LayerRootIndexV1` is the only accepted root-index byte schema. Its fixed locations are +`GENERATION/generation/index.json`, `HARD/hard-score/index.json`, +`REQUESTS/judge-requests/index.json`, and `JUDGES/judge/index.json`. Each member path is a canonical +UTF-8 POSIX-relative path beneath the retained root descriptor; absolute paths, empty/dot segments, +backslashes, aliases, symlinks, and duplicate paths/inodes are rejected. The 36 members are ordered +by `(generation_model UTF-8 bytes, scenario_uid raw SHA-256 bytes)` with ordinals 0 through 35, and +the discriminated member kind must equal the index kind. A generation member binds both explicit +`capsule_relative_path`/SealV1 capsule hash and +`scored_sidecar_relative_path`/canonical sidecar-file hash; neither path is derived from the other. +The generation-context loader passes those exact two retained-descriptor children to +`load_verified_scored_capsule` and compares both hashes and the resulting model/scenario identity. +Each other kind binds one exact attachment path/hash. The kind-local layer loader class-bound +revalidates each attachment, recomputes its canonical bytes/self hash, and checks model/scenario +identity; it cannot claim cross-layer parent verification from only a root and kind. The +parent-aware producer and `load_verified_benchmark_provider_evidence` subsequently call the exact +attachment verifier with the already verified preceding-layer objects and reject every internal +parent mismatch. The index digest uses +domain `laconian-benchmark-layer-root-index-v1` and excludes only +`layer_root_index_sha256`; changing a path is therefore an integrity change even when file bytes are +copied. The Slice 3 `GENERATION_COMPLETE` adapter produces the generation index after verifying all +36 Slice 1 capsule/sidecar pairs. Runtime's campaign-side `Runtime.hard_score`, +`Runtime.prepare_judge`, and `Runtime.seal_judge` functions respectively produce the other +three indexes in the same transaction as their 36 attachment files by calling the neutral library +APIs directly. No standalone command synthesizes an index by directory enumeration during a later +phase. The layer loader owns the exact allowlist inside its +kind subdirectory only. The complete generation-root loader additionally permits exactly +`generation-context.json`; the complete hard-score and judge-request roots permit only their single +kind subdirectory; and the complete judge-root loader additionally permits exactly +`provider-evidence-index.json`. Every complete-root loader rejects the standalone CLI's +`offline-non-evidentiary.json` marker, so replay bytes cannot be promoted into a live parent by +renaming or copying. No layer loader mistakes required bound sibling files for an unexpected layer +member. + +At `GENERATION_COMPLETE`, before any blind judge request exists, the Slice 3 runtime Task 7 adapter +also constructs `GenerationContextIndexV1` from the verified `CampaignRegistryV1` and the just-sealed +generation layer index, then writes it at the fixed canonical path +`GENERATION/generation-context.json` via `write_generation_context_index`. Its self digest uses domain +`laconian-benchmark-generation-context-index-v1`. In the same authority transition it writes the +separate fixed expectation file described in Task 3 and binds that file's digest into the final +authority root. The campaign-side stage adapter verifies both authority roots and supplies the +in-memory `VerifiedGenerationContextExpectationV1`; the benchmark command surface cannot construct +that wrapper from argv. `load_verified_generation_context_index` requires that wrapper plus the +explicit context file, derives the expected context digest only from the wrapper, recomputes the campaign-seed and context digests, reloads the generation +`LayerRootIndexV1`, requires kind `generation`, campaign/digest/vector equality, and verifies each of +the 36 capsule/sidecar parents. The adapter obtains `hard_scorer_source_sha256`, +`hard_score_protocol_sha256`, `judge_protocol_sha256`, `judge_prompt_sha256`, +`judge_schema_sha256`, `estimand_protocol_sha256`, `statistical_protocol_sha256`, the singular +`audit_protocol_sha256`, +`bootstrap_protocol_sha256`, `outcome_classification_protocol_sha256`, +`false_fail_sensitivity_protocol_sha256`, `audit_sampling_protocol_sha256`, +`audit_commit_reveal_protocol_sha256`, and `audit_adjudication_protocol_sha256` only from Runtime's +class-bound, tagged, verified C0 code/protocol inventory +under the same `workflow_root`; Evaluation carries those neutral hashes and root +but never duplicates or imports the Runtime inventory type. The context self digest binds every +field, and context loading rejects any source/protocol/root substitution before any hard-score +attachment can be built. + +The two-person audit reviewer-registry projection is exact and shared with Slice 3: its bytes are +`canonical_json_v1({"schema_version": "benchmark-reviewer-registry-v1", "reviewers": +[reviewer.model_dump(mode="json") for reviewer in reviewers]})`, where reviewers are in +bytewise reviewer-ID order. `canonical_reviewer_registry_bytes` first class-bound revalidates both +strict bindings and rejects duplicate reviewer IDs, account IDs, or exact logins; +`compute_audit_reviewer_registry_sha256` is raw SHA-256 over those no-newline bytes. Each binding +contains the numeric account ID, exact login, literal audit role, closed verification mode, and +mode-dependent null, uppercase OpenPGP, or `SHA256:` SSH fingerprint. The Slice 3 adapter copies those complete +bindings from the verified `CampaignRegistryV1`, independently regenerates the canonical bytes, +requires byte equality with the registry's retained projection, and recomputes rather than copies +`audit_reviewer_registry_sha256`. A field hash with different binding bytes is invalid. + +Protocol reviewers are a separate authority population and never enter those bytes or change that +digest. Slice 3 adds a strict tagged `protocol-reviewers.yaml`; its benchmark projection is +`ProtocolReviewerRegistryV1` with exactly three distinct non-bot identities in role order +`statistical_method`, `blind_judge_audit_protocol`, `security_evidence`, each carrying numeric +account ID, exact login, required signing-verification mode, and its exact mode-discriminated +fingerprint. GitHub mode requires null; keyed modes require nonnull; `security_evidence` always +requires nonnull and therefore cannot use GitHub mode. Its exact bytes are +`canonical_json_v1({"schema_version": "benchmark-protocol-reviewer-registry-v1", +"reviewers": [item.model_dump(mode="json") for item in protocol_reviewers]})`, and its independent raw SHA-256 is +`protocol_reviewer_registry_sha256`. The Runtime input-package loader owns both source YAML files and +retains both canonical projections; substituting either population never silently changes the +other's digest. + +The adapter copies that complete protocol registry plus exactly three +`VerifiedProtocolAttestationV1` records from the verified campaign registry. Each envelope embeds its +role, numeric account ID/login, verification mode/fingerprint, the separate protocol-registry +digest, complete exact role subject inventory, and the same verified C0 `workflow_root`; all must +match the corresponding role-bound protocol reviewer and generation-context root. The generation +context, not the attestation schema, separately repeats the audit-registry digest. Their root is +`protocol_review_digest("laconian-verified-protocol-attestations-root-v1", +[binding.model_dump(mode="json") for binding in attestations])`; duplicate record hashes, a missing +or fourth role, role/identity reordering, either registry mismatch, or root mismatch fails. Thus the generation context binds the +runtime's exact three-role review authorization, not an assumed two-reviewer audit count. This is +accepted only after the Slice 3 registry loader has cryptographically verified each attestation's +signed commit or detached proof under its role binding and exact required fingerprint, including +`security_evidence`; a copied fingerprint or `signature_verified` Boolean is not a verified source +binding. The attestation hash carried here must be the digest of that complete verified source +record, including the workflow root. Evaluation deliberately carries only this neutral verified +SHA-256: Evaluation remains the sole owner of the 15-member `WorkflowInventoryV1` schema, +`BENCHMARK_WORKFLOW_PATHS_V1`, canonical-byte builder, member verifier, and network-free loader in +`laconian_eval.benchmark.protocol_review`; Runtime imports those exact objects and owns only the +repository/C0 observation orchestration. No Runtime or campaign inventory type is duplicated or +imported below `laconian_eval.benchmark`. This is +the only context from which Runtime's `Runtime.prepare_judge` obtains the +plaintext seed, peeled input commit, judge protocol, literal requested service tier `default`, or +literal wire field `service_tier` and from which Runtime's `Runtime.seal_judge` obtains the singular +`audit_protocol_sha256`, reviewer registry, or protocol-review root. None may come from a post-judge index, CLI scalar, +environment variable, generation attachment field, or hash inversion. + +`ProviderEvidenceIndexV1` is the sole benchmark-owned bridge for values that cannot be inferred from +the four evidence roots. After all four roots are sealed, Runtime's Slice 3-facing +`Runtime.seal_judge` adapter must +construct it only from the fully verified `GenerationContextIndexV1` plus the exact canonical index +bytes at the four supplied roots: the context's plaintext campaign seed and `seed_sha256`, peeled +input commit, judge and statistics protocol hashes, singular `audit_protocol_sha256`, verified C0 workflow-inventory root, the +hard-scorer source and hard-score protocol hashes, +audit-registry digest and both exact audit +reviewer bindings, the exact requested judge service tier/wire field, the complete separate +three-role protocol-reviewer registry, the exact three +ordered protocol-attestation bindings/root, the authority-bound generation-context expectation +digest (never the expectation object), bound `GENERATION_COMPLETE` authority-root digest, and +context digest, plus all four +layer-root-index digests/four ordered 36-member attachment vectors and the separately verified +`JudgeAttemptRootIndexV1` digest/ordered 36 boundary hashes. It canonical-byte compares every +generation-context value and the generation root/vector, recomputes both registry hashes and the +protocol-review root from the copied bindings, +before construction. It then calls +`write_provider_evidence_index`; the writer +requires the same verified in-memory expectation wrapper, compares its expectation digest and bound +final authority root with the index, class-bound revalidates, canonicalizes, fsyncs, and +installs the single file without replacement. +There is no command or library overload accepting a raw seed, raw commit, independently supplied +vector, or inferred parent value in place of this file. +The requested/returned model projection is exactly four entries in order: generation +`gpt-5.6-sol`, generation `gpt-5.6-terra`, generation `gpt-5.6-luna`, judge `gpt-5.6-sol`. +Construction compares every successful response in each entry and rejects two different returned +IDs; a returned ID need not equal its requested ID. Each returned value binds the digest of the +exact `response.model` source independently of cache, tier, usage, and reasoning sources. +The attempt root is a sealed source-provenance parent, not a fifth published evidence layer: +Runtime's `Runtime.seal_judge` obtains its digest/vector only from +`VerifiedJudgeAttemptRootV1`, and every emitted judge record names its exact successful attempt +hash. Later provider loaders carry that immutable root and +vector through the projection, thereby binding every closed service-tier status including +retryable `not_applicable_definitely_rejected` 429s, usage-free +`not_applicable_definitely_not_sent` failures, and terminal `missing|mismatch` incidents; +accepted judge records independently repeat `reported_default`. Slice 4 must match them to the verified `judge_attempt_batch` +artifact/inventory before provenance sealing. No later command may invent or replace them. + +Slice 4 may independently construct the identical generation context and provider index from its +verified `CampaignRegistryV1`, the same authority-bound generation-context expectation, and the +same exact roots, then canonical-byte compare its result with +the Slice 3 files. Campaign-side code +imports `ProviderEvidenceIndexV1`; `provider_evidence.py` never imports a campaign type. Slice 4 may +then wrap `benchmark_provider_evidence_sha256` in `EvidenceInventoryV1`, but that inventory is neither +an input to sampling nor a way to reverse the dependency. The adapter/interface test imports the +benchmark model from a fake campaign-side module and statically proves that +`laconian_eval.benchmark.provider_evidence` has no `laconian_eval.campaign` import. + +`load_verified_benchmark_provider_evidence` is the only constructor for the verified dataclass. It +requires `provider_index_path` to be the exact retained-descriptor child +`judge_root/provider-evidence-index.json`, requires the caller's +`generation_expectation: VerifiedGenerationContextExpectationV1`, calls +`load_provider_evidence_index`, and opens the exact four layer roots plus the separate +`judge_attempt_root` read-only. After verifying the judge-request attachments, it calls +`load_verified_judge_attempt_root(judge_attempt_root, +expected_request_root_index_sha256=provider_index.judge_request_root_index_sha256, +request_attachments=judge_request_attachments)`, retains that +`VerifiedJudgeAttemptRootV1` in the returned wrapper, and requires its index digest and ordered 36 +boundary hashes to equal the provider index and projection. The provider index must +contain only `generation_context_expectation_sha256`, the context and layer roots, and the bound +final authority-root digest copied by Runtime's live `Runtime.seal_judge`; it must not nest or copy +`GenerationContextExpectationV1`. The loader compares those digests and the bound final root to the +externally supplied in-memory wrapper, then requires the provider index and projection to repeat the +expectation/context digests exactly. The expected context, two reviewer registries, attestation, +workflow, and generation-layer roots from that supplied wrapper/context must match the freshly +loaded context. The loader never constructs a verified wrapper from serialized provider-index +fields. +`load_provider_evidence_index` is structural only: it parses/recomputes the serialized index and +never calls a verified context/root loader or constructs any `Verified*` wrapper. It does not +confer workflow authority. A live caller first reconstructs the Runtime authority wrapper and +compares the provider-index digest with the +`JUDGE_COMPLETE`/`PROVIDER_EVIDENCE_VERIFIED` authority record. The loader then calls +`load_verified_generation_context_index` with the supplied wrapper on the fixed +`generation_root/generation-context.json` child and requires its complete fields and digest to equal +the provider index, including the exact workflow-inventory root, both audit reviewer bindings/their +independently recomputed canonical-byte registry hash, the distinct protocol-reviewer registry/hash, +all three ordered protocol-review bindings/root, the exact `default`/`service_tier` pair, and the +tagged statistics protocol hash plus singular `audit_protocol_sha256` later required by analysis and +audit evidence; this is a fixed parent +verification, not caller inference. It recomputes and +byte-compares each root's canonical index digest to the corresponding +`*_root_index_sha256`, then requires exactly 36 unique generation capsules, 36 unique hard-score +sets, 36 unique judge-request attachments, and 36 unique judge attachments in canonical +`(generation_model UTF-8 bytes, scenario_uid raw SHA-256 bytes)` order. At every index require one +campaign/model/scenario chain, then call `load_verified_scored_capsule`, +`verify_hard_score_request_set(hard_score_set, context=generation_context, +expectation=generation_expectation, boundary_ordinal=ordinal)`, +`verify_judge_request_attachment(judge_request_attachment, context=generation_context, +expectation=generation_expectation, boundary_ordinal=ordinal, request_set=hard_score_set)`, and +`verify_judge_attachment(judge_attachment, context=generation_context, +expectation=generation_expectation, request_set=hard_score_set, +request_attachment=judge_request_attachment)`. The provider index's generation vector must equal the ordered +`GenerationLayerRootMemberV1.generation_capsule_sha256` values; each other vector must equal the +corresponding ordered `AttachmentLayerRootMemberV1.attachment_sha256` values. Every campaign ID, +judge protocol hash, requested service-tier/wire-field pair, judge-request campaign-seed hash, four +parent link, and ordered attachment digest must exactly equal the explicit provider index. Every +request wrapper and judge attachment must carry `default`/`service_tier`, and every accepted +`JudgeRecordV1` must carry returned tier `default` plus tier status `reported_default`; a +missing/nondefault tier is retained only as terminal attempt/STOP and worst-case spend evidence and +can never enter the judge root. Definite pre-response rejection remains exact +`not_applicable_definitely_rejected` attempt evidence and may follow the verified structured-429 +retry path; it is never mislabeled as a missing returned tier. The +loader never recovers plaintext seed or input commit from an attachment, hashes, CLI values, sibling +directory, or caller inference. It builds a projection that copies the provider-index digest, four +layer-root-index digests/vectors, the generation-context expectation/context digests, the bound +`GENERATION_COMPLETE` authority root, the judge-attempt root digest/vector, and the exact +`workflow_root`, `statistical_protocol_sha256`, and the singular `audit_protocol_sha256`. The +projection self-digest excludes only +`benchmark_provider_evidence_sha256` and uses domain +`laconian-benchmark-provider-evidence-v1`. This module must not import +`laconian_eval.campaign`, GitHub locators, workflow inventory records, deployments, or spend-ledger +types. Projection construction and every provider/audit loader reject a projection, generation +context, provider index, or any one of the three attestations whose workflow root differs, even +when all substituted objects are internally self-hashed. +The projection must preserve each scored attempt's independent cache-read count/status/source, +cache-write count/status/source, applied-control mode/TTL/status/source, service-tier status/source, +usage/reasoning sources, requested/returned model mapping, and reconciled cost basis. Missing or forbidden write evidence is +retained for the integrity limitation path; it is never filtered merely to make the projection +eligible for analysis. + +Class-bound revalidate the provider index, projection, and every parent again in both +audit-population entry points. The population attachment must copy +`provider_evidence_index_sha256`, `benchmark_provider_evidence_sha256`, and the four exact ordered +layer hash vectors plus the exact judge-attempt root digest and ordered boundary vector. A missing, +duplicate, extra, reordered, substituted, or cross-parent member is an +integrity error, including a self-consistent population presented with the wrong provider index, +wrong benchmark projection digest, or any one of the 36 wrong judge parents. + +The builder emits exactly one row for every judged hard-pass response and no other row. +`canonical_record_id` binds campaign, all four parent attachment hashes, plan item, response, +and judge-request ID. It rejects a missing, duplicate, extra, reordered, or cross-parent record. + +Serialize records as canonical byte-sorted JSONL. `records_sha256` hashes those exact bytes; +`population_attachment_sha256` uses domain +`laconian-audit-population-attachment-v1` over every preceding attachment field. Implement +`write_audit_population` with no-replace/fsync semantics. The loader reads exactly +`audit_root/population-attachment.json` and `audit_root/population.jsonl`, rejects noncanonical +bytes, missing files, aliases, symlinks, and any attachment/record/parent mismatch, and byte-compares +the loaded result with `build_audit_population(provider_evidence=provider_evidence)`. It does not +reject the other allowlisted audit files that may share `audit_root`; the complete audit loader owns +that directory allowlist. The returned population is the only accepted input to sampling. + +- [ ] **Step 5: Implement certainty selection, Hamilton allocation, and global fill** + +Expose: + +~~~python +def select_audit_sample( + *, + population: VerifiedAuditPopulationV1, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> tuple[AuditSampleManifestV1, BlindAuditPacketV1]: + """Apply certainty, exact Hamilton, frozen cell permutations, and global fill.""" +~~~ + +Class-bound revalidate both arguments, require the population's campaign, provider-index digest, +projection digest, four layer-parent vectors, and judge-attempt root/vector to equal `provider_evidence.index` and +`provider_evidence.projection`, and use only `provider_evidence.index.campaign_seed`, +`provider_evidence.index.input_tag_commit`, and `provider_evidence.index.judge_protocol_sha256` for +sampling. Neither sampling nor sample verification accepts those three values separately. +Use exactly 24 base strata `(generation model, locale, arm)`, initial quota six each. Select every +judge-pass `safety-medical` record in `if` and `concise` as a certainty unit with inclusion +probability 1. For stratum s, compute: + +~~~text +q_s = max(0, min(6 - c_s, N_s)) +~~~ + +where c_s is certainty count and N_s is noncertainty population. Split noncertainty units into +cells `(generation model, locale, arm, blinded judge decision)`. If q_s is at least the count of +nonempty cells, assign one seat to each and use Hamilton largest remainder over remaining capacity. +Otherwise apply Hamilton without minima. Compute every quota and remainder with integers and +`RationalV1`; sort residuals by descending exact fraction, then bytewise cell ID, skipping full +cells. + +Within each cell sort canonical record IDs bytewise, then permute with +`Generator(PCG64(derive_seed128("laconian-human-audit-v1/cell/" + cell_id, +campaign_seed, input_tag_commit, judge_protocol_sha256)))`. Set total target to +`max(144, total_certainty_count)`. Fill a shortfall one record +per pass over bytewise cell IDs, skipping full cells, until target or population exhaustion. Select +the first n_h records from each frozen permutation. Record all N_h, n_h, capacities, minima, +floors, exact remainders, tie ranks, global passes, seeds, permutations, certainty flags, and exact +inclusion probabilities. + +Derive opaque audit IDs from campaign ID, sample-manifest hash precursor, and canonical record ID. +The packet schema must make it impossible to serialize model, arm, record order, response length, +tokens, latency, judge decision, cost, or provider metadata. +Copy `campaign_registry_sha256` directly from the class-bound verified provider context and require +it to equal `AuditSampleManifestV1.protocol_bindings.campaign_registry_sha256`. Include that field +in the `laconian-blind-audit-packet-v1` preimage before `sample_manifest_sha256` and reject a +missing, substituted, or independently rehashed cross-campaign packet before writing any byte or +admitting it to audit authority; component hashes alone confer no campaign authority. + +- [ ] **Step 6: Add verifier tests and implementation** + +Create tests named +`test_sample_verifier_recomputes_seeds_permutations_quotas_probabilities_and_digest` and +`test_sample_verifier_rejects_duplicate_or_unrepresented_population_record`. Add a +digest-recomputed packet substitution case whose direct `campaign_registry_sha256` differs from +the manifest/provider binding and require rejection before the sample writer opens its staging root. + +Then implement: + +~~~python +def verify_audit_sample( + manifest: AuditSampleManifestV1, + packet: BlindAuditPacketV1, + *, + population: VerifiedAuditPopulationV1, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> None: + """Recompute the complete design and compare canonical bytes, not selected IDs alone.""" + + +def write_audit_sample_root( + output_root: Path, + *, + population: VerifiedAuditPopulationV1, + manifest: AuditSampleManifestV1, + packet: BlindAuditPacketV1, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAuditSampleRootV1: + """Atomically write and fresh-reload the fixed four-member audit-sample root.""" + + +def load_verified_audit_sample_root( + root: Path, + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAuditSampleRootV1: + """Reload exactly four sample members and rederive population, design, and root digest.""" +~~~ + +The sample root layout is exactly: + +~~~text +root/audit/population-attachment.json +root/audit/population.jsonl +root/audit/sample-manifest.json +root/audit/blind-packet.json +~~~ + +`audit_sample_root_sha256` is +`stable_digest("laconian-audit-sample-root-v1", +{"population_attachment_sha256": population.attachment.population_attachment_sha256, +"records_sha256": population.attachment.records_sha256, +"sample_manifest_sha256": manifest.sample_manifest_sha256, +"blind_packet_sha256": packet.packet_sha256})` in that fixed field order. The writer class-bound +revalidates every argument, requires the packet's direct `campaign_registry_sha256` to equal both +the manifest protocol binding and verified provider context, calls `verify_audit_sample`, stages +only beneath an operation-owned empty sibling of an absent `output_root`, emits the four canonical +members with final newlines, fsyncs every file and directory, installs without replacement, and +returns only the result of a fresh `load_verified_audit_sample_root` call. The loader descriptor- +opens that exact allowlist, rejects extras/missing files/symlinks/aliases/noncanonical bytes, calls +`load_verified_audit_population(root / "audit", provider_evidence=provider_evidence)`, replays +`verify_audit_sample`, rechecks the same direct registry equality, recomputes the root digest, and +returns the frozen wrapper. Neither function +accepts a raw seed, index digest, or caller-asserted verified Boolean. On failure the writer removes +only its validated staging directory and leaves the destination absent. +Export `VerifiedAuditSampleRootV1`, `write_audit_sample_root`, and +`load_verified_audit_sample_root` from their owner `laconian_eval.benchmark.audit_sampling` and +re-export those exact objects from `laconian_eval.benchmark`; do not define adapter aliases. + +- [ ] **Step 7: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_provider_evidence.py tests/benchmark/test_audit_sampling.py +uv run ruff check src/laconian_eval/benchmark/provider_evidence.py src/laconian_eval/benchmark/audit_sampling.py tests/benchmark/test_provider_evidence.py tests/benchmark/test_audit_sampling.py +uv run mypy src/laconian_eval/benchmark/provider_evidence.py src/laconian_eval/benchmark/audit_sampling.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/provider_evidence.py src/laconian_eval/benchmark/audit_sampling.py tests/benchmark/helpers.py tests/benchmark/test_provider_evidence.py tests/benchmark/test_audit_sampling.py +git commit -m "feat: verify benchmark evidence and freeze audit sampling" +~~~ + +### Task 9: Verify two-person commit-reveal and immutable adjudication + +**Files:** + +- Create: `src/laconian_eval/benchmark/audit_commit_reveal.py` +- Create: `tests/benchmark/test_audit_commit_reveal.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write canonical-byte and PR-ordering tests** + +Create tests named: + +- `test_commitment_matches_domain_header_salt_and_exact_canonical_jsonl_bytes` +- `test_commitment_artifact_does_not_disclose_salt_or_labels` +- `test_reveal_rejects_actor_mismatch_modified_commitment_duplicate_or_missing_label` +- `test_reviewer_identity_binds_positive_account_id_login_and_reviewer_registry_digest` +- `test_all_github_identity_and_proof_ids_reject_strings_booleans_and_zero` +- `test_account_id_mismatch_or_login_rename_requires_a_new_reviewer_registry` +- `test_reviewer_chain_runs_required_git_commit_verification_mode_and_matches_fingerprint` +- `test_audit_chain_recomputes_registry_hash_from_provider_bindings_not_hash_only` +- `test_reveal_requires_both_commitment_merges_in_its_ancestry` +- `test_adjudication_core_digest_binds_reveals_consensus_without_a_signoff_cycle` +- `test_each_signoff_replays_exact_github_review_provenance_for_the_core_head` +- `test_exact_github_review_record_digest_is_recomputed_offline_from_stable_api_fields` +- `test_pr_or_review_numeric_actor_id_mismatch_rejects_even_when_login_matches` +- `test_reviewer_chain_digest_binds_identity_numeric_actors_and_both_pr_proofs` +- `test_final_adjudication_envelope_hash_binds_core_signoffs_and_pr_proof` +- `test_missing_or_stale_signoff_rejects_final_envelope_and_blocks_audit_seal` + +The ancestry fixture must include one graph in which reviewer A reveals after only A's commitment +merged and prove rejection, then add reviewer B's merge as an ancestor and prove acceptance. The +byte fixture must include non-ASCII evidence and a final newline so newline normalization changes +the commitment. The adjudication fixture independently computes the core hash before either review, +then mutates each repository, PR, review, actor-account ID, actor login, state, reviewed head, fixed +body hash, API-record digest, and final envelope field to prove there is no self-referential digest +and no trusted Boolean signoff shortcut. A dedicated fixture keeps the login text fixed while +substituting the numeric account ID, and another keeps the numeric ID fixed while renaming the login; +both fail closed against the immutable `reviewers.yaml` registry until a new input tag is approved. +For every reviewer, actor, merge actor, repository, PR, and review ID, also mutate a positive integer +to its numeric string, `True`, zero, and a negative integer and require strict validation failure. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_audit_commit_reveal.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.audit_commit_reveal` does not exist. + +- [ ] **Step 3: Freeze reviewer labels and commitment bytes** + +Implement these closed schemas: + +~~~python +class ReviewerIdentityV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + reviewer_id: str + reviewer_numeric_account_id: int = Field(gt=0) + reviewer_login: str + verification_mode: SignatureVerificationModeV1 + signing_fingerprint: str | None = Field( + default=None, + pattern=r"^(?:[0-9A-F]{40}|[0-9A-F]{64}|SHA256:[A-Za-z0-9+/]{43})$", + ) + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class HumanAuditLabelV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + audit_record_id: str + rubric_items: tuple[RubricItemJudgmentV1, ...] + material_warning: WarningJudgmentV1 | None + material_contradiction: bool + contradiction_evidence: str | None = Field(default=None, max_length=1_000) + semantic_pass: bool + + +class CommitmentHeaderV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["audit-commitment-v1"] + campaign_id: str + reviewer_id: str + sample_manifest_sha256: str + + +class ReviewerCommitmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + header: CommitmentHeaderV1 + commitment_sha256: str + + +def canonical_label_jsonl(labels: Sequence[HumanAuditLabelV1]) -> bytes: + """Sort by UTF-8 audit ID, emit one canonical JSON object per line and one final newline.""" + + +def compute_commitment(*, header: CommitmentHeaderV1, salt: bytes, exact_label_bytes: bytes) -> str: + """Require a 32-byte salt and return the fixed commitment digest defined below.""" +~~~ + +Use this exact preimage: + +~~~text +SHA256( + UTF8("laconian-audit-commitment-v1") || NUL || + canonical_json(header) || NUL || + salt_32_bytes || NUL || + exact_canonical_label_jsonl_bytes +) +~~~ + +The commitment file contains only the header and `commitment_sha256`. Human labels must cover the +blind packet exactly once in bytewise audit-ID order; validate each derived semantic decision with +the same rule used for the judge. + +- [ ] **Step 4: Bind reveal and pull-request provenance** + +~~~python +class PullRequestProofV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + repository_id: int = Field(gt=0) + pr_number: int = Field(gt=0) + actor_account_id: int = Field(gt=0) + actor: str + base_sha: str = Field(pattern="^[0-9a-f]{40}$") + head_sha: str = Field(pattern="^[0-9a-f]{40}$") + merge_commit_sha: str = Field(pattern="^[0-9a-f]{40}$") + merge_actor_account_id: int = Field(gt=0) + merge_actor: str + verification_mode: SignatureVerificationModeV1 + head_signing_fingerprint: str | None + signature_evidence: SignatureEvidenceV1 + changed_paths: tuple[str, ...] + exact_pr_api_record_sha256: str = Field(pattern="^[0-9a-f]{64}$") + pull_request_proof_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class ReviewerRevealV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["audit-reveal-v1"] + campaign_id: str + reviewer_id: str + sample_manifest_sha256: str + commitment_sha256: str + salt_hex: str + labels_byte_length: int = Field(gt=0) + labels_sha256: str + labels: tuple[HumanAuditLabelV1, ...] + reveal_sha256: str + + +class ReviewerChainV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + identity: ReviewerIdentityV1 + commitment: ReviewerCommitmentV1 + commitment_pr: PullRequestProofV1 + reveal: ReviewerRevealV1 + reveal_pr: PullRequestProofV1 + reviewer_chain_proof_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +def verify_reviewer_chain( + chain: ReviewerChainV1, + *, + other_commitment_merge_sha: str, + packet: BlindAuditPacketV1, + expected_reviewer: ReviewerAccountBindingV1, + expected_audit_reviewer_registry_sha256: str, + git_object_database: Path, +) -> None: + """Verify identity, signature, paths, immutable bytes, commitment, order, and coverage.""" +~~~ + +The only changed commitment path is +`benchmarks/audits//commitments/.json`; the reveal PR adds only immutable +files under `benchmarks/audits//reveals//`. Identity registry digest, +numeric GitHub account ID, login, commit-signing verification mode, and optional fingerprint must +exactly equal the corresponding binding in +`provider_evidence.index.audit_reviewer_registry.reviewers`; every +commitment/reveal PR actor must match both that numeric account ID and login. Before accepting either +PR proof, `verify_reviewer_chain` uses its fixed Git object reader over `git_object_database` to +parse commit/tree/parent objects and compute ancestry itself. It verifies exact mode-discriminated +`SignatureEvidenceV1`: captured GitHub verification with `verified=true`, `reason=valid`, numeric +ID/login and null fingerprint, or keyed SSH/OpenPGP verification with the exact registry +fingerprint. No injected ancestry/signature callback, caller-supplied Boolean, GitHub badge text, or +copied fingerprint authorizes the chain. A login +rename is not silently followed: even with the same stable account ID it requires a newly reviewed +registry and input tag. The PR proof also binds the numeric repository ID and merge-actor account +ID/login from the captured API record. Recompute `exact_pr_api_record_sha256` from the canonical +stable GitHub API projection, then compute `pull_request_proof_sha256` with domain +`laconian-audit-pull-request-proof-v1` over every preceding proof field. Both reviewers' commitment +merge SHAs must be ancestors of each +reveal head and reveal merge commit. The original commitment blob hash must remain unchanged. +`reviewer_chain_proof_sha256` uses domain `laconian-audit-reviewer-chain-proof-v1` over every +preceding chain field, so both identity/registry fields and both complete PR proofs are immutable. +Before any identity comparison, both `verify_reviewer_chain` and `verify_audit_chain` class-bound +revalidate the expected two reviewers, regenerate `canonical_reviewer_registry_bytes`, recompute raw +`audit_reviewer_registry_sha256`, and require that value to equal the provider index, every identity, +signoff, and audit attachment. A self-consistent substituted hash without the exact two binding +bytes therefore fails closed. + +- [ ] **Step 5: Seal adjudication without exposing judge labels** + +~~~python +class ConsensusLabelV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + audit_record_id: str + semantic_pass: bool | None + resolution: Literal["reviewer-agreement", "adjudicated", "unresolved"] + rationale: str | None = Field(default=None, max_length=2_000) + + +class AuditAdjudicationCoreV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["audit-adjudication-core-v1"] + campaign_id: str + sample_manifest_sha256: str + reveal_sha256s: tuple[str, str] + consensus: tuple[ConsensusLabelV1, ...] + judge_labels_were_available: Literal[False] = False + adjudication_core_sha256: str + + +class ExactGitHubReviewRecordV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["audit-github-review-record-v1"] + repository_id: int = Field(gt=0) + pr_number: int = Field(gt=0) + review_id: int = Field(gt=0) + actor_account_id: int = Field(gt=0) + actor_login: str + reviewed_head_sha: str = Field(pattern="^[0-9a-f]{40}$") + body: str + state: Literal["APPROVED"] + submitted_at_utc: AwareDatetime + exact_api_record_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class ExactGitHubReviewSignoffV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["audit-adjudication-github-review-v1"] + reviewer_id: str + reviewer_numeric_account_id: int = Field(gt=0) + reviewer_login: str + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + adjudication_core_sha256: str = Field(pattern="^[0-9a-f]{64}$") + repository_id: int = Field(gt=0) + pr_number: int = Field(gt=0) + review_id: int = Field(gt=0) + state: Literal["APPROVED"] + reviewed_head_sha: str = Field(pattern="^[0-9a-f]{40}$") + submitted_at_utc: AwareDatetime + fixed_body_sha256: str = Field(pattern="^[0-9a-f]{64}$") + exact_api_record_sha256: str = Field(pattern="^[0-9a-f]{64}$") + signoff_proof_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +class AuditAdjudicationV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["audit-adjudication-v1"] + core: AuditAdjudicationCoreV1 + signoffs: tuple[ExactGitHubReviewSignoffV1, ExactGitHubReviewSignoffV1] + adjudication_pr: PullRequestProofV1 + adjudication_sha256: str + + +def verify_audit_chain( + *, + identities: tuple[ReviewerIdentityV1, ReviewerIdentityV1], + chains: tuple[ReviewerChainV1, ReviewerChainV1], + adjudication: AuditAdjudicationV1, + packet: BlindAuditPacketV1, + expected_reviewers: tuple[ReviewerAccountBindingV1, ReviewerAccountBindingV1], + expected_audit_reviewer_registry_sha256: str, + git_object_database: Path, + github_review_records: tuple[ExactGitHubReviewRecordV1, ExactGitHubReviewRecordV1], +) -> None: + """Verify reveal chains, core, exact review proofs, final envelope, and append-only PRs.""" +~~~ + +Agreement rows derive consensus without a rationale. Disagreements require either one bounded +rationale and a Boolean consensus or explicit unresolved status with null consensus. Compute +`adjudication_core_sha256` with domain `laconian-audit-adjudication-core-v1` over every preceding core +field before requesting either review. The adjudication PR head contains the exact canonical core +file and both reveal merges in its ancestry. + +Each preregistered reviewer then submits an exact GitHub `APPROVED` review on that same immutable +head. The only permitted body bytes are +`b"laconian-audit-adjudication-core-v1\0" + core_hash_ascii + b"\n"`; bind their SHA-256, exact +repository/PR/review IDs, numeric actor account ID, actor login, reviewed commit, state, submission +time, reviewer-registry digest, and API-record digest in `ExactGitHubReviewSignoffV1`. +The private helper has the exact boundary +`load_exact_github_review(captured_records: tuple[ExactGitHubReviewRecordV1, +ExactGitHubReviewRecordV1], *, repository_id: int, pr_number: int, +review_id: int) -> ExactGitHubReviewRecordV1`. It retrieves the canonical captured record by those +exact numeric IDs, validates `ExactGitHubReviewRecordV1`, recomputes +`exact_api_record_sha256` with domain `laconian-audit-github-review-record-v1` over every preceding +field, and canonical-byte compare every duplicated signoff field. It also recomputes +`fixed_body_sha256` from the record's exact UTF-8 body. No network call, mutable login-only lookup, or +caller-supplied `signature_verified` Boolean is accepted during offline reload. Both distinct +preregistered account IDs/logins must approve the exact core head after both reveals and before the +adjudication PR merges. + +Only after those proofs exist, compute `adjudication_sha256` with domain +`laconian-audit-adjudication-v1` over `core`, both bytewise-reviewer-ordered signoff proofs, and the +adjudication PR proof, excluding only the final hash. Thus neither signoff references the final +envelope digest and no digest cycle exists. A missing, stale, unverified, or wrong-head signoff +rejects the final envelope and blocks `AUDIT_SEALED`; it is never converted into an accepted +adjudicated consensus. Bind numeric repository/PR/review and actor IDs, actor logins, +reviewer-registry digest, base/head/merge SHAs, merge actors, independently verified fingerprints, exact +API-record digests, and file hashes in the verified result. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_audit_commit_reveal.py +uv run ruff check src/laconian_eval/benchmark/audit_commit_reveal.py tests/benchmark/test_audit_commit_reveal.py +uv run mypy src/laconian_eval/benchmark/audit_commit_reveal.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/audit_commit_reveal.py tests/benchmark/helpers.py tests/benchmark/test_audit_commit_reveal.py +git commit -m "feat: verify human-audit commit reveal" +~~~ + +### Task 10: Compute design-weighted audit metrics and model-specific gates + +**Files:** + +- Create: `src/laconian_eval/benchmark/audit_metrics.py` +- Create: `tests/benchmark/test_audit_metrics.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` + +- [ ] **Step 1: Write weight, two-sided Wilson, denominator, and gate tests** + +Create tests named: + +- `test_design_weights_are_one_for_certainty_and_population_over_sample_for_noncertainty` +- `test_hajek_agreement_false_pass_and_false_fail_use_their_exact_denominators` +- `test_two_sided_design_weighted_wilson_matches_frozen_decimal_endpoints_and_z` +- `test_two_sided_wilson_retains_nonzero_uncertainty_after_zero_errors_or_perfect_agreement` +- `test_reported_false_fail_wilson_upper_is_the_only_u_authorized_for_sensitivity` +- `test_empty_stratum_low_effective_n_zero_denominator_or_unresolved_consensus_is_inconclusive` +- `test_binary_percentile_resampling_is_rejected_for_audit_gate_uncertainty` +- `test_weighted_kappa_reports_complete_confusion_without_an_interval` +- `test_model_gate_uses_primary_arm_point_thresholds_available_intervals_and_critical_coverage` +- `test_model_audit_metric_digest_binds_protocols_weights_intervals_and_all_primary_arm_metrics` + +Use `Fraction` assertions for weights and weighted counts. For every Wilson endpoint use fixed +`Decimal` strings at 15 significant digits from an independently frozen hand calculation. The zero- +error fixture asserts `point == lower == 0` and `upper > 0`; the perfect-agreement fixture asserts +`point == upper == 1` and `lower < 1`. Neither test derives its expected endpoint with the production +helper. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_audit_metrics.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.audit_metrics` does not exist. + +- [ ] **Step 3: Reconstruct exact design weights and weighted confusion tables** + +Implement: + +~~~python +class WeightedConfusionV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + pass_pass: RationalV1 + pass_fail: RationalV1 + fail_pass: RationalV1 + fail_fail: RationalV1 + + +class WeightedProportionV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + numerator: RationalV1 + denominator: RationalV1 + point: Decimal | None + effective_n: Decimal | None + lower: Decimal | None + upper: Decimal | None + available: bool + confidence_level: Literal["two-sided-0.95"] = "two-sided-0.95" + z: Decimal + interval_method: Literal["design-weighted-wilson-score-v1"] + authorization_use: Literal["audit-gate", "false-fail-sensitivity", "reported-only"] + unavailable_reasons: tuple[ + Literal[ + "zero_denominator", + "empty_required_stratum", + "effective_sample_size_below_one", + "unresolved_sampled_consensus", + ], + ..., + ] + + @model_validator(mode="after") + def validate_interval_state(self) -> Self: + if self.z != Decimal("1.959963984540054"): + raise ValueError("Wilson z value mismatch") + numeric = (self.point, self.effective_n, self.lower, self.upper) + if self.available: + if any(value is None for value in numeric) or self.unavailable_reasons: + raise ValueError("available Wilson interval is incomplete") + assert self.point is not None and self.effective_n is not None + assert self.lower is not None and self.upper is not None + if not (Decimal(0) <= self.lower <= self.point <= self.upper <= Decimal(1)): + raise ValueError("Wilson interval order/range mismatch") + if self.effective_n < Decimal(1): + raise ValueError("available Wilson interval requires n_eff >= 1") + elif any(value is not None for value in numeric) or not self.unavailable_reasons: + raise ValueError("unavailable Wilson interval state mismatch") + return self + + +class ModelAuditMetricsV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + generation_model: str + protocol_bindings: BenchmarkProtocolBindingsV1 + weights_by_record: Mapping[str, RationalV1] + judge_consensus_confusion: WeightedConfusionV1 + reviewer_confusion: WeightedConfusionV1 + agreement: WeightedProportionV1 + false_pass: WeightedProportionV1 + false_fail_by_primary_arm: Mapping[Literal["if", "concise"], WeightedProportionV1] + reviewer_agreement: WeightedProportionV1 + weighted_kappa: Decimal | None + model_audit_metric_sha256: str = Field(pattern="^[0-9a-f]{64}$") + + +def compute_model_audit_metrics( + *, + model: str, + manifest: AuditSampleManifestV1, + population: Sequence[AuditPopulationRecordV1], + chains: tuple[ReviewerChainV1, ReviewerChainV1], + adjudication: AuditAdjudicationV1, +) -> ModelAuditMetricsV1: + """Join opaque IDs to sealed population only after consensus is immutable, then weight.""" +~~~ + +For a certainty unit use weight 1. For a noncertainty unit in cell h use exact +`w_h = N_h / n_h`, with N_h and n_h excluding certainty units. Compute: + +~~~text +agreement = sum(w * I[judge = consensus]) / sum(w) +false_pass = sum(w * I[judge = pass and consensus = fail]) + / sum(w * I[judge = pass]) +false_fail = sum(w * I[judge = fail and consensus = pass]) + / sum(w * I[judge = fail]) +~~~ + +False-fail point estimates and intervals remain separate for each `(generation model, primary arm)`. +Human-human agreement and kappa use the full design-weighted reviewer confusion table. Compute weighted kappa as +`(p_observed - p_expected) / (1 - p_expected)` and return null when its denominator is zero; it has +no interval. + +Metrics may read consensus only from `adjudication.core.consensus` after +`verify_audit_chain` has independently verified both exact review signoffs and the final envelope. +Neither the unreviewed core alone nor a signoff Boolean is an accepted metrics input. Copy +`protocol_bindings` only from the verified sample/population parent, require its exact singular +`audit_protocol_sha256` and every other field to agree, and compute `model_audit_metric_sha256` with +domain `laconian-model-audit-metric-v1` over every preceding field. + +- [ ] **Step 4: Implement the authorizing two-sided design-weighted Wilson interval** + +For the records in a proportion's denominator, calculate: + +~~~text +sum_w = sum(w) +n_eff = sum(w)^2 / sum(w^2) +p = weighted_numerator / sum_w +z = 1.959963984540054 +center = (p + z^2 / (2*n_eff)) / (1 + z^2/n_eff) +half = z/(1 + z^2/n_eff) * sqrt(p*(1-p)/n_eff + z^2/(4*n_eff^2)) +interval = [max(0, center-half), min(1, center+half)] +~~~ + +Use a fixed high-precision local `decimal.Context`; never convert weights through binary floats. +An empty required stratum, `n_eff < 1`, zero denominator, or unresolved consensus makes the affected +measure unavailable with the corresponding closed reason. Every available interval is labeled +`design-weighted-wilson-score-v1`, `two-sided-0.95`, and the exact frozen z value. It is the sole +authorizing audit-uncertainty construction: agreement and false-pass use +`authorization_use="audit-gate"`; each primary-arm false-fail proportion uses +`authorization_use="false-fail-sensitivity"`; reviewer agreement uses `reported-only`. + +The confirmatory gate still applies the preregistered point-estimate thresholds, but it cannot pass +unless the corresponding two-sided Wilson intervals are available. For sensitivity, define +`U_{m,a}` as the reported upper endpoint of that same model/arm two-sided Wilson interval. No +alternate interval inversion, familywise adjustment, delete-one/jackknife bound, normal approximation, +or binary percentile resampling may authorize the gate, supply U, set K, prune the sensitivity +search, or alter an outcome. Tests inspect the implementation call graph to prove there is exactly +one audit-interval constructor and that only its stored upper endpoint flows to Task 11. + +- [ ] **Step 5: Encode the confirmatory gate per generation model** + +~~~python +class ModelAuditGateV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + generation_model: str + agreement_interval_available: bool + false_pass_interval_available: bool + agreement_at_least_90_percent: bool + false_pass_at_most_5_percent: bool + no_unresolved_disagreement: bool + critical_primary_coverage_complete: bool + no_critical_primary_false_pass: bool + passed: bool + reasons: tuple[str, ...] + + +def evaluate_model_audit_gate( + *, + metrics: ModelAuditMetricsV1, + manifest: AuditSampleManifestV1, + population: Sequence[AuditPopulationRecordV1], + adjudication: AuditAdjudicationV1, +) -> ModelAuditGateV1: + """Use only this model's if/concise strata and retain every failed reason.""" +~~~ + +The point-estimate gate is `agreement >= 0.90`, `false_pass <= 0.05`, both authorizing two-sided +Wilson intervals available, no unresolved reviewer +disagreement, 100% coverage of judge-pass primary-arm critical `safety-medical` records, and no +false pass on either preregistered critical warning. Baseline, Caveman, other models, and +campaign-wide aggregates are exploratory and cannot rescue the gate. `passed` is the conjunction of +all seven Boolean fields; retain every false condition as a closed reason. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_audit_metrics.py +uv run ruff check src/laconian_eval/benchmark/audit_metrics.py tests/benchmark/test_audit_metrics.py +uv run mypy src/laconian_eval/benchmark/audit_metrics.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/audit_metrics.py tests/benchmark/test_audit_metrics.py +git commit -m "feat: compute weighted human-audit metrics" +~~~ + +### Task 11: Enumerate bounded model/arm false-fail assignments exactly + +**Files:** + +- Create: `src/laconian_eval/benchmark/sensitivity.py` +- Create: `tests/benchmark/test_sensitivity_direct.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write M/D/U/K and direct-enumeration tests** + +Create tests named: + +- `test_false_fail_limits_use_model_arm_m_d_u_and_closed_k_formula` +- `test_false_fail_limit_uses_authorizing_two_sided_design_weighted_wilson_upper` +- `test_both_primary_arm_limits_require_the_same_model_audit_metric_digest` +- `test_known_false_fails_are_forced_and_every_other_judge_fail_row_is_optional` +- `test_zero_judge_fail_rows_produce_k_zero_without_an_interval` +- `test_unestimable_upper_bound_makes_model_sensitivity_inconclusive` +- `test_assignment_count_matches_literal_product_of_binomial_sums` +- `test_decimal_wilson_upper_at_k_boundary_is_ceiled_without_binary_float_rounding` +- `test_direct_enumeration_matches_literal_four_extrema_and_assignment_hashes` +- `test_each_assignment_recomputes_s_eligibility_and_both_bootstrap_intervals` +- `test_assignment_space_above_4096_refuses_direct_enumeration` +- `test_nonexhausted_sensitivity_result_forbids_an_exhaustion_reason` + +The golden direct fixture must make a reclassified `if` row create a newly eligible token pair and +make a reclassified `concise` row change semantic quality in the opposite direction. Freeze all +four expected endpoints and their attaining assignment digests as literals. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_sensitivity_direct.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.sensitivity` does not exist. + +- [ ] **Step 3: Implement exact per-model/per-arm limits** + +~~~python +class FalseFailCandidateV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + response_id: str + generation_model: str + arm: Literal["if", "concise"] + scenario_uid: str + planned_key: str + known_false_fail: bool + + +class FalseFailLimitV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + generation_model: str + arm: Literal["if", "concise"] + m_all_judge_fail: int = Field(ge=0, le=120) + d_known_false_fail: int = Field(ge=0, le=120) + optional_candidates: int = Field(ge=0, le=120) + upper_false_fail: Decimal | None + model_audit_metric_sha256: str = Field(pattern="^[0-9a-f]{64}$") + k_max_reclassified: int = Field(ge=0, le=120) + estimable: bool + + +def derive_false_fail_limit( + *, + model: str, + arm: Literal["if", "concise"], + candidates: Sequence[FalseFailCandidateV1], + metrics: ModelAuditMetricsV1, +) -> FalseFailLimitV1: + """Select this arm's authorizing Wilson upper from one metric record and derive M/D/K.""" +~~~ + +Use: + +~~~text +M = count(all judge-fail rows for this model and arm) +D = count(audited judge-fail rows whose immutable consensus is pass) +optional_candidates = M - D = count(all remaining judge-fail rows) +if M = 0: K = 0 and estimable = true +if M > 0 and the two-sided design-weighted Wilson interval is unavailable: estimable = false +otherwise: U = metrics.false_fail_by_primary_arm[arm].upper and + K = min(M, max(D, ceil(U * M))) +~~~ + +`derive_false_fail_limit` first class-bound revalidates `metrics`, requires its model, selects the +requested arm's `authorization_use="false-fail-sensitivity"` proportion, and copies +`model_audit_metric_sha256` into the limit. Derive both primary-arm limits from the same metrics +object; sensitivity input validation rejects different metric digests even when each limit is +otherwise internally valid. Use `Decimal` ceiling under the same fixed high-precision context as +Task 10 and never round U through binary float. + +Every `known_false_fail=True` row is mandatory in every assignment. Every one of the other `M-D` +judge-fail rows is an optional reclassification candidate—including an audited consensus-fail row— +exactly matching the frozen assignment formula below. A sampled unresolved record makes the model inconclusive before candidate +construction. Reject `optional_candidates != M-D`, `K < D`, U outside `[0, 1]`, duplicate or missing candidate rows, +different metric digests, an interval with any other authorization use/method, or any candidate not +backed by an H=1 judge-fail row. + +- [ ] **Step 4: Count and enumerate the feasible product space** + +Compute exactly for each model: + +~~~text +A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a}) +~~~ + +Implement that literal product in production and in an independent golden test with Python integers; +do not substitute a count over a differently filtered candidate pool. Direct enumeration is +permitted only when `A_m <= 4096`. For each arm, order its `M-D` optional candidates by UTF-8 +response ID, enumerate total reclassified cardinality `j` ascending, and enumerate combinations in +lexicographic index order for `if`, followed by `concise`. Prefix the D forced IDs before the selected +optional IDs. The assignment digest is the domain digest of canonical sorted reclassified IDs, the +forced/optional partition, and both limits. + +- [ ] **Step 5: Recompute and retain all four extrema** + +~~~python +class SensitivityExtremumV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + value: float + assignment_sha256: str + + +SensitivityExhaustionReason = Literal[ + "visited_node_cap", + "bootstrap_evaluation_cap", +] + + +class SensitivityResultV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + generation_model: str + model_audit_metric_sha256: str = Field(pattern="^[0-9a-f]{64}$") + assignment_count: int = Field(ge=0) + visited_nodes: int = Field(ge=0) + evaluated_assignments: int = Field(ge=0) + semantic_min_lower: SensitivityExtremumV1 | None + semantic_max_upper: SensitivityExtremumV1 | None + token_min_lower: SensitivityExtremumV1 | None + token_max_upper: SensitivityExtremumV1 | None + search_exhausted: bool + exhaustion_reason: SensitivityExhaustionReason | None + certificate_sha256: str | None + + @model_validator(mode="after") + def validate_exhaustion_state(self) -> Self: + extrema = ( + self.semantic_min_lower, + self.semantic_max_upper, + self.token_min_lower, + self.token_max_upper, + ) + if self.search_exhausted: + if ( + self.exhaustion_reason is None + or any(extremum is not None for extremum in extrema) + or self.certificate_sha256 is not None + ): + raise ValueError("exhausted search must discard uncertified outputs") + if self.exhaustion_reason == "visited_node_cap" and self.visited_nodes != 1_000_000: + raise ValueError("visited-node exhaustion counter mismatch") + if self.exhaustion_reason == "bootstrap_evaluation_cap" and ( + self.evaluated_assignments != 4_096 or self.visited_nodes >= 1_000_000 + ): + raise ValueError("bootstrap exhaustion counter mismatch") + elif self.exhaustion_reason is not None: + raise ValueError("completed search cannot have exhaustion_reason") + return self + + +def enumerate_sensitivity_exact( + *, + aggregate: AggregatedModelV1, + limits: tuple[FalseFailLimitV1, FalseFailLimitV1], + candidates: Sequence[FalseFailCandidateV1], + vectors: NDArray[np.uint8], +) -> SensitivityResultV1: + """Enumerate every feasible assignment when A_m is at most 4096.""" +~~~ + +Both limit entries must be in exact `(if, concise)` order, match the aggregate model, and carry one +identical nonblank `model_audit_metric_sha256`; copy that digest into `SensitivityResultV1`. Direct +enumeration, certified search, certificate verification, analysis loading, and reporting all reject +a mixed-metric pair even when both individual arm limits are otherwise internally valid. + +For each assignment set `S=1` on mandatory and selected false-fail rows, leave H unchanged, and +recompute the semantic paired rate-difference interval, semantic eligibility, token-pair +eligibility, and visible-token interval with the same frozen 10,000 vectors. Retain minimum +semantic lower, maximum semantic upper, minimum token lower, and maximum token upper. If a token +interval is unavailable for any feasible assignment, the corresponding directional extremum is +unavailable; do not drop the assignment. + +Direct enumeration always returns `search_exhausted=False`, `exhaustion_reason=None`, and +`certificate_sha256=None`; its literal extrema tests must assert all three fields as well as the +four endpoint values. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_sensitivity_direct.py +uv run ruff check src/laconian_eval/benchmark/sensitivity.py tests/benchmark/test_sensitivity_direct.py +uv run mypy src/laconian_eval/benchmark/sensitivity.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/sensitivity.py tests/benchmark/helpers.py tests/benchmark/test_sensitivity_direct.py +git commit -m "feat: enumerate exact false-fail sensitivity" +~~~ + +### Task 12: Add verifier-checked exact branch-and-bound certificates + +**Files:** + +- Modify: `src/laconian_eval/benchmark/sensitivity.py` +- Create: `tests/benchmark/test_sensitivity_certificate.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write proof-partition, soundness, and deterministic-cap tests** + +Create tests named: + +- `test_certificate_verifies_cardinality_pruned_subtrees_and_every_feasible_leaf` +- `test_certificate_rejects_missing_overlapping_or_wrong_cardinality_subtree` +- `test_v1_schema_rejects_semantic_or_token_dominance_pruning` +- `test_certificate_rejects_wrong_leaf_extremum_or_bootstrap_vector_digest` +- `test_certificate_digest_precedes_result_reference_without_a_hash_cycle` +- `test_direct_and_certified_search_return_identical_extrema_on_overlap_space` +- `test_m_equals_k_120_exhausts_at_exact_caps_and_discards_partial_extrema` +- `test_each_search_cap_emits_its_closed_reason_and_no_certificate` +- `test_sensitivity_result_rejects_unknown_or_inconsistent_exhaustion_reason` + +The cap fixtures use `M=K=120` and `D=0` for both arms, so each literal optional pool has `M-D=120` +and the independent formula oracle yields `A_m = 2^240`; they set the operation caps to the normative values and +exercise each guard independently. Assert exactly 1,000,000 visited nodes with +`exhaustion_reason="visited_node_cap"` or exactly 4,096 evaluated leaves with +`exhaustion_reason="bootstrap_evaluation_cap"`, `search_exhausted=True`, a null certificate, and +all four published extrema null even when an incumbent was found earlier. Unknown reasons, a reason +when `search_exhausted=False`, a reason inconsistent with its exact cap counter, or any +extremum/certificate on an exhausted result must fail model validation. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_sensitivity_certificate.py +~~~ + +Expected: tests fail because the certificate schemas and branch-and-bound entry point are absent. + +- [ ] **Step 3: Implement the frozen traversal, counters, and certificate schemas** + +~~~python +MAX_VISITED_NODES = 1_000_000 +MAX_BOOTSTRAP_LEAVES = 4_096 + + +class PrunedSubtreeV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + prefix_bits: str = Field(pattern="^[01]*$") + selected_by_arm: Mapping[Literal["if", "concise"], int] + remaining_by_arm: Mapping[Literal["if", "concise"], int] + assignment_count: int = Field(gt=0) + reason: Literal["cardinality-infeasible"] + + +class EvaluatedLeafV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + assignment_sha256: str + selected_response_ids: tuple[str, ...] + semantic_lower: float | None + semantic_upper: float | None + token_lower: float | None + token_upper: float | None + + +class SensitivityCertificateV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["sensitivity-certificate-v1"] + generation_model: str + model_audit_metric_sha256: str = Field(pattern="^[0-9a-f]{64}$") + candidate_order: tuple[str, ...] + limits: tuple[FalseFailLimitV1, FalseFailLimitV1] + bootstrap_vectors_sha256: str + visited_nodes: int = Field(ge=0, le=1_000_000) + evaluated_leaves: tuple[EvaluatedLeafV1, ...] + pruned_subtrees: tuple[PrunedSubtreeV1, ...] + semantic_min_lower: SensitivityExtremumV1 | None + semantic_max_upper: SensitivityExtremumV1 | None + token_min_lower: SensitivityExtremumV1 | None + token_max_upper: SensitivityExtremumV1 | None + certificate_sha256: str +~~~ + +Traverse optional candidates in UTF-8 response-ID order with a deterministic depth-first tree, +exclude child before include child. Count the root and every entered prefix as one visited node; +count a complete feasible assignment immediately before running its 10,000-vector evaluation. +Cardinality-infeasible nodes do not consume a leaf evaluation. + +On a complete partition, compute the four certificate extrema first and hash the certificate with +domain `laconian-sensitivity-certificate-v1`, excluding only `certificate_sha256`. Only then build +`SensitivityResultV1` with those same four extrema and the resulting certificate digest. The +certificate never embeds a result that points back to it, so there is no circular preimage. +Before traversal, require both ordered limits to carry the same model-audit metric digest and copy it +to the certificate; the verifier independently repeats this comparison and requires the returned +result to carry that same digest. + +- [ ] **Step 4: Implement only mechanically exact cardinality pruning in v1** + +For each prefix over the UTF-8-ordered `M-D` optional rows, first prune when an arm already has more +than `K-D` optional selections or cannot complete a cardinality in `0..K-D`. Its subtree assignment +count must use the residual form of the same literal identity +`A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a})`; the certificate +verifier independently recomputes that integer and proves the disjoint evaluated-leaf plus pruned- +subtree counts sum to it exactly. + +Do not implement semantic-bound, token-bound, incumbent, or dominance pruning in v1. The interaction +among reclassification, matched-pair eligibility, medians, missing token intervals, and type-7 +bootstrap endpoints makes a locally plausible token bound insufficient. Every cardinality-feasible +leaf must receive the full 10,000-vector evaluation. `PrunedSubtreeV1` deliberately has no objective +bounds and rejects any reason other than `cardinality-infeasible`; producer and verifier tests must +also reject extra “witness” fields. A future schema version may add dominance only with an exact, +independently replayable witness proving the full endpoint bound and matched-record coupling. Until +then, a space with more than 4,096 feasible leaves necessarily exhausts the bootstrap-evaluation cap +and is inconclusive, which is preferable to an unsound certified extremum. + +- [ ] **Step 5: Implement an independent exact certificate verifier** + +~~~python +def search_sensitivity_exact( + *, + aggregate: AggregatedModelV1, + limits: tuple[FalseFailLimitV1, FalseFailLimitV1], + candidates: Sequence[FalseFailCandidateV1], + vectors: NDArray[np.uint8], +) -> tuple[SensitivityResultV1, SensitivityCertificateV1 | None]: + """Run deterministic certified search when A_m exceeds 4096.""" + + +def verify_sensitivity_certificate( + certificate: SensitivityCertificateV1, + *, + aggregate: AggregatedModelV1, + candidates: Sequence[FalseFailCandidateV1], + vectors: NDArray[np.uint8], +) -> SensitivityResultV1: + """Reconstruct the full tree partition and independently verify every proof and leaf.""" +~~~ + +The verifier recomputes candidate order, forced/optional partitions, limits, vector digest, +cardinality-infeasible subtree counts, every feasible leaf result, disjointness, and exhaustive +coverage of the assignment space. It recomputes extrema solely from verified leaves and compares +canonical bytes. It must not trust counters, accept an objective bound, omit a forced D row, or +permit a selected row outside the exact `M-D` optional pool. + +If either normative cap is reached before an exhaustive verified partition exists, return +`search_exhausted=True`, publish both counters and the closed reason for the guard that prevented +the next logical operation, return no `SensitivityCertificateV1`, and set all four extrema and the +certificate digest to null. Check the visited-node guard before the leaf-evaluation guard so a tie +deterministically reports `visited_node_cap`. Partial incumbents must not enter outcome +classification. A completed certified search returns `exhaustion_reason=None` and a nonnull +certificate whose digest equals the result field. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_sensitivity_direct.py tests/benchmark/test_sensitivity_certificate.py +uv run ruff check src/laconian_eval/benchmark/sensitivity.py tests/benchmark/test_sensitivity_direct.py tests/benchmark/test_sensitivity_certificate.py +uv run mypy src/laconian_eval/benchmark/sensitivity.py +~~~ + +Expected: all commands pass, including the exact-cap fixture. + +~~~bash +git add src/laconian_eval/benchmark/sensitivity.py tests/benchmark/helpers.py tests/benchmark/test_sensitivity_certificate.py +git commit -m "feat: certify bounded false-fail sensitivity" +~~~ + +### Task 13: Seal audit and machine-analysis roots, verified loaders, and the public report + +**Files:** + +- Create: `src/laconian_eval/benchmark/reporting.py` +- Create: `tests/benchmark/test_reporting.py` +- Modify: `src/laconian_eval/benchmark/__init__.py` +- Modify: `tests/benchmark/helpers.py` + +- [ ] **Step 1: Write model-analysis, artifact, loader, and rendering tests** + +Create tests named: + +- `test_report_places_intervals_denominators_missingness_and_direction_adjacent` +- `test_report_labels_bootstrap_target_and_nominal_approximate_twelve_cluster_coverage` +- `test_visible_tokens_are_never_labelled_billed_output_or_cost_savings` +- `test_report_keeps_cache_reads_writes_uncached_input_and_cost_availability_separate` +- `test_report_surfaces_missing_or_forbidden_cache_write_integrity_limitations` +- `test_usage_status_maps_are_closed_complete_and_sum_to_120_per_arm` +- `test_report_discloses_audit_weights_confusion_intervals_and_search_caps` +- `test_report_uses_two_sided_design_weighted_wilson_for_gate_and_false_fail_u` +- `test_report_never_renders_candidate_or_judge_text_as_markdown` +- `test_analysis_writers_are_canonical_failure_atomic_and_no_replace` +- `test_audit_evidence_writer_is_canonical_failure_atomic_no_replace_and_fresh_reloads` +- `test_audit_evidence_writer_emits_exact_allowlist_and_copies_sample_bytes_unchanged` +- `test_analysis_writer_copies_verified_audit_parent_into_combined_result_root` +- `test_verified_audit_loader_recomputes_every_component_and_root_digest` +- `test_verified_audit_loader_recomputes_canonical_github_review_records_offline` +- `test_verified_audit_loader_rejects_missing_extra_or_mismatched_review_record` +- `test_verified_audit_loader_rejects_reviewer_chain_proof_or_account_identity_substitution` +- `test_audit_attachment_directly_binds_all_four_layer_vectors_and_judge_attempt_vector` +- `test_verified_audit_loader_rejects_provider_projection_or_any_of_36_judge_parent_substitutions` +- `test_verified_analysis_loader_rejects_report_bootstrap_or_attachment_substitution` +- `test_verified_analysis_loader_rejects_analysis_only_root_without_bound_audit_tree` +- `test_analysis_builder_and_loader_require_provider_bound_statistical_protocol`. +- `test_analysis_builder_and_loader_require_exact_provider_bound_audit_protocol`. +- `test_bootstrap_artifact_builder_derives_seed_from_provider_evidence_and_round_trips_c_order_bytes`. +- `test_bootstrap_artifact_builder_rejects_shape_range_metadata_or_digest_substitution`. +- `test_bootstrap_artifact_builder_has_no_raw_seed_or_protocol_override`. + +The report fixture contains hostile model and rationale text with HTML, a link, an image, a heading, +a fenced block, and a mention. Assert that the text-only encoder neutralizes every active construct +and that candidate responses and raw judge evidence do not appear at all. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_reporting.py +~~~ + +Expected: collection fails because `laconian_eval.benchmark.reporting` does not exist. + +- [ ] **Step 3: Implement the closed analysis and evidence-root schemas** + +Implement: + +~~~python +class DistributionSummaryV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + unit: Literal[ + "tokens", + "usd", + "milliseconds", + "characters", + ] + observed_count: int = Field(ge=0) + missing_count: int = Field(ge=0) + minimum: Decimal | None + median: Decimal | None + maximum: Decimal | None + + +class BootstrapArtifactV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["bootstrap-artifact-v1"] + metadata: BootstrapVectorsV1 + indices: tuple[tuple[int, ...], ...] = Field(min_length=10_000, max_length=10_000) + bootstrap_artifact_sha256: str + + +class ChecksumEntryV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + relative_path: str + byte_length: int = Field(ge=0) + sha256: str + + +class ChecksumManifestV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["analysis-checksums-v1"] + entries: tuple[ChecksumEntryV1, ...] + checksums_sha256: str + + +class DescriptiveUsageV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + input_tokens: DistributionSummaryV1 + visible_output_tokens: DistributionSummaryV1 + reasoning_tokens: DistributionSummaryV1 + billed_output_tokens: DistributionSummaryV1 + total_tokens: DistributionSummaryV1 + ordinary_uncached_input_tokens: DistributionSummaryV1 + cache_read_tokens: DistributionSummaryV1 + cache_write_tokens: DistributionSummaryV1 + trusted_usage_cost_usd: DistributionSummaryV1 + definitely_rejected_zero_cost_usd: DistributionSummaryV1 + retained_worst_case_exposure_usd: DistributionSummaryV1 + unavailable_cost_count: int = Field(ge=0) + cost_availability_counts: Mapping[CostAvailabilityV1, int] + cache_policy_status_counts: Mapping[CachePolicyStatusV1, int] + latency_ms: DistributionSummaryV1 + output_characters: DistributionSummaryV1 + + +class ModelAnalysisV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + generation_model: str + hard_denominators: PairDenominatorsV1 + semantic_denominators: PairDenominatorsV1 + hard_pass_by_arm: Mapping[ArmName, BootstrapIntervalV1] + semantic_pass_by_arm: Mapping[ArmName, BootstrapIntervalV1] + hard_primary_difference: BootstrapIntervalV1 + semantic_primary_difference: BootstrapIntervalV1 + hard_visible_delta: BootstrapIntervalV1 + semantic_visible_delta: BootstrapIntervalV1 + usage_by_arm: Mapping[ArmName, DescriptiveUsageV1] + audit_metrics: ModelAuditMetricsV1 + audit_gate: ModelAuditGateV1 + false_fail_limits: tuple[FalseFailLimitV1, FalseFailLimitV1] + sensitivity: SensitivityResultV1 + outcome: ModelOutcomeV1 + + +class CampaignAnalysisV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["campaign-analysis-v1"] + campaign_id: str + input_tag_commit: str + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + protocol_bindings: BenchmarkProtocolBindingsV1 + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_projection_root: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + benchmark_provider_evidence_sha256: str + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_hard_score_request_set_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_judge_request_attachment_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + judge_attempt_root_index_sha256: str + ordered_judge_attempt_boundary_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attachment_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + audit_evidence_sha256: str + bootstrap_vectors_sha256: str + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + models: tuple[ModelAnalysisV1, ModelAnalysisV1, ModelAnalysisV1] + limitations: tuple[str, ...] + campaign_analysis_sha256: str + + +class AuditEvidenceAttachmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["verified-audit-evidence-v1"] + campaign_id: str + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + protocol_bindings: BenchmarkProtocolBindingsV1 + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_projection_root: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_evidence_index_sha256: str + benchmark_provider_evidence_sha256: str + judge_attempt_root_index_sha256: str + ordered_generation_capsule_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_hard_score_request_set_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + ordered_judge_request_attachment_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attempt_boundary_sha256s: tuple[str, ...] = Field( + min_length=36, + max_length=36, + ) + ordered_judge_attachment_sha256s: tuple[str, ...] = Field(min_length=36, max_length=36) + population_attachment_sha256: str + sample_manifest_sha256: str + blind_packet_sha256: str + commitment_sha256s: tuple[str, str] + reveal_sha256s: tuple[str, str] + reviewer_chain_proof_sha256s: tuple[str, str] + adjudication_core_sha256: str + signoff_proof_sha256s: tuple[str, str] + exact_github_review_record_sha256s: tuple[str, str] + adjudication_sha256: str + model_audit_metric_sha256s: tuple[str, str, str] + audit_evidence_sha256: str + + +class AnalysisEvidenceAttachmentV1(BaseModel): + model_config = ConfigDict(extra="forbid", frozen=True) + schema_version: Literal["verified-analysis-evidence-v1"] + campaign_id: str + audit_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_reviewer_registry_sha256: str = Field(pattern="^[0-9a-f]{64}$") + protocol_attestations_root: str = Field(pattern="^[0-9a-f]{64}$") + workflow_root: str = Field(pattern="^[0-9a-f]{64}$") + protocol_bindings: BenchmarkProtocolBindingsV1 + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + generation_context_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + provider_projection_root: str = Field(pattern="^[0-9a-f]{64}$") + provider_evidence_index_sha256: str = Field(pattern="^[0-9a-f]{64}$") + benchmark_provider_evidence_sha256: str = Field(pattern="^[0-9a-f]{64}$") + hard_score_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_prompt_sha256: str = Field(pattern="^[0-9a-f]{64}$") + judge_schema_sha256: str = Field(pattern="^[0-9a-f]{64}$") + statistical_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_sampling_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_commit_reveal_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_adjudication_protocol_sha256: str = Field(pattern="^[0-9a-f]{64}$") + audit_evidence_sha256: str + campaign_analysis_sha256: str + bootstrap_artifact_sha256: str + report_sha256: str + checksums_sha256: str + analysis_evidence_sha256: str +~~~ + +Require exactly 36 unique generation capsule hashes, 36 matching hard-score attachment hashes, +36 matching judge-request attachment hashes, 36 matching judge-attempt boundary hashes rooted in +the exact attempt index, 36 matching judge attachment hashes, and exactly +three distinct model analyses sorted by UTF-8 model ID. The campaign analysis digest excludes only +its own digest and uses domain +`laconian-campaign-analysis-v1`. +`analyze_campaign` class-bound revalidates `provider_evidence` and sets +`statistical_protocol_sha256` only from +`provider_evidence.index.statistical_protocol_sha256`; it has no protocol argument or environment +fallback. It likewise sets `audit_protocol_sha256` only from +`provider_evidence.index.audit_protocol_sha256`. Both repeated projection fields and the complete +`protocol_bindings` object must match those index values before analysis. +For every model, require +the limits in exact `(if, concise)` order, each +`limit.model_audit_metric_sha256 == audit_metrics.model_audit_metric_sha256`, and +`sensitivity.model_audit_metric_sha256 == audit_metrics.model_audit_metric_sha256`; neither +reporting nor outcome classification accepts limits derived from another metric record. Recompute +the literal A_m formula from those stored limits and require equality with +`sensitivity.assignment_count` before sealing analysis. + +`AuditEvidenceAttachmentV1.audit_evidence_sha256` uses domain +`laconian-verified-audit-evidence-v1` over every preceding field. Its two reviewer-chain, two +signoff-proof, and two exact API-record digests are ordered by reviewer ID and must +correspond one-to-one; no sequence may be reordered independently. The attachment therefore +directly binds all four ordered 36-parent layer vectors, the attempt root/vector, and transitively +binds both identities and PR proofs, the stored core, signoffs, offline-review records, numeric +accounts, reviewer registry, and final envelope. + +For `CampaignAnalysisV1`, `AuditEvidenceAttachmentV1`, and `AnalysisEvidenceAttachmentV1`, build +`protocol_bindings` only with Task 3's `protocol_bindings_from_context`; class-bound validation +requires its two registry digests, attestation root, every tagged protocol/source root, and +`workflow_root` to byte-equal the verified provider index. This comparison explicitly includes the +singular Runtime-registry-derived `audit_protocol_sha256` without adding it to any attestation subject +inventory. Each final object also repeats and +verifies the expectation digest, context digest, and provider-projection root. Tests mutate any one +binding and recompute every local self digest; the fixed parent comparison must still reject it. + +- [ ] **Step 4: Expose the Slice 4 verified loader boundary** + +Use frozen dataclasses for already-verified aggregates: + +~~~python +@dataclass(frozen=True, slots=True) +class VerifiedAuditEvidenceV1: + attachment: AuditEvidenceAttachmentV1 + population: VerifiedAuditPopulationV1 + manifest: AuditSampleManifestV1 + packet: BlindAuditPacketV1 + reviewer_chains: tuple[ReviewerChainV1, ReviewerChainV1] + github_review_records: tuple[ExactGitHubReviewRecordV1, ExactGitHubReviewRecordV1] + adjudication: AuditAdjudicationV1 + metrics: tuple[ModelAuditMetricsV1, ModelAuditMetricsV1, ModelAuditMetricsV1] + + +@dataclass(frozen=True, slots=True) +class VerifiedAnalysisEvidenceV1: + attachment: AnalysisEvidenceAttachmentV1 + audit: VerifiedAuditEvidenceV1 + analysis: CampaignAnalysisV1 + bootstrap: BootstrapArtifactV1 + report_bytes: bytes + checksums: ChecksumManifestV1 + + +def write_audit_evidence_root( + output_root: Path, + *, + source_sample_root: Path, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + sample: VerifiedAuditSampleRootV1, + reviewer_chains: tuple[ReviewerChainV1, ReviewerChainV1], + github_review_records: tuple[ExactGitHubReviewRecordV1, ExactGitHubReviewRecordV1], + adjudication: AuditAdjudicationV1, + metrics: tuple[ModelAuditMetricsV1, ModelAuditMetricsV1, ModelAuditMetricsV1], + git_object_database: Path, +) -> AuditEvidenceAttachmentV1: + """Verify every audit parent, atomically write the exact audit root, and fresh-reload it.""" + + +def load_verified_audit_evidence( + root: Path, + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAuditEvidenceV1: + """Load root/audit and recompute it against the exact provider-parent projection.""" + + +def load_verified_analysis_evidence( + root: Path, + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, +) -> VerifiedAnalysisEvidenceV1: + """Verify provider parents and audit first, then recompute analysis and artifact hashes.""" +~~~ + +The audit loader reads exactly: + +~~~text +root/audit/audit-evidence.json +root/audit/population-attachment.json +root/audit/population.jsonl +root/audit/sample-manifest.json +root/audit/blind-packet.json +root/audit/commitments/.json +root/audit/reveals//reveal.json +root/audit/reveals//labels.jsonl +root/audit/reviewer-chains/.json +root/audit/adjudication-core.json +root/audit/signoffs/.json +root/audit/github-review-records/.json +root/audit/adjudication.json +root/audit/metrics.json +~~~ + +`write_audit_evidence_root` requires an absent destination and first fresh-loads +`source_sample_root` with `load_verified_audit_sample_root`, requiring canonical equality with the +supplied `sample`. It reruns `verify_audit_chain` using the two supplied exact review records as a +closed numeric-ID lookup and the explicit `git_object_database` path consumed by the fixed Git +object reader and exact mode-discriminated signature verifier; no ancestry/signature callback is +accepted. It then recomputes all three `ModelAuditMetricsV1` values from the immutable +sample/chains/adjudication and canonical-byte compares them with `metrics`. It constructs +`AuditEvidenceAttachmentV1` itself—there is no caller-supplied attachment or digest override. + +The writer stages only beneath an operation-owned empty sibling, copies the four sample files byte +for byte, writes every remaining member in the exact allowlist above from the verified models, +fsyncs all files/directories, and installs the root without replacement. It then calls +`load_verified_audit_evidence(output_root, provider_evidence=provider_evidence)`, requires every +returned component and digest to equal the inputs/constructed attachment, and returns that freshly +loaded attachment. On failure it deletes only its validated staging tree and leaves the destination +absent. The loader rejects the offline CLI report, partial sample-only roots, extras, aliases, and +any population/reviewer/record/metric/provider substitution. Thus Publication's live seal wrapper +has an exact neutral writer/loader boundary and never needs a CLI implementation detail. + +The analysis loader additionally reads exactly: + +~~~text +root/analysis/analysis-evidence.json +root/analysis/analysis.json +root/analysis/bootstrap.json +root/analysis/report.md +root/analysis/checksums.json +~~~ + +The audit loader first calls +`load_verified_audit_population(root / "audit", provider_evidence=provider_evidence)`, requires its +attachment hash to equal `AuditEvidenceAttachmentV1.population_attachment_sha256`, requires the +attachment provider-index digest, benchmark-provider digest, reviewer-registry digest, all four +36-parent layer vectors, and the judge-attempt root/vector to equal +`provider_evidence.index`/`provider_evidence.projection`, and replays +sampling from its exact records. The analysis loader +passes the same required projection through to the audit loader and additionally requires +`CampaignAnalysisV1.benchmark_provider_evidence_sha256 == +provider_evidence.projection.benchmark_provider_evidence_sha256`, its input-tag commit to match +`provider_evidence.index.input_tag_commit`, its `statistical_protocol_sha256` to equal both +`provider_evidence.index.statistical_protocol_sha256` and the repeated projection field, its +`audit_protocol_sha256` to equal both `provider_evidence.index.audit_protocol_sha256` and the +repeated projection field, and all four campaign-analysis layer-parent vectors plus +the judge-attempt root/vector to match. +Reject symlinks, non-regular +files, duplicate reviewer paths, unexpected members, extra JSON fields, noncanonical JSON or JSONL, +checksum mismatch, any campaign/root disagreement, and any component not reachable from the +attachment root. Export both verified types and both loaders from +`laconian_eval.benchmark.reporting`, plus `write_audit_evidence_root`, +`write_analysis_evidence_root`, `BootstrapArtifactV1`, `build_bootstrap_artifact`, and both +attachment types, and re-export those exact owners from +`laconian_eval.benchmark` for the Slice 4 collector. + +The audit allowlist requires exactly two canonical reviewer-chain proof files that byte-compare their +embedded commitment/reveal fields and labels against the dedicated files, exactly one canonical +`adjudication-core.json`, two distinct bytewise-reviewer-ordered signoff files, and two distinct canonical review records named by their +decimal positive review IDs; aliases, leading-zero IDs, duplicate IDs/inodes, extra records, and +signoff/filename disagreement are errors. Reload each review record first, recompute its domain +digest solely from the stable stored API fields, require its account ID/login and +the signoff's `audit_reviewer_registry_sha256` to match the exact +`provider_evidence.index.audit_reviewer_registry.reviewers` binding and the digest freshly computed from +`canonical_reviewer_registry_bytes(provider_evidence.index.audit_reviewer_registry.reviewers)`, then require the signoff's +`exact_api_record_sha256` and duplicated fields to match. Finally recompute the core digest, both +signoff-proof digests, and the final adjudication envelope, and require the core, ordered signoffs, +ordered reviewer-chain proofs/API-record digests, final envelope, provider roots, and reviewer registry to equal +`AuditEvidenceAttachmentV1`. It never accepts a cached `signature_verified` or review-state Boolean +in place of the exact provenance records. + +- [ ] **Step 5: Render analysis artifacts without reinterpreting evidence** + +Implement: + +~~~python +def build_bootstrap_artifact( + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + scenario_uids: Sequence[str], +) -> BootstrapArtifactV1: + """Derive the frozen seed, vectors, matrix, and artifact digest from verified parents.""" + + +def analyze_campaign( + *, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + aggregates: Sequence[AggregatedModelV1], + hard_sets: Sequence[HardScoreRequestSetV1], + judge_attachments: Sequence[JudgeAttachmentV1], + audit: VerifiedAuditEvidenceV1, + vectors: BootstrapArtifactV1, +) -> CampaignAnalysisV1: + """Derive outcomes with analysis protocol only from the verified provider projection.""" + + +def render_public_report(analysis: CampaignAnalysisV1) -> bytes: + """Render deterministic UTF-8 Markdown from sealed numeric fields and fixed prose only.""" + + +def write_analysis_evidence_root( + output_root: Path, + *, + source_audit_root: Path, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + audit: VerifiedAuditEvidenceV1, + analysis: CampaignAnalysisV1, + bootstrap: BootstrapArtifactV1, +) -> AnalysisEvidenceAttachmentV1: + """Atomically write one combined root containing the verified audit and new analysis.""" +~~~ + +`build_bootstrap_artifact` class-bound revalidates `provider_evidence`, derives +`seed = derive_seed128("laconian-bootstrap-v1", campaign_seed, input_tag_commit, +judge_protocol_sha256)` solely from its index, and calls `make_cluster_vectors` with exactly the 12 +bytewise-sorted scenario UIDs from the verified generation parents. It serializes exactly 10,000 +rows of 12 integer values in `[0, 11]`, requires their tuple values to equal the returned contiguous +`uint8` matrix, and copies the metadata whose `indices_sha256` already binds seed, ordered UIDs, +dtype, shape, and canonical C-order bytes. `bootstrap_artifact_sha256` is raw SHA-256 over +`UTF8("laconian-bootstrap-artifact-v1") || NUL || canonical_json(metadata) || NUL || +indices_uint8.tobytes(order="C")`. The builder has no raw seed, protocol, matrix, or digest argument. +Loaders reconstruct the exact matrix from the JSON integers, reject non-10,000-by-12 shape or values +outside `[0, 11]`, recompute both metadata and artifact digests, and never regenerate a missing +matrix. The independently authority-bound `statistical_protocol_sha256` selects/authorizes this +frozen analysis method through `CampaignAnalysisV1`; the preregistered judge-protocol seed input +remains the Task 2 public randomization contract. + +Place point, two-sided 95% interval, fixed denominator 120, scenario coverage, eligible pairs, +token pairs, and missingness in one table row. State the direction +`visible tokens(concise) - visible tokens(if)` next to every primary estimate and phrase any claim +as “among jointly successful matched responses.” Keep input, visible output, reasoning output, +billed output, total, uncached input, cached-read input, cache-write input, reconciled cost by +availability basis, retained worst-case exposure, latency, and characters separate. Never call +cache writes cached reads, infer absent writes as zero, combine retained exposure with trusted-usage +cost, or call visible-token change billed-token, total-token, cost, or unconditional savings. Render +`cache_write_detail_missing` and `forbidden_cache_write_observed` as operational-integrity +limitations adjacent to cost availability and the model outcome. +For each arm, every distribution requires `observed_count + missing_count == 120`; +`cost_availability_counts` contains exactly all four `CostAvailabilityV1` keys including explicit +zeros, and `cache_policy_status_counts` contains exactly all four `CachePolicyStatusV1` keys. Their +counts each sum to 120. A missing cache-write detail therefore appears simultaneously in the write +distribution's missing count, the closed policy-status count, retained-worst-case exposure, and the +model limitation; no serializer may omit the zero/nonzero map entry or collapse it into +cached/uncached input. + +Beside every bootstrap interval, state that the target is scenario-superpopulation variation +conditional on this fixed campaign and that nominal 95% percentile coverage is approximate with 12 +clusters. The report must expressly deny generalization to new models, provider versions, prompts, +domains, or time periods; a bare “95% CI” label is forbidden. + +Report audit cells, exact weights, weighted confusion tables, authorizing two-sided design-weighted +Wilson intervals, reviewer +agreement, kappa without an interval, critical-record coverage, model-specific gates, M/D/U/K by +primary arm, assignment-space size, visited/evaluated counters, certificate digest, cap values, the +closed search-exhaustion reason (or null), all four extrema, outcome reasons, and limitations. Label +each interval `design-weighted-wilson-score-v1`, `two-sided-0.95`, and +`z = 1.959963984540054`. Beside each sensitivity U, report that it is that model/arm interval's upper +endpoint, its `n_eff`, the exact Decimal-derived K, the shared model-audit metric digest, and any +closed unavailability reasons; no alternate bound may set K. Present baseline and Caveman +only as exploratory context. Report each model outcome independently +and, if counting supported models descriptively, link the statement to all three rows. + +The limitations section states that certificate schema v1 permits cardinality pruning only and +deliberately disables semantic/token dominance pruning. Consequently, any feasible assignment space +above 4,096 reaches the evaluation cap and is inconclusive unless a future, separately versioned +exact witness scheme is approved. + +Canonical JSON files end with one newline. `bootstrap.json` contains vector metadata plus the +10,000 by 12 integer matrix and is hash-bound to its C-order bytes. Before writing, +`write_analysis_evidence_root` calls +`load_verified_audit_evidence(source_audit_root, provider_evidence=provider_evidence)` and requires +canonical equality with `audit`. It also calls `build_bootstrap_artifact` on the 12 scenario UIDs +from the verified provider parents, canonical-byte compares the result with `bootstrap`, and +requires `analysis.statistical_protocol_sha256` to equal the provider index and projection statistics +protocol and `analysis.audit_protocol_sha256` to equal the provider index and projection singular +audit protocol before accepting either object. It stages an absent `output_root`, copies that loader's exact +allowlisted `source_audit_root/audit` tree byte for byte to `output_root/audit`, and writes the five +analysis members under `output_root/analysis`. No reference or symlink back to the source is +permitted. Build `analysis/checksums.json` over the other analysis artifacts, then bind it in +`analysis/analysis-evidence.json` without a digest cycle by excluding `analysis-evidence.json` from +that checksum manifest. Fsync every file and directory, install the combined root with exclusive +no-replace operations, and verify the fresh installed root through +`load_verified_analysis_evidence(output_root, provider_evidence=provider_evidence)`. On any error +remove only the newly created staging directory and leave the destination absent. + +- [ ] **Step 6: Run GREEN and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_reporting.py +uv run ruff check src/laconian_eval/benchmark/reporting.py tests/benchmark/test_reporting.py +uv run mypy src/laconian_eval/benchmark/reporting.py +~~~ + +Expected: all commands pass. + +~~~bash +git add src/laconian_eval/benchmark/__init__.py src/laconian_eval/benchmark/reporting.py tests/benchmark/helpers.py tests/benchmark/test_reporting.py +git commit -m "feat: seal benchmark analysis and reports" +~~~ + +### Task 14: Prove the complete analysis on a 36-capsule synthetic campaign + +**Files:** + +- Modify: `tests/benchmark/helpers.py` +- Create: `tests/benchmark/test_synthetic_analysis.py` +- Modify: `benchmarks/methodology.md` +- Modify: `evals/README.md` +- Modify: `tests/test_public_contract.py` + +- [ ] **Step 1: Write exactly fifteen failing end-to-end analysis tests** + +Create tests named: + +- `test_synthetic_campaign_reconstructs_analysis_from_36_bound_attachments` +- `test_synthetic_negative_inconclusive_and_supported_models_remain_separate` +- `test_synthetic_artifacts_are_byte_identical_across_two_fresh_roots` +- `test_synthetic_analysis_loaders_fail_closed_on_each_parent_hash_substitution` +- `test_synthetic_audit_reload_recomputes_core_review_records_signoffs_and_final_envelope` +- `test_synthetic_sample_and_audit_atomic_writers_fresh_reload_exact_roots` +- `test_synthetic_two_sided_wilson_false_fail_upper_sets_k_and_keeps_zero_error_uncertainty_positive` +- `test_synthetic_attestations_accept_null_github_and_keyed_fingerprints_by_mode` +- `test_synthetic_security_attestation_requires_nonnull_keyed_fingerprint` +- `test_synthetic_attestations_reject_cross_role_reorder_extra_missing_or_duplicate_subject` +- `test_synthetic_attestations_reject_extra_top_level_field_or_signature_mode_mismatch` +- `test_synthetic_protocol_review_constructs_exact_t0_c0_rstat_rjudge_rsecurity_b0_t1_dag` +- `test_synthetic_protocol_review_reconstructs_all_raw_objects_and_receipts_without_network` +- `test_synthetic_protocol_review_rejects_every_canonical_json_git_header_tree_delta_signature_ruleset_creation_suite_and_cross_campaign_negative` +- `test_synthetic_every_downstream_attachment_binds_campaign_registry_tag_binding_attestation_workflow_and_archive_closure_roots` + +Do not add the helper yet. The first test's literal expectations require identical authority-tagged +`statistical_protocol_sha256` and singular `audit_protocol_sha256` across context, provider index, +projection, nested protocol bindings, audit evidence, analysis, and final analysis evidence. It also +pins the exact assignment-count formula, the shared per-model audit-metric digest in both arm limits, +all four sensitivity extrema or one closed exhaustion reason, and every count/root described in +Step 3 below. The other fourteen tests cover independent outcomes, deterministic bytes, parent +substitution, full audit re-verification, atomic writers, Wilson-to-K propagation, and the four +attestation mode/inventory failures named above. + +- [ ] **Step 2: Run the complete synthetic tests RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_synthetic_analysis.py +~~~ + +Expected: tests fail because the complete synthetic campaign builder and artifact reconstruction +are not implemented. + +- [ ] **Step 3: Implement the deterministic 36-capsule fixture** + +Only after recording RED, add `build_synthetic_public_campaign()` to +`tests/benchmark/helpers.py`. It creates: + +~~~text +3 generation models +x 12 scenario capsules per model +x 2 locales per scenario +x 4 arms per locale +x 5 repetitions per arm += 36 verified capsules and 1,440 planned terminal rows +~~~ + +Every synthetic capsule carries a non-null SealV1 hash and verified ScoredAttemptV2 projection. +Derive 36 hard-score request sets, 36 judge-request attachments, 36 judge-attempt-boundary files and +their `JudgeAttemptRootIndexV1`, and 36 judge attachments, including one explicit empty boundary and +sealed zero-call attachment. Provider-ready request/attempt fixtures use literal +`service_tier=default`; include one definite pre-response 429 retry with +`service_tier_status=not_applicable_definitely_rejected` and one rejected nondefault-tier attempt +that retains worst-case exposure and cannot seal. Build accepted attachments only from +`load_verified_judge_attempt_root`. + +Build a complete provider-offline synthetic `TagOperatorRegistryV1`, two-entry +`TagRulesetPolicyV1`, 15-member `WorkflowInventoryV1`, T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 raw Git +closure, unique T0/T1 creation suites, stable REST/GraphQL/local signature projections/receipts, +three statements/envelopes, bundle, post-tag binding, and `ProtocolReviewObjectArchiveV1`. Reimport +the archive without network and require byte-identical objects, OIDs, raw SHA-256 values, projections, +roots, and campaign identity. The fixed C0 input-package blob includes the exact ordered three +broker-signing public-key records and exact token-delivery-isolation policy bytes required by the +approved amendment. Evaluation freezes those canonical bytes and their subject digests as a golden +Git-object fixture but defines no campaign-side schema; Runtime's cumulative contract test rebuilds +the same bytes from its sole-owner `BrokerSigningKeyV1` and +`BrokerTokenDeliveryIsolationPolicyV1` types and requires byte equality. The `security_evidence` +statement contains the exact fourteen-kind tuple from +`PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1`, including the branch-ruleset policy, +token-delivery-isolation policy, and broker-signing-key root in their approved positions; deleting, +reordering, duplicating, or restoring the former eleven-kind tuple fails even after recomputing all +outer digests. Then build a fixed synthetic `GenerationContextExpectationV1`, authority wrapper, +`GenerationContextIndexV1`, and `ProviderEvidenceIndexV1` with independently fixed plaintext +seed/input commit; the exact two audit reviewers and recomputed registry digest; the separate exact +three-role protocol reviewer registry; allowed null GitHub and exact keyed fingerprints; the three +exact `VerifiedProtocolAttestationV1` records with unchanged role subject inventories; their shared +`workflow_root`; exact authority-tagged statistics and singular audit protocol hashes; expectation, +context, four layer-index, and attempt-root digests; and the provider projection/wrapper. Propagate +the same `audit_protocol_sha256` through every nested `BenchmarkProtocolBindingsV1` and every final +top-level field specified in Task 13. + +Then build the complete audit population/JSONL; deterministic sample round-tripped through +`write_audit_sample_root` and `load_verified_audit_sample_root`; two distinct reviewer chains; +independently hashed adjudication core; two canonical exact GitHub review records with stable numeric +account IDs; two signoff proofs; final adjudication envelope; per-model metrics with authorizing two- +sided design-weighted Wilson intervals; Decimal-derived U and K; exact candidate spaces satisfying +`A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a})`; frozen bootstrap +artifact; sensitivity results; three model analyses; and the combined audit-plus-analysis result +root. The helper never instantiates a provider, reads credentials, accesses the network, uses wall- +clock time, or derives a test expectation from implementation output. + +Shape outcomes deliberately: one model has a verified hard or semantic negative-quality interval, +one is inconclusive through a declared audit or sensitivity gate, and one is supported with strict +positive brevity and non-inferior quality. Assert those outcomes by literal exact model ID. + +- [ ] **Step 4: Run the fifteen tests GREEN** + +Run after implementing the helper and exact assertions: + +~~~bash +uv run pytest -q tests/benchmark/test_protocol_review.py tests/benchmark/test_synthetic_analysis.py +~~~ + +Expected: all fifteen named tests pass without network access or environment secrets. + +- [ ] **Step 5: Replace the public no-interval limitation with the frozen contract** + +Update `benchmarks/methodology.md` to state all of these normative facts in its confidence-interval, +quality-gate, audit, and outcome sections: + +- visible output equals provider output minus reasoning output; all other usage measures remain + separate, including uncached input, cached reads, cache writes, and cost availability/retained + worst-case exposure; +- H and S use 120 planned keys per model/arm, with terminal zero reasons separated from inference- + invalid missing or ambiguous evidence; +- every provider-ready judge request binds the exact API pair `"service_tier": "default"`; returned + tier and its closed `service_tier_status` are captured per attempt using the exact + Foundation vocabulary `reported_default`, `not_applicable_definitely_not_sent`, + `not_applicable_definitely_rejected`, `missing`, and `mismatch`; a definite pre-response rejection + with no response/usage records + `not_applicable_definitely_rejected` and remains retryable, while + response-received or unknown-delivery missing/nondefault tier stops without entering judge + evidence and retains worst-case spend exposure; +- eligible pairs and token pairs are separate and require at least 96 pairs and 10 scenarios; +- 10,000 NumPy PCG64 scenario-cluster replicates, 12 sampled scenarios, type-7 0.025/0.975 + quantiles, at least 9,990 valid replicates, the fixed-campaign conditional scenario target, and + nominal approximate coverage with only 12 clusters; +- five-point hard and sensitivity-adjusted semantic non-inferiority; +- analysis and bootstrap use only the authority-tagged `statistical_protocol_sha256`, while audit + evidence also requires the singular Runtime-registry-derived `audit_protocol_sha256`; both are + carried identically by generation context, provider index/projection, nested protocol bindings, + campaign analysis, and final evidence; +- exact 144-record sampling, certainty critical records, Hamilton allocation, two-person + commit-reveal, design weights, authorizing two-sided design-weighted Wilson intervals with + `z = 1.959963984540054`, model-specific point-estimate audit gates, each primary arm's Wilson upper + endpoint as U, the exact `K = min(M, max(D, ceil(U * M)))` Decimal calculation, the literal + assignment count `A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a})`, + and bounded exact false-fail certificates; +- the strict outcome precedence and the phrase “among jointly successful matched responses.” +- Runtime's three live methods are exactly + `laconian_eval.campaign.runtime.Runtime.hard_score`, + `laconian_eval.campaign.runtime.Runtime.prepare_judge`, and + `laconian_eval.campaign.runtime.Runtime.seal_judge`, reachable only from the private + `_reconstruct_verified_runtime` constructor; they receive an in-memory verified + generation-context expectation and call the neutral Task 3/4/8 library boundaries directly; +- Publication's four later live methods are exactly + `Publication.campaign.evaluation_stage.sample_audit`, + `Publication.campaign.evaluation_stage.seal_audit`, + `Publication.campaign.evaluation_stage.analyze`, and + `Publication.campaign.evaluation_stage.verify`, reachable only from the private + `_reconstruct_verified_publication` constructor; `analyze` and `verify` remain separate; +- all seven standalone benchmark commands are offline and non-evidentiary, use the one canonical + expectation file, and accept no raw expected-digest flag. + +Update `evals/README.md` so the published-results section names sealed generation evidence, all 36 +hard-score request sets, all 36 judge-request attachments, all 36 judge attachments, +the campaign-neutral `JudgeAttemptEvidenceV1`/`JudgeAttemptRootIndexV1` verification handoff, +`LayerRootIndexV1`, `GenerationContextExpectationV1`, `GenerationContextIndexV1`, +`ProviderEvidenceIndexV1`, the distinct +`reviewers.yaml` and `protocol-reviewers.yaml` identity registries plus +`ProtocolReviewerRegistryV1`, `population-attachment.json`, +`population.jsonl`, the neutral `write_audit_sample_root` and `write_audit_evidence_root` +boundaries, the remaining audit root, bootstrap output, +`BootstrapArtifactV1`/`build_bootstrap_artifact`, +`reviewer-chains/`, `adjudication-core.json`, both `signoffs/` and `github-review-records/`, machine analysis, +human-readable report, and immutable checksums as derived layers. Keep fixtures +explicitly non-evidentiary. State that all seven `laconian-benchmark` commands are offline +validation only. Name the exact Runtime and Publication method tuple above, the two private +constructors, and the separate `analyze` and `verify` operations; neither live module imports the +CLI. State +that all three verified protocol-attestation envelopes, the generation context, +provider index, and benchmark projection carry the same verified +`workflow_root`, while `laconian_eval.benchmark.protocol_review` alone owns the exact 15-member +`WorkflowInventoryV1` schema and Runtime only verifies/consumes its sealed root. +Also state that `statistical_protocol_sha256` and the singular `audit_protocol_sha256` are authority- +bound through context/provider evidence and are the only accepted statistics/audit protocol values; +the singular audit digest does not alter the approved granular attestation subject inventories. + +- [ ] **Step 6: Add an exact public-contract regression test** + +Add this test to `tests/test_public_contract.py`: + +~~~python +def test_methodology_freezes_public_cluster_bootstrap_and_audit_contract() -> None: + methodology = _read("benchmarks/methodology.md") + required = ( + "visible_output_tokens = output_tokens - reasoning_tokens", + "cache_write_tokens", + "retained_worst_case", + "sum(H) / 120", + "sum(S) / 120", + '"service_tier": "default"', + "service_tier_status", + "not_applicable_definitely_not_sent", + "not_applicable_definitely_rejected", + "missing", + "mismatch", + "reported_default", + "statistical_protocol_sha256", + "audit_protocol_sha256", + "10,000", + "Generator(PCG64)", + "type-7", + "9,990", + "scenario-superpopulation-conditional-on-fixed-campaign", + "nominal 95% approximate", + "144", + "Hamilton", + "commit-reveal", + "n_eff = sum(w)^2 / sum(w^2)", + "z = 1.959963984540054", + "design-weighted-wilson-score-v1", + "K = min(M, max(D, ceil(U * M)))", + "A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a})", + "1,000,000", + "4,096", + "among jointly successful matched responses", + "offline and non-evidentiary", + "in-memory verified generation-context expectation", + "Runtime.hard_score", + "Runtime.prepare_judge", + "Runtime.seal_judge", + "Publication.campaign.evaluation_stage.sample_audit", + "Publication.campaign.evaluation_stage.seal_audit", + "Publication.campaign.evaluation_stage.analyze", + "Publication.campaign.evaluation_stage.verify", + "_reconstruct_verified_runtime", + "_reconstruct_verified_publication", + ) + for phrase in required: + assert phrase in methodology + + eval_readme = _read("evals/README.md") + for phrase in ( + "LayerRootIndexV1", + "GenerationContextExpectationV1", + "GenerationContextIndexV1", + "workflow_root", + "statistical_protocol_sha256", + "audit_protocol_sha256", + "JudgeAttemptEvidenceV1", + "JudgeAttemptRootIndexV1", + "ProviderEvidenceIndexV1", + "write_audit_sample_root", + "write_audit_evidence_root", + "BootstrapArtifactV1", + "build_bootstrap_artifact", + "ProtocolReviewerRegistryV1", + "reviewers.yaml", + "protocol-reviewers.yaml", + "HardScoreRequestSetV1", + "JudgeAttachmentV1", + "audit-evidence.json", + "adjudication-core.json", + "github-review-records", + "analysis-evidence.json", + "bootstrap.json", + "checksums.json", + ): + assert phrase in eval_readme +~~~ + +- [ ] **Step 7: Run the Slice 2 suite and public-contract test** + +Run: + +~~~bash +uv run pytest -q tests/benchmark tests/test_public_contract.py::test_methodology_freezes_public_cluster_bootstrap_and_audit_contract +uv run ruff check src/laconian_eval/benchmark tests/benchmark tests/test_public_contract.py +uv run mypy src/laconian_eval/benchmark +~~~ + +Expected: every command passes. + +~~~bash +git add tests/benchmark/helpers.py tests/benchmark/test_synthetic_analysis.py benchmarks/methodology.md evals/README.md tests/test_public_contract.py +git commit -m "test: prove synthetic benchmark analysis" +~~~ + +### Task 15: Expose seven fixed content-free offline validation commands + +**Files:** + +- Modify: `src/laconian_eval/cli.py` +- Create: `src/laconian_eval/replay/__init__.py` +- Create: `src/laconian_eval/replay/benchmark.py` +- Create: `tests/benchmark/test_cli.py` +- Modify: `pyproject.toml` +- Modify: `tests/test_public_contract.py` + +This task depends on Tasks 1–14. It adds no workflow, network client, provider dispatch, GitHub API +call, publication mutation, or authority-bearing adapter. Every `laconian-benchmark` command is a +strictly offline, non-evidentiary structural-validation surface. None constructs a +`VerifiedGenerationContextExpectationV1`, calls an evidence writer, returns a verified authority +capability, or creates an artifact that a live loader may accept. Runtime Task 7 owns the first +three campaign-side live functions and depends on neutral Tasks 3/4/8, never Task 15. Publication +Task 7 later creates the `Publication` capability and +`Publication.campaign.evaluation_stage` contract after Evaluation Task 13, and calls the neutral +Task 8/9/10/13 provider, sample-root, audit-root, and analysis-root APIs directly. Neither live +module imports or invokes this Task 15 CLI. Task 15 records the exact live tuple only as a literal +cross-slice contract; it neither imports nor fabricates those future modules as proof. + +- [ ] **Step 1: Write the exact parser and console-safety tests** + +Create tests named: + +- `test_help_lists_exact_seven_commands_and_no_abbreviated_command_is_accepted` +- `test_cli_main_signature_is_exactly_main_argv_program_none_and_preserves_legacy_dispatch` +- `test_help_lists_offline_replay_only_and_never_names_live_callables` +- `test_every_option_rejects_abbreviation_and_every_command_rejects_unknown_options` +- `test_all_seven_commands_require_one_canonical_generation_expectation_path` +- `test_no_command_accepts_seed_commit_source_protocol_workflow_or_any_digest_flag` +- `test_all_seven_commands_emit_only_closed_offline_non_evidentiary_kinds` +- `test_first_six_commands_write_only_one_offline_validation_report_and_no_evidence_tree` +- `test_verify_is_read_only_and_emits_only_an_offline_verification_envelope` +- `test_offline_validation_reports_are_rejected_by_every_live_complete_root_loader` +- `test_cli_source_has_no_live_hook_campaign_import_verified_loader_builder_or_evidence_writer_call` +- `test_cli_cannot_construct_or_import_verified_generation_context_expectation` +- `test_offline_hard_score_detects_context_code_protocol_member_or_workflow_root_substitution` +- `test_offline_prepare_judge_checks_default_tier_context_and_all_36_hard_score_parents` +- `test_offline_seal_judge_checks_36_attempt_boundaries_retry_lineage_and_tier_statuses` +- `test_offline_sample_audit_checks_provider_projection_and_all_parent_vectors_without_sampling` +- `test_offline_seal_audit_checks_population_core_signoffs_and_exact_review_records` +- `test_offline_analyze_checks_audit_and_statistical_protocol_inputs_without_running_analysis` +- `test_offline_verify_checks_all_four_layer_vectors_and_attempt_root` +- `test_commands_are_input_read_only_output_no_replace_and_failure_atomic` +- `test_every_error_is_canonical_content_free_json_without_path_model_prompt_or_label_text` + +Create those tests in `tests/benchmark/test_cli.py`. Also add the cumulative test +`test_public_benchmark_slice2_exports_and_exact_seven_commands_are_owned` to +`tests/test_public_contract.py`. In that file define, as literal tuples rather than values derived +from the implementation, `EXPECTED_BENCHMARK_SLICE2_EXPORTS` containing every public name in Step 6 +in that exact order and `EXPECTED_BENCHMARK_COMMANDS` equal to: + +~~~python +EXPECTED_BENCHMARK_COMMANDS = ( + "hard-score", + "prepare-judge", + "seal-judge", + "sample-audit", + "seal-audit", + "analyze", + "verify", +) +~~~ + +All tests invoke only `laconian_eval.cli.main(argv, program=None)` with the benchmark program +selector, assert that positional/keyword compatibility exactly, and prove the existing legacy +dispatcher remains byte-compatible. The first six commands may write exactly one quarantined +`offline-non-evidentiary.json`; `verify` is read-only. Tests assert no command writes a +layer index, provider index, audit root, analysis root, or any live schema, and that every live +complete-root loader rejects the offline report. Task 3/4/8/13 tests remain the owners of real +artifact production and verification, with Tasks 9–13 owning the review, metric, certificate, +audit, and analysis layers; Task 15 does not duplicate those live paths. + +Task 15 proves only the offline modules and call graph that exist in this slice. Runtime Task 7 and +Publication Tasks 7–8 own and test the real live modules after they exist; no fake future-module +fixture or import is accepted as proof here. + +The cumulative test imports `laconian_eval.benchmark`, asserts its `__all__` is exactly +`EXPECTED_BENCHMARK_SLICE2_EXPORTS` with no missing, extra, or reordered name, imports +`laconian_eval.replay.benchmark.build_parser` explicitly, extracts the root parser's subparser choices, +and asserts their tuple is exactly `EXPECTED_BENCHMARK_COMMANDS`. It additionally asserts `cli` and +`main` are absent from the package `__all__`, importing the package did not import the CLI module, +and a static scan finds no `laconian_eval.campaign` import anywhere below +`src/laconian_eval/replay`. + +Parametrize every command with a symlink input, non-regular input, wrong campaign parent, malformed +canonical JSON, injected candidate canary, injected model-ID canary, and injected exception canary; +parametrize commands 1–6 additionally with an existing output root. Snapshot input bytes and file +metadata before and after every success and failure, and prove command 7 never creates an output. +The CLI tests also import representative library boundaries without initializing the CLI. The +cumulative public-contract test, not a duplicated implementation-derived list in this file, owns +the exact complete export set and exact seven-command surface. + +- [ ] **Step 2: Run RED** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_cli.py::test_help_lists_exact_seven_commands_and_no_abbreviated_command_is_accepted +uv run pytest -q tests/test_public_contract.py::test_public_benchmark_slice2_exports_and_exact_seven_commands_are_owned +~~~ + +Expected: the first command fails because the existing dispatcher has no benchmark replay parser, +and the second fails because the exact Slice 2 export/command contract is not implemented. + +- [ ] **Step 3: Add the exact console entry point and non-abbreviating parser** + +Add to `pyproject.toml` under `[project.scripts]`: + +~~~toml +laconian-benchmark = "laconian_eval.cli:main" +~~~ + +Implement: + +~~~python +EXIT_OK = 0 +EXIT_USAGE = 2 +EXIT_VERIFICATION = 3 +EXIT_OUTPUT_EXISTS = 4 +EXIT_SOFTWARE = 70 + + +# src/laconian_eval/replay/benchmark.py +def build_parser() -> argparse.ArgumentParser: + """Return the fixed parser with allow_abbrev=False on root and every subparser.""" + + +# src/laconian_eval/cli.py +def main( + argv: Sequence[str] | None = None, + *, + program: str | None = None, +) -> int: + """Preserve legacy dispatch; select replay.build_parser only for laconian-benchmark.""" + + +class OfflineValidationReportV1(BaseModel): + model_config = ConfigDict(strict=True, extra="forbid", frozen=True) + schema_version: Literal["benchmark-offline-validation-report-v1"] + command: Literal[ + "hard-score", + "prepare-judge", + "seal-judge", + "sample-audit", + "seal-audit", + "analyze", + "verify", + ] + artifact_kind: Literal[ + "offline-hard-score-validation", + "offline-prepare-judge-validation", + "offline-seal-judge-validation", + "offline-sample-audit-validation", + "offline-seal-audit-validation", + "offline-analyze-validation", + "offline-verify-validation", + ] + generation_context_expectation_sha256: str = Field(pattern="^[0-9a-f]{64}$") + ordered_input_sha256s: tuple[str, ...] + status: Literal["structurally-valid-not-authorized"] + offline_report_sha256: str = Field(pattern="^[0-9a-f]{64}$") +~~~ + +`main` computes `effective_program = program or Path(sys.argv[0]).name`. Exact +`laconian-benchmark` selects the replay parser; exact `laconian` delegates to the existing +`entrypoint`/legacy parser. Any other program name is a content-free usage error. Tests call `main` +with the explicit program selector and also invoke both installed console scripts, so direct imports +and existing monkeypatches keep a compatible `entrypoint` owner. + +Use `ArgumentParser(allow_abbrev=False, add_help=True)` for the root and pass +`allow_abbrev=False` to every subparser. Override parser error handling so usage failures never +echo supplied values or paths. Subcommand prefixes and option prefixes are errors; there are no +aliases, environment-derived paths, positional paths, free-form model IDs, shell strings, command +strings, or arbitrary reason text. +The exact help description for every command begins +`OFFLINE NON-EVIDENTIARY VALIDATION ONLY; replay validates structure but cannot authorize live execution`. +Thus no standalone surface can be mistaken for a release-authorizing path. + +`main` canonical-parses the one expectation file, recomputes its self digest, and uses the contained +identities only to check the declared artifacts' internal graph. Possession of those bytes does not +verify the predecessor or final authority roots. The CLI must not import +`VerifiedGenerationContextExpectationV1`, create a verified wrapper, or call an authority-bearing +loader with caller-derived expected digests. + +Commands 1–6 write only one canonical `OUTPUT/offline-non-evidentiary.json` report containing the +closed command kind, the expectation self digest, sorted input digests, fixed status +`structurally-valid-not-authorized`, and its own self digest. The report is a private CLI schema, is +not package-exported, and is rejected by every layer/provider/audit/analysis loader. Command 7 +writes no file and emits the same closed information in the content-free stdout envelope. Offline +validation uses only strict raw-schema parsing, canonical-byte hashing, and integrity-relation +checks. It never invokes a `load_verified_*` function, evidence builder, sampling/analysis builder, +or evidentiary attachment/root writer. Static AST tests reject those calls and reject construction +of every `Verified*` capability. No raw expected-context, expectation, predecessor, +final-authority, source/protocol, workflow, registry, or evidence-root digest option exists. + +Require the command-to-kind mapping above exactly, validate every input digest as 64 lowercase +hexadecimal characters, bytewise-sort `ordered_input_sha256s`, and compute +`offline_report_sha256` with domain +`laconian-benchmark-offline-validation-report-v1` over every preceding field. The type is private to +`replay.benchmark` and must be absent from package `__all__`. + +- [ ] **Step 4: Freeze the seven commands and their complete option sets** + +The help order and accepted invocations are exactly: + +~~~text +laconian-benchmark hard-score --generation-expectation GENERATION_EXPECTATION --generation-index GENERATION_INDEX --generation-root GENERATION --output-root OUTPUT +laconian-benchmark prepare-judge --generation-expectation GENERATION_EXPECTATION --generation-index GENERATION_INDEX --generation-root GENERATION --hard-score-root HARD --output-root OUTPUT +laconian-benchmark seal-judge --generation-expectation GENERATION_EXPECTATION --generation-index GENERATION_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS --judge-attempt-root ATTEMPTS --output-root OUTPUT +laconian-benchmark sample-audit --generation-expectation GENERATION_EXPECTATION --provider-index PROVIDER_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS --judge-root JUDGES --output-root OUTPUT +laconian-benchmark seal-audit --generation-expectation GENERATION_EXPECTATION --provider-index PROVIDER_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS --judge-root JUDGES --review-root REVIEWS --repository-root REPOSITORY --output-root OUTPUT +laconian-benchmark analyze --generation-expectation GENERATION_EXPECTATION --provider-index PROVIDER_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS --judge-root JUDGES --audit-root AUDIT --output-root OUTPUT +laconian-benchmark verify --generation-expectation GENERATION_EXPECTATION --provider-index PROVIDER_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS --judge-root JUDGES --result-root RESULT +~~~ + +Root meanings are exact: `GENERATION_EXPECTATION`, required by all seven commands, names only the +canonical adapter-produced file at +`GENERATION_COMPLETE/generation-context-expectation.json` inside the read-only reconstructed +authority package. The standalone CLI verifies its canonical bytes/self digest and uses it only for +non-evidentiary structural validation; path possession does not prove the predecessor/final +authority binding. `GENERATION_INDEX`, required by commands 1 through 3, is the one canonical +`GenerationContextIndexV1` file at +`GENERATION/generation-context.json`, emitted by the Slice 3 runtime Task 7 adapter at +`GENERATION_COMPLETE`; the CLI checks the declared layout but cannot authorize it as that retained +child. +`PROVIDER_INDEX` is the one canonical +`ProviderEvidenceIndexV1` file at `JUDGES/provider-evidence-index.json`, emitted at +`JUDGE_COMPLETE` after the four roots were sealed; the explicit flag must name that exact child; +`GENERATION` is the Slice 1 sealed generation evidence root; `HARD`, `REQUESTS`, and `JUDGES` are +complete retained live-stage or explicit-fixture evidence roots containing +`hard-score/`, `judge-requests/`, and `judge/` respectively; `ATTEMPTS` is the exact Runtime Task 7 +output root containing only the fixed `judge-attempts/` tree described in Task 4; `AUDIT` is the complete `seal-audit` +output root containing `audit/`; and `RESULT` is the complete `analyze` output root containing both +`audit/` and `analysis/`. Passing an index's parent, a layer subdirectory where a complete root is +required, a copied expectation outside the fixed authority-package layout, or a provider index with +graph identities that disagree with the expectation/root set is an error. Commands do not +probe parent/sibling directories or search for a newest artifact. None accepts a campaign seed, +input-tag commit, expected-context/expectation/authority hash, source/protocol hash, workflow root, +reviewer registry, or evidence vector as a +separate option. + +`OUTPUT` always means an offline-report root; it never means `HARD`, `REQUESTS`, `JUDGES`, `AUDIT`, +or `RESULT`, and no CLI invocation produces an input for a later CLI invocation. Those evidence +roots must already come from Runtime's direct library stages, Publication's direct library stages, +or an explicitly non-evidentiary fixture. Help text states this distinction beside every +`--output-root` option. + +The exact live tuple is frozen here, without importing a future live module: + +~~~python +EXPECTED_LIVE_METHODS = ( + "laconian_eval.campaign.runtime.Runtime.hard_score", + "laconian_eval.campaign.runtime.Runtime.prepare_judge", + "laconian_eval.campaign.runtime.Runtime.seal_judge", + "laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.sample_audit", + "laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.seal_audit", + "laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.analyze", + "laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.verify", +) +EXPECTED_PRIVATE_CONSTRUCTORS = ( + "_reconstruct_verified_runtime", + "_reconstruct_verified_publication", +) +~~~ + +Runtime Task 7 and Publication Tasks 7–8 own the live import/call-graph proof after those modules +exist. This task only asserts that `src/laconian_eval/replay/**` imports no campaign module and +that the seven offline parser choices equal the literal command tuple; a fake module, monkeypatch, +or fixture standing in for either live owner is forbidden. + +Offline command validation responsibilities are fixed: + +1. `hard-score` checks the canonical generation expectation/context pair, generation layer index, + all 36 generation capsule-plus-sidecar parents, hard-scorer code/protocol identities, judge + protocol, workflow root, registries, and attestations by schema and digest only. It derives no + request set and calls no Task 3 builder or verified loader. +2. `prepare-judge` additionally checks all 36 hard-score parents, public seed/input commitment, + judge protocol, and the literal `"service_tier":"default"` wire field stored in context. It + creates no blinded request attachment or provider payload and calls no Task 4 builder. +3. `seal-judge` additionally checks the exact 36-boundary attempt root, including empty boundaries, + request/blind/retry/usage/terminal parentage, and the closed Foundation cache/tier statuses. + It creates no judge attachment, layer root, or provider index and calls no verified attempt or + provider loader. +4. `sample-audit` checks that the explicit provider index projects the same expectation/context, + workflow root, registries, attestations, four ordered 36-parent vectors, and judge-attempt + root/vector by raw schema and digest only. It neither constructs a verified provider projection, + builds a population/sample, nor writes an audit packet, and it never imports + `EvidenceInventoryV1`. +5. `seal-audit` additionally checks the unchanged population/sample bindings, reviewer chains, + Git ancestry/signing evidence, adjudication core, independently recomputable exact GitHub review + records, signoffs, and final envelope as supplied structural evidence. It performs no GitHub + call, invokes no audit builder, and writes no audit tree. +6. `analyze` checks the complete audit tree, provider/audit parent bindings, audit metrics, + the provider-bound statistics and singular audit protocols, the authorizing two-sided Wilson + inputs, Decimal U/K derivation, exact assignment-count/certificate inputs, and + cache-write accounting needed by a later live analysis. It invokes no aggregation, bootstrap, + sensitivity, or analysis builder and writes no result root. +7. `verify` performs the same offline structural checks over `RESULT`, including both + `audit/` and `analysis/`, all four ordered 36-parent layer vectors, and the judge-attempt + root/vector. It also imports `ProtocolReviewObjectArchiveV1` without network, reconstructs every + T0/C0/reviewer/B0/T1 raw Git object, stable projection/receipt and campaign/tag binding, and + rejects any downstream campaign/archive-root mismatch. It is read-only and emits only the + offline stdout envelope. + +Every input path is opened beneath a retained parent descriptor; reject absolute references inside +indexes, parent traversal, symlinks, devices, FIFOs, sockets, duplicate inode aliases, unstable +identity, and unexpected members. Every output root must be absent. Stage under an operation-owned +sibling, fsync files and directories, install without replacement, and clean only the validated +owned staging tree after failure. + +- [ ] **Step 5: Freeze content-free console and exit behavior** + +On success write exactly +`canonical_json({"artifact_count": artifact_count, "artifact_kind": artifact_kind, +"artifact_sha256": offline_artifact_sha256, "command": command_name, "status": "ok"}) + b"\n"` +to stdout and nothing to stderr. Validate `offline_artifact_sha256` as exactly 64 lowercase hexadecimal +characters before serialization. Every command uses count one and exactly one closed kind: +`offline-hard-score-validation`, `offline-prepare-judge-validation`, +`offline-seal-judge-validation`, `offline-sample-audit-validation`, +`offline-seal-audit-validation`, `offline-analyze-validation`, or +`offline-verify-validation`. The CLI has no evidentiary artifact kind. For commands 1–6, +`artifact_sha256` is the freshly reloaded offline report digest; for `verify` it is the +digest of the canonical offline verification envelope. The envelope contains no path, campaign ID, model ID, scenario ID, +prompt, candidate response, judge output, human label, rationale, token count, or exception text. + +On failure write nothing to stdout and exactly one canonical JSON line to stderr: + +~~~json +{"code":"verification-failed","command":"seal-audit","status":"error"} +~~~ + +The closed codes are `usage` with exit 2, `verification-failed` with exit 3, +`output-exists` with exit 4, and `software-error` with exit 70. Never include the caught exception +or supplied argument in console output. Static `--help` text may contain only the seven command +names, fixed option names, and fixed descriptions; it exits zero and creates no file. + +- [ ] **Step 6: Finalize public imports** + +Export these Slice 2 boundaries from `laconian_eval.benchmark` without importing `cli`: + +~~~text +CanonicalJSONV1Error, canonical_json_v1, parse_canonical_json_v1, +RationalV1, attachment_digest, write_attachment_json, derive_seed128, +HardScoreRequestSetV1, build_hard_score_request_set, verify_hard_score_request_set, +JUDGE_REQUESTED_SERVICE_TIER, JUDGE_SERVICE_TIER_WIRE_FIELD, +BlindJudgeRequestV1, JudgeProviderRequestV1, JudgeRequestAttachmentV1, JudgeAttemptUsageV1, +JudgeAttemptEvidenceV1, JudgeAttemptBoundaryV1, JudgeAttemptRootMemberV1, +JudgeAttemptRootIndexV1, VerifiedJudgeAttemptRootV1, +write_judge_attempt_root, load_verified_judge_attempt_root, +JudgeAttachmentV1, build_judge_request_attachment, verify_judge_request_attachment, +build_judge_attachment, verify_judge_attachment, +AggregatedModelV1, aggregate_verified_evidence, +BootstrapVectorsV1, BootstrapIntervalV1, make_cluster_vectors, +BootstrapArtifactV1, build_bootstrap_artifact, +LayerKindV1, GenerationLayerRootMemberV1, AttachmentLayerRootMemberV1, +LayerRootMemberV1, LayerRootIndexV1, write_layer_root_index, load_layer_root_index, +SignatureVerificationModeV1, GitHubVerifiedCommitEvidenceV1, +SSHVerifiedCommitEvidenceV1, OpenPGPVerifiedCommitEvidenceV1, +SignatureEvidenceV1, ProtocolReviewRoleV1, ProtocolSubjectKindV1, +PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1, +ReviewerAccountBindingV1, AuditReviewerRegistryV1, +ProtocolReviewerBindingV1, ProtocolReviewerRegistryV1, +TagOperatorProjectionV1, TagOperatorRegistryV1, TagRulesetPolicyV1, +GITHUB_COMMIT_SIGNER_QUERY_V1, GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1, +InputTagMessageV1, ProtocolAttestationTagMessageV1, +ProtocolBundleBuilderGitIdentityV1, TagRulesetObservationReceiptV1, +TagCreationRuleSuiteReceiptV1, ArchivedApiReceiptBindingV1, +WorkflowInventoryV1, BENCHMARK_WORKFLOW_PATHS_V1, build_workflow_inventory, +GitObjectSHA256V1, ParsedProtocolGitObjectV1, VerifiedProtocolReviewPrefixV1, +VerifiedProtocolReviewDagV1, ArchivedApiBlobV1, +parse_protocol_git_object, verify_protocol_review_prefix, verify_protocol_review_dag, +build_protocol_attestation_bundle, build_protocol_attestation_tag_binding, +build_protocol_review_object_archive, load_verified_protocol_review_object_archive, +ProtocolReviewSubjectV1, ProtocolReviewStatementV1, VerifiedProtocolAttestationV1, +GitHubCommitVerificationProjectionV1, GitHubSignatureProjectionV1, +GitHubSignatureObservationReceiptV1, LocalSignatureVerificationReceiptV1, +ProtocolAttestationBundleV1, ProtocolAttestationTagBindingV1, +ProtocolReviewObjectArchiveV1, +canonical_reviewer_registry_bytes, compute_audit_reviewer_registry_sha256, +canonical_protocol_reviewer_registry_bytes, compute_protocol_reviewer_registry_sha256, +protocol_review_digest, compute_protocol_attestations_root, +BenchmarkProtocolBindingsV1, protocol_bindings_from_context, +GenerationContextExpectationV1, VerifiedGenerationContextExpectationV1, +GenerationContextIndexV1, VerifiedGenerationContextIndexV1, +write_generation_context_index, load_verified_generation_context_index, +ProviderEvidenceIndexV1, write_provider_evidence_index, load_provider_evidence_index, +BenchmarkProviderEvidenceProjectionV1, VerifiedBenchmarkProviderEvidenceV1, +load_verified_benchmark_provider_evidence, +AuditPopulationAttachmentV1, VerifiedAuditPopulationV1, VerifiedAuditSampleRootV1, +build_audit_population, write_audit_population, load_verified_audit_population, +AuditSampleManifestV1, BlindAuditPacketV1, select_audit_sample, verify_audit_sample, +write_audit_sample_root, load_verified_audit_sample_root, +ReviewerIdentityV1, PullRequestProofV1, ReviewerCommitmentV1, ReviewerRevealV1, +ReviewerChainV1, verify_reviewer_chain, AuditAdjudicationCoreV1, +ExactGitHubReviewRecordV1, ExactGitHubReviewSignoffV1, AuditAdjudicationV1, verify_audit_chain, +WeightedConfusionV1, WeightedProportionV1, ModelAuditMetricsV1, ModelAuditGateV1, +compute_model_audit_metrics, evaluate_model_audit_gate, +SensitivityResultV1, SensitivityCertificateV1, verify_sensitivity_certificate, +CampaignAnalysisV1, AuditEvidenceAttachmentV1, AnalysisEvidenceAttachmentV1, +VerifiedAuditEvidenceV1, VerifiedAnalysisEvidenceV1, +write_audit_evidence_root, load_verified_audit_evidence, load_verified_analysis_evidence, +write_analysis_evidence_root +~~~ + +Set `laconian_eval.benchmark.__all__` to exactly the ordered names above. This is the sole normative +export tuple copied literally into `EXPECTED_BENCHMARK_SLICE2_EXPORTS`; the test must not calculate +the expectation from `dir()`, annotations, source parsing, or the current `__all__`. +`ServiceTierStatus` remains owned and exported by `laconian_eval.providers`; benchmark +models import that exact type but neither re-export it here nor introduce a benchmark alias. + +The cumulative public-contract test also pins module ownership. Every reviewer/operator/ruleset/ +workflow registry, statement, verified envelope, bundle/tag binding, Git-object projection, +signature projection/receipt, creation-suite receipt, digest helper, and object-archive type/function +must have `__module__ == "laconian_eval.benchmark.protocol_review"`. Concrete layer-root, +`BenchmarkProtocolBindingsV1`, generation-expectation, and generation-context classes/functions must +have `__module__ == "laconian_eval.benchmark.context"`; typing aliases are asserted by object +identity with attributes imported from their sole owner module. Provider index/projection +classes/functions must similarly identify `laconian_eval.benchmark.provider_evidence`. A package +re-export is allowed only from those owners, and neither module may define a shadow copy. +`VerifiedAuditSampleRootV1`, `write_audit_sample_root`, and +`load_verified_audit_sample_root` are owned only by +`laconian_eval.benchmark.audit_sampling`; `AuditEvidenceAttachmentV1`, +`BootstrapArtifactV1`, `build_bootstrap_artifact`, `AnalysisEvidenceAttachmentV1`, +`write_audit_evidence_root`, and the audit/analysis loaders are owned only by +`laconian_eval.benchmark.reporting`. The cumulative public-contract test pins those modules and +rejects shadow definitions. +`CanonicalJSONV1Error`, `canonical_json_v1`, `parse_canonical_json_v1`, `attachment_digest`, and +`write_attachment_json` must be object-identical to their sole definitions in +`laconian_eval.benchmark.attachments`. `ProtocolSubjectKindV1`, the immutable +`PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1`, and all three concrete signature-evidence variants must +be object-identical to their sole definitions in `laconian_eval.benchmark.protocol_review`; the +mapping's exact `security_evidence` tuple has fourteen members in approved order. Runtime and +Publication contract tests import these package exports and reject copied Literals, tuples, +encoders, parsers, or mode variants. + +The console target remains `laconian_eval.cli:main`; `laconian_eval.replay.benchmark` owns only the +offline parser/handlers. The existing `laconian` command continues to route through its legacy +parser/`entrypoint`, while the `laconian-benchmark` program selector routes to the seven replay +handlers. There is no live hook, and the cumulative test asserts no capability-bearing callable is +exported by replay modules or the benchmark package. + +- [ ] **Step 7: Run GREEN, console gates, and commit** + +Run: + +~~~bash +uv run pytest -q tests/benchmark/test_cli.py tests/test_public_contract.py::test_public_benchmark_slice2_exports_and_exact_seven_commands_are_owned +uv run pytest -p no:cacheprovider tests/test_public_contract.py tests/test_package.py -q +uv run laconian-benchmark --help +uv run ruff check src/laconian_eval/cli.py src/laconian_eval/replay tests/benchmark/test_cli.py tests/test_public_contract.py +uv run mypy src/laconian_eval/cli.py src/laconian_eval/replay +~~~ + +Expected: tests and static checks pass; help exits zero and lists exactly the seven commands in the +order above. + +~~~bash +git add pyproject.toml src/laconian_eval/cli.py src/laconian_eval/replay/__init__.py src/laconian_eval/replay/benchmark.py tests/benchmark/test_cli.py tests/test_public_contract.py +git commit -m "feat: expose benchmark evaluation commands" +~~~ + +## Final Slice 2-local verification before handoff + +- [ ] Confirm the Slice 1 prerequisite tests pass first: + +~~~bash +uv run pytest -q tests/capsule/test_seal_models.py tests/capsule/test_finalize.py tests/capsule/test_scorable.py tests/capsule/test_sidecars.py +~~~ + +Expected: all prerequisite tests pass; otherwise stop without constructing benchmark attachments. + +- [ ] Run the complete evaluation and audit suite: + +~~~bash +uv sync --locked +uv run pytest -q tests/benchmark +uv run pytest -q tests/test_public_contract.py tests/test_models.py tests/test_reporting.py +uv run ruff check src tests +uv run mypy src/laconian_eval +uv run pytest -q +~~~ + +Expected: all six commands pass in order. + +- [ ] Re-run the synthetic analysis twice in separate fresh pytest temporary roots and compare + generation-context expectation/wrapper projection, generation-context/provider indexes, the + 36-boundary judge-attempt root, all four layer + indexes, `audit-evidence.json`, both + reviewer-chain proofs, `adjudication-core.json`, both signoffs and exact GitHub review records, + `analysis-evidence.json`, `analysis.json`, `bootstrap.json`, `report.md`, and `checksums.json` + byte-for-byte. + +- [ ] Run Task 15's Slice 2-local literal adapter fixture contracts. Prove they pin the public + generation/provider/attempt-root types, the external expectation parameter, all four exact + campaign-side live boundary names, and the no-`replay.benchmark` dependency without importing + not-yet-implemented Runtime or Publication modules. + +The real Runtime Task 7 and Publication Task 7 adapter/workflow tests are explicitly deferred +cross-slice integration gates, not Slice 2 completion or handoff criteria. The roadmap Milestones +2B and 3 own those checks after the corresponding campaign modules exist; their failure blocks the +synthetic rollout and all live execution, but cannot create a Slice 2 -> Runtime/Publication -> +Slice 2 dependency cycle. + +- [ ] Inspect `git status --short` and `git diff --check`. Expected: only the files named in the + completed task commits are changed, and the whitespace check emits no output. + +- [ ] Record the exact input commit, NumPy version, Python version, test commands, and passing test + counts in the implementation handoff. Do not publish model-performance language from the + synthetic fixture. diff --git a/docs/superpowers/plans/2026-08-30-public-benchmark-foundations.md b/docs/superpowers/plans/2026-08-30-public-benchmark-foundations.md new file mode 100644 index 0000000..3e68602 --- /dev/null +++ b/docs/superpowers/plans/2026-08-30-public-benchmark-foundations.md @@ -0,0 +1,3499 @@ +# Public Benchmark Foundations Slice 1 Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Build the immutable generation foundations required by the approved three-model benchmark: a neutral severity-annotated corpus, exact native-v2 reasoning, verbosity, no-write prompt-cache, and literal default-service-tier requests, complete token-usage and returned-tier evidence, conservative standard-tier input bounds, stable parent request identities, 36 scenario shards, public sealing, sealed verification, a verified deterministic scored sidecar, and safely restorable uncompressed checkpoints. + +**Architecture:** Keep authored experiment data, deterministic parent planning, mutable capsule execution, immutable sealing, and checkpoint transport as separate trust boundaries. Parent request identities derive from immutable manifest, cache/tier policy, and request input bounds rather than a random run UUID; each shard captures the complete parent plan plus one hash-bound 40-row projection, while per-attempt and response identities remain bound to the capsule run. Sealing and checkpoint restore reuse one exact capsule-tree policy, descriptor-relative no-follow I/O, canonical JSON, bounded streaming, fsync, and atomic no-replace publication. + +**Tech Stack:** Python 3.11+, Pydantic 2 strict/frozen models, OpenAI Responses API adapter, canonical JSON/JSONL and SHA-256, POSIX descriptor APIs, deterministic USTAR encoding, pytest, Ruff, and mypy. + +--- + +## Execution contract + +- Normative design: [Public Three-Model Benchmark Pipeline Design](../specs/2026-08-30-public-three-model-benchmark-design.md) at full SHA `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`, especially Sections 6.1–6.6, 7.1–7.3, 8, 14.1, and 16. +- Approval metadata: governance-only successor `d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad`, recording the maintainer/user's exact 2026-08-31 approval message `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. Milestone 0 is complete, but implementation starts only after the synchronized five-plan commit is recorded at handoff as `PLAN_BASE_SHA`. A later normative amendment re-blocks every affected task until separately approved. +- Seal grammar: [Laconian v0.1 Generation Capsule Design](../specs/2026-08-24-v0.1-generation-capsule-design.md), especially Sections 14–17. +- Provider cache/usage contract: [OpenAI Responses create reference](https://developers.openai.com/api/reference/cli/resources/responses/methods/create), [prompt-caching guide](https://developers.openai.com/api/docs/guides/prompt-caching), and [GPT-5.6 model guidance](https://developers.openai.com/api/docs/guides/latest-model), frozen into the reviewed manifest rather than fetched during execution. +- Worktree: `/Users/if/PycharmProjects/agent-axiom/laconian/.worktrees/public-benchmark-design`. +- Starting point: the synchronized roadmap plus four slice plans. The handoff records their already-created commit as `PLAN_BASE_SHA` before Task 1; the plan source does not embed its own future commit SHA. Keep implementation on an isolated `codex/` branch or worktree based on that exact commit. +- This slice ends when exact capsule bytes can be prepared as a scenario projection, executed with the approved wire fields, finalized, verified without a lock on transport storage, packed as uncompressed USTAR, restored into a new directory, and fully reverified. +- Protocol-review attestations, paired-tag construction, campaign authority/state, downstream orchestration, analysis, judging, human review, and repository release mechanics remain owned by the other slice plans. Slice 1 implements none of those authorities. It does bind every downstream C0 input it owns: exact code and `uv.lock`, provider/request policy, price evidence, corpus and parent/shard plans, capsule/seal/checkpoint schemas, and their canonical digests. +- No test reads a real credential, opens a network connection, depends on wall-clock sleeps, invokes `tar -xf`, or calls `tarfile.extractall`. +- Every public error added here stores a stable code, renders a constant message, and excludes paths, provider payloads, output text, environment values, and archive member bytes. +- Every mutation uses already-open descriptors, `O_NOFOLLOW`, exclusive creation, explicit fsync, and no-replace publication. A failed operation never overwrites an existing capsule, archive, sidecar, seal, or restored directory. +- Each task follows RED, observed expected failure, minimal GREEN, focused regression, and one commit. Run the final full gate only after all focused commits are green. + +## Slice 1 file boundary + +```text +evals/cases/response-smoke.yaml remove 14 ungrounded sentence caps; freeze warning severities +evals/README.md document neutrality and severity contract +src/laconian_eval/models.py strict semantic-warning severity schema +src/laconian_eval/capsule/schema.py reasoning/verbosity/cache-TTL/service-tier and planning-input scalar types +src/laconian_eval/capsule/manifest_models.py authored/resolved native-v2 generation and five-dimension price settings +src/laconian_eval/capsule/capture.py v1-compatible resolution of the new settings +src/laconian_eval/providers/base.py legacy request plus versioned benchmark request/policy, bounds, and exact evidence +src/laconian_eval/providers/openai.py SDK-3.3.1 exact Responses wire and canonical response-path parsing +src/laconian_eval/providers/replay.py offline applied/read/write/reasoning/tier/model fixture support +src/laconian_eval/providers/__init__.py public benchmark evidence/status exports +src/laconian_eval/capsule/attempts.py canonical applied/read/write/reasoning/tier/model evidence and visible tokens +src/laconian_eval/capsule/execution.py reconstructed benchmark requests and canonical attempt evidence +src/laconian_eval/capsule/planning.py stable parent plan identities and validation +src/laconian_eval/capsule/sharding.py ShardPlanV1 construction, hashing, projection, and coverage +src/laconian_eval/capsule/record_models.py captured parent/shard planning-input records +src/laconian_eval/capsule/prepare.py full-parent and captured-shard capsule preparation +src/laconian_eval/capsule/tree_policy.py shared exact capsule member allowlist +src/laconian_eval/capsule/seal_models.py strict SealV1 schema and deterministic derivation +src/laconian_eval/capsule/finalize.py normalized history and atomic seal publication +src/laconian_eval/capsule/verify.py parent/shard, seal, and lockless sealed verification +src/laconian_eval/capsule/scorable.py deterministic terminal RawAttemptV2 hard-score projection +src/laconian_eval/capsule/sidecars.py seal-bound scored sidecar writer and verified loader +src/laconian_eval/scoring.py shared deterministic hard-check calculation +src/laconian_eval/capsule/filesystem.py descriptor-relative, no-follow, no-replace filesystem helpers +src/laconian_eval/capsule/limits.py bounded archive/member/restore limits +src/laconian_eval/capsule/checkpoint.py deterministic USTAR pack and safe one-pass restore +src/laconian_eval/cli.py public finalize command +tests/test_models.py warning-severity schema tests +tests/test_smoke_cases.py exact corpus neutrality/severity assertions +tests/test_public_contract.py cumulative corpus, provider, and capsule-name contract +tests/capsule_helpers.py complete manifest/usage/plan payload builders +tests/capsule/test_manifest_models.py new generation-setting schema tests +tests/capsule/test_capture.py v1/v2 resolution compatibility +tests/capsule/test_planning.py request hash and stable parent identity tests +tests/test_openai_provider.py exact wire, returned tier, bound, and usage-detail parsing +tests/test_providers.py replay cache-write/reasoning-token/tier compatibility +tests/fixtures/replay-responses.yaml explicit replay cache-write and returned-tier evidence +tests/capsule/test_attempts_v2.py canonical cache-write, tier, and visible-token evidence +tests/capsule/test_execution.py manifest-to-request/attempt tier reconstruction +tests/capsule/test_sharding.py 36-by-40 partition and hostile-plan tests +tests/capsule/test_prepare.py captured shard preparation tests +tests/capsule/test_verify_prepared.py prepared-capsule descriptor and projection verification +tests/capsule/test_record_models.py planning-input record schema tests +tests/capsule/test_tree_policy.py shared member allowlist tests +tests/capsule/test_seal_models.py strict SealV1 and derivation tests +tests/capsule/test_finalize.py crash-safe/idempotent finalization tests +tests/capsule/test_verify_sealed.py sealed and lockless transport verification +tests/capsule/test_cli_finalize.py stable finalize CLI behavior +tests/capsule/test_scorable.py exact terminal scoring and row-order projection +tests/capsule/test_sidecars.py sealed sidecar binding and verified loading +tests/capsule/test_limits.py bounded archive/member/restore limit tests +tests/capsule/test_checkpoint.py USTAR round-trip and hostile restore tests +pyproject.toml pin OpenAI SDK exactly 3.3.1 +uv.lock lock SDK 3.3.1; preflight later binds the C0 member hash +``` + +`runner.py`, legacy `GenerationRequest`, legacy `RawAttempt`, legacy `TokenUsageModel`, and legacy reports continue to expose their current byte-compatible non-capsule contract. Public benchmark fields live only in `PublicBenchmarkRequestV1` and `PublicBenchmarkRequestPolicyV1`; no new default is added to the shared legacy request. The exact applied-cache/read/write/reasoning/tier/model evidence is preserved by capsule `RawAttemptV2`; no legacy projection may enter the public campaign ledger. + +## Stable interfaces and canonical preimages + +### Corpus severity + +```python +# src/laconian_eval/models.py +WarningSeverity = Literal["material", "critical"] + + +class SemanticRubric(StrictModel): + required_facts: tuple[str, ...] = () + material_warning: str | None = None + material_warning_severity: WarningSeverity | None = None + + @model_validator(mode="after") + def validate_warning_severity(self) -> Self: + if (self.material_warning is None) != (self.material_warning_severity is None): + raise ValueError("material warning and severity must be present together") + return self +``` + +### Generation settings and wire request + +```python +# src/laconian_eval/capsule/schema.py +ReasoningEffort = Literal["low", "medium", "high"] +TextVerbosity = Literal["low", "medium", "high"] +ReasoningMode = Literal["omitted"] +PromptCacheMode = Literal["explicit"] +PromptCacheTTL = Literal["30m"] +ServiceTier = Literal["default"] +PublicBenchmarkModelId = Literal["gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"] + + +# src/laconian_eval/capsule/manifest_models.py +class SourceGenerationSettingsV2(CapsuleModel): + max_output_tokens: StrictMaxOutputTokens = 1024 + temperature: Temperature | None = None + reasoning_effort: ReasoningEffort | None = None + text_verbosity: TextVerbosity | None = None + reasoning_mode: ReasoningMode = "omitted" + prompt_cache_mode: PromptCacheMode = "explicit" + prompt_cache_ttl: PromptCacheTTL = "30m" + service_tier: ServiceTier = "default" + + +class ResolvedGenerationSettingsV2(CapsuleModel): + max_output_tokens: StrictMaxOutputTokens + temperature: Temperature | None + reasoning_effort: ReasoningEffort | None + text_verbosity: TextVerbosity | None + reasoning_mode: ReasoningMode + prompt_cache_mode: PromptCacheMode + prompt_cache_ttl: PromptCacheTTL + service_tier: ServiceTier + + +PriceDimensionV1 = Literal[ + "ordinary_uncached_input_per_million", + "cache_read_input_per_million", + "cache_write_input_per_million", + "visible_output_per_million", + "reasoning_output_per_million", +] + + +class PriceSourceEvidenceV1(CapsuleModel): + dimension: PriceDimensionV1 + source_url: ExactAsciiHttpUrl + effective_date: ExactDate + usd_per_million: NonNegativeFiniteFloat + source_sha256: Sha256 + + +class SourcePriceSnapshotV1(CapsuleModel): + currency: Literal["USD"] = "USD" + effective_date: ExactDate + source_url: ExactAsciiHttpUrl + service_tier: ServiceTier = "default" + ordinary_uncached_input_per_million: NonNegativeFiniteFloat + cache_read_input_per_million: NonNegativeFiniteFloat + cache_write_input_per_million: NonNegativeFiniteFloat + visible_output_per_million: NonNegativeFiniteFloat + reasoning_output_per_million: NonNegativeFiniteFloat + source_evidence: tuple[PriceSourceEvidenceV1, ...] + + +class ResolvedPriceSnapshotV1(CapsuleModel): + currency: Literal["USD"] + effective_date: ExactDate + source_url: ExactAsciiHttpUrl + service_tier: ServiceTier + ordinary_uncached_input_per_million: NonNegativeFiniteFloat + cache_read_input_per_million: NonNegativeFiniteFloat + cache_write_input_per_million: NonNegativeFiniteFloat + visible_output_per_million: NonNegativeFiniteFloat + reasoning_output_per_million: NonNegativeFiniteFloat + source_evidence: tuple[PriceSourceEvidenceV1, ...] + + +# src/laconian_eval/providers/base.py — leave legacy GenerationRequest unchanged. +class PublicBenchmarkRequestPolicyV1(CapsuleModel): + schema_version: Literal["PublicBenchmarkRequestPolicyV1"] + service_tier: ServiceTier + prompt_cache_mode: PromptCacheMode + prompt_cache_ttl: PromptCacheTTL + reasoning_mode: ReasoningMode + input_token_bound_version: Literal["openai-utf8-envelope-v1"] + max_input_tokens: Literal[272000] + + +@dataclass(frozen=True, slots=True) +class PublicBenchmarkRequestV1: + case_id: str + arm: str + repetition: int + requested_model_id: PublicBenchmarkModelId + instructions: str | None + prompt: str + max_output_tokens: int + temperature: float | None + timeout_seconds: float + policy: PublicBenchmarkRequestPolicyV1 + reasoning_effort: ReasoningEffort | None = None + text_verbosity: TextVerbosity | None = None +``` + +All five public price dimensions are required, non-null, and independently sourced; numeric zero is +allowed only when the source explicitly attests it. Compatibility resolution for historical +snapshots stays outside the public validator. The canonical digest binds literal +`service_tier="default"`; `auto`, `flex`, `priority`, `ultrafast`, omission, an unsourced rate, or a +long-context price class is invalid. Runtime reuses these exact field names and does not redefine +the schema. + +Both snapshot validators require `source_evidence` in the literal `PriceDimensionV1` order with no +missing, extra, duplicate, or reordered member. Each `usd_per_million` must exactly equal the +corresponding snapshot field, and `source_sha256` is recomputed from the preceding evidence fields; +a zero rate without its own exact source record is invalid. + +The standard-tier scheduling bound is a frozen, provider-specific conservative upper bound. One +token is reserved per UTF-8 request byte, plus a deliberately large fixed allowance for provider +framing. This is a reservation bound, not a tokenizer estimate: + +```python +# src/laconian_eval/providers/base.py +INPUT_TOKEN_BOUND_VERSION = "openai-utf8-envelope-v1" +OPENAI_RESPONSES_ENVELOPE_TOKEN_ALLOWANCE = 65_536 +OPENAI_STANDARD_TIER_MAX_INPUT_TOKENS = 272_000 + + +def conservative_input_token_bound(*, instruction_utf8_bytes: int, prompt_utf8_bytes: int) -> int: + """Return one-token-per-byte plus the frozen Responses-envelope allowance.""" + if ( + type(instruction_utf8_bytes) is not int + or instruction_utf8_bytes < 0 + or type(prompt_utf8_bytes) is not int + or prompt_utf8_bytes < 0 + ): + raise ValueError("input byte counts must be nonnegative integers") + return instruction_utf8_bytes + prompt_utf8_bytes + OPENAI_RESPONSES_ENVELOPE_TOKEN_ALLOWANCE +``` + +Every public-campaign request must have the value returned by +`conservative_input_token_bound(instruction_utf8_bytes=instruction_utf8_bytes, +prompt_utf8_bytes=prompt_utf8_bytes) <= OPENAI_STANDARD_TIER_MAX_INPUT_TOKENS`; equality is allowed. +The adapter recomputes this from the exact strings before any provider call, while planning stores +the same value in the row used by later spend reservation. A request above the limit is a +`definitely_not_sent` configuration failure. The campaign never relies on automatic truncation or a +long-context price multiplier. + +For the confirmatory request, the adapter sends these exact additional kwargs: + +```python +kwargs["reasoning"] = {"effort": "medium"} +kwargs["text"] = {"verbosity": "medium"} +kwargs["prompt_cache_options"] = {"mode": "explicit", "ttl": "30m"} +kwargs["service_tier"] = "default" +``` + +Before serialization, recursively walk canonical `instructions` and every object in canonical +`input` and reject a `prompt_cache_breakpoint` key at any depth. The adapter never sends +`prompt_cache_key`, deprecated `prompt_cache_retention`, any other cache-control member, +`reasoning_mode`, or a pricing policy; it never omits or sends `service_tier="auto"`, and it never sends `temperature` +when null and continues sending `store=False`. The request-config preimage is: + +```python +{ + "provider_kind": manifest.provider.kind, + "requested_model": manifest.provider.model, + "generation": { + "max_output_tokens": manifest.generation.max_output_tokens, + "temperature": manifest.generation.temperature, + "reasoning_effort": manifest.generation.reasoning_effort, + "text_verbosity": manifest.generation.text_verbosity, + "reasoning_mode": manifest.generation.reasoning_mode, + "prompt_cache_mode": manifest.generation.prompt_cache_mode, + "prompt_cache_ttl": manifest.generation.prompt_cache_ttl, + "service_tier": manifest.generation.service_tier, + }, + "retry": { + "max_transient_retries": manifest.retry.max_transient_retries, + "timeout_seconds": manifest.retry.timeout_seconds, + }, + "instruction_placement": manifest.instruction_placement, + "prompt_cache_options": { + "mode": manifest.generation.prompt_cache_mode, + "ttl": manifest.generation.prompt_cache_ttl, + }, + "service_tier": manifest.generation.service_tier, + "input_token_bound": { + "version": INPUT_TOKEN_BOUND_VERSION, + "envelope_allowance_tokens": OPENAI_RESPONSES_ENVELOPE_TOKEN_ALLOWANCE, + "standard_tier_max_input_tokens": OPENAI_STANDARD_TIER_MAX_INPUT_TOKENS, + }, + "store": False, + "tools": [], +} +``` + +Task 2 pins `openai==3.3.1` in `pyproject.toml`/`uv.lock` and solely owns the pure SDK-contract gate +and its public exports. Runtime invokes that gate with the independently verified C0 `uv.lock` bytes +and tagged member hash before any credential lookup, client construction, or provider access. The +gate proves the installed distribution is exactly `3.3.1`, the complete frozen `openai` lock member +is exact, and the SDK typed request and response models expose every frozen field/path. Task 3 owns +the benchmark-only request/response adapter used only after that precredential gate. Request bytes, +provider kwargs, and captured projection must be byte-equivalent for all frozen request members. + +### Applied-cache, cache-read/write, reasoning, tier, and model evidence + +```python +# src/laconian_eval/providers/base.py +ReasoningTokenAccounting = Literal["reported", "not_reported", "invalid"] +ServiceTierStatus = Literal[ + "reported_default", + "not_applicable_definitely_not_sent", + "not_applicable_definitely_rejected", + "missing", + "mismatch", +] +AppliedCacheControlStatus = Literal[ + "reported_exact", + "not_applicable_definitely_not_sent", + "not_applicable_definitely_rejected", + "missing", + "mismatch", + "invalid", +] +CacheReadStatus = Literal[ + "reported_zero", + "reported_nonzero", + "not_applicable_definitely_not_sent", + "not_applicable_definitely_rejected", + "missing", + "invalid", +] +CacheWriteStatus = Literal[ + "reported_zero", + "reported_nonzero", + "not_applicable_definitely_not_sent", + "not_applicable_definitely_rejected", + "missing", + "invalid", +] + + +@dataclass(frozen=True, slots=True) +class TokenUsage: + input_tokens: int + output_tokens: int + total_tokens: int + cache_read_tokens: int | None = None + cache_write_tokens: int | None = None + reasoning_tokens: int | None = None + reasoning_token_accounting: ReasoningTokenAccounting = "not_reported" + + +# Legacy GenerationResult/ProviderError bytes remain unchanged. The public benchmark adapter +# constructs PublicBenchmarkResponseEvidenceV1 directly from canonical raw Responses bytes. + + +# src/laconian_eval/capsule/attempts.py +class AttemptUsageV2(CapsuleModel): + input_tokens: StrictNonNegativeInt | None + output_tokens: StrictNonNegativeInt | None + total_tokens: StrictNonNegativeInt | None + cache_read_tokens: StrictNonNegativeInt | None + cache_write_tokens: StrictNonNegativeInt | None + ordinary_uncached_input_tokens: StrictNonNegativeInt | None + reasoning_tokens: StrictNonNegativeInt | None + availability: UsageAvailability + source: UsageSource + cache_read_status: CacheReadStatus + cache_write_status: CacheWriteStatus + reasoning_token_accounting: ReasoningTokenAccounting + + +class PublicBenchmarkResponseEvidenceV1(CapsuleModel): + schema_version: Literal["public-benchmark-response-evidence-v1"] + response_id: ProviderMetadataString + raw_response_sha256: Sha256 + usage: AttemptUsageV2 + requested_model_id: PublicBenchmarkModelId + returned_model_id: ProviderMetadataString | None + returned_model_source_sha256: Sha256 + requested_service_tier: ServiceTier + returned_service_tier: ProviderMetadataString | None + service_tier_status: ServiceTierStatus + service_tier_source_sha256: Sha256 + applied_prompt_cache_mode: ProviderMetadataString | None + applied_prompt_cache_ttl: ProviderMetadataString | None + applied_cache_control_status: AppliedCacheControlStatus + applied_cache_control_source_sha256: Sha256 + cache_read_source_sha256: Sha256 + cache_write_source_sha256: Sha256 + usage_source_sha256: Sha256 + reasoning_tokens_source_sha256: Sha256 + + +class PublicBenchmarkProviderErrorEvidenceV1(CapsuleModel): + schema_version: Literal["public-benchmark-provider-error-evidence-v1"] + delivery_certainty: DeliveryCertainty + provider_request_id: ProviderMetadataString | None + response_id: ProviderMetadataString | None + raw_response_sha256: Sha256 | None + usage: AttemptUsageV2 + requested_model_id: PublicBenchmarkModelId + returned_model_id: ProviderMetadataString | None + returned_model_source_sha256: Sha256 + requested_service_tier: ServiceTier + returned_service_tier: ProviderMetadataString | None + service_tier_status: ServiceTierStatus + service_tier_source_sha256: Sha256 + applied_prompt_cache_mode: ProviderMetadataString | None + applied_prompt_cache_ttl: ProviderMetadataString | None + applied_cache_control_status: AppliedCacheControlStatus + applied_cache_control_source_sha256: Sha256 + cache_read_source_sha256: Sha256 + cache_write_source_sha256: Sha256 + usage_source_sha256: Sha256 + reasoning_tokens_source_sha256: Sha256 + structured_status: int | None + error_source_sha256: Sha256 + + +PublicBenchmarkProviderOutcomeV1 = ( + PublicBenchmarkResponseEvidenceV1 | PublicBenchmarkProviderErrorEvidenceV1 +) + + +class PublicBenchmarkProvider(Protocol): + def generate_benchmark( + self, request: PublicBenchmarkRequestV1 + ) -> PublicBenchmarkProviderOutcomeV1: + raise NotImplementedError + + +# Added to NormalizedProviderEvidenceV2 before response_model. +requested_model_id: PublicBenchmarkModelId +returned_model_id: ProviderMetadataString | None +returned_model_source_sha256: Sha256 +requested_service_tier: ServiceTier +returned_service_tier: ProviderMetadataString | None +service_tier_status: ServiceTierStatus +service_tier_source_sha256: Sha256 +applied_prompt_cache_mode: ProviderMetadataString | None +applied_prompt_cache_ttl: ProviderMetadataString | None +applied_cache_control_status: AppliedCacheControlStatus +applied_cache_control_source_sha256: Sha256 +cache_read_source_sha256: Sha256 +cache_write_source_sha256: Sha256 +usage_source_sha256: Sha256 +reasoning_tokens_source_sha256: Sha256 + + +# Appended to RawAttemptV2 immediately after response_model, in the same order. +requested_model_id: PublicBenchmarkModelId +returned_model_id: ProviderMetadataString | None +returned_model_source_sha256: Sha256 +requested_service_tier: ServiceTier +returned_service_tier: ProviderMetadataString | None +service_tier_status: ServiceTierStatus +service_tier_source_sha256: Sha256 +applied_prompt_cache_mode: ProviderMetadataString | None +applied_prompt_cache_ttl: ProviderMetadataString | None +applied_cache_control_status: AppliedCacheControlStatus +applied_cache_control_source_sha256: Sha256 +cache_read_source_sha256: Sha256 +cache_write_source_sha256: Sha256 +usage_source_sha256: Sha256 +reasoning_tokens_source_sha256: Sha256 + + +def visible_output_tokens(usage: AttemptUsageV2) -> int | None: + if usage.output_tokens is None or usage.reasoning_token_accounting != "reported": + return None + if usage.reasoning_tokens is None: + return None + return usage.output_tokens - usage.reasoning_tokens +``` + +The canonical cache/tier/usage raw-response paths are exactly `response.service_tier`, +`response.prompt_cache_options.mode`, `response.prompt_cache_options.ttl`, +`response.usage.input_tokens`, `response.usage.input_tokens_details.cached_tokens`, +`response.usage.input_tokens_details.cache_write_tokens`, `response.usage.output_tokens`, +`response.usage.output_tokens_details.reasoning_tokens`, and `response.usage.total_tokens`. That +nine-member list is exact. Returned-model evidence is a separate field read only from the exact +`response.model` path; it does not extend or alias the canonical nine-member accounting list. +Alternate, flattened, inferred, billing, or convenience paths are rejected. Each field retains an +independent raw-response source digest even when sanitization yields null. + +For a Responses result, exact zero/positive read and write counts independently map to +`reported_zero`/`reported_nonzero`; absence maps to `missing`; wrong type, negative/bound/total +failure, or source-digest failure maps to `invalid`. Proven no-dispatch and definite rejection with +no result or usage map to their exact `not_applicable_*` status. Applied mode/TTL maps to +`reported_exact` only for literal `explicit`/`30m`; otherwise it maps to `missing`, `mismatch`, or +`invalid`. A conforming no-cache response is exactly +`reported_exact/reported_zero/reported_zero`. Valid counts require each and their sum to be at most +`input_tokens`, and set `ordinary_uncached_input_tokens = input_tokens - cache_read_tokens - +cache_write_tokens`. Nonzero read/write or any missing/mismatch/invalid evidence retains the +affected conservative exposure and causes Runtime to STOP after durable accounting. + +Every attempt also carries literal `requested_service_tier="default"`, sanitized +`returned_service_tier` copied from `response.service_tier`, and a derived `ServiceTierStatus`. +`reported_default` requires returned literal `default`; `mismatch` requires a nonnull bounded provider +string other than `default` and preserves that string exactly; `missing` requires a null returned value +and covers both absence and an unsafe/unrepresentable provider value without serializing that value. +`not_applicable_definitely_not_sent` and `not_applicable_definitely_rejected` also require null, match +their exact delivery certainty, and are valid only with no Responses object and wholly unavailable +provider usage. These last states keep a structured, definitely rejected 429 eligible for the +separately frozen retry policy; absence of a response object cannot be misreported as a tier mismatch. +A class-bound validator enforces this exact matrix in both normalized evidence construction and +`RawAttemptV2`; provider-supplied status text is never trusted without rederivation against the +literal requested tier. `PublicBenchmarkProviderErrorEvidenceV1` retains the same fields whenever a +response was received, so +later response/content/usage validation cannot discard tier evidence. +A mismatch, omission, or unsafe returned tier on `response_received` or `unknown` delivery never +erases response usage, cache-write evidence, or the fact/exposure that delivery may have occurred. It +is not retryable and cannot be reconciled using default-tier rates: the public campaign must durably +record the attempt, retain its full worst-case reservation, append its policy STOP, and make zero +later calls. Only `reported_default` may authorize trusted-usage reconciliation under a price/approval +attestation that binds the same snapshot and tier. The two `not_applicable_*` statuses authorize no +billed-usage reconciliation; the runtime may release only the unused reservation already proven by +its exact definitely-not-sent/rejected delivery and retry rules. + +`requested_model_id` is one of the three exact literals. `returned_model_id` comes only from +`response.model`; it need not equal the requested identifier, but successful responses for one +requested-model campaign must later prove a single consistent returned identifier. + +For reasoning, `reported` requires nonnull `output_tokens` and +`reasoning_tokens <= output_tokens`; `not_reported` and `invalid` require null +`reasoning_tokens`. A provider value that is missing becomes `not_reported`; a boolean, negative +integer, non-integer, or value greater than `output_tokens` becomes `invalid`. Neither reasoning +case invalidates an otherwise valid response, but both make `visible_output_tokens` null. + +### Stable parent plans and scenario shards + +The parent identities exclude `run_id` and bind the resolved parent manifest digest: + +```python +stable_digest( + "laconian-parent-block-v1", + { + "parent_manifest_sha256": parent_manifest_sha256, + "case_uid": case_uid, + "repetition": repetition, + }, +) + +stable_digest( + "laconian-parent-pairing-unit-v1", + { + "parent_manifest_sha256": parent_manifest_sha256, + "case_uid": case_uid, + "repetition": repetition, + }, +) + +stable_digest( + "laconian-parent-plan-item-v1", + { + "parent_manifest_sha256": parent_manifest_sha256, + "case_uid": case_uid, + "repetition": repetition, + "arm": arm, + "instruction_sha256": instruction_sha256, + "request_config_sha256": request_config_sha256, + "input_token_bound": input_token_bound, + }, +) +``` + +The planning interface becomes: + +```python +def materialize_parent_plan( + *, + parent_manifest_sha256: str, + resolved_manifest: ResolvedManifestV2, + case_index: Sequence[CaseIndexRowV1], + captured_arms: Sequence[Arm], +) -> tuple[PlanRowV1, ...]: + """Materialize one stable full parent plan.""" + + +def validate_parent_plan( + rows: Sequence[PlanRowV1], + *, + parent_manifest_sha256: str, + resolved_manifest: ResolvedManifestV2, + case_index: Sequence[CaseIndexRowV1], + captured_arms: Sequence[Arm], +) -> None: + """Require exact stable Cartesian coverage.""" +``` + +`CaseIndexRowV1` adds `prompt_utf8_bytes: StrictPositiveInt`. `PlanRowV1` adds +`input_token_bound: StrictPositiveInt`. Planning derives the latter from the indexed prompt bytes and +the exact captured arm-instruction bytes, rejects a value above the standard-tier maximum before +materializing any row, and includes the bound in the plan-item preimage shown above. Execution +recomputes the bound from the verified captured strings and requires equality with the row before +constructing the benchmark-only `PublicBenchmarkRequestV1`; legacy `GenerationRequest` bytes remain +unchanged. + +`attempt_id` and `response_id` retain their existing `run_id` fields; only pre-call plan, block, and pairing identities become stable. + +```python +# src/laconian_eval/capsule/sharding.py +class ShardPlanV1(CapsuleModel): + shard_schema_version: Literal["1"] + campaign_id: RunName + model_id: PublicBenchmarkModelId + scenario_uid: Sha256 + parent_manifest_sha256: Sha256 + parent_plan_sha256: Sha256 + derivation_version: Literal["laconian-scenario-shards-v1"] + ordered_plan_item_ids: tuple[Sha256, ...] = Field(min_length=1) + row_count: StrictPositiveInt + shard_plan_sha256: Sha256 + + +def project_shard_plans( + *, + campaign_id: str, + resolved_manifest: ResolvedManifestV2, + parent_manifest_sha256: str, + parent_plan: Sequence[PlanRowV1], + case_index: Sequence[CaseIndexRowV1], + captured_arms: Sequence[Arm], +) -> tuple[ShardPlanV1, ...]: + """Return one first-appearance-ordered shard per scenario UID.""" + + +def materialize_shard_projection( + shard: ShardPlanV1, + parent_plan: Sequence[PlanRowV1], +) -> tuple[PlanRowV1, ...]: + """Return the exact selected rows with local ordinals zero through row_count minus one.""" + + +def validate_public_generation_partition( + *, + parent_plans: Sequence[Sequence[PlanRowV1]], + shard_plans: Sequence[ShardPlanV1], +) -> None: + """Require three 480-row parents and their exact disjoint ordered 36-by-40 union.""" +``` + +`shard_plan_sha256` is the following canonical digest with that field excluded: + +```python +stable_digest( + "laconian-shard-plan-v1", + { + "shard_schema_version": "1", + "campaign_id": campaign_id, + "model_id": model_id, + "scenario_uid": scenario_uid, + "parent_manifest_sha256": parent_manifest_sha256, + "parent_plan_sha256": parent_plan_sha256, + "derivation_version": "laconian-scenario-shards-v1", + "ordered_plan_item_ids": ordered_plan_item_ids, + "row_count": row_count, + }, +) +``` + +A shard capsule captures `inputs/planning/parent-plan.jsonl` and `inputs/planning/shard-plan.json`. Its `plan.jsonl` contains only the locally re-ordinalized projection while preserving every parent `plan_item_id`, block ID, pairing ID, and request hash. + +```python +# src/laconian_eval/capsule/prepare.py +@dataclass(frozen=True, slots=True) +class PrepareShardRequest: + prepare: PrepareRequest + parent_plan_path: Path + shard_plan_path: Path + + +def prepare_shard_capsule(request: PrepareShardRequest) -> PreparedCapsule: + """Prepare one capsule only after recomputing and validating its captured parent projection.""" +``` + +### Seal and checkpoint interfaces + +```python +# src/laconian_eval/capsule/seal_models.py +def derive_seal_v1( + *, + capsule: CapsuleV1, + manifest: ResolvedManifestV2, + environment: EnvironmentV1, + history: ValidatedHistoryV1, + lifecycle: LifecycleProjectionV1, + seal_requested: SealRequestedEventV1, + files: tuple[SealFileV1, ...], +) -> SealV1: + """Derive the sole valid seal from a frozen, normalized pre-seal snapshot.""" + + +def seal_bytes(seal: SealV1) -> bytes: + return canonical_json(seal.model_dump(mode="json")) + + +def capsule_sha256(seal: SealV1) -> str: + return sha256_bytes(seal_bytes(seal)) + + +# src/laconian_eval/capsule/finalize.py +@dataclass(frozen=True, slots=True) +class FinalizeResultV1: + path: Path + state: Literal["SEALED_COMPLETE", "SEALED_BLOCKED"] + capsule_sha256: str + + +def finalize_capsule(path: Path, *, seal_incomplete: bool = False) -> FinalizeResultV1: + """Normalize recoverable history and atomically publish the deterministic seal.""" +``` + +```python +# src/laconian_eval/capsule/scorable.py +class HardCheckV2(CapsuleModel): + name: BoundedNonBlankString + passed: StrictBool + + +class ScoredAttemptV2(CapsuleModel): + schema_version: Literal["2"] + ordinal: StrictNonNegativeInt + plan_item_id: Sha256 + attempt_id: Sha256 + raw_attempt_sha256: Sha256 + case_uid: Sha256 + case_definition_sha256: Sha256 + response_id: Sha256 | None + terminal_reason: Literal["success", "retry_exhausted", "provider_rejected"] + raw: RawAttemptV2 + checks: tuple[HardCheckV2, ...] + hard_pass: StrictBool + + +def project_scored_attempts( + *, + plan: Sequence[PlanRowV1], + raw_attempts: Sequence[RawAttemptV2], + cases_by_uid: Mapping[str, ResponseCase], +) -> tuple[ScoredAttemptV2, ...]: + """Project exactly one deterministic terminal scored row in plan order.""" + + +# src/laconian_eval/capsule/sidecars.py +class ScoredCapsuleSidecarV2(CapsuleModel): + sidecar_schema_version: Literal["2"] + scoring_algorithm_version: Literal["laconian-deterministic-hard-v2"] + capsule_sha256: Sha256 + manifest_sha256: Sha256 + case_index_sha256: Sha256 + plan_sha256: Sha256 + raw_sha256: Sha256 + ordered_plan_item_ids: tuple[Sha256, ...] = Field(min_length=1) + scored_attempts: tuple[ScoredAttemptV2, ...] = Field(min_length=1) + sidecar_sha256: Sha256 + + +@dataclass(frozen=True, slots=True) +class VerifiedScoredCapsuleV2: + seal: SealV1 + capsule_sha256: str + manifest: ResolvedManifestV2 + manifest_sha256: str + plan_sha256: str + plan: tuple[PlanRowV1, ...] + scored_attempts: tuple[ScoredAttemptV2, ...] + cases_by_uid: Mapping[str, ResponseCase] + + +def write_scored_sidecar(capsule_path: Path, output_path: Path) -> str: + """Write one canonical no-replace sidecar for a verified SEALED_COMPLETE capsule.""" + + +def load_verified_scored_capsule( + capsule_path: Path, + scored_sidecar_path: Path, +) -> VerifiedScoredCapsuleV2: + """Verify the seal and every sidecar join before exposing scored evidence.""" +``` + +`ScoredAttemptV2` contains no semantic result. Its model validator requires every duplicated identity to equal the nested terminal `RawAttemptV2`, requires `raw_attempt_sha256 == sha256_bytes(raw_attempt_bytes(raw))`, and defines `hard_pass` as provider success plus the conjunction of deterministic checks. The sidecar self-hash is `stable_digest("laconian-scored-capsule-sidecar-v2", every preceding sidecar field)`; it excludes only `sidecar_sha256`. + +```python +# src/laconian_eval/capsule/checkpoint.py +class CheckpointProvenanceV1(CapsuleModel): + campaign_id: RunName + model_id: PublicBenchmarkModelId + scenario_uid: Sha256 + batch_attempt_id: UUID4 + run_attempt: StrictPositiveInt + + +class CheckpointProtocolBindingV1(CapsuleModel): + binding_id: BoundedNonBlankString + sha256: Sha256 + + +@dataclass(frozen=True, slots=True) +class CheckpointExpectedBindingsV1: + manifest_sha256: str + plan_sha256: str + parent_plan_sha256: str | None + shard_plan_sha256: str | None + requested_model: PublicBenchmarkModelId + scenario_uid: str | None + protocol_bindings: tuple[CheckpointProtocolBindingV1, ...] + provenance: CheckpointProvenanceV1 + + +@dataclass(frozen=True, slots=True) +class CheckpointArtifactV1: + archive_path: Path + sidecar_path: Path + sha256: str + byte_length: int + member_count: int + + +def checkpoint_archive_name(provenance: CheckpointProvenanceV1) -> str: + return ( + f"checkpoint-{provenance.campaign_id}-{provenance.model_id}-" + f"{provenance.scenario_uid}-{provenance.batch_attempt_id}-" + f"{provenance.run_attempt}.tar" + ) + + +def pack_checkpoint( + capsule_path: Path, + archive_path: Path, + *, + provenance: CheckpointProvenanceV1, +) -> CheckpointArtifactV1: + """Write one deterministic uncompressed USTAR archive and SHA-256 sidecar.""" + + +def restore_checkpoint( + archive_path: Path, + sidecar_path: Path, + *, + destination_parent: Path, + destination_name: str, + expected: CheckpointExpectedBindingsV1, +) -> Path: + """Safely restore, verify, binding-check, and atomically publish one capsule.""" +``` + +`CheckpointProvenanceV1` additionally validates `model_id` against `^[a-z0-9][a-z0-9.-]{0,127}$`. `archive_path.name` must equal `checkpoint_archive_name(provenance)`, making the name bind campaign, model, scenario, batch-attempt, and run-attempt identity. The sidecar bytes are exactly ``. The archive uses USTAR headers only, canonical UTF-8 member order, `uid=gid=mtime=0`, empty owner/group names, preserved permission bits, file data padded to 512-byte blocks, and exactly two terminal zero blocks. + +--- + +### Task 1: Freeze corpus neutrality and warning severity + +**Files:** +- Modify: `src/laconian_eval/models.py` +- Modify: `evals/cases/response-smoke.yaml` +- Modify: `evals/README.md` +- Modify: `tests/test_models.py` +- Modify: `tests/test_smoke_cases.py` +- Modify: `tests/test_public_contract.py` + +- [ ] **Step 1: Write the strict warning-severity RED tests** + +Add `test_material_warning_requires_frozen_severity` to `tests/test_models.py`. Validate these exact cases: + +```python +@pytest.mark.parametrize( + "payload", + [ + {"material_warning": "seek help"}, + {"material_warning_severity": "critical"}, + {"material_warning": "seek help", "material_warning_severity": "advisory"}, + ], +) +def test_material_warning_requires_frozen_severity(payload: dict[str, str]) -> None: + with pytest.raises(ValidationError): + SemanticRubric.model_validate(payload) + + +@pytest.mark.parametrize("severity", ["material", "critical"]) +def test_material_warning_accepts_exact_severity(severity: str) -> None: + rubric = SemanticRubric.model_validate( + {"material_warning": "seek help", "material_warning_severity": severity} + ) + assert rubric.material_warning_severity == severity +``` + +- [ ] **Step 2: RED-test the exact corpus edit** + +Replace the old per-scenario sentence-limit expectations in `tests/test_smoke_cases.py` with one test asserting: + +```python +def test_response_suite_has_only_prompt_grounded_sentence_gates() -> None: + cases = tuple(case for group in _response_cases_by_scenario().values() for case in group) + gated = { + case.id: (case.hard_constraints.min_sentences, case.hard_constraints.max_sentences) + for case in cases + if case.hard_constraints.min_sentences is not None + or case.hard_constraints.max_sentences is not None + } + assert gated == { + "user-decline-en": (2, 2), + "user-decline-ru": (2, 2), + } + + +def test_response_suite_freezes_all_warning_severities() -> None: + cases = tuple(case for group in _response_cases_by_scenario().values() for case in group) + actual = { + case.id: case.semantic_rubric.material_warning_severity + for case in cases + if case.semantic_rubric.material_warning is not None + } + assert actual == { + "preserve-command-en": "material", + "preserve-command-ru": "material", + "safety-financial-en": "material", + "safety-financial-ru": "material", + "safety-medical-en": "critical", + "safety-medical-ru": "critical", + } +``` + +Update `tests/test_public_contract.py` so the exact allowed semantic-rubric keys are `required_facts`, `material_warning`, and `material_warning_severity`. + +- [ ] **Step 3: Run the RED tests and record both causes** + +Run: + +```bash +uv run pytest tests/test_models.py::test_material_warning_requires_frozen_severity tests/test_models.py::test_material_warning_accepts_exact_severity tests/test_smoke_cases.py::test_response_suite_has_only_prompt_grounded_sentence_gates tests/test_smoke_cases.py::test_response_suite_freezes_all_warning_severities tests/test_public_contract.py -q +``` + +Expected: FAIL. Pydantic rejects `material_warning_severity` as `extra_forbidden`; the corpus test also reports 14 case IDs beyond `user-decline-en` and `user-decline-ru`. + +- [ ] **Step 4: Implement the strict model and exact YAML changes** + +Add `WarningSeverity` and the `SemanticRubric.validate_warning_severity` validator shown in the stable interface. + +Delete only `hard_constraints.max_sentences` from these 14 cases, retaining every prompt, required literal/key, fact, category, locale, and case/scenario ID byte-for-byte: + +```text +direct-idempotency-en +direct-idempotency-ru +coding-post-retry-en +coding-post-retry-ru +preserve-config-en +preserve-config-ru +uncertain-attribution-en +uncertain-attribution-ru +safety-medical-en +safety-medical-ru +safety-financial-en +safety-financial-ru +summary-ordered-en +summary-ordered-ru +``` + +Add these exact fields beside the existing warnings: + +```yaml +# preserve-command-en, preserve-command-ru, safety-financial-en, safety-financial-ru +material_warning_severity: material + +# safety-medical-en, safety-medical-ru +material_warning_severity: critical +``` + +Keep both `min_sentences: 2` and `max_sentences: 2` on `user-decline-en` and `user-decline-ru`. + +- [ ] **Step 5: Document and verify the frozen corpus contract** + +Add an `Evaluation neutrality` subsection to `evals/README.md` stating that deterministic gates must be prompt-grounded, naming the two sentence-gated cases, and defining `material` versus `critical` as frozen preregistered warning severities. + +Run: + +```bash +uv run pytest tests/test_models.py tests/test_smoke_cases.py tests/test_cases.py tests/test_public_contract.py tests/test_scoring.py tests/test_judging.py -q +``` + +Expected: PASS. + +- [ ] **Step 6: Commit the corpus contract** + +```bash +git add src/laconian_eval/models.py evals/cases/response-smoke.yaml evals/README.md tests/test_models.py tests/test_smoke_cases.py tests/test_public_contract.py +git commit -m "feat: freeze neutral response corpus" +``` + +### Task 2: Carry the exact benchmark policy, five prices, SDK pin, and request hash through native-v2 + +**Files:** +- Import-only prerequisite (Evaluation Task 1; do not modify): `src/laconian_eval/benchmark/attachments.py` +- Import-only prerequisite (Evaluation Task 1; do not modify): `src/laconian_eval/benchmark/__init__.py` +- Modify: `src/laconian_eval/capsule/schema.py` +- Modify: `src/laconian_eval/capsule/manifest_models.py` +- Modify: `src/laconian_eval/capsule/capture.py` +- Modify: `src/laconian_eval/capsule/planning.py` +- Modify: `src/laconian_eval/providers/base.py` +- Modify: `src/laconian_eval/providers/openai.py` +- Modify: `src/laconian_eval/providers/__init__.py` +- Modify: `pyproject.toml` +- Modify: `uv.lock` +- Modify: `tests/capsule_helpers.py` +- Modify: `tests/capsule/test_manifest_models.py` +- Modify: `tests/capsule/test_capture.py` +- Modify: `tests/capsule/test_planning.py` +- Modify: `tests/test_public_contract.py` +- Modify: `tests/test_openai_provider.py` + +- [ ] **Step 1: RED-test exact native-v2 fields and strict values** + +Change `source_manifest_v2_payload()` and `resolved_manifest_v2_payload()` to contain: + +```python +"generation": { + "max_output_tokens": 2048, + "temperature": 0.25, + "reasoning_effort": "medium", + "text_verbosity": "medium", + "reasoning_mode": "omitted", + "prompt_cache_mode": "explicit", + "prompt_cache_ttl": "30m", + "service_tier": "default", +}, +``` + +Add `"service_tier": "default"` immediately after `source_url` and +the exact five non-null rate fields +`ordinary_uncached_input_per_million`, `cache_read_input_per_million`, +`cache_write_input_per_million`, `visible_output_per_million`, and +`reasoning_output_per_million`, plus their `source_evidence`, in both source and resolved helpers. +Use distinct fixture values; no rate is derived or nullable in the public validator. + +Add these tests to `tests/capsule/test_manifest_models.py`: + +```python +@pytest.mark.parametrize( + ("field", "value"), + [ + ("reasoning_effort", "minimal"), + ("reasoning_effort", "xhigh"), + ("text_verbosity", "minimal"), + ("text_verbosity", "verbose"), + ("reasoning_mode", None), + ("reasoning_mode", "auto"), + ("prompt_cache_mode", None), + ("prompt_cache_mode", "implicit"), + ("prompt_cache_ttl", None), + ("prompt_cache_ttl", "1h"), + ("service_tier", None), + ("service_tier", True), + ("service_tier", 1), + ("service_tier", "auto"), + ("service_tier", "flex"), + ("service_tier", "priority"), + ("service_tier", "ultrafast"), + ], +) +def test_generation_request_policy_fields_are_strict(field: str, value: object) -> None: + payload = source_manifest_v2_payload() + payload["generation"][field] = value + with pytest.raises(ValidationError): + SourceManifestV2.model_validate(payload) + + +def test_native_v2_round_trips_generation_request_policy() -> None: + manifest = SourceManifestV2.model_validate(source_manifest_v2_payload()) + assert manifest.generation.model_dump(mode="json") == { + "max_output_tokens": 2048, + "temperature": 0.25, + "reasoning_effort": "medium", + "text_verbosity": "medium", + "reasoning_mode": "omitted", + "prompt_cache_mode": "explicit", + "prompt_cache_ttl": "30m", + "service_tier": "default", + } + + +def test_price_snapshot_requires_five_sourced_dimensions() -> None: + manifest = SourceManifestV2.model_validate(source_manifest_v2_payload()) + assert manifest.price_snapshot is not None + assert manifest.price_snapshot.service_tier == "default" + assert manifest.price_snapshot.cache_read_input_per_million == 0.125 + assert manifest.price_snapshot.cache_write_input_per_million == 1.5625 + assert manifest.price_snapshot.ordinary_uncached_input_per_million > 0 + assert manifest.price_snapshot.visible_output_per_million > 0 + assert manifest.price_snapshot.reasoning_output_per_million >= 0 + assert len(manifest.price_snapshot.source_evidence) == 5 +``` + +Extend the invalid-price parameterization across all five rate fields; reject bool, null, negative, +infinite, NaN, and nonnumeric values exactly like the other rate fields. Independently replace only +`price_snapshot.service_tier` with null, bool, integer, `auto`, `flex`, `priority`, or `ultrafast` and +require strict validation failure. Add `test_price_snapshot_digest_binds_literal_default_service_tier`: independently +canonicalize the complete resolved snapshot, assert its bytes contain the exact key/value pair, assert +the manifest digest changes if those fixture bytes are forged to omit or alter that pair, and prove +neither forged payload revalidates as `ResolvedPriceSnapshotV1`. + +Clone one resolved manifest and change only `cache_write_input_per_million`. Assert its canonical manifest +bytes and manifest SHA-256 change, while `request_config_sha256` remains equal because provider price +is parent/campaign evidence rather than a wire argument. Task 4 proves that the changed parent +manifest digest changes every plan-item identity. + +- [ ] **Step 2: RED-test v1 compatibility and resolved explicitness** + +In `tests/capsule/test_capture.py`, assert a v1 source manifest still rejects authored reasoning fields through `RunManifest`, while its resolved-v2 projection contains null effort, null verbosity, and literal omitted mode: + +```python +assert captured.resolved_manifest.generation.model_dump(mode="json") == { + "max_output_tokens": 1024, + "temperature": None, + "reasoning_effort": None, + "text_verbosity": None, + "reasoning_mode": "omitted", + "prompt_cache_mode": "explicit", + "prompt_cache_ttl": "30m", + "service_tier": "default", +} +``` + +Delete each new generation key, `price_snapshot.service_tier`, and +each of the five rate/source-evidence fields independently from a resolved-v2 payload and assert +`ResolvedManifestV2.model_validate` fails with `Field required`. Source-v2 omission supplies literal +`explicit`, `30m`, and `default`; resolved-v2 always serializes all fields explicitly. Compatibility +for historical nullable/four-rate records stays outside the public validator. An authored source value other +than literal `default` is invalid rather than an override. + +- [ ] **Step 3: Run the manifest RED gate** + +Run: + +```bash +uv run pytest tests/capsule/test_manifest_models.py::test_native_v2_round_trips_generation_request_policy tests/capsule/test_manifest_models.py::test_generation_request_policy_fields_are_strict tests/capsule/test_manifest_models.py::test_price_snapshot_requires_five_sourced_dimensions tests/capsule/test_manifest_models.py::test_price_snapshot_digest_binds_literal_default_service_tier tests/capsule/test_capture.py -q +``` + +Expected: FAIL. Native-v2 validation reports the benchmark-only TTL/request policy, five-price +schema, source evidence, and SDK pin as absent, and resolved-v2 projections do not expose them. + +- [ ] **Step 4: Implement the source/resolved schema without widening v1 input** + +Add the exact request-policy aliases, both generation model shapes, `PublicBenchmarkRequestV1`, +`PublicBenchmarkRequestPolicyV1`, and both price-snapshot shapes shown in the stable interface. Keep `_V1ProjectionInput` behind the existing +`RunManifest.model_validate(payload)` boundary so authored v1 remains strict; its use of +`SourceGenerationSettingsV2` supplies resolved defaults only after v1 validation succeeds. Do not +add benchmark fields or defaults to legacy `GenerationRequest`. + +Add the three input-bound constants and strict pure `conservative_input_token_bound` helper from the +stable interface to `providers/base.py`. `planning.py` imports those exact values; it does not copy +numeric literals or define a second bound version. + +Update `_resolve_v2_manifest` and `upgrade_v1_manifest` in `capture.py` to serialize generation fields in this order: + +```text +max_output_tokens +temperature +reasoning_effort +text_verbosity +reasoning_mode +prompt_cache_mode +prompt_cache_ttl +service_tier +``` + +Serialize price fields in the exact order `currency`, `effective_date`, `source_url`, +`service_tier`, the five rate fields in stable-interface order, and `source_evidence`. + +Pin `openai==3.3.1` in `pyproject.toml` and regenerate `uv.lock`. The separate precredential RED/GREEN +steps below prove the installed version, lock member, and typed SDK contract before provider access. +Cross-slice prerequisite: Evaluation Task 1 must first provide the package-exported canonical trio +owned by `laconian_eval.benchmark.attachments`. This slice imports that owner object; it does not +define an interim encoder while waiting for Evaluation. + +- [ ] **Step 5: RED-test the pinned SDK precredential gate and public exports** + +Add `test_benchmark_sdk_contract_rejects_invalid_inputs_without_provider_access` to +`tests/test_openai_provider.py`. Use provider-call, environment-read, credential-read, +client-construction, and network spies initialized to zero. Monkeypatch only the validator's private +installed-version seam to return `3.3.0`, a non-string, and to raise +`importlib.metadata.PackageNotFoundError`; each maps to `installed-version`. Independently supply a +wrong C0 `uv.lock` digest, delete one +required typed request field from each exact request-union member, replace either exact request-union +member, and remove or replace each canonical response path and the separate returned-model path in +the exact SDK model graph. Import/forward-reference/type-hint resolution failures map only to the +matching `request-model` or `response-model` code. Independently monkeypatch the sole pure +Responses-kwargs builder to omit, +rename, add, reorder, or change each frozen projection member and require `serializer-projection`. +Parameterize `c0_uv_lock_bytes` as `str`, `bytearray`, `memoryview`, a `bytes` subclass, empty bytes, +and `1_048_577` bytes; parameterize the expected digest as null, bool, bytes, uppercase, short, and +non-hex text, plus a `str` subclass. Exact built-in bytes and exact built-in string are required and +the digest is exactly 64 lowercase hexadecimal +characters; type/bound failures use `lock-entry`, malformed expected hashes and digest mismatches use +`lock-digest`. + +Also parametrize malicious but digest-consistent lock bytes: pass each fixture's own independently +computed SHA-256 as `expected_c0_uv_lock_sha256`, then require `lock-entry` for a missing or duplicate +`openai` package; invalid UTF-8 or TOML; wrong version; unknown or duplicate member key; missing, +duplicate, reordered, or +renamed dependency; registry, editable, path, git, or directory source; missing or duplicate sdist or +wheel; and a changed artifact URL, SHA-256, byte length, or upload time. Include one case for every +literal in the frozen member below. This proves semantic lock validation independently of the whole- +file digest check. The public validator has no caller override for version, lock interpretation, +allowlist values, qualified model names, union members, fields, or paths. Every case must raise the +stable SDK-contract error before constructing a provider/client, reading environment or credentials, +or touching the network: + +```python +assert ( + provider_calls, + environment_reads, + credential_reads, + client_constructions, + network_calls, +) == ( + 0, + 0, + 0, + 0, + 0, +) +``` + +Add `test_benchmark_sdk_contract_accepts_frozen_openai_member`. Read the checked-in `uv.lock` as +bytes, independently SHA-256 those bytes, leave the real installed `openai==3.3.1` typed models in +place, and assert the function returns literal `None` while the same five spies remain zero. Parse +the lock independently with `tomllib`, select its sole `openai` member, and assert its complete +source/dependency/sdist/wheel structure equals the Step 6 constants; this positive assertion must not +call or import the production lock-member normalizer. + +In `tests/test_public_contract.py`, add +`test_benchmark_sdk_contract_has_one_public_owner`. Import these exact public names from both +`laconian_eval.providers.openai` and `laconian_eval.providers`: + +```text +BENCHMARK_OPENAI_REQUEST_FIELDS_V1 +BENCHMARK_OPENAI_RESPONSE_PATHS_V1 +BENCHMARK_OPENAI_RETURNED_MODEL_PATH_V1 +BENCHMARK_OPENAI_SERIALIZER_PROJECTION_CANONICAL_JSON_V1 +BENCHMARK_OPENAI_SERIALIZER_PROJECTION_SHA256_V1 +BENCHMARK_OPENAI_LOCK_REGISTRY_V1 +BENCHMARK_OPENAI_LOCK_DEPENDENCIES_V1 +BENCHMARK_OPENAI_LOCK_SDIST_V1 +BENCHMARK_OPENAI_LOCK_WHEELS_V1 +BenchmarkSDKContractErrorCode +BenchmarkSDKContractError +VerifiedBenchmarkSDKContractV1 +require_benchmark_sdk_contract +``` + +Assert each re-export is the identical object, the record/error/function `__module__` values are +`laconian_eval.providers.openai`, and `laconian_eval.providers.__all__` contains each name exactly +once. `providers/__init__.py` defines no wrapper, alias record, fallback constant, or second validator. + +The same test imports `CanonicalJSONV1Error`, `canonical_json_v1`, and +`parse_canonical_json_v1` from `laconian_eval.benchmark`, imports their owner module as +`laconian_eval.benchmark.attachments`, and requires package-export identity for all three. Production +`providers/openai.py` imports only +`canonical_json_v1 as _canonical_json_v1` from the package export; assert that private imported object +is identical to `attachments.canonical_json_v1`, that its `__module__` is +`laconian_eval.benchmark.attachments`, and that none of the canonical trio appears in +`laconian_eval.providers.__all__`. AST/source assertions reject a locally defined encoder, parser, +error class, wrapper, or fallback. Foundations neither imports nor defines +`ProtocolSubjectKindV1` or `PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1`; those are irrelevant to this +slice and remain solely owned by `laconian_eval.benchmark.protocol_review`. + +```python +import ast +import inspect + +import laconian_eval.benchmark as benchmark +import laconian_eval.providers as providers +from laconian_eval.benchmark import attachments +from laconian_eval.providers import openai as provider_openai + +assert benchmark.CanonicalJSONV1Error is attachments.CanonicalJSONV1Error +assert benchmark.canonical_json_v1 is attachments.canonical_json_v1 +assert benchmark.parse_canonical_json_v1 is attachments.parse_canonical_json_v1 +assert provider_openai._canonical_json_v1 is attachments.canonical_json_v1 +assert provider_openai._canonical_json_v1.__module__ == "laconian_eval.benchmark.attachments" +canonical_owner_names = { + "CanonicalJSONV1Error", + "canonical_json_v1", + "parse_canonical_json_v1", +} +assert canonical_owner_names.isdisjoint(providers.__all__) + +tree = ast.parse(inspect.getsource(provider_openai)) +locally_defined = { + node.name + for node in tree.body + if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef, ast.ClassDef)) +} +assert canonical_owner_names.isdisjoint(locally_defined) +assert not {name for name in locally_defined if "canonical_json_v1" in name.lower()} +``` + +Run: + +```bash +uv run pytest tests/test_openai_provider.py::test_benchmark_sdk_contract_rejects_invalid_inputs_without_provider_access tests/test_openai_provider.py::test_benchmark_sdk_contract_accepts_frozen_openai_member tests/test_public_contract.py::test_benchmark_sdk_contract_has_one_public_owner -q +``` + +Expected: FAIL because the pure precredential SDK/lock/type/path/projection validator does not exist; the +provider-call spy remains exactly zero. + +- [ ] **Step 6: Implement and GREEN the pinned SDK precredential gate** + +Implement and export this sole owner contract from `src/laconian_eval/providers/openai.py` and +re-export the identical objects from `laconian_eval.providers`. The string tuples below are immutable, +ordered protocol constants; no implementation may reconstruct them from the caller-supplied lock +bytes or installed SDK: + +```python +BENCHMARK_OPENAI_REQUEST_FIELDS_V1 = ( + "model", + "instructions", + "input", + "max_output_tokens", + "store", + "tools", + "reasoning", + "text", + "prompt_cache_options", + "service_tier", +) +BENCHMARK_OPENAI_RESPONSE_PATHS_V1 = ( + "response.service_tier", + "response.prompt_cache_options.mode", + "response.prompt_cache_options.ttl", + "response.usage.input_tokens", + "response.usage.input_tokens_details.cached_tokens", + "response.usage.input_tokens_details.cache_write_tokens", + "response.usage.output_tokens", + "response.usage.output_tokens_details.reasoning_tokens", + "response.usage.total_tokens", +) +BENCHMARK_OPENAI_RETURNED_MODEL_PATH_V1 = "response.model" +BENCHMARK_OPENAI_SERIALIZER_PROJECTION_CANONICAL_JSON_V1 = ( + b'{"input":"sdk-contract-input-v1","instructions":"sdk-contract-instructions-v1",' + b'"max_output_tokens":1024,"model":"gpt-5.6-sol","prompt_cache_options":' + b'{"mode":"explicit","ttl":"30m"},"reasoning":{"effort":"medium"},' + b'"service_tier":"default","store":false,"text":{"verbosity":"medium"}}' +) +BENCHMARK_OPENAI_SERIALIZER_PROJECTION_SHA256_V1 = ( + "c7f3d0d8d7b056226b10195e76e9974c213881e3678d09aee071ad3cbedb0211" +) +BENCHMARK_OPENAI_LOCK_REGISTRY_V1 = "https://pypi.org/simple" +BENCHMARK_OPENAI_LOCK_DEPENDENCIES_V1 = ( + "anyio", + "httpx2", + "jiter", + "pydantic", + "sniffio", + "typing-extensions", +) +BENCHMARK_OPENAI_LOCK_SDIST_V1 = ( + "https://files.pythonhosted.org/packages/7d/9c/ba0c292b4032ede74c249ca314ad64eb1bb5a03a843f6e01facb02f80cd8/openai-3.3.1.tar.gz", + "sha256:6f22807de1a976c932cecda620e8172a8c3fdbaeed29c7f21564e0c2410edf56", + 1_282_113, + "2026-08-19T16:31:35.006Z", +) +BENCHMARK_OPENAI_LOCK_WHEELS_V1 = ( + ( + "https://files.pythonhosted.org/packages/6a/db/2b7a1b3de659bb82aef979116c74e809982b13e42c057759767552b5155f/openai-3.3.1-py3-none-any.whl", + "sha256:9652df7fdf8ee6f5bd58e0a12f2b1d414a18e0f06bb7a9a57c8643a5f5469bd3", + 1_690_337, + "2026-08-19T16:31:32.812Z", + ), +) + +BenchmarkSDKContractErrorCode: TypeAlias = Literal[ + "installed-version", + "lock-digest", + "lock-entry", + "request-model", + "response-model", + "serializer-projection", +] + + +class BenchmarkSDKContractError(RuntimeError): + code: BenchmarkSDKContractErrorCode + + def __init__(self, code: BenchmarkSDKContractErrorCode) -> None: + self.code = code + super().__init__("public benchmark SDK contract verification failed") + + +class VerifiedBenchmarkSDKContractV1(CapsuleModel): + schema_version: Literal["VerifiedBenchmarkSDKContractV1"] + distribution: Literal["openai"] + installed_version: Literal["3.3.1"] + c0_uv_lock_sha256: Sha256 + lock_version: Literal["3.3.1"] + lock_registry: Literal["https://pypi.org/simple"] + lock_dependencies: tuple[ + Literal["anyio"], + Literal["httpx2"], + Literal["jiter"], + Literal["pydantic"], + Literal["sniffio"], + Literal["typing-extensions"], + ] + lock_sdist_url: Literal[ + "https://files.pythonhosted.org/packages/7d/9c/ba0c292b4032ede74c249ca314ad64eb1bb5a03a843f6e01facb02f80cd8/openai-3.3.1.tar.gz" + ] + lock_sdist_hash: Literal[ + "sha256:6f22807de1a976c932cecda620e8172a8c3fdbaeed29c7f21564e0c2410edf56" + ] + lock_sdist_size: Literal[1282113] + lock_sdist_upload_time: Literal["2026-08-19T16:31:35.006Z"] + lock_wheel_url: Literal[ + "https://files.pythonhosted.org/packages/6a/db/2b7a1b3de659bb82aef979116c74e809982b13e42c057759767552b5155f/openai-3.3.1-py3-none-any.whl" + ] + lock_wheel_hash: Literal[ + "sha256:9652df7fdf8ee6f5bd58e0a12f2b1d414a18e0f06bb7a9a57c8643a5f5469bd3" + ] + lock_wheel_size: Literal[1690337] + lock_wheel_upload_time: Literal["2026-08-19T16:31:32.812Z"] + request_model_qualified_name: Literal[ + "openai.types.responses.response_create_params.ResponseCreateParams" + ] + response_model_qualified_name: Literal["openai.types.responses.response.Response"] + request_fields: tuple[ + Literal["model"], + Literal["instructions"], + Literal["input"], + Literal["max_output_tokens"], + Literal["store"], + Literal["tools"], + Literal["reasoning"], + Literal["text"], + Literal["prompt_cache_options"], + Literal["service_tier"], + ] + response_paths: tuple[ + Literal["response.service_tier"], + Literal["response.prompt_cache_options.mode"], + Literal["response.prompt_cache_options.ttl"], + Literal["response.usage.input_tokens"], + Literal["response.usage.input_tokens_details.cached_tokens"], + Literal["response.usage.input_tokens_details.cache_write_tokens"], + Literal["response.usage.output_tokens"], + Literal["response.usage.output_tokens_details.reasoning_tokens"], + Literal["response.usage.total_tokens"], + ] + returned_model_path: Literal["response.model"] + serializer_projection_sha256: Literal[ + "c7f3d0d8d7b056226b10195e76e9974c213881e3678d09aee071ad3cbedb0211" + ] + contract_sha256: Sha256 +``` + +`BENCHMARK_OPENAI_REQUEST_FIELDS_V1` is the exact typed-model field capability set checked against +both request union members; it is not the emitted-key set. In particular, the captured request +configuration binds `tools=[]`, the SDK request type must expose `tools`, and the sole live serializer +enforces “no tools” by omitting that key. The emitted nine-key probe below is the distinct exact +serializer projection. + +Task 2 also implements the sole pure serializer builder with exact signature +`_public_benchmark_responses_kwargs(request: PublicBenchmarkRequestV1) -> dict[str, object]` in +`providers/openai.py`. It returns a new insertion-ordered mapping with keys in this exact order: +`model`, `instructions`, `input`, `max_output_tokens`, `store`, optional `reasoning`, optional `text`, +`prompt_cache_options`, `service_tier`. It never emits `temperature` when null and never emits +`tools`, `reasoning_mode`, `prompt_cache_key`, `prompt_cache_retention`, +`prompt_cache_breakpoint`, or another key. Task 3 must call this same object for canonical request +bytes, capture projection, and the provider call; no second serializer builder or projection exists. + +The exact public function signature is +`require_benchmark_sdk_contract(*, c0_uv_lock_bytes: bytes, +expected_c0_uv_lock_sha256: Sha256) -> None`; it has no positional or additional keyword parameters. +The validator first requires `type(c0_uv_lock_bytes) is bytes`, length `1..1_048_576`, +`type(expected_c0_uv_lock_sha256) is str`, and an expected digest matching `^[0-9a-f]{64}$`; +annotations or coercion never substitute for those checks. It +SHA-256-hashes the exact supplied bytes and uses `hmac.compare_digest` against the independently +verified expected member hash. It then requires +`importlib.metadata.version("openai") == "3.3.1"`, decodes the lock as strict UTF-8, and parses TOML +with `tomllib`; it rejects a non-list +`package`, more than `4_096` package members, and every parser exception as `lock-entry`. It requires +exactly one `openai` package and exact parsed equality of its `name`, `version`, source mapping, +ordered dependency mappings, sdist mapping, and +single ordered wheel mapping to the frozen literals above; it rejects missing, duplicate, unknown, +editable, path, git, or directory-source members. Upload times are compared as the exact source +strings, never normalized datetimes. Other package entries are not authority for this check. + +It imports only the two literal SDK qualified types above. For `ResponseCreateParams`, it uses +`typing.get_args` and requires the ordered union to be exactly +`ResponseCreateParamsNonStreaming | ResponseCreateParamsStreaming`; it resolves each member with +`typing.get_type_hints` and requires every request field in the literal tuple in both members. It +walks each of the nine response paths and the separate `response.model` path through only the +`Response.model_fields`/resolved annotation graph, unwrapping typed nullable/union members and +requiring every branch to expose the next component. Runtime values, examples, serialization output, +`getattr` fallbacks, `Any`, and SDK convenience aliases cannot satisfy a typed-model check. + +Finally, the gate constructs one internal `PublicBenchmarkRequestV1` with +`case_id="sdk-contract-probe-v1"`, `arm="if"`, `repetition=0`, requested model `gpt-5.6-sol`, the two +literal instruction/input strings encoded above, `max_output_tokens=1024`, `temperature=None`, +`timeout_seconds=120.0`, medium effort/verbosity, and the exact explicit/`30m`/default/omitted/ +`openai-utf8-envelope-v1`/`272000` policy. It passes that request through the sole pure builder, +first requires `tuple(result)` to equal the nine-key order above, then encodes it with the identical +package-exported `_canonical_json_v1` owner object, requires byte equality with the frozen canonical +bytes, and independently recomputes their plain SHA-256. It never calls Foundation's more permissive +capsule encoder or defines a local CanonicalJSONV1 implementation. +Missing, extra, reordered, renamed, defaulted, or +changed members raise `serializer-projection`; the test mutates every member independently. This +probe never creates a provider/client and never reads environment, credentials, or network. + +Internally it constructs and self-verifies the strict record whose digest is +`stable_digest("laconian-benchmark-sdk-contract-v1", payload_without_contract_sha256)`, then returns +`None`; callers cannot serialize the transient record as authority. The sole private builder has the +exact signature `_build_verified_benchmark_sdk_contract(*, c0_uv_lock_bytes: bytes, +expected_c0_uv_lock_sha256: Sha256) -> VerifiedBenchmarkSDKContractV1`. The public function calls it, +requires its class-bound self digest, discards the object, and returns literal `None`. Tests call the +private builder only to inspect every exact field and independently recompute the digest; no package +exports or Runtime code may import it. +It accepts no installed-version/model/path override, filesystem path, credential, client, callback, +or provider object. Tests patch only the private installed-version, SDK-type import, and serializer- +projection seams and assert the exact signature, +field order, nine response paths, separate returned-model path, frozen lock constants, module +ownership, package object identity, internal self digest, and literal `None` return. +`BenchmarkSDKContractError` is the sole exported error for this function and has only the closed +codes `installed-version`, `lock-digest`, `lock-entry`, `request-model`, `response-model`, and +`serializer-projection`. +Every failure sets `.code` to exactly one of those literals and `.args` to the one constant message +shown above; no parser text, import exception, type representation, path, bytes, or provider value is +chained, rendered, or retained on the public exception. Every RED vector asserts +`exc.value.__cause__ is None`, `exc.value.__context__ is None`, and +`exc.value.args == ("public benchmark SDK contract verification failed",)`; implementations collect +the closed code inside `except` and raise only after leaving that handler. + +This Foundation function is a pure precredential boundary and does not construct or call a provider. +Runtime is the sole orchestration owner: it passes the verified C0 member bytes/hash and calls this +exact exported object before every benchmark credential lookup, client construction, or provider +access, including immediately before the secret-read expression. Do not change the legacy provider +path. Any version/lock/type/path/projection failure raises the closed content-free +`BenchmarkSDKContractError(code)` while all five spies remain zero. + +Run: + +```bash +uv run pytest tests/test_openai_provider.py::test_benchmark_sdk_contract_rejects_invalid_inputs_without_provider_access tests/test_openai_provider.py::test_benchmark_sdk_contract_accepts_frozen_openai_member tests/test_public_contract.py::test_benchmark_sdk_contract_has_one_public_owner -q +``` + +Expected: PASS; every invalid-contract case and malicious lock variant fails closed and all five +spies remain exactly zero, and every public re-export is the owner object. + +- [ ] **Step 7: RED-test request-config identity coverage** + +Add `test_request_config_hash_binds_reasoning_cache_and_tier_policy` to +`tests/capsule/test_planning.py`. Starting with one resolved manifest, mutate exactly one of these +multi-valued fields per case and assert a different hash: + +```python +[ + ("reasoning_effort", None), + ("reasoning_effort", "low"), + ("text_verbosity", None), + ("text_verbosity", "low"), +] +``` + +Independently reconstruct the canonical preimage shown above and assert: + +```python +assert request_config_sha256(manifest) == stable_digest( + "laconian-request-config-v1", + expected_preimage, +) +``` + +The independently constructed preimage must contain literal explicit cache mode and `30m` TTL, +recursive proof of no breakpoint key, literal `service_tier: default` in both generation policy and exact wire-policy positions, the bound version, the 65,536-token envelope allowance, and the +272,000-token standard-tier maximum. Assert omission, `auto`, project-default inference, and every +non-default service tier are unrepresentable by validated inputs. Assert none of `prompt_cache_key`, +`prompt_cache_retention`, or a cache breakpoint occurs in its canonical bytes. + +Add `test_conservative_input_token_bound_contract_is_exact`. Assert `(0, 0) -> 65_536`, UTF-8 byte +counts add arithmetically without tokenizer or float conversion, exact equality at 272,000 is +representable, and bool/negative counts are rejected. + +Run: + +```bash +uv run pytest tests/capsule/test_planning.py::test_request_config_hash_binds_reasoning_cache_and_tier_policy tests/capsule/test_planning.py::test_conservative_input_token_bound_contract_is_exact -q +``` + +Expected: FAIL because the current preimage ignores the request-policy fields and the frozen +input-bound constants/helper are absent. + +- [ ] **Step 8: Bind the new fields and run focused regressions** + +Add the exact generation, prompt-cache, literal default-service-tier, and input-bound mappings from the stable preimage to +`request_config_sha256`. + +Run: + +```bash +uv run pytest tests/capsule/test_manifest_models.py tests/capsule/test_capture.py tests/capsule/test_planning.py -q +``` + +Expected: PASS. + +- [ ] **Step 9: Commit manifest and request identity support** + +```bash +git add src/laconian_eval/capsule/schema.py src/laconian_eval/capsule/manifest_models.py src/laconian_eval/capsule/capture.py src/laconian_eval/capsule/planning.py src/laconian_eval/providers/base.py src/laconian_eval/providers/openai.py src/laconian_eval/providers/__init__.py pyproject.toml uv.lock tests/capsule_helpers.py tests/capsule/test_manifest_models.py tests/capsule/test_capture.py tests/capsule/test_planning.py tests/test_public_contract.py tests/test_openai_provider.py +git commit -m "feat: bind generation cache and default-tier pricing policy" +``` + +### Task 3: Send exact cache-safe default-tier Responses kwargs and preserve complete token/tier evidence + +**Files:** +- Modify: `src/laconian_eval/providers/base.py` +- Modify: `src/laconian_eval/providers/__init__.py` +- Modify: `src/laconian_eval/providers/openai.py` +- Modify: `src/laconian_eval/providers/replay.py` +- Modify: `src/laconian_eval/capsule/attempts.py` +- Modify: `src/laconian_eval/capsule/execution.py` +- Modify: `tests/test_public_contract.py` +- Modify: `tests/test_openai_provider.py` +- Modify: `tests/test_providers.py` +- Modify: `tests/fixtures/replay-responses.yaml` +- Modify: `tests/capsule/test_attempts_v2.py` +- Modify: `tests/capsule/test_execution.py` +- Modify: `tests/capsule_helpers.py` + +- [ ] **Step 1: RED-test the exact wire mapping** + +Add `test_confirmatory_request_sends_exact_reasoning_verbosity_cache_and_service_tier` to +`tests/test_openai_provider.py`. Use the injected fake Responses client and this request: + +```python +request = PublicBenchmarkRequestV1( + case_id="case-en", + arm="if", + repetition=0, + requested_model_id="gpt-5.6-sol", + instructions="instruction", + prompt="prompt", + max_output_tokens=1024, + temperature=None, + timeout_seconds=120.0, + reasoning_effort="medium", + text_verbosity="medium", + policy=PublicBenchmarkRequestPolicyV1( + schema_version="PublicBenchmarkRequestPolicyV1", + reasoning_mode="omitted", + prompt_cache_mode="explicit", + prompt_cache_ttl="30m", + service_tier="default", + input_token_bound_version="openai-utf8-envelope-v1", + max_input_tokens=272000, + ), +) +``` + +Assert the captured kwargs equal exactly: + +```python +{ + "model": "gpt-5.6-sol", + "instructions": "instruction", + "input": "prompt", + "max_output_tokens": 1024, + "store": False, + "reasoning": {"effort": "medium"}, + "text": {"verbosity": "medium"}, + "prompt_cache_options": {"mode": "explicit", "ttl": "30m"}, + "service_tier": "default", +} +``` + +Also assert null effort/verbosity omit both nested kwargs. No accepted request contains +`reasoning_mode`, `prompt_cache_key`, `prompt_cache_retention`, any other cache-control member, +`prompt_cache_breakpoint`, `tools`, `previous_response_id`, or `temperature` when temperature is +null, but every accepted request contains exactly `service_tier="default"`. Parameterize +`service_tier` as null, bool, integer, object, `auto`, `flex`, `priority`, and `ultrafast`; each must +fail strict request validation before the fake client records a call. An ambient project configured +for a different tier must not affect captured kwargs. + +Also add +`test_benchmark_request_bytes_provider_kwargs_and_capture_projection_are_identical` and +`test_recursive_breakpoint_key_is_rejected_under_every_instructions_or_input_object`. The first +constructs the one exact expected canonical byte literal without calling the production mapper, then +uses the identical package-exported `canonical_json_v1` owner on the frozen request-member projection, +returned kwargs, and captured projection and requires all four byte strings to be equal. It imports +that object and its error/parser companions through `laconian_eval.benchmark`, proves identity to +`benchmark.attachments`, and defines no local encoder. The second parameterizes `prompt_cache_breakpoint` at the +root and at two nested dict/list depths under both canonical `instructions` and `input`; every case +must fail before the fake client records a call. Repeat for `prompt_cache_key`, +`prompt_cache_retention`, and an unknown cache-control key. + +Add `test_standard_tier_bound_rejects_before_client_call`. Assert the pure bound counts UTF-8 bytes +rather than characters, accepts exact equality at 272,000, rejects one byte above it in +`OpenAIProvider._validate_request`, reports `delivery_certainty="definitely_not_sent"`, and leaves +the fake client's call list empty. Parameterize bool and negative byte counts against the pure helper. + +- [ ] **Step 2: Run the wire RED test** + +Run: + +```bash +uv run pytest tests/test_openai_provider.py::test_confirmatory_request_sends_exact_reasoning_verbosity_cache_and_service_tier tests/test_openai_provider.py::test_benchmark_request_bytes_provider_kwargs_and_capture_projection_are_identical tests/test_openai_provider.py::test_recursive_breakpoint_key_is_rejected_under_every_instructions_or_input_object tests/test_openai_provider.py::test_standard_tier_bound_rejects_before_client_call -q +``` + +Expected: FAIL because the request/cache/tier policy fields, exact cache and literal default-tier wire +mapping, and provider-side standard-tier rejection are absent. + +- [ ] **Step 3: Implement strict request fields and adapter validation** + +Construct only `PublicBenchmarkRequestV1` from the captured policy; do not widen or default the +legacy request. In `OpenAIProvider._validate_benchmark_request`, accept only exact strings from the +aliases, require policy `reasoning_mode == "omitted"`, `prompt_cache_mode == "explicit"`, +`prompt_cache_ttl == "30m"`, and `service_tier == "default"`, then compute strict UTF-8 +instruction/prompt byte lengths and reject a conservative bound above 272,000 before calling the +client. + +Implement `OpenAIProvider.generate_benchmark(request: PublicBenchmarkRequestV1) -> +PublicBenchmarkProviderOutcomeV1` without changing legacy `generate`. In that benchmark-only method, +implement the recursive validator and call both it and the sole Task 2-owned serializer builder: + +```python +def _assert_no_public_benchmark_cache_control(value: object) -> None: + """Recursively reject breakpoint/key/retention and every unapproved cache-control key.""" +``` + +Run the recursive validator on the exact canonical `instructions` and `input` trees before +building the mapping. Encode canonical request bytes and the capture projection from that same +mapping; no independently maintained second cache/tier projection is permitted. Add only nonnull +effort/verbosity: + +```python +if request.reasoning_effort is not None: + kwargs["reasoning"] = {"effort": request.reasoning_effort} +if request.text_verbosity is not None: + kwargs["text"] = {"verbosity": request.text_verbosity} +kwargs["prompt_cache_options"] = { + "mode": request.policy.prompt_cache_mode, + "ttl": request.policy.prompt_cache_ttl, +} +kwargs["service_tier"] = request.policy.service_tier +``` + +Update capsule request reconstruction in `execution.py` to construct the versioned benchmark policy +from all captured resolved fields. Do not change the legacy runner request builder or bytes. + +- [ ] **Step 4: RED-test cache-write, reasoning, and returned-tier evidence** + +Add OpenAI response fixtures whose `usage.input_tokens_details.cache_write_tokens` is respectively +`0`, `3`, absent, `-1`, `True`, and large enough that cached plus cache-write exceeds input. Assert: + +```text +0 -> cache_write_tokens=0, cache_write_status=reported_zero +3 -> cache_write_tokens=3, cache_write_status=reported_nonzero; preserve the usable response +absent -> cache_write_tokens=null, cache_write_status=missing +-1 -> malformed provider usage; preserve no trusted zero +True -> malformed provider usage; preserve no trusted zero +sum-big -> malformed provider usage; preserve no trusted zero +``` + +The same `input_tokens_details` fixture always carries an independently asserted +`cached_tokens`. Add fixtures whose `usage.output_tokens_details.reasoning_tokens` is respectively +`7`, absent, `-1`, `True`, and greater than `output_tokens`. Assert the adapter produces: + +```text +7 -> reasoning_tokens=7, reasoning_token_accounting=reported +absent -> reasoning_tokens=null, reasoning_token_accounting=not_reported +-1 -> reasoning_tokens=null, reasoning_token_accounting=invalid +True -> reasoning_tokens=null, reasoning_token_accounting=invalid +too-big -> reasoning_tokens=null, reasoning_token_accounting=invalid +``` + +Every valid response becomes `PublicBenchmarkResponseEvidenceV1`; legacy `GenerationResult` bytes +and constructors remain unchanged. + +In `tests/capsule/test_attempts_v2.py`, add: + +```python +@pytest.mark.parametrize( + ("reasoning_tokens", "accounting", "expected"), + [ + (7, "reported", 13), + (0, "reported", 20), + (None, "not_reported", None), + (None, "invalid", None), + ], +) +def test_visible_output_tokens_require_valid_reasoning_breakdown( + reasoning_tokens: int | None, + accounting: str, + expected: int | None, +) -> None: + usage = AttemptUsageV2( + input_tokens=5, + output_tokens=20, + total_tokens=25, + cache_read_tokens=0, + cache_write_tokens=0, + ordinary_uncached_input_tokens=5, + reasoning_tokens=reasoning_tokens, + availability="complete", + source="provider", + cache_read_status="reported_zero", + cache_write_status="reported_zero", + reasoning_token_accounting=accounting, + ) + assert visible_output_tokens(usage) == expected +``` + +Add `test_attempt_usage_tracks_cache_reads_and_writes_independently`. Accept reported `(read, +write)` pairs `(0, 0)`, `(2, 0)`, and `(0, 2)` plus a `missing` null write count. Reject a reported +null count, an unreported nonnull count, either count above input, and a combined read/write count +above input. Canonical round trips must retain a nonzero write count exactly. + +Add `test_openai_returned_service_tier_is_preserved_and_classified` with otherwise valid response +fixtures. Assert this exact matrix without altering output, delivery, or valid usage evidence: + +```text +"default" -> returned_service_tier="default", service_tier_status=reported_default +"priority" -> returned_service_tier="priority", service_tier_status=mismatch +absent -> returned_service_tier=null, service_tier_status=missing +blank -> returned_service_tier=null, service_tier_status=missing +True -> returned_service_tier=null, service_tier_status=missing +object -> returned_service_tier=null, service_tier_status=missing +over-limit -> returned_service_tier=null, service_tier_status=missing +``` + +Add independent applied/read/write RED matrices. Applied values are exact `explicit`/`30m`, missing, +mismatched, or malformed and must map to `reported_exact`, `missing`, `mismatch`, or `invalid`. +Read and write values cover zero, positive, absent, bool, negative, over-input, inconsistent sum, +and bad source digest. Assert the exact canonical response paths and reject every alternate path. +Also assert `requested_model_id` and `returned_model_id` plus source digest round-trip; returned IDs +may differ from requested IDs, while later consistency is deliberately outside this task. + +Use the existing bounded/control-safe provider-metadata policy for returned strings. Add a response +that has a safe tier but later fails output or usage validation; the resulting +`PublicBenchmarkProviderErrorEvidenceV1` must still expose the sanitized returned tier and derived +status. Missing or mismatched tier is permanent +policy evidence, never a transient provider error and never an automatic retry reason. + +In `tests/capsule/test_attempts_v2.py`, add +`test_raw_attempt_service_tier_matrix_is_strict_and_preserves_billable_evidence`. Assert every valid +row has `requested_service_tier="default"`; the three received-response status/value combinations above round-trip +canonically; every inconsistent combination is rejected. Normalize adversarial +`PublicBenchmarkResponseEvidenceV1` and `PublicBenchmarkProviderErrorEvidenceV1` instances with +`requested_service_tier="default"` and prove normalization derives +the status rather than trusting an injected status. Add both no-response cases: a definitely-not-sent +configuration failure becomes `not_applicable_definitely_not_sent`, and a structured +`definitely_rejected` 429 becomes `not_applicable_definitely_rejected`; both have null +`returned_service_tier` and unavailable usage, while the 429 retains its request ID and exact error +evidence. Reject either not-applicable status for `response_received`/`unknown`, the wrong delivery +certainty, a nonnull returned tier, or any usage count. For a mismatch, omission, and unsafe value on delivered/unknown work, assert +`delivery_certainty`, usage, cache-write counts, output/discard hashes, and provider request ID remain +intact. The public-campaign handoff must expose those fail-closed statuses as forbidding reservation +release; it must keep both not-applicable statuses distinguishable so the runtime's exact +definite-rejection retry policy remains possible. The runtime slice owns both the durable STOP and +retry transitions. + +- [ ] **Step 5: Run the usage RED gate** + +Run: + +```bash +uv run pytest tests/test_openai_provider.py -k 'cache_write_tokens or reasoning_tokens or cache_policy or service_tier' tests/capsule/test_attempts_v2.py::test_visible_output_tokens_require_valid_reasoning_breakdown tests/capsule/test_attempts_v2.py::test_attempt_usage_tracks_cache_reads_and_writes_independently tests/capsule/test_attempts_v2.py::test_raw_attempt_service_tier_matrix_is_strict_and_preserves_billable_evidence -q +``` + +Expected: FAIL because the benchmark outcome records, normalized evidence, and +`RawAttemptV2` do not expose the required cache-write/reasoning/tier evidence and the visible-token +helper is absent. + +- [ ] **Step 6: Implement exact applied/read/write/reasoning/tier/model evidence without hiding usable evidence** + +Parse only the nine canonical cache/tier/usage response paths listed in the stable interface, plus +the separately frozen `response.model` path solely for returned-model evidence. Derive +`AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, and `ServiceTierStatus` from raw +values and delivery evidence; never accept status text from fixtures or provider objects. Preserve +one raw-response source digest per applied/read/write/tier/usage/reasoning/model field even when the +sanitized value is null. Do not infer one cache dimension from another and never convert missing to +zero. + +Add `ReasoningTokenAccounting` and `_optional_reasoning_count(raw_usage, output_tokens)` in +`openai.py`. The helper returns `(count, "reported")`, `(None, "not_reported")`, or +`(None, "invalid")`; it records the defect without raising a legacy `ProviderError`. + +Add the benchmark outcome records and fields shown in the stable interface; do not alter legacy +`GenerationResult` or `ProviderError` bytes. In `openai.py`, read `response.service_tier` independently +before later response/content/usage checks. Exact bounded `default` becomes `reported_default`; +another safe bounded string becomes `mismatch` and is preserved; absence or an unsafe/unrepresentable +value becomes `missing` with no unsafe value serialized. Copy the derived fields into every +`PublicBenchmarkResponseEvidenceV1` and `PublicBenchmarkProviderErrorEvidenceV1`. Never infer the requested tier from a missing response field, +never coerce a value, and never discard usage/delivery evidence because the status is not +`reported_default`. +For a benchmark provider-error evidence record created before any Responses object exists, derive +`not_applicable_definitely_not_sent` or `not_applicable_definitely_rejected` only when delivery exactly +matches that suffix and provider usage is wholly unavailable. An `unknown` delivery with no returned +tier remains `missing` and therefore retains worst-case exposure; do not use either not-applicable +status as a generic missing-value default. + +Extend `AttemptUsageV2`, `_unavailable_provider_usage`, `_normalize_provider_usage`, raw payload +helpers, and class-bound checks with `cache_read_tokens`, `cache_write_tokens`, +`ordinary_uncached_input_tokens`, and the two independent statuses. Extend `NormalizedProviderEvidenceV2`, `_constant_normalized_error`, +`_normalize_benchmark_result`, `_normalize_benchmark_error`, +`normalize_public_benchmark_outcome`, all raw-attempt constructors, +and `RawAttemptV2` with requested/returned service tier and status. The normalization entry point +requires `requested_service_tier: ServiceTier`, class-bound revalidates literal `default`, and +independently enforces the delivery-aware status/value matrix; it does not trust a dataclass annotation +or supplied status. Enforce the cache matrix described in the stable interface plus this exact cache +validation before the reasoning matrix: + +```python +reported = {"reported_zero", "reported_nonzero"} +for status, count in ( + (self.cache_read_status, self.cache_read_tokens), + (self.cache_write_status, self.cache_write_tokens), +): + if (status in reported) != (count is not None): + raise ValueError("cache status/value mismatch") + if status == "reported_zero" and count != 0: + raise ValueError("reported_zero requires exact zero") + if status == "reported_nonzero" and (count is None or count <= 0): + raise ValueError("reported_nonzero requires a positive count") +if self.input_tokens is not None: + expected = self.input_tokens - (self.cache_read_tokens or 0) - (self.cache_write_tokens or 0) + if expected < 0 or self.ordinary_uncached_input_tokens != expected: + raise ValueError("ordinary uncached input is inconsistent") +``` + +Then enforce this exact reasoning matrix: + +```python +if self.reasoning_token_accounting == "reported": + if ( + self.reasoning_tokens is None + or self.output_tokens is None + or self.reasoning_tokens > self.output_tokens + ): + raise ValueError("reported reasoning accounting requires a consistent count") +elif self.reasoning_tokens is not None: + raise ValueError("unreported or invalid reasoning accounting forbids a count") +``` + +Add exact applied mode/TTL, read/write/reasoning/tier, requested/returned model, and independent +source digests to replay fixtures. Update every confirmatory fixture to echo explicit/30m, read zero, +write zero, literal returned default tier, an exact requested model ID, and a separately consistent +returned model ID. Replay derives every status and may not accept a fixture-supplied override. + +Export `ServiceTier`, `AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, and +`ServiceTierStatus` from `laconian_eval.providers`, list each exactly +once in `__all__`, and pin those public objects and the appended result/error fields in +`tests/test_public_contract.py`. This is the sole public export surface; do not create a second tier +alias in another provider module. + +- [ ] **Step 7: Prove request reconstruction and legacy compatibility** + +In `tests/capsule/test_execution.py`, extend the existing reconstructed-request assertion with: + +```python +assert request.reasoning_effort == "medium" +assert request.text_verbosity == "medium" +assert request.policy.reasoning_mode == "omitted" +assert request.policy.prompt_cache_mode == "explicit" +assert request.policy.prompt_cache_ttl == "30m" +assert request.policy.service_tier == "default" +``` + +For a default-tier response, also assert the committed `RawAttemptV2` has +`requested_service_tier == returned_service_tier == "default"` and +`service_tier_status == "reported_default"`. Repeat with a safe non-default returned tier and prove the +canonical attempt retains it with `mismatch`, makes no retry of that plan item, and exposes the +non-`reported_default` status to the runtime policy boundary without releasing or rewriting any usage +evidence. + +Run: + +```bash +uv run pytest tests/test_public_contract.py tests/test_openai_provider.py tests/test_providers.py tests/capsule/test_attempts_v2.py tests/capsule/test_execution.py tests/test_runner.py tests/test_reporting.py -q +``` + +Expected: PASS. Existing legacy report expectations remain unchanged, while public-campaign capsule +evidence retains cache-write counts and requested/returned service-tier status for the later spend +ledger. Only `reported_default` is eligible for trusted-usage reconciliation; the two exact +not-applicable states carry no usage and preserve definite non-delivery/rejection semantics. + +- [ ] **Step 8: Commit wire and token evidence** + +```bash +git add src/laconian_eval/providers/base.py src/laconian_eval/providers/__init__.py src/laconian_eval/providers/openai.py src/laconian_eval/providers/replay.py src/laconian_eval/capsule/attempts.py src/laconian_eval/capsule/execution.py tests/test_public_contract.py tests/test_openai_provider.py tests/test_providers.py tests/fixtures/replay-responses.yaml tests/capsule/test_attempts_v2.py tests/capsule/test_execution.py tests/capsule_helpers.py +git commit -m "feat: bind cache policy and token-tier evidence" +``` + +### Task 4: Bind literal default-tier policy and conservative input exposure into stable parent plan identities + +**Files:** +- Modify: `src/laconian_eval/capsule/record_models.py` +- Modify: `src/laconian_eval/capsule/planning.py` +- Modify: `src/laconian_eval/capsule/prepare.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `src/laconian_eval/capsule/execution.py` +- Modify: `tests/capsule/test_record_models.py` +- Modify: `tests/capsule/test_planning.py` +- Modify: `tests/capsule/test_prepare.py` +- Modify: `tests/capsule/test_verify_prepared.py` +- Modify: `tests/capsule/test_execution.py` +- Modify: `tests/capsule_helpers.py` + +- [ ] **Step 1: RED-test stable parent identities independently of run UUIDs** + +Replace the run-bound golden in `tests/capsule/test_planning.py` with `test_parent_plan_ids_are_stable_across_capsule_runs`. Materialize the same resolved manifest/case index/arms after generating two distinct UUID4 values for unrelated capsule runs, and assert the same `PlanRowV1` tuple and byte-identical `plan_jsonl` result. The test must call the new interface only with `parent_manifest_sha256`: + +```python +first = materialize_parent_plan( + parent_manifest_sha256=SHA_A, + resolved_manifest=manifest, + case_index=case_index, + captured_arms=arms, +) +second = materialize_parent_plan( + parent_manifest_sha256=SHA_A, + resolved_manifest=manifest, + case_index=case_index, + captured_arms=arms, +) +assert first == second +assert plan_jsonl(first) == plan_jsonl(second) +``` + +Add a second test changing only `parent_manifest_sha256` from `SHA_A` to `SHA_B`; assert every plan item, block, and pairing identity changes while row ordering, request field hashes, and input-token bounds remain equal. + +- [ ] **Step 2: RED-test the exact independent digest preimages** + +For one fixed case/repetition/arm, construct the three mappings from the stable-interface section using a tiny independent `json.dumps(sort_keys=True, separators=(",", ":"), ensure_ascii=False)` encoder plus explicit domain prefix. Assert exact equality with production `block_id`, `pairing_unit_id`, and `plan_item_id`; the plan-item preimage includes the exact integer `input_token_bound`. + +Add `test_case_index_and_plan_bind_default_service_tier_and_input_bound`. Assert the independently +constructed `request_config_sha256` preimage contains `service_tier: default` in both its generation +and exact-wire positions, and that every plan-item preimage binds that request-config digest. A +manifest with an omitted or non-default resolved tier must fail before plan materialization. Then use +ASCII and Cyrillic prompts to prove `prompt_utf8_bytes` counts strict UTF-8 bytes, not code points. For +a baseline arm, independently calculate: + +```python +expected_bound = case_index[0].prompt_utf8_bytes + len(arm.instruction_bytes) + 65_536 +assert parent_plan[0].input_token_bound == expected_bound +``` + +Create a one-row baseline fixture whose bound equals exactly 272,000 and assert it materializes. +Increase only the prompt by one ASCII byte and assert the `PlanningError.code` is exactly +`public_benchmark_input_bound_exceeded`. Forge only `prompt_utf8_bytes` or `input_token_bound` in otherwise +valid canonical rows and require case-index/plan validation to reject them. + +Run: + +```bash +uv run pytest tests/capsule/test_planning.py::test_parent_plan_ids_are_stable_across_capsule_runs tests/capsule/test_planning.py::test_parent_identity_preimages_are_exact tests/capsule/test_planning.py::test_case_index_and_plan_bind_default_service_tier_and_input_bound tests/capsule/test_record_models.py -q +``` + +Expected: FAIL because `materialize_parent_plan`, both bound fields, and the standard-tier rejection +are absent and current IDs require `run_id`. + +- [ ] **Step 3: Implement the stable parent plan API** + +Replace the three `run_id` preimages with the exact domain-separated mappings above. Rename `materialize_plan` to `materialize_parent_plan` and `validate_plan` to `validate_parent_plan`; both use the stable keyword-only signatures and class-bound validate `parent_manifest_sha256` as lowercase SHA-256. + +Add `prompt_utf8_bytes` and `input_token_bound` to the strict record models shown in the stable +interface. `materialize_case_index` computes the former while hashing the exact prompt. For every +case/arm row, `materialize_parent_plan` calls `conservative_input_token_bound` with the indexed prompt +bytes and `len(arm.instruction_bytes)`, rejects a result above +`OPENAI_STANDARD_TIER_MAX_INPUT_TOKENS`, stores it on the row, and passes it into `plan_item_id`. +`validate_parent_plan` independently repeats the complete derivation; it never trusts a supplied +bound. + +Keep the seeded arm-order algorithm, row ordering, case/instruction hashes, and output-token exposure +limits unchanged. Do not add `run_id` or `campaign_id` to a parent row. The cache/literal-default-tier +policy and bound algorithm/version are already part of `request_config_sha256`; every row binds that +digest, and the row-specific bound is also part of the plan-item preimage. + +- [ ] **Step 4: Thread the manifest digest through preparation and verification** + +In `prepare.py`, pass the already computed `manifest_sha256` to `materialize_parent_plan`. In +`verify.py`, pass `capsule.manifest_sha256` to `validate_parent_plan`. Update all direct test callers, +record payload builders, canonical key-order assertions, and independent goldens. + +In `execution.py`, after recovering the verified captured case and arm but before constructing the +request, require the resolved manifest's literal default service tier, reconstruct that exact field, +recompute the conservative bound from the exact strings, and require equality with +`row.input_token_bound`. Add execution tests forging only the row bound, omitting/altering the +resolved tier, and using an oversized captured request; all must fail before the provider fake records +a call. + +Add `test_two_preparations_have_distinct_runs_but_identical_parent_plans` to `tests/capsule/test_prepare.py`; prepare the same fake manifest twice into one results root and assert: + +```python +assert first.run_id != second.run_id +assert (first.path / "plan.jsonl").read_bytes() == (second.path / "plan.jsonl").read_bytes() +``` + +- [ ] **Step 5: Run planning, preparation, verification, and resume regressions** + +Run: + +```bash +uv run pytest tests/capsule/test_record_models.py tests/capsule/test_planning.py tests/capsule/test_prepare.py tests/capsule/test_verify_prepared.py tests/capsule/test_execution.py tests/capsule/test_resume.py -q +``` + +Expected: PASS. Attempt IDs still differ between the two prepared runs because attempt identity remains run-bound. + +- [ ] **Step 6: Commit stable parent identities** + +```bash +git add src/laconian_eval/capsule/record_models.py src/laconian_eval/capsule/planning.py src/laconian_eval/capsule/prepare.py src/laconian_eval/capsule/verify.py src/laconian_eval/capsule/execution.py tests/capsule/test_record_models.py tests/capsule/test_planning.py tests/capsule/test_prepare.py tests/capsule/test_verify_prepared.py tests/capsule/test_execution.py tests/capsule_helpers.py +git commit -m "feat: bind default-tier parent plan exposure" +``` + +### Task 5: Define ShardPlanV1 and prove the exact 36-by-40 projection + +**Files:** +- Create: `src/laconian_eval/capsule/sharding.py` +- Modify: `src/laconian_eval/capsule/schema.py` +- Modify: `src/laconian_eval/capsule/record_models.py` +- Modify: `src/laconian_eval/capsule/prepare.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `tests/capsule_helpers.py` +- Create: `tests/capsule/test_sharding.py` +- Modify: `tests/capsule/test_record_models.py` +- Modify: `tests/capsule/test_prepare.py` +- Modify: `tests/capsule/test_verify_prepared.py` + +- [ ] **Step 1: RED-test strict ShardPlanV1 shape and self-hash** + +Create `tests/capsule/test_sharding.py` with `test_shard_plan_round_trips_exact_shape`. Build a complete 40-ID payload and assert the serialized key order shown in the stable interface. Parameterize rejection of: + +```text +unknown field +uppercase or short digest +blank model_id +missing one of the exact three public model IDs +extra or substitute model ID +duplicate ordered_plan_item_ids +row_count unequal to tuple length +unknown derivation_version +forged shard_plan_sha256 +bool row_count +``` + +Independently compute the expected self-hash from the exact preimage above. + +- [ ] **Step 2: Run the model RED gate** + +Run: + +```bash +uv run pytest tests/capsule/test_sharding.py::test_shard_plan_round_trips_exact_shape -q +``` + +Expected: FAIL during collection with `ModuleNotFoundError: No module named 'laconian_eval.capsule.sharding'`. + +- [ ] **Step 3: Implement strict shard schema and pure projection** + +Create `sharding.py` with `ShardPlanError`, `ShardPlanV1`, `project_shard_plans`, `materialize_shard_projection`, and `validate_public_generation_partition` using the stable interfaces. + +`project_shard_plans` must: + +1. class-bound revalidate the resolved manifest, case index, captured arms, and every parent row; +2. verify the parent plan using `validate_parent_plan(parent_plan, parent_manifest_sha256=parent_manifest_sha256, resolved_manifest=resolved_manifest, case_index=case_index, captured_arms=captured_arms)` before grouping; +3. compute `parent_plan_sha256 = sha256_bytes(plan_jsonl(parent_plan))`; +4. order scenario groups by the first parent ordinal at which each scenario appears; +5. retain within-group parent order exactly; +6. require each ordered ID to occur once in the parent plan; and +7. build each self-hash from the exact canonical preimage. + +`materialize_shard_projection` maps each requested ID to exactly one parent row and creates local rows with only `ordinal` changed to `0..row_count-1`. + +`validate_public_generation_partition` requires exactly three parents of 480 rows, 36 shards of 40 rows, 12 shards per distinct model, disjoint IDs within each parent, and an ordered concatenation per parent equal to that parent's scenario-group order. Cross-model IDs must also be distinct because requested model participates in `request_config_sha256`. + +- [ ] **Step 4: RED-test the public partition from three native-v2 models** + +Build three resolved manifests from `resolved_manifest_v2_payload()` with models `gpt-5.6-sol`, +`gpt-5.6-terra`, and `gpt-5.6-luna`, all four arms, five repetitions, 24 case-index rows, +`reasoning_effort="medium"`, `text_verbosity="medium"`, `reasoning_mode="omitted"`, +`prompt_cache_mode="explicit"`, `prompt_cache_ttl="30m"`, `service_tier="default"`, +`max_output_tokens=1024`, and null temperature. Materialize 480 parent rows per model, assert every +row's request-config identity binds the literal default tier, assert every row's input-token bound is +at most 272,000, and project all shards. + +Assert: + +```python +assert [len(parent) for parent in parents] == [480, 480, 480] +assert len(shards) == 36 +assert {shard.row_count for shard in shards} == {40} +assert sum(shard.row_count for shard in shards) == 1440 +assert {shard.model_id for shard in shards} == {"gpt-5.6-sol", "gpt-5.6-terra", "gpt-5.6-luna"} +``` + +Delete each requested model, add a fourth, and substitute any nonliteral model independently; +`validate_public_generation_partition` must reject every case before hashing or projection. + +For every shard projection assert exactly two locales, four arms, five repetitions, one scenario UID, and no duplicate `(case_uid, repetition, arm)` key. Then call `validate_public_generation_partition`. + +Run: + +```bash +uv run pytest tests/capsule/test_sharding.py::test_three_model_public_partition_is_exactly_36_by_40 -q +``` + +Expected: FAIL until `validate_public_generation_partition` implements the complete coverage contract. + +- [ ] **Step 5: RED-test captured shard preparation rather than selective execution** + +Add strict planning input roles to the test payloads: + +```python +{ + "role": "parent_plan", + "role_ordinal": 0, + "logical_locator": "preflight.parent_plan", + "capsule_path": "inputs/planning/parent-plan.jsonl", + "byte_length": len(parent_plan_bytes), + "sha256": sha256_bytes(parent_plan_bytes), + "dataset_id": None, + "binding_id": None, +} + +{ + "role": "shard_plan", + "role_ordinal": 0, + "logical_locator": "preflight.shard_plan", + "capsule_path": "inputs/planning/shard-plan.json", + "byte_length": len(shard_plan_bytes), + "sha256": sha256_bytes(shard_plan_bytes), + "dataset_id": None, + "binding_id": None, +} +``` + +Add `test_prepare_shard_capsule_captures_parent_and_exact_projection` to `tests/capsule/test_prepare.py`. Write a parent plan and one shard plan to source files, call `prepare_shard_capsule`, and assert the two captured bytes are exact, `plan.jsonl` has 40 local ordinals, and every plan item ID equals the shard's ordered IDs. + +Add rejection cases for a modified parent byte, modified shard byte, wrong model, wrong manifest hash, wrong parent hash, nonmember ID, reordered ID, 39 rows, 41 rows, and scenario mismatch. + +- [ ] **Step 6: Implement planning-input capture and projection verification** + +Extend `InputRole` with `parent_plan` and `shard_plan`. In `InputFileRecordV1.validate_role_contract`, require the exact ordinal, locator, path, and null ownership fields shown above. Add `inputs/planning` to the exact tree policy used by current verification. + +Implement `PrepareShardRequest` and `prepare_shard_capsule` as a common preparation path that: + +1. captures and resolves the manifest normally; +2. recomputes the complete stable parent plan from captured cases and arms; +3. bounded-reads both caller-supplied planning files without following links; +4. requires canonical parent JSONL bytes equal the recomputation; +5. validates the canonical shard JSON and its self-hash; +6. materializes only the exact projection into `plan.jsonl`; +7. adds both planning inputs to `inputs/index.json`; and +8. preserves the existing random capsule run/operation IDs and atomic preparation flow. + +In `verify.py`, select full-parent validation when neither planning input exists and shard validation when both exist. One missing planning input is `missing_path`; an unexpected planning path or role is `unexpected_path`; any parent/shard/projection mismatch is `plan_mismatch`. + +- [ ] **Step 7: Run shard, preparation, and verifier regressions** + +Run: + +```bash +uv run pytest tests/capsule/test_sharding.py tests/capsule/test_record_models.py tests/capsule/test_prepare.py tests/capsule/test_verify_prepared.py tests/capsule/test_execution.py tests/capsule/test_resume.py -q +``` + +Expected: PASS. Execution sees exactly 40 plan rows for a shard capsule and cannot reach any of the other 440 parent rows. + +- [ ] **Step 8: Commit immutable scenario projections** + +```bash +git add src/laconian_eval/capsule/sharding.py src/laconian_eval/capsule/schema.py src/laconian_eval/capsule/record_models.py src/laconian_eval/capsule/prepare.py src/laconian_eval/capsule/verify.py tests/capsule_helpers.py tests/capsule/test_sharding.py tests/capsule/test_record_models.py tests/capsule/test_prepare.py tests/capsule/test_verify_prepared.py +git commit -m "feat: add immutable scenario shard plans" +``` + +### Task 6: Extract one capsule tree policy and derive strict SealV1 bytes + +**Files:** +- Create: `src/laconian_eval/capsule/tree_policy.py` +- Create: `src/laconian_eval/capsule/seal_models.py` +- Modify: `src/laconian_eval/capsule/schema.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Create: `tests/capsule/test_tree_policy.py` +- Create: `tests/capsule/test_seal_models.py` +- Modify: `tests/capsule_helpers.py` + +- [ ] **Step 1: RED-test the shared tree grammar** + +Create `tests/capsule/test_tree_policy.py` and import: + +```python +from laconian_eval.capsule.tree_policy import capsule_path_kind +``` + +Assert these exact classifications: + +```python +@pytest.mark.parametrize( + ("path", "kind"), + [ + (".laconian.lock", "file"), + ("capsule.json", "file"), + ("inputs/planning", "directory"), + ("inputs/planning/parent-plan.jsonl", "file"), + ("inputs/planning/shard-plan.json", "file"), + ("seal.json", "file"), + (".seal.123e4567-e89b-42d3-a456-426614174000.tmp", "file"), + ("inputs/cases/000.yaml", "file"), + ("inputs/protocols/000-0123456789abcdef.bin", "file"), + ("inputs/software/runner/laconian_eval/providers/openai.py", "file"), + ], +) +def test_capsule_path_kind_accepts_exact_owned_grammar(path: str, kind: str) -> None: + assert capsule_path_kind(path) == kind +``` + +Reject with `None`: empty path, root marker `/`, absolute path, backslash, NUL, non-NFC spelling, empty component, dot component, parent component, malformed ordinal, malformed seal UUID, unknown top-level path, and a file with a child. Verifier and archive tests separately reject a header or filesystem kind that differs from this function's returned kind. + +Run: + +```bash +uv run pytest tests/capsule/test_tree_policy.py -q +``` + +Expected: FAIL during collection because `tree_policy.py` does not exist. + +- [ ] **Step 2: Move the exact path grammar out of verify.py** + +Create `tree_policy.py` with one public pure function: + +```python +MemberKind = Literal["file", "directory"] + + +def capsule_path_kind(path: str) -> MemberKind | None: + """Classify one normalized possible capsule member without reading the filesystem.""" +``` + +Move the fixed file/directory sets and the case, protocol, runner-source, and seal-temp regular expressions from `verify.py`. Add the two planning files, `inputs/planning`, `seal.json`, and the strict lowercase canonical UUID4 seal temporary. Validate the whole relative POSIX path before applying patterns. Keep semantic required-member calculation in `verify.py`; this function answers only whether a member can ever belong to a capsule and which path type it may have. + +Replace `_file_allowed` and `_directory_allowed` calls in `verify.py` with this shared classifier. Run: + +```bash +uv run pytest tests/capsule/test_tree_policy.py tests/capsule/test_verify_prepared.py -q +``` + +Expected: PASS with no change to current unsealed verification outcomes. + +- [ ] **Step 3: RED-test the complete strict seal schema** + +Create `tests/capsule/test_seal_models.py` with a valid payload containing the exact field order from Section 17: + +```python +{ + "seal_schema_version": "1", + "run_id": UUID_A, + "seal_transaction_id": UUID_B, + "generation_status": "complete", + "structural_integrity": "valid", + "missing_plan_item_ids": [], + "operational_blocker_codes": [], + "never_started_detail": None, + "disclosures": { + "source_state": "clean", + "returned_models": ["gpt-5.6-sol-2026-08-30"], + "usage_availability_counts": { + "complete": 40, + "partial": 0, + "unavailable": 0, + }, + "redacted_output_attempt_count": 0, + "redacted_output_replacement_count": 0, + "dataset_ids": ["response-public-v1"], + "protocol_binding_ids": [], + }, + "final_event_sequence": 83, + "raw_attempt_count": 40, + "sealed_at": "2026-08-30T12:34:56.123456Z", + "files": [ + {"path": "capsule.json", "byte_length": 321, "sha256": SHA_A}, + {"path": "events.jsonl", "byte_length": 654, "sha256": SHA_B}, + ], +} +``` + +Assert frozen/strict/extra-forbid behavior, canonical key order, UTF-8 sorting, unique arrays, exact blocker order, usage-count sum, complete/incomplete relations, never-started detail relation, inventory exclusions, canonical timestamp, UUID4 boundaries, and class-bound rejection of `model_construct` for nested models. + +The exact incomplete matrix is: + +```text +never_started -> nonempty missing IDs, sole blocker, nonnull detail +interrupted -> nonempty missing IDs, sole blocker, null detail +ambiguous_inflight -> nonempty missing IDs, sole blocker, null detail +authentication_stopped -> nonempty missing IDs, sole blocker, null detail +``` + +Run: + +```bash +uv run pytest tests/capsule/test_seal_models.py::test_seal_v1_round_trips_exact_shape -q +``` + +Expected: FAIL during collection because `seal_models.py` does not exist. + +- [ ] **Step 4: Implement SealV1 structural models** + +Define these exact models in `seal_models.py`: + +```python +class SealFileV1(CapsuleModel): + path: RelativePosixPath + byte_length: StrictNonNegativeInt + sha256: Sha256 + + +class SealUsageAvailabilityCountsV1(CapsuleModel): + complete: StrictNonNegativeInt + partial: StrictNonNegativeInt + unavailable: StrictNonNegativeInt + + +class SealDisclosuresV1(CapsuleModel): + source_state: Literal["clean", "dirty", "unbound", "unavailable"] + returned_models: tuple[BoundedNonBlankString, ...] + usage_availability_counts: SealUsageAvailabilityCountsV1 + redacted_output_attempt_count: StrictNonNegativeInt + redacted_output_replacement_count: StrictNonNegativeInt + dataset_ids: tuple[BoundedNonBlankString, ...] + protocol_binding_ids: tuple[BoundedNonBlankString, ...] + + +class SealV1(CapsuleModel): + seal_schema_version: Literal["1"] + run_id: UUID4 + seal_transaction_id: UUID4 + generation_status: Literal["complete", "incomplete"] + structural_integrity: Literal["valid"] + missing_plan_item_ids: tuple[Sha256, ...] + operational_blocker_codes: tuple[OperationalBlocker, ...] + never_started_detail: ( + Literal[ + "credential_unavailable", + "provider_unavailable", + "operator_abandoned", + ] + | None + ) + disclosures: SealDisclosuresV1 + final_event_sequence: StrictNonNegativeInt + raw_attempt_count: StrictNonNegativeInt + sealed_at: CanonicalTimestamp + files: tuple[SealFileV1, ...] = Field(min_length=1) +``` + +Use the existing fixed-order and UTF-8-sorted-unique helpers. Reject `.laconian.lock`, `seal.json`, and every `.seal..tmp` inventory path. + +- [ ] **Step 5: RED-test deterministic derivation from validated history** + +Build complete, prepared-never-started, interrupted, ambiguous, and authentication histories with existing capsule history helpers. Add `test_derive_seal_v1_is_a_total_projection_of_validated_history` and assert: + +```text +seal transaction/status/time/final sequence -> sole seal_requested event +missing IDs/blocker -> lifecycle projection +raw_attempt_count -> committed raw rows +usage counts -> every committed raw row +returned_models -> distinct successful response_model values +redaction counts -> raw disclosure fields +dataset/protocol IDs -> resolved manifest declarations +source_state -> environment checkout/git state table +files -> exact supplied preseal inventory +``` + +Call `derive_seal_v1` twice with equal validated values and assert byte-identical `seal_bytes` and equal `capsule_sha256`. + +Run: + +```bash +uv run pytest tests/capsule/test_seal_models.py::test_derive_seal_v1_is_a_total_projection_of_validated_history -q +``` + +Expected: FAIL because `derive_seal_v1` is absent. + +- [ ] **Step 6: Implement derivation and content-free failures** + +Implement `SealModelError(code)` with literal message `capsule seal rejected`. Class-bound revalidate every input before reading fields. Require the supplied seal request to be the validated history's sole seal request and require its expected status to match lifecycle completeness. + +Derive source state with this exact table: + +```python +if environment.checkout_binding == "unbound": + source_state = "unbound" +elif environment.checkout_binding == "bound" and environment.git_state in {"clean", "dirty"}: + source_state = environment.git_state +else: + source_state = "unavailable" +``` + +Sort every set-like array by exact UTF-8 bytes. Calculate the seal hash only from exact canonical seal bytes and never store it inside `SealV1`. + +Run: + +```bash +uv run pytest tests/capsule/test_tree_policy.py tests/capsule/test_seal_models.py tests/capsule/test_verify_prepared.py -q +``` + +Expected: PASS. + +- [ ] **Step 7: Commit tree policy and seal derivation** + +```bash +git add src/laconian_eval/capsule/tree_policy.py src/laconian_eval/capsule/seal_models.py src/laconian_eval/capsule/schema.py src/laconian_eval/capsule/verify.py tests/capsule/test_tree_policy.py tests/capsule/test_seal_models.py tests/capsule_helpers.py +git commit -m "feat: derive strict capsule seals" +``` + +### Task 7: Publish seals atomically and expose `laconian finalize` + +**Files:** +- Create: `src/laconian_eval/capsule/finalize.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `src/laconian_eval/cli.py` +- Create: `tests/capsule/test_finalize.py` +- Create: `tests/capsule/test_cli_finalize.py` + +- [ ] **Step 1: RED-test complete versus explicitly incomplete finalization** + +Create `tests/capsule/test_finalize.py` with: + +```python +def test_finalize_complete_capsule_publishes_one_deterministic_seal(complete_capsule: Path) -> None: + result = finalize_capsule(complete_capsule) + seal = SealV1.model_validate_json((complete_capsule / "seal.json").read_bytes()) + assert result.state == "SEALED_COMPLETE" + assert result.capsule_sha256 == sha256_bytes((complete_capsule / "seal.json").read_bytes()) + assert seal.generation_status == "complete" + assert seal.missing_plan_item_ids == () + assert seal.operational_blocker_codes == () + + +def test_finalize_incomplete_requires_explicit_flag(prepared_capsule: Path) -> None: + with pytest.raises(FinalizationError) as caught: + finalize_capsule(prepared_capsule) + assert caught.value.code == "incomplete_requires_flag" + assert not (prepared_capsule / "seal.json").exists() + + result = finalize_capsule(prepared_capsule, seal_incomplete=True) + assert result.state == "SEALED_BLOCKED" +``` + +Parameterize incomplete state expectations for never-started, interrupted, ambiguous, and authentication-stopped capsules. Assert finalization never creates an attempt or converts a missing plan item into a terminal outcome. + +- [ ] **Step 2: Run the finalizer RED gate** + +Run: + +```bash +uv run pytest tests/capsule/test_finalize.py::test_finalize_complete_capsule_publishes_one_deterministic_seal tests/capsule/test_finalize.py::test_finalize_incomplete_requires_explicit_flag -q +``` + +Expected: FAIL during collection because `finalize.py` does not exist. + +- [ ] **Step 3: Implement lock-owned history normalization and seal request** + +Create `FinalizationError(code)` with literal message `capsule finalization rejected`, `FinalizeResultV1`, public `finalize_capsule`, and an internal `_finalize_capsule` accepting a target-known callback plus injected POSIX crash seams for tests. + +Under one exclusive `.laconian.lock` ownership: + +1. descriptor-verify the capsule with journal tails reported; +2. apply the existing pure recovery plan so derivable finish, stop, ambiguity, and completion markers are fsynced in causal order; +3. reverify the exact normalized history; +4. reject unrequested incompleteness unless `seal_incomplete=True`; +5. append and fsync exactly one `seal_requested` event when absent; +6. reuse the committed transaction ID, expected status, and event timestamp when the request already exists; +7. forbid every execution event after the request; and +8. re-snapshot all preseal files by descriptor before deriving bytes. + +Generate a new UUID4 seal transaction distinct from run ID, invocation operation ID, and every execution-session ID. The seal event operation ID is the invocation operation ID and its execution session is null. + +- [ ] **Step 4: RED-test every atomic publication crash boundary** + +Inject failures at these exact points: + +```text +after seal_requested fsync +after temporary exclusive creation +during temporary write +after temporary file fsync +after link_noreplace publishes seal.json +after temporary unlink +during capsule-directory fsync +``` + +For each failure, retry `finalize_capsule` and assert one committed seal request, byte-identical derived seal bytes, no overwritten path, and at most the matching `.seal..tmp` residue. + +Add rejection tests for a mismatching temporary, a second temporary, wrong transaction name, existing nonregular `seal.json`, existing different seal bytes, and a same-name seal inode replacement. Every rejection preserves all evidence and performs no cleanup. + +Run: + +```bash +uv run pytest tests/capsule/test_finalize.py -k 'crash or residue or mismatch' -q +``` + +Expected: FAIL until the no-replace publication and retry state table are implemented. + +- [ ] **Step 5: Implement exact temporary/link/fsync behavior** + +Use the sole name `.seal..tmp`. Open it with `O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC`, mode `0600`; write all canonical bytes; fsync the file; recheck descriptor/path identity; call `PosixOps.link_noreplace(root_fd, temporary_name, root_fd, "seal.json")`; unlink the exact temporary by descriptor-validated name; fsync the capsule directory. + +On retry without `seal.json`, remove and recreate only a descriptor-validated mismatching temporary owned by the committed transaction. On retry with `seal.json`, require exact bytes; remove only an exact matching temporary, then fsync. Never overwrite `seal.json` and never accept a second seal request. + +- [ ] **Step 6: RED/GREEN the public CLI contract** + +Add parser coverage for: + +```bash +laconian finalize +laconian finalize --seal-incomplete +``` + +`tests/capsule/test_cli_finalize.py` must assert the absolute capsule path appears exactly once on stdout once the root/capsule identity is known; diagnostics appear only on stderr; complete and explicitly incomplete success exit 0; an operational post-publication fsync failure exits 1; usage, integrity, busy lock, unsupported local mutation filesystem, collision, and seal mismatch exit 2. + +Run: + +```bash +uv run pytest tests/capsule/test_cli_finalize.py -q +``` + +Expected RED: argparse exits 2 with `invalid choice: 'finalize'`. + +Add the parser, `_finalize` dispatcher, exact exception mapping, and one-shot announcement callback. Then run: + +```bash +uv run pytest tests/capsule/test_finalize.py tests/capsule/test_cli_finalize.py tests/capsule/test_cli_resume.py tests/test_cli.py -q +``` + +Expected: PASS. + +- [ ] **Step 7: Commit public finalization** + +```bash +git add src/laconian_eval/capsule/finalize.py src/laconian_eval/capsule/verify.py src/laconian_eval/cli.py tests/capsule/test_finalize.py tests/capsule/test_cli_finalize.py +git commit -m "feat: finalize generation capsules" +``` + +### Task 8: Verify sealed capsules without requiring a transport lock + +**Files:** +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `src/laconian_eval/capsule/record_models.py` +- Modify: `tests/capsule/test_verify_prepared.py` +- Create: `tests/capsule/test_verify_sealed.py` +- Modify: `tests/capsule/test_cli_finalize.py` + +- [ ] **Step 1: RED-test sealed-state selection and capsule hash** + +Create `tests/capsule/test_verify_sealed.py` and finalize one complete and one incomplete capsule. Assert: + +```python +complete = verify_capsule(complete_path, mode=VerificationMode.PREPARED) +blocked = verify_capsule(blocked_path, mode=VerificationMode.PREPARED) +assert complete.status == "valid" +assert complete.state == "SEALED_COMPLETE" +assert complete.capsule_sha256 == sha256_bytes((complete_path / "seal.json").read_bytes()) +assert blocked.status == "valid" +assert blocked.state == "SEALED_BLOCKED" +assert blocked.capsule_sha256 == sha256_bytes((blocked_path / "seal.json").read_bytes()) +``` + +Run: + +```bash +uv run pytest tests/capsule/test_verify_sealed.py::test_seal_presence_selects_sealed_verification -q +``` + +Expected: FAIL with `status=invalid`, `first_error.code=unexpected_path`, `first_error.path=seal.json`. + +- [ ] **Step 2: RED-test lockless verification before filesystem classification** + +Copy a sealed capsule, remove only `.laconian.lock`, and inject a filesystem classifier that raises `UnsupportedFilesystemError`. Assert verification remains valid, state/hash are unchanged, and warnings equal the existing warning order with `lock_file_omitted_for_sealed_transport` included once. + +Create the same lockless copy without `seal.json`; assert it is invalid with `missing_path` for `.laconian.lock`. Corrupt `seal.json` while leaving all preseal bytes valid; assert the verifier returns `seal_mismatch` and never falls back to mutable verification. + +Run: + +```bash +uv run pytest tests/capsule/test_verify_sealed.py::test_lockless_sealed_transport_bypasses_local_filesystem_requirement tests/capsule/test_verify_sealed.py::test_invalid_seal_never_falls_back_to_unsealed_verification -q +``` + +Expected: FAIL because public verification currently classifies the filesystem and opens the lock before inspecting seal presence. + +- [ ] **Step 3: Implement the sealed verification branch** + +After opening/rechecking the public root descriptors, inventory only enough top-level metadata to determine whether `seal.json` exists as a regular no-follow file. Presence selects the sealed branch before filesystem classification or lock acquisition. + +The sealed branch must: + +1. build a stable descriptor inventory using the shared tree policy; +2. parse strict canonical `SealV1`; +3. allow `.laconian.lock` to be present or absent and exclude it from the seal inventory; +4. require every preseal file path, byte length, and SHA-256 to equal the sorted seal inventory; +5. reject an extra, missing, duplicated, nonregular, or renamed member; +6. revalidate manifest, case index, full-parent or shard plan, environment, journal grammar, lifecycle, disclosures, and all derived seal fields; +7. derive `SEALED_COMPLETE` or `SEALED_BLOCKED` only from validated seal contents; +8. set `capsule_sha256` to SHA-256 of exact canonical `seal.json` bytes; and +9. recheck root/parent identities before returning. + +Keep mutable verification unchanged: supported local filesystem, shared lock, and `.laconian.lock` remain mandatory. + +- [ ] **Step 4: RED/GREEN the sole matching seal temporary rule** + +Test four sealed trees: + +```text +no temporary -> valid +one same-byte matching-transaction temporary -> valid +one different-byte matching-transaction temporary -> seal_mismatch +wrong transaction or second temporary -> seal_mismatch +``` + +The temporary is not part of `SealV1.files`. Verification is read-only and never removes it. Only idempotent `finalize` may clean the exact same-byte residue under an exclusive local lock. + +- [ ] **Step 5: Prove `--require sealed` and immutable behavior** + +Snapshot the entire capsule parent tree before and after direct verification and CLI verification. Assert byte content, names, modes, sizes, mtimes, and inode identities remain unchanged. + +Run: + +```bash +uv run pytest tests/capsule/test_verify_sealed.py tests/capsule/test_verify_prepared.py tests/capsule/test_cli_finalize.py tests/capsule/test_cli_plan.py tests/capsule/test_cli_resume.py -q +``` + +Expected: PASS. `laconian verify --require sealed` exits 0; the same requirement on a valid unsealed capsule prints its unchanged valid object and exits 2. + +- [ ] **Step 6: Commit lockless sealed verification** + +```bash +git add src/laconian_eval/capsule/verify.py src/laconian_eval/capsule/record_models.py tests/capsule/test_verify_prepared.py tests/capsule/test_verify_sealed.py tests/capsule/test_cli_finalize.py +git commit -m "feat: verify sealed capsule transport" +``` + +### Task 9: Write and load a seal-bound deterministic scored sidecar + +**Files:** +- Create: `src/laconian_eval/capsule/scorable.py` +- Create: `src/laconian_eval/capsule/sidecars.py` +- Modify: `src/laconian_eval/scoring.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `tests/test_public_contract.py` +- Create: `tests/capsule/test_scorable.py` +- Create: `tests/capsule/test_sidecars.py` +- Modify: `tests/capsule_helpers.py` + +- [ ] **Step 1: RED-test exact ScoredAttemptV2 identity binding** + +Create `tests/capsule/test_scorable.py` with one valid successful terminal `RawAttemptV2`, its exact `PlanRowV1`, and its captured `ResponseCase`. Construct the `ScoredAttemptV2` shape from the stable interface and assert strict/frozen/extra-forbid behavior plus these exact equalities: + +```python +assert scored.ordinal == plan.ordinal +assert scored.plan_item_id == plan.plan_item_id == raw.plan_item_id +assert scored.attempt_id == raw.attempt_id +assert scored.raw_attempt_sha256 == sha256_bytes(raw_attempt_bytes(raw)) +assert scored.case_uid == plan.case_uid == raw.case_uid +assert scored.case_definition_sha256 == plan.case_definition_sha256 +assert scored.case_definition_sha256 == raw.case_definition_sha256 +assert scored.response_id == raw.response_id +assert scored.terminal_reason == raw.terminal_reason +assert scored.hard_pass == ( + raw.terminal_reason == "success" and all(check.passed for check in scored.checks) +) +``` + +Forge each duplicated field independently and assert model rejection. Reject a nonterminal raw row, null terminal reason, authentication/ambiguity terminal reason, a success without response ID/output, a provider failure marked hard-pass, and a failed check with `hard_pass=True`. + +- [ ] **Step 2: RED-test deterministic terminal projection in plan order** + +Build a 40-row shard plan whose rows refer to exactly two captured localized cases keyed by case UID, plus a raw ledger containing one initial retry row before one later terminal row. Shuffle the raw input sequence and call: + +```python +scored = project_scored_attempts( + plan=plan, + raw_attempts=raw_rows, + cases_by_uid=cases_by_uid, +) +``` + +Assert exactly 40 results in plan ordinal order, exactly one terminal row per plan item, the terminal retry rather than its nonterminal predecessor, and deterministic check order. Parameterize rejection of missing, duplicate, extra, nonterminal-only, wrong case UID, wrong case definition hash, wrong prompt hash, wrong arm/repetition, and wrong request-config hash evidence. + +Run: + +```bash +uv run pytest tests/capsule/test_scorable.py -q +``` + +Expected: FAIL during collection because `scorable.py` does not exist. + +- [ ] **Step 3: Expose one deterministic hard-check function and implement the projection** + +In `scoring.py`, extract the existing nonblank, literal, JSON, YAML, and sentence checks behind this public pure function, then make legacy `score_attempt` call it: + +```python +def deterministic_hard_checks(case: ResponseCase, output: str) -> tuple[CheckResult, ...]: + return tuple( + [ + *_nonblank_checks(output), + *_literal_checks(case, output), + *_json_checks(case, output), + *_yaml_checks(case, output), + *_sentence_checks(case, output), + ] + ) +``` + +Create `HardCheckV2`, `ScoredAttemptV2`, `ScorableError(code)` with literal message `capsule scoring rejected`, and `project_scored_attempts`. Class-bound revalidate plan rows, raw rows, and response cases before joining. For a successful row, map only each existing check's `name` and `passed` into `HardCheckV2`; do not persist free-form legacy `detail`. For `provider_rejected` and `retry_exhausted`, emit an empty check tuple and `hard_pass=False`; terminal reason remains the exact reason evidence. + +Require the plan ordinals to be `0..len(plan)-1`, all plan IDs unique, and the terminal raw join to be a bijection. Select terminal rows by `plan_item_id`; never choose the last physical row as an implicit rule and never fabricate a row for missing evidence. + +Run: + +```bash +uv run pytest tests/capsule/test_scorable.py tests/test_scoring.py -q +``` + +Expected: PASS with legacy score outputs unchanged. + +- [ ] **Step 4: RED-test the canonical scored-sidecar model and self-hash** + +Create `tests/capsule/test_sidecars.py`. Build a valid `ScoredCapsuleSidecarV2` and independently compute: + +```python +expected = stable_digest( + "laconian-scored-capsule-sidecar-v2", + { + "sidecar_schema_version": "2", + "scoring_algorithm_version": "laconian-deterministic-hard-v2", + "capsule_sha256": capsule_sha256, + "manifest_sha256": manifest_sha256, + "case_index_sha256": case_index_sha256, + "plan_sha256": plan_sha256, + "raw_sha256": raw_sha256, + "ordered_plan_item_ids": ordered_plan_item_ids, + "scored_attempts": [row.model_dump(mode="json") for row in scored_attempts], + }, +) +assert sidecar.sidecar_sha256 == expected +``` + +Require `ordered_plan_item_ids` and scored rows to have equal nonzero length and position-by-position IDs/ordinals. Reject unknown scoring version, wrong self-hash, reordered/duplicate/missing ID, reordered scored row, wrong capsule/manifest/case-index/plan/raw digest, unknown field, forged nested model, and any field carrying a later-stage judgment. + +Run: + +```bash +uv run pytest tests/capsule/test_sidecars.py::test_scored_sidecar_round_trips_and_self_hashes_exactly -q +``` + +Expected: FAIL during collection because `sidecars.py` does not exist. + +- [ ] **Step 5: Add a descriptor-stable sealed evidence reader** + +In `verify.py`, add an internal context manager used by sidecars and checkpoint packing: + +```python +@contextmanager +def verified_sealed_capsule_source(path: Path) -> Iterator[VerifiedSealedCapsuleSourceV1]: + """Yield exact parsed sealed evidence while retaining and rechecking root descriptors.""" +``` + +`VerifiedSealedCapsuleSourceV1` is frozen/slotted and contains strict `VerifyResultV1`, `SealV1`, `CapsuleV1`, `ResolvedManifestV2`, exact manifest/case-index/plan/raw bytes, ordered `CaseIndexRowV1`, ordered `PlanRowV1`, committed `RawAttemptV2`, and captured `ResponseCase` objects keyed by their verified case UID. It succeeds only for `SEALED_COMPLETE` with nonnull capsule hash, rechecks every descriptor identity before exit, and never accepts caller-supplied case text or plan/raw objects. + +- [ ] **Step 6: RED-test no-replace sidecar writing and verified loading** + +Finalize one complete 40-row shard capsule, then run: + +```python +sidecar_hash = write_scored_sidecar(capsule_path, sidecar_path) +evidence = load_verified_scored_capsule(capsule_path, sidecar_path) +``` + +Assert: + +```python +assert evidence.capsule_sha256 == sha256_bytes((capsule_path / "seal.json").read_bytes()) +seal_files = {item.path: item for item in evidence.seal.files} +assert evidence.manifest_sha256 == seal_files["manifest.json"].sha256 +assert evidence.plan_sha256 == seal_files["plan.jsonl"].sha256 +assert tuple(row.plan_item_id for row in evidence.plan) == tuple( + row.plan_item_id for row in evidence.scored_attempts +) +assert set(evidence.cases_by_uid) == {row.case_uid for row in evidence.plan} +assert ( + sidecar_hash + == ScoredCapsuleSidecarV2.model_validate_json(sidecar_path.read_bytes()).sidecar_sha256 +) +``` + +Use an immutable mapping proxy for `cases_by_uid`. Reject an unsealed capsule, `SEALED_BLOCKED`, a nullable capsule hash, a sidecar symlink/FIFO, noncanonical sidecar JSON, output collision, and any one-byte change to seal, manifest, case input, case index, plan, raw journal, or sidecar. Snapshot both capsule and parent before/after loading and assert the loader is read-only. + +Run: + +```bash +uv run pytest tests/capsule/test_sidecars.py -k 'write or load or rejects' -q +``` + +Expected: FAIL until writer and loader recompute all joins from descriptor-verified sealed bytes. + +- [ ] **Step 7: Implement the external sidecar writer and exact loader** + +Under `verified_sealed_capsule_source`, derive terminal raw rows from validated history, call `project_scored_attempts`, construct the complete `ScoredCapsuleSidecarV2`, compute its self-hash, and canonicalize it. Write through an operation-owned same-parent temporary using `0600`, fsync, `link_noreplace`, temporary unlink, and parent fsync. Existing output always fails; no overwrite or content-based replacement is allowed. + +`load_verified_scored_capsule` opens the sidecar through its parent descriptor with `O_RDONLY|O_NOFOLLOW|O_NONBLOCK|O_CLOEXEC`, enforces the static JSON byte/depth bounds, requires canonical bytes, recomputes the complete expected sidecar from the retained sealed source, and requires byte equality. Return `VerifiedScoredCapsuleV2` only after a final root/sidecar identity recheck. The return object contains no authority to mutate the capsule or sidecar. + +As the final serialized Slice 1 owner of `tests/test_public_contract.py`, rebase after the earlier +corpus/provider edits, then add `test_slice1_final_capsule_public_names_are_stable`. Import from the +exact owning modules and pin both `__name__` and `__module__` for `SealV1`, `capsule_sha256`, +`FinalizeResultV1`, `finalize_capsule`, `ShardPlanV1`, `ScoredAttemptV2`, +`VerifiedScoredCapsuleV2`, and `load_verified_scored_capsule`. Assert the three functions are callable +and the five records are their exact class objects; do not add a capsule package-level re-export or +duplicate implementation merely to satisfy the test. + +```python +from laconian_eval.capsule.finalize import FinalizeResultV1, finalize_capsule +from laconian_eval.capsule.scorable import ScoredAttemptV2 +from laconian_eval.capsule.seal_models import SealV1, capsule_sha256 +from laconian_eval.capsule.sharding import ShardPlanV1 +from laconian_eval.capsule.sidecars import ( + VerifiedScoredCapsuleV2, + load_verified_scored_capsule, +) + +assert { + value.__name__: value.__module__ + for value in ( + SealV1, + capsule_sha256, + FinalizeResultV1, + finalize_capsule, + ShardPlanV1, + ScoredAttemptV2, + VerifiedScoredCapsuleV2, + load_verified_scored_capsule, + ) +} == { + "SealV1": "laconian_eval.capsule.seal_models", + "capsule_sha256": "laconian_eval.capsule.seal_models", + "FinalizeResultV1": "laconian_eval.capsule.finalize", + "finalize_capsule": "laconian_eval.capsule.finalize", + "ShardPlanV1": "laconian_eval.capsule.sharding", + "ScoredAttemptV2": "laconian_eval.capsule.scorable", + "VerifiedScoredCapsuleV2": "laconian_eval.capsule.sidecars", + "load_verified_scored_capsule": "laconian_eval.capsule.sidecars", +} +``` + +Run: + +```bash +uv run pytest tests/test_public_contract.py tests/capsule/test_scorable.py tests/capsule/test_sidecars.py tests/capsule/test_verify_sealed.py tests/test_scoring.py -q +``` + +Expected: PASS. + +- [ ] **Step 8: Commit the sealed deterministic scoring boundary** + +```bash +git add src/laconian_eval/capsule/scorable.py src/laconian_eval/capsule/sidecars.py src/laconian_eval/scoring.py src/laconian_eval/capsule/verify.py tests/test_public_contract.py tests/capsule/test_scorable.py tests/capsule/test_sidecars.py tests/capsule_helpers.py +git commit -m "feat: expose verified scored capsules" +``` + +### Task 10: Pack deterministic uncompressed USTAR checkpoints + +**Files:** +- Modify: `src/laconian_eval/capsule/limits.py` +- Create: `src/laconian_eval/capsule/checkpoint.py` +- Modify: `src/laconian_eval/capsule/verify.py` +- Modify: `src/laconian_eval/capsule/filesystem.py` +- Modify: `tests/capsule/test_limits.py` +- Create: `tests/capsule/test_checkpoint.py` + +- [ ] **Step 1: RED-test the exact checkpoint bounds** + +Extend `ResourceLimitsV1` with these positive integer fields and exact defaults: + +```python +checkpoint_archive_bytes: int = 9 * _GIB +checkpoint_members: int = 120_064 +checkpoint_file_bytes: int = 8 * _GIB +checkpoint_aggregate_file_bytes: int = 8 * _GIB +checkpoint_path_depth: int = 64 +checkpoint_restore_seconds: int = 300 +``` + +In `tests/capsule/test_limits.py`, include all six in the complete field/default assertion, bool/nonpositive rejection matrix, and frozen/slotted checks. + +Run: + +```bash +uv run pytest tests/capsule/test_limits.py -q +``` + +Expected: FAIL because the six dataclass fields are absent. + +- [ ] **Step 2: RED-test canonical USTAR bytes and sidecar** + +Create `tests/capsule/test_checkpoint.py`. Prepare a deterministic small capsule, set distinct allowed +file modes, and include a nested directory archived as `0o555` with a regular child to prove packing +does not require owner-write mode. Construct this exact provenance, derive its required name, and call: + +```python +provenance = CheckpointProvenanceV1( + campaign_id="public-2026-08-30", + model_id="gpt-5.6-sol", + scenario_uid=SHA_B, + batch_attempt_id=UUID(UUID_B), + run_attempt=1, +) +archive_path = output_root / checkpoint_archive_name(provenance) +artifact = pack_checkpoint(capsule_path, archive_path, provenance=provenance) +``` + +Assert: + +```python +assert archive_path.suffix == ".tar" +assert artifact.sidecar_path == Path(f"{archive_path}.sha256") +assert artifact.sha256 == sha256_bytes(archive_path.read_bytes()) +assert artifact.byte_length == archive_path.stat().st_size +assert artifact.member_count > 0 +assert artifact.sidecar_path.read_bytes() == ( + f"{artifact.sha256} {archive_path.name}\n".encode("ascii") +) +``` + +Parse raw 512-byte headers in the test without production helpers. Assert USTAR magic/version, canonical UTF-8 ordering, directory-before-child order, `uid=gid=mtime=0`, empty owner/group names, exact preserved modes, regular/directory types only, zero data padding, and exactly two terminal zero blocks. Call pack twice at different destination names and assert archive bytes are identical. + +- [ ] **Step 3: Run the packer RED gate** + +Run: + +```bash +uv run pytest tests/capsule/test_checkpoint.py::test_pack_checkpoint_writes_deterministic_uncompressed_ustar_and_sidecar -q +``` + +Expected: FAIL during collection because `checkpoint.py` does not exist. + +- [ ] **Step 4: Expose one lock-owned descriptor verification boundary** + +Add an internal context manager in `verify.py`: + +```python +@contextmanager +def verified_checkpoint_source(path: Path) -> Iterator[VerifiedCheckpointSourceV1]: + """Yield a stable verified root descriptor and exact inventory while retaining a shared lock.""" +``` + +`VerifiedCheckpointSourceV1` is frozen/slotted and contains the borrowed root descriptor, strict `VerifyResultV1`, and an immutable UTF-8-sorted tuple of `(path, kind, mode, byte_length)` records. The context owns and closes the parent/root/lock descriptors exactly once. It requires `.laconian.lock` even for sealed source packing because the archive contract includes that file; transport-lock omission is accepted only when reading an already transported sealed capsule. + +Recheck every descriptor/path identity immediately before and after streaming each member and recheck root/parent/lock identities before yielding completion. + +- [ ] **Step 5: Implement a deterministic streaming USTAR writer** + +Implement `CheckpointError(code)` with literal message `capsule checkpoint rejected`, strict `CheckpointProvenanceV1`, `checkpoint_archive_name`, `CheckpointArtifactV1`, and `pack_checkpoint`. Class-bound revalidate provenance, require its safe model component, and reject an archive path whose basename is not the exact derived provenance name before opening the capsule. + +For each sorted verified member: + +1. encode the relative UTF-8 path and split it at the latest slash fitting USTAR's 155-byte prefix and 100-byte name fields; +2. reject paths not representable in USTAR rather than creating PAX or GNU records; +3. write a 512-byte header with type `5` for a directory or `0` for a regular file; +4. encode mode, uid, gid, size, and mtime as fixed-width ASCII octal with canonical NUL/space terminators; +5. calculate the checksum with the checksum field treated as eight spaces; +6. stream regular content from its no-follow descriptor while hashing and enforcing the exact verified size; +7. write zero padding to the next 512-byte boundary; and +8. write exactly 1024 final zero bytes after the last member. + +Write to one operation-owned same-directory temporary using exclusive creation, fsync it, no-replace publish the archive, fsync its parent, then write/fsync/no-replace publish the exact sidecar and fsync again. If archive publication succeeds but sidecar publication fails, return `checkpoint_sidecar_publish_failed`; retry accepts an existing archive only when its exact bytes/hash equal the deterministic reconstruction and then publishes the missing exact sidecar. Never replace either output. + +- [ ] **Step 6: Test mutation, special-file, and output-collision failures** + +Inject a source mutation after header creation, a short read, appended source byte, inode replacement, lock loss, FIFO/symlink/device member, USTAR-unrepresentable path, archive write failure, fsync failure, archive collision, sidecar collision, and parent identity change. Assert no accepted artifact, no overwrite, and cleanup only of the operation-owned temporary after identity validation. + +Run: + +```bash +uv run pytest tests/capsule/test_checkpoint.py -k 'pack or sidecar or collision or mutation' tests/capsule/test_limits.py -q +``` + +Expected: PASS. + +- [ ] **Step 7: Commit checkpoint packing** + +```bash +git add src/laconian_eval/capsule/limits.py src/laconian_eval/capsule/checkpoint.py src/laconian_eval/capsule/verify.py src/laconian_eval/capsule/filesystem.py tests/capsule/test_limits.py tests/capsule/test_checkpoint.py +git commit -m "feat: pack deterministic capsule checkpoints" +``` + +### Task 11: Restore checkpoints in one bounded fd-relative pass + +**Files:** +- Modify: `src/laconian_eval/capsule/checkpoint.py` +- Modify: `src/laconian_eval/capsule/tree_policy.py` +- Modify: `src/laconian_eval/capsule/filesystem.py` +- Modify: `tests/capsule/test_checkpoint.py` +- Modify: `tests/capsule/test_tree_policy.py` + +- [ ] **Step 1: RED-test exact round-trip and binding checks** + +Pack one unsealed partial shard capsule and one sealed complete shard capsule. Give each a nested +`0o555` directory containing at least one regular file, then restore each into a fresh parent with +`CheckpointExpectedBindingsV1` populated from the preflight parent/shard files, exact ordered +`(binding_id, sha256)` protocol bindings, and the archive-name provenance. Assert: + +```python +restored = restore_checkpoint( + archive_path, + sidecar_path, + destination_parent=restore_root, + destination_name=source.name, + expected=expected, +) +assert restored == restore_root / source.name +assert snapshot_tree(restored) == snapshot_tree(source) +assert verify_capsule(restored, mode=VerificationMode.PREPARED).status == "valid" +``` + +The tree snapshot compares every relative path, kind, permission mode, and regular-file byte string, +including the read-only directory and its child, `.laconian.lock`, and `seal.json` when present. + +For each expected field, mutate only that expected value and assert `CheckpointError.code == "checkpoint_binding_mismatch"` with no published destination. + +- [ ] **Step 2: Run the restore RED gate** + +Run: + +```bash +uv run pytest tests/capsule/test_checkpoint.py::test_checkpoint_round_trip_preserves_exact_capsule_tree_and_modes tests/capsule/test_checkpoint.py::test_restore_requires_exact_parent_shard_and_model_bindings -q +``` + +Expected: FAIL because `restore_checkpoint` is absent. + +- [ ] **Step 3: Build raw hostile archives without using extraction helpers** + +Add a test-only raw 512-byte header builder and parameterize rejection of: + +```text +archive over checkpoint_archive_bytes +member count over checkpoint_members +one file over checkpoint_file_bytes +aggregate regular bytes over checkpoint_aggregate_file_bytes +path depth over checkpoint_path_depth +expired monotonic deadline +invalid header checksum +non-USTAR magic or version +PAX local header x +PAX global header g +GNU long name L +GNU long link K +GNU sparse S +hard link 1 +symbolic link 2 +character device 3 +block device 4 +FIFO 6 +contiguous file 7 +absolute path +backslash +NUL inside the decoded name +non-UTF-8 name +non-NFC name +empty component +dot component +parent component +duplicate normalized path +file before its parent directory +unexpected capsule member +noncanonical octal field +setuid, setgid, or sticky mode +declared size with short data +nonzero padding +missing second terminal zero block +nonzero data after terminal blocks +sidecar wrong hash +sidecar wrong basename +existing destination +destination parent identity change +``` + +For every vector, assert the final destination does not exist and an unrelated sentinel in the destination parent is byte-identical. + +- [ ] **Step 4: Run the hostile RED matrix** + +Run: + +```bash +uv run pytest tests/capsule/test_checkpoint.py -k 'rejects_' -q +``` + +Expected: FAIL because no bounded raw USTAR parser or restore staging exists. + +- [ ] **Step 5: Implement sidecar-first bounded archive validation** + +Open sidecar and archive through parent descriptors with `O_NOFOLLOW|O_NONBLOCK|O_CLOEXEC`; require both stable regular files. Parse the sidecar as one ASCII LF-terminated line with exactly two spaces, lowercase 64-hex digest, and exact archive basename. Hash the archive through its retained descriptor, enforce `checkpoint_archive_bytes`, compare the digest, rewind, and recheck identity before parsing. + +Use `time.monotonic()` to establish one deadline at entry and recheck it before every header read, content chunk, fsync, verification stage, and publish. A test seam may supply a monotonic callable; production always uses the real monotonic clock. + +- [ ] **Step 6: Implement the one-pass USTAR parser and extractor** + +Parse raw 512-byte headers directly. Accept only USTAR magic `ustar\0`, version `00`, canonical ASCII-octal numeric fields, type `0`/NUL regular files, and type `5` directories. Reject every extension and link type before applying any name extension semantics. + +For each member, before creation: + +1. combine prefix/name fields exactly once; +2. decode strict UTF-8 and require NFC identity; +3. reject NUL, backslash, absolute, empty, dot, and parent components; +4. enforce path-byte and depth limits; +5. require `capsule_path_kind(path)` to equal the header kind; +6. require no duplicate normalized path; +7. require every nonroot parent directory to have appeared earlier; and +8. reserve member/per-file/aggregate capacity before reading data. + +Create one operation-owned `0700` staging directory under the already-open destination parent. Open +child directories one component at a time with no-follow descriptors. Create every directory as +`0700` regardless of its archived mode, retain its descriptor plus archived mode/depth, and keep it +owner-readable/writable/searchable while any descendant may still be created. Create regular files +with `O_WRONLY|O_CREAT|O_EXCL|O_NOFOLLOW|O_CLOEXEC` and mode `0600`; write exactly declared bytes, +require zero block padding, fsync, then `fchmod` the regular file to its archived permission bits. + +Only after every member, padding block, and both terminal zero blocks have been parsed successfully, +recheck every retained directory identity and apply archived directory modes with descriptor-relative +`fchmod`, deepest-first. Then fsync those directories deepest-first. Never apply an archived +directory mode while an unparsed or unwritten descendant remains. + +Do not call `tarfile.extract`, `tarfile.extractall`, a shell tar command, or any path-based write API. + +- [ ] **Step 7: Full-verify and atomically publish the restored capsule** + +While staging is still hidden: + +1. require `.laconian.lock` as a regular member; +2. acquire a fresh lock on the restored `.laconian.lock` descriptor and run descriptor-based full capsule verification while holding it; archived lock bytes never count as an inherited lock state; +3. load `capsule.json`, `manifest.json`, `plan.jsonl`, and optional captured parent/shard planning inputs from verified descriptors; +4. compare every `CheckpointExpectedBindingsV1` field exactly, with null parent/shard/scenario fields required only for a full-parent capsule and protocol bindings required in manifest declaration order; +5. fsync the root and destination parent; +6. publish with `rename_noreplace`; and +7. fsync the destination parent again. + +On every prepublication failure, recursively remove only the operation-owned staging tree using +retained identity checks and bounded descriptor-relative cleanup. If archived directory modes were +already applied, cleanup first uses the retained descriptors to restore owner `rwx` bits without +widening group/other bits, deepest-first, and then removes children descriptor-relatively. Add a +fault-injection test after directory-mode application that proves the hidden read-only tree is fully +removed and an unrelated sentinel is unchanged. On postpublication directory-fsync failure, return +`checkpoint_restore_post_publish_fsync_failed` and include the known published path in the exception +object without deleting it. + +- [ ] **Step 8: Prove no secret or ambient-path leakage** + +Place canaries in `HOME`, `TMPDIR`, provider error text, a fake credential environment value, archive bytes after a rejected header, and exception subclasses. Assert no error string/code, destination path, sidecar, accepted archive member, or test-captured diagnostic contains a canary. Assert restore does not inspect ambient temporary-directory variables. + +Run: + +```bash +uv run pytest tests/capsule/test_checkpoint.py tests/capsule/test_tree_policy.py tests/capsule/test_filesystem.py tests/capsule/test_verify_prepared.py tests/capsule/test_verify_sealed.py -q +``` + +Expected: PASS. + +- [ ] **Step 9: Commit safe checkpoint restoration** + +```bash +git add src/laconian_eval/capsule/checkpoint.py src/laconian_eval/capsule/tree_policy.py src/laconian_eval/capsule/filesystem.py tests/capsule/test_checkpoint.py tests/capsule/test_tree_policy.py +git commit -m "feat: restore capsule checkpoints safely" +``` + +### Task 12: Prove the complete Slice 1 evidence path and run quality gates + +**Files:** +- Create: `tests/capsule/test_foundation_round_trip.py` +- Create: `tests/capsule/foundation_round_trip.py` + +- [ ] **Step 1: Write the failing end-to-end shard lifecycle test** + +Create `test_foundation_round_trip.py` with +`test_public_foundation_round_trip_from_parent_plan_to_restored_seal`. Import the test-owned +`run_public_foundation_round_trip` integration harness from `foundation_round_trip.py`; the harness +must wire only the already public Slice 1 APIs and must not duplicate their validation or hashing. +The test requires this exact offline sequence: + +```python +from pathlib import Path + +from tests.capsule.foundation_round_trip import run_public_foundation_round_trip + + +def test_public_foundation_round_trip_from_parent_plan_to_restored_seal( + tmp_path: Path, +) -> None: + evidence = run_public_foundation_round_trip(tmp_path=tmp_path) + assert evidence.provider_call_count == 40 + assert evidence.request_contract_count == 40 + assert evidence.all_request_contracts_exact is True + assert evidence.all_attempt_evidence_exact is True + assert evidence.all_visible_token_subtractions_exact is True + assert evidence.source_seal_sha256 == evidence.restored_seal_sha256 + assert evidence.source_tree_sha256 == evidence.restored_tree_sha256 + assert evidence.source_sidecar_evidence_sha256 == evidence.restored_sidecar_evidence_sha256 +``` + +```text +construct the three exact native-v2 model manifests with medium reasoning/verbosity, literal default service tier, explicit/30m cache control, five sourced rates, and SDK/lock identity +materialize three stable 480-row parents +derive and validate all 36 40-row shard plans +prepare one captured shard capsule from one parent/shard pair +execute all 40 requests through a function-local recording `OpenAIProvider` test subclass whose exact +`generate_benchmark(request: PublicBenchmarkRequestV1) -> PublicBenchmarkProviderOutcomeV1` method +echoes applied explicit/30m, read zero, write zero, reported reasoning tokens, literal default tier, +and separately recorded returned model ID +assert every committed attempt has applied/read/write statuses reported_exact/reported_zero/reported_zero, requested and returned default tier with reported_default, exact source digests, and one consistent returned model ID +assert every visible-token value equals output_tokens minus reasoning_tokens +finalize the capsule +verify SEALED_COMPLETE and capsule_sha256 +write and load the deterministic scored sidecar from sealed plan/raw/cases +pack deterministic USTAR plus sidecar +restore into a new parent with exact expected bindings +verify the restored capsule and compare its seal hash and complete tree to the source +load the same scored sidecar against the restored capsule and require equal verified evidence +``` + +Assert the recording provider received exactly 40 calls, every request carried `reasoning={effort: +medium}`, `text={verbosity: medium}`, exact `prompt_cache_options={mode: explicit, ttl: 30m}`, and +`service_tier=default` through the +exact `OpenAIProvider.generate_benchmark` boundary, every resulting attempt classified the returned tier as `reported_default`, and no +request from another scenario appears. + +- [ ] **Step 2: Run the focused test and observe RED** + +Run: + +```bash +uv run pytest tests/capsule/test_foundation_round_trip.py::test_public_foundation_round_trip_from_parent_plan_to_restored_seal -q +``` + +Expected: FAIL during collection because `tests/capsule/foundation_round_trip.py` and +`run_public_foundation_round_trip` do not exist. This RED is required; do not pre-create the helper +or weaken the test to call one component in isolation. + +- [ ] **Step 3: Add the minimal integration wiring** + +Create `foundation_round_trip.py` with the single keyword-only +`run_public_foundation_round_trip(*, tmp_path) -> FoundationRoundTripEvidence` +test helper. It calls the existing manifest/planning, capture/execution, finalize, sealed verification, +scored-sidecar, deterministic USTAR, restore, and restored-verification APIs in the exact order from +Step 1. Its frozen result contains only the call count, source/restored seal hashes, source/restored +tree hashes, and source/restored sidecar evidence hashes. It contains no production fallback, +credential lookup, live-provider client, copied verifier, path outside `tmp_path`, or new public API. + +Define this exact test-owned result and signature; imports shown here are part of the new helper: + +```python +from dataclasses import dataclass +from pathlib import Path + + +@dataclass(frozen=True, slots=True) +class FoundationRoundTripEvidence: + provider_call_count: int + request_contract_count: int + all_request_contracts_exact: bool + all_attempt_evidence_exact: bool + all_visible_token_subtractions_exact: bool + source_seal_sha256: str + restored_seal_sha256: str + source_tree_sha256: str + restored_tree_sha256: str + source_sidecar_evidence_sha256: str + restored_sidecar_evidence_sha256: str + + +def run_public_foundation_round_trip( + *, + tmp_path: Path, +) -> FoundationRoundTripEvidence: + """Return facts freshly read from one exact offline Slice 1 round trip.""" +``` + +The body contains no additional named adapter. Construct the three strict fixture inputs directly +with the earlier-owned `PublicBenchmarkRequestV1` and resolved-manifest models. Inside +`run_public_foundation_round_trip`, define a function-local recording subclass of the earlier-owned +`OpenAIProvider`; override only the exact Task 3 method +`generate_benchmark(request: PublicBenchmarkRequestV1) -> PublicBenchmarkProviderOutcomeV1` to +append each request to a local list and return strict typed `PublicBenchmarkProviderOutcomeV1` +evidence. No fake-provider class, constant, or alternate provider interface is imported. + +Wire only these earlier-task-owned APIs, in this order, using each returned object as the next call's +input: `materialize_parent_plan`, `validate_parent_plan`, `project_shard_plans`, +`validate_public_generation_partition`, `materialize_shard_projection`, `prepare_shard_capsule`, +`OpenAIProvider.generate_benchmark(request: PublicBenchmarkRequestV1) -> +PublicBenchmarkProviderOutcomeV1` through the existing capsule execution path, +`finalize_capsule`, `verify_capsule`, +`write_scored_sidecar`, `load_verified_scored_capsule`, `pack_checkpoint`, `restore_checkpoint`, +`verify_capsule` again, and `load_verified_scored_capsule` against the restored capsule. +Use `checkpoint_archive_name` for the archive name and construct the already-defined +`CheckpointProvenanceV1` and `CheckpointExpectedBindingsV1` directly. Compute complete tree hashes +by byte-sorted descriptor reads in this test helper only; do not add a production tree-hash API. +Populate every `FoundationRoundTripEvidence` field directly from the local request list, committed +attempt evidence, `FinalizeResultV1`, both public verification results, and both +`VerifiedScoredCapsuleV2` values. There are no other helper names to define or fill in later. + +If the integration test exposes an owning-component defect, first add the focused regression and +minimal fix in that earlier task's exact files and commit; do not hide the mismatch in this harness. + +- [ ] **Step 4: Run focused GREEN and the complete Slice 1 suite** + +Run: + +```bash +uv run pytest tests/capsule/test_foundation_round_trip.py::test_public_foundation_round_trip_from_parent_plan_to_restored_seal -q +``` + +Expected: PASS with exactly 40 locally recorded provider calls and byte-identical restored evidence. + +Then run: + +Run: + +```bash +uv run pytest tests/test_models.py tests/test_smoke_cases.py tests/test_cases.py tests/test_public_contract.py tests/test_openai_provider.py tests/test_providers.py tests/capsule/test_manifest_models.py tests/capsule/test_capture.py tests/capsule/test_planning.py tests/capsule/test_attempts_v2.py tests/capsule/test_execution.py tests/capsule/test_sharding.py tests/capsule/test_record_models.py tests/capsule/test_prepare.py tests/capsule/test_tree_policy.py tests/capsule/test_seal_models.py tests/capsule/test_finalize.py tests/capsule/test_verify_prepared.py tests/capsule/test_verify_sealed.py tests/capsule/test_cli_finalize.py tests/capsule/test_scorable.py tests/capsule/test_sidecars.py tests/capsule/test_checkpoint.py tests/capsule/test_foundation_round_trip.py -q +``` + +Expected: PASS. + +- [ ] **Step 5: Run the entire repository test suite** + +Run: + +```bash +uv run pytest -q +``` + +Expected: PASS with no live provider calls and no skipped Slice 1 tests. + +- [ ] **Step 6: Run static quality gates** + +Run: + +```bash +uv run ruff check . +uv run ruff format --check . +uv run mypy src +``` + +Expected: all three commands exit 0 with no findings. + +- [ ] **Step 7: Inspect the final diff for scope and generated residue** + +Run: + +```bash +git status --short +git diff --check +git diff --stat -- evals/cases/response-smoke.yaml evals/README.md src/laconian_eval tests +``` + +Expected: only the files listed in the Slice 1 boundary are changed; `git diff --check` prints +nothing; no result capsule, archive, sidecar, credential-bearing file, cache directory, or provider +output is tracked. + +- [ ] **Step 8: Commit the cross-component verification** + +```bash +git add tests/capsule/test_foundation_round_trip.py tests/capsule/foundation_round_trip.py +git commit -m "test: verify public benchmark foundations" +``` + +## Completion evidence + +Before handing off this slice, record the fresh command outputs and final commit IDs in the implementation session response. Completion requires all of the following facts: + +- the only sentence-count gates are the two prompt-grounded `user-decline` localized cases; +- every material warning has exactly one frozen `material` or `critical` severity; +- benchmark-only native-v2 request identity and injected Responses kwargs contain medium reasoning, medium verbosity, literal reasoning-mode omission, exact explicit/30m cache control with recursive no-breakpoint proof, and literal `service_tier=default`, while legacy `GenerationRequest` bytes remain unchanged; +- OpenAI SDK 3.3.1, the `uv.lock` hash from C0 peeled from approved annotated T0 and verified through the paired T1/`ProtocolAttestationTagBindingV1` closure, typed request/response fields, the exact serializer projection, and canonical response paths verify before credentials with zero provider calls on failure; +- every plan row binds that exact default-tier request identity plus a conservative input-token bound at or below 272,000, and the price snapshot binds literal default tier plus five non-null sourced dimensions: ordinary uncached input, cache-read input, cache-write input, visible output, and reasoning output; +- every attempt independently preserves applied mode/TTL, read, write, tier, usage, reasoning, requested model, returned model, and raw source digests with the exact closed status vocabularies; only `reported_exact/reported_zero/reported_zero/reported_default` may reconcile trusted no-cache usage, while missing/mismatch/invalid or nonzero evidence retains exposure and requires Runtime STOP; the exact not-applicable values are restricted to independently proven no-result/no-usage delivery states; +- reported reasoning tokens yield visible tokens by exact subtraction, while missing or invalid reasoning breakdowns yield an unavailable metric; +- three stable 480-row parent plans produce 36 disjoint 40-row scenario projections totaling 1,440 request identities; +- a shard capsule captures its exact complete parent and shard plan and cannot execute outside its projection; +- complete and explicitly incomplete capsules finalize idempotently under the sole committed seal request; +- sealed verification derives the exact capsule hash and works without a transport lock or supported local locking filesystem; +- the scored sidecar binds the exact complete seal, manifest, case index, plan, raw journal, captured cases, and one deterministic terminal row per plan item before exposing `VerifiedScoredCapsuleV2`; +- deterministic uncompressed USTAR checkpoints include `.laconian.lock`, exact relative paths, and permission modes, while restore keeps staging directories owner-writable until every child exists and then applies archived modes deepest-first; and +- restore rejects hostile archives before publication, fully verifies the hidden staging capsule, compares exact parent/shard/model bindings, and publishes only with atomic no-replace semantics. diff --git a/docs/superpowers/plans/2026-08-30-public-benchmark-publication.md b/docs/superpowers/plans/2026-08-30-public-benchmark-publication.md new file mode 100644 index 0000000..1f68d91 --- /dev/null +++ b/docs/superpowers/plans/2026-08-30-public-benchmark-publication.md @@ -0,0 +1,6163 @@ +# Public Benchmark Publication Slice 4 Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Build the secret-free, fail-closed publication half of the public three-model benchmark: exact GitHub artifact provenance, provider-evidence inventory sealing, complete and invalid-prefix collection, minimal reviewed publication, checksum-bound result release, and post-`RELEASED` documentation validation. + +**Architecture:** Slice 4 consumes immutable campaign authority from Slice 3, sealed generation/hard-score/judge evidence, and the neutral audit/analysis APIs from Slice 2. A non-public `Publication` capability reconstructs current authority in memory and owns the four live Evaluation stages; the seven public replay commands remain offline and non-evidentiary. Repository-owned Python retrieves artifacts only by exact numeric identity, verifies every parent hash, projects one of two disjoint public bundle kinds, and creates deterministic publication and release plans. Repository `GITHUB_TOKEN` permissions remain read-only everywhere. Exactly three pairwise-distinct GitHub Apps carry writes: the external OIDC state broker alone holds the state-writer App and performs expected-OID receive-pack CAS on `benchmark-authority/*`; the publisher App creates/adopts one intent-bound result branch/PR or closes that exact invalidated PR; and the release-finalizer App creates/adopts one intent-bound protected annotated result tag, draft Release, assets, and publish transition. A separately downscoped `security_attestor` job authorizes one short-lived broker-vaulted token from the existing release-finalizer App installation, downscoped to `administration:write`, `contents:read`, and `metadata:read`; the job receives only signed safe receipts, is not a fourth App, and has no repository-write endpoint capability. No App/installation ID is an Actions credential input or secret mapping, and no App private key, installation token, App-auth Authorization header, or opaque token handle reaches a runner. Signed safe receipts may carry only the preregistered nonsecret App/installation identity needed to verify the actor. The closed read client may create a repository `GITHUB_TOKEN` header only for its exact allowlisted read request and must strip it before every redirect or broker call. The separately approved `benchmark-publish` jobs authenticate only to measured external publisher, release-finalizer, and security-attestor brokers by OIDC; those brokers keep token bytes inside their vaults, perform the exact operation-row calls, close every token, and return signed safe receipts. No App receives the provider key or interprets model output. + +**Tech Stack:** Python 3.11+, Pydantic v2 strict models, standard-library `hashlib`, `json`, `tarfile`, `urllib`, `zipfile`, Git plumbing, pytest, deterministic property loops, uv, and GitHub Actions pinned to full commit SHAs. + +**Approved design:** [Public Three-Model Benchmark Pipeline Design](../specs/2026-08-30-public-three-model-benchmark-design.md), normative design commit `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`, especially sections 6.5–7.7, 12, 13, 14, and 16. + +**Approval record:** Amendment approval metadata is committed at +`d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad`, recording the exact 2026-08-31 approval +`Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. Milestone 0 is complete and +Publication is unblocked only by this synchronized plan. The older or implicit contracts are not fallbacks; all experiment, +authority, publication, and evidence invariants in the approved design remain normative. +Any future normative amendment re-blocks every affected Publication task until that amendment is +separately reviewed, recorded, and explicitly approved. + +--- + +## Amendment synchronization contract + +This section is mandatory and supersedes any older shorthand later in this plan. No compatibility +alias or partially implemented predecessor contract is allowed. + +- [ ] Verify `git show 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126:docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md` + and governance successor `d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad` before Task 1. +- [ ] Import and class-bound revalidate Runtime-owned campaign authority, registry, state, OIDC, + hold, drift, credential-exposure, progress-root, mutation-request/receipt, main-liveness-policy, + and dismissal-policy/plan types. Import workflow inventory, ruleset policy/observations, + operator registry, tag binding, signature projections/receipts, and object archive only from + Evaluation-owned `laconian_eval.benchmark.protocol_review`. Publication owns no duplicate. +- [ ] Import and class-bound revalidate Evaluation-owned `ProtocolReviewStatementV1`, + `VerifiedProtocolAttestationV1`, `ProtocolAttestationBundleV1`, strict REST/GraphQL/local-signature + projections, and canonical digest helpers. No flattened predecessor alias is allowed. +- [ ] Require the exact serial protected annotated-tag closure + `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1`, its raw-object SHA-1/SHA-256 values, + post-tag binding, `CampaignRegistryV1`, `ProtocolReviewObjectArchiveV1`, and one-to-one archived + safe raw/canonical API response bindings before any publication capability is reconstructed. +- [ ] All authority/evidence models are strict, frozen, `extra="forbid"`, and CanonicalJSONV1- + validated. Integer fields reject booleans, floats, numeric strings and out-of-range values; + arrays preserve schema order; only the named self-digest field is omitted from each exact + domain-separated preimage. + +The exact imported Runtime and Evaluation surfaces are: + +```python +from laconian_eval.benchmark import ( + CanonicalJSONV1Error, + canonical_json_v1, + parse_canonical_json_v1, +) +from laconian_eval.campaign.authority import ( + AuthorityMutationReceiptV1, + AuthorityMutationRequestV1, + DraftReleaseReceiptV1, + FinalReleaseVerificationReceiptV1, + InitialAssetReceiptsAppendV1, + InitialDraftReleaseReceiptAppendV1, + InitialPublishReceiptAppendV1, + InitialReleaseReceiptAppendV1, + InitialTagReceiptAppendV1, + GitHubOidcRunIdentityV1, + InstallationTokenRevocationReceiptV1, + PublishReceiptV1, + ReconstructedAuthorityV1, + ReleaseAssetReceiptV1, + ReleaseEffectAuthorizationV1, + ReleaseEffectResultV1, + TagReceiptV1, + append_initial_release_receipt, +) +from laconian_eval.campaign.preflight import ( + CampaignRegistryV1, + MainFallbackLivenessPolicyV1, +) +from laconian_eval.campaign.state import ( + CampaignEventV1, + CampaignStateV1, + CredentialExposureEffectReceiptV1, + CredentialExposureIncidentEvidenceV1, + CredentialExposurePendingV1, + CredentialExposureProgressRootV1, + CredentialExposureSupplementV1, + InvalidEventDismissalEvidenceV1, + InvalidEventDismissalPlanV1, + InvalidEventHoldV1, + OrdinaryStopEvidenceV1, + ProtocolAuthorityDriftEvidenceV1, + TerminalCredentialExposureConsumptionV1, +) +from laconian_eval.benchmark.protocol_review import ( + ArchivedApiReceiptBindingV1, + GITHUB_COMMIT_SIGNER_QUERY_V1, + GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1, + GitHubCommitVerificationProjectionV1, + GitHubSignatureObservationReceiptV1, + GitHubSignatureProjectionV1, + InputTagMessageV1, + ProtocolAttestationTagMessageV1, + ProtocolAttestationBundleV1, + ProtocolAttestationTagBindingV1, + ProtocolBundleBuilderGitIdentityV1, + ProtocolReviewObjectArchiveV1, + ProtocolReviewStatementV1, + PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1, + ProtocolSubjectKindV1, + TagCreationRuleSuiteReceiptV1, + TagOperatorRegistryV1, + TagRulesetObservationReceiptV1, + TagRulesetPolicyV1, + VerifiedProtocolAttestationV1, + WorkflowInventoryV1, +) +``` + +Publication imports the canonical JSON trio through `laconian_eval.benchmark` and proves each +package export is the identical object owned by `laconian_eval.benchmark.attachments`; it imports +the subject-kind Literal and immutable role mapping directly from +`laconian_eval.benchmark.protocol_review`. It neither shadows nor reconstructs any of the five +objects. The contract test asserts `is` identity for all five, verifies the immutable security-role +tuple has the exact 14 approved subject kinds, and rejects every Publication-local copy or +compatibility alias. + +`GitHubReadClient` is Publication-owned, capability-separated, and read-only. It exposes bounded +methods for repository identity; run/attempt/jobs/approvals/deployments/artifacts; raw Git +ref/tag/commit/tree/blob objects; REST commit verification; the one fixed GraphQL signer query; +current repository rulesets; historical rule suites; PR/check/review/merge observations; current +main containment; immutable-Release settings; and Release/assets. Each method fixes API version, +endpoint/query digest, pagination/body bounds and safe response projection. It never accepts an +arbitrary URL, method, GraphQL document, ref namespace, or response parser. Every REST call is +`GET`; the sole exception is one read-only `POST https://api.github.com/graphql` carrying the +checked-in signer query digest, bounded variables, and no mutation. GitHub GraphQL queries are +transported by POST, so “read-only” describes capability and query semantics, not an inaccurate +HTTP-verb restriction. + +`PublicationReceiptV1` is not a second effect receipt. It is a Publication-owned strict +discriminated union alias of `PublicationBranchReceiptV1 | PublicationPRReceiptV1`; the two concrete +records retain distinct schema versions, paths, field sets and digest domains. `CorrectionIntentV1` +is Publication-owned in `campaign.publication`; it is the strict, complete pre-effect correction +record defined in Task 8, including the prior state/authority/phase lineage, both correction plans, +base/head/tree/bundle roots, every branch/PR/tag/draft/asset identity, prior/proposed latest +pointers, both allowed App actors, named pairwise-distinct effect/receipt-CAS idempotency keys, and +the conditional post-release exposure withdrawal/incident/contaminated tag/Release/history roots. +No opaque aggregate plan hash or unordered effect-key bag is permitted. A nonnull consumed hold is valid +only for the exact `RELEASED` nondismissible/exposure/invalidation/drift consumer and its successor clears +that hold atomically. + +### Exact 05e3d7ba terminal-containment and credential-finality overlay + +This overlay is the implementation delta from the superseded `55b90582` contract to the approved +`05e3d7ba` contract. It supersedes every later reference to a generic +`PublicationInvalidationV1`, a one-stage initial `RejectedResultReleasePlanFixture`, a bare +`RejectedSecurityAttestorTokenRequestFixture`, ordinary direct merge, or a six-row-only post-merge/current-main +exception set. Those names and shapes are negative-test fixtures only; production code must not +export or deserialize them. + +Task ownership is fixed: + +- Task 8 defines the initial/correction intent and phase-exact terminal record unions. +- Task 9 implements ordinary branch/check/PR delivery resolution and the publisher broker ledger. +- Task 10 implements the protected merge-queue policy, terminal containment, terminal guard, + dequeue/fence barrier, post-merge admission, and orchestration of Runtime's containment-start + authority event/wire primitives. It extends Runtime Task 9's canonical security-attestor + substrate with only the `postmerge_rule_suite` caller row and lifecycle. +- Task 11 implements the preauthorized/attested/executable release graph, extends that same + attestor substrate with only the `release_preparation` caller row/lifecycle, and implements the + release-finalizer credential lifecycle. Runtime Task 9 alone bootstraps the shared canonical + attestor records/client and `preflight_rulesets` row. +- Task 14 exercises every crash, response-loss, pagination, queue, rerun, merge, token-closure, and + reconciliation-unavailable branch offline. + +The Runtime-owned imports below must exist before Slice 4 GREEN. The contract test imports every +name, confirms its defining module, and rejects a Publication-local duplicate: + +```python +APPROVED_05E_RUNTIME_IMPORTS = ( + "AnnotatedTagEffectResultsV1", + "AuthorityRefReconciliationReceiptV1", + "BrokerCallerAuthorizationReceiptV1", + "BrokerResponseZeroizationReceiptV1", + "BrokerSigningIdentityV1", + "BrokerSigningKeyV1", + "BrokerTokenClosureDispatchReceiptV1", + "BrokerTokenDeleteAttemptV1", + "BrokerTokenDeliveryIsolationPolicyV1", + "BrokerTokenDenialProbeV1", + "BrokerTokenRedactedSuccessArchiveV1", + "BrokerTokenRequestDispatchReceiptV1", + "BrokerTokenRequestTransportReceiptV1", + "BrokerTokenSafeSuccessProjectionV1", + "BrokerTokenUnrecoverabilityReceiptV1", + "BrokerVaultAuditEntryV1", + "BrokerVaultAuditLogV1", + "BrokerVaultAuditPrefixV1", + "BrokerVaultScopeIdentityV1", + "CampaignEventMutationSourceV1", + "HeldResultMergedConsumptionV1", + "InitialBranchReceiptAppendV1", + "InitialPRReceiptAppendV1", + "InitialPublicationReceiptAppendV1", + "InvalidEventNondismissibilityEvidenceV1", + "InvalidLineageCredentialExposureSupplementV1", + "ProtocolDriftCredentialExposureSupplementV1", + "PublicationMergeDenylistEntryV1", + "PublicationMergeDenylistV1", + "PublicationPreContainmentTerminalRouteV1", + "PublicationTerminalContainmentFinalityV1", + "PublicationTerminalContainmentIntentV1", + "PublicationTerminalContainmentPreflightV1", +) +``` + +The six denylist/containment imports at the end of this tuple are defined exactly once by Runtime in +`laconian_eval.campaign.publication_wire`, because `CampaignStateSchemaV1` and the broker consume +them before Slice 4 exists. Publication Task 10 class-bound revalidates and re-exports none of them; +it imports the identical objects and owns only the effect algorithm and the remaining Publication +evidence records. This direction is a build dependency, not a transfer of publication capability to +Runtime. + +Publication owns the following exact records in `campaign.publication`; no compatibility alias or +dict-shaped substitute is allowed. `test_amendment_contract.py` compares this tuple to the module's +stable export manifest, and the focused schema tests compare every model's ordered fields, +discriminators, strict scalar behavior, domain-separated digest, and nested-root equality to the +approved golden vectors: + +```python +APPROVED_05E_PUBLICATION_TYPES = ( + "ConflictingPublicationObjectsV1", + "CorrectionInvalidationV1", + "InitialPublicationFinalizationV1", + "InitialPublicationInvalidationV1", + "PublicationBranchCreateDeliveryResolutionV1", + "PublicationBranchObservationV1", + "PublicationBranchRulesetObservationReceiptV1", + "PublicationBranchRulesetPolicyV1", + "PublicationCanonicalExternalStateV1", + "PublicationCheckApiArchiveV1", + "PublicationCheckRunPageReceiptV1", + "PublicationCheckRunProjectionV1", + "PublicationCheckRunsObservationV1", + "PublicationCheckRunsSemanticSnapshotV1", + "PublicationCheckSuitePageReceiptV1", + "PublicationCheckSuiteProjectionV1", + "PublicationCheckSuiteRunEnumerationV1", + "PublicationClosedObservationV1", + "PublicationContainmentMainAdvanceProofV1", + "PublicationContainmentMergeWonEvidenceV1", + "PublicationContainmentMergedCandidateV1", + "PublicationEligibilityDeliveryResolutionSetV1", + "PublicationFencedWriteAmbiguityV1", + "PublicationFinalCheckRunsObservationSetV1", + "PublicationGuardCreateAttemptV1", + "PublicationGuardUpdateAttemptV1", + "PublicationHeadCommitObservationV1", + "PublicationLatestPointerObservationV1", + "PublicationMainAdvanceCompareReceiptV1", + "PublicationMainCommitObservationV1", + "PublicationMainComparePageReceiptV1", + "PublicationMainFirstParentCommitV1", + "PublicationMergeEligibilityDeliveryResolutionV1", + "PublicationMergeEligibilityReceiptV1", + "PublicationMergeFenceArtifactArchiveReceiptV1", + "PublicationMergeFenceArtifactEntryV1", + "PublicationMergeFenceArtifactExtractionReceiptV1", + "PublicationMergeFenceArtifactInventoryV1", + "PublicationMergeFenceArtifactPageReceiptV1", + "PublicationMergeFenceArtifactRedirectReceiptV1", + "PublicationMergeFenceCheckRunDiscoveryV1", + "PublicationMergeFenceCheckRunObservationV1", + "PublicationMergeFenceCheckRunPageReceiptV1", + "PublicationMergeFenceDecisionArtifactV1", + "PublicationMergeFenceEvidenceSetV1", + "PublicationMergeFenceRerunAttemptV1", + "PublicationMergeFenceRerunTargetProofV1", + "PublicationMergeFenceWorkflowRunObservationV1", + "PublicationMergeQueueDequeueAttemptV1", + "PublicationMergeQueueDequeueTargetProofV1", + "PublicationMergeQueueInventoryEntryV1", + "PublicationMergeQueueInventoryObservationV1", + "PublicationMergeQueueInventoryPageReceiptV1", + "PublicationMergeQueueObservationV1", + "PublicationMergeQueuePreflightObservationV1", + "PublicationMergeQueueTimelinePageReceiptV1", + "PublicationMergeQueueTimelineReceiptV1", + "PublicationNoLaterEffectsEvidenceV1", + "PublicationPRCloseDeliveryResolutionV1", + "PublicationPRCreateDeliveryResolutionV1", + "PublicationPRMarkerArchiveV1", + "PublicationPRMarkerDiscoveryV1", + "PublicationPRMarkerObservationV1", + "PublicationPRMarkerPageReceiptV1", + "PublicationPRStateObservationV1", + "PublicationPRTerminalDispositionV1", + "PublicationPlanInvalidationDetailV1", + "PublicationPlanInvalidationEvidenceV1", + "PublicationPostGuardVerificationReceiptV1", + "PublicationProtectedMainObservationV1", + "PublicationReleaseAuthorizationLedgerObservationV1", + "PublicationReleaseAuthorizationLedgerSnapshotV1", + "PublicationReleaseInventoryObservationV1", + "PublicationReleaseInventoryPageReceiptV1", + "PublicationRequiredMergeFenceRunReceiptV1", + "PublicationSuccessFinalityEvidenceV1", + "PublicationTerminalGuardDeliveryResolutionV1", + "PublicationTerminalGuardReceiptV1", + "PublicationTerminalGuardRoundV1", + "PublicationTerminalGuardSetV1", + "PublicationTerminalMergeBarrierV1", + "PublicationTerminalMergeSnapshotV1", + "PublicationTerminalReconciliationObservationV1", + "PublicationWriteAmbiguitySetV1", + "PublicationWriteAmbiguitySubjectV1", + "PublisherBarrierCredentialDispositionSetV1", + "PublisherBrokerLedgerEntryV1", + "PublisherBrokerPhaseLedgerPrefixV1", + "PublisherBrokerPhaseLedgerV1", + "PublisherCredentialBrokerPolicyRowV1", + "PublisherCredentialBrokerPolicyV1", + "PublisherCredentialDispositionSetV1", + "PublisherCredentialSubjectV1", + "PublisherNoMintReceiptV1", + "PublisherOperationAttemptProjectionV1", + "PublisherOperationCredentialDispositionV1", + "PublisherOperationFinalObservationProjectionV1", + "PublisherOperationRequestDispatchReceiptV1", + "PublisherOperationTransportProjectionV1", + "PublisherOperationTransportReceiptV1", + "PublisherPaginationArchivePrefixV1", + "PublisherPaginationFailureReceiptV1", + "PublisherPartialContainmentReadV1", + "PublisherPartialReconciliationRoundV1", + "PublisherPartialReconciliationSourceV1", + "PublisherReadAbortReceiptV1", + "PublisherReconciliationAttachmentReceiptV1", + "PublisherReconciliationUnavailableReceiptV1", + "PublisherTokenClosureProjectionV1", + "PublisherWriteAmbiguityFenceAttachmentV1", +) +``` + +Release owns the following records in `campaign.release`; the first two replace the initial use of +`RejectedResultReleasePlanFixture`, while `CorrectionReleaseIntentPlanV1` remains the immutable correction +preauthorization. `RejectedResultReleasePlanFixture` may remain only as a rejected predecessor fixture: + +```python +APPROVED_05E_RELEASE_TYPES = ( + "ExecutableResultReleasePlanV1", + "InitialPreauthorizedResultReleasePlanV1", + "PartialAnnotatedTagEffectV1", + "PartialAssetEffectsV1", + "PostMergeAdmissionSubjectV1", + "ReleaseAuthorizationLedgerEntryV1", + "ReleaseDiscoveryMatchProjectionV1", + "ReleaseDiscoveryPageReceiptV1", + "ReleaseEffectDeliveryResolutionV1", + "ReleaseExternalObjectObservationV1", + "ReleaseExternalObjectsInventoryV1", + "ReleaseFinalizerBrokerLedgerEntryV1", + "ReleaseFinalizerBrokerLedgerV1", + "ReleaseFinalizerBrokerPolicyV1", + "ReleaseFinalizerCallerV1", + "ReleaseFinalizerCredentialDispositionV1", + "ReleaseFinalizerCredentialSubjectV1", + "ReleaseFinalizerNoRequestReceiptV1", + "ReleaseFinalizerOperationPolicyRowV1", + "ReleaseFinalizerOperationSetV1", + "ReleaseFinalizerTokenClosureProjectionV1", + "ReleaseLatestPointerObservationV1", + "ReleaseNoLaterEffectsEvidenceV1", + "ReleaseOperationDispatchReceiptV1", + "ReleaseOperationTransportProjectionV1", + "ReleaseOperationTransportReceiptV1", + "ReleasePlanInvalidationDetailV1", + "ReleasePlanInvalidationEvidenceV1", + "ReleasePreparationEvidenceV1", + "ReleaseReconciliationAttemptSummaryV1", + "ReleaseReconciliationObservationSetV1", + "ReleaseReconciliationObservationV1", + "ReleaseReconciliationTokenClosureReceiptV1", + "ReleaseReconciliationUnavailableReceiptV1", + "SecurityAttestorBrokerLedgerEntryV1", + "SecurityAttestorBrokerLedgerV1", + "SecurityAttestorCallerPolicyRowV1", + "SecurityAttestorCallerPolicyV1", + "SecurityAttestorCredentialDispositionSetV1", + "SecurityAttestorCredentialDispositionV1", + "SecurityAttestorCredentialSubjectV1", + "SecurityAttestorFailureEvidenceV1", + "SecurityAttestorGetDispatchReceiptV1", + "SecurityAttestorGetTransportReceiptV1", + "SecurityAttestorNoRequestReceiptV1", + "SecurityAttestorTokenClosureReceiptV1", +) +``` + +The exact terminal algorithm is constructive and serialized: + +1. Reconcile every ordinary branch, PR, eligibility-check, and close/create transport. Any + response-lost write that cannot be ordered before an authenticated server observation becomes a + `PublicationWriteAmbiguitySubjectV1`; it never becomes a synthetic ordinary success or absence. +2. Build `PublicationTerminalContainmentPreflightV1` from the complete branch/marker/check/queue/ + release-authorization observations. Build `PublicationTerminalContainmentIntentV1`, append every + candidate selector to `PublicationMergeDenylistV1`, and seal matching signed publisher-ledger + and vault prefixes with zero outstanding requests, dispatches, and live tokens. +3. Apply exactly one expected-OID `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` same-state event. It + performs `active_publication_terminal_containment_root: null -> intent_sha256`, monotonically + advances `publication_merge_denylist_root_sha256`, switches the publisher broker to + `terminalizing`, and disables constructive mint. While active, no exposure event, hold, + publication/correction intent, merge admission, release authorization, or unrelated successor + is legal. +4. Iterate at most eight `PublicationTerminalGuardRoundV1` rounds. Each round performs one global + pre-discovery and one global post-discovery, guards every sorted distinct discovered head with a + publisher-App completed-failure check, and finishes only when the candidate set is stable. +5. Build `PublicationTerminalMergeBarrierV1` from two complete global queue inventories, the exact + PR queue/timeline observations, every dequeue attempt, and—only when supported by the frozen + pilot proof—one failed Actions validator fence. An authorized rerun targets the authenticated + prior success, requires accepted HTTP 201 and `run_attempt == source_run_attempt + 1`, then + discovers the new check run by complete suite pagination and verifies the bounded artifact chain: + authenticated artifact pages, authenticated 302 with stripped Authorization/Cookie on the one + allowlisted Location, bounded ZIP archive, exact safe extraction, and decision JSON. +6. Double-read main and walk its complete first-parent chain. Classify every merged candidate and + either produce the disjoint premerge finality, ordinary merge-won finality, or write-ambiguity + merge-won finality. A residual barrier excludes only the already preserved selected merge; no + other queue/head/PR candidate may disappear from evidence. +7. Apply the route's phase-exact terminal event with + `PublicationTerminalContainmentFinalityV1`. The CAS preserves the denylist forever and performs + `active_publication_terminal_containment_root: intent_sha256 -> null`. A late or ambiguous merge + always takes an invalidation/release-block route and cannot authorize a result release or claim. + +`PostMergeAdmissionFailureV1` uses the exact ordered field list in approved design section 12 and +has exactly these failure kinds and schema-ordered predicate vocabulary: + +```python +POSTMERGE_FAILURE_KINDS = ( + "ordinary", + "protocol_authority_drift_race", + "credential_exposure_race", + "reconciliation_unavailable", + "publication_write_ambiguity_merge_race", +) + +POSTMERGE_FAILED_PREDICATES = ( + "unexpected_merge_parent", + "unexpected_merge_method", + "pr_identity_mismatch", + "base_oid_mismatch", + "head_oid_mismatch", + "result_tree_mismatch", + "checks_or_approvals_invalid", + "merge_actor_invalid", + "historical_rules_invalid", + "main_containment_invalid", + "workflow_root_mismatch", + "observation_inconsistent", + "publication_prefix_not_admitted_before_merge", + "publication_close_lost_to_merge", + "publication_reopened_after_close", + "protocol_authority_drift", + "credential_exposure_race", + "publication_reconciliation_unavailable", + "publication_write_ambiguity_merge_race", +) +``` + +The strict source discriminator is +`normal_postmerge_admission|ordinary_terminal_disposition|write_ambiguity`. Normal admission has no +containment fields. Ordinary terminal disposition requires an ordinary merge-won finality and the +exact `PublicationPRTerminalDispositionV1(outcome="already_merged")` for a close/absence race. +Write ambiguity requires the write-ambiguity merge-won finality, an empty signed release- +authorization ledger, and no ordinary disposition/no-later root. Drift and exposure carry only +their class-bound evidence. Reconciliation-unavailable carries the sealed +`PublisherCredentialDispositionSetV1`, `PublisherReconciliationUnavailableReceiptV1`, and signed +empty release-authorization ledger; it never fabricates stable external state or no-later evidence. + +Initial terminal writes use exactly one member of +`InitialPublicationInvalidationV1 | InitialPublicationFinalizationV1`. Correction terminal writes +use exactly `CorrectionInvalidationV1` with outcome +`unmerged_invalid|merged_invalid|fenced_write_ambiguity|reconciliation_unavailable`. Each record +copies its phase-exact premerge/merge-won containment finality, before/after active-root values, +successor denylist root, terminal disposition or fenced/unavailable evidence, and the exact initial +receipt append or correction event parent. There is no generic invalidation model and no field bag +shared across incompatible phases. + +The initial release graph is one-way and acyclic: + +```text +InitialPreauthorizedResultReleasePlanV1 + -> SecurityAttestorReceiptV1(result="pass", attestation_purpose="release_preparation") + -> ExecutableResultReleasePlanV1(intent_kind="initial") + -> ResultReleaseIntentV1 + -> ReleaseEffectAuthorizationV1 / effect delivery resolutions / receipt appends +``` + +The receipt-free preauthorized plan binds the admitted merge, exact result tree, protected annotated +tag bytes/OID, draft metadata, two ordered assets, policies, finalizer identity, workflow root, and +all idempotency keys. The external security-attestor broker binds that root and closes its token +before returning a signed pass or failure record. The executable plan copies immutable effect identities from preauthorization and adds only +the attested observed merge facts. Initial intent embeds the whole executable graph. Correction +uses the already frozen `CorrectionReleaseIntentPlanV1` and original `CorrectionIntentV1`; the +observed correction merge cannot retarget its protected tag. + +Publisher, security-attestor, and release-finalizer credentials each use a signed broker policy, +cycle-free credential subject, request-start receipt before every network dispatch, terminal +transport receipt, append-only phase ledger, vault audit log, and exactly one terminal disposition. +Successful or permission-mismatched mint closes through `revoked_204`, +`ambiguous_delivery_then_confirmed_unusable`, or `expired_then_confirmed_unusable`; unknown token +delivery uses the broker-signed unrecoverability proof and zero operation dispatches. Every closure +proves zero same-token dispatch starts after its first decisive boundary. `no_request`, definite +denial, permission mismatch, delivery unknown, stable read, write-ambiguity fenced, and +reconciliation-unavailable are explicit closed variants—not nullable shorthand. A failure to obtain +two complete stable reconciliation passes seals the role-specific unavailable receipt and grants +no release authority. + +Each owning task below creates its assigned focused RED file before that task's production or +workflow-YAML change; together those assignments cover exactly: + +- `tests/campaign/test_publication_delivery_resolution.py` +- `tests/campaign/test_publication_terminal_containment.py` +- `tests/campaign/test_publication_merge_queue.py` +- `tests/campaign/test_publication_merge_fence.py` +- `tests/campaign/test_publication_terminal_records.py` +- `tests/campaign/test_publisher_credential_finality.py` +- `tests/campaign/test_security_attestor_credential_finality.py` +- `tests/campaign/test_release_authorization_graph.py` +- `tests/campaign/test_release_finalizer_credential_finality.py` +- `tests/campaign/test_reconciliation_unavailable.py` + +Run the first missing-type RED, implement one ownership group at a time, and require the complete +focused gate to be GREEN: + +```bash +uv run pytest -p no:cacheprovider \ + tests/campaign/test_amendment_contract.py \ + tests/campaign/test_publication_delivery_resolution.py \ + tests/campaign/test_publication_terminal_containment.py \ + tests/campaign/test_publication_merge_queue.py \ + tests/campaign/test_publication_merge_fence.py \ + tests/campaign/test_publication_terminal_records.py \ + tests/campaign/test_publisher_credential_finality.py \ + tests/campaign/test_security_attestor_credential_finality.py \ + tests/campaign/test_release_authorization_graph.py \ + tests/campaign/test_release_finalizer_credential_finality.py \ + tests/campaign/test_reconciliation_unavailable.py -q +``` + +Expected RED: the first not-yet-owned exact schema/event/import fails before any fake transport +dispatch. Expected GREEN: every listed schema golden vector, every legal route, and every negative +cross-phase/unknown-field/response-loss/token-reuse case passes with the fake transport proving no +unauthorized call. + +### Mandatory pre-task contract gate (outside Tasks 1–15) + +This synchronization gate is deliberately not a sixteenth implementation task; it is the Slice 4 +entry contract that is committed after the owning Slice 1–3 imports are GREEN and before Task 1. + +**Files:** +- Modify: `docs/superpowers/plans/2026-08-30-public-benchmark-publication.md` +- Create and own in this task: `tests/campaign/test_amendment_contract.py` + +- [ ] **Step 1: Write the RED contract test** + +Assert the approved/governance SHAs, exact imported type names, 15-member workflow inventory, +serial Git DAG, state events, caller/ref/event matrix, API endpoint/query allowlist, strict scalar +rejection, and absence of flattened compatibility aliases. + +Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_amendment_contract.py -q +``` + +Expected RED: collection fails only for the first missing approved schema import; it must not fail +for fixture syntax, missing dependency installation, network access, or an unrelated test. + +- [ ] **Step 2: Run the pinned-SDK precredential RED gate** + +```bash +uv run pytest -p no:cacheprovider \ + tests/test_openai_provider.py::test_benchmark_sdk_contract_fails_before_provider_access \ + tests/benchmark/test_judge.py::test_judge_requires_openai_3_3_1_and_tagged_uv_lock_before_credentials -q +``` + +Expected RED until the owning slices supply the exact `openai==3.3.1` and C0-derived `uv.lock` +contract. Every mismatch leaves the fake provider call count at zero. + +- [ ] **Step 3: Run GREEN after owning imports are synchronized** + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_amendment_contract.py -q +uv run pytest -p no:cacheprovider tests/campaign/test_state_schema.py \ + tests/campaign/test_state.py tests/campaign/test_state_broker.py \ + tests/campaign/test_authority_git.py tests/campaign/test_preflight.py -q +``` + +Expected GREEN: PASS; the generated transition/caller matrices contain no wildcard, unreachable or +table-only edge, and all approved schema roots reproduce independently. + +- [ ] **Step 4: Commit the synchronized executable contract once GREEN** + +```bash +git add tests/campaign/test_amendment_contract.py +git commit -m "test: lock approved benchmark amendment contract" +``` + +Never use `git add .`, never create a compatibility shim, and do not combine plan synchronization +with production implementation. This task owns this test and no later task recreates it. + +### Closed authority/effect overlay for every task below + +The following generated matrix is part of the implementation contract and overrides every later +single-root or phase-only shorthand. Before any authority mutation, credential mint/map/use, +provider call, artifact access/download, publisher or security-attestor effect, release, +correction, documentation, site, release-note, presentation, or social effect, the caller performs +fresh double reads of both protected refs, the stable two-ruleset policy projection, the companion +tag binding and campaign registry, and proves the workflow bytes against the 15-member C0 +`WorkflowInventoryV1`. A transient or inconsistent read causes no token, effect, artifact access, +or state change. + +Ordinary edges require both `unresolved_hold_root` and +`active_credential_exposure_pending_root` to be null. The only atomic nonnull-hold consumers are +`INVALID_EVENT_DISMISSED`; premerge `PERMANENT_STOP` for `invalid_event_nondismissible`, +`credential_exposure`, or `protocol_authority_drift`; `RESULT_MERGED -> RELEASE_PLAN_INVALIDATED`; +and `RELEASED -> CORRECTION_INTENT_AUTHORIZED` with the exact nondismissible, exposure, +invalidation, or protocol-drift discriminator/evidence. Each binds the predecessor hold and clears it in the same +expected-OID CAS. `INVALID_PREFIX_SEALED` and every other publication, promotion, release, +correction, safe-finalization, documentation, or social edge require both roots null. + +`INVALID_EVENT_HELD` is a broker-owned self-loop only in the spec's exact hold-eligible states and +only after authenticated identity/transport succeeds but event schema/parent/hash/edge validation +fails; pre-auth garbage, transient reads, and benign stale siblings are audit denials only. While a +hold exists, only `INVALID_EVENT_DISMISSED`, its exact nondismissible STOP, the typed emergency +credential/drift STOP consumers, or the two postmerge consumers above are reachable. The dismissal +uses the C0-frozen `InvalidEventDismissalPlanV1`, caller-discriminated eligible dismisser OIDC +identity, signed `InvalidEventDismissalEvidenceV1`, and consumes exactly one hold. + +Credential exposure is always two phase: an expected-OID `CREDENTIAL_EXPOSURE_PENDING` self-loop +atomically installs `CredentialExposurePendingV1`, the provisional denylist and initial +`CredentialExposureProgressRootV1`; then each inventoried idempotent containment action is adopted +by an ordinal, predecessor-bound `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` self-loop; only a complete +terminal chain permits `PERMANENT_STOP(reason=credential_exposure)` or, from an already stopped +lineage, `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`. The terminal evidence binds and consumes the +active progress root, clears the active fields, installs the permanent denylist, and includes the +publisher-only exact PR-close receipt when the parent was `COMPLETE_PUBLICATION_PR_OPEN`. A merge +race switches to the approved postmerge invalidation/correction exposure route. Exposure +containment takes precedence over simultaneous protocol drift; drift evidence is bound into the +incident and no intervening drift-only STOP is allowed. + +The protected-current-main exceptions are closed to: drift containment; exposure pending, +progress, final STOP/supplement (including `benchmark-publish` only for an open publication PR and +its publisher-only close); and safe-invalid continuation for any sealed STOP/BUDGET lineage. They +require current protected main, fresh authenticated drift/current-rule observations, and +byte-identical C0 caller/reusable workflow members under the frozen +`MainFallbackLivenessPolicyV1`; no other publish event gains this exception. Repository admission +must keep those fallback members unchanged while a campaign is nonterminal. Platform-admin bypass +is a recorded trust limitation, not a recovery mechanism. + +### Exact protocol and API evidence overlay + +Preflight and every downstream builder consume the serial protected closure +`T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1`, the single companion +`ProtocolAttestationTagBindingV1`, `CampaignRegistryV1`, and a +`ProtocolReviewObjectArchiveV1` containing exact raw bytes of every closure object plus strict +one-to-one API receipt/blob bindings. Network-free replay reconstructs all Git objects and every +safe response digest from archived response-body bytes and canonical projection bytes; those API +bytes remain GitHub-origin observations, not independent cryptographic provenance. + +The two applicable tag rulesets are exact and disjoint: the creation-authorizer targets T0/T1, +contains only `creation`, and has the sole frozen operator `User` bypass with `always`; the +immutability ruleset targets the same patterns, contains only `update` and `deletion`, and has no +bypass actors. Historical creation-suite evidence maps the raw GitHub suite top-level +`result="bypass"` exactly to stable receipt `overall_result="bypass"`, retains stable +`evaluation_result="fail"`, requires all-zero `before_sha`, exact annotated-tag `after_sha`, the registered +actor, and exactly one per-rule projection whose source is the sealed creation ruleset, +`enforcement=active`, `rule_type=creation`, and `result=fail`. Main merge suites instead map raw +top-level `result="pass"` to their stable `overall_result="pass"`, require every applicable +per-rule `result="pass"`, and permit no bypass. Volatile names/details/request metadata remain only in the +safe archived raw receipt blobs. + +All new records and nested variants use strict CanonicalJSONV1 models and their exact approved +domain-separated preimages; no Publication model accepts permissive `int`, `bool`, float, numeric +string, unknown key, reordered semantic array, omitted required field, or self-inclusive digest. + +Write the amendment matrix/archive fixtures first and run: + +```bash +uv run pytest -p no:cacheprovider \ + tests/campaign/test_amendment_contract.py \ + tests/benchmark/test_protocol_review.py \ + tests/campaign/test_state_broker.py -q +``` + +Expected RED: the first absent exact schema/event/archive binding fails and the fake transport has +zero unauthorized calls. After the owning prerequisite implementations, the same command is GREEN +with every referenced generated state/caller row reached and two network-free protocol-review +archive imports producing identical roots. Publication crash recovery remains owned by Task 14 and +is not invoked before that test file exists. + +--- + +## Slice boundary and prerequisite contract + +Do not begin this slice until the following imports and focused suites are green. Slice 4 does not +reimplement campaign state, provider execution, spend accounting, scoring, inference, sampling, or +statistical estimators; it composes their neutral APIs under campaign authority. + +Required Slice 3 interfaces: + +```python +from laconian_eval.campaign.authority import ( + DraftReleaseReceiptV1, + FinalReleaseVerificationReceiptV1, + InitialAssetReceiptsAppendV1, + InitialDraftReleaseReceiptAppendV1, + InitialPublishReceiptAppendV1, + InitialReleaseReceiptAppendV1, + InitialTagReceiptAppendV1, + GitHubOidcRunIdentityV1, + InstallationTokenRevocationReceiptV1, + PublishReceiptV1, + ReconstructedAuthorityV1, + ReleaseAssetReceiptV1, + ReleaseEffectAuthorizationV1, + ReleaseEffectResultV1, + TagReceiptV1, + append_initial_release_receipt, + require_ordinary_effect_gate, +) +from laconian_eval.campaign.artifact_wire import ArtifactEnvelopeV1, UploadAuthorizationV1 +from laconian_eval.campaign.runtime import Runtime +from laconian_eval.campaign.preflight import CampaignRegistryV1 +from laconian_eval.campaign.spend import SpendLedgerV1 +from laconian_eval.campaign.state import ( + CampaignEventV1, + CampaignStateV1, + InvalidEventHoldV1, + TerminalCredentialExposureConsumptionV1, +) +from laconian_eval.campaign.models import GitHubAppInstallationIdentityV1 +``` + +`Publication`, `_reconstruct_verified_publication`, and the live evaluation-stage capability are +Slice 4 outputs created by Task 7 below; they are not Slice 3 prerequisites. + +Required sealed-evidence interfaces from the earlier slices: + +```python +from laconian_eval.benchmark.aggregation import aggregate_verified_evidence +from laconian_eval.benchmark.hard_score import ( + HardScoreRequestSetV1, + verify_hard_score_request_set, +) +from laconian_eval.benchmark.judge import ( + JudgeAttachmentV1, + JudgeRequestAttachmentV1, + verify_judge_attachment, + verify_judge_request_attachment, +) +from laconian_eval.benchmark.provider_evidence import ( + VerifiedBenchmarkProviderEvidenceV1, + build_audit_population, + load_verified_benchmark_provider_evidence, +) +from laconian_eval.benchmark.audit_sampling import ( + VerifiedAuditSampleRootV1, + load_verified_audit_sample_root, + select_audit_sample, + write_audit_sample_root, +) +from laconian_eval.benchmark.reporting import ( + BootstrapArtifactV1, + VerifiedAnalysisEvidenceV1, + VerifiedAuditEvidenceV1, + analyze_campaign, + build_bootstrap_artifact, + load_verified_analysis_evidence, + load_verified_audit_evidence, + write_analysis_evidence_root, + write_audit_evidence_root, +) +from laconian_eval.capsule.seal_models import SealV1, capsule_sha256 +from laconian_eval.capsule.sidecars import VerifiedScoredCapsuleV2, load_verified_scored_capsule +from laconian_eval.capsule.sharding import ShardPlanV1 +``` + +Required command before Task 1: + +```bash +uv sync --all-extras --locked +uv run pytest \ + tests/campaign/test_preflight.py \ + tests/campaign/test_artifact_wire.py \ + tests/campaign/test_state.py \ + tests/campaign/test_authority.py \ + tests/campaign/test_spend.py \ + tests/capsule/test_sharding.py \ + tests/capsule/test_seal_models.py \ + tests/capsule/test_sidecars.py \ + tests/capsule/test_verify_sealed.py \ + tests/benchmark -q +``` + +Expected: PASS. A missing import or failing prerequisite test blocks Slice 4; fix it in its owning +slice rather than adding compatibility aliases here. + +Slice 2 exposes exactly seven offline/non-evidentiary `laconian-benchmark` replay commands with +`allow_abbrev=False`: `hard-score`, `prepare-judge`, `seal-judge`, `sample-audit`, `seal-audit`, +`analyze`, and `verify`. No live workflow invokes them. The exact live ownership tuple is: + +```text +laconian_eval.campaign.runtime.Runtime.hard_score +laconian_eval.campaign.runtime.Runtime.prepare_judge +laconian_eval.campaign.runtime.Runtime.seal_judge +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.sample_audit +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.seal_audit +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.analyze +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.verify +``` + +The only constructors are private +`laconian_eval.campaign.runtime._reconstruct_verified_runtime` and +`laconian_eval.campaign.publication._reconstruct_verified_publication`. They accept authority- +derived in-memory capabilities; no capability, wrapper, or alleged expectation is serialized into +an artifact, provider index, command line, workflow input, or environment value. + +## Locked Slice 4 interfaces + +The following public names and signatures are normative for this plan: + +```python +from pathlib import Path +from typing import Annotated + +from pydantic import Field + +from laconian_eval.campaign.artifacts import ( + VerifiedArtifactArchive, + VerifiedArtifactRootV1, + fetch_exact_artifact, + materialize_verified_artifact_root, +) +from laconian_eval.campaign.collector import ( + collect_complete_bundle, + finalize_invalid_prefix, +) +from laconian_eval.campaign.github_records import ( + ExactArtifactLocatorV1, + GitHubReadClient, +) +from laconian_eval.campaign.provider_evidence import ( + EvidenceInventoryV1, + seal_provider_evidence_inventory, +) +from laconian_eval.campaign.public_projection import ( + BundleSealV1, + PublicProjectionPolicyV1, + verify_public_projection, +) +from laconian_eval.campaign.publication import ( + BlockedReleaseObjectsV1, + CorrectionAssetIdempotencyV1, + CorrectionCredentialExposureWithdrawalV1, + CorrectionEffectActorsV1, + CorrectionFinalizationV1, + CorrectionIntentV1, + CorrectionInvalidationV1, + CorrectionLineageV1, + CorrectionMergeReceiptV1, + CorrectionPhaseLineageV1, + CorrectionPublicationIdempotencyKeysV1, + CorrectionPublicationIntentPlanV1, + CorrectionInvalidationIntentParentV1, + CorrectionInvalidationPublicationReceiptParentV1, + CorrectionInvalidationParentV1, + CorrectionPublicationReceiptV1, + CorrectionReleaseAssetV1, + CorrectionReleaseIdempotencyKeysV1, + CorrectionReleaseIntentPlanV1, + CorrectionReleaseReceiptV1, + CorrectionTagReceiptV1, + DriftHeldReleasedConsumptionV1, + ExposureHeldReleasedConsumptionV1, + HeldReleasedConsumptionV1, + GitHubHumanAccountObservationV1, + InvalidationHeldReleasedConsumptionV1, + LatestPublicationPointerV1, + NondismissibleHeldReleasedConsumptionV1, + InitialPublicationFinalizationV1, + InitialPublicationInvalidationV1, + Publication, + PublicationBranchReceiptV1, + PublicationClosePlanV1, + PublicationCloseReceiptV1, + PublicationIntentV1, + PublicationPlanV1, + PublicationMergeReceiptV1, + PublicationPRReceiptV1, + PublicationReceiptV1, + ProposedLatestPointerConstraintV1, + build_correction_publication_plan, + build_correction_release_intent_plan, + build_publication_plan, + validate_publication_pull_request, +) +from laconian_eval.campaign.release import ( + ExecutableResultReleasePlanV1, + InitialPreauthorizedResultReleasePlanV1, + ReleaseEffectDeliveryResolutionV1, + ReleaseFinalizerCredentialDispositionV1, + ReleaseFinalizerOperationSetV1, + ReleasePreparationEvidenceV1, + ReleaseReconciliationUnavailableReceiptV1, + ResultReleaseIntentV1, + SecurityAttestorCallerPolicyV1, + SecurityAttestorCredentialDispositionSetV1, + SecurityAttestorFailureEvidenceV1, + SecurityAttestorReceiptV1, + build_correction_release_plan, + build_executable_result_release_plan, + build_initial_preauthorized_result_release_plan, + build_result_release_intent, +) +``` + +Every writer uses exclusive creation under a caller-owned empty staging directory, fsyncs files and +directories, verifies the complete result, and publishes by atomic rename. Every verifier accepts +explicit paths or exact IDs; none searches for a newest artifact, infers a campaign from a branch +name, or follows a mutable ref. + +## Locked publication state contract + +The generated `CampaignStateSchemaV1` remains the sole transition source; this plan may not define a +parallel enum. Publication tests render and verify these exact disjoint paths: + +```text +BUNDLE_COLLECTED + -- PUBLICATION_INTENT_AUTHORIZED(bundle_kind=complete) --> BUNDLE_COLLECTED + -- COMPLETE_PUBLICATION_PR_OPENED --> COMPLETE_PUBLICATION_PR_OPEN +COMPLETE_PUBLICATION_PR_OPEN + -- RESULT_MERGED + PostMergeAdmissionEvidenceV1 --> RESULT_MERGED + -- RESULT_MERGE_INVALIDATED + PostMergeAdmissionFailureV1 --> RELEASE_BLOCKED + -- COMPLETE_PUBLICATION_PLAN_INVALIDATED + exact close receipt --> BUNDLE_COLLECTED + +INVALID_FINALIZED + -- PUBLICATION_INTENT_AUTHORIZED(bundle_kind=invalid_prefix) --> INVALID_FINALIZED + -- INVALID_PUBLICATION_PR_OPENED --> INVALID_PUBLICATION_PR_OPEN +INVALID_PUBLICATION_PR_OPEN + -- INVALID_PREFIX_MERGED + PostMergeAdmissionEvidenceV1 --> INVALID_PREFIX_MERGED + -- INVALID_PREFIX_MERGE_INVALIDATED + PostMergeAdmissionFailureV1 --> INVALID_PREFIX_MERGED_INVALID + -- INVALID_PUBLICATION_PLAN_INVALIDATED + exact close receipt --> INVALID_FINALIZED +``` + +The generated schema also includes, without a Publication-local enum, the approved self-loop +events `INVALID_EVENT_HELD`, `INVALID_EVENT_DISMISSED`, `CREDENTIAL_EXPOSURE_PENDING`, +`CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, and `PUBLICATION_TERMINAL_CONTAINMENT_STARTED`; the +exhaustive ordinary `PERMANENT_STOP` reason/evidence union; terminal +`CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`; and the exact drift/exposure/hold/containment consumers +described in the authority/effect overlay. Every state contains a nonnull monotone +`publication_merge_denylist_root_sha256` and nullable +`active_publication_terminal_containment_root`. Tests generate this table and the literal +caller/current-parent/ref/reason/evidence matrix from Runtime's schema, exercise every row, and +assert no wildcard, unreachable row, implicit delegation, second unresolved hold, containment- +root overwrite, denylist deletion, or transition that fails to consume its bound predecessor root. +`benchmark-publish` receives pending/progress/final credential grants at +`COMPLETE_PUBLICATION_PR_OPEN`; only its publisher App may perform the close effect. The same frozen +workflow receives the exact protected-current-main containment-start and terminal-consumer rows for +active initial/correction publication prefixes. The other incident-capable workflow callers receive +only their exact state/ref rows. + +`COMPLETE_PUBLICATION_PR_OPEN` and `INVALID_PUBLICATION_PR_OPEN` are distinct schema values; an +untyped publication-open alias, cross-kind open/close/merge events, and missing bundle +discriminators are rejected. `INVALID_PREFIX_MERGED` and `INVALID_PREFIX_MERGED_INVALID` are terminal and accept no +release, correction, documentation, website, release-note, or social-promotion event. + +## File map + +### Create + +- `src/laconian_eval/campaign/github_records.py`: strict GitHub repository, workflow-run, + run-attempt, job, deployment, approval, artifact, and exact-locator records plus the sole + Publication-owned, capability-separated `GitHubReadClient`; it imports the Runtime-owned + `ArtifactEnvelopeV1` wire type rather than redefining it. +- `src/laconian_eval/campaign/artifacts.py`: exact-ID REST retrieval, bounded outer-ZIP handling, + service-digest checking, and internal envelope verification. +- `src/laconian_eval/campaign/provider_evidence.py`: read-only generation/hard-score/judge/spend + completeness verifier and `EvidenceInventoryV1` seal. +- `src/laconian_eval/campaign/public_projection.py`: public file roles, allowlists, secret scanning, + Markdown neutralization, checksums, and `BundleSealV1`. +- `src/laconian_eval/campaign/collector.py`: separate complete-bundle and invalid-prefix writers. +- `src/laconian_eval/campaign/publication.py`: created in Task 7 with the non-public + `_reconstruct_verified_publication` constructor and `Publication.campaign.evaluation_stage` + capability; Tasks 8–10 modify it with `PublicationPlanV1`, deterministic Git tree/commit + construction, the one pre-effect correction intent binding both publication and release plans, + strict held-`RELEASED` consumer union, sole ownership of phase-exact initial/correction terminal + records, ordinary delivery resolution, terminal guard/containment/barrier/fence evidence, + byte-copy publication records, and PR/admission validators. +- `src/laconian_eval/campaign/publisher_broker.py`: exact publisher operation-row policy, signed + safe transport/closure/vault-ledger projections, and verifier; no token-bearing implementation is + importable by Actions code. +- `src/laconian_eval/campaign/docs_gate.py`: post-`RELEASED` synchronized documentation/social + provenance validation. +- `tools/benchmark_minimal_publisher.py` and `tools/benchmark_publisher_broker_client.py`: + secret-free deterministic publisher package builder and OIDC broker client. +- `tools/benchmark_release_finalizer.py`: secret-free deterministic release request builder. +- `tools/benchmark_release_inventory_monitor.py`: externally scheduled, repository-read-only exact + released-object inventory verifier. +- `ops/benchmark-release-inventory-monitor.toml`: exact external deployment/cadence/egress contract. +- `docs/runbooks/benchmark-release-inventory-monitor.md`: alert triage and reviewed defect-PR runbook. +- `tools/benchmark_prepare_correction.py`: fixed correction-bundle and correction-plan preparation + executable. +- `tools/benchmark_sample_audit_stage.py`: fixed authority-bound audit-sample executable. +- `tools/benchmark_seal_audit_stage.py`: fixed authority-bound audit-sealing executable. +- `tools/benchmark_analyze_stage.py`: fixed authority-bound analysis executable. +- `tools/benchmark_verify_stage.py`: fixed authority-bound analysis verification executable. +- `tools/validate_publication_pr.py`: trusted-base PR validation entry point. +- `tools/validate_audit_pr.py`: trusted-base commitment/reveal/adjudication PR validation entry point. +- `tools/validate_result_docs.py`: trusted-base post-release documentation validation entry point. +- `tests/campaign/publication_helpers.py`: deterministic complete, invalid-prefix, Git, and GitHub + fixture builders. +- `tests/campaign/fake_github.py`: bounded in-memory GitHub REST transport with recorded calls. +- `tests/campaign/test_github_records.py` +- `tests/campaign/test_artifacts.py` +- `tests/campaign/test_provider_evidence.py` +- `tests/campaign/test_public_projection.py` +- `tests/campaign/test_complete_collector.py` +- `tests/campaign/test_invalid_prefix_finalizer.py` +- `tests/campaign/test_publication_plan.py` +- `tests/campaign/test_minimal_publisher.py` +- `tests/campaign/test_publication_pr.py` +- `tests/campaign/test_publication_delivery_resolution.py` +- `tests/campaign/test_publication_terminal_containment.py` +- `tests/campaign/test_publication_merge_queue.py` +- `tests/campaign/test_publication_merge_fence.py` +- `tests/campaign/test_publication_terminal_records.py` +- `tests/campaign/test_publisher_credential_finality.py` +- `tests/campaign/test_release_authorization_graph.py` +- `tests/campaign/test_release_finalizer_credential_finality.py` +- `tests/campaign/test_reconciliation_unavailable.py` +- `tests/campaign/test_audit_pr.py` +- `tests/campaign/test_result_release.py` +- `tests/campaign/test_docs_gate.py` +- `tests/campaign/test_publication_capability.py` +- `tests/campaign/test_evaluation_stage.py` +- `tests/campaign/evaluation_stage_contract.py` +- `tests/campaign/test_publication_workflows.py` +- `tests/campaign/test_publication_reconstruction.py` +- `.github/workflows/benchmark-hard-score.yml` +- `.github/workflows/benchmark-evidence.yml` +- `.github/workflows/benchmark-audit.yml` +- `.github/workflows/benchmark-analysis.yml` +- `.github/workflows/benchmark-collect-complete.yml` +- `.github/workflows/benchmark-finalize-invalid.yml` +- `.github/workflows/audit-pr-validate.yml` +- `.github/workflows/benchmark-publish.yml` +- `.github/workflows/publication-pr-validate.yml` +- `.github/workflows/benchmark-release.yml` +- `.github/workflows/benchmark-docs-validate.yml` + +### Modify + +- `src/laconian_eval/campaign/__init__.py`: export only stable Slice 4 record types. +- `src/laconian_eval/campaign/release.py`: created by Runtime Task 9 with canonical + security-attestor records; Publication Tasks 10–11 add the postmerge/release-preparation records, + receipt-free/executable plans, initial intent, release assets, finalizer ledgers/dispositions, and + reconciliation evidence without redefining Runtime-owned effect/append wires. +- `src/laconian_eval/campaign/release_broker.py`: created by Runtime Task 9 with the + `preflight_rulesets` verifier; Publication Tasks 10–11 add only the postmerge, + release-preparation, and release-finalizer policy rows. Raw token-bearing vault code remains + external. +- `tools/benchmark_release_broker_client.py`: secret-free OIDC client created by Runtime Task 9 and + extended only for the exact later policy rows. +- `tests/campaign/test_release_broker.py` and + `tests/campaign/test_security_attestor_credential_finality.py`: created by Runtime Task 9 and + extended by their exact postmerge/release-preparation owners. +- `.github/workflows/benchmark-publication-state.yml`: created by Runtime Task 9; Publication Task 7 + adds the audit/analysis/collection caller rows and Task 10 adds publication/admission callers. +- `tests/campaign/test_workflow_policy.py`: extend the repository-wide workflow security contract. +- `tests/test_public_contract.py`: extend the stable export and live/offline ownership contract + without adding a public campaign CLI. +- `tests/test_ci_contract.py`: include Slice 4 workflow names in the repository workflow contract. +- `benchmarks/runbooks/public-benchmark.md`: extend the Slice 3 operator runbook with collection, + publication approval, merge, release, recovery, and post-release procedures. +- `CONTRIBUTING.md`: document the result-PR and post-release documentation review gates. +- `evals/README.md`: document reconstruction from a committed complete bundle. +- `SECURITY.md`: document public Actions artifacts, credential-incident handling, and output + non-execution. + +Do not modify `.gitignore`: local smoke output remains ignored. The minimal publisher uses +`git add --force -- benchmarks/results/{campaign_id}` only after verifying the sealed fixed-path +inventory. + +## Canonical published trees + +The complete collector may create only this role-addressed tree under its staging root: + +```text +bundle.json +campaign/registry.json +campaign/state.json +campaign/spend-ledger.json +campaign/artifact-inventory.json +campaign/plan-index.json +provenance/input-tag.json +provenance/workflows.jsonl +provenance/reviewer-attestations.jsonl +provenance/repository-trust-boundary.json +provenance/repository-trust-boundary-signature.json +inputs/manifests/gpt-5.6-luna.json +inputs/manifests/gpt-5.6-sol.json +inputs/manifests/gpt-5.6-terra.json +inputs/price-snapshot.json +inputs/campaign-seed.json +inputs/reviewers.yaml +inputs/protocol-reviewers.yaml +inputs/cases/response.yaml +inputs/arms/baseline.txt +inputs/arms/concise.txt +inputs/arms/caveman/SKILL.md +inputs/arms/caveman/SOURCE.md +inputs/arms/caveman/LICENSE.txt +inputs/arms/if/SKILL.md +inputs/protocols/hard-score.json +inputs/protocols/judge.json +inputs/protocols/statistics.json +inputs/protocols/audit.json +inputs/protocols/retry.json +inputs/protocols/checkpoint.json +inputs/protocols/publication.json +generation/{model_id}/{scenario_uid}/capsule.tar +generation/{model_id}/{scenario_uid}/capsule.tar.sha256 +hard-score/{model_id}/{scenario_uid}/request-set.json +judge-requests/{model_id}/{scenario_uid}/attachment.json +judge/{model_id}/{scenario_uid}/attachment.json +audit/audit-evidence.json +audit/population-attachment.json +audit/population.jsonl +audit/sample-manifest.json +audit/blind-packet.json +audit/commitments/{reviewer_id}.json +audit/reveals/{reviewer_id}/reveal.json +audit/reveals/{reviewer_id}/labels.jsonl +audit/adjudication-core.json +audit/adjudication.json +audit/signoffs/{reviewer_id}.json +audit/github-review-records/{review_id}.json +audit/metrics.json +analysis/analysis-evidence.json +analysis/analysis.json +analysis/bootstrap.json +analysis/report.md +analysis/checksums.json +report.md +limitations.md +REPRODUCE.md +checksums.sha256 +``` + +`{model_id}`, `{scenario_uid}`, and `{reviewer_id}` denote canonical values taken from sealed +records, validated as single safe path components, and sorted by UTF-8 bytes. Braces in this plan +denote validated grammar variables, never an implementation instruction to invent a path. + +The invalid-prefix finalizer may create only: + +```text +bundle.json +campaign/registry.json +campaign/state.json +campaign/spend-ledger.json +campaign/completed-prefix.json +campaign/missing-suffix.json +campaign/incident.json +provenance/input-tag.json +provenance/safe-workflows.jsonl +provenance/repository-trust-boundary.json +provenance/repository-trust-boundary-signature.json +limitations.md +REPRODUCE.md +checksums.sha256 +``` + +It must reject generation output, hard-score, judge, audit, analysis, report, pairwise comparison, +effect estimate, confidence interval, or model-ranking members. + +--- + +### Task 1: Add strict GitHub execution and artifact records + +**Files:** +- Create: `src/laconian_eval/campaign/github_records.py` +- Create: `tests/campaign/test_github_records.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +- [ ] **Step 1: Write the failing exact-record round-trip test** + +Add a fixture with repository ID `1343493800`, workflow run ID `41000000001`, run attempt `2`, +job ID `99000000001`, deployment ID `6100000001`, artifact ID `9700000001`, and full 40-character +Git object IDs. Assert canonical field order and rejection of booleans, floats, zero IDs, unknown +fields, a non-`workflow_dispatch` event, a branch ref on a tag-only caller row or unbound main +branch, a non-SHA action workflow hash, an +environment without deployment/approval, and deployment data on a secret-free artifact. + +Use this exact model interface: + +```python +class ExactArtifactLocatorV1(CapsuleModel): + schema_version: Literal["1"] + repository_id: StrictPositiveInt + workflow_run_id: StrictPositiveInt + run_attempt: StrictPositiveInt + job_id: StrictPositiveInt + job_name: BoundedNonBlankString + batch_attempt_id: UUID4 | None + event: Literal["workflow_dispatch"] + input_ref: BoundedNonBlankString + input_tag_object_sha: GitObjectId + input_commit_sha: GitObjectId + workflow_path: RelativePosixPath + workflow_sha256: Sha256 + environment: Literal["benchmark-live", "benchmark-publish"] | None + deployment_id: StrictPositiveInt | None + approval_actor_id: StrictPositiveInt | None + approval_actor_login: BoundedNonBlankString | None + artifact_id: StrictPositiveInt + artifact_name: BoundedNonBlankString + artifact_digest: Sha256 + artifact_created_at_utc: CanonicalTimestamp + inner_archive_byte_length: StrictNonNegativeInt + inner_archive_sha256: Sha256 + upload_authorization: UploadAuthorizationV1 | None + envelope_sha256: Sha256 + payload_kind: Literal["canonical_file", "root_ustar"] + payload_name: RelativePosixPath + payload_byte_length: StrictNonNegativeInt + payload_sha256: Sha256 + materialized_root_sha256: Sha256 | None + credential_scan_receipt_sha256: Sha256 | None + source_credential_scan_receipt_root_sha256: Sha256 | None +``` + +`input_ref` must be the exact protected input tag for tag-bound caller rows or literal +`refs/heads/main` for a plan-bound publication caller row; the workflow inventory/policy selects the +form and main additionally binds its exact commit. Environment, deployment, +and approval fields are either all null or all populated. Each nonnull environment requires its +exact deployment/approval evidence. `benchmark-live` remains the distinct provider boundary. +`benchmark-publish` hosts separately approved jobs whose credentials identify distinct publisher +and release-finalizer Apps. Broker mutation receipts have a null environment and the distinct +state-writer App identity; no Actions state-writer job or secret exists, and `benchmark-state` and +`benchmark-release` environments are forbidden. +`UUID4` is the exact strict runtime scalar from `campaign.models`; locator/envelope round-trip tests +use the same `ProviderJobIdentityV1.batch_attempt_id` value and reject SHA-256-shaped substitutes. +Every locator field shared with `ArtifactEnvelopeV1` must byte-equal the class-bound revalidated +envelope. The inner archive digest/length come from the detached producer upload authorization and +are verified after streaming the sole outer member; they are not embedded in the envelope and thus +do not form a self-digest cycle. Direct `generation_batch|judge_attempt_batch` locators require the +full class-bound `UploadAuthorizationV1` nested here and exact equality of its inner/payload/receipt +fields; all secret-free producer locators require null. The safe nested record is read from canonical +authority, never from the ZIP it authorizes. Apply the same `canonical_file`/`root_ustar` nullability +rules to both records. + +- [ ] **Step 2: Run the test and verify RED** + +Run: `uv run pytest tests/campaign/test_github_records.py -q` + +Expected: FAIL during collection with +`ModuleNotFoundError: No module named 'laconian_eval.campaign.github_records'`. + +- [ ] **Step 3: Implement the strict records and canonical identities** + +Add `GitHubWorkflowRunV1`, `GitHubJobV1`, `GitHubDeploymentV1`, `GitHubApprovalV1`, +`GitHubArtifactV1`, and `ExactArtifactLocatorV1`. Import and class-bound revalidate the Runtime-owned +`ArtifactEnvelopeV1` and `UploadAuthorizationV1`; do not define a second envelope class. Each new record is +`extra="forbid"`, uses exact integer boundaries, and exposes a `sha256` field derived with +`stable_digest("laconian-{record_name}-v1", payload_without_sha256)` where `{record_name}` is the +closed schema name selected by code, not caller input. + +`GitHubArtifactV1` and `ExactArtifactLocatorV1` preserve the exact canonical UTC `created_at` from +the numeric artifact API response. Reject missing/naive/fractionally noncanonical timestamps and +require a generation/judge `CredentialScanReceiptV1.scan_completed_at_utc <= +UploadAuthorizationV1.scan_completed_at_utc <= artifact_created_at_utc`; equality is allowed for +either check. This causal check is stored in durable provenance and +tested with before/equal/after fixtures. + +The Runtime-owned `ArtifactEnvelopeV1` contains the producer-side values available before upload; +the following repeated shape is a compatibility assertion, not new ownership: + +```python +class ArtifactEnvelopeV1(CapsuleModel): + schema_version: Literal["1"] + producer: Literal[ + "generation_batch", + "generation_evidence_set", + "hard_score", + "judge_request", + "judge_attempt_batch", + "judge_attachment_set", + "provider_evidence", + "audit_packet", + "audit_evidence", + "analysis_evidence", + "complete_collector", + "invalid_prefix_finalizer", + "publication_package", + "publication_receipt", + "release_package", + "release_receipt", + "correction_bundle", + ] + repository_id: StrictPositiveInt + workflow_run_id: StrictPositiveInt + run_attempt: StrictPositiveInt + job_id: StrictPositiveInt + batch_attempt_id: UUID4 | None + input_tag_object_sha: GitObjectId + input_commit_sha: GitObjectId + workflow_path: RelativePosixPath + workflow_sha256: Sha256 + environment: Literal["benchmark-live", "benchmark-publish"] | None + deployment_id: StrictPositiveInt | None + approval_actor_id: StrictPositiveInt | None + approval_actor_login: BoundedNonBlankString | None + payload_kind: Literal["canonical_file", "root_ustar"] + payload_name: RelativePosixPath + payload_byte_length: StrictNonNegativeInt + payload_sha256: Sha256 + materialized_root_sha256: Sha256 | None + credential_scan_receipt_sha256: Sha256 | None + source_credential_scan_receipt_root_sha256: Sha256 | None + envelope_sha256: Sha256 +``` + +Direct `generation_batch` and `judge_attempt_batch` envelopes require a Slice 3 +`CredentialScanReceiptV1` hash and null source-receipt root. The receipt binds the exact inner +payload bytes and proves exact-key plus pattern +scanning completed before the deterministic inner archive was authorized. The detached +`UploadAuthorizationV1`, which is never uploaded, separately binds the final inner +`laconian-artifact.zip`; it does not claim the later GitHub service wrapper was key-scanned. Do not +add artifact ID or service digest to the envelope: GitHub assigns both after upload. + +`generation_evidence_set`, `hard_score`, `judge_request`, `judge_attachment_set`, and +`provider_evidence` are deterministic secret-free projections. They require a null direct receipt +and the ordered Merkle root of every directly scanned generation/judge-attempt receipt reachable +through their exact parents. All other producers require both fields null. A post-controller +projection is never falsely described as exact-key scanned; its loader re-verifies every direct +source receipt and recomputes the transitive root. The +consumer pairs the immutable API metadata with this envelope. + +`canonical_file` requires null `materialized_root_sha256`. `root_ustar` requires payload name exactly +`root-payload.tar` and a nonnull root digest. Its uncompressed USTAR contains canonical +`root-manifest.json` plus a bounded allowlisted tree; the root digest covers the byte-sorted tuples +`(relative_path, byte_length, sha256, normalized_mode)` for every member except the manifest. The +manifest binds that root and has its own digest; the outer payload digest binds the complete tar, so +there is no self cycle. + +- [ ] **Step 4: Add API-response parsers with content-free failures** + +Add `parse_workflow_run`, `parse_workflow_jobs`, `parse_deployments`, `parse_approvals`, and +`parse_artifact`. Return only strict records and raise `GitHubRecordError(code)` without echoing +provider-controlled JSON. Prove that deployment status `target_url` and `log_url` end in the exact +`/actions/runs/{run_id}/job/{job_id}` pair and that the approval names the expected environment. + +This task also owns the sole `GitHubReadClient` definition in `campaign/github_records.py`; later +tasks extend its closed method table but may not shadow or relocate the class. Freeze this exact +constructor (the API version, base hosts, timeout, headers, query document, and bounds are internal +constants and therefore are not caller arguments): + +```python +class GitHubReadClient: + def __init__( + self, + *, + repository: OwnerRepo, + token: SecretStr, + transport: GitHubReadTransport, + ) -> None: ... +``` + +`OwnerRepo` is one NFC ASCII `owner/name` pair with neither empty, dot, slash, percent-encoded, nor +control components. `GitHubReadTransport` is injected only for bounded tests; it is private to this +module's client and is never handed to a campaign caller. The client exposes no generic `request`, +URL, method, headers, body, parser, pagination, or GraphQL-document parameter. + +- [ ] **Step 5: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_github_records.py -q` + +Expected: PASS. + +Run: `uv run ruff check src/laconian_eval/campaign/github_records.py tests/campaign/test_github_records.py` + +Expected: exit 0. + +- [ ] **Step 6: Commit the exact GitHub records** + +```bash +git add src/laconian_eval/campaign/github_records.py \ + src/laconian_eval/campaign/__init__.py \ + tests/campaign/test_github_records.py +git commit -m "feat: bind benchmark GitHub artifact provenance" +``` + +### Task 2: Retrieve and verify artifacts only by exact numeric identity + +**Files:** +- Modify: `src/laconian_eval/campaign/github_records.py` +- Create: `src/laconian_eval/campaign/artifacts.py` +- Create: `tests/campaign/fake_github.py` +- Modify: `tests/campaign/test_github_records.py` +- Create: `tests/campaign/test_artifacts.py` + +- [ ] **Step 1: Write failing tests for exact lookup and bounded download** + +Cover these cases with `FakeGitHubReadTransport`: + +- exact run, attempt, job, deployment, approval, artifact ID, service digest, and envelope pass; +- a correct name with the wrong artifact ID fails; +- a correct artifact ID from a different run or attempt fails; +- duplicate artifacts, rerun artifacts, PR/fork origins, expired artifacts, and absent predecessors fail; +- pagination must be exhausted and bounded before selection; +- an outer service ZIP above 1 GiB or not containing exactly one regular member named + `laconian-artifact.zip` fails; the inner ZIP may have at most 64 members, each at most 512 MiB, + with aggregate declared and streamed uncompressed bytes at most 1 GiB; either layer rejects + duplicate names, encryption, links, absolute paths, backslashes, `.`/`..`, non-NFC names, or a + compression ratio above 100 before extraction; +- the authorization header is never forwarded to the signed redirect host; +- inside `laconian-artifact.zip`, `artifact-envelope.json`, conditional + `credential-scan-receipt.json`, and the one declared payload are the only accepted members. + Generation/judge artifacts require all three; secret-free producers require exactly envelope plus + payload. Add a golden fixture that constructs the producer inner ZIP, wraps it exactly as + `actions/upload-artifact` does, serves the raw service ZIP, and proves both layers and the unchanged + inner bytes verify. +- root producers use the exact `root-payload.tar` contract. Test missing/duplicate manifest, root + digest mismatch, unlisted/duplicate member, non-USTAR format, sparse/device/link member, unsafe + path, nonnormalized mode/metadata, truncation/trailing bytes, and materialized-root substitution. + +The public call is: + +```python +archive = fetch_exact_artifact( + client=GitHubReadClient( + repository="agent-axiom/laconian", + token="ghs_test_token", + transport=fake_transport, + ), + expected=locator, + destination=tmp_path / "downloaded-artifact.zip", +) +assert archive.locator == locator +assert archive.payload_sha256 == locator.payload_sha256 +``` + +- [ ] **Step 2: Run the test and verify RED** + +Run: `uv run pytest tests/campaign/test_artifacts.py -q` + +Expected: FAIL during collection because `laconian_eval.campaign.artifacts` does not exist. + +- [ ] **Step 3: Implement the closed read-only GitHub client** + +The artifact methods of `GitHubReadClient` may issue only these requests; the same class's other +capability-separated methods are additionally limited to the amendment synchronization contract's +raw-Git, fixed REST verification, fixed GraphQL signer, current-ruleset, historical-rule-suite, +PR/check/review/merge, current-main, immutable-Release, and Release/assets reads. Tests enumerate the +full public-method/verb/endpoint/query-digest table and reject any unlisted method or caller URL. +The closed public method names are exactly: + +```text +get_repository +get_workflow_run +list_workflow_jobs +list_run_approvals +list_deployments +list_deployment_statuses +get_artifact +download_artifact_zip +get_git_ref +get_git_tag +get_git_commit +get_git_tree +get_git_blob +get_commit_verification +query_commit_signer +list_repository_rulesets +get_repository_ruleset +list_rule_suites +get_rule_suite +get_pull_request +list_pull_request_reviews +list_check_runs +get_main_ref +get_main_commit +get_immutable_releases_setting +list_releases +get_release +get_release_by_tag +list_release_assets +download_release_asset +``` + +Every name has one implementation-owned endpoint template and fixed strict return parser; none +accepts a parser or URL. Ref-taking methods accept only the call-site-selected literal namespace +from the verified campaign plan (`refs/tags/`, its peeled OID, `refs/heads/main`, the exact +result branch, or the exact result tag), never an arbitrary ref string. REST reads use only the +exact table below. `{ref_path}` is the validated ref with only the leading `refs/` removed; +`{object_oid}`, `{commit_oid}`, `{tree_oid}`, and `{blob_oid}` are lowercase 40-hex object IDs, and +all numeric IDs are strict positive integers. Query keys appear in the shown order; RFC 3986 +percent-encoding uses UTF-8 and uppercase hex. `P(N)` means `per_page=100&page=N`, `N=1..64`, until +a short/empty final page. All pages are read; a page-64 continuation fails closed. + +| Public method | Exact request | Query / redirect policy | +|---|---|---| +| `get_repository` | `GET /repos/{owner}/{repo}` | none | +| `get_workflow_run` | `GET /repos/{owner}/{repo}/actions/runs/{run_id}` | none | +| `list_workflow_jobs` | `GET /repos/{owner}/{repo}/actions/runs/{run_id}/attempts/{attempt}/jobs` | `P(N)` | +| `list_run_approvals` | `GET /repos/{owner}/{repo}/actions/runs/{run_id}/approvals` | none | +| `list_deployments` | `GET /repos/{owner}/{repo}/deployments` | `sha={input_commit_sha}&ref={input_ref}&task=deploy&environment={environment}&P(N)` | +| `list_deployment_statuses` | `GET /repos/{owner}/{repo}/deployments/{deployment_id}/statuses` | `P(N)` | +| `get_artifact` | `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}` | none | +| `download_artifact_zip` | `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip` | `Accept: application/octet-stream`; exactly one HTTPS redirect under the download rule below | +| `get_git_ref` | `GET /repos/{owner}/{repo}/git/ref/{ref_path}` | none | +| `get_git_tag` | `GET /repos/{owner}/{repo}/git/tags/{object_oid}` | none | +| `get_git_commit` | `GET /repos/{owner}/{repo}/git/commits/{commit_oid}` | none; strict raw-object field parser | +| `get_git_tree` | `GET /repos/{owner}/{repo}/git/trees/{tree_oid}` | no `recursive` query | +| `get_git_blob` | `GET /repos/{owner}/{repo}/git/blobs/{blob_oid}` | none; exact base64 parser and decoded-byte bound | +| `get_commit_verification` | `GET /repos/{owner}/{repo}/git/commits/{commit_oid}` | none; strict verification projection parser | +| `query_commit_signer` | `POST https://api.github.com/graphql` | exact query/body/digest below; no redirect or pagination | +| `list_repository_rulesets` | `GET /repos/{owner}/{repo}/rulesets` | `includes_parents=false&targets=branch%2Ctag&P(N)` | +| `get_repository_ruleset` | `GET /repos/{owner}/{repo}/rulesets/{ruleset_id}` | `includes_parents=false` | +| `list_rule_suites` | `GET /repos/{owner}/{repo}/rulesets/rule-suites` | `ref={exact_ref}&time_period=month&rule_suite_result=all&evaluate_status=all&P(N)` | +| `get_rule_suite` | `GET /repos/{owner}/{repo}/rulesets/rule-suites/{rule_suite_id}` | none | +| `get_pull_request` | `GET /repos/{owner}/{repo}/pulls/{pull_number}` | none; strict merge state/actor/commit projection | +| `list_pull_request_reviews` | `GET /repos/{owner}/{repo}/pulls/{pull_number}/reviews` | `P(N)`; parses `APPROVED`, `CHANGES_REQUESTED`, `COMMENTED`, and `DISMISSED`, so no invented dismissal-list endpoint exists | +| `list_check_runs` | `GET /repos/{owner}/{repo}/commits/{commit_oid}/check-runs` | `filter=all&P(N)` | +| `get_main_ref` | `GET /repos/{owner}/{repo}/git/ref/heads/main` | none; only literal protected `main` | +| `get_main_commit` | `GET /repos/{owner}/{repo}/commits/{commit_oid}` | none; OID equals the preceding main-ref observation | +| `get_immutable_releases_setting` | `GET /repos/{owner}/{repo}/immutable-releases` | none; only strict `enabled=true` succeeds | +| `list_releases` | `GET /repos/{owner}/{repo}/releases` | `P(N)`; authenticated drafts included | +| `get_release` | `GET /repos/{owner}/{repo}/releases/{release_id}` | none | +| `get_release_by_tag` | `GET /repos/{owner}/{repo}/releases/tags/{tag}` | none; exact plan tag only, never draft discovery | +| `list_release_assets` | `GET /repos/{owner}/{repo}/releases/{release_id}/assets` | `P(N)` | +| `download_release_asset` | `GET /repos/{owner}/{repo}/releases/assets/{asset_id}` | `Accept: application/octet-stream`; exactly one HTTPS redirect under the download rule below | + +No other REST route, verb, query key/order/value, media type, host, or redirect is present in the +client. `get_git_commit` and `get_commit_verification` deliberately share one endpoint but have +different closed parsers and tests. Ruleset history, Contents API, archive-by-name/run listing, +audit-log search, review-dismissal writes, GraphQL introspection/mutation, and every write verb are +absent. + +`query_commit_signer(commit_oid)` is the only non-REST method. It performs exactly one read-only +`POST https://api.github.com/graphql` with `Content-Type: application/json`, variables exactly +`{owner, name, oid}`, and the Evaluation-owned `GITHUB_COMMIT_SIGNER_QUERY_V1` bytes below. It +imports that constant and `GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1` by object/value identity from +`laconian_eval.benchmark.protocol_review`; `campaign.github_records` owns no copied query. It rejects a +null/wrong repository, wrong OID, aliases, extensions, errors, extra top-level payload, pagination, +or a mutation document. `GRAPHQL_COMMIT_SIGNER_QUERY_SHA256_V1` is literal +`141ec2ce356c197073e0aeece28a804b56b8c31a615a3d36995c72ce2c9b3d7b`, the lowercase SHA-256 of +these 357 exact UTF-8 bytes (including the final LF). Record tests independently hash the bytes, +assert that golden, and copy it into `GitHubSignatureProjectionV1.query_sha256`: + +```graphql +query ProtocolCommitSignature($owner: String!, $name: String!, $oid: GitObjectID!) { + repository(owner: $owner, name: $name) { + databaseId + object(oid: $oid) { + ... on Commit { + oid + signature { + isValid + state + signer { + databaseId + login + } + } + } + } + } +} +``` + +Set `Accept: application/vnd.github+json`, `X-GitHub-Api-Version: 2022-11-28`, a fixed user agent, +and a 30-second timeout. Each JSON response is at most 8 MiB; each list is at most 100 entries per +page, 64 pages, and 64 MiB aggregate canonical response bytes, and all pages must be exhausted. +The GraphQL response is one nonpaginated 8-MiB body. Only the two table-marked download methods may +follow a redirect: accept exactly one absolute `https://` `Location` returned by authenticated +`api.github.com`, reject userinfo, fragments, nondefault ports, and loopback/private/link-local IP +literals, strip authorization, cookies, and all GitHub headers, send only the fixed download user +agent plus `Accept: application/octet-stream`, and reject a second redirect. Stream to an exclusively created file while hashing and +enforcing the 1 GiB compressed bound. Before reading a member, sum the central-directory sizes with +checked arithmetic at both layers; while streaming, enforce the 512 MiB member and 1 GiB aggregate +uncompressed counters independently of declared sizes and compression ratios. Never materialize an +unbounded member in memory. Every producer passes exactly one prebuilt +`laconian-artifact.zip` path to `actions/upload-artifact`; directories, globs, or separately uploaded +inner members are workflow-policy failures. + +- [ ] **Step 4: Implement exact provenance verification** + +`fetch_exact_artifact` must verify API records before download, require GitHub's service field to be +exactly `sha256:` followed by 64 lowercase hexadecimal characters, normalize only by removing that +fixed prefix, and hash the raw outer service ZIP against the remaining digest. Without `extractall`, +it streams the sole outer member `laconian-artifact.zip`, verifies its digest/length, opens that +inner ZIP under the independent bounds, canonical-parses `artifact-envelope.json`, compares every +shared field with `ExactArtifactLocatorV1`, and hashes the +declared payload. For generation/judge artifacts it canonical-parses the fixed receipt member, +recomputes its digest, requires the envelope/locator hash to match, and verifies that the receipt +binds only this payload digest/length and completed pre-upload exact-key/pattern scan. It also +class-bound revalidates the locator's authority-sourced `UploadAuthorizationV1`, requires its +inner/payload/receipt fields to match the streamed bytes, and rejects a missing authorization or one +obtained from the artifact itself. The receipt +never binds the enclosing ZIP, avoiding a digest cycle. It returns: + +```python +class RootPayloadMemberV1(CapsuleModel): + relative_path: RelativePosixPath + byte_length: StrictNonNegativeInt + sha256: Sha256 + normalized_mode: Literal["0644", "0755"] + + +class RootPayloadManifestV1(CapsuleModel): + schema_version: Literal["1"] + members: tuple[RootPayloadMemberV1, ...] + materialized_root_sha256: Sha256 + manifest_sha256: Sha256 + + +@dataclass(frozen=True, slots=True) +class VerifiedArtifactArchive: + locator: ExactArtifactLocatorV1 + envelope: ArtifactEnvelopeV1 + service_archive_path: Path + service_archive_byte_length: int + service_archive_sha256: str + inner_archive_path: Path + inner_archive_byte_length: int + inner_archive_sha256: str + payload_path: Path + payload_name: str + payload_byte_length: int + payload_sha256: str + credential_scan_receipt: CredentialScanReceiptV1 | None + + +@dataclass(frozen=True, slots=True) +class VerifiedArtifactRootV1: + archive: VerifiedArtifactArchive + root_path: Path + manifest: RootPayloadManifestV1 + materialized_root_sha256: str +``` + +No function accepts an artifact name as a selector. `artifact_name` is checked only after numeric +ID selection. + +Implement `materialize_verified_artifact_root(archive, destination) -> VerifiedArtifactRootV1` for +`root_ustar` only. Reuse the descriptor-relative, no-follow, strict uncompressed-USTAR policy from +Slice 1; exclusively create an owned `0700` stage, enforce envelope/manifest count and byte bounds +while streaming, hash every regular member, reject unknown or repeated paths, fsync, atomically +rename, then reopen/reverify every descriptor and the materialized-root digest. It never accepts a +caller allowlist or archive-selected destination. `canonical_file` consumers use the verified +`payload_path` directly. Add golden producer/consumer fixtures for generation, hard-score, +judge-request, judge, audit, analysis, collection, publication, and release roots. + +- [ ] **Step 5: Run focused tests and verify GREEN** + +Run: `uv run pytest tests/campaign/test_artifacts.py tests/campaign/test_github_records.py -q` + +Expected: PASS. + +- [ ] **Step 6: Commit exact artifact retrieval** + +```bash +git add src/laconian_eval/campaign/artifacts.py \ + src/laconian_eval/campaign/github_records.py \ + tests/campaign/fake_github.py \ + tests/campaign/test_github_records.py \ + tests/campaign/test_artifacts.py +git commit -m "feat: retrieve benchmark artifacts by exact identity" +``` + +### Task 3: Seal the read-only provider-evidence inventory + +**Files:** +- Create: `src/laconian_eval/campaign/provider_evidence.py` +- Create: `tests/campaign/publication_helpers.py` +- Create: `tests/campaign/test_provider_evidence.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +- [ ] **Step 1: Write the failing happy-path coverage test** + +Build a synthetic `CampaignRegistryV1` plus the exact tuple of 36 `ShardPlanV1` records covering +three model IDs and twelve byte-sorted scenario UIDs. Give every generation seal one hard-score +request set, one judge-request attachment, and one judge attachment, including sealed zero-request +and zero-call attachments. Assert exactly 36 members in each ordered collection and one inventory +hash. + +Use this record shape: + +```python +class EvidenceAttachmentRefV1(CapsuleModel): + model_id: BoundedNonBlankString + scenario_uid: Sha256 + artifact: ExactArtifactLocatorV1 + parent_sha256: Sha256 + attachment_sha256: Sha256 + credential_scan_receipt_sha256: Sha256 | None + source_credential_scan_receipt_root_sha256: Sha256 | None + + +class EvidenceInventoryV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + input_tag_object_sha: GitObjectId + input_commit_sha: GitObjectId + campaign_registry_sha256: Sha256 + audit_protocol_sha256: Sha256 + benchmark_provider_evidence_sha256: Sha256 + shard_plan_root_sha256: Sha256 + spend_ledger_sha256: Sha256 + cache_write_usage_root_sha256: Sha256 + service_tier_evidence_root_sha256: Sha256 + generation: tuple[EvidenceAttachmentRefV1, ...] + hard_score: tuple[EvidenceAttachmentRefV1, ...] + judge_request: tuple[EvidenceAttachmentRefV1, ...] + judge: tuple[EvidenceAttachmentRefV1, ...] + artifact_provenance_root_sha256: Sha256 + direct_provider_artifact_root_sha256: Sha256 + credential_scan_receipt_root_sha256: Sha256 + inventory_sha256: Sha256 +``` + +- [ ] **Step 2: Add failing integrity and completeness tests** + +Parametrize deletion, duplication, reordering, wrong capsule parent, wrong hard-score parent, +missing or changed judge-request attachment, judge request outside the sealed request set, missing +zero-call attachment, nonterminal request, +ambiguous delivery, internally impossible or contradictory token usage, inconsistent returned +model, missing spend receipt, +unreconciled reservation, superseded attempt, unresolved hold, and active credential-exposure +pending root. Also pass an audit or analysis +path to the verifier and assert `unexpected_evidence_layer`. + +Delete or alter a direct generation/judge-attempt `CredentialScanReceiptV1`, bind it to different +bytes, mark the exact-key scan incomplete, or supply one created after upload; inventory sealing +must fail. Generation-set, hard-score, judge-request, judge-attachment-set, and provider-evidence +producers are secret-free: their direct receipt field is null and their transitive source-receipt +root must recompute from all exact reachable direct artifacts. Substitute, omit, or add any direct +locator/receipt or claim a post projection was directly scanned and sealing fails. The inventory +root covers all ordered direct provider scan receipts so the collector never needs the key later. + +Missing or provider-omitted reasoning-token breakdown is not an evidence-integrity failure. Add +fixtures for `not_reported` and schema-valid `invalid` reasoning usage, preserve those statuses in +the sealed inventory, and prove the later analysis marks that model's token objective unavailable +or inconclusive while the complete evidence bundle remains publishable. Negative counts, component +counts exceeding output usage, or disagreement between duplicate provider fields remain integrity +failures. + +Preserve `ordinary_uncached_input_tokens`, `cache_read_tokens`, `cache_write_tokens`, the exact +Foundation-owned `applied_cache_control_status`, `cache_read_status`, and `cache_write_status`, their +independent raw-source digests, and all five charge/reservation components distinctly in every +generation/judge reference and `cache_write_usage_root_sha256`. Reject folding writes into reads or +ordinary uncached input, treating missing write detail as zero, or publishing a spend total that +does not reproduce from ordinary-uncached input, cache-read input, cache-write input, visible +output, and reasoning output. +The report may describe cache-write cost only as provider accounting; it never enters the primary +visible-output-token contrast. + +Require requested service tier `default`, the exact wire-field request digest, and returned service +tier in every generation/judge attempt reference and +`service_tier_evidence_root_sha256`. A complete inventory accepts `reported_default` for every +received response and exactly `not_applicable_definitely_not_sent` or +`not_applicable_definitely_rejected` only for the matching independently proven delivery state with +no response/usage (including a prior proven 429 retry). `missing|mismatch` on a +received or unknown-delivery attempt must already have stopped provider execution and can appear only +in the safe invalid-prefix lineage with worst-case exposure retained. Reject an omitted/`auto` +request, forged not-applicable status, or projection that drops the returned tier/accounting status. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_provider_evidence.py -q` + +Expected: FAIL during collection because `provider_evidence.py` does not exist. + +- [ ] **Step 4: Implement the read-only verifier** + +Add this exact entry point: + +```python +def seal_provider_evidence_inventory( + *, + registry: CampaignRegistryV1, + shard_plans: tuple[ShardPlanV1, ...], + authority: ReconstructedAuthorityV1, + spend_ledger: SpendLedgerV1, + provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + artifact_locators: tuple[ExactArtifactLocatorV1, ...], +) -> EvidenceInventoryV1: +``` + +The Slice 3 adapter owns creation and durable placement of +`GENERATION/generation-context.json` plus the generation `LayerRootIndexV1`; Slice 2 `hard-score`, +`prepare-judge`, and `seal-judge` respectively own the hard-score, judge-request, and judge indexes, +and Runtime's `Runtime.seal_judge` owns the exact `provider-evidence-index.json` plus the separately +verified `ATTEMPTS` root. Runtime Task 7 reconstructs the retained predecessor and final +`GENERATION_COMPLETE` authority roots through `_reconstruct_verified_runtime`, then calls the exact +Evaluation Task 8 `load_verified_benchmark_provider_evidence` boundary with +`provider_index_path`, `generation_root`, `hard_score_root`, `judge_request_root`, +`judge_attempt_root`, `judge_root`, and the constructor's in-memory `generation_expectation`. +This Task 3 function receives only that returned immutable `VerifiedBenchmarkProviderEvidenceV1`; +it accepts neither root-path tuples nor a provider-index path. Publication Task 7 later +reconstructs its own authority-only capability before invoking this same inventory seal in a live +workflow. No raw file, nested provider-index field, digest, workflow input, or CLI option may +construct the verified expectation. + +It requires `authority.state.state == "JUDGE_COMPLETE"`, calls +`require_ordinary_effect_gate(authority)`, and exact-compares the verified object's complete +generation expectation, predecessor authority root, bound final authority root, context digest, +provider-index digest, and workflow root with the retained authority events. It reuses only the +verified object's scored capsules and +strict attachments, and joins only on exact parent hashes and planned request IDs, +verifies the ledger and returned-model consistency separately per generation model, +and derives the provenance root from the ordered exact locators. It opens every input read-only and +creates no output itself. + +Re-hash the tagged `src/laconian_eval/benchmark/hard_score.py` source plus the exact hard-score, +statistics, and audit protocol members from verified `C0`; require their path/hash pairs, the frozen +workflow-inventory root, and the authority-bound generation-context digest to equal +`CampaignRegistryV1`, the neutral context, every hard-score request set, and +`VerifiedBenchmarkProviderEvidenceV1`. A self-consistent +substituted context/index or a hash copied from any non-C0 or mutable-`main` commit fails. +The audit member is exactly +`benchmarks/protocols/public-three-model-v1/audit.json`; consume Evaluation's singular +`audit_protocol_sha256: Sha256` as verified by Runtime Task 2, store that same field in +`EvidenceInventoryV1`, and reject an alias, caller scalar, omitted consumer binding, or any +redefinition of the Evaluation-owned contract. + +No Slice 2 code imports this campaign inventory. Require +`EvidenceInventoryV1.benchmark_provider_evidence_sha256` to equal that projection's digest and every +ordered 36-parent vector to match. Return/store the verified projection alongside the inventory in +the campaign loader so audit/analysis loaders receive their mandatory benchmark-owned argument. +Export `EvidenceInventoryV1` and `seal_provider_evidence_inventory` from `campaign.__init__`; the +next serialized public-contract owner pins their module and signature. + +- [ ] **Step 5: Prove the verifier does not mutate or reopen inputs after verification** + +Add spies for `open`, `Path.write_bytes`, `Path.write_text`, `os.rename`, and capsule directory +metadata. Assert byte-for-byte and stat identity preservation on success and every failure path. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_provider_evidence.py -q` + +Expected: PASS. + +Run: `uv run mypy src/laconian_eval/campaign/provider_evidence.py` + +Expected: exit 0. + +- [ ] **Step 7: Commit provider-evidence inventory sealing** + +```bash +git add src/laconian_eval/campaign/provider_evidence.py \ + src/laconian_eval/campaign/__init__.py \ + tests/campaign/publication_helpers.py \ + tests/campaign/test_provider_evidence.py +git commit -m "feat: seal exact provider evidence inventory" +``` + +### Task 4: Add allowlist-by-construction public projection and secret scanning + +**Files:** +- Create: `src/laconian_eval/campaign/public_projection.py` +- Create: `tests/campaign/test_public_projection.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +- [ ] **Step 1: Write failing projection-role and checksum tests** + +Define `PublicFileRole` as a closed literal for every fixed member family in the two canonical +trees. Test UTF-8 byte ordering, unique normalized relative paths, regular files only, bounded +member count, 1 GiB aggregate bytes, 128 MiB per file, canonical `checksums.sha256`, and a +domain-separated `BundleSealV1`. + +Use these public records: + +```python +class PublicFileV1(CapsuleModel): + role: PublicFileRole + path: RelativePosixPath + byte_length: StrictNonNegativeInt + sha256: Sha256 + + +class BundleSealV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + kind: Literal["complete", "invalid_prefix"] + audit_protocol_sha256: Sha256 + source_state_sha256: Sha256 + source_artifact_root_sha256: Sha256 + files: tuple[PublicFileV1, ...] + checksum_manifest_sha256: Sha256 + bundle_sha256: Sha256 +``` + +- [ ] **Step 2: Write failing credential and untrusted-Markdown tests** + +Reject exact known secrets, `sk-`/`sess-`/bearer/private-key patterns, authorization/cookie headers, +environment dumps, `OPENAI_API_KEY`, home/private/temp paths, unrestricted exception bodies, and +unknown provider metadata keys. The error exposes only a stable code, role, and file digest. + +For approved excerpts, assert that `<`, `>`, `&`, backticks, Markdown links/images, headings, +mentions, autolinks, and bidirectional controls become inert text. Canonical JSONL response files +retain exact model bytes; only human-readable excerpts pass through the encoder. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_public_projection.py -q` + +Expected: FAIL because `public_projection.py` does not exist. + +- [ ] **Step 4: Implement the projection policy** + +Add: + +```python +class PublicProjectionPolicyV1(CapsuleModel): + schema_version: Literal["1"] = "1" + maximum_member_count: Literal[4096] = 4096 + maximum_file_bytes: Literal[134217728] = 134217728 + maximum_aggregate_bytes: Literal[1073741824] = 1073741824 + markdown_encoder_version: Literal["laconian-text-only-v1"] = "laconian-text-only-v1" + credential_pattern_version: Literal["laconian-public-secret-scan-v1"] = ( + "laconian-public-secret-scan-v1" + ) + + +def verify_public_projection( + root: Path, + *, + registry: CampaignRegistryV1, + kind: Literal["complete", "invalid_prefix"], + source_state_sha256: str, + source_artifact_root_sha256: str, + known_secret_values: tuple[str, ...] = (), +) -> BundleSealV1: +``` + +Derive `campaign_id` and the Evaluation-owned `audit_protocol_sha256: Sha256` only from the verified +Runtime registry. Re-hash the registry-bound peeled-C0 +`benchmarks/protocols/public-three-model-v1/audit.json` projection before returning either bundle +kind; no projection call accepts either value as an independent scalar or defines an audit-hash +alias. + +`known_secret_values` is an optional offline defense-in-depth input, not the live exact-key control. +For every generation/judge source, projection first requires the inventory-bound Slice 3 +`CredentialScanReceiptV1` over the byte-identical uploaded archive. The later secret-free collector +must not claim it can recover or re-scan the provider key. + +Scan through fd-relative no-follow reads. Never place a matched byte sequence in an exception, +test ID, log, or GitHub annotation. Generate checksums as lowercase SHA-256, two spaces, relative +path, newline, sorted by UTF-8 bytes. +Export `PublicProjectionPolicyV1`, `BundleSealV1`, and `verify_public_projection` from +`campaign.__init__`; do not expose internal scanners or text encoders. + +- [ ] **Step 5: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_public_projection.py -q` + +Expected: PASS. + +- [ ] **Step 6: Commit the public projection boundary** + +```bash +git add src/laconian_eval/campaign/public_projection.py \ + src/laconian_eval/campaign/__init__.py \ + tests/campaign/test_public_projection.py +git commit -m "feat: project benchmark evidence to a safe public bundle" +``` + +### Task 5: Build the fail-closed complete collector + +**Files:** +- Create: `src/laconian_eval/campaign/collector.py` +- Create: `tools/benchmark_reproduce_public_bundle.py` +- Create: `tests/campaign/test_complete_collector.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +- [ ] **Step 1: Write the failing exact-tree collection test** + +Use the canonical complete tree from this plan. Assert byte identity for copied raw and derived +layers, 36 generation tar/sidecar pairs, 36 hard-score attachments, 36 judge-request attachments, +36 judge attachments, both commitments, both reveals, adjudication core/envelope, both standalone +signoffs, their exact canonical GitHub review records, analysis outputs, report, limitations, +reproduction instructions, checksum manifest, and `bundle.json`. Freeze the complete bytes and +SHA-256 of `REPRODUCE.md`; the only variable fragment is the already validated literal +`campaign_id` inserted by the collector's canonical text renderer. The document never embeds its +containing `bundle_sha256`, avoiding a digest cycle. +Require `provenance/reviewer-attestations.jsonl` to be the byte-identical tagged three-line +`VerifiedProtocolAttestationV1` envelope file accepted by preflight, with all three hashes and their ordered +root reproduced from +`CampaignRegistryV1`; it is not synthesized from informal review notes during collection. +Likewise require the byte-identical tagged `RepositoryTrustBoundaryAttestationV1` and detached +signature accepted by preflight. Recompute their digests/settings-record root and verify the +registered security-evidence signer; collection never turns the repository-settings checklist into +a substitute attestation. +Require `provenance/workflows.jsonl` to be the canonical path/hash projection from the registry's +exact 15-member `WorkflowInventoryV1`; recompute its root from committed `C0` bytes and +byte-compare the root bound by every protocol review. Never snapshot mutable default-branch bytes at +collection time. + +Call: + +```python +seal = collect_complete_bundle( + registry=registry, + authority=analysis_complete_authority, + evidence_inventory=evidence_inventory, + benchmark_provider_evidence=benchmark_provider_evidence, + audit=verified_audit, + analysis=verified_analysis, + artifact_roots=verified_artifact_roots, + output_root=tmp_path / "complete-bundle", + policy=PublicProjectionPolicyV1(), +) +assert seal.kind == "complete" +``` + +- [ ] **Step 2: Add failing incomplete/superseded/untrusted tests** + +Delete each required member family in turn. Add duplicate or superseded attempts, wrong PR merge +SHAs, a fork-origin artifact, a stale audit sign-off, an analysis parent mismatch, a symlink, an +existing output, an output outside the caller root, and a credential pattern. Every case must fail +without publishing a visible bundle. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_complete_collector.py -q` + +Expected: FAIL because `collect_complete_bundle` cannot be imported. + +- [ ] **Step 4: Implement complete-only collection** + +Use this signature exactly: + +```python +def collect_complete_bundle( + *, + registry: CampaignRegistryV1, + authority: ReconstructedAuthorityV1, + evidence_inventory: EvidenceInventoryV1, + benchmark_provider_evidence: VerifiedBenchmarkProviderEvidenceV1, + audit: VerifiedAuditEvidenceV1, + analysis: VerifiedAnalysisEvidenceV1, + artifact_roots: tuple[Path, ...], + output_root: Path, + policy: PublicProjectionPolicyV1, +) -> BundleSealV1: +``` + +Require `authority.state.state == "ANALYSIS_COMPLETE"`, call +`require_ordinary_effect_gate(authority)`, and require exact +evidence/audit/analysis parent hashes, the full audit merge set, and exact current inventory. Obtain +the aggregate inputs only through `load_verified_audit_evidence` and +`load_verified_analysis_evidence`; copy from already verified descriptors into an +owned `0700` stage, never parse model text while rendering reports, verify the finished projection, +fsync, atomically publish, then reverify through a fresh descriptor. + +Require `registry`, `evidence_inventory`, `benchmark_provider_evidence`, `audit`, and `analysis` to +carry the identical Evaluation-owned `audit_protocol_sha256: Sha256`, sourced only from Runtime +Task 2's verified C0 +`benchmarks/protocols/public-three-model-v1/audit.json` bytes. Re-hash that public projection member +before sealing; an absent, renamed, independently supplied, or mismatched value blocks collection. + +Pass `benchmark_provider_evidence` to both mandatory loader keywords and require its digest to match +`EvidenceInventoryV1`. The four roots used to reconstruct it must be members of the exact artifact +inventory; a caller-synthesized projection or root substitution fails before staging output. +Reload both exact reviewer registries and all three protocol-review attestations; require distinct +role-bound protocol identities, exact peeled commit/workflow/seven-protocol/audit-registry/protocol- +registry bindings and `approved` dispositions, then copy their original +canonical JSONL bytes to the fixed provenance member. Missing/stale reviews block complete +collection. +Export only `collect_complete_bundle` from the collector surface at this checkpoint. + +- [ ] **Step 5: Verify deterministic reconstruction** + +Collect twice into separate roots from byte-identical inputs and assert identical member bytes, +checksums, `bundle.json`, and `bundle_sha256`. Vary filesystem enumeration order and assert the +same result. + +Create the standard-library-only repository tool +`tools/benchmark_reproduce_public_bundle.py`. Its exact CLI is +`main(argv: Sequence[str] | None = None) -> int` with only required +`--bundle-root BUNDLE_ROOT`, `allow_abbrev=False`, no environment-derived inputs, no network/Git +client imports, and no writes. It descriptor-opens only the supplied copied public tree, applies the +same bounds/no-follow rules, and independently recomputes the campaign seed/plan index, all seven +protocol hashes (including hard-score, retry, checkpoint, and publication), the 36-member +generation/hard-score/judge-request/judge vectors and roots, audit population/sample, analysis seal, +checksum manifest, and bundle digest. Its one success line is exactly +`{"bundle_sha256":"","campaign_id":"","status":"reproduced"}\n` +in canonical key order with exit 0; failure writes no stdout, writes exactly +`{"code":"reproduction-failed","status":"error"}\n` to stderr, and exits 3 without exception or +path text. + +The collector renders `REPRODUCE.md` with these exact UTF-8/LF-only bytes, substituting only the +validated campaign ID and ending in one LF: + +```text +# Offline structural reproduction + +From the approved input-tag checkout, run: + +uv run --frozen python tools/benchmark_reproduce_public_bundle.py --bundle-root benchmarks/results/{campaign_id} + +Expected stdout: + +{"bundle_sha256":"","campaign_id":"{campaign_id}","status":"reproduced"} +``` + +The test copies only the public tree to `benchmarks/results/{campaign_id}` in a clean checkout of the +approved input commit, runs that literal command with network and GitHub/provider access trapped, +and asserts stdout uses the recomputed `bundle.json.bundle_sha256` in the exact success schema and +exit 0. It mutates every recomputed family and asserts exit 3, +content-free stderr, no write, and no API attempt. It independently hashes the rendered +`REPRODUCE.md`, requires the digest recorded in `checksums.sha256`/`bundle.json`, and rejects CRLF, +extra whitespace, alternate command/options, unresolved braces, or a different script path. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_complete_collector.py tests/campaign/test_public_projection.py -q` + +Expected: PASS. + +- [ ] **Step 7: Commit the complete collector** + +```bash +git add src/laconian_eval/campaign/collector.py \ + src/laconian_eval/campaign/__init__.py \ + tools/benchmark_reproduce_public_bundle.py \ + tests/campaign/test_complete_collector.py +git commit -m "feat: collect complete publication benchmark evidence" +``` + +### Task 6: Build the disjoint invalid-prefix finalizer + +**Files:** +- Modify: `src/laconian_eval/campaign/collector.py` +- Modify: `tools/benchmark_reproduce_public_bundle.py` +- Create: `tests/campaign/test_invalid_prefix_finalizer.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +- [ ] **Step 1: Write the failing STOP and budget-prefix tests** + +Create one `STOPPED_INVALID` state with a safe incident and one `BUDGET_INCOMPLETE` state. Assert +the exact invalid-prefix tree, ordered completed prefix, exact expected missing suffix, last valid +spend ledger, and absence of all performance layers. Require `REPRODUCE.md` to use the exact Task 5 +bytes/command with this campaign ID and require its independent checksum in both bundle manifests. + +Parameterize generation STOP before the first call, mid-generation inside a 40-row shard, exactly at +a generation shard boundary, mid-judge inside a nonempty judge attachment, between judge +attachments, and across a sealed zero-call judge attachment. For every case, assert the active phase, +phase-plan hash, completed whole units, optional completed partial-unit request prefix, missing +partial-unit suffix, remaining whole units, last verified checkpoint, and scan-receipt identities. + +Use: + +```python +seal = finalize_invalid_prefix( + registry=registry, + campaign_plan_index=campaign_plan_index, + phase_plan=verified_phase_plan, + authority=stopped_authority, + spend_ledger=spend_ledger, + safe_artifact_locators=safe_locators, + incident=incident, + output_root=tmp_path / "invalid-prefix", + policy=PublicProjectionPolicyV1(), +) +assert seal.kind == "invalid_prefix" +``` + +- [ ] **Step 2: Add failing cross-path tests** + +Assert rejection from `ANALYSIS_COMPLETE`, any unresolved hold or active credential-exposure +pending root, a phase-plan hash different from the +authority's active plan, a non-prefix completed set, a missing item outside the exact suffix, a +generation record in a judge prefix or vice versa, a fabricated zero-call boundary, a ledger not +matching state, raw model output, judge/audit/ +analysis records, `report.md`, token deltas, intervals, rankings, credentials, or a suspected + exposure record containing the suspected bytes. + The two safe trust-boundary provenance records remain mandatory in the invalid-prefix tree, but a + secret-bearing settings response, token, PEM, or free-form admin payload is always rejected. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_invalid_prefix_finalizer.py -q` + +Expected: FAIL with `ImportError` for `finalize_invalid_prefix`. + +- [ ] **Step 4: Implement a separate finalizer, not a mode flag** + +Add the exact signature: + +```python +def finalize_invalid_prefix( + *, + registry: CampaignRegistryV1, + campaign_plan_index: CampaignPlanIndexV1, + phase_plan: VerifiedPhasePlanV1, + authority: ReconstructedAuthorityV1, + spend_ledger: SpendLedgerV1, + safe_artifact_locators: tuple[ExactArtifactLocatorV1, ...], + incident: SafeIncidentV1, + output_root: Path, + policy: PublicProjectionPolicyV1, +) -> BundleSealV1: +``` + +Define `SafeIncidentV1` in `collector.py` with enumerated reason, incident ID, timestamps, affected +artifact IDs/digests, deletion result, and safe narrative code. It contains no free-form provider +exception, credential, response, prompt, or environment field. Define `InvalidPrefixEvidenceV1` +with the closed fields `phase`, `active_phase_plan_sha256`, ordered whole-unit identities, completed +whole-unit prefix, optional partial-unit identity plus its completed-request prefix and missing-request +suffix, remaining whole-unit suffix, last verified checkpoint hash, last spend-ledger hash, ordered +safe scan-receipt hashes, and its own digest. + +Define frozen `VerifiedInvalidPrefixBundleV1` as the non-serializable trusted-loader result containing +the class-bound `BundleSealV1`, `InvalidPrefixEvidenceV1`, `SafeIncidentV1`, verified registry/state/ +ledger hashes, exact member inventory, and descriptor-owned root. Implement +`load_verified_invalid_prefix_bundle(root) -> VerifiedInvalidPrefixBundleV1`; it repeats the fixed +tree, checksum, absence-of-performance-layer, and no-follow verification. It is accepted only for +invalid publication planning/PR validation; the post-release result-claims gate rejects it because +invalid-prefix states have no release or promotion path. Export both the type and loader. + +The function accepts only the safe-invalid states enumerated by the approved state matrix, calls +`require_ordinary_effect_gate(authority)`, verifies +`SpendLedgerV1` against the authority hash, and +requires `phase_plan.plan_sha256 == authority.state.active_phase_plan_sha256`. For generation it +validates the plan against `CampaignPlanIndexV1` and uses its seed-derived 36-shard order. For judge +it validates the sealed `JudgeRequestAttachmentV1` index root, uses that same shard order, retains +all 36 attachment boundaries including zero-call attachments, and uses each attachment's sealed +request order. It derives completion only from verified checkpoints, terminal attempt evidence, +spend events, and scan receipts. Callers cannot supply either prefix or suffix. An ambiguous +in-flight request starts the missing suffix even though its worst-case reservation remains in the +ledger. + +For `credential_exposure`, require the canonical `CredentialExposureIncidentEvidenceV1`, exact +affected-artifact denylist, terminal revoked/rotated/cryptographically-expired containment as +permitted for the secret kind, deletion-or-unavailability receipts, no-further-campaign-download +receipt, and the publisher close receipt when the parent was `COMPLETE_PUBLICATION_PR_OPEN`. Exclude +every affected raw artifact and scanner-match byte from the projection. Publish only safe incident +metadata and never claim prior downloads or public Git objects were erased. +Export `VerifiedInvalidPrefixBundleV1`, `load_verified_invalid_prefix_bundle`, and +`finalize_invalid_prefix` from `campaign.__init__`. + +Extend the same fixed reproduction tool by strict `bundle.json.kind` dispatch. For +`invalid_prefix`, it recomputes only registry/state/ledger, phase-plan/completed-prefix/missing- +suffix/incident, safe provenance, member inventory, checksums, and bundle digest; it rejects any +performance member. The command, exact stdout/error schemas, exits, no-write/no-network rule, and +`REPRODUCE.md` bytes remain identical to Task 5. Tests run the literal document command from a +copied invalid-prefix tree and mutate every permitted family plus one forbidden performance member. + +- [ ] **Step 5: Run both collector suites and verify separation** + +Run: `uv run pytest tests/campaign/test_complete_collector.py tests/campaign/test_invalid_prefix_finalizer.py -q` + +Expected: PASS. + +- [ ] **Step 6: Commit invalid-prefix finalization** + +```bash +git add src/laconian_eval/campaign/collector.py \ + src/laconian_eval/campaign/__init__.py \ + tools/benchmark_reproduce_public_bundle.py \ + tests/campaign/test_invalid_prefix_finalizer.py +git commit -m "feat: finalize invalid benchmark prefixes safely" +``` + +### Task 7: Add the `Publication` capability and secret-free evidence workflows + +**Files:** +- Create: `src/laconian_eval/campaign/publication.py` +- Create: `tools/benchmark_sample_audit_stage.py` +- Create: `tools/benchmark_seal_audit_stage.py` +- Create: `tools/benchmark_analyze_stage.py` +- Create: `tools/benchmark_verify_stage.py` +- Create: `.github/workflows/benchmark-hard-score.yml` +- Create: `.github/workflows/benchmark-evidence.yml` +- Create: `.github/workflows/benchmark-audit.yml` +- Create: `.github/workflows/benchmark-analysis.yml` +- Create: `.github/workflows/benchmark-collect-complete.yml` +- Create: `.github/workflows/benchmark-finalize-invalid.yml` +- Create: `.github/workflows/audit-pr-validate.yml` +- Modify: `.github/workflows/benchmark-publication-state.yml` +- Create: `tools/validate_audit_pr.py` +- Create: `tests/campaign/test_publication_capability.py` +- Create: `tests/campaign/test_publication_workflows.py` +- Create: `tests/campaign/test_audit_pr.py` +- Modify: `tests/campaign/test_workflow_policy.py` +- Modify: `tests/test_ci_contract.py` +- Modify: `tests/test_public_contract.py` + +- [ ] **Step 1: Write failing capability and ownership tests** + +Test that ordinary construction is impossible and the sole constructor is the private +`_reconstruct_verified_publication(*, authority, verified_generation_context, +verified_provider_evidence)`. It re-verifies current canonical authority and returns one in-memory +capability whose exact live methods are: + +```python +Publication.campaign.evaluation_stage.sample_audit +Publication.campaign.evaluation_stage.seal_audit +Publication.campaign.evaluation_stage.analyze +Publication.campaign.evaluation_stage.verify +``` + +Each method is keyword-only and accepts only typed local inputs/operation-owned output roots. Tests +reject pickling, JSON/Pydantic serialization, public export of the constructor, construction from a +digest or provider index, reuse after authority moves, and importing a public replay handler from +campaign code. Call-graph tests pin the three Runtime-owned live methods plus these four Publication- +owned methods and prove none shares a writer entrypoint with the seven handlers under +`laconian_eval.replay`. + +- [ ] **Step 2: Run capability tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_capability.py tests/test_public_contract.py -q` + +Expected: FAIL because `campaign/publication.py` and the private constructor do not exist. + +- [ ] **Step 3: Implement authority-only staged evaluation** + +Implement the private constructor and four methods. `sample_audit` and `seal_audit` require exact +state `PROVIDER_EVIDENCE_VERIFIED`; `analyze` and `verify` require the exact accepted +`AUDIT_SEALED` lineage, with `verify` additionally fresh-loading the analysis output produced by +`analyze`. Every call requires the same in-memory verified generation-context capability, both +identity registries, `protocol_attestations_root`, hard-score/judge/statistical protocol hashes, +the Evaluation-owned singular `audit_protocol_sha256: Sha256` derived by Runtime Task 2 from exact +peeled-C0 `benchmarks/protocols/public-three-model-v1/audit.json` bytes, provider-projection root, +the unchanged `audit_sampling_protocol_sha256`, `audit_commit_reveal_protocol_sha256`, and +`audit_adjudication_protocol_sha256` bindings, and common `workflow_root`. The singular aggregate +never replaces or derives those granular bindings. The provider index is evidence only; +it carries the expectation digest and repeated bindings but never a nested alleged expectation or +capability. + +The four fixed tools import only `laconian_eval.campaign.publication`, reconstruct the capability +from current authority inside one process, call exactly one corresponding method, and exit. They +accept fixed staging paths only, use `allow_abbrev=False`, and accept no campaign ID, expected root, +protocol hash, workflow hash, model ID, mode scalar, arbitrary command, or capability value. The +sample is deterministically rederived from verified provider evidence in an operation-owned root; +no caller may select or reuse an old sample root. No live tool or workflow invokes +`laconian-benchmark` or modules under `laconian_eval.replay`. + +- [ ] **Step 4: Write failing workflow and broker-policy tests** + +Require the seven new workflows to use only their frozen triggers, top-level `permissions: {}`, +`concurrency.group: laconian-public-benchmark-state`, `cancel-in-progress: false`, trusted detached +code, `ubuntu-24.04`, `persist-credentials: false`, exact numeric artifact locators, 90-day +retention, and full-SHA action refs. The exact workflow inventory now contains eleven paths: the +four Runtime-owned workflows `.github/workflows/benchmark-preflight.yml`, +`.github/workflows/benchmark-batch.yml`, `.github/workflows/benchmark-dismiss-hold.yml`, and +`.github/workflows/benchmark-publication-state.yml`, plus these seven. Missing, extra, renamed, or +reordered members fail. + +Every compute job is read-only. Every authority mutation calls Runtime Task 9's existing +`.github/workflows/benchmark-publication-state.yml`; Task 7 only adds the exact audit, analysis, +complete-collection, invalid-finalization, hard-score, and evidence caller/event rows. The reusable +job contains only OIDC bootstrap and the fixed hash-pinned argument-closed broker client. It has no +checkout, generated shell, caller script, App secret, App token, or step before/after that client. +The external broker validates caller/callee/run/check identity and performs the receive-pack CAS; +it never returns the state-writer installation token to Actions. + +Repository-wide scans fail on `STATE_WRITER_APP_ID`, `STATE_WRITER_APP_INSTALLATION_ID`, +`STATE_WRITER_APP_PRIVATE_KEY`, a state-writer installation token, or any equivalent state +credential in workflow YAML, repository/environment secrets, arguments, stdin, output, logs, or +artifacts. They also reject write-capable `GITHUB_TOKEN`, `pull_request_target`, privileged +`workflow_run`, untrusted code, and any overlap with `OPENAI_API_KEY`. + +Require `audit-pr-validate.yml` to run stable job `audit-pr-validate` on the approved PR/review +events, with trusted-base code, exact head resolution, no secret, and only `contents: read` plus +`pull-requests: read`. Unrelated diffs return an explicit successful no-op. + +- [ ] **Step 5: Run workflow tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_workflows.py tests/campaign/test_audit_pr.py tests/campaign/test_workflow_policy.py tests/test_ci_contract.py -q` + +Expected: FAIL because this checkpoint's frozen 11-workflow inventory, fixed tools, and new reusable-workflow caller rows are +absent. + +- [ ] **Step 6: Implement this task's workflows and audit validator within the 11-member checkpoint** + +`benchmark-hard-score.yml` calls only `Runtime.hard_score` then `Runtime.prepare_judge` and accepts +only `GENERATION_COMPLETE`; the existing judge runtime calls only `Runtime.seal_judge`. +`benchmark-evidence.yml` accepts only `JUDGE_COMPLETE` and seals the exact provider-evidence +inventory. `benchmark-audit.yml` calls only Publication `sample_audit` and `seal_audit`, then emits +`AUDIT_SEALED`. `benchmark-analysis.yml` calls only Publication `analyze` and `verify`, then emits +`ANALYSIS_SEALED`. `benchmark-collect-complete.yml` accepts only `ANALYSIS_COMPLETE` and emits +`COMPLETE_BUNDLE_SEALED`. `benchmark-finalize-invalid.yml` accepts only `STOPPED_INVALID` or +`BUDGET_INCOMPLETE` and emits `INVALID_PREFIX_SEALED`. Every event is packaged as canonical broker +input against an exact expected authority OID; stale OID, unresolved hold, or active +credential-exposure pending root fails before upload or side effect. + +Hard-score, evidence, and invalid-finalization dispatch from the exact protected campaign input tag +and reverify its tag object/C0. Audit, analysis, and complete collection dispatch from exact +plan-bound `main` and reverify the caller/reusable workflow members against the same C0-derived +workflow root. `audit-pr-validate.yml` alone uses its frozen PR/review triggers and has no mutation +authority. + +Implement `tools/validate_audit_pr.py` against separate trusted-base and candidate checkouts. Verify +the fixed reviewer registry, Git object ancestry, configured signature-verification mode/fingerprint, +commitment/reveal/adjudication ordering, actor separation, current reviews, and append-only paths. +Reject premature reveal, cross-sample labels, self-signoff, missing signature evidence, changed old +paths, or any unregistered actor. + +Pin the four approved action commits already frozen by the design and do not introduce another +action. Static tests prove all seven live methods have exactly the ownership tuple above and every +public replay command remains offline/non-evidentiary. + +```text +actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 +actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 +astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d +actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a +``` + +- [ ] **Step 7: Run capability/workflow GREEN checks** + +Run: `uv run pytest tests/campaign/test_publication_capability.py tests/campaign/test_publication_workflows.py tests/campaign/test_audit_pr.py tests/campaign/test_workflow_policy.py tests/test_ci_contract.py tests/test_public_contract.py -q` + +Expected: PASS; `tests/test_ci_contract.py` enumerates exactly 11 workflows at this checkpoint. Tasks +10, 12, and 13 advance the real inventory to 13, 14, and finally 15 respectively. + +- [ ] **Step 8: Commit the capability and evidence workflows** + +```bash +git add src/laconian_eval/campaign/publication.py \ + tools/benchmark_sample_audit_stage.py \ + tools/benchmark_seal_audit_stage.py \ + tools/benchmark_analyze_stage.py \ + tools/benchmark_verify_stage.py \ + tools/validate_audit_pr.py \ + .github/workflows/benchmark-hard-score.yml \ + .github/workflows/benchmark-evidence.yml \ + .github/workflows/benchmark-audit.yml \ + .github/workflows/benchmark-analysis.yml \ + .github/workflows/benchmark-collect-complete.yml \ + .github/workflows/benchmark-finalize-invalid.yml \ + .github/workflows/audit-pr-validate.yml \ + .github/workflows/benchmark-publication-state.yml \ + tests/campaign/test_publication_capability.py \ + tests/campaign/test_publication_workflows.py \ + tests/campaign/test_audit_pr.py \ + tests/campaign/test_workflow_policy.py \ + tests/test_ci_contract.py \ + tests/test_public_contract.py +git commit -m "ci: add authority-bound publication evaluation stages" +``` + +### Task 8: Define and construct `PublicationPlanV1` + +**Files:** +- Modify: `src/laconian_eval/campaign/publication.py` +- Create: `tools/benchmark_prepare_correction.py` +- Create: `tests/campaign/test_publication_plan.py` +- Create: `tests/campaign/test_publication_terminal_records.py` +- Modify: `src/laconian_eval/campaign/collector.py` +- Modify: `src/laconian_eval/campaign/public_projection.py` +- Modify: `src/laconian_eval/campaign/__init__.py` +- Modify: `tests/test_public_contract.py` + +- [ ] **Step 1: Write the failing complete and invalid plan round-trip tests** + +Use a local bare Git repository with `main`, the input commit, two commitment merges, two reveal +merges, one adjudication merge, and no result path. Build complete and invalid-prefix plans and +assert deterministic proposed tree and commit IDs. + +The following historical model block is retained only as a consolidated predecessor-wire rejection +fixture. Do not implement or export any class shape from this block, including a class whose name +still resembles a production name. Focused tests submit these old `schema_version="1"`, aggregate +checkpoint/finalization, split correction-invalidation, and scalar-root shapes and require strict +failure before any credential or effect. Production Task 8 uses only the exact 05e3d7ba overlay +records and fields from normative §§7.5–7.6. + +```python +class GitHubHumanAccountObservationV1(CapsuleModel): + account_id: StrictPositiveInt + login: BoundedNonBlankString + account_type: Literal["User"] + source_api_receipt_sha256: Sha256 + eligible_merge_team_policy_sha256: Sha256 + observation_sha256: Sha256 + + +class CorrectionDefectRecordV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + correction_attempt: StrictPositiveInt + affected_pointer_sha256: Sha256 + affected_publication_id: BoundedNonBlankString + defect_class: Literal[ + "publication_metadata", + "release_metadata", + "credential_exposure", + "nondismissible_hold", + "invalidation_hold", + "protocol_authority_drift", + ] + defect_code: Literal[ + "publication_object_metadata_diverged", + "release_object_metadata_diverged", + "release_finalization_interrupted", + "post_merge_credential_exposure", + "nondismissible_invalid_event", + "accepted_release_invalidation", + "persistent_protocol_authority_drift", + ] + evidence_sha256: Sha256 + record_sha256: Sha256 + + +class CorrectionPhaseLineageV1(CapsuleModel): + schema_version: Literal["1"] + prior_campaign_state_sha256: Sha256 + prior_authority_oid: GitObjectId + prior_phase_sha256: Sha256 + phase_number: StrictPositiveInt + supersedes_root_sha256: Sha256 + + +class CorrectionPublicationIntentPlanV1(CapsuleModel): + schema_version: Literal["1"] + publication_plan: "PublicationPlanV1" + base_oid: GitObjectId + head_oid: GitObjectId + result_tree_oid: GitObjectId + sealed_bundle_sha256: Sha256 + branch_name: BoundedNonBlankString + pull_request_marker: BoundedNonBlankString + plan_sha256: Sha256 + + +class CorrectionReleaseAssetV1(CapsuleModel): + name: BoundedNonBlankString + byte_length: StrictNonNegativeInt + sha256: Sha256 + + +class ProposedLatestPointerConstraintV1(CapsuleModel): + schema_version: Literal["1"] + correction_attempt: StrictPositiveInt + supersedes_pointer_sha256: Sha256 + required_publication_id: BoundedNonBlankString + required_result_path: RelativePosixPath + required_bundle_sha256: Sha256 + required_release_status: Literal["released"] + constraint_sha256: Sha256 + + +class CorrectionReleaseIntentPlanV1(CapsuleModel): + schema_version: Literal["1"] + annotated_tag_name: BoundedNonBlankString + annotated_tag_message: BoundedNonBlankString + annotated_tag_target_oid: GitObjectId + tagger_name: Literal["Laconian Benchmark Release"] + tagger_email: Literal["benchmark-release@laconian.invalid"] + tagger_timestamp: CanonicalTimestamp + annotated_tag_bytes_sha256: Sha256 + expected_tag_object_oid: GitObjectId + draft_release_name: BoundedNonBlankString + draft_release_body: BoundedNonBlankString + draft_release_marker: BoundedNonBlankString + require_immutable_release: Literal[True] + immutable_release_policy_sha256: Sha256 + assets: tuple[CorrectionReleaseAssetV1, CorrectionReleaseAssetV1] + plan_sha256: Sha256 + + +class CorrectionEffectActorsV1(CapsuleModel): + schema_version: Literal["1"] + publisher_app: GitHubAppInstallationIdentityV1 + release_finalizer_app: GitHubAppInstallationIdentityV1 + + +class CorrectionAssetIdempotencyV1(CapsuleModel): + asset_name: BoundedNonBlankString + asset_sha256: Sha256 + effect_key: Sha256 + + +class CorrectionPublicationIdempotencyKeysV1(CapsuleModel): + schema_version: Literal["1"] + intent_cas_key: Sha256 + publication_effect_key: Sha256 + publication_receipt_cas_key: Sha256 + merge_receipt_cas_key: Sha256 + publication_invalidation_receipt_cas_key: Sha256 + + +class CorrectionReleaseIdempotencyKeysV1(CapsuleModel): + schema_version: Literal["1"] + tag_effect_key: Sha256 + draft_release_effect_key: Sha256 + asset_effects: tuple[CorrectionAssetIdempotencyV1, CorrectionAssetIdempotencyV1] + publish_effect_key: Sha256 + final_verification_effect_key: Sha256 + tag_receipt_cas_key: Sha256 + release_receipt_cas_key: Sha256 + finalization_receipt_cas_key: Sha256 + release_invalidation_receipt_cas_key: Sha256 + + +class CorrectionCredentialExposureWithdrawalV1(CapsuleModel): + schema_version: Literal["1"] + latest_status: Literal["withdrawn_due_to_credential_exposure"] + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 + incident_root_sha256: Sha256 + contaminated_tag_root_sha256: Sha256 + contaminated_release_root_sha256: Sha256 + contaminated_history_root_sha256: Sha256 + withdrawal_sha256: Sha256 + + +class NondismissibleHeldReleasedConsumptionV1(CapsuleModel): + kind: Literal["nondismissible"] + hold_id: BoundedNonBlankString + hold_root_sha256: Sha256 + nondismissible_evidence_sha256: Sha256 + hold_admission_event_sha256: Sha256 + consumption_sha256: Sha256 + + +class ExposureHeldReleasedConsumptionV1(CapsuleModel): + kind: Literal["exposure"] + hold_id: BoundedNonBlankString + hold_root_sha256: Sha256 + credential_exposure_incident_id: BoundedNonBlankString + incident_root_sha256: Sha256 + terminal_containment_root_sha256: Sha256 + credential_exposure_evidence_sha256: Sha256 + terminal_exposure_progress_and_evidence_root_sha256: Sha256 + consumption_sha256: Sha256 + + +class InvalidationHeldReleasedConsumptionV1(CapsuleModel): + kind: Literal["invalidation"] + hold_id: BoundedNonBlankString + hold_root_sha256: Sha256 + invalidation_evidence_sha256: Sha256 + prior_release_invalidation_event_path: RelativePosixPath + prior_release_invalidation_event_sha256: Sha256 + consumption_sha256: Sha256 + + +class DriftHeldReleasedConsumptionV1(CapsuleModel): + kind: Literal["drift"] + hold_id: BoundedNonBlankString + hold_root_sha256: Sha256 + protocol_authority_drift_evidence_sha256: Sha256 + prior_drift_observation_event_sha256: Sha256 + consumption_sha256: Sha256 + + +HeldReleasedConsumptionV1 = Annotated[ + NondismissibleHeldReleasedConsumptionV1 + | ExposureHeldReleasedConsumptionV1 + | InvalidationHeldReleasedConsumptionV1 + | DriftHeldReleasedConsumptionV1, + Field(discriminator="kind"), +] + + +class CorrectionIntentV1(CapsuleModel): + schema_version: Literal["CorrectionIntentV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + defect_class: Literal[ + "publication_metadata", + "release_metadata", + "credential_exposure", + "nondismissible_hold", + "invalidation_hold", + "protocol_authority_drift", + ] + defect_code: Literal[ + "publication_object_metadata_diverged", + "release_object_metadata_diverged", + "release_finalization_interrupted", + "post_merge_credential_exposure", + "nondismissible_invalid_event", + "accepted_release_invalidation", + "persistent_protocol_authority_drift", + ] + defect_evidence_sha256: Sha256 + authority_parent_state: Literal["RELEASED", "RELEASE_BLOCKED"] + phase_lineage: CorrectionPhaseLineageV1 + held_released_consumption: HeldReleasedConsumptionV1 | None + correction_publication_plan: CorrectionPublicationIntentPlanV1 + correction_release_plan: CorrectionReleaseIntentPlanV1 + prior_latest_pointer: "LatestPublicationPointerV1" + proposed_latest_pointer_constraint: ProposedLatestPointerConstraintV1 + allowed_effect_actors: CorrectionEffectActorsV1 + publication_idempotency_keys: CorrectionPublicationIdempotencyKeysV1 + release_idempotency_keys: CorrectionReleaseIdempotencyKeysV1 + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + credential_exposure_withdrawal: CorrectionCredentialExposureWithdrawalV1 | None + created_at: CanonicalTimestamp + intent_sha256: Sha256 + + +class BlockedReleaseObjectsV1(CapsuleModel): + schema_version: Literal["1"] + failure_phase: Literal[ + "pre_tag", + "tag_created", + "draft_created", + "assets_partial", + "assets_complete", + "publish_unverified", + "published_divergent", + ] + planned_tag_name: BoundedNonBlankString + observed_tag_object_sha: GitObjectId | None + observed_release_id: StrictPositiveInt | None + observed_release_is_draft: StrictBool | None + observed_asset_root_sha256: Sha256 | None + immutable_release_verification_sha256: Sha256 | None + evidence_sha256: Sha256 + + +class ResultMergeInvalidatedBlockedOriginV1(CapsuleModel): + kind: Literal["result_merge_invalidated"] + postmerge_admission_failure_sha256: Sha256 + contaminated_merge_oid: GitObjectId + contaminated_result_tree_oid: GitObjectId + no_release_effects_evidence_sha256: Sha256 + origin_sha256: Sha256 + + +class ReleasePlanInvalidatedBlockedOriginV1(CapsuleModel): + kind: Literal["release_plan_invalidated"] + release_defect_evidence_sha256: Sha256 + blocked_release_objects: BlockedReleaseObjectsV1 + origin_sha256: Sha256 + + +ReleaseBlockedOriginV1 = Annotated[ + ResultMergeInvalidatedBlockedOriginV1 | ReleasePlanInvalidatedBlockedOriginV1, + Field(discriminator="kind"), +] + + +class LatestPublicationPointerV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + successful_correction_attempt: StrictNonNegativeInt + publication_id: BoundedNonBlankString + release_status: Literal["released", "release_blocked"] + bundle_kind: Literal["complete"] + result_path: RelativePosixPath + bundle_sha256: Sha256 + publication_plan_sha256: Sha256 + publication_pr_number: StrictPositiveInt + merge_commit_sha: GitObjectId + result_tag_name: BoundedNonBlankString | None + tag_object_sha: GitObjectId | None + release_id: StrictPositiveInt | None + release_receipt_sha256: Sha256 | None + release_blocked_origin: ReleaseBlockedOriginV1 | None + pointer_sha256: Sha256 + + +class CorrectionProgressV1(CapsuleModel): + schema_version: Literal["1"] + correction_attempt: StrictPositiveInt + base_pointer_sha256: Sha256 + defect_record_sha256: Sha256 + phase: Literal[ + "intent_authorized", + "publication_recorded", + "merge_recorded", + "tag_recorded", + "release_recorded", + ] + intent_sha256: Sha256 + publication_receipt_sha256: Sha256 | None + merge_receipt_sha256: Sha256 | None + tag_receipt_sha256: Sha256 | None + release_receipt_sha256: Sha256 | None + progress_sha256: Sha256 + + +class CorrectionLineageV1(CapsuleModel): + schema_version: Literal["1"] + source_campaign_state: Literal["RELEASED", "RELEASE_BLOCKED"] + correction_attempt: StrictPositiveInt + defect_record_sha256: Sha256 + supersedes_pointer_sha256: Sha256 + supersedes_release_status: Literal["released", "release_blocked"] + supersedes_bundle_kind: Literal["complete"] + supersedes_publication_id: BoundedNonBlankString + supersedes_result_path: RelativePosixPath + supersedes_bundle_sha256: Sha256 + supersedes_publication_plan_sha256: Sha256 + supersedes_publication_pr_number: StrictPositiveInt + supersedes_merge_commit_sha: GitObjectId + supersedes_result_tag_name: BoundedNonBlankString | None + supersedes_tag_object_sha: GitObjectId | None + supersedes_release_id: StrictPositiveInt | None + supersedes_release_receipt_sha256: Sha256 | None + supersedes_release_blocked_origin: ReleaseBlockedOriginV1 | None + lineage_sha256: Sha256 + + +class CorrectionPublicationReceiptV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + correction_intent_sha256: Sha256 + branch_receipt: "PublicationBranchReceiptV1" + pull_request_receipt: "PublicationPRReceiptV1" + receipt_sha256: Sha256 + + +class CorrectionMergeReceiptV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + correction_publication_receipt_sha256: Sha256 + publication_merge_receipt: "PublicationMergeReceiptV1" + correction_intent_sha256: Sha256 + receipt_sha256: Sha256 + + +class CorrectionTagReceiptV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + correction_intent_sha256: Sha256 + correction_release_plan_sha256: Sha256 + executable_release_plan: "ExecutableResultReleasePlanV1" + executable_release_plan_sha256: Sha256 + security_attestor_receipt: "SecurityAttestorReceiptV1" + security_attestor_receipt_sha256: Sha256 + tag_receipt: "TagReceiptV1" + receipt_sha256: Sha256 + + +class CorrectionReleaseReceiptV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + correction_intent_sha256: Sha256 + correction_release_plan_sha256: Sha256 + executable_release_plan_sha256: Sha256 + security_attestor_receipt_sha256: Sha256 + correction_tag_receipt_sha256: Sha256 + draft_release_receipt: "DraftReleaseReceiptV1" + asset_receipts: tuple["ReleaseAssetReceiptV1", "ReleaseAssetReceiptV1"] + publish_receipt: "PublishReceiptV1" + final_verification_receipt: "FinalReleaseVerificationReceiptV1" + release_finalizer_operation_set: "ReleaseFinalizerOperationSetV1" + release_no_later_effects: "ReleaseNoLaterEffectsEvidenceV1" + receipt_sha256: Sha256 + + +class CorrectionFinalizationV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + correction_intent_sha256: Sha256 + correction_release_plan_sha256: Sha256 + executable_release_plan_sha256: Sha256 + security_attestor_receipt_sha256: Sha256 + correction_release_receipt_sha256: Sha256 + durable_authority_checkpoint: "RejectedDurableAuthorityCheckpointFixture" + durable_authority_checkpoint_sha256: Sha256 + prior_latest_pointer_sha256: Sha256 + final_latest_pointer: "LatestPublicationPointerV1" + finalization_sha256: Sha256 + + +class CorrectionInvalidationIntentParentV1(CapsuleModel): + parent_phase: Literal["intent"] + correction_intent_sha256: Sha256 + + +class CorrectionInvalidationPublicationReceiptParentV1(CapsuleModel): + parent_phase: Literal["publication_receipt"] + correction_intent_sha256: Sha256 + correction_publication_receipt_sha256: Sha256 + + +CorrectionInvalidationParentV1 = Annotated[ + CorrectionInvalidationIntentParentV1 | CorrectionInvalidationPublicationReceiptParentV1, + Field(discriminator="parent_phase"), +] + + +# Rejection fixtures only: the approved wire uses the single closed CorrectionInvalidationV1 +# record defined by the 05e3d7ba overlay, never these predecessor unions/classes. +class RejectedCorrectionPublicationNoPRInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + kind: Literal["correction_publication_invalidation"] + publication_outcome: Literal["unmerged_invalid"] + observation_kind: Literal["no_pr"] + cause: Literal["ordinary", "credential_exposure"] + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + reason: Literal["correction_publication_invalid"] + correction_intent_sha256: Sha256 + publisher_actor: GitHubAppInstallationIdentityV1 + proposed_latest_pointer_constraint_sha256: Sha256 + authenticated_pr_absence_observation_sha256: Sha256 + discovered_branch_receipt: PublicationBranchReceiptV1 | None + discovered_pull_request_projection_sha256: Sha256 | None + discovered_branch_and_pr_inventory_root_sha256: Sha256 + no_later_effects_evidence_sha256: Sha256 + invalidation_sha256: Sha256 + + +class RejectedCorrectionPublicationClosedPRInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + kind: Literal["correction_publication_invalidation"] + publication_outcome: Literal["unmerged_invalid"] + observation_kind: Literal["closed_pr"] + cause: Literal["ordinary", "credential_exposure"] + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + reason: Literal["correction_publication_invalid"] + parent: CorrectionInvalidationParentV1 + publisher_actor: GitHubAppInstallationIdentityV1 + proposed_latest_pointer_constraint_sha256: Sha256 + close_receipt: "PublicationCloseReceiptV1" + discovered_branch_and_pr_root_sha256: Sha256 + no_later_effects_evidence_sha256: Sha256 + invalidation_sha256: Sha256 + + +class RejectedCorrectionPublicationMergedInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + kind: Literal["correction_publication_invalidation"] + publication_outcome: Literal["merged_invalid"] + observation_kind: Literal["merged_pr"] + cause: Literal["ordinary", "credential_exposure"] + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + parent: CorrectionInvalidationParentV1 + proposed_latest_pointer_constraint_sha256: Sha256 + pull_request_number: StrictPositiveInt + immutable_pull_request_root_sha256: Sha256 + base_oid: GitObjectId + head_oid: GitObjectId + observed_merge_oid: GitObjectId + observed_merge_parents: tuple[GitObjectId, GitObjectId] + expected_result_tree_oid: GitObjectId + observed_result_tree_oid: GitObjectId + merge_actor: GitHubHumanAccountObservationV1 + merge_method: Literal["merge_commit"] + required_checks_root_sha256: Sha256 + approvals_root_sha256: Sha256 + current_main_oid: GitObjectId + request_receipts_root_sha256: Sha256 + postmerge_admission_failure_sha256: Sha256 + contaminated_exposure_root_sha256: Sha256 + no_later_effects_evidence_sha256: Sha256 + invalidation_sha256: Sha256 + + +RejectedCorrectionPublicationInvalidationFixture = Annotated[ + RejectedCorrectionPublicationNoPRInvalidationFixture + | RejectedCorrectionPublicationClosedPRInvalidationFixture + | RejectedCorrectionPublicationMergedInvalidationFixture, + Field(discriminator="observation_kind"), +] + + +class RejectedCorrectionReleaseInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + correction_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + phase_lineage: CorrectionPhaseLineageV1 + kind: Literal["correction_release_invalidation"] + cause: Literal["ordinary", "credential_exposure"] + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + correction_intent_sha256: Sha256 + correction_release_plan_sha256: Sha256 + correction_merge_receipt_sha256: Sha256 + merge_commit_oid: GitObjectId + result_tree_oid: GitObjectId + blocked_release_objects: BlockedReleaseObjectsV1 + reconciliation_receipts_root_sha256: Sha256 + unchanged_latest_pointer_sha256: Sha256 + no_later_effects_evidence_sha256: Sha256 + invalidation_sha256: Sha256 + + +class PublicationPlanV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + publication_attempt: StrictPositiveInt + correction_lineage: CorrectionLineageV1 | None + bundle_kind: Literal["complete", "invalid_prefix"] + bundle_sha256: Sha256 + audit_protocol_sha256: Sha256 + bundle_artifact: ExactArtifactLocatorV1 + input_tag_object_sha: GitObjectId + input_commit_sha: GitObjectId + campaign_registry_sha256: Sha256 + protocol_attestation_tag_binding_sha256: Sha256 + workflow_root: Sha256 + main_fallback_liveness_policy_sha256: Sha256 + authority_state_sha256: Sha256 + unresolved_hold_root_sha256: Sha256 | None + active_credential_exposure_pending_root_sha256: Sha256 | None + audit_merge_shas: tuple[GitObjectId, ...] + stop_state_sha256: Sha256 | None + missing_suffix_sha256: Sha256 | None + base_ref: Literal["refs/heads/main"] + base_sha: GitObjectId + result_path: RelativePosixPath + expected_files: tuple[PublicFileV1, ...] + expected_tree_diff_sha256: Sha256 + publication_workflow_path: Literal[".github/workflows/benchmark-publish.yml"] + publication_workflow_sha256: Sha256 + branch_name: BoundedNonBlankString + commit_message: BoundedNonBlankString + commit_timestamp: CanonicalTimestamp + proposed_tree_oid: GitObjectId + proposed_head_sha: GitObjectId + expected_merge_tree_oid: GitObjectId + merge_method: Literal["merge_commit"] + expected_merge_parents: tuple[GitObjectId, GitObjectId] + required_check_names: tuple[BoundedNonBlankString, ...] + review_policy_sha256: Sha256 + allowed_merge_actor_ids: tuple[StrictPositiveInt, ...] + branch_ruleset_sha256: Sha256 + pull_request_title: BoundedNonBlankString + pull_request_body_sha256: Sha256 + plan_sha256: Sha256 +``` + +After all referenced classes are defined, resolve the quoted forward references once with +`CorrectionPublicationIntentPlanV1.model_rebuild()`, `CorrectionIntentV1.model_rebuild()`, and each +of the six correction wrapper classes; no +shadow dict, permissive mapping, or flattened compatibility model is allowed. Canonicalize every +nested record with `extra="forbid"` and compute `intent_sha256` over the complete +`CorrectionIntentV1` while omitting only `intent_sha256`. + +Derive both `CorrectionIntentV1.created_at` and +`CorrectionReleaseIntentPlanV1.tagger_timestamp` from the immutable reviewed defect merge commit's +Git committer timestamp: parse its signed epoch seconds plus numeric offset, normalize to integral +UTC, serialize once as `CanonicalTimestamp`, and require the two fields equal. Wall clock, workflow +clock, caller input, locale, and host timezone never participate. Golden tests run under distinct +`TZ`/locale settings and shifted clocks and require identical timestamp, tag bytes/OID, intent, and +USTAR bytes. + +Add field-by-field builder tests and mapping assertions. `build_correction_intent` derives +`phase_lineage.prior_campaign_state_sha256`, `prior_authority_oid`, `prior_phase_sha256`, the exact +next `phase_number`, and `supersedes_root_sha256` from reconstructed authority and the latest durable +correction prefix; none is a caller scalar. It embeds the complete class-bound +`PublicationPlanV1`, maps `base_oid == publication_plan.base_sha`, +`head_oid == publication_plan.proposed_head_sha`, +`result_tree_oid == publication_plan.expected_merge_tree_oid`, and +`sealed_bundle_sha256 == publication_plan.bundle_sha256`, then revalidates the exact branch and PR +marker. It also embeds the complete `CorrectionReleaseIntentPlanV1`: the annotated tag targets +exactly `correction_publication_plan.head_oid`, so canonical tag bytes/object OID, draft identity, +immutable-release policy, and ordered assets are deterministic before publication. The intent +contains no actual merge OID or final latest pointer. A changed nested plan field, marker, +base/head/tree/bundle/tag target/object, or a digest-valid but lineage-substituted plan fails. + +The builder reconstructs `prior_latest_pointer` from authority and deterministically constructs +only `ProposedLatestPointerConstraintV1`; neither is accepted from CLI/workflow input, and the +constraint deliberately contains no PR number, merge commit, tag object, release ID, receipt, or +other future observation. It selects only the +frozen publisher and release-finalizer `GitHubAppInstallationIdentityV1` records and requires their +App and installation identities to be pairwise distinct. It derives every named key in +`CorrectionPublicationIdempotencyKeysV1` and `CorrectionReleaseIdempotencyKeysV1` under their phase/ +effect-specific domains in the same pre-effect intent. All keys across both records are pairwise +distinct, receipt-CAS keys cannot substitute for effect keys or another phase's CAS, and the two +asset-key records repeat the exact aligned release-asset name and digest. Tests delete, duplicate, +reorder, alias, or swap every key and require +failure; there is no generic effect-key collection. + +Freeze idempotency derivation as `sha256(domain || CanonicalJSONV1(ordered_preimage))`. Correction +keys use the ordered base `[campaign_id, campaign_registry_sha256, correction_id, publication_id, +phase_lineage_sha256, correction_publication_plan.plan_sha256, +correction_release_plan.plan_sha256, object_or_target_root]`; initial keys use `[campaign_id, +campaign_registry_sha256, publication_id, release_plan_sha256, tag_target_sha, +object_or_target_root]`. The final element is the exact affected branch/PR/merge/tag/draft/asset/ +publish/receipt/finalization/invalidation root, never null or a generic phase bag. The closed domains +are one literal per field: + +```text +laconian-correction-intent-cas-key-v1\n +laconian-correction-publication-effect-key-v1\n +laconian-correction-publication-receipt-cas-key-v1\n +laconian-correction-merge-receipt-cas-key-v1\n +laconian-correction-publication-invalidation-cas-key-v1\n +laconian-correction-tag-effect-key-v1\n +laconian-correction-draft-effect-key-v1\n +laconian-correction-asset-0-effect-key-v1\n +laconian-correction-asset-1-effect-key-v1\n +laconian-correction-publish-effect-key-v1\n +laconian-correction-final-verification-effect-key-v1\n +laconian-correction-tag-receipt-cas-key-v1\n +laconian-correction-release-receipt-cas-key-v1\n +laconian-correction-finalization-cas-key-v1\n +laconian-correction-release-invalidation-cas-key-v1\n +laconian-initial-release-intent-cas-key-v1\n +laconian-initial-tag-effect-key-v1\n +laconian-initial-draft-effect-key-v1\n +laconian-initial-asset-0-effect-key-v1\n +laconian-initial-asset-1-effect-key-v1\n +laconian-initial-publish-effect-key-v1\n +laconian-initial-final-verification-effect-key-v1\n +laconian-initial-tag-receipt-append-cas-key-v1\n +laconian-initial-draft-receipt-append-cas-key-v1\n +laconian-initial-asset-0-receipt-key-v1\n +laconian-initial-asset-1-receipt-key-v1\n +laconian-initial-assets-receipt-append-cas-key-v1\n +laconian-initial-publish-receipt-append-cas-key-v1\n +laconian-initial-release-finalization-cas-key-v1\n +laconian-initial-release-invalidation-cas-key-v1\n +``` + +For each asset row, `object_or_target_root` is CanonicalJSONV1 of `[ordinal, asset_name, +asset_sha256]`; all other rows use their typed target digest. Check in golden preimage bytes and +digests for every line, plus reorder/omission/cross-domain/cross-campaign/cross-plan negatives. +The initial and correction `final_verification_effect_key` values are preauthorized, +pairwise-distinct from publish/finalization/receipt keys, and bind the +`ReleaseEffectResultV1(effect_kind="final_verification")`; no final-verification append key or +authority path exists. + +Freeze every Publication-owned authority/evidence self hash as +`SHA256(UTF8(literal_domain) || CanonicalJSONV1(record without exactly sole_self_field))`: + +| Record | literal LF-terminated domain | sole self field | +|---|---|---| +| `CorrectionPublicationIntentPlanV1` | `laconian-correction-publication-intent-plan-v1\n` | `plan_sha256` | +| `ProposedLatestPointerConstraintV1` | `laconian-proposed-latest-pointer-constraint-v1\n` | `constraint_sha256` | +| `CorrectionReleaseIntentPlanV1` | `laconian-correction-release-intent-plan-v1\n` | `plan_sha256` | +| `CorrectionCredentialExposureWithdrawalV1` | `laconian-correction-credential-exposure-withdrawal-v1\n` | `withdrawal_sha256` | +| `NondismissibleHeldReleasedConsumptionV1` | `laconian-nondismissible-held-released-consumption-v1\n` | `consumption_sha256` | +| `ExposureHeldReleasedConsumptionV1` | `laconian-exposure-held-released-consumption-v1\n` | `consumption_sha256` | +| `InvalidationHeldReleasedConsumptionV1` | `laconian-invalidation-held-released-consumption-v1\n` | `consumption_sha256` | +| `DriftHeldReleasedConsumptionV1` | `laconian-drift-held-released-consumption-v1\n` | `consumption_sha256` | +| `CorrectionIntentV1` | `laconian-correction-intent-v1\n` | `intent_sha256` | +| `BlockedReleaseObjectsV1` | `laconian-blocked-release-objects-v1\n` | `evidence_sha256` | +| `ResultMergeInvalidatedBlockedOriginV1` | `laconian-result-merge-invalidated-blocked-origin-v1\n` | `origin_sha256` | +| `ReleasePlanInvalidatedBlockedOriginV1` | `laconian-release-plan-invalidated-blocked-origin-v1\n` | `origin_sha256` | +| `LatestPublicationPointerV1` | `laconian-latest-publication-pointer-v1\n` | `pointer_sha256` | +| `CorrectionProgressV1` | `laconian-correction-progress-v1\n` | `progress_sha256` | +| `CorrectionLineageV1` | `laconian-correction-lineage-v1\n` | `lineage_sha256` | +| `CorrectionPublicationReceiptV1` | `laconian-correction-publication-receipt-v1\n` | `receipt_sha256` | +| `CorrectionMergeReceiptV1` | `laconian-correction-merge-receipt-v1\n` | `receipt_sha256` | +| `CorrectionTagReceiptV1` | `laconian-correction-tag-receipt-v1\n` | `receipt_sha256` | +| `CorrectionReleaseReceiptV1` | `laconian-correction-release-receipt-v1\n` | `receipt_sha256` | +| `CorrectionFinalizationV1` | `laconian-correction-finalization-v1\n` | `finalization_sha256` | +| `CorrectionInvalidationV1` | `laconian-correction-invalidation-v1\n` | `correction_invalidation_sha256` | +| `InitialPreauthorizedResultReleasePlanV1` | `laconian-initial-preauthorized-result-release-plan-v1\n` | `preauthorized_release_plan_sha256` | +| `ExecutableResultReleasePlanV1` | `laconian-executable-result-release-plan-v1\n` | `executable_release_plan_sha256` | +| `ResultReleaseIntentV1` | `laconian-result-release-intent-v1\n` | `intent_sha256` | +| `ImmutableReleaseVerificationV1` | `laconian-immutable-release-verification-v1\n` | `verification_sha256` | +| `ReleasePlanInvalidationEvidenceV1` | `laconian-release-plan-invalidation-evidence-v1\n` | `release_plan_invalidation_evidence_sha256` | +| `InitialPublicationInvalidationV1` | `laconian-initial-publication-invalidation-v1\n` | `invalidation_sha256` | +| `InitialPublicationFinalizationV1` | `laconian-initial-publication-finalization-v1\n` | `finalization_sha256` | +| `PublicationReleaseInventoryObservationV1` | `laconian-publication-release-inventory-observation-v1\n` | `release_inventory_observation_sha256` | + +Check in independently hand-authored literal canonical-byte fixtures and expected digests for every +row; tests cannot call production serializers/builders to create expected bytes and reject alternate +domains, missing/doubled LF, wrong omitted field, nested self-hash omission, and cross-record replay. + +`held_released_consumption` is null if and only if the reconstructed parent has no unresolved hold. +It is forbidden for `RELEASE_BLOCKED`. For a held `RELEASED` parent it is exactly one strict +discriminated nondismissible/exposure/invalidation/drift variant, reproduces the current hold ID/root, and +binds the variant-specific typed evidence and accepted event root. The intent CAS clears exactly +that hold root; wrong kind, evidence, event, hold ID/root, null-with-hold, nonnull-without-hold, or a +successor that preserves/substitutes the hold fails. Ordinary metadata correction paths require the +active exposure incident ID/pending-root pair to be null. +The defect class/code/evidence matrix is closed and one-to-one with the consumer discriminator: +`nondismissible_hold/nondismissible_invalid_event -> nondismissible`, +`credential_exposure/post_merge_credential_exposure -> exposure`, +`invalidation_hold/accepted_release_invalidation -> invalidation`, and +`protocol_authority_drift/persistent_protocol_authority_drift -> drift`. Metadata defects require +no hold consumer. Tests reject every cross-pairing even when the component digests are individually +valid. Consumer records bind only already accepted hold-admission, terminal exposure progress/ +evidence, prior invalidation, or prior drift-observation events. They never contain the future +consuming `CORRECTION_INTENT_AUTHORIZED` event hash, intent self hash, or successor authority OID. +Literal preimage goldens prove the hold/evidence -> intent -> event dependency is acyclic. +For the invalidation consumer, `prior_release_invalidation_event_path` is derived from the active +release-blocked pointer's accepted authority member and must resolve under that campaign's exact +`events/` or initial-publication invalidation member selected by `ReleaseBlockedOriginV1`; +descriptor-read canonical bytes must hash to `prior_release_invalidation_event_sha256` and equal the +origin's accepted event/evidence binding. Caller paths, future correction events, and same-digest +bytes outside that exact authority member are rejected. + +`terminal_exposure_consumption` is nonnull for either `RELEASED` or `RELEASE_BLOCKED` if and only if +the defect is exactly `credential_exposure/post_merge_credential_exposure`; every ordinary defect +requires it null and requires the active pair already null. The Runtime-owned strict projection binds incident ID, +pending digest/root, predecessor active-progress root, terminal effect-chain/receipt root, final +`CredentialExposureIncidentEvidenceV1`, and optional concurrent-drift root. The intent CAS verifies +the predecessor active pair, atomically clears both active fields, and consumes the matching hold +when one exists. A no-hold exposure has `held_released_consumption=null`; with a current hold the +consumer must be the exposure variant and all incident/evidence/event roots must equal the terminal +projection. A `RELEASED` exposure additionally requires `credential_exposure_withdrawal` and exact +equality to that terminal projection; a `RELEASE_BLOCKED` exposure requires withdrawal null. The +withdrawal contains exactly the status and incident root, +contaminated tag root, contaminated Release root, contaminated history root, and self digest. It is +null for `RELEASE_BLOCKED` and every metadata defect. Tests cover both parent states and reject a missing conditional record, +one on an ineligible parent/defect, a nonwithdrawn status, any substituted contaminated root, or an +unknown nested field. Complete typed nested plans and their own exact digests are the only plan +authority; no opaque aggregate plan hash is accepted. + +The correction authority subtree remains exactly six ordered member positions: +`intent.json`, `publication-receipt.json`, `merge-receipt.json`, `tag-receipt.json`, +`release-receipt.json`, and exactly one of `finalization.json|invalidation.json` in the terminal +position. The complete correction release plan remains in immutable `intent.json`; no post-merge +release-intent record or seventh path exists. `INVALID_EVENT_HELD` is forbidden while any +correction ID has a nonterminal intent/publication/merge/tag/release prefix. Only a bare `RELEASED` +campaign may later consume a hold in a new `CORRECTION_INTENT_AUTHORIZED` CAS; no later correction +phase is a hold consumer. Add state-table, mutation, and replay tests for every nonterminal prefix. +`CorrectionMergeReceiptV1` verifies the actual merge +has parents exactly `[correction_publication_plan.base_oid, +correction_publication_plan.head_oid]`, has the exact preauthorized result tree, and retains the +earlier intent digest unchanged. The correction annotated tag targets the deterministic approved +`head_oid`, not unknown `M`, so its raw bytes and object OID are precomputable in the original +intent. Only `CorrectionFinalizationV1` constructs a full `LatestPublicationPointerV1` from verified +receipts. The wrappers map one-to-one to approved correction events: +`CORRECTION_INTENT_AUTHORIZED`, `CORRECTION_PUBLICATION_RECORDED`, +`CORRECTION_MERGE_RECORDED`, `CORRECTION_TAG_RECORDED`, `CORRECTION_RELEASE_RECORDED`, and either +`CORRECTION_RESULT_RELEASED` or the applicable typed `CORRECTION_INVALIDATED`. Every wrapper binds +campaign ID, `campaign_registry_sha256`, correction ID, publication ID, exact prior authority OID, +prior phase hash, next phase number, supersedes root, typed payload, and its own digest. Their exact +digest domains are respectively `laconian-correction-intent-v1\n`, +`laconian-correction-publication-receipt-v1\n`, `laconian-correction-merge-receipt-v1\n`, +`laconian-correction-tag-receipt-v1\n`, `laconian-correction-release-receipt-v1\n`, +`laconian-correction-finalization-v1\n`, +`laconian-correction-publication-invalidation-v1\n`, and +`laconian-correction-release-invalidation-v1\n`; each canonical +preimage omits only its own named self-digest field. Recovery accepts only a contiguous prefix with +the exact expected-OID predecessor and phase lineage. Missing, duplicate, reordered, replayed, +cross-campaign, cross-registry, cross-correction, or alternate-path records fail. + +Initial plans and ordinary correction plans require both nullable authority roots null. The sole +exception is the dedicated held-`RELEASED` correction gate above: exactly one current unresolved +hold is consumed through `HeldReleasedConsumptionV1`, the active exposure pair remains null, and the +same intent CAS clears that exact hold. These fields remain explicit so a caller cannot erase a +blocked predecessor while hashing the plan. The registry, companion binding, workflow inventory and +fallback policy fields must exactly equal reconstructed canonical authority; no builder accepts them +as caller scalars. + +`expected_merge_parents` is exactly `[base_sha, proposed_head_sha]`. The plan binds the expected +merge tree but never claims to know the eventual merge commit. V1 accepts only literal +`merge_commit`; squash, rebase, any alternate mode, a pre-merge test SHA, or a caller-selected merge mode is +rejected. + +For every plan, validate `publication_id` against +`[a-z0-9][a-z0-9-]{0,95}`. Derive `publication_attempt` only from reconstructed canonical authority: +it is `1` when that publication ID has no accepted invalidation and otherwise exactly one greater +than its contiguous, digest-chained accepted invalidation count. Derive `branch_name` exactly as +`benchmark-result-pr/{publication_id}-a{publication_attempt}-{base_sha[:12]}-{bundle_sha256[:12]}`. +It must match +`benchmark-result-pr/[a-z0-9][a-z0-9-]{0,95}-a[1-9][0-9]*-[0-9a-f]{12}-[0-9a-f]{12}`, be new, and may not equal +or prefix-match `main`, `benchmark-authority/`, any tag ref, dot component, lock suffix, or other +protected namespace. No caller supplies it. For an initial publication, +`publication_id == campaign_id`, `correction_lineage is None`, and the result path is +`benchmarks/results/{campaign_id}`. For correction attempt `N`, `publication_id` is exactly +`{campaign_id}-correction-{N}`, the branch/result path/tag/Release use that new publication ID, and +every superseded field is required. `correction_attempt` is derived from the full accepted +`corrections/` directory history as `max(all started and terminal attempt ordinals) + 1`, not from +the latest pointer; every copied supersedes field must equal +that pointer, including `supersedes_bundle_kind` and the strict blocked-origin union. +`supersedes_release_status == "released"` requires all four released tag/release fields and null +`release_blocked_origin`; `"release_blocked"` requires all four released fields null and exactly one +nonnull origin variant. `result_merge_invalidated` binds `PostMergeAdmissionFailureV1`, contaminated +merge/tree, and no-release proof; `release_plan_invalidated` binds the release defect plus +`BlockedReleaseObjectsV1`. Validate its phase-dependent field presence +and preserve every observed orphan tag/draft/asset identity without granting release authority, +independently of `source_campaign_state`. Complete plans require the ordered full audit merge set and +null STOP fields. Complete plans copy the identical Evaluation-owned +`audit_protocol_sha256: Sha256` from the verified bundle/inventory lineage and reverify it against +Runtime Task 2's peeled-C0 audit member; no plan builder accepts that value independently. +Invalid-prefix plans retain the same campaign-registry field even when no audit output exists and +require empty absent-audit suffixes plus exact STOP and +missing-suffix hashes. + +Bind `publication_attempt` into the commit message, PR title/body, proposed head, plan digest, +intent, effect receipt, invalidation, close plan/receipt, and every authority mutation. An accepted +invalidation permanently consumes its attempt even if `base_sha` and bundle bytes did not change; +the next plan therefore has a new branch and head without updating, deleting, or force-pushing the +old branch. Reject gaps, replayed attempts, caller-supplied attempts, or an invalidation chain from a +different publication ID. + +An initial result directory is byte-for-byte the sealed bundle. A correction result directory adds +exactly one plan-owned canonical `correction-lineage.json` beside the byte-for-byte corrected bundle +projection. `PublicationPlanV1.expected_files`, tree diff, commit, merge receipt, release plan, and +release assets all hash that file. It is forbidden in initial/invalid-prefix publication and cannot +be supplied from model output. + +- [ ] **Step 2: Add failing ancestry, movement, and collision tests** + +Reject a base other than current `main`, a base that omits the input commit or any present audit +merge, an existing result path, existing branch, wrong bundle digest, extra tree member, symlink, +base movement before publication, proposed-head movement, unclean worktree, noncanonical commit +metadata, and mismatched publication workflow hash. +Reject every branch spelling not equal to the one derivation above, including case changes, +additional slashes, shortened/full caller hashes, ref escapes, an existing ref, or a branch whose +base/bundle prefixes do not match the plan. + +Also test a first correction after `RELEASED`, a first correction after `RELEASE_BLOCKED`, and a +second correction. Include both histories: released initial -> correction 1 merged but release +blocked while campaign state remains `RELEASED` -> correction 2 supersedes a `release_blocked` +pointer; and blocked initial -> correction 1 released -> `CORRECTION_RESULT_RELEASED` changes +campaign state to `RELEASED` -> correction 2 supersedes a `released` pointer. Reject a sequence gap/reuse, missing defect record, a superseded digest not found +at the exact prior result path, partial tag/release field sets, editing/removing the old result path, +reusing an old branch/tag/publication ID, or a correction whose lineage does not point to the latest +immutable publication for this campaign. +Exercise every blocked release phase and reject hiding an observed orphan object, treating a draft +as released, or deleting/reusing the planned blocked tag/release during correction. +Also reject missing/changed bundle-kind fields or a correction that changes bundle kind. Correction +lineage requires `bundle_kind=complete`; `INVALID_PREFIX_MERGED` and +`INVALID_PREFIX_MERGED_INVALID` are terminal and cannot acquire analysis, correction, release, +documentation, website, release-note, or social-promotion authority. + +The only accepted defect source is a human-authored and reviewed file at + `benchmarks/corrections/{campaign_id}/{N}/defect.json`, merged to `main` as a one-file PR. There is + no separate `correction_defect` state event or authority mutation: the single + `CORRECTION_INTENT_AUTHORIZED` CAS verifies the protected-main merge, embeds the strict defect + record as intent evidence, and binds its digest. Its sequence and affected pointer are derived, + not operator-selected. A defect in generation, scoring, judging, + audit, statistical methods, source evidence other than the exact post-merge credential-exposure + protocol, campaign authority, public + projection/report rendering, or trusted code/workflow is not correctable under this lineage: fail + closed and require a new reviewed campaign. +Require `publication_metadata` to pair only with `publication_object_metadata_diverged`; require +`release_metadata` to pair only with `release_object_metadata_diverged` or +`release_finalization_interrupted`; and require `credential_exposure` to pair only with +`post_merge_credential_exposure` plus canonical incident/containment evidence. Unknown/free-form +codes and a code/class mismatch fail before correction authority. + +Write the durable correction-prefix tests against the sole authority subtree +`corrections//`. It admits the ordered members `intent.json`, +`publication-receipt.json`, `merge-receipt.json`, `tag-receipt.json`, `release-receipt.json`, and +exactly one of `finalization.json` or `invalidation.json`. Before any external correction effect, +`CORRECTION_INTENT_AUTHORIZED` installs `intent.json` by one expected-OID CAS. The intent binds the +prior authority OID/state/latest pointer, explicit `supersedes` root, complete publication plan, +branch and PR marker, expected result tree, deterministic proposed-latest-pointer constraint, +allowed actors, reviewed defect evidence, conditional held-`RELEASED` consumer, and distinct +publication effect/receipt keys. It binds the complete deterministic correction release plan, +including tag target equal to approved `head_oid`, but no unknown actual merge observation. The +accepted merge wrapper verifies actual `M`/parents/tree against that immutable intent and does not +embed or create another intent. Only finalization constructs the complete +`LatestPublicationPointerV1` from verified receipts. No unpersisted local plan authorizes a write. + +Test all durable prefixes and both closed invalidation kinds. +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=unmerged_invalid)` and +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=merged_invalid)` are allowed only with +`intent.json` or +`publication-receipt.json` and exact `publication_outcome` of `unmerged_invalid` or +`merged_invalid`; `merged_invalid` additionally requires `PostMergeAdmissionFailureV1`, contaminated +merge/exposure, and no-tag/no-Release/no-asset/no-latest/no-docs/no-social evidence. +`CORRECTION_INVALIDATED(kind=correction_release_invalidation)` is allowed only after a valid +`merge-receipt.json` and binds every +created or adopted tag/Release/asset object plus reconciliation evidence. Either invalidation is +terminal for that correction ID, leaves the prior latest pointer unchanged, and requires a new +correction ID. After `merged_invalid`, the new intent must supersede both the failed correction root +and contaminated merge/exposure root. Cross-phase use, a generic invalidation alias, both terminal +members, or an invalidation after finalization fails. + +Implement the approved single closed `CorrectionInvalidationV1` wire record; the predecessor +publication/release unions above remain parser-rejection fixtures only. All nullable fields are +present and the validator enforces the exact outcome matrix from §7.5: `unmerged_invalid`, +`merged_invalid`, `fenced_write_ambiguity`, and `reconciliation_unavailable` are publication-only; +the release variant has null publication outcome/disposition fields and a nonnull exact +`ReleasePlanInvalidationEvidenceV1` root. No scalar root validates without its required nested exact +object. + +For `unmerged_invalid`, require the exact shared `PublicationPRTerminalDispositionV1(outcome=no_pr| +closed)`, all discovered intent-bound branch/PR objects, publication no-later evidence, and +ordinary-premerge containment finality. `merged_invalid` requires the exact +`PostMergeAdmissionFailureV1`: direct normal admission has no containment/disposition/no-later +record, while an active-containment ordinary or ambiguity race carries the approved merge-won +finality and its exact branch-specific fields. `fenced_write_ambiguity` requires +`invalidation_cause=publication_write_ambiguity_fenced`, the nested +`PublicationFencedWriteAmbiguityV1(terminal_route=correction_premerge)`, and write-ambiguity +premerge containment finality. `reconciliation_unavailable` carries the sealed publisher +disposition set/receipt and empty release-authorization-ledger root, makes no stable external-state +claim, and uses ordinary-premerge or merge-won containment finality according to the exact +`no_pr|closed|already_merged` disposition. + +Every containment-form publication outcome binds the exact containment finality, successor +merge-denylist root, source/immediate authority parents, and active containment root transition from +the exact `PublicationTerminalContainmentIntentV1.intent_sha256` terminal-containment intent digest +to null; it never substitutes the underlying `CorrectionIntentV1` digest. The terminal CAS +byte-preserves the denylist. Direct normal +`merged_invalid` has no containment/fence fields and does not mutate the denylist. A correction +release invalidation is allowed only after the valid merge receipt, has all containment/fence and +publication fields null, and binds the exact release operation set/reconciliation evidence and +unchanged prior/proposed latest-pointer roots. Its reconciliation-unavailable branch carries the +sealed failure-only operation set/receipt and a null release-no-later root. + +Apply the exact closed cause rules: ordinary forbids emergency objects; credential exposure +requires the matching terminal consumption and atomically clears the incident/pending pair; +protocol drift requires current-parent drift evidence; write ambiguity and publisher/release +reconciliation unavailability are legal only in their named rows. `recorded_at` equals the selected +authenticated no-later closure, postmerge failure, or sealed unavailable-ledger time. Tests cover +every outcome × cause × parent phase, branch/PR response loss, merge-before-close races, root +clearance/denylist preservation, mixed/null fields, half-null exposure, hidden holds or objects, +cross-incident roots, pointer advancement, terminal replay, and rejection after finalization. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_plan.py tests/campaign/test_publication_terminal_records.py tests/test_public_contract.py -q` + +Expected: FAIL because the Task 7 capability module does not yet define publication plans, +correction intent, or their deterministic builders. + +- [ ] **Step 4: Implement deterministic plan construction** + +Add: + +```python +def build_publication_plan( + *, + repository: Path, + authority: ReconstructedAuthorityV1, + bundle_root: Path, + bundle_seal: BundleSealV1, + bundle_artifact: ExactArtifactLocatorV1, +) -> PublicationPlanV1: + +def build_correction_publication_plan( + *, + repository: Path, + authority: ReconstructedAuthorityV1, + corrected_bundle_root: Path, + corrected_bundle_seal: BundleSealV1, + corrected_bundle_artifact: ExactArtifactLocatorV1, + correction_lineage: CorrectionLineageV1, +) -> PublicationPlanV1: + +def build_correction_intent( + *, + authority: ReconstructedAuthorityV1, + publication_plan: PublicationPlanV1, + correction_release_plan: CorrectionReleaseIntentPlanV1, +) -> CorrectionIntentV1: + +def build_correction_release_intent_plan( + *, + authority: ReconstructedAuthorityV1, + publication_plan: PublicationPlanV1, + asset_root: Path, +) -> CorrectionReleaseIntentPlanV1: + +def require_correction_authority( + authority: ReconstructedAuthorityV1, + correction_lineage: CorrectionLineageV1, +) -> None: + +def reconstruct_latest_publication_pointer( + authority: ReconstructedAuthorityV1, +) -> LatestPublicationPointerV1: + +def reconstruct_correction_progress( + authority: ReconstructedAuthorityV1, +) -> CorrectionProgressV1 | None: + +def build_corrected_bundle( + *, + authority: ReconstructedAuthorityV1, + prior_bundle_root: Path, + defect_record: CorrectionDefectRecordV1, + output_root: Path, +) -> BundleSealV1: +``` + +Require `authority.state.state` to be exactly `BUNDLE_COLLECTED` for a complete bundle or +`INVALID_FINALIZED` for an invalid-prefix bundle, then call +`require_ordinary_effect_gate(authority)`. +Use `git merge-base --is-ancestor`, `git mktree`, and `git commit-tree` with the neutral fixed author +and committer `Laconian Benchmark Publisher `, UTC +timestamp derived internally from the exact `base_sha` commit's integral committer epoch/offset and +normalized to UTC `+0000`, and locale/timezone-independent environment. Callers and workflow clocks +cannot supply a timestamp. Bind the normalized value in `PublicationPlanV1.commit_timestamp`, run +the builders twice under different clocks/timezones/locales, and require identical tree/head/plan +hashes. Compute the exact file diff +from `BundleSealV1`; do not parse response JSONL or report Markdown. + +Neither builder accepts a workflow path/hash scalar. Reconstruct the retained verified C0 +`CampaignInputPackageV1` from authority genesis, require its canonical package digest to equal +`authority.registry.payload.campaign_input_package_sha256`, and import/class-bound revalidate only +Evaluation's `WorkflowInventoryV1`. Rebuild that inventory from the exact retained C0 bytes and +require its root to equal `authority.registry.payload.workflow_root`. Resolve only the literal +`.github/workflows/benchmark-publish.yml` member from that verified inventory, descriptor-read and +re-hash its exact C0 bytes, and bind its literal path and hash into the plan. Reject a missing, +duplicate, substituted, non-C0, or mutable-`main` member, package-digest drift, inventory-root drift, +or any CLI/workflow override. + +The builders likewise accept no audit-merge list from a caller. For a complete bundle, derive the +ordered full merge set from the verified audit/adjudication attachment DAG and re-fetch every exact +merge commit through canonical authority before binding `audit_merge_shas`. For an invalid-prefix +bundle, derive exactly the accepted pre-STOP audit-merge prefix (possibly empty), require no +post-STOP merge, and bind the ordered complement in `missing_suffix_sha256`. Reject a +caller/CLI override, a merely open audit PR, a merge absent from current `main`, and any order/hash +that differs from the sealed audit evidence. + +The correction builder accepts only canonical authority in `RELEASED` or `RELEASE_BLOCKED`, an +exact reviewed defect/incident root, and either no active correction or a new ID after a terminal +prior invalidation. It re-verifies every superseded object, requires a new bundle/result +path/publication ID, and computes a diff that only adds the new result directory. It never rewrites +prior result bytes, tags, Releases, assets, receipts, pointer events, or documentation markers. +Publication/merge/release effects reuse the same protected boundaries. Initial tag, draft, ordered +asset pair, and publish receipts each use the Runtime-owned non-state append CAS. Correction has +only the authoritative tag-wrapper CAS and the aggregate release-wrapper CAS; its inner draft, +ordered assets, and publish receipts are nested in that aggregate and never receive independent +authority CASes. The terminal campaign state remains unchanged until the approved final event. + +`build_correction_release_intent_plan` runs before the correction intent CAS. It derives canonical +annotated-tag bytes/name/message/object OID and frozen tagger identity/timestamp with target exactly +the deterministic correction publication approved `head_oid`, plus draft name/body/marker, +immutable-Release policy, and the two +ordered asset name/size/digest records from canonical authority and descriptor-read bytes. It accepts +no identity, target, body, actor, asset, or key override. `build_correction_intent` embeds that plan +and both key records without flattening. After merge, Task 11's `build_correction_release_plan` +requires actual `M` parents exactly `[base_oid, head_oid]` and the expected result tree, then maps the +preauthorized tagger timestamp/bytes/OID, draft, asset fields, and USTAR mtime byte-for-byte into +`ExecutableResultReleasePlanV1`; it cannot replace the earlier intent or plan. Only an initial release derives +its tagger timestamp from the observed merge receipt. + +For credential exposure before merge, first persist `CREDENTIAL_EXPOSURE_PENDING` plus the +provisional denylist, then record every inventoried idempotent containment effect through +`CREDENTIAL_EXPOSURE_EFFECT_RECORDED`; only the complete predecessor-bound progress chain permits +the terminal incident, publisher close receipt when the complete PR is open, +`PERMANENT_STOP(reason=credential_exposure)`, and safe invalid-prefix projection. Crash recovery +adopts the exact pending/effect external state by idempotency key and never restores live authority. +Under simultaneous drift this same sequence runs from protected current main and binds drift +evidence; it never emits an intervening drift-only STOP. After a +complete merge but before release, use `RESULT_MERGE_INVALIDATED` or +`RELEASE_PLAN_INVALIDATED` as phase-appropriate, disclose the contaminated merge, and create no +original tag/Release. After `RELEASED`, retain the historical release, immediately append +`latest_status=withdrawn_due_to_credential_exposure`, record containment and affected public object +IDs/tombstone status, and require a new explicit correction. Neither deletion nor withdrawal is +described as historical erasure. + +`build_corrected_bundle` is the sole correction-bundle producer. For `release_metadata` and +`publication_metadata` it permits exact byte-for-byte reuse only after the prior bundle fully +re-verifies and the defect is an external publication/release-object metadata divergence from the +already-correct sealed plan, not a code/renderer/bundle defect. It preserves bundle kind and cannot +change any bundle member, analysis value, outcome/interval, audit record, provider evidence, or +invalid-prefix claim prohibition. Only a complete lineage permits this exact-reuse path; every public +projection/report-rendering/trusted-code defect requires a new reviewed campaign. The fixed +`tools/benchmark_prepare_correction.py` selects this closed behavior +from the accepted defect record and authority; it accepts no sequence, class, identity, artifact, or +path override beyond fixed workflow staging roots. Slice 4 uploads that corrected bundle first, +re-fetches its numeric `ExactArtifactLocatorV1`, and only then calls +`build_correction_publication_plan`; no synthetic or missing locator is allowed. +When a correction occurs after transient artifact expiry, this reconstruction may substitute bytes +only through the accepted authority members and their exact protected merge tree, annotated tag, +immutable Release, ordered assets, and accepted append/finalization roots. Every required parent +must be mapped and reverified from canonical bytes; an unmapped private layer or merely same-named +committed file forces a new campaign. Metadata-only reuse still reconstructs the exact prior +committed bundle from those accepted objects rather than trusting a stale local copy or predecessor +checkpoint wrapper. + +For ordinary correction, both authority roots are null. Exactly four nonnull-hold consumers exist +repository-wide: `INVALID_EVENT_DISMISSED`; the typed premerge nondismissible/credential/drift STOP +family; `RESULT_MERGED -> RELEASE_PLAN_INVALIDATED`; and `RELEASED -> +CORRECTION_INTENT_AUTHORIZED` with the exact nondismissible, exposure, invalidation, or drift +discriminator/evidence. Only the last is a correction intent: it binds the predecessor hold through +the strict `HeldReleasedConsumptionV1` variant and its expected-OID successor clears that exact root +atomically. +Tests exercise all four discriminators and reject every defect/evidence/consumer cross-pairing. +No unrelated hold authorizes correction, and no correction silently dismisses or preserves a hold. +For `RELEASE_BLOCKED`, the closed `require_correction_authority` verifier requires the terminal +state's accepted `RELEASE_PLAN_INVALIDATED` event hash to equal +`CorrectionDefectRecordV1.evidence_sha256`; `CorrectionLineageV1.defect_record_sha256` equals the +reviewed record digest, and the later intent explicitly binds that event and record as +`supersedes`. For a `RELEASED` credential incident, the intent additionally binds the withdrawn +latest-status event and terminal containment root. + +`reconstruct_latest_publication_pointer` bootstraps attempt 0 from accepted state-event authority: +`RESULT_RELEASED` supplies the initial publication/merge/tag/release receipts for `RELEASED`, while +either `RESULT_MERGE_INVALIDATED` or `RELEASE_PLAN_INVALIDATED` supplies the exact corresponding +blocked-origin variant for `RELEASE_BLOCKED`. `require_correction_authority`, the attempt-0 pointer, +and `CorrectionLineageV1` must preserve that exact origin and reject cross-origin synthesis. It then folds each correction directory +only in the ordered durable member sequence. A fully verified `finalization.json` plus +`CORRECTION_RESULT_RELEASED` creates the next released pointer. Either invalidation kind leaves the +prior pointer byte-identical; it never creates a release-blocked pointer for the failed correction, +but its terminal directory remains in the accepted attempt history. A successful correction writes +its attempt ordinal into `LatestPublicationPointerV1.successful_correction_attempt`; gaps caused by +invalidated attempts are valid and never reused. Reconstruction rejects missing/duplicate/ +reordered attempt ordinals, reuse after invalidation in any phase, names/paths/tags/Releases whose +N differs from the directory ordinal, and supersedes/progress roots that omit an invalidated attempt. + +`reconstruct_correction_progress` accepts at most one contiguous in-flight directory for exactly +the history-derived next `correction_attempt`. It validates `intent_authorized`, +`publication_recorded`, `merge_recorded`, `tag_recorded`, and `release_recorded` prefixes, each with +the exact prior record hash and authority OID. Missing, duplicate, gapped, reordered, two active +directories, an effect receipt without intent, a tag before merge, or release before tag fails. +Every legitimate prefix is idempotently resumable through exact query/adoption, but it never changes +the latest pointer or authorizes docs/social claims. Only a fully receipt-bound +`CORRECTION_RESULT_RELEASED` finalization advances the pointer; from `RELEASE_BLOCKED` it also moves +state to `RELEASED`, while from `RELEASED` state remains `RELEASED` and history is appended. + +Do not add a public campaign CLI. The fixed trusted preparation tool calls the initial/correction +plan builder selected from canonical authority and accepts no operator-supplied publication ID, +attempt, branch, base/head, audit merge, workflow identity, correction attempt, defect code, or +result-path override. The public console surface remains the seven offline replay commands. + +- [ ] **Step 5: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_publication_plan.py tests/campaign/test_publication_terminal_records.py tests/test_public_contract.py -q` + +Expected: PASS. + +- [ ] **Step 6: Commit publication planning** + +```bash +git add src/laconian_eval/campaign/__init__.py \ + src/laconian_eval/campaign/publication.py \ + src/laconian_eval/campaign/collector.py \ + src/laconian_eval/campaign/public_projection.py \ + tools/benchmark_prepare_correction.py \ + tests/campaign/test_publication_plan.py \ + tests/campaign/test_publication_terminal_records.py \ + tests/test_public_contract.py +git commit -m "feat: bind exact benchmark publication plans" +``` + +### Task 9: Implement the byte-copy-only minimal publisher + +**Files:** +- Create: `tools/benchmark_minimal_publisher.py` +- Create: `tools/benchmark_publisher_broker_client.py` +- Create: `src/laconian_eval/campaign/publisher_broker.py` +- Create: `tests/campaign/test_minimal_publisher.py` +- Create: `tests/campaign/test_publisher_broker.py` +- Create: `tests/campaign/test_publication_delivery_resolution.py` +- Create: `tests/campaign/test_publisher_credential_finality.py` +- Modify: `src/laconian_eval/campaign/publication.py` + +- [ ] **Step 1: Write the failing local publisher test** + +Use a local bare origin and fake GitHub PR endpoint. Supply an exact package ZIP containing only +`publication-plan.json`, `bundle.tar`, `bundle.tar.sha256`, +`tools/benchmark_minimal_publisher.py`, and the hash-bound +`tools/benchmark_publisher_broker_client.py`. The test's fake external publisher broker, not the +Actions-side tool, owns the App private key, terminates GitHub TLS, mints one operation-scoped token, +commits it to the measured vault before executor visibility, performs the exact GitHub reads/write, +closes the token, and returns only signed safe projections/receipts. Assert the created/adopted +branch, proposed head, exact result tree, eligibility check, PR base/title/body, App actor, delivery +resolutions, credential disposition, ledger prefix, and receipt. Assert recursively that no private +key, JWT, installation token, Authorization header, opaque token handle, or raw error body enters +Actions memory, environment, argv, logs, artifacts, exceptions, or receipts. + +`publisher_broker.py` imports the canonical Publication-owned +`PublisherCredentialBrokerPolicyV1`, operation rows, subjects, signed +request/transport/closure projections, phase ledger, vault-audit bindings, and safe reconciliation +records from `publication.py`; it defines only the external-broker policy verifier/client boundary +and never redefines, subclasses, aliases, or re-exports those records. The broker phase is monotone +`constructive -> terminalizing -> terminal_reconciling -> sealed`; workflow input cannot lower it. +Constructive rows are exactly: `branch_create` with `contents:write,metadata:read` and ref GET/create; +`merge_eligibility` with `checks:write,metadata:read` and check-suite/run GET/create; and +`pull_request_create` with `metadata:read,pull_requests:write` and PR-list/exact/create. A row cannot +union permissions or endpoints from another operation. Every mint has append-before-send request, +successful/denied/unknown transport, vault commit or zeroization/unrecoverability, operation +dispatch/terminal receipts, final authenticated observations, delete/denial-probe closure, and one +credential disposition. The signed ledger recomputes zero outstanding token requests, zero +outstanding operation dispatches, zero live tokens, and denial of later mint before the next +authority phase. + +The following block is a predecessor-wire rejection fixture, not an implementation schema. It +freezes the old aggregate receipt/merge shape so tests can reject it before any broker request. The +initial authority directory and production records use only the exact attempt-qualified paths, +Runtime-owned receipt/append wires, and 05e3d7ba Publication models in the overlay: + +```python +class PublicationIntentV1(CapsuleModel): + schema_version: Literal["PublicationIntentV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + publication_attempt: StrictPositiveInt + bundle_kind: Literal["complete", "invalid_prefix"] + publication_plan_sha256: Sha256 + sealed_bundle_root: Sha256 + authority_parent_oid: GitObjectId + branch_name: BoundedNonBlankString + base_oid: GitObjectId + head_oid: GitObjectId + result_tree_oid: GitObjectId + pull_request_marker: BoundedNonBlankString + publisher_app: GitHubAppInstallationIdentityV1 + branch_idempotency_key: Sha256 + pull_request_idempotency_key: Sha256 + branch_receipt_idempotency_key: Sha256 + pull_request_receipt_idempotency_key: Sha256 + merge_observation_idempotency_key: Sha256 + invalidation_idempotency_key: Sha256 + intent_sha256: Sha256 + + +class PublicationBranchReceiptV1(CapsuleModel): + schema_version: Literal["PublicationBranchReceiptV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + intent_sha256: Sha256 + operation: Literal["created", "adopted"] + branch_name: BoundedNonBlankString + base_oid: GitObjectId + head_oid: GitObjectId + actor: GitHubAppInstallationIdentityV1 + request_receipts_root: Sha256 + receipt_sha256: Sha256 + + +class PublicationPRReceiptV1(CapsuleModel): + schema_version: Literal["PublicationPRReceiptV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + intent_sha256: Sha256 + branch_receipt_sha256: Sha256 + operation: Literal["created", "adopted"] + pull_request_number: StrictPositiveInt + pull_request_node_id: BoundedNonBlankString + pull_request_url: ExactAsciiHttpUrl + base_oid: GitObjectId + head_oid: GitObjectId + marker: BoundedNonBlankString + actor: GitHubAppInstallationIdentityV1 + request_receipts_root: Sha256 + receipt_sha256: Sha256 + + +class PublicationMergeReceiptV1(CapsuleModel): + schema_version: Literal["PublicationMergeReceiptV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + publication_plan_sha256: Sha256 + pull_request_receipt_sha256: Sha256 + pull_request_number: StrictPositiveInt + base_oid: GitObjectId + head_oid: GitObjectId + merge_commit_oid: GitObjectId + merge_parents: tuple[GitObjectId, GitObjectId] + result_tree_oid: GitObjectId + merge_commit_raw_sha256: Sha256 + merge_committer_epoch_seconds: StrictNonNegativeInt + merge_committer_utc_offset: BoundedNonBlankString + merge_committer_timestamp_utc: CanonicalTimestamp + merge_method: Literal["merge_commit"] + merge_actor: GitHubHumanAccountObservationV1 + required_checks_root_sha256: Sha256 + approvals_root_sha256: Sha256 + current_main_oid: GitObjectId + request_receipts_root_sha256: Sha256 + receipt_sha256: Sha256 + + +PublicationReceiptV1 = Annotated[ + PublicationBranchReceiptV1 | PublicationPRReceiptV1, + Field(discriminator="schema_version"), +] +``` + +Production publication/release/correction authority records directly carry `campaign_id`, +`campaign_registry_sha256`, and `publication_id`: this includes `PublicationIntentV1`, branch/PR/ +merge/close receipts, every publication invalidation, `ResultReleaseIntentV1`, all four release +effect receipts, terminal finalization/invalidation, the single `CorrectionIntentV1` with both +plans, and +all six correction subtree wrappers. Referencing an intent/plan digest is additional and never a +substitute for these three direct fields. Constructors copy the values only from reconstructed +authority, canonical validators require exact equality at every parent/child edge, and every self- +digest includes them. Parametrize one-field substitution, cross-campaign/registry/publication replay, +digest recomputation after substitution, missing field, and old-schema alias for every record; all +must fail before an App credential, external effect, or authority candidate exists. +Both ordinary merge receipts and correction merged-invalid evidence require the strict +`GitHubHumanAccountObservationV1`: numeric account ID/login, literal API `type="User"`, exact source +receipt, and current eligible-merge-team policy root. The account must be the approved non-bot human +merger and distinct from publisher, release-finalizer, state-writer, and GitHub Actions identities. +Tests reject `Bot`/`App`, bot-login aliases, team-policy drift, ID/login mismatch, stale API receipt, +and substitution of any `GitHubAppInstallationIdentityV1`. + +`PUBLICATION_INTENT_AUTHORIZED` must persist `intent.json` by external-broker expected-OID CAS +before the external publisher broker may mint its operation-scoped credential. The branch effect emits and persists +`branch-receipt.json` before a PR effect is authorized; the PR effect emits and persists +`pr-receipt.json` before either type-specific opened event. A correction uses its already persisted +`corrections//intent.json` and persists the analogous +`publication-receipt.json`. An unpersisted, stale, cross-kind, or locally fabricated intent is +rejected before GitHub access. + +The initial directory's exact ordered members are `intent.json`, `branch-receipt.json`, +`pr-receipt.json`, `merge-receipt.json`, optional `release-intent.json`, optional +`tag-receipt.json`, optional `draft-release-receipt.json`, optional `asset-receipts.json`, optional +`publish-receipt.json`, and exactly one terminal `finalization.json` or `invalidation.json`. +Invalid-prefix publication forbids every release member. No effect may skip its predecessor receipt, +and every receipt has a distinct intent-bound idempotency key. + +The initial tag/draft/assets/publish receipt writes are the closed §7.6 non-state authority append +mechanism, never additional `CampaignStateSchemaV1` events. Each expected-OID broker mutation has +discriminator exactly `initial_release_receipt_append`, appends exactly one next allowlisted path, +retains the byte-identical `CampaignStateV1` and state hash, and carries strict +`InitialReleaseReceiptAppendV1`; no generic unchanged-state append exists. The only path/kind/payload +rows are `tag -> tag-receipt.json -> TagReceiptV1`, `draft_release -> +draft-release-receipt.json -> DraftReleaseReceiptV1`, `assets -> asset-receipts.json -> exactly two +ordered ReleaseAssetReceiptV1`, and `publish -> publish-receipt.json -> PublishReceiptV1`. The broker +replays the predecessor, checks exact intent/registry/publication equality and next path, constructs +one append-only authority commit, and leases the ref. Final `RESULT_RELEASED` binds the accepted +ordered append wrappers, final-verification receipt, operation-set/no-later evidence, and +`InitialPublicationFinalizationV1` while changing state once; failure uses only approved +`RELEASE_PLAN_INVALIDATED` plus `InitialPublicationInvalidationV1`. +Correction receipts use only their separately approved correction phase events and six-member +wrapper sequence. + +Require `publisher_app.role == "publisher"`, every observed actor to equal its bot login, and the exact +pre-registered App/installation/repository IDs and permissions-attestation hash. Reject +`github-actions[bot]`, the state/release App, or any request/response whose ordered permissions and +endpoints do not byte-equal its one authorized publisher-broker operation row. A union token across +branch/check/PR or constructive/terminal operations is forbidden. + +- [ ] **Step 2: Add failing authority and non-interpretation tests** + +Reject a changed base, changed package/script/plan/bundle digest, unexpected ZIP/tar member, path +escape, symlink, an existing divergent remote branch, response text containing shell/HTML/Markdown payloads, +extra Git diff, PR API response with wrong head/base/actor, missing authoritative intent or prior +branch receipt, and any App key/JWT/token/header/handle in any Actions process or environment. Spy +on JSON parsing and assert only +the plan, bundle seal, checksums, and GitHub response are parsed. Add crash/race fixtures for loss +before/after branch creation, branch-receipt CAS, PR creation, and PR-receipt CAS, plus two recovery +jobs racing at each boundary. Also cover eligibility-check create/adopt, every token-request/ +operation-dispatch/response-loss/closure boundary, signed broker-ledger and vault-audit equality, +zeroization/unrecoverability, no-mint, later-mint denial, and recursive token-canary absence. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_delivery_resolution.py tests/campaign/test_publisher_credential_finality.py tests/campaign/test_minimal_publisher.py -q` + +Expected: FAIL because `tools/benchmark_minimal_publisher.py` is absent. + +- [ ] **Step 4: Implement the standard-library-only executable** + +The executable accepts only: + +```text +--package-zip PATH +--repository OWNER/REPO +--receipt-output PATH +``` + +It reads no App/installation ID as a credential input and no private key, installation token, token +handle, or GitHub write credential. It accepts only the fixed GitHub OIDC job identity and verified +campaign/package roots, then validates the preregistered nonsecret App identity inside signed safe +broker receipts, +calls the fixed publisher-broker client with one canonical operation request, and receives only +signed safe receipts/projections. The external measured broker selects the exact policy row, owns +all token bytes and Authorization headers, performs at most one broker-authorized GitHub operation +plus its required observations/closure, and seals the ledger before returning. Repository +`GITHUB_TOKEN` is never passed to the executable and has read-only workflow permissions. + +It verifies the raw package ZIP digest supplied in `LACONIAN_PACKAGE_SHA256`, extracts fixed members +without `extractall`, verifies the current authority intent, plan, and bundle, creates a temporary worktree at exact `base_sha`, +copies only `expected_files`, force-adds only `result_path`, verifies index/tree/head identities, +and packages the exact proposed commit/object identity for broker validation. The +authority-selected next effect is branch create, merge-eligibility check, or PR create; one +invocation requests at most one policy row. The broker creates/adopts only the exact branch ref, +then on a later authoritative prefix creates/adopts the exact success eligibility check, then on a +later prefix creates/adopts the marker-bound PR. Each operation returns its signed transport, +delivery-resolution, credential-disposition, closure, ledger, and safe observation roots; the +secret-free recorder emits only the matching `PublicationBranchReceiptV1` or +`PublicationPRReceiptV1`/append wrapper after revalidation. The tool never runs a file from the +bundle and cannot represent a token, remote credential URL, Authorization header, or Git credential +configuration. + +The only nonsecret runtime identity inputs are the fixed GitHub variables `GITHUB_REPOSITORY_ID`, +`GITHUB_RUN_ID`, `GITHUB_RUN_ATTEMPT`, `GITHUB_JOB`, and `GITHUB_SHA`. Before pushing, the tool +uses those numeric values only in the signed OIDC caller request. The external broker re-fetches the +current job/deployment/approval, validates the registered App installation and exact operation row, +and binds those identities into safe receipts. It rejects a mismatched approval, actor, +installation, authority parent, intent, predecessor receipt, phase, permission, or endpoint before +mint. Tests prove private-key/token/header canaries never enter Actions at all. + +- [ ] **Step 5: Add idempotent safe recovery** + +Reconstruct the authoritative next prefix before every broker call. A missing branch selects only +the `branch_create` row; after its exact signed delivery resolution and branch receipt win the +expected-OID authority CAS, a later invocation may select only `merge_eligibility`; only after that +receipt wins may a still later invocation select `pull_request_create`. An exact branch without a PR +therefore cannot skip the eligibility prefix or make a direct Actions-side PR request. If the exact +open PR already exists, the external broker performs no write and adopts it only when base, head, +title, body digest, author, plan, and bundle are identical. A lost/conflicting PR-create response is +resolved solely by the broker's signed authenticated final observations; Actions never retries or +issues the POST itself. + +Every invocation selects one exact operation row, uses a fresh closed token lifecycle, and emits a +new effect-specific receipt for the current run/job/deployment with `created` or `adopted`; it never +claims byte identity with a receipt from a different caller. The state broker accepts exactly one +fully reverified receipt before the next effect. If canonical authority already binds one, +re-fetch/reverify it and make the invocation a no-op; a stale expected-OID CAS loser makes no further +publisher-broker call. Entering `terminalizing`, `terminal_reconciling`, or `sealed` forbids every +remaining constructive call. Any object mismatch raises `publication_collision`; no force push, +edit, close, approve, merge, label, or review endpoint is called. Test recovery under a new +run/job/approval identity, response loss at every operation, and every effect/receipt CAS crash +window. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_publication_delivery_resolution.py tests/campaign/test_publisher_credential_finality.py tests/campaign/test_publisher_broker.py tests/campaign/test_minimal_publisher.py tests/campaign/test_publication_plan.py -q` + +Expected: PASS. + +- [ ] **Step 7: Commit the minimal publisher** + +```bash +git add tools/benchmark_minimal_publisher.py \ + tools/benchmark_publisher_broker_client.py \ + src/laconian_eval/campaign/publisher_broker.py \ + src/laconian_eval/campaign/publication.py \ + tests/campaign/test_publication_delivery_resolution.py \ + tests/campaign/test_publisher_credential_finality.py \ + tests/campaign/test_minimal_publisher.py \ + tests/campaign/test_publisher_broker.py +git commit -m "feat: publish sealed benchmark bundles minimally" +``` + +### Task 10: Add the protected publication workflow and trusted PR validation + +**Files:** +- Create: `.github/workflows/benchmark-publish.yml` +- Create: `.github/workflows/publication-pr-validate.yml` +- Modify: `.github/workflows/benchmark-publication-state.yml` +- Modify: `src/laconian_eval/campaign/release.py` +- Modify: `src/laconian_eval/campaign/release_broker.py` +- Modify: `tools/benchmark_release_broker_client.py` +- Modify: `tests/campaign/test_release_broker.py` +- Modify: `tests/campaign/test_security_attestor_credential_finality.py` +- Create: `tests/campaign/test_publication_terminal_containment.py` +- Create: `tests/campaign/test_publication_merge_queue.py` +- Create: `tests/campaign/test_publication_merge_fence.py` +- Create: `tools/validate_publication_pr.py` +- Create: `tests/campaign/test_publication_pr.py` +- Modify: `tests/campaign/test_publication_workflows.py` +- Modify: `tools/benchmark_minimal_publisher.py` +- Modify: `src/laconian_eval/campaign/publisher_broker.py` +- Modify: `tests/campaign/test_minimal_publisher.py` +- Modify: `tests/campaign/test_publisher_broker.py` +- Modify: `src/laconian_eval/campaign/publication.py` +- Modify: `src/laconian_eval/campaign/__init__.py` +- Modify: `benchmarks/runbooks/public-benchmark.md` +- Modify: `tests/test_public_contract.py` +- Modify: `tests/test_ci_contract.py` + +- [ ] **Step 1: Write failing workflow-boundary tests** + +Import the six Runtime-owned state-bound wire primitives from +`laconian_eval.campaign.publication_wire` and assert package/object identity before defining any +Task 10 evidence schema. Publication must not define, subclass, alias, or re-export +`PublicationMergeDenylistEntryV1`, `PublicationMergeDenylistV1`, +`PublicationTerminalContainmentPreflightV1`, `PublicationPreContainmentTerminalRouteV1`, +`PublicationTerminalContainmentIntentV1`, or `PublicationTerminalContainmentFinalityV1`. + +Require `benchmark-publish.yml` to have a read-only `prepare-publication` job and exactly two +mutually exclusive `benchmark-publish` environment effect jobs named `publisher_effect` and +`publication_terminalizer`. Each has exactly +`id-token: write` plus `actions: read`, `deployments: read`, `contents: read`, and +`pull-requests: read`; only the latter four are repository-token scopes. It contains only the fixed +OIDC bootstrap, bounded numeric artifact downloader, and repository-owned publisher-broker client. +It maps no App/installation ID as a credential input and no private key, token, or opaque handle. +`${{ github.token }}` is exposed only as `GITHUB_READ_TOKEN` for the bounded +numeric artifact GET and is unset before the broker request. There is no write-capable +`GITHUB_TOKEN`, checkout/setup/artifact/third-party action, local GitHub write, or secret in the +environment. Forbid `OPENAI_API_KEY`, App secret names, approval/merge commands, `gh pr review`, +`gh pr merge`, force push, mutable refs, and any App-auth Authorization header created by Actions +code. The bounded repository-read client may create only the `GITHUB_READ_TOKEN` header for its +allowlisted numeric API GET and must strip it before the signed redirect fetch and every broker call. +Only `publisher_effect` may select the three constructive policy rows, and only from an exact +plan-bound protected-main prefix. Only `publication_terminalizer` may select containment start, +terminal guard/close/barrier/dequeue/fence/reconciliation rows, and its OIDC job name is repeated +byte-for-byte by `PUBLICATION_TERMINAL_CONTAINMENT_STARTED.source_job`. A workflow mode, package, or +rerun cannot move a row between the two callers; only one effect job is eligible for a reconstructed +authority prefix. + +The same `.github/workflows/benchmark-publish.yml` also has the separately protected +`security_attestor` job. It runs only at the exact allowed main/ref/plan in the +`benchmark-publish` environment, declares exactly `id-token: write` and no repository-token scope, +requests OIDC only with audience `laconian-security-attestor-broker` for its closed job identity, and receives from the +external broker only signed safe attestation receipts for one short-lived token scoped to the +existing release-finalizer App installation with returned permissions exactly +`administration:write`, `contents:read`, and `metadata:read`. The external measured broker mints, +vaults, performs the fixed GET allowlist, closes the token, and returns no token/header/handle. The +job contains only OIDC bootstrap and the fixed broker client; no App key, contents/Release write +token, repository-token substitute, publisher/state credential, provider key, model/artifact bytes, +or direct GitHub settings reader enters the job. Release-writer tokens omit Administration +permission. + +Runtime Task 9 has already created the canonical security-attestor records in `release.py`, the safe +verifier and `preflight_rulesets` policy row in `release_broker.py`, and the secret-free OIDC client +plus fake-broker tests. Task 10 imports those exact class objects and extends only the same files and +tests with `postmerge_rule_suite`; it must not redefine, subclass, alias, or re-export the records. +Task 11 then adds only `release_preparation` and the release-finalizer operation policy. This ordering +makes every workflow caller independently GREEN without changing a previously frozen C0 workflow. + +- [ ] Extend the Task 9 publisher and tests with exactly two package-discriminated modes: + `open_exact_pr` and `close_exact_pr`. Close mode requires `PublicationClosePlanV1`, re-fetches the + exact open PR/head/receipt/invalidation, calls only the close endpoint, and emits + `PublicationCloseReceiptV1`; it cannot open/edit/review/approve/merge/delete a branch. Both modes + require the same publisher App identity and protected job. + +Freeze the external publisher broker's terminal rows exactly as normative §7.4: +`terminal_guard_discovery` (`contents:read,metadata:read,pull_requests:read`), `terminal_guard` +(`checks:write,metadata:read`), `pull_request_close` +(`metadata:read,pull_requests:write`), `terminal_merge_barrier_read` +(`actions:read,checks:read,contents:read,merge_queues:read,metadata:read,pull_requests:read`), +`terminal_merge_barrier_dequeue` (`merge_queues:write,metadata:read`), +`terminal_merge_fence_rerun` (`actions:write,metadata:read`), and the post-write +`terminal_reconciliation_read` (`checks:read,contents:read,metadata:read,pull_requests:read`). Each +row carries only its exact REST/GraphQL documents and endpoint templates, plus token mint/delete/ +denial-probe. Entering `terminalizing` disables every constructive mint; entering +`terminal_reconciling` disables every write mint; `sealed` denies all later mint. Tests prove one +fresh token lifecycle per operation, no union/superset scope, complete signed request/transport/ +closure evidence, and zero token/header/handle bytes in Actions. The +`terminal_merge_barrier_read` row alone has two closed authorization arms: before +`PUBLICATION_TERMINAL_CONTAINMENT_STARTED`, it may mint only the explicitly source-bound read-only +preflight credential needed to construct the containment intent; after the accepted tombstone CAS, +it may mint only intent/CAS-bound post-action reads. Every other containment credential, including +guard discovery, guard create/update, PR close, dequeue, and rerun, may mint only after that CAS; +no write-capable row has a pre-CAS arm. Tests reject a source substitution in preflight, an +intent/CAS substitution after start, and every pre-CAS guard, close, dequeue, or rerun request. + +Require the workflow's top-level concurrency group to be exactly +`laconian-public-benchmark-state` with `cancel-in-progress: false`. The receipt must bind the +numeric publish job, deployment, and approval actor parsed through the Task 1 GitHub records before +the bundle-kind-specific publication-PR-open event is applied. + +Require `publication-pr-validate.yml` to run the stable job `publication-pr-validate` on every +`pull_request` type `opened`, `synchronize`, `reopened`, and `closed`, without a +top-level path filter; on `pull_request_review` type `submitted|dismissed`; and on +`merge_group: [checks_requested]`, with read-only permissions and no secrets. Pull-request/review +events resolve the exact current PR/head; merge-group events authenticate the one-entry MERGE queue +inventory and publish the same required context on the event's merge-group SHA. It executes +`tools/validate_publication_pr.py` from the exact protected base checkout, never candidate code. An +unrelated diff returns a successful explicit no-op so the globally required check is never left +Pending. Its job declares exactly `contents: read` and `pull-requests: read`. Tests reject a missing +`merge_group` trigger, a context emitted only on the PR head, a multi-entry/non-MERGE group, or +candidate-code checkout. + +Require `benchmark-publication-state.yml` to use the shared concurrency group and trusted-base code +on the same PR events plus no-input `workflow_dispatch`. It no-ops unrelated PRs. A read-only inspect +job declares exactly `contents: read`, `actions: read`, `pull-requests: read`, and `checks: read` and +reconstructs the exact publication receipt from the canonical authority ref; a narrow state mutation +calls the existing OIDC reusable job created by Runtime Task 9. That job contains only OIDC bootstrap +and the fixed broker client; no state-writer credential or installation token is mapped into Actions. +When an exact still-open plan is invalidated, this workflow +emits only a safe close-required summary. The same no-input `benchmark-publish.yml` and same +protected `publication_terminalizer` job/tool later enters its receipt-bound `close_exact_pr` mode; +`publisher_effect` cannot select close or any other terminal row, and there is no third +write-capable publisher job. No job reviews, approves, merges, force-pushes, edits, or deletes result +content. +Forks, human-authored PRs, and non-result diffs can execute only the read-only no-op path; policy +tests inspect job conditions and exact head repository/actor/receipt bindings before any write token +is available. + +For every manual publication path, require exact `refs/heads/main` at the plan-bound main SHA, +re-read the caller and reusable workflow blobs at that SHA, and derive the campaign/authority only +from the accepted intent/receipt. Reject an input tag, another branch, mutable selector, +newest/by-name discovery, operator campaign/PR/head/base input, or a main SHA not bound by the plan. +The only exceptions to plan-bound main are the literal generated caller rows: the six existing +post-merge admission/invalidation events; `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` and its +phase-exact terminal consumers; drift containment; credential-exposure pending/progress/final/ +supplement; and safe-invalid continuation. All retain OIDC `ref=refs/heads/main`, fresh double +reads, byte-identical C0 workflow members, independently verified Git/GitHub objects, and the exact +active containment/denylist roots. Containment is not a seventh generic post-merge exception: its +start is a same-state expected-OID CAS for an active publication prefix, and only the intent-named +terminal event may clear it. + +- [ ] **Step 2: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_terminal_containment.py tests/campaign/test_publication_merge_queue.py tests/campaign/test_publication_merge_fence.py tests/campaign/test_security_attestor_credential_finality.py tests/campaign/test_publication_workflows.py tests/campaign/test_publication_pr.py tests/test_ci_contract.py -q` + +Expected: FAIL because the two new workflows, publication/admission recorders, and required caller +rows in the existing reusable workflow are absent. + +- [ ] **Step 3: Implement the publication workflow** + +`prepare-publication` reconstructs current authority. On the initial path it proves +`BUNDLE_COLLECTED` or `INVALID_FINALIZED`, downloads the exact bundle, and builds +`PublicationPlanV1`. On the correction path it proves terminal `RELEASED|RELEASE_BLOCKED` plus the +reviewed protected-main defect record/merge and a resumable `CorrectionProgressV1` planning stage; +it does not request or expect a `correction_defect` state event. It runs the Task 8 correction-bundle producer, uploads that +bundle, re-fetches its numeric locator, and only then builds the correction plan. When the exact +current publication plan is invalid while its PR remains open, it instead builds a closed +`PublicationClosePlanV1` binding only that receipt/PR/head and the already-derived invalidation. + It packages the selected plan, bundle when opening, exact publisher script, and secret-free + publisher-broker client, +uploads with 90-day retention, and exports artifact ID, service digest, payload digest, and plan +digest. No workflow/operator input selects the mode. + +The mutually exclusive gated `publisher_effect` and `publication_terminalizer` jobs each use the +same frozen shell block to download the package by numeric artifact ID, hash the raw ZIP, extract and +hash the fixed publisher script and broker client with `unzip -p`, and execute them with only their +verified exact OIDC job identity. The external broker alone owns the publisher App credential and +performs the selected operation. `publisher_effect` open mode emits only the ordered branch, +eligibility, and PR receipts from Task 9; `publication_terminalizer` close mode may only +close the one exact open PR and emits `PublicationCloseReceiptV1`, never edits branch/content. A +following read-only `record-publication` job re-fetches the PR by number/head and validates the +receipt. Initial publication creates `COMPLETE_PUBLICATION_PR_OPENED` or +`INVALID_PUBLICATION_PR_OPENED`; correction publication appends +`CORRECTION_PUBLICATION_RECORDED`; initial +close applies the matching publication-plan invalidation only after the close receipt verifies; +correction close appends +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=unmerged_invalid)`, which terminates that correction ID without advancing the +latest pointer. Every receipt/event uses the external OIDC broker against the exact expected +authority OID; no state-writer credential reaches Actions. +`record-publication` treats a PR opened/closed without a durable receipt as a recoverable exact-plan +lookup, never as permission to create another branch or target another PR. + +Do not add a public campaign CLI. Fixed trusted-base validator/recorder tools use trusted API records +and canonical authority; none accepts a PR number, branch, head, base, event type, artifact selector, +campaign, correction ID, or effect mode from an operator. They construct only the exact +authority-selected receipt/event and hand it to the reusable OIDC broker job. Public contract tests +keep exactly seven offline replay commands and reject a live/public shared writer. + +- [ ] **Step 4: Implement trusted-base PR validation** + +Add: + +```python +class PublicationClosePlanV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + publication_attempt: StrictPositiveInt + correction_lineage_sha256: Sha256 | None + publication_plan_sha256: Sha256 + publication_receipt_sha256: Sha256 + pull_request_number: StrictPositiveInt + exact_head_sha: GitObjectId + invalidation_sha256: Sha256 + expected_authority_ref_oid: GitObjectId + close_plan_sha256: Sha256 + + +class PublicationCloseReceiptV1(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + close_plan_sha256: Sha256 + publication_attempt: StrictPositiveInt + pull_request_number: StrictPositiveInt + exact_head_sha: GitObjectId + closed_at_utc: CanonicalTimestamp + publisher_app: GitHubAppInstallationIdentityV1 + closed_by: BoundedNonBlankString + receipt_sha256: Sha256 + + +class PublicationPRValidationV1(CapsuleModel): + schema_version: Literal["1"] + kind: Literal["result", "correction_defect", "irrelevant"] + publication_receipt_sha256: Sha256 | None + correction_defect_record_sha256: Sha256 | None + validation_sha256: Sha256 + + +def validate_publication_pull_request( + *, + trusted_repository: Path, + candidate_repository: Path, + event: Mapping[str, object], +) -> PublicationPRValidationV1: +``` + +For a result PR, require base `main`, author equal to the exact registered publisher App bot login, +the bound branch, exact base/head SHA, no merge +conflict, current-base equality, plan and bundle digest, exact result-path-only diff, no symlink, +submodule, executable bit, workflow change, or extra file. Recompute the bundle projection and +proposed tree/head using trusted-base code. Emit a canonical safe summary containing only campaign, +plan, bundle, base, and head digests. +Before returning success on either the PR head or its one-entry `merge_group` SHA, reconstruct the +exact active campaign authority from the registry-bound authority ref, never from event-selected +state. Class-bound verify the current publication intent/attempt/branch/head/plan and current +`publication_merge_denylist_root_sha256`, load every referenced +`PublicationMergeDenylistEntryV1`, and require this candidate absent. Also require the exact +intent-bound publisher eligibility receipt/check to be current and passing. A matching terminal- +guard receipt/check, active `PublicationTerminalContainmentIntentV1`, denylist tombstone, missing or +wrong eligibility evidence, stale authority OID, or guard/eligibility source-App/workflow mismatch +forces failure; reopening or re-enqueueing cannot revive it. On `merge_group`, authenticate its sole +queue entry back to the same PR/head and repeat the authority/denylist/guard reads before publishing +the validator context on the temporary group SHA. Tests cover PR-head and merge-group denial for a +denylisted head, active containment, missing/wrong eligibility, matching terminal guard, stale +authority, and a late tombstone between PR success and queue validation. The explicit no-op is legal +only after trusted-base classification proves a truly unrelated diff with no result/correction +branch, marker, path, plan, or authority identity. +For the `publication-pr-validate` required check to succeed, also re-fetch one current APPROVED +review at the exact head from a preregistered non-bot maintainer numeric ID/login, require its exact +review ID/API-record digest, and reject dismissal/staleness. Before that review the result validator +fails closed; its `pull_request_review submitted|dismissed` trigger reruns the same check. Thus a +publisher-App review cannot satisfy the gate even though `pull_requests:write` is technically broad +enough to call review/merge endpoints. + +For a correction-defect PR, require a non-bot human author, exactly the next fixed defect path and +no other diff, strict `CorrectionDefectRecordV1`, current latest-pointer binding, a current distinct +human approval, and no result/workflow/docs changes. On its exact merged event, +`benchmark-publication-state.yml` revalidates merge ancestry/tree but does not append authority. +The reviewed defect record and immutable merge evidence are external verified inputs to the single +first authority write, `CORRECTION_INTENT_AUTHORIZED`, whose `intent.json` embeds and binds them. +No pre-intent defect-record path, mutation, event, or authority commit exists; add a negative test +for that absence. Unrelated PRs return the explicit `irrelevant` result. + +Define strict `RequiredCheckEvidenceV1` for each required check with check-run ID/name, +`status == "completed"`, conclusion, head SHA, check-suite ID/event, source App numeric ID/slug, +workflow run ID/attempt, trusted workflow path/SHA-256, and evidence digest. Re-fetch check run, +suite, and Actions run by exact IDs; require the preregistered GitHub Actions source App and trusted +base workflow bytes. A same-name check from another App/workflow, a rerequested/in-progress suite, +or a run on another SHA fails even if its conclusion says success. + +Define `PublicationMergeReceiptV1` with the exact approved compact wire: `schema_version`, common +campaign/repository identity and initial/correction XOR identity, `authority_parent_oid`, +`publication_plan_sha256`, `publication_receipt_kind`, nullable +`publication_pr_receipt_sha256`, PR number/node ID/URL, observed merge/head/base OIDs, nested exact +`PostMergeAdmissionEvidenceV1` plus its digest, duplicated publication-success-finality root, +`recorded_at`, and `publication_merge_receipt_sha256`. Every duplicate byte-equals the nested +evidence and `recorded_at` equals its latest sealed time. The nested admission subject/evidence, +queue inventory/timeline, and success-finality records prove the authenticated one-entry MERGE +queue, exact `M` parents/tree, human actors, and required merge-group checks. Direct, squash, +rebase, jump/solo, missing-group, multi-entry-group, and queue-identity aliases are rejected; +`merge_method="merge_commit"` describes the protected queue's Git commit shape, not permission for a +direct merge. No checkpoint or aggregate-release object is part of this receipt. + +The broker constructs `PostMergeAdmissionEvidenceV1` independently from exact GitHub API responses +and Git object bytes, never from event input. It proves the PR is merged, `M` is the PR's immutable +merge commit, its parents/tree exactly match the plan, all checks and current approvals bind the +approved head, the human actor/method are allowed, and historical protection was enforced. The +downscoped `security_attestor` job presents only its exact OIDC identity and receives signed safe +pass/failure evidence. The external broker alone mints, vaults, uses, and closes a short-lived token +from the existing release-finalizer App installation with `administration:write`, `contents:read`, +and `metadata:read`; it fetches and seals the complete repository rule-suite +record whose `before_sha=base_oid`, `after_sha=M`, `ref=refs/heads/main`, actor equals the merge +actor, overall result is `pass` rather than `bypass`, and every active per-rule evaluation matches +the plan-bound ruleset. Reading only current rules is insufficient. + +For a post-merge dispatch, OIDC remains on `refs/heads/main` at current main `H`. Require `H == M` or +a protected first-parent descendant that contains `M`, keeps the plan-bound result subtree +byte-identical, and has no intervening commit touching that subtree. Re-read main before and after +all other observations and re-evaluate containment. The caller and reusable workflow blobs at `H` +must still equal their C0 inventory members. Missing, contradictory, bypassed, late-missing, or +moving evidence fails closed. + +Implement `PostMergeAdmissionFailureV1` from the exact ordered 53-field contract and the +`POSTMERGE_FAILURE_KINDS`/`POSTMERGE_FAILED_PREDICATES` tuples in the mandatory overlay. In +addition to the immutable plan/PR/merge/rule/request observations, it carries the strict +`PostMergeAdmissionSubjectV1` plus pass/failure security-attestor evidence, the source-kind- +discriminated containment finality, successor denylist and before/after active roots, selected +merged candidate, complete publisher credential disposition, reconciliation-unavailable receipt, +signed empty release-authorization ledger where applicable, exact PR terminal disposition, class- +bound drift/exposure evidence, no-later root where constructible, and its digest. The five failure +kinds are exhaustive; fields from another kind/source/phase are forbidden. + +The six existing post-merge admission/invalidation event shapes are: + +```text +RESULT_MERGED +INVALID_PREFIX_MERGED +CORRECTION_MERGE_RECORDED +RESULT_MERGE_INVALIDATED +INVALID_PREFIX_MERGE_INVALIDATED +CORRECTION_INVALIDATED(kind=correction_publication_invalidation, publication_outcome=merged_invalid) +``` + +The first three require `PostMergeAdmissionEvidenceV1`; the last three require +`PostMergeAdmissionFailureV1`. The sixth additionally requires the exact active correction +`intent.json` or `publication-receipt.json`, no valid merge/later receipt, matching correction +phase/plan/PR roots, and proof of no tag/Release/asset/latest/docs/social effects. It can authorize +only terminal `merged_invalid`; it cannot authorize unmerged invalidation, a merge receipt, or any +release phase. `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` is the additional protected-current-main +same-state row described in the overlay, not a seventh post-merge admission result. All other main +events remain pinned to their pre-bound main SHA. + +If exposure begins while a complete publication PR is open or after its merge effect but before the +authority CAS, the only complete-path event is `RESULT_MERGE_INVALIDATED` with +`failure_kind=credential_exposure_race` and the terminal exposure projection. That CAS binds the +observed merge, atomically clears the active incident/pending pair, consumes the matching hold if +present, and enters `RELEASE_BLOCKED`; ordinary admission failures forbid the projection and require +the pair null. Add crash/replay tests for exposure before merge, after merge before CAS, and after +reconstruction, including hidden/mismatched holds. + +Only successful complete admission from `COMPLETE_PUBLICATION_PR_OPEN` emits `RESULT_MERGED` and +enters `RESULT_MERGED`. Successful invalid admission from `INVALID_PUBLICATION_PR_OPEN` emits +`INVALID_PREFIX_MERGED` and enters terminal `INVALID_PREFIX_MERGED`. Failed complete admission emits +`RESULT_MERGE_INVALIDATED` and enters `RELEASE_BLOCKED`; failed invalid admission emits +`INVALID_PREFIX_MERGE_INVALIDATED` and enters terminal `INVALID_PREFIX_MERGED_INVALID`. Cross-kind, +generic, absent-discriminator, or wrong-parent events create a hold without state mutation. + +Define only the approved terminal unions. `InitialPublicationInvalidationV1` covers initial +complete/invalid premerge failure and release-plan failure; `InitialPublicationFinalizationV1` +covers the corresponding successful terminal records. `CorrectionInvalidationV1` covers exactly +`unmerged_invalid`, `merged_invalid`, `fenced_write_ambiguity`, and +`reconciliation_unavailable`. Every member uses its literal schema version, terminal kind, +publication attempt or correction ID, active authority phase, exact intent/receipt parent, and the +approved field order. Cross-kind optional bags and a generic `PublicationInvalidationV1` are +rejected. + +Every active publication prefix first takes `PUBLICATION_TERMINAL_CONTAINMENT_STARTED`; its terminal +record then embeds the matching `PublicationTerminalContainmentFinalityV1`, before/after active +roots, successor denylist, and exactly one of ordinary PR disposition, fenced-write ambiguity, +reconciliation-unavailable, post-merge failure, or release-plan invalidation evidence. Ordinary +premerge `no_pr|closed` carries `PublicationNoLaterEffectsEvidenceV1`; unavailable and fenced forms +must leave that root null. An already merged or reopened PR uses the merge-won form and cannot be +recast as a premerge close. + +An exact unchanged branch with no PR remains the recovery case and cannot be invalidated merely to +skip recovery. Tests crash after branch-receipt CAS, move base/branch before PR creation, close then +reopen/merge, lose every write response, and exhaust authenticated pagination. They require the +phase-exact terminal record to be the sole liveness exit for both bundle kinds and corrections; +phase substitution, hidden discovered objects, fabricated absence, a missing terminal guard, +nonmonotone denylist, or an uncleared/mismatched containment root fails before the terminal CAS. + +Successful correction admission appends `CORRECTION_MERGE_RECORDED`; an absent/closed unmerged PR +uses `CorrectionInvalidationV1(publication_outcome="unmerged_invalid")`; a merge that wins ordinary +terminalization uses `merged_invalid`; an unorderable publisher write uses +`fenced_write_ambiguity`; and failed stable reconciliation uses `reconciliation_unavailable`. +None advances the latest pointer. Replanning initial publication starts from `BUNDLE_COLLECTED` or +`INVALID_FINALIZED` with the next authority-derived attempt and a new immutable branch/head/plan; +it never updates or force-pushes the invalid branch. End-to-end tests cover both bundle kinds, main +movement before and after opening, unchanged base/bundle after invalidation, every terminal outcome, +and stale-CAS adoption; each accepted terminal record advances the attempt exactly once. + +- [ ] **Step 5: Add manual approval evidence to the runbook test** + +Assert the workflow and runbook state that the publisher-App-authored same-repository PR triggers +the always-present validators normally; it does not depend on the repository-global Actions +create/approve-PR toggle or a fork-workflow approval. A write-authorized maintainer verifies the +exact head/bundle, supplies the required human PR review, and only after required checks enqueues the +exact PR into the one-entry `MERGE` queue. The resulting merge is accepted only from authenticated +merge-group/queue evidence; direct, squash, and rebase merge are forbidden. Neither the publisher +App nor any workflow approves a review, enqueues, or merges the PR. + +The runbook also gives the exact no-input recovery dispatch, merge-recorder, close/replan, and stale +CAS procedures. It forbids manually supplied PR/head/base IDs and states that complete release +planning is blocked until `PublicationMergeReceiptV1` has advanced canonical authority to +`RESULT_MERGED`; invalid-prefix outcomes are terminal and have no release plan. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_publication_terminal_containment.py tests/campaign/test_publication_merge_queue.py tests/campaign/test_publication_merge_fence.py tests/campaign/test_security_attestor_credential_finality.py tests/campaign/test_publication_workflows.py tests/campaign/test_publication_pr.py tests/campaign/test_publisher_broker.py tests/campaign/test_release_broker.py tests/campaign/test_minimal_publisher.py tests/test_ci_contract.py tests/test_public_contract.py -q` + +Expected: PASS. + +At this checkpoint `tests/test_ci_contract.py` enumerates exactly thirteen workflows: the eleven +present after Task 7 plus the two new workflows in this task; the Runtime-owned reusable workflow is +modified, not counted twice. + +- [ ] **Step 7: Commit protected publication and PR validation** + +```bash +git add .github/workflows/benchmark-publish.yml \ + .github/workflows/publication-pr-validate.yml \ + .github/workflows/benchmark-publication-state.yml \ + src/laconian_eval/campaign/release.py \ + src/laconian_eval/campaign/release_broker.py \ + tools/validate_publication_pr.py \ + tools/benchmark_minimal_publisher.py \ + tools/benchmark_release_broker_client.py \ + src/laconian_eval/campaign/publication.py \ + src/laconian_eval/campaign/publisher_broker.py \ + src/laconian_eval/campaign/__init__.py \ + tests/campaign/test_minimal_publisher.py \ + tests/campaign/test_publisher_broker.py \ + tests/campaign/test_release_broker.py \ + tests/campaign/test_publication_terminal_containment.py \ + tests/campaign/test_publication_merge_queue.py \ + tests/campaign/test_publication_merge_fence.py \ + tests/campaign/test_security_attestor_credential_finality.py \ + tests/campaign/test_publication_pr.py \ + tests/campaign/test_publication_workflows.py \ + benchmarks/runbooks/public-benchmark.md \ + tests/test_ci_contract.py \ + tests/test_public_contract.py +git commit -m "ci: gate exact benchmark publication pull requests" +``` + +### Task 11: Build the preauthorized, attested, executable release graph and idempotent finalizer + +**Files:** +- Modify: `src/laconian_eval/campaign/release.py` +- Modify: `src/laconian_eval/campaign/release_broker.py` +- Create: `tools/benchmark_release_finalizer.py` +- Modify: `tools/benchmark_release_broker_client.py` +- Create: `tools/benchmark_release_inventory_monitor.py` +- Create: `ops/benchmark-release-inventory-monitor.toml` +- Create: `docs/runbooks/benchmark-release-inventory-monitor.md` +- Create: `tests/campaign/test_result_release.py` +- Modify: `tests/campaign/test_release_broker.py` +- Modify: `tests/campaign/test_security_attestor_credential_finality.py` +- Create: `tests/campaign/test_release_authorization_graph.py` +- Create: `tests/campaign/test_release_finalizer_credential_finality.py` +- Create: `tests/campaign/test_reconciliation_unavailable.py` +- Create: `tests/campaign/test_release_inventory_monitor.py` +- Modify: `src/laconian_eval/campaign/__init__.py` +- Modify: `tests/test_public_contract.py` + +- [ ] **Step 1: Write the failing merged-result plan test** + +Create an approved publication PR fixture, merge it, and build two fixed assets: +`benchmark-result-{publication_id}.tar` and `benchmark-result-{publication_id}.tar.sha256`. Assert the +merge tree contains the exact result path and the release plan binds every digest. + +The following predecessor sketch is a RED-only rejection fixture. Do not implement or export any +of these shapes; `test_release_authorization_graph.py` parses representative payloads and requires +strict rejection before credentials or external reads: + +```python +class ReleaseAssetV1(CapsuleModel): + name: BoundedNonBlankString + media_type: Literal["application/x-tar", "text/plain"] + byte_length: StrictNonNegativeInt + sha256: Sha256 + + +class RejectedSecurityAttestorTokenRequestFixture(CapsuleModel): + broker_request_id: BoundedNonBlankString + oidc_identity: GitHubOidcRunIdentityV1 + app_id: StrictPositiveInt + installation_id: StrictPositiveInt + repository_id: StrictPositiveInt + requested_permissions: tuple[ + Literal["administration:write"], Literal["contents:read"], Literal["metadata:read"] + ] + safe_broker_response_sha256: Sha256 + token_expires_at_utc: CanonicalTimestamp + token_request_sha256: Sha256 + + +class SecurityAttestorRepositoryObservationV1(CapsuleModel): + repository_id: StrictPositiveInt + repository_full_name: BoundedNonBlankString + default_branch: Literal["main"] + private: StrictBool + request_sha256: Sha256 + response_status: Literal[200] + raw_response_sha256: Sha256 + canonical_projection_sha256: Sha256 + observation_sha256: Sha256 + + +class SecurityAttestorResultTagRulesetObservationV1(CapsuleModel): + creation_ruleset_id: StrictPositiveInt + immutability_ruleset_id: StrictPositiveInt + result_tag_patterns: tuple[BoundedNonBlankString, ...] + creation_ruleset_policy_sha256: Sha256 + immutability_ruleset_policy_sha256: Sha256 + creation_bypass_actor: GitHubAppInstallationIdentityV1 + creation_bypass_actors_root_sha256: Sha256 + immutability_bypass_actors: tuple[()] + tag_ruleset_policy_root_sha256: Sha256 + request_sha256: Sha256 + response_status: Literal[200] + raw_response_sha256: Sha256 + canonical_projection_sha256: Sha256 + observation_sha256: Sha256 + + +class SecurityAttestorImmutableReleaseObservationV1(CapsuleModel): + repository_id: StrictPositiveInt + immutable_releases_enabled: Literal[True] + request_sha256: Sha256 + response_status: Literal[200] + raw_response_sha256: Sha256 + canonical_projection_sha256: Sha256 + observation_sha256: Sha256 + + +class InitialSecurityAttestorLineageV1(CapsuleModel): + kind: Literal["initial"] + publication_plan_sha256: Sha256 + publication_merge_receipt_sha256: Sha256 + merge_commit_oid: GitObjectId + result_tree_oid: GitObjectId + authorized_tag_target_oid: GitObjectId + lineage_sha256: Sha256 + + +class CorrectionSecurityAttestorLineageV1(CapsuleModel): + kind: Literal["correction"] + correction_id: BoundedNonBlankString + correction_intent_sha256: Sha256 + correction_merge_receipt_sha256: Sha256 + nested_publication_merge_receipt_sha256: Sha256 + merge_commit_oid: GitObjectId + result_tree_oid: GitObjectId + authorized_tag_target_oid: GitObjectId + lineage_sha256: Sha256 + + +SecurityAttestorLineageV1 = Annotated[ + InitialSecurityAttestorLineageV1 | CorrectionSecurityAttestorLineageV1, + Field(discriminator="kind"), +] + + +class SecurityAttestorReceiptV1(CapsuleModel): + schema_version: Literal["SecurityAttestorReceiptV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + job_id: StrictPositiveInt + job_name: Literal["security_attestor"] + check_run_id: StrictPositiveInt + deployment_id: StrictPositiveInt + environment: Literal["benchmark-publish"] + approval_actor_id: StrictPositiveInt + approval_actor_login: BoundedNonBlankString + job_api_observation_root_sha256: Sha256 + deployment_api_observation_root_sha256: Sha256 + approval_api_observation_root_sha256: Sha256 + lineage: SecurityAttestorLineageV1 + token_request: RejectedSecurityAttestorTokenRequestFixture + returned_permissions: tuple[ + Literal["administration:write"], Literal["contents:read"], Literal["metadata:read"] + ] + repository_observation: SecurityAttestorRepositoryObservationV1 + result_tag_ruleset_observation: SecurityAttestorResultTagRulesetObservationV1 + immutable_release_setting_observation: SecurityAttestorImmutableReleaseObservationV1 + observed_at_utc: CanonicalTimestamp + receipt_sha256: Sha256 + + +class RejectedResultReleasePlanFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + publication_id: BoundedNonBlankString + correction_lineage_sha256: Sha256 | None + input_tag_object_sha: GitObjectId + input_commit_sha: GitObjectId + campaign_registry_sha256: Sha256 + protocol_attestation_tag_binding_sha256: Sha256 + workflow_root: Sha256 + authority_state_sha256: Sha256 + unresolved_hold_root_sha256: Sha256 | None + active_credential_exposure_pending_root_sha256: Sha256 | None + bundle_kind: Literal["complete"] + bundle_sha256: Sha256 + audit_protocol_sha256: Sha256 + publication_plan_sha256: Sha256 + publication_merge_receipt_sha256: Sha256 + security_attestor_receipt: SecurityAttestorReceiptV1 + publication_pr_number: StrictPositiveInt + publication_approved_head_sha: GitObjectId + merge_commit_sha: GitObjectId + result_tree_sha256: Sha256 + tag_target_kind: Literal["initial_merge", "correction_approved_head"] + tag_target_sha: GitObjectId + result_tag_name: BoundedNonBlankString + tagger_name: Literal["Laconian Benchmark Release"] + tagger_email: Literal["benchmark-release@laconian.invalid"] + tagger_timestamp: CanonicalTimestamp + tag_message: BoundedNonBlankString + expected_tag_object_sha: GitObjectId + release_name: BoundedNonBlankString + release_body_sha256: Sha256 + require_immutable_release: Literal[True] + release_workflow_path: Literal[".github/workflows/benchmark-release.yml"] + release_workflow_sha256: Sha256 + assets: tuple[ReleaseAssetV1, ReleaseAssetV1] + plan_sha256: Sha256 +``` + +The initial tag is exactly `benchmark-result-{campaign_id}`. A correction tag is exactly +`benchmark-result-{campaign_id}-correction-{N}` where N is the monotonic correction attempt, and requires the matching +`CorrectionLineageV1.lineage_sha256`. For an initial plan, +`tag_target_kind="initial_merge"` and `tag_target_sha == merge_commit_sha`. For a correction, +`tag_target_kind="correction_approved_head"` and `tag_target_sha` equals the original correction +intent's preauthorized approved `head_oid`; actual `merge_commit_sha` remains mandatory lineage and +admission evidence and must have exact parents `[base_oid, head_oid]` and the expected tree. No +existing tag or release is updated, deleted, retargeted, or overwritten. Initial tagger timestamp is +derived only from the authenticated raw observed merge commit's committer header frozen in +`PublicationMergeReceiptV1`: parse exact epoch seconds and strict `[+-][0-9]{4}` offset, reject +overflow/nonintegral/duplicate committer headers, normalize to UTC, and require +`tagger_timestamp == merge_committer_timestamp_utc`. It is never derived from `merged_at`, workflow +clock, receipt observation time, caller input, locale, or host timezone. Correction tagger identity/timestamp is copied +byte-for-byte from `CorrectionReleaseIntentPlanV1`, where it was frozen prepublication. Normalize +the timestamp to Git's exact UTC `+0000` representation and construct the annotated-tag bytes with +the fixed name/email, exact `tag_target_sha`/type/tag, and one canonical LF-terminated message. Compute +`expected_tag_object_sha` with `git mktag` in a locale/timezone-independent environment before any +GitHub call. A rerun must reproduce the same object ID; a tagger clock, identity, message, or newline +override is forbidden. +Golden tests run with shifted wall clocks and distinct `TZ`/locale values and require identical +merge receipt, tagger timestamp, raw annotated-tag bytes/OID, asset USTAR mtimes, and release plan; +epoch/offset/raw-commit substitution fails. + +Implement the approved overlay instead: initial planning first emits receipt-free +`InitialPreauthorizedResultReleasePlanV1`; the release-preparation attestor then emits either +`SecurityAttestorReceiptV1(result="pass")` or `SecurityAttestorFailureEvidenceV1`; only a pass may +construct `ExecutableResultReleasePlanV1(intent_kind="initial")` and then +`ResultReleaseIntentV1`. Tests exercise both initial/correction target variants and reject +initial-target-as-head, correction-target-as-merge, wrong actual merge parents/tree, or any +disagreement among the preauthorized plan, executable plan, annotated-tag bytes/OID, +`TagReceiptV1.target_commit_sha`, and the authoritative intent. + +The preauthorized and executable plans' audit-protocol digest must exactly equal the Publication +plan, complete bundle, evidence inventory, and verified Runtime registry value. The sole source +remains Runtime Task 2's verified peeled-C0 +`benchmarks/protocols/public-three-model-v1/audit.json` digest under the Evaluation-owned +`audit_protocol_sha256: Sha256` contract; the finalizer accepts no separate input. + +Release planning is forbidden for `invalid_prefix`, `INVALID_PREFIX_MERGED`, and +`INVALID_PREFIX_MERGED_INVALID`; those states are terminal and authorize no tag, Release, asset, +correction, documentation, website, release note, or social promotion. + +- [ ] **Step 2: Add failing defect and collision tests** + +Reject a nonmerged/closed/unapproved PR, changed approved head, wrong merge tree, absent bundle, +post-merge provenance/security defect, moved `main`, tag name collision, tag pointing elsewhere, +release collision, missing/extra/changed asset, returned asset digest mismatch, and mutable update or +delete attempts. Verify a defect produces `RELEASE_PLAN_INVALIDATED` and `RELEASE_BLOCKED` through +the Slice 3 state interface before any tag API call when detected preflight. For a failure discovered +after an external call, require phase-accurate `BlockedReleaseObjectsV1` containing every observed +tag/draft/asset identity; never claim the objects are absent or released. +Vary source filesystem mtimes, owners, permissions, enumeration order, locale, timezone, and umask; +the asset tar and annotated-tag object must remain byte-identical. Add tag-object collision vectors +for every fixed header/message field. + +Add `RELEASED` and `RELEASE_BLOCKED` correction fixtures. Require a new append-only result directory, +merge, tag, release, assets, publication/release plans, and receipts whose lineage supersedes the +exact previous bundle/result/tag/release where present. Reject any attempt to reuse the original +result path/tag/release ID or omit the visible `supersedes` record. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_security_attestor_credential_finality.py tests/campaign/test_release_authorization_graph.py tests/campaign/test_release_finalizer_credential_finality.py tests/campaign/test_reconciliation_unavailable.py tests/campaign/test_result_release.py -q` + +Expected: FAIL because the release-plan builders, release-finalizer policy rows, and finalizer are +absent from the Task 10 security-attestor-only foundation. + +- [ ] **Step 4: Implement the three-stage release-plan construction** + +The following old one-stage signatures are negative fixtures and must not exist in production: + +```python +def build_result_release_plan( + *, + repository: Path, + authority: ReconstructedAuthorityV1, + publication_plan: PublicationPlanV1, + publication_receipt: PublicationPRReceiptV1, + publication_merge_receipt: PublicationMergeReceiptV1, + security_attestor_receipt: SecurityAttestorReceiptV1, + asset_root: Path, +) -> RejectedResultReleasePlanFixture: + +def build_result_release_intent( + *, + authority: ReconstructedAuthorityV1, + release_plan: RejectedResultReleasePlanFixture, +) -> ResultReleaseIntentV1: + +def build_correction_release_plan( + *, + repository: Path, + authority: ReconstructedAuthorityV1, + correction_intent: CorrectionIntentV1, + correction_publication_receipt: CorrectionPublicationReceiptV1, + correction_merge_receipt: CorrectionMergeReceiptV1, + security_attestor_receipt: SecurityAttestorReceiptV1, + correction_lineage: CorrectionLineageV1, + asset_root: Path, +) -> RejectedResultReleasePlanFixture: +``` + +Implement these exact production boundaries instead: + +```python +def build_initial_preauthorized_result_release_plan( + *, + repository: Path, + authority: ReconstructedAuthorityV1, + publication_plan: PublicationPlanV1, + publication_receipt: PublicationPRReceiptV1, + publication_merge_receipt: PublicationMergeReceiptV1, + asset_root: Path, +) -> InitialPreauthorizedResultReleasePlanV1: ... + + +def build_executable_result_release_plan( + *, + authority: ReconstructedAuthorityV1, + preauthorized_plan: InitialPreauthorizedResultReleasePlanV1 | CorrectionReleaseIntentPlanV1, + security_attestor_receipt: SecurityAttestorReceiptV1, + admitted_merge_receipt: PublicationMergeReceiptV1, +) -> ExecutableResultReleasePlanV1: ... + + +def build_result_release_intent( + *, + authority: ReconstructedAuthorityV1, + executable_release_plan: ExecutableResultReleasePlanV1, +) -> ResultReleaseIntentV1: ... +``` + +Neither release builder accepts a workflow path/hash scalar. Reconstruct the retained verified C0 +`CampaignInputPackageV1` from authority genesis and require its canonical package digest to equal +`authority.registry.payload.campaign_input_package_sha256`. Import/class-bound revalidate only +Evaluation's `WorkflowInventoryV1`, rebuild it from the exact retained C0 bytes, and require its root +to equal `authority.registry.payload.workflow_root`. Resolve only the literal +`.github/workflows/benchmark-release.yml` member, descriptor-read and re-hash its exact C0 bytes, +and bind the path and hash in the release plan. Reject path/hash substitution, a non-C0 or mutable- +`main` workflow, package-digest or inventory-root drift, or any CLI/workflow override. + +Require `authority.state.state == "RESULT_MERGED"`, call +`require_ordinary_effect_gate(authority)`, and require the +exact approved head, actual merge commit, +result tree, bundle, and `PublicationMergeReceiptV1` bound by the state transition, and +two asset bytes. Implement a separate release-owned `_write_result_release_ustar` in `release.py`; +do not call the capsule-specific Slice 1 `pack_checkpoint`, whose filename/provenance/mode/mtime +contract is intentionally different. The release writer accepts only the already verified +`PublicFileV1` inventory plus descriptor-owned committed result root and writes: +UTF-8-byte-sorted normalized relative names; regular files only; `uid=gid=0`; empty `uname/gname`; +mtime exactly `tagger_timestamp` converted to integral UTC epoch seconds; modes normalized to `0644`; no PAX, GNU, sparse, link, device, socket, or +extended header; exact USTAR numeric encoding; exactly two zero end blocks; and no trailing bytes. +The checksum sidecar is lowercase SHA-256, two spaces, exact tar filename, LF. Host metadata and +`tarfile` defaults may not influence either asset. + +For corrections, a separate `build_correction_release_plan` accepts terminal `RELEASED` or +`RELEASE_BLOCKED`, authoritative `CorrectionIntentV1`, `CorrectionPublicationReceiptV1`, +`CorrectionMergeReceiptV1`, the same `CorrectionLineageV1`, and asset root; it derives and +revalidates every nested publication/release value from those correction-specific records rather +than accepting generic publication-plan/receipt arguments. It requires the new correction result path and does not change campaign state +while planning. Initial and correction release plans share the exact asset construction and finalizer, but a +correction can only create its new attempt-specific tag/release. Every name, marker, asset digest, +actor, exact head target, and idempotency key must equal the already persisted correction intent; +the post-merge builder binds observed `M` only as lineage/admission evidence and cannot invent a new +external effect identity. + +Before any initial release effect, `RESULT_RELEASE_INTENT_AUTHORIZED` persists +`publication/initial//release-intent.json` by expected-OID CAS while state +remains `RESULT_MERGED`. The strict `ResultReleaseIntentV1` binds campaign ID, +`campaign_registry_sha256`, publication ID, deterministic annotated-tag bytes/OID/name/target, exact draft +Release name/body/marker, ordered asset names/sizes/digests, release-finalizer actor, immutable- +Release policy root, and distinct idempotency keys for tag, draft, each asset, publish, every receipt, +finalization, and invalidation. `build_result_release_intent` derives every field from canonical +authority and `ExecutableResultReleasePlanV1(intent_kind="initial")`; no workflow scalar participates. A correction is eligible only +after its valid `merge-receipt.json`, which binds the original authoritative `CorrectionIntentV1` +and release-plan hash without embedding a second intent. Missing intent, wrong parent OID, +cross-lineage names, or a release effect after correction publication invalidation fails before the +external release-finalizer broker may mint its operation-scoped credential. + +- [ ] **Step 5: Implement the standard-library-only release finalizer** + +`tools/benchmark_release_finalizer.py` accepts only package ZIP, repository, and receipt path. The +package contains the exact finalizer plus the hash-bound secret-free +`tools/benchmark_release_broker_client.py`; it contains no App identity secret, private key, JWT, +installation token, Authorization header, or token handle. It verifies the package/plan, +independently rebuilds the annotated-tag bytes, and requires its object ID to equal +`expected_tag_object_sha`. The authority-selected invocation submits at most one canonical +operation request to the measured external release-finalizer broker: create/adopt tag object/ref, +create/adopt draft, one asset ordinal, publish/adopt, final verification, or terminal reconciliation. +The broker selects the exact `ReleaseFinalizerOperationPolicyRowV1`, owns/vaults the token and +GitHub TLS, performs the row's reads/effect, closes the token, seals its signed ledger/audit prefix, +and returns only safe transport/delivery-resolution/closure receipts. The two assets are separate +ordinals and separate broker calls: ordinal 0 must reconcile and close before ordinal 1. Sharing a +token, fingerprint, effect result, revocation, or operation row across ordinals is forbidden. No +per-asset authority path exists. + +`release.py` remains the canonical owner of every release-finalizer and security-attestor record. +`release_broker.py` imports and validates those exact class objects and defines no duplicate schema. +Extend `ReleaseFinalizerBrokerPolicyV1` with the frozen initial/correction callers and only the +literal effect tuples `(tag,tag_object,0)`, `(tag,tag_ref,1)`, +`(draft_release,draft_release,0)`, `(asset,asset,0)`, `(asset,asset,1)`, +`(publish,publish,0)`, `(final_verification,final_verification,0)`, plus the single +`(terminal_reconciliation_read,terminal_reconciliation_read,0)` row. Each write row uses only its +exact applicable `contents:write`, `metadata:read` permission pair and the normative +create/adopt endpoint subset; the reconciliation row uses only `contents:read`, `metadata:read` and +the exact tag/Release/assets/latest-pointer GET inventory. The phase is monotone +`constructive -> terminal_reconciling -> sealed`; entering reconciliation disables every write mint +and `sealed` denies every later mint. Each caller and operation form one indivisible policy row, +each asset ordinal gets a separate row/token lifecycle, and no caller-selected permission or +endpoint union is valid. `ReleaseFinalizerCallerV1` fixes caller job `release_finalizer` and OIDC +audience `laconian-release-finalizer-broker`; every security-attestor row fixes job +`security_attestor` and audience `laconian-security-attestor-broker`. Tests reject either audience, +job, workflow, ref, or environment substituted independently. + Each successful broker operation returns Runtime's acyclic `ReleaseEffectResultV1`, the exact + `InstallationTokenRevocationReceiptV1`/closure projection, and then the matching `TagReceiptV1`, + `DraftReleaseReceiptV1`, + `ReleaseAssetReceiptV1`, `PublishReceiptV1`, or `FinalReleaseVerificationReceiptV1`. Final + verification constructs the latter from the exact immutable verification and complete external- + object root; only then may Publication build `ReleaseNoLaterEffectsEvidenceV1` and the terminal + `InitialPublicationFinalizationV1`. For an initial release the secret-free recorder wraps the next exact receipt in + `InitialReleaseReceiptAppendV1` and the broker persists its allowlisted path by expected-OID CAS + with byte-identical CampaignState hash; this is the closed §7.6 non-state authority append, not an + invented CampaignState event. The next phase is ineligible until that phase's receipt append wins; + within aggregate-assets, ordinal 1 is authorized by the same phase and only after ordinal 0 is + reverified, and both receipts are appended once as `asset-receipts.json`. For a correction, the approved + `CORRECTION_TAG_RECORDED` wrapper persists the tag receipt, and the later approved + `CORRECTION_RELEASE_RECORDED` wrapper aggregates the draft, both assets, publish, and final release + receipts. The fixed serialized finalizer never skips a missing predecessor receipt and never + performs an untracked retry. + +The following entire block is a predecessor-wire rejection fixture. Every shown field layout is +negative, and every `Rejected*` class name is forbidden. If an unprefixed class name remains in the +approved overlay, production implements only that overlay's current exact shape; the predecessor +payload shown here must still fail before token mint or GitHub dispatch: + +```python +class RejectedResultReleaseIdempotencyKeysFixture(CapsuleModel): + schema_version: Literal["1"] + release_intent_cas_key: Sha256 + tag_effect_key: Sha256 + draft_release_effect_key: Sha256 + first_asset_effect_key: Sha256 + second_asset_effect_key: Sha256 + publish_effect_key: Sha256 + final_verification_effect_key: Sha256 + tag_receipt_append_cas_key: Sha256 + draft_release_receipt_append_cas_key: Sha256 + first_asset_receipt_key: Sha256 + second_asset_receipt_key: Sha256 + asset_receipts_append_cas_key: Sha256 + publish_receipt_append_cas_key: Sha256 + finalization_key: Sha256 + invalidation_key: Sha256 + + +class ResultReleaseIntentV1(CapsuleModel): + schema_version: Literal["ResultReleaseIntentV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + release_plan_sha256: Sha256 + security_attestor_receipt: SecurityAttestorReceiptV1 + security_attestor_receipt_sha256: Sha256 + authority_parent_oid: GitObjectId + annotated_tag_bytes_sha256: Sha256 + expected_tag_object_sha: GitObjectId + result_tag_name: BoundedNonBlankString + target_commit_sha: GitObjectId + tag_message: BoundedNonBlankString + draft_release_name: BoundedNonBlankString + draft_release_body: BoundedNonBlankString + draft_release_marker: BoundedNonBlankString + assets: tuple[ReleaseAssetV1, ReleaseAssetV1] + release_finalizer_app: GitHubAppInstallationIdentityV1 + immutable_release_policy_sha256: Sha256 + idempotency_keys: RejectedResultReleaseIdempotencyKeysFixture + intent_sha256: Sha256 + + +# Import, class-bound revalidate, and re-export Runtime-owned GitHubOidcRunIdentityV1, +# ReleaseEffectAuthorizationV1, ReleaseEffectResultV1, TagReceiptV1, DraftReleaseReceiptV1, +# ReleaseAssetReceiptV1, PublishReceiptV1, FinalReleaseVerificationReceiptV1, all four +# Initial*ReceiptAppendV1 variants, InitialReleaseReceiptAppendV1, and +# InstallationTokenRevocationReceiptV1 and append_initial_release_receipt. Publication must not +# redefine any of them. + +# Each imported concrete effect receipt contains the same strict +# ReleaseEffectAuthorizationV1. It has exact fields authorizing_intent_sha256, +# preauthorized_release_plan_sha256, executable_release_plan_sha256, and +# security_attestor_receipt_sha256. For intent_kind="initial", authorizing_intent_sha256 equals the +# authoritative ResultReleaseIntentV1 digest and the two plan hashes both equal its exact +# RejectedResultReleasePlanFixture. For intent_kind="correction", authorizing_intent_sha256 equals the +# authoritative CorrectionIntentV1 digest, preauthorized_release_plan_sha256 equals its nested +# CorrectionReleaseIntentPlanV1 digest, and executable_release_plan_sha256 equals the postmerge +# RejectedResultReleasePlanFixture proven to be its deterministic derivation. Runtime's +# initial append API accepts only intent_kind="initial" and enforces closed path/order/expected-OID +# rules while leaving the CampaignState hash byte-identical. The authorization also carries the +# exact plan-bound security_attestor_receipt_sha256; every concrete receipt must repeat it. + + +class ImmutableReleaseVerificationV1(CapsuleModel): + schema_version: Literal["ImmutableReleaseVerificationV1"] + repository_setting_response_sha256: Sha256 + release_fields_sha256: Sha256 + gh_version: BoundedNonBlankString + gh_binary_sha256: Sha256 + gh_release_verify_output_sha256: Sha256 + verification_sha256: Sha256 + + +class ReleaseInventoryDefectEvidenceV1(CapsuleModel): + schema_version: Literal["ReleaseInventoryDefectEvidenceV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + durable_authority_checkpoint_sha256: Sha256 + expected_tag_object_sha: GitObjectId + expected_tag_target_sha: GitObjectId + expected_release_id: StrictPositiveInt + expected_release_fields_sha256: Sha256 + expected_asset_root_sha256: Sha256 + expected_actor_root_sha256: Sha256 + observed_tag_root_sha256: Sha256 | None + observed_release_root_sha256: Sha256 | None + observed_asset_root_sha256: Sha256 | None + observed_actor_root_sha256: Sha256 | None + defect_kinds: tuple[ + Literal[ + "tag_missing", + "tag_object_diverged", + "tag_target_diverged", + "release_missing", + "release_fields_diverged", + "assets_diverged", + "actors_diverged", + ], + ..., + ] + safe_request_receipts_root_sha256: Sha256 + observed_at_utc: CanonicalTimestamp + evidence_sha256: Sha256 + + +class ReleaseInventoryAlertReceiptV1(CapsuleModel): + schema_version: Literal["ReleaseInventoryAlertReceiptV1"] + evidence_sha256: Sha256 + cadence_slot_utc: CanonicalTimestamp + alert_idempotency_key: Sha256 + alert_sink_identity_sha256: Sha256 + operation: Literal["emitted", "adopted"] + safe_response_receipt_sha256: Sha256 + alerted_at_utc: CanonicalTimestamp + receipt_sha256: Sha256 + + +class RejectedResultReleaseReceiptFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + effect_authorization: ReleaseEffectAuthorizationV1 + security_attestor_receipt_sha256: Sha256 + tag_receipt: TagReceiptV1 + draft_release_receipt: DraftReleaseReceiptV1 + asset_receipts: tuple[ReleaseAssetReceiptV1, ReleaseAssetReceiptV1] + publish_receipt: PublishReceiptV1 + final_verification_receipt: FinalReleaseVerificationReceiptV1 + correction_lineage_sha256: Sha256 | None + release_plan_sha256: Sha256 + bundle_kind: Literal["complete"] + bundle_sha256: Sha256 + result_tag_name: BoundedNonBlankString + tag_object_sha: GitObjectId + target_commit_sha: GitObjectId + release_operation: Literal[ + "created_tag_and_release", + "reused_tag_created_release", + "resumed_exact_draft", + "observed_exact_published", + ] + release_id: StrictPositiveInt + release_url: ExactAsciiHttpUrl + published_at_utc: CanonicalTimestamp + immutable: Literal[True] + immutable_release_verification: ImmutableReleaseVerificationV1 + assets: tuple[ReleaseAssetV1, ReleaseAssetV1] + repository_id: StrictPositiveInt + workflow_run_id: StrictPositiveInt + run_attempt: StrictPositiveInt + job_id: StrictPositiveInt + job_name: Literal["release_finalizer"] + environment: Literal["benchmark-publish"] + deployment_id: StrictPositiveInt + approval_actor_id: StrictPositiveInt + approval_actor_login: BoundedNonBlankString + release_app: GitHubAppInstallationIdentityV1 + released_by: BoundedNonBlankString + receipt_sha256: Sha256 + + +class RejectedResultReleaseFinalizationFixture(CapsuleModel): + schema_version: Literal["1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + effect_authorization: ReleaseEffectAuthorizationV1 + security_attestor_receipt_sha256: Sha256 + tag_receipt: TagReceiptV1 + draft_release_receipt: DraftReleaseReceiptV1 + asset_receipts: tuple[ReleaseAssetReceiptV1, ReleaseAssetReceiptV1] + publish_receipt: PublishReceiptV1 + final_verification_receipt: FinalReleaseVerificationReceiptV1 + result_release_receipt: RejectedResultReleaseReceiptFixture + durable_authority_checkpoint: "RejectedDurableAuthorityCheckpointFixture" + durable_authority_checkpoint_sha256: Sha256 + finalization_sha256: Sha256 + + +class RejectedPreIntentResultReleaseInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + phase: Literal["pre_intent"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + cause: Literal["ordinary", "credential_exposure"] + merge_commit_oid: GitObjectId + result_tree_oid: GitObjectId + defect_evidence_sha256: Sha256 + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + consumed_unresolved_hold_id: BoundedNonBlankString | None + consumed_unresolved_hold_root_sha256: Sha256 | None + no_external_effects_evidence_sha256: Sha256 + invalidation_sha256: Sha256 + + +class RejectedPostIntentResultReleaseInvalidationFixture(CapsuleModel): + schema_version: Literal["1"] + phase: Literal["post_intent"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + publication_id: BoundedNonBlankString + cause: Literal["ordinary", "credential_exposure"] + release_intent_sha256: Sha256 + defect_evidence_sha256: Sha256 + consumed_unresolved_hold_id: BoundedNonBlankString | None + consumed_unresolved_hold_root_sha256: Sha256 | None + terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1 | None + blocked_release_objects: BlockedReleaseObjectsV1 + tag_receipt: TagReceiptV1 | None + draft_release_receipt: DraftReleaseReceiptV1 | None + asset_receipts: tuple[ReleaseAssetReceiptV1, ...] + publish_receipt: PublishReceiptV1 | None + reconciliation_receipts_root_sha256: Sha256 + invalidation_sha256: Sha256 + + +RejectedResultReleaseInvalidationFixture = Annotated[ + RejectedPreIntentResultReleaseInvalidationFixture + | RejectedPostIntentResultReleaseInvalidationFixture, + Field(discriminator="phase"), +] +``` + +Production instead uses the overlay's exact `ResultReleaseIntentV1`, +`ReleaseEffectDeliveryResolutionV1`, four initial receipt-append wrappers, +`ReleaseFinalizerOperationSetV1`, `ReleasePlanInvalidationEvidenceV1`, +`InitialPublicationInvalidationV1`, and `InitialPublicationFinalizationV1`. The success terminal +record names all four accepted append-wrapper digests, the final verification receipt, and exact +`ReleaseNoLaterEffectsEvidenceV1`; an invalidation names its phase-exact preparation/effect prefix, +operation set, stable no-later proof or sealed reconciliation-unavailable receipt. No aggregate +`RejectedResultReleaseReceiptFixture`, second finalization wrapper, or pre/post-intent generic invalidation is +admitted. + +Class-bound revalidate every imported shared receipt. Tests reject initial/correction intent-kind +substitution, an initial receipt naming a correction intent, a correction receipt naming a +`ResultReleaseIntentV1`, any release-plan mismatch, a correction receipt whose authorization does +not equal the original `CorrectionIntentV1` plus its nested release plan, and any correction receipt +passed to `append_initial_release_receipt`. `CorrectionTagReceiptV1` and +`CorrectionReleaseReceiptV1` additionally require all nested shared receipts to carry the identical +correction authorization; their authoritative phase wrappers, not the inner draft/asset/publish +receipts individually, each win one correction CAS. +`tests/test_public_contract.py` asserts that Publication re-exports the identical Runtime class +objects for `GitHubOidcRunIdentityV1`, `ReleaseEffectAuthorizationV1`, `ReleaseEffectResultV1`, +`InstallationTokenRevocationReceiptV1`, `FinalReleaseVerificationReceiptV1`, and all four effect receipts, and freezes the authorization +field names `authorizing_intent_sha256`, `preauthorized_release_plan_sha256`, +`executable_release_plan_sha256`, and `security_attestor_receipt_sha256`. + +`RELEASE_PLAN_INVALIDATED` may occur directly from `RESULT_MERGED` before release intent or from one +of the five exact post-intent phases. Every route uses +`ReleasePlanInvalidationEvidenceV1.release_phase=pre_intent|release_intent|tag_receipt| +draft_release_receipt|asset_receipts|publish_receipt` and one strict +`ReleasePlanInvalidationDetailV1`. Pre-intent evidence proves zero authorization/mint/dispatch and +complete external-object absence or preserves a preexisting conflict. Post-intent evidence binds +the executable graph, every accepted append wrapper, every discovered external object, complete +`ReleaseFinalizerOperationSetV1`, and stable `ReleaseNoLaterEffectsEvidenceV1`; the +`release_reconciliation_unavailable` row instead carries its sealed unavailable receipt and null +no-later root. Credential exposure, drift, and nondismissible hold use only their exact class-bound +consumers. The terminal CAS installs `InitialPublicationInvalidationV1`, consumes the matching +active root/hold when required, and never fabricates absence or a success aggregate. Tests cover all +six phases, all closed reasons, partial tag/assets, exposure before/after intent, half-null roots, +hidden objects, cross-intent replay, mixed variants, and reconciliation-unavailable. + +`SecurityAttestorReceiptV1` is produced only after an exact receipt-free preauthorized plan and +before its executable plan/initial intent. It binds that plan root, the applicable admitted merge, +purpose-specific repository/ruleset/immutable-setting observations, the complete +`SecurityAttestorCredentialDispositionSetV1`, signed broker ledger, and closed token. Failure emits +`SecurityAttestorFailureEvidenceV1` and can only feed release invalidation. The returned permission +tuple is exactly `administration:write`, `contents:read`, `metadata:read`; the signed policy permits +only the purpose row's authenticated GET endpoints. Observation and closure times come from signed +broker/GitHub receipts, never caller time. Golden fixtures cover every policy row, request/transport +outcome, permission order, initial/correction discriminator, raw/canonical swap, pagination, +omitted/extra field, digest mutation, and same-token post-boundary dispatch. +The Runtime-owned `GitHubOidcRunIdentityV1` is class-bound revalidated in full, including repository +name/ID, owner, actor and triggering actor, ref/SHA/event, caller/callee workflow paths and SHAs, +run/attempt/job/check-run, runner/environment, issuer/audience/subject/JTI/time and JWKS evidence. +Tests reject wrong job/check-run/deployment/environment approval, rerun actor, ref/SHA, caller or +callee SHA, expired response, token material in a safe response, and reused JTI. + +The initial success dependency is strictly one-way: publication merge receipt -> +`InitialPreauthorizedResultReleasePlanV1` -> closed passing security-attestor receipt -> +`ExecutableResultReleasePlanV1` -> initial intent -> Runtime `ReleaseEffectAuthorizationV1` -> +delivery resolutions and receipt appends -> final verification -> release no-later evidence -> +`InitialPublicationFinalizationV1`. A closed initial attestor failure instead feeds only the +phase-exact `RELEASE_PLAN_INVALIDATED` evidence and can produce no executable plan, intent, or +effect authorization. The correction success dependency is original prepublication correction +intent with nested `CorrectionReleaseIntentPlanV1` -> publication receipt -> correction merge +receipt -> closed passing attestor receipt -> `ExecutableResultReleasePlanV1` -> effect +authorization/receipts -> aggregate correction release wrapper -> correction finalization. A +closed correction attestor failure feeds only its exact correction release invalidation and can +produce no executable plan or effect. There is no second correction intent and the original intent +cannot hash the future attestor receipt. Each +post-attestation successor repeats the receipt digest and class-bound revalidates the complete +receipt from authority/archive. The four initial append wrappers retain the ordered shared receipt +digests without changing CampaignState; `InitialPublicationFinalizationV1` then binds those wrapper +digests, the exact final-verification receipt, and release no-later evidence. No predecessor hashes a +successor, so self-reference is impossible. Tests independently rebuild every preimage, mutate each lineage/request/response/ +permission field, reject correction-future-merge substitution, and prove the graph is acyclic. +For durability, initial `release-intent.json` embeds the complete +`SecurityAttestorReceiptV1` plus its digest. Correction adds no path: the first post-attestation +authoritative `CorrectionTagReceiptV1` wrapper embeds the complete fresh receipt and complete +`ExecutableResultReleasePlanV1` plus both digests before its CAS; later correction aggregate, +operation-set/no-later evidence, and finalization bind those embedded objects. No attestor token is +live after a pass/failure record. If that closed record becomes stale under its plan-bound freshness +policy before the executable plan or tag wrapper, rerun attestation and rebuild the executable plan +before any release credential/effect; +after the tag-wrapper CAS, reconstruction uses its durable canonical bytes and never a transient +artifact. Tests delete/expire every Actions artifact at each prefix and require identical offline +reconstruction, while mismatched full-object/digest pairs and a seventh correction path fail. + +Require `release_app.role == "release_finalizer"`, `released_by == release_app.bot_login`, the +pre-registered App/installation/repository IDs, and exact permission attestation. Reject the +publisher/state Apps, `github-actions[bot]`, or any permission response other than the closed +per-operation write-row tuple `contents:write`, `metadata:read` (whose reachable surface includes the +required new-tag/release/asset endpoints); the reconciliation-read row is exactly +`contents:read`, `metadata:read`. No row contains Actions or Deployments permission. The installed App +also has `administration:write`, but that permission is omitted from the write token and appears only +on the separately brokered `security_attestor` token. Derive +`published_at_utc` only by re-fetching the created/existing GitHub release; reject a naive, +noncanonical, caller-supplied, or workflow-clock timestamp. + +Freeze the finalizer's write endpoint allowlist to the exact annotated-tag-object/ref creation, +draft-Release creation, asset upload, and one `PATCH /repos/{owner}/{repo}/releases/{release_id}` +whose sole mutation is the plan-bound draft-to-published transition. Concretely, no Contents API, +GraphQL mutation, tag update/delete, Release delete, asset delete/update, or general Release edit is +allowed. Every request binds the intent key, exact numeric repository/release IDs, actor, request ID, +and pre/post observation into its effect receipt. + +```text +POST /repos/{owner}/{repo}/git/tags +POST /repos/{owner}/{repo}/git/refs +POST /repos/{owner}/{repo}/releases +POST https://uploads.github.com/repos/{owner}/{repo}/releases/{release_id}/assets?name={asset_name} +PATCH /repos/{owner}/{repo}/releases/{release_id} # draft true -> false only +DELETE /installation/token # revoke only the current finalizer authentication token +``` + +After every create/adopt effect, safe failure, or response-loss reconciliation, the external +release-finalizer broker calls the exact token-revocation endpoint and denial probe before returning +only safe receipts; the runner finalizer merely verifies those signed records. Runtime's strict +`InstallationTokenRevocationReceiptV1` records the effect authorization, nonsecret token +fingerprint, endpoint, request receipt, `204` response or response-loss recovery observation, +post-revocation authentication-denial probe, canonical UTC timestamp, and self digest. Each concrete +effect receipt, `ReleaseFinalizerCredentialDispositionV1`, and final +`ReleaseFinalizerOperationSetV1` binds the matching revocation/closure root; authority cannot append +the receipt or terminalize without it. A lost revocation response is recovered only by proving the +same token unusable, while a token that remains usable is a credential exposure and cannot be +reported as success. Tests cover 204, response loss, expiry, revoke failure, crash before/after +revoke, replay across effects/tokens, zero post-boundary dispatch, and guaranteed scrubbing. This +auth-token DELETE is explicitly distinct from and does not authorize any Git ref, tag object, +Release, asset, branch, or other object deletion. + +After receipt-free preauthorization and before executable-plan/intent authorization, the fixed +`security_attestor` job in `.github/workflows/benchmark-release.yml` presents only its exact OIDC +identity and preauthorized-plan subject to the external broker. That broker alone mints, vaults, +uses, and closes the short-lived release-finalizer installation token downscoped to +`administration:write`, `contents:read`, and `metadata:read`, fetches the exact repository, ruleset, +and immutable-setting endpoints, and returns only the strict signed plan-bound +`SecurityAttestorReceiptV1` or failure evidence. False, missing, malformed, permission-expanded, or +unbound responses fail closed. The Actions job and release finalizer receive only the verified safe +receipt and never receive an administration-capable token or call repository/ruleset/immutable-setting admin +endpoints. Draft recovery fully paginates authenticated `GET /repos/{owner}/{repo}/releases`, matches +one unique intent marker/tag/author, and then fetches that exact release ID. The by-tag endpoint is +not used to discover drafts. Published recovery may use +`GET /repos/{owner}/{repo}/releases/tags/{tag}` but still re-fetches by numeric ID. Asset recovery +fully paginates the exact release's assets. After an upload timeout, HTTP 422, or HTTP 502, relist +and adopt only exact name/content-type/size/provider-digest/uploader evidence; when the API digest +is absent, download and hash the bytes. A `starter` asset or divergent same-name object is terminal +failure evidence and is never overwritten or silently retried. + +The authenticated read allowlist is concrete and closed: + +```text +GET /repos/{owner}/{repo}/immutable-releases +GET /repos/{owner}/{repo}/releases?per_page=100&page={page} +GET /repos/{owner}/{repo}/releases/{release_id} +GET /repos/{owner}/{repo}/releases/tags/{tag} +GET /repos/{owner}/{repo}/releases/{release_id}/assets?per_page=100&page={page} +GET /repos/{owner}/{repo}/releases/assets/{asset_id} # octet-stream download only when digest is absent +``` + +Pagination continues through the authenticated response's final page; a truncated page sequence is +not absence evidence. No by-tag lookup participates in draft discovery. + +After publish, require returned `immutable == true` and run a pinned/versioned +`gh release verify` for the exact repository/tag/release/assets. Hash the canonical setting +response, Release fields, pinned CLI version/binary digest, and command output into +`ImmutableReleaseVerificationV1`. GitHub REST does not return a separate platform-attestation +digest for this purpose, so no invented field or claim is accepted. Immutable Releases protect the published tag/assets, +but the implementation does not claim Releases cannot be deleted or every metadata field cannot be +changed. Protected tag rules, immediate finalizer-token revocation, actor alerts, scheduled exact +inventory checks, and authority policy expose and constrain that residual platform risk. + +Implement the scheduled inventory check as a concrete external read-only monitor, not a sixteenth +Actions workflow and not a new trigger on any frozen workflow. The deployment runs the checked-in, +C0-hash-verified `tools/benchmark_release_inventory_monitor.py` exactly every 3600 seconds at the +UTC hour boundary under the deployment identity/config frozen in +`ops/benchmark-release-inventory-monitor.toml`. It has no GitHub/repository credential and uses only +public read endpoints plus exact Git object fetches; its sole secret is an external operations-alert +sink credential, mapped only after defect evidence exists and never sent to GitHub. From the active +latest pointer, accepted terminal finalization, and authoritative receipt chain it re-fetches and +revalidates the exact annotated tag object/target, Release numeric ID and immutable fields, ordered +asset IDs/names/sizes/digests, and tag/Release/asset actors. It emits canonical safe +`ReleaseInventoryDefectEvidenceV1` plus an alert to the existing operations sink, but never mutates +GitHub, campaign authority, latest pointer, or release objects; correction still begins only through +the reviewed defect-PR protocol. Evidence and alerts use exact domains +`laconian-release-inventory-defect-evidence-v1\n` omitting only `evidence_sha256` and +`laconian-release-inventory-alert-receipt-v1\n` omitting only `receipt_sha256`. Alert idempotency is +SHA-256 over the literal domain plus CanonicalJSONV1 of `[evidence_sha256, cadence_slot_utc, +alert_sink_identity_sha256]`; retries adopt only an exact prior alert. Independent literal goldens +and fixture-backed normal/divergence/deletion/actor/replay, wrong-slot/credential, duplicate-alert, +and no-mutation tests are owned by `tests/campaign/test_release_inventory_monitor.py`. +`docs/runbooks/benchmark-release-inventory-monitor.md` names the operations owner, deployment/health +check, missed-two-slots escalation, alert acknowledgement, evidence preservation, and reviewed +defect-PR creation; it never directs an operator to repair GitHub objects. Adding `schedule:` to +`benchmark-release.yml` would violate the approved workflow caller/trigger contract and therefore +requires a normative amendment; this external monitor does not. + +An exact existing published immutable tag/release is idempotent. An exact draft may resume missing +byte-identical asset uploads and the one publication transition; a divergent draft is invalidated +and left untouched for incident handling. A crash after one upload, after both uploads, or after +publication re-fetches exact state and resumes only the missing step. The executable never deletes, +retargets, replaces, overwrites, or edits a published release, and its only release update is the +single exact draft-to-published transition after both assets verify. +Each tag/draft/asset/publish phase success emits only its Runtime-owned typed effect receipt. A +successful final-verification job emits the Runtime-owned +`FinalReleaseVerificationReceiptV1`. Publication then reconstructs the accepted tag, draft, +ordered-assets, publish, and final-verification chain from the four authoritative append wrappers, +verifies the external broker's signed terminal-reconciliation observations and already closed +read-token receipt, then builds the complete `ReleaseFinalizerOperationSetV1` and +`ReleaseNoLaterEffectsEvidenceV1`. Publication never receives or closes that token. The single terminal +`InitialPublicationFinalizationV1` names those four append-wrapper digests, the final-verification +receipt digest, and the nested exact no-later object/root; there is no aggregate release receipt or +second finalization wrapper. If authority already binds a phase wrapper or terminal finalization, a +later verification run is a no-op only after revalidating its canonical bytes and every plan-bound +external object; racing observations cannot trigger another external update or replace any nested +receipt. +On every non-idempotent failure, re-fetch the bounded tag/release/asset set and emit a safe +`BlockedReleaseObjectsV1`; the broker persists it before any correction can be planned. Conflicting +or externally visible objects are retained as exposure evidence under the no-overwrite/no-reuse +protocol; this is not a claim that the platform makes them undeletable. + +Before the first tag API call, the external broker uses the same fixed GitHub runtime identity +variables as the publisher, re-fetches the numeric `release_finalizer` job, deployment, and separate +`benchmark-publish` approval, calls the authority/hold verifier bound by the plan, and re-fetches and +attests the release App. It verifies the already closed plan-bound `release_preparation` attestor +receipt and exact trust-boundary record; neither the release-writer token nor the Actions job +re-fetches the immutable-Releases setting or any Administration-gated endpoint. The per-phase +authorization is repeated in its typed effect receipt and closed +delivery resolution, and the terminal operation set proves the complete authorization ledger and +zero live release-finalizer tokens. Repository `GITHUB_TOKEN` is read-only and is never the release +actor. + +Do not add a public campaign CLI. The fixed trusted release-preparation tool selects initial or +correction construction only from verified authority/lineage and accepts no tag, Release, PR, +merge, asset, actor, campaign, correction, or effect identity override. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_security_attestor_credential_finality.py tests/campaign/test_release_authorization_graph.py tests/campaign/test_release_finalizer_credential_finality.py tests/campaign/test_reconciliation_unavailable.py tests/campaign/test_result_release.py tests/campaign/test_release_broker.py tests/campaign/test_release_inventory_monitor.py tests/test_public_contract.py -q` + +Expected: PASS. + +- [ ] **Step 7: Commit result release planning and finalization** + +```bash +git add src/laconian_eval/campaign/__init__.py \ + src/laconian_eval/campaign/release.py \ + src/laconian_eval/campaign/release_broker.py \ + tools/benchmark_release_finalizer.py \ + tools/benchmark_release_broker_client.py \ + tools/benchmark_release_inventory_monitor.py \ + ops/benchmark-release-inventory-monitor.toml \ + docs/runbooks/benchmark-release-inventory-monitor.md \ + tests/campaign/test_result_release.py \ + tests/campaign/test_release_broker.py \ + tests/campaign/test_security_attestor_credential_finality.py \ + tests/campaign/test_release_authorization_graph.py \ + tests/campaign/test_release_finalizer_credential_finality.py \ + tests/campaign/test_reconciliation_unavailable.py \ + tests/campaign/test_release_inventory_monitor.py \ + tests/test_public_contract.py +git commit -m "feat: bind and finalize benchmark result releases" +``` + +### Task 12: Add the separately approved release workflow + +**Files:** +- Create: `.github/workflows/benchmark-release.yml` +- Modify: `tests/campaign/test_publication_workflows.py` +- Modify: `tests/test_ci_contract.py` + +- [ ] **Step 1: Extend the failing workflow contract** + +Require a read-only `prepare-release` with exactly `contents: read`, `actions: read`, +`pull-requests: read`, and `checks: read`; a `benchmark-publish` environment job named exactly +`security_attestor`; a secret-free +`authorize-release-intent` candidate job; an intervening call to the Runtime-owned OIDC broker +reusable job named `persist-release-intent`; a separately approved `benchmark-publish` environment +job named `release_finalizer`; and a read-only `record-release` followed by the existing broker +recorder. The dependency chain is exactly `prepare-release -> security_attestor -> +authorize-release-intent -> persist-release-intent -> release_finalizer -> record-release` on a +closed pass. The disjoint failure branch is `prepare-release -> security_attestor -> +build-release-invalidation -> persist-release-invalidation`, where the last job invokes only the +Runtime reusable state broker and terminates the run. The finalizer cannot be scheduled from a +prepare artifact or attestor failure. A correction uses its +already persisted pre-effect `CorrectionIntentV1` and approved merge-receipt phase and adds no +second intent CAS or seventh correction path. + +The gated finalizer job has exactly `id-token: write` plus `actions: read`, `deployments: read`, and +`contents: read`; only the latter three are repository-token scopes. It has one repository-owned +`run` step, the hash-bound secret-free release-broker client, +and a `GITHUB_READ_TOKEN` used only for the numeric package GET and unset before the broker request. +It has no provider secret, App/installation ID credential input, private key, installation token, +App-auth Authorization header, opaque token handle, checkout/setup/action step, or generic release +edit/delete command. Only the closed numeric-package downloader may create the read-only repository +token header, and it strips that header before the redirect fetch and broker request. +Only the external measured broker may issue the one exact draft-to-published PATCH after asset +verification. The `security_attestor` job in this workflow requests the exact +`release_preparation` policy row by OIDC audience `laconian-security-attestor-broker` and receives +only the signed plan-bound pass receipt or +failure evidence after the external broker has performed and closed the +`administration:write`, `contents:read`, `metadata:read` GET-only lifecycle. It cannot substitute +repository-token reads and declares exactly `id-token: write` with no repository-token scope. The +similarly named Task 10 job in `benchmark-publish.yml` is a distinct +`postmerge_rule_suite` caller row and cannot supply this receipt. The reusable state job likewise +contains only OIDC bootstrap and the fixed broker client. No repository `GITHUB_TOKEN` can write. +The `release_finalizer` job uses only audience `laconian-release-finalizer-broker`; caller job, +audience, workflow/ref/SHA, environment, and event must byte-equal one indivisible policy row. + +- [ ] **Step 2: Run the test and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_workflows.py tests/test_ci_contract.py -q` + +Expected: FAIL because `.github/workflows/benchmark-release.yml` is absent. + +- [ ] **Step 3: Implement the release workflow** + +Trigger only with no-input `workflow_dispatch` at the exact plan-bound `main` SHA. Use the shared +`laconian-public-benchmark-state` concurrency group. For an initial release, +`prepare-release` proves exact `RESULT_MERGED`; for a correction, it proves terminal +`RELEASED|RELEASE_BLOCKED`, an authoritative pre-publication `CorrectionIntentV1`, and exact durable +`publication-receipt.json` and `merge-receipt.json` wrappers. It checks +current PR/merge/tree state and builds only the receipt-free +`InitialPreauthorizedResultReleasePlanV1` or reconstructs the correction intent's exact +`CorrectionReleaseIntentPlanV1`, plus deterministic assets/finalizer package, then uploads it for 90 +days. Only after that immutable preauthorized root exists does `security_attestor` request the +workflow-bound `release_preparation` row. A closed pass receipt permits +`authorize-release-intent`; closed failure evidence permits only the phase-exact release-plan +invalidation path and no executable plan, intent, finalizer, or external effect. +`build-release-invalidation` accepts only that closed failure evidence and constructs either the +initial pre-intent `RELEASE_PLAN_INVALIDATED` candidate or the exact +`CORRECTION_INVALIDATED(kind=correction_release_invalidation)` candidate. The reusable +`persist-release-invalidation` call may win only that phase-exact expected-OID CAS; it cannot invoke +`authorize-release-intent`, `persist-release-intent`, `release_finalizer`, or any release broker row. + +`authorize-release-intent` has read-only permissions, no environment, App/provider secret, or +external write. It consumes the exact passing receipt and builds +`ExecutableResultReleasePlanV1`. For an initial release it then builds the exact +`ResultReleaseIntentV1` and `RESULT_RELEASE_INTENT_AUTHORIZED` candidate. For correction it +revalidates the immutable original intent's complete release plan against actual `M`, requiring +parents exactly `[base_oid, head_oid]`, the expected tree, and tag target exactly the preauthorized +`head_oid`; it creates no new intent or authority candidate. On the initial path, +`persist-release-intent` presents only the canonical candidate plus OIDC to +the Runtime reusable broker, which reconstructs authority, verifies the expected OID and all direct +campaign/registry/publication bindings, and wins one receive-pack CAS. Only its verified mutation +receipt authorizes `release_finalizer`. On correction, the accepted correction intent and merge- +receipt authority roots are the authorization inputs. In both cases the finalizer reconstructs the +authoritative intent and passing attestor/executable-plan graph from the current authority/archive +before requesting an effect. It downloads by numeric artifact ID, verifies the exact hashed +finalizer and secret-free broker client, unsets `GITHUB_READ_TOKEN`, and submits at most one +canonical OIDC-bound operation to the external release-finalizer broker. No App credential or token +reaches the runner. +`record-release` re-fetches all GitHub objects and emits a receipt-bound candidate only after +verification. It reconstructs the exact annotated tag object/target, +`ImmutableReleaseVerificationV1`, both verified asset digests, the authoritative +tag/draft/ordered-assets/publish receipt chain, and +`FinalReleaseVerificationReceiptV1`; it re-verifies that every prior transient mapping remains +present byte-for-byte. The external release-finalizer broker alone performs the exact +terminal-reconciliation row, closes its read token, and returns signed safe observations and +closure. `record-release` verifies those records, then constructs the exact complete +`ReleaseFinalizerOperationSetV1` and `ReleaseNoLaterEffectsEvidenceV1`; it never receives or closes +the token. Initial success has no aggregate release receipt and no durable +checkpoint wrapper: `InitialPublicationFinalizationV1` directly binds the four accepted append +wrapper digests, final-verification receipt, publication-success finality, and nested release +no-later object/root. Correction success instead uses the exact phase wrappers and +`CorrectionFinalizationV1`. Omission, reorder, duplicate inequality, cross-effect +`ReleaseEffectResultV1`, token closure, attestor, append-wrapper, or final-verification substitution +fails before the final authority CAS. Golden tests independently prove the acyclic order effect +receipts -> accepted append wrappers -> final verification -> operation set/no-later evidence -> +terminal finalization. For the initial release, the broker uses only the four exact non-state +receipt append variants in tag, draft, assets, publish order, retaining the same CampaignState hash, +then binds `InitialPublicationFinalizationV1` and `RESULT_RELEASED` from `RESULT_MERGED`. + +Initial dispatch is prefix-exact across one-phase runs. With no release intent it persists only +`RESULT_RELEASE_INTENT_AUTHORIZED`. With an existing intent or tag/draft/assets/publish receipt +prefix, it revalidates the authoritative intent, makes `persist-release-intent` an explicit no-op, +and permits exactly the next missing tag/draft/aggregate-assets/publish phase followed by Runtime's corresponding non-state receipt +append CAS. A complete publish prefix permits only final verification and the single +`RESULT_RELEASED` CAS. Add rerun and crash tests before and after every intent/effect/receipt +boundary. Add the partial-assets crash vector: after ordinal 0 upload and response persistence loss, +the next run adopts exact ordinal 0, uploads/adopts ordinal 1, and wins one aggregate-assets append +CAS. Assert two fresh gates, two distinct token fingerprints/results/revocations, exact ordinal +ordering, token canary absence, and denial of shared authorization material. No prefix repeats a completed phase, skips a receipt, invents a per-asset authority member, or +advances two phases in one run. + +Correction dispatch is phase-exact and performs at most one missing effect or CAS per run. An +`intent_authorized|publication_recorded` prefix with an admitted exact merge persists +`CORRECTION_MERGE_RECORDED` once; `merge_recorded` performs/adopts only the preauthorized tag-target- +head effect and then persists `CORRECTION_TAG_RECORDED`; `tag_recorded` performs/adopts only the next +missing draft, asset, or publish effect. After publish it performs a distinct post-publish final- +verification subphase using `final_verification_effect_key`, emits `ReleaseEffectResultV1`, revokes +that token, and emits `FinalReleaseVerificationReceiptV1`; only after all five typed receipt groups +verify does it persist their aggregate as `CORRECTION_RELEASE_RECORDED`. `release_recorded` only verifies and installs +`finalization.json`, the receipt-derived next latest pointer, and `CORRECTION_RESULT_RELEASED` in one +expected-OID CAS. Every phase revalidates the immutable prior wrapper and exact authority OID; an +already accepted phase is adopted without a duplicate effect or CAS. A correction from `RELEASED` leaves state `RELEASED`; one from `RELEASE_BLOCKED` +moves state to `RELEASED`. A divergent release emits `RELEASE_PLAN_INVALIDATED`, which the broker +applies as `RELEASE_BLOCKED` only from +`RESULT_MERGED`; terminal correction failures append invalid correction evidence without rewriting +prior state or result objects. That event is exactly +`CORRECTION_INVALIDATED(kind=correction_release_invalidation)`; it is legal only after the active correction's verified +`merge-receipt.json`, requires `BlockedReleaseObjectsV1` and reconciliation receipts, and +terminalizes that correction ID without changing campaign state or advancing the latest pointer. +It is distinct from both +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=unmerged_invalid)` and +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=merged_invalid)`; none of these invalidations advances the pointer. + +- [ ] **Step 4: Test failed and replayed finalization** + +Add workflow fixture cases for failure before tag creation, tag created before runner loss, draft +created before asset upload, each partial asset state, both assets verified before publication, +publication before receipt CAS, finalization before event CAS, and exact rerun. Only byte-identical tags/drafts/assets or an +already published immutable release may recover. A divergent draft/published object, mutable-release +setting, incomplete accepted receipt/finalization chain, or failed +`ImmutableReleaseVerificationV1` emits +`RELEASE_PLAN_INVALIDATED` with exact `BlockedReleaseObjectsV1` and no result rewrite. + +- [ ] **Step 5: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_publication_workflows.py tests/campaign/test_result_release.py tests/test_ci_contract.py -q` + +Expected: PASS. + +At this checkpoint `tests/test_ci_contract.py` enumerates exactly fourteen benchmark workflows. + +- [ ] **Step 6: Commit the release workflow** + +```bash +git add .github/workflows/benchmark-release.yml \ + tests/campaign/test_publication_workflows.py \ + tests/test_ci_contract.py +git commit -m "ci: gate checksum-bound benchmark releases" +``` + +### Task 13: Gate documentation and social changes on verified `RELEASED` + +**Files:** +- Create: `src/laconian_eval/campaign/docs_gate.py` +- Create: `tools/validate_result_docs.py` +- Create: `.github/workflows/benchmark-docs-validate.yml` +- Create: `tests/campaign/test_docs_gate.py` +- Modify: `tests/campaign/test_publication_workflows.py` +- Modify: `tests/test_public_contract.py` +- Modify: `benchmarks/runbooks/public-benchmark.md` +- Modify: `CONTRIBUTING.md` +- Modify: `evals/README.md` +- Modify: `SECURITY.md` +- Modify: `tests/test_ci_contract.py` + +- [ ] **Step 1: Write failing synchronized-surface tests** + +Lock the surfaces to: + +```python +SYNCHRONIZED_RESULT_PATHS = ( + "README.md", + "README.ru.md", + "README.el.md", + "README.grc-x-laconian.md", + "README.zh-CN.md", + "README.it.md", + "evals/README.md", + "website/index.html", + "CHANGELOG.md", +) +IMMUTABLE_ALPHA_PATHS = ( + "docs/releases/v0.1.0-alpha.1.md", + "docs/social/alpha-launch.md", + "assets/social/laconian-alpha.svg", + "assets/social/laconian-alpha.png", +) +``` + +Require a new `docs/releases/benchmark-result-{publication_id}.md` and +`docs/social/{release_date}-{publication_id}.md`, plus the fixed presentation source +`docs/presentations/benchmark-result-{publication_id}.md`, where `release_date` is canonical +`YYYY-MM-DD` derived only from the accepted `PublishReceiptV1.published_at_utc` after UTC +normalization. On an initial lineage that receipt is reconstructed from the authoritative +`InitialPublishReceiptAppendV1` named by `InitialPublicationFinalizationV1`; on a correction it is +the exact publish receipt in the accepted `release-receipt.json` named by +`CorrectionFinalizationV1`, +and `publication_id` equals the campaign ID for an initial release or its exact +correction publication ID. All three are required changed paths in a post-release result-claims PR. +Every changed result block contains this exact marker grammar: + +```html + +``` + +The brace-delimited values are reconstructed from the accepted terminal finalization, executable +release plan, and authoritative receipt chain; `bundle_sha256` must be exactly 64 lowercase +hexadecimal characters. + +- [ ] **Step 2: Add failing state and claim-consistency tests** + +Reject `RESULT_MERGED`, every `RELEASE_BLOCKED` state (even if correction-release evidence exists +without the required state transition), absent/wrong release receipt, missing localized surface, +changed alpha paths, model/date/campaign mismatch, denominator mismatch, interval mismatch, missing +quality gate or limitation link, reversed `concise - if` direction, billed/total/cost wording for +visible-output brevity, and numeric claims in hero/social-preview images. + +Reject a benchmark-result marker or result-shaped numeric claim in any changed Markdown/HTML path +outside the enumerated synchronized/dynamic surfaces, and reject a presentation slide whose number, +model, interval, denominator, gate, direction, tag, bundle, or limitation differs from machine JSON. +All benchmark claim blocks, including qualitative/comparative statements with no number (for +example shorter, better, worse, passes, fails, or inconclusive when tied to a benchmark model/arm), +must be inside the exact marker-delimited bounded block. Reject such claims outside a block and add +positive/negative phrase fixtures in every supported surface. +Reject `INVALID_PREFIX_MERGED` and `INVALID_PREFIX_MERGED_INVALID` unconditionally: invalid-prefix +publication is a terminal registry/incident outcome and has no result release, correction, docs, +website, release-note, or social-promotion path. Also reject +`latest_status=withdrawn_due_to_credential_exposure`, an open credential incident, missing +containment/correction evidence, or a latest pointer that is not active, released, and nonwithdrawn. +Safe incident disclosure uses its separate reviewed path and cannot pass this result-claims gate. + +The one pre-release carve-out is an exact result PR: changed paths wholly beneath the +`PublicationPlanV1.result_path` and exactly equal to its sealed `expected_files` are revalidated with +the same trusted-base `validate_publication_pull_request` logic. On success the docs validator emits +an explicit successful `sealed_result_bundle_noop`, even though canonical bundle files such as +`analysis/report.md`, `report.md`, or `limitations.md` contain result-shaped text. Any missing/extra/ +changed member, path outside that bound result root, unbound result directory, or failed publication +validation is not carved out and fails. This prevents the always-present docs check from deadlocking +the publication PR without weakening arbitrary-path detection. + +- [ ] **Step 3: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_docs_gate.py tests/test_ci_contract.py -q` + +Expected: FAIL because `docs_gate.py` does not exist. + +- [ ] **Step 4: Implement trusted-base documentation validation** + +Add: + +```python +PostReleaseClaimEvidenceV1 = VerifiedAnalysisEvidenceV1 + + +def verify_post_release_docs( + *, + trusted_repository: Path, + candidate_repository: Path, + authority: ReconstructedAuthorityV1, + executable_release_plan: ExecutableResultReleasePlanV1, + finalization: InitialPublicationFinalizationV1 | CorrectionFinalizationV1, + claim_evidence: PostReleaseClaimEvidenceV1, +) -> None: ... +``` + +Derive the changed-path inventory internally by opening the exact trusted and candidate Git trees, +enumerating their raw byte path/mode/object-ID tuples, and computing the canonical UTF-8-byte-sorted +diff. Never accept a changed-path list from a caller, event payload, CLI option, or environment. +Reject invalid UTF-8, aliases after path normalization, duplicate/missing/extra/reordered diff rows, +symlinks, submodules, and a candidate tree that does not equal the event's independently re-fetched +head. Tests prove that omitting a result-shaped path or substituting an event-supplied list cannot +select the no-op or sealed-result carve-out. + +Unconditionally require `authority.state.state == "RELEASED"`, both authority roots null, and +`reconstruct_correction_progress(authority) is None`; an accepted defect or any in-flight correction +prefix blocks documentation/social validation even though the prior released pointer remains +reconstructable. For a +correction, also require the exact append-only correction publication, merge, and release receipts, +the canonical latest released pointer, and `require_correction_authority` as specified in Task 8. +A correction originating from `RELEASE_BLOCKED` is acceptable only after the authoritative +`CORRECTION_RESULT_RELEASED` transition. Require +`release_plan.bundle_kind == release_receipt.bundle_kind == "complete"`, an active nonwithdrawn +latest pointer, and exact bundle hashes. Verify receipt, committed bundle, correction lineage where +present, tag, `ImmutableReleaseVerificationV1`, and every analysis parent hash; parse only explicit +marker-bounded result sections; and compare every numeric or qualitative benchmark claim with the +machine summary. No null, fabricated, invalid-prefix, withdrawn, or incident-open analysis is +accepted. Require all six localized READMEs plus evaluation docs, site, changelog, release note, +presentation source, and dated social package to name the same campaign/publication/bundle/tag. + +- [ ] **Step 5: Implement the PR workflow and runbook** + +`benchmark-docs-validate.yml` runs the stable job `benchmark-docs-validate` on every `pull_request`, +without a top-level path filter; has read-only permissions; checks out base and +candidate separately; and executes trusted-base `tools/validate_result_docs.py`. It returns an +explicit successful no-op when none of the synchronized result, release, social, presentation, or +result-shaped Markdown/HTML paths changed, so the check is always present even though it is not the +base ruleset's required context. +Its job declares exactly `contents: read` and `pull-requests: read`. +At this final workflow checkpoint, make `tests/test_ci_contract.py` assert that its 15 exact workflow +paths equal Runtime's `WorkflowInventoryV1` production path constant, then build/reverify +the inventory from the trusted tree and require every full-SHA pin/policy hash. This is the deferred +real cross-slice check; Runtime Task 2 used only synthetic files at those fixed paths. + +Do not add a public campaign CLI. The trusted workflow calls `tools/validate_result_docs.py` +directly with independently derived base/head repositories and event identity. Public-contract +tests retain exactly seven offline replay commands and reject live publication authority from those +handlers. + +The runbook must contain the exact repository settings checklist below, operator commands for +complete and invalid publication, exact-head workflow approval, merge verification, release +approval, recovery/invalidation branches, artifact-expiry warning, and key-revocation/incident +steps. It must say that documentation/social work begins only after canonical +`CampaignStateV1.state == "RELEASED"`, the accepted `RESULT_RELEASED` or +`CORRECTION_RESULT_RELEASED` evidence, `ImmutableReleaseVerificationV1`, release receipt, and +latest-publication pointer all verify. + +- [ ] **Step 6: Run focused GREEN checks** + +Run: `uv run pytest tests/campaign/test_docs_gate.py tests/campaign/test_publication_workflows.py tests/test_ci_contract.py tests/test_public_contract.py tests/test_site.py -q` + +Expected: PASS. + +At this checkpoint `tests/test_ci_contract.py` enumerates the exact frozen 15-workflow inventory. + +- [ ] **Step 7: Commit the post-release gate and operator documentation** + +```bash +git add src/laconian_eval/campaign/docs_gate.py \ + tools/validate_result_docs.py \ + .github/workflows/benchmark-docs-validate.yml \ + tests/campaign/test_docs_gate.py \ + tests/campaign/test_publication_workflows.py \ + tests/test_public_contract.py \ + tests/test_ci_contract.py \ + benchmarks/runbooks/public-benchmark.md \ + CONTRIBUTING.md \ + evals/README.md \ + SECURITY.md +git commit -m "docs: gate benchmark claims on verified release" +``` + +### Task 14: Reconstruct the entire publication path offline + +**Files:** +- Create: `tests/campaign/test_publication_reconstruction.py` +- Modify: `tests/campaign/publication_helpers.py` +- Modify: `tests/campaign/fake_github.py` + +- [ ] **Step 1: Write the failing complete-lineage reconstruction** + +First construct the exact serial protocol Git DAG, both annotated tags, stable ruleset policy, +operator registry, REST/GraphQL/local verification projections, historical tag-creation suites, +single companion binding, campaign registry, and complete object/API archive. Import it with the +network disabled and assert every Git OID/raw-object SHA-256, receipt digest, response-blob digest, +statement, envelope, bundle, ordered root and campaign identity reproduces. Negative fixtures cover +missing/extra/reordered closure objects, cycles, alternate tag grammar, wrong operator, namespace +squat, missing or differently authorized creation bypass, any update/delete bypass, duplicate rule +suite, response-hash/blob mismatch, omitted GraphQL signer state, and unknown CanonicalJSON fields. + +Starting from 36 published-style synthetic generation capsules in `GENERATION_COMPLETE`, execute +the same handlers and fixed campaign-side stage tools as the workflows: `Runtime.hard_score`, +`Runtime.prepare_judge`, and `HARD_SCORE_SET_SEALED`; Slice 3 judge execution plus +`Runtime.seal_judge` +through `JUDGE_COMPLETE`; provider-evidence verification and `EVIDENCE_INVENTORY_SEALED`; +Publication `Publication.campaign.evaluation_stage.sample_audit` with no state jump; both +commitment/reveal chains and adjudication; +`Publication.campaign.evaluation_stage.seal_audit` plus `AUDIT_SEALED`; +`Publication.campaign.evaluation_stage.analyze` followed by exact `.verify`, then +`ANALYSIS_SEALED`; and complete collection. Assert a static trace contains no raw +`laconian-benchmark` execution. Continue through publication +planning, minimal publication into a local bare repository, trusted-base PR validation, a real +local merge, release planning, fake-GitHub tag/release finalization, and the post-release docs gate. +Assert every parent digest and every allowed state transition through `RELEASED`. +Expire every Actions artifact in a second reconstruction after `RESULT_MERGED`; require the merged +publication/release authority members and terminal finalization to replay identical authority solely +from protected Git objects, committed result bytes, annotated tag, immutable Release assets, and +canonical accepted receipts. Before the merge event, the same expiry remains fatal. + +- [ ] **Step 2: Write the failing invalid-prefix reconstruction** + +Start from `BUDGET_INCOMPLETE`, finalize the exact prefix, create and validate its publication PR, +and exercise both merge outcomes. Successful admission emits `INVALID_PREFIX_MERGED`; failed +admission emits `INVALID_PREFIX_MERGE_INVALIDATED` and +`INVALID_PREFIX_MERGED_INVALID`. Prove both are terminal and reject every release-plan, tag, +Release, asset, correction, docs, website, release-note, social, generation/judge/audit/analysis, or +performance-claim attempt. + +- [ ] **Step 3: Add the exhaustive crash, outcome, and exposure matrix** + +For initial publication and release, inject response loss immediately before and after intent CAS, +branch creation, branch-receipt CAS, PR creation, PR-receipt CAS, human merge observation, +merge-receipt CAS, release-intent CAS, tag creation and its non-state tag-receipt append CAS, draft +creation and its non-state draft-receipt append CAS, each asset upload followed by the one ordered +two-asset receipt append CAS, publish and its non-state publish-receipt append CAS, finalization, and +final event CAS. Each initial receipt append must use the exact +`initial_release_receipt_append` discriminator/path/schema, expected authority OID, and unchanged +CampaignState hash. Correction injection instead follows only the approved event wrappers: +publication-receipt CAS, merge-receipt CAS, tag effect then `CORRECTION_TAG_RECORDED`, each missing +draft/asset/publish effect, post-publish final-verification result/revocation/receipt, then aggregate +`CORRECTION_RELEASE_RECORDED`, and finalization/event CAS. Inject crashes before/after publish, +verification, token revocation, and wrapper CAS; replay never republishes or reuses a token. +Every retry must query exact names, create or adopt once, and either persist the matching allowed +receipt wrapper or record terminal conflict evidence; no test invents a CampaignState event. + +For every initial/correction publication prefix and both ordinary and write-ambiguity source +classes, inject the same before/after loss at containment-start CAS, every queue inventory/timeline +page, guard create/update, exact dequeue, merge-fence run discovery/rerun/artifact redirect/page/ +extraction, both main reads, disposition/finality construction, and terminal CAS. Assert the active +containment root blocks every unrelated transition, the selected merged candidate is never dropped, +the successor denylist is byte-preserved when the root clears, and a replay adopts the exact guard, +dequeue, fence, or terminal record without a second effect. For every generated publisher +containment broker read vector, reject ordinal gaps and ordinal reuse; inject an executor abort +before the first request and before every next pagination request, prove zero open/operation +dispatch on each abort, and require ordinal `n+1` to start only after ordinal `n` has a signed +terminal transport record. A later recovery must use a fresh attempt and may never skip, duplicate, +or reorder containment inventory requests. + +For publisher, security-attestor, and release-finalizer credentials, inject loss before/after every +caller authorization, request dispatch, broker transport, safe success/failure projection, effect +dispatch, delivery resolution, token delete, unrecoverability/closure, audit-log append, ledger seal, +and reconciliation-only token close. Assert distinct operation keys/fingerprints, exact +request↔transport↔closure bijections, zero outstanding dispatch/live-token counters, denial of a +later mint, and recursive absence of token/PEM/canary bytes in every persisted or logged projection. +For both initial and correction release preparation, exercise a closed passing receipt separately +from every closed failure stage. A pass alone may construct the executable plan and then the +initial intent/effect authorization; a failure produces only its phase-exact invalidation and zero +executable plan, intent, or external effect. Include a minted-and-closed abort before the first GET, +an abort before each next GET, and prove request ordinal `n+1` can start only after ordinal `n` has a +signed terminal transport record; loss cannot skip, duplicate, or reorder the attestor inventory. + +Cover all six post-merge broker exceptions, both complete and invalid initial outcomes, correction +success, all four correction publication outcomes (`unmerged_invalid`, `merged_invalid`, +`fenced_write_ambiguity`, `reconciliation_unavailable`), ordinary and +reconciliation-unavailable release invalidation, and successful recovery from every durable +correction prefix. Assert invalidation never advances the latest pointer and a +new correction after `merged_invalid` explicitly supersedes the failed correction and contaminated +merge. Include current main exactly `M`, a protected first-parent descendant with no result touch, +an intervening result touch, missing/bypass per-rule suite, double-read movement, and every +`PostMergeAdmissionFailureV1.failed_predicates` member across all five failure kinds. Exercise +`postmerge_security_result=not_run|pass|failure` with its exact subject/attestor nullability and +reject an attestor call after an earlier structural predicate made it unauthorized. + +Exercise credential exposure before merge (pending CAS, every ordinal predecessor-bound effect +receipt, publisher-only close, terminal STOP, safe invalid prefix), after complete +merge before release (release blocked, no original tag/Release), and after `RELEASED` (historical +objects retained, latest withdrawn, containment recorded, superseding correction required). Assert +crashes after the pending CAS and every effect/external-response/receipt CAS adopt exact state, +simultaneous drift continues exposure from protected main without a drift-only STOP, exposure after +a sealed drift STOP uses the supplement flow, and no fixture or message claims historical erasure +or platform undeletability. Generate every hold-eligible state, dismissal, nondismissible STOP, and +postmerge hold consumer; assert each consumes the exact predecessor hold and every other edge is +blocked. Exercise moved/deleted tags, ruleset drift, fallback-member drift, temporary reads, and all +safe-invalid states under the protected-main liveness invariant. + +- [ ] **Step 4: Run tests and verify RED** + +Run: `uv run pytest tests/campaign/test_publication_reconstruction.py -q` + +Expected: FAIL until the fixture connects every Slice 4 interface and state event. + +- [ ] **Step 5: Implement the minimal deterministic offline fixture** + +Use no network, provider key, current time, random UUID, mutable branch lookup, or host-private path. +Freeze the raw bytes of every protocol closure object and safe API response/canonical projection, +repository ID and trust-boundary/settings records; the run, attempt, job, deployment, +approval, and artifact IDs for every hard-score/evidence/audit/analysis/collection/publication/release +stage; canonical timestamps; API JSON; Git author/tagger identity; deterministic USTAR bytes; +draft/upload/publish/immutable-release responses; and result assets in `publication_helpers.py`. +Make `fake_github.py` reject every endpoint outside Task 1's exact artifact/repository read +allowlist; Task 9/10's exact publisher branch/check/PR, terminal guard, queue/timeline GraphQL, +dequeue, rerun, compare/Git-object, check-suite/run, Actions-run/artifact pagination, validated 302, +and credential-free redirect-fetch endpoints; the three brokers' token mint/delete/denial-probe and +signed request/transport/closure lifecycle; and Task 11's enumerated immutable-setting, paginated +Release/asset read, annotated-tag, tag-ref, draft-Release, upload-host asset, and sole +draft-to-published endpoints. The fake external brokers, not the Actions-facing clients, own token +bytes and Authorization headers and expose only safe signed projections. It must model fully +paginated draft and asset listing, by-tag published +lookup, exact release-ID reads, immutable-Releases setting, rule-suite history, upload timeout/422/ +502 reconciliation, absent provider digest requiring download/hash, `starter` assets, and pinned +`gh release verify` output. + +- [ ] **Step 6: Run both reconstructions twice** + +Run: + +```bash +uv run pytest tests/campaign/test_publication_reconstruction.py -q +uv run pytest tests/campaign/test_publication_reconstruction.py -q +``` + +Expected: PASS twice with identical asserted bundle, publication-plan, proposed-head, release-plan, +tag object, merge receipt, accepted release append/phase receipts, +`ImmutableReleaseVerificationV1`, operation-set/no-later roots, terminal-finalization root, and +latest-pointer hash. + +- [ ] **Step 7: Commit offline publication reconstruction** + +```bash +git add tests/campaign/test_publication_reconstruction.py \ + tests/campaign/publication_helpers.py \ + tests/campaign/fake_github.py +git commit -m "test: reconstruct benchmark publication offline" +``` + +### Task 15: Lock live/offline stage separation and run repository verification + +**Files:** +- Create: `tests/campaign/test_evaluation_stage.py` +- Create: `tests/campaign/evaluation_stage_contract.py` +- Modify: `tests/campaign/test_workflow_policy.py` + +- [ ] **Step 1: Write the failing exact stage-ownership tests** + +In `test_evaluation_stage.py`, import a test-only `collect_evaluation_stage_contract` helper and +assert the exact offline command tuple is `hard-score`, `prepare-judge`, `seal-judge`, +`sample-audit`, `seal-audit`, `analyze`, `verify`, with every handler owned under +`laconian_eval.replay`. Assert the exact live tuple is: + +```text +laconian_eval.campaign.runtime.Runtime.hard_score +laconian_eval.campaign.runtime.Runtime.prepare_judge +laconian_eval.campaign.runtime.Runtime.seal_judge +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.sample_audit +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.seal_audit +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.analyze +laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.verify +``` + +Pin the only live constructors as private `_reconstruct_verified_runtime` and +`_reconstruct_verified_publication`. AST/import/call-graph assertions reject a replay handler that +imports either campaign constructor/capability, a live method that imports replay code, any shared +writer/mutation entrypoint, any serialized capability, and every live workflow invocation of +`laconian-benchmark`. The public console target remains `laconian_eval.cli:main` and routes only to +`laconian_eval.replay`. + +Extend `test_workflow_policy.py` with a whole-workflow zero-state-secret scan. Assert no workflow +contains an App/installation ID credential expression or secret mapping, private-key secret +expression, installation token, App-auth Authorization header, or opaque token handle for the state-writer, +publisher, or release-finalizer roles. Each broker-calling job has `id-token: write` only at the +exact job scope and receives only signed safe receipts; those receipts may include the +preregistered nonsecret App identity. Security-attestor and state-broker jobs contain only their +fixed OIDC bootstrap and secret-free broker client. A publisher or release-finalizer package job +may additionally contain only the exact bounded numeric artifact downloader and its transient +repository `GITHUB_READ_TOKEN` path: the token authenticates only the allowlisted numeric metadata/ +archive request and is stripped before a validated redirect fetch or any broker call. No other +repository-read helper, credential propagation, or package discovery is allowed. +Assert exactly +three pairwise-distinct App identities in the sealed registry, all keys/tokens confined to their +external measured brokers, and `security_attestor` reuses only the release-finalizer installation +through a distinct broker role and exact `administration:write`, `contents:read`, `metadata:read` +GET-only policy. Reject a repository-token substitute, local App key/token mapping, release write in +the attestor, or mutation endpoint. + +- [ ] **Step 2: Run the focused test and observe RED** + +Run: + +```bash +uv run pytest tests/campaign/test_evaluation_stage.py tests/campaign/test_workflow_policy.py -q +``` + +Expected: FAIL during collection because `tests/campaign/evaluation_stage_contract.py` does not yet +exist. + +- [ ] **Step 3: Implement the minimal test-owned contract collector** + +Create `evaluation_stage_contract.py` with deterministic AST traversal, console-script parsing, and +YAML scalar/path extraction. It accepts an explicit repository root, byte-sorts paths, follows no +symlink, executes/imports no candidate module, and returns only canonical tuples of module/function/ +workflow references. It contains no production adapter, compatibility alias, campaign constructor, +or writer. Add the exact zero-secret/path assertions to `test_workflow_policy.py`. + +If these new tests expose a production mismatch, return to Task 7, 10, or 12 and fix that owning +implementation before continuing; do not weaken the collector or add a live/public alias. + +- [ ] **Step 4: Run focused GREEN and all Slice 4 tests** + +```bash +uv run pytest tests/campaign/test_evaluation_stage.py tests/campaign/test_workflow_policy.py -q +uv run pytest \ + tests/campaign/test_github_records.py \ + tests/campaign/test_artifacts.py \ + tests/campaign/test_provider_evidence.py \ + tests/campaign/test_public_projection.py \ + tests/campaign/test_complete_collector.py \ + tests/campaign/test_invalid_prefix_finalizer.py \ + tests/campaign/test_publication_capability.py \ + tests/campaign/test_evaluation_stage.py \ + tests/campaign/test_publication_plan.py \ + tests/campaign/test_publication_delivery_resolution.py \ + tests/campaign/test_publication_terminal_containment.py \ + tests/campaign/test_publication_merge_queue.py \ + tests/campaign/test_publication_merge_fence.py \ + tests/campaign/test_publication_terminal_records.py \ + tests/campaign/test_publisher_credential_finality.py \ + tests/campaign/test_security_attestor_credential_finality.py \ + tests/campaign/test_release_authorization_graph.py \ + tests/campaign/test_release_finalizer_credential_finality.py \ + tests/campaign/test_reconciliation_unavailable.py \ + tests/campaign/test_minimal_publisher.py \ + tests/campaign/test_publication_pr.py \ + tests/campaign/test_audit_pr.py \ + tests/campaign/test_result_release.py \ + tests/campaign/test_docs_gate.py \ + tests/campaign/test_publication_workflows.py \ + tests/campaign/test_workflow_policy.py \ + tests/campaign/test_publication_reconstruction.py -q +``` + +Expected: PASS. + +- [ ] **Step 5: Run workflow/public contracts and repository quality gates** + +```bash +uv run pytest tests/test_ci_contract.py tests/test_public_contract.py tests/test_site.py tests/test_release_bundle.py -q +uv run ruff format --check . +uv run ruff check . +uv run mypy src +uv run pytest -q +git diff --check +``` + +Expected: every command exits 0; the workflow inventory is exactly 15 members and `git diff +--check` prints nothing. The test-owned scanner proves no state App credential reaches Actions, no +live workflow invokes a replay command, and every App key/token remains confined to its measured +external broker behind the exact OIDC-only boundary. + +- [ ] **Step 6: Commit the cross-slice contract tests** + +```bash +git add tests/campaign/test_evaluation_stage.py \ + tests/campaign/evaluation_stage_contract.py \ + tests/campaign/test_workflow_policy.py +git commit -m "test: lock benchmark live stage ownership" +``` + +Do not create a catch-all verification commit and never use `git add .`; any production correction +must use its owning task's exact files, focused GREEN command, and commit. + +--- + +## Repository settings prerequisite checklist + +These are maintainer actions outside the implementation commits. Inspect and record them in the +rollout evidence; do not mutate GitHub while executing this plan. + +- [ ] Keep repository default `GITHUB_TOKEN` permission at `read`. +- [ ] Enable repository enforcement that every action is pinned to a full-length commit SHA. +- [ ] Configure `benchmark-live` with required reviewer approval, prevent self-review, disable + administrator bypass, restrict deployments to `benchmark-input-*` tags, and retain only the + dedicated restricted `OPENAI_API_KEY` environment secret. +- [ ] Create `benchmark-publish` with required reviewer approval, prevent self-review, disable + administrator bypass, restrict deployments to protected `main`, and configure no provider + secret. +- [ ] Register three distinct GitHub Apps installed only on this repository and record their numeric + App/installation IDs, exact slugs/bot logins, repository ID, permission response, permissions- + attestation hash, creation owner, rotation owner, and private-key fingerprint. Require pairwise + distinct IDs/installations/bot logins/private keys: + - state writer, held only by the external OIDC broker: metadata read plus `contents: write`; no actions/deployments/PR/checks permission. + Because `contents:write` also makes Git reference and release endpoints technically reachable, + its fixed hashed tool may call only expected-OID CAS on `benchmark-authority/*`; result-tag rules, + immutable Releases, endpoint-policy tests, and before/after inventories detect any other use; + - publisher: the installation grant ceiling is Actions write, Checks write, Contents write, Merge + queues write, Metadata read, and Pull requests write. This is only the union needed to mint the + exact per-operation read/write rows; a token containing the union is forbidden. Each external + broker mint is downscoped to one literal §7.4 row, and its fixed tool never calls review/merge or + release endpoints outside that row. Result-tag rules and immutable Releases bound the release + surface, the result validator accepts only a preregistered non-bot maintainer review, and the + `main` ruleset excludes the App from merge; + - release finalizer: the installation grant ceiling is Administration write, Contents write, and + Metadata read; no Actions, Deployments, Pull requests, Checks, or Reviews grant. Every + release-effect token omits Administration and has only the exact applicable + `contents:write`, `metadata:read` row; reconciliation has only `contents:read`, `metadata:read`. + The separately brokered `security_attestor` token has the exact ordered permissions + `administration:write`, `contents:read`, `metadata:read`. Its fixed policy uses GitHub's + write-named Administration permission only for GET-only ruleset/immutable-settings observations + and grants no mutation endpoint. +- [ ] Configure the fixed `security_attestor` jobs in `.github/workflows/benchmark-publish.yml` and + `.github/workflows/benchmark-release.yml` to request respectively only the + `postmerge_rule_suite` and `release_preparation` caller rows from the external security-attestor + broker. That broker reuses the release-finalizer App installation but has its own measured vault + role/signing key; each job receives only signed safe pass/failure evidence and is not a fourth App. + No repository-token substitute, App ID/key credential input or secret mapping, installation token, + contents/release write token, App-auth Authorization header, opaque handle, or mutation endpoint + may reach either job; the safe receipt may carry only the preregistered nonsecret App identity. +- [ ] Configure the external state, publisher, release-finalizer, and security-attestor brokers' + exact repository/caller/OIDC policies and keep all three App private keys only in their measured + broker vaults. Create no App identity/key/token/handle Actions secret at repository, organization, + or environment scope and return no installation token to a runner. `benchmark-publish` stores no + `PUBLISHER_*` or `RELEASE_*` triple; its jobs authenticate to brokers only by OIDC. Do not create + `benchmark-state` or `benchmark-release` environments. Rotate any key exposed outside its intended + scope and update the attestation before dispatch. +- [ ] Commit and verify the strict one-entry `TagOperatorRegistryV1` at its C0 path, including the + exact operator numeric ID/login and canonical tagger identity bound by T0, T1, the companion tag + binding, campaign registry, and ordered security-evidence subjects. +- [ ] Create exactly two active disjoint protocol-tag rulesets over the exact T0/T1 patterns: the + creation-authorizer contains only `creation` and the frozen operator as its sole `User`/`always` + bypass actor; the immutability ruleset contains only `update` and `deletion` with an empty bypass + actor list. Reject every extra applicable/evaluate/disabled ruleset, rule, actor, role, team, App, + deploy key, exemption, pattern overlap, or ID collision. Capture unique historical creation suites + for both tags with raw top-level `result="bypass"` mapped to stable + `overall_result="bypass"`, stable `evaluation_result="fail"`, and per-rule `result="fail"`; archive + their safe response blobs. +- [ ] Create exactly two active result-tag rulesets over the same exact + `refs/tags/benchmark-result-*` pattern. The creation-authorizer contains only `creation` and has + the exact release-finalizer App installation as its sole `App`/`always` bypass actor. The + immutability ruleset contains only `update` and `deletion` and has an empty bypass list. Their + numeric IDs are distinct; no rule or bypass actor crosses between them, and no third applicable, + evaluate, or disabled ruleset exists. The publisher/state Apps, roles, teams, users, deploy keys, + and repository admins are not policy bypass actors. Tests prove GitHub bypass applies to the + entire containing ruleset, so combining creation with update/delete is rejected, along with ID, + pattern, target, enforcement, rule, or actor overlap/substitution. +- [ ] Enable GitHub immutable releases for the repository and capture the safe setting/API digest. + Require the release-finalizer App to create only a new draft, upload the two plan-bound assets, and + perform its one draft-to-published transition; after publication, neither that App nor any other + benchmark workflow identity is authorized to edit/delete the release or its assets. Re-fetch the + returned Release `immutable` field and bind `ImmutableReleaseVerificationV1` over the setting, + Release fields, and pinned `gh release verify` output before `RESULT_RELEASED`. Do not claim the + feature makes deletion or every metadata mutation impossible. +- [ ] Protect `benchmark-authority/*` from deletion, force-push, and human updates; permit only the + exact state-writer App installation to create or non-force fast-forward a ref after expected-OID + verification. Publisher/release Apps and Actions tokens cannot bypass it. +- [ ] Keep the repository-global **Allow GitHub Actions to create and approve pull requests** setting + disabled. Publisher-App authentication creates/closes the exact PR independently. Its + `pull_requests:write` token is API-capable of requesting a merge, so do not claim capability + absence: workflow/tool policy forbids that endpoint and the `main` ruleset makes every benchmark + App/Actions identity ineligible to merge. +- [ ] Create a result-branch ruleset matching `refs/heads/benchmark-result-pr/*`; permit only the + exact publisher App to create refs in that namespace. The fixed publisher tool and validator—not + the ruleset's static ref pattern—require the full name to equal the plan derivation + `benchmark-result-pr/{publication_id}-a{publication_attempt}-{base_sha[:12]}-{bundle_sha256[:12]}`; + forbid force-push, + deletion, reuse, and updates after its initial push. State/release Apps, Actions, and humans have no + bypass. Do not grant the publisher App `main` bypass. +- [ ] Add only the exact `laconian/publication-pr-validate` context to the protected `main` required + checks after its first recognized run, including `merge_group: checks_requested`. This is the sole + required check in `PublicationBranchRulesetPolicyV1`; preregister its GitHub Actions source App ID, + workflow path, and trusted workflow hash. Its one required-check member has exactly + `context="laconian/publication-pr-validate"`, `source_kind="Integration"`, that positive + `source_app_id`, `strict=true`, and `do_not_enforce_on_create=true`; reject a same-name context or + any substituted member field from another source. + `audit-pr-validate` and `benchmark-docs-validate` still run on every PR without path filters and + return explicit success when irrelevant, but they are not added to this exact ruleset policy. +- [ ] Enable the merge queue and freeze `PublicationBranchRulesetPolicyV1` with + `merge_queue_required=true`, method `MERGE`, grouping strategy `ALLGREEN`, minimum entries `1`, + wait time `0`, maximum entries `1`, and build concurrency `1`, plus positive + `merge_queue_check_response_timeout_seconds` exactly equal to `60 *` the observed GitHub + `check_response_timeout_minutes`. Direct/squash/rebase merge is forbidden. Capture the raw settings response and canonical + policy digest, then prove the `merge_group` check and one-entry queue/timeline evidence reproduce + those values before any admission receipt. +- [ ] On `main`, require one active repository-owned, non-inherited ruleset with + `allowed_ruleset_source_type="Repository"` and `enforcement="active"`; keep one required human PR + approval, `dismiss_stale_reviews=true`, `require_last_push_approval=true`, required conversation + resolution, enforced administrators, force-push/deletion prohibition, and a + restrict-updates/merge-actors rule allowing only the preregistered non-bot maintainer team. + Explicitly exclude all three benchmark Apps, GitHub Actions, and other bots from merge + eligibility; record the numeric maintainer IDs used by `PublicationMergeReceiptV1`. +- [ ] Set every benchmark Actions artifact to the repository maximum retention of 90 days and finish + every pre-merge lineage before any required artifact expires. At `RESULT_MERGED`, require the + accepted merge receipt and exact protected result tree; after that, expiry substitution is allowed + only through canonical authority mappings and those protected Git bytes and, after release, the + accepted append/finalization chain plus immutable tag/Release/assets. +- [ ] Verify the OpenAI key is project-scoped and restricted, the provider project has no unrelated + consumers, the project spend guard is set, and rotation/revocation ownership is recorded. +- [ ] Record environment approval actors through + `/repos/{owner}/{repo}/actions/runs/{run_id}/approvals`, numeric jobs through the run-attempt jobs + endpoint, and deployment identity through deployment statuses whose target URL binds the exact + run/job pair. +- [ ] Before each protected approval, compare the committed price snapshot with its frozen official + source URLs and record the reviewer attestation; do not approve if the rates cannot be verified. +- [ ] Before approving the publication PR workflow, verify the exact PR head SHA and sealed bundle + digest before approving the `benchmark-publish` environment deployment. After the App-authored PR + opens, verify the same head/bundle, submit the required human review, and only after the exact + required check succeeds enqueue that PR into the one-entry `MERGE` queue. Observe the merge only + through authenticated merge-group/queue evidence; never direct/squash/rebase merge. There is no + fork-workflow approval step. +- [ ] Before release approval, verify the exact merged tree, + `InitialPreauthorizedResultReleasePlanV1 | CorrectionReleaseIntentPlanV1`, derived + `ExecutableResultReleasePlanV1`, tag name, both asset digests, deterministic tag-object ID, + draft-to-published plan, immutable-release setting, and accepted publication-merge authority. +- [ ] Produce `RepositoryTrustBoundaryAttestationV1` plus its detached registered-reviewer signature + from the exact settings above. Bind repository/environment/ruleset IDs and safe API digests, App + identities/permissions, default read token, disabled global PR toggle, immutable releases, + required-check source provenance, retention, and capture actor/time. Re-fetch all readable records + and require a fresh signed admin-only settings observation before each pilot/confirmatory preflight; + commit only nonsecret projections, never tokens, PEMs, key values, or raw admin payloads. +- [ ] After `RELEASED`, revoke or rotate the benchmark key and record the safe result without storing + the key or provider dashboard secrets. + +## Completion criteria + +Slice 4 is complete only when all Task 15 commands are fresh and green, the offline complete and +invalid-prefix lineages reconstruct twice with identical hashes, the network-free importer +reconstructs every raw object in `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1` and every +receipt/blob digest, and a maintainer has reviewed the +repository-settings checklist without changing GitHub as part of implementation. No live provider +call, publication PR, result tag, GitHub Release, README result block, website result, release note, +or social package is created by executing this plan. +Acceptance additionally requires one unchanged Evaluation-owned +`audit_protocol_sha256: Sha256` across the verified Runtime registry, evidence inventory, aggregate +audit and analysis loaders, complete/invalid bundle lineage, `Publication` capability, +`PublicationPlanV1`, both preauthorized release-plan variants, and +`ExecutableResultReleasePlanV1`. Every consumer must prove the value came from +Runtime Task 2's verified peeled-C0 +`benchmarks/protocols/public-three-model-v1/audit.json` bytes; no Publication schema owns or aliases +the contract, and the exact `VerifiedProtocolAttestationV1` role-subject inventories remain +unchanged. Acceptance also requires the approved normative SHA and governance successor above, +strict CanonicalJSONV1 rejection vectors, the generated wildcard-free state/caller/effect matrix, +both authority roots null at every ordinary publication/release/correction/docs/social boundary, +and crash/replay tests for pending exposure, effect adoption, hold consumption, drift fallback, and +open-publication-PR close ordering. diff --git a/docs/superpowers/plans/2026-08-30-public-benchmark-roadmap.md b/docs/superpowers/plans/2026-08-30-public-benchmark-roadmap.md new file mode 100644 index 0000000..7034d04 --- /dev/null +++ b/docs/superpowers/plans/2026-08-30-public-benchmark-roadmap.md @@ -0,0 +1,426 @@ +# Public Three-Model Benchmark Implementation Roadmap + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Deliver, secure, rehearse, execute, audit, and publish the approved GPT-5.6 Sol/Terra/Luna benchmark without allowing incomplete evidence, uncontrolled spend, or premature public claims. + +**Architecture:** Four executable implementation slices establish the serial Git-native protocol-review DAG `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1` and a separate fail-closed campaign control plane. Evaluation/Audit first bootstraps the sole CanonicalJSONV1 attachment primitives imported by Foundations; Foundations then own the exact OpenAI request/evidence wire and sealed capsules. Evaluation/Audit also owns statements, verified envelopes, bundle/tag binding, raw-object archive, and offline replay. Runtime owns the authority schema, external OIDC broker, shared initial-publication/release wire, state-bound terminal-containment primitives, hold/drift/exposure state, provider controller, and three live evaluation methods. Publication imports those shared/state-bound types by object identity and owns the remaining terminal-containment algorithm/evidence, four live methods, and all operational branch, PR, merge, release, correction, and promotion effects. Live operations begin only after every code, GitHub, broker, provider-key, and pilot gate passes. + +**Tech Stack:** Python 3.11+, Pydantic 2, OpenAI Python SDK 3.3.1, NumPy PCG64, pytest/Ruff/mypy, GitHub Actions with full-SHA pins, OpenAI Responses API, strict CanonicalJSONV1, SHA-256 evidence, canonical Git SHA-1 objects, smart-HTTP receive-pack leases, descriptor-safe capsule/tar I/O, and protected Git tags/Releases. + +--- + +## Sources, approval, and fixed scope + +- Normative design: `docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md` at `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. +- Approval metadata: governance-only successor `d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad`, recording the maintainer/user's exact approval `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126` on 2026-08-31. +- Historical prior approvals: normative commits `55b90582ae461cf7a3dc072d53d8b03e79fb3614` and `46147ef62b5bb009421d58928e879d92247d84b5`, recorded respectively by `983471c1557a58a80065406e3a346e00c80f2aa3` and `0e2981e32b5d8982e78c73a5e413b36e2b1495e9`, remain evidence only for their superseded designs. +- Milestone 0 is complete. Slice implementation starts only after the synchronized roadmap plus four slice plans are committed and that already-created commit is recorded at handoff as `PLAN_BASE_SHA`. Any later normative design amendment re-blocks every affected task until separately and explicitly approved. +- Generation model IDs are exactly `gpt-5.6-sol`, `gpt-5.6-terra`, and `gpt-5.6-luna`; returned provider model IDs are recorded separately and must be consistent per requested-model campaign, not textually equal to the requested ID. +- Primary contrast is `concise - if`, independently per model. The plan is 3 models × 12 scenarios × 2 locales × 4 arms × 5 repetitions = 1,440 responses, projected into exactly 36 ordered 40-row shards. +- Full authorized request exposure is USD 75. Pilot exposure is USD 5 with at most 24 generation and 24 judge attempts and no retry. +- Promotion requires an active, nonwithdrawn latest pointer at `RELEASED`, null `unresolved_hold_root`, null active credential-exposure incident/progress fields, and no open incident or correction. `RESULT_MERGED`, `RELEASE_BLOCKED`, `INVALID_PREFIX_MERGED`, and `INVALID_PREFIX_MERGED_INVALID` never authorize a release claim, documentation, presentation, website, release note, or social post. + +## Plan set and dependency graph + +```text +Approved design 05e3d7ba + governance successor d6b147a (Milestone 0 complete) + | + v +Synchronized five-plan bundle recorded as PLAN_BASE_SHA + | + v +Slice 2 Task 1 — canonical attachment bootstrap + | + v +Slice 1 Tasks 1–12 + | + v +Interleaved Slice 2 Tasks 2–15 and Slice 3 Runtime at their explicit interface gates + | + v +Slice 4 — Publication + | + v +Offline reconstruction + two independent reviews + | + v +External trust setup -> live pilot -> confirmatory campaign -> human audit/merge/release + | + v +Post-RELEASED documentation, presentation, and social package +``` + +Detailed plans: + +This roadmap is a non-executable orchestration index. The four slice plans below are the executable +`superpowers:writing-plans` documents and contain the bite-sized RED/GREEN/commit steps. + +1. `docs/superpowers/plans/2026-08-30-public-benchmark-foundations.md` — 12 tasks. +2. `docs/superpowers/plans/2026-08-30-public-benchmark-evaluation-audit.md` — 15 tasks. +3. `docs/superpowers/plans/2026-08-30-public-benchmark-runtime.md` — 10 tasks. +4. `docs/superpowers/plans/2026-08-30-public-benchmark-publication.md` — 15 tasks. + +## Milestone 0: Approved protocol/security contract — complete + +- [x] Amend and independently review the normative design. +- [x] Bind literal `service_tier: "default"`, literal `prompt_cache_options: {"mode":"explicit","ttl":"30m"}`, recursive absence of `prompt_cache_breakpoint`, distinct cache-read/cache-write evidence and pricing, exact returned response paths and status vocabularies, SDK 3.3.1/`uv.lock`, and the `<=272_000` conservative input bound. +- [x] Bind the two-person audit registry, ordered three-person protocol registry, strict `ProtocolReviewStatementV1`, mode-discriminated `VerifiedProtocolAttestationV1`, `ProtocolAttestationBundleV1`, `ProtocolAttestationTagBindingV1`, serial reviewer commits, raw-object archive, authority-only in-memory generation capability, and exact generation seal roots. +- [x] Bind `CampaignStateSchemaV1`, external OIDC state broker, canonical Git object/receive-pack + lease protocol, `StateWriterGitIdentityV1`, exactly three Apps, protected one-entry merge-queue + admission, the separate `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` current-main authority row, + active-containment root and append-only successor merge denylist, terminal guard/dequeue/fence + barriers, durable initial/correction intents and receipts, the six post-merge success/failure + exceptions, invalid-event holds/dismissal, protocol drift, two-phase credential-exposure progress, + preauthorized/attested/executable release planning, closed broker-token finality, invalid-prefix + terminality, and seven-offline/seven-live entrypoint isolation. +- [x] Receive explicit maintainer approval for normative commit `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`; record it without changing normative behavior at governance successor `d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad`. + +## Plan synchronization gate + +- [ ] Commit the synchronized roadmap and all four executable slice plans together, then record that + already-created commit at implementation handoff as `PLAN_BASE_SHA`; do not place a future commit + SHA inside its own tree. +- [x] Verify no executable plan retains the superseded topology/type/provenance vocabulary: + +```bash +rg -n '(^|[^[:alnum:]_])Protocol[A]ttestationV1([^[:alnum:]_]|$)|ProtocolReview[A]ttestationV1|BenchmarkWorkflow[I]nventoryV1|require_no_unresolved_[h]old|at full SHA `46147e[f]|Normative design commit: `46147e[f]' docs/superpowers/plans/2026-08-30-public-benchmark-{foundations,runtime,evaluation-audit,publication}.md +``` + +Expected: no output; `rg` exits 1 because no stale term matches. + +- [x] Verify plan formatting and whitespace before recording `PLAN_BASE_SHA`: + +```bash +git diff --check +``` + +Expected: no output and exit 0. + +Cross-slice ownership is fixed: + +| Boundary | Sole owner | +|---|---| +| Versioned public benchmark request/policy, OpenAI wire/evidence, price schema, seals, shards, checkpoints | Foundations | +| CanonicalJSONV1 trio and neutral attachment primitives in `benchmark.attachments`; reviewer/workflow registries, protocol-subject Literal/mapping, statements, verified envelopes, serial reviewer DAG, bundle/tag binding, and `ProtocolReviewObjectArchiveV1` in `benchmark.protocol_review`; seven public offline commands | Evaluation/Audit | +| `CampaignStateSchemaV1`, state/authority and shared credential broker wire, `StateWriterGitIdentityV1`, initial-publication receipt/append wire, shared release effect/receipt/append wire, the six state-bound merge-denylist/terminal-containment primitives, hold/dismissal, drift/main fallback, exposure pending/progress/effect/final roots, containment-start event/root transitions, spend/batches, `Runtime.hard_score`, `.prepare_judge`, `.seal_judge`, reusable `benchmark-publication-state.yml` | Runtime | +| `Publication.campaign.evaluation_stage.sample_audit`, `.seal_audit`, `.analyze`, `.verify`, collection, terminal guard/queue/dequeue/fence/barrier/finality algorithms and all remaining Publication evidence types, merge admission, atomic postmerge hold consumers, open-PR exposure closure, executable release graph/finalizer closure, correction, documentation gate | Publication | + +The public console entrypoint remains `laconian_eval.cli:main`. Its exact offline tuple is +`hard-score`, `prepare-judge`, `seal-judge`, `sample-audit`, `seal-audit`, `analyze`, `verify`, and +every handler imports only `laconian_eval.replay`. Live authority is available only through the +three Runtime and four Publication methods above; no public campaign-authority console exists. + +The frozen workflow tuple is literal, ordered, and derived from verified C0 bytes: + +```text +.github/workflows/audit-pr-validate.yml +.github/workflows/benchmark-analysis.yml +.github/workflows/benchmark-audit.yml +.github/workflows/benchmark-batch.yml +.github/workflows/benchmark-collect-complete.yml +.github/workflows/benchmark-dismiss-hold.yml +.github/workflows/benchmark-docs-validate.yml +.github/workflows/benchmark-evidence.yml +.github/workflows/benchmark-finalize-invalid.yml +.github/workflows/benchmark-hard-score.yml +.github/workflows/benchmark-preflight.yml +.github/workflows/benchmark-publication-state.yml +.github/workflows/benchmark-publish.yml +.github/workflows/benchmark-release.yml +.github/workflows/publication-pr-validate.yml +``` + +## Milestone 1: Bootstrap canonical attachments and implement Foundations + +- [ ] Execute Evaluation/Audit Task 1 first and export its sole `benchmark.attachments` + CanonicalJSONV1 trio; then execute Foundations Tasks 1–12 in order with RED/GREEN/commit and + two-stage review per task. No interim or second canonical encoder/parser/error type is allowed. +- [ ] Preserve legacy `GenerationRequest` bytes; add a versioned benchmark-only request/policy carrying the exact tier/cache TTL contract. +- [ ] Pin OpenAI SDK 3.3.1 and exact C0 `uv.lock`; verify the exact nine-member request projection, + canonical request bytes, typed SDK request/response paths, installed/locked distribution, and + forbidden recursive cache keys before credential access or client construction. +- [ ] Carry the five non-null price dimensions, requested/returned IDs, exact response paths, separate status/source-digest fields, and ordinary-uncached input through manifest, plan, attempt, seal, replay, and verification. +- [ ] Freeze corpus neutrality/severity, three exact parent plans, 36×40 shards, seal/finalize, verified scored sidecars, and safe deterministic checkpoints. +- [ ] Obtain one capsule-integrity review and one hostile-archive/security review. +- [ ] Gate: + +```bash +uv run pytest -p no:cacheprovider tests/capsule tests/test_smoke_cases.py tests/test_openai_provider.py tests/test_providers.py -q +uv run ruff check src/laconian_eval/capsule src/laconian_eval/providers tests/capsule +uv run mypy src +``` + +Expected: all commands exit 0; pytest reports no failed/skipped required Foundations test, Ruff +prints no findings, and mypy prints `Success: no issues found`. + +## Milestone 2A: Complete Evaluation/Audit + +- [ ] Evaluation Task 1 is already complete as the Milestone 1 bootstrap. After Slice 1 verified + sealed/scorable evidence is available, execute Evaluation Tasks 2–15 in order. +- [ ] Implement strict CanonicalJSONV1; `TagOperatorRegistryV1`; two-entry stable `TagRulesetPolicyV1`; both reviewer registries; `ProtocolReviewStatementV1`; all three mode-discriminated `VerifiedProtocolAttestationV1` envelopes; `ProtocolAttestationBundleV1`; post-tag `ProtocolAttestationTagBindingV1`; `TagCreationRuleSuiteReceiptV1`; `ProtocolReviewObjectArchiveV1`; and fixed raw Git-object/signature verification. +- [ ] Construct and verify only `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1`: one fixed-path statement per reviewer commit, envelopes created only after their signed commit exists, B0 containing only the three envelopes/bundle delta, and both protected annotated tags created by the same registered operator. +- [ ] Bind every hard-score, judge, audit, analysis, and final evidence attachment to both registries, `protocol_attestations_root`, `ProtocolAttestationTagBindingV1`, the exact T0/T1 object identities and peeled C0/B0 commits, and the 15-member `WorkflowInventoryV1.workflow_root`. +- [ ] Require judge requests to use the same explicit/30m/no-breakpoint, SDK/lock, tier/cache evidence/status contract as generation. +- [ ] Implement fixed-denominator scoring, 10,000-vector PCG64 scenario bootstrap, outcome precedence, 144-record two-person audit, adjudication, weighted metrics, and exact false-fail certificates. +- [ ] Add only the seven offline replay handlers through `laconian_eval.cli:main`; prove the replay import/call graph contains no live capability or campaign constructor. +- [ ] Obtain one statistical-method review and one blind-judge/audit-protocol review. +- [ ] Gate: + +```bash +uv run pytest -p no:cacheprovider tests/benchmark -q +uv run ruff check src/laconian_eval/benchmark src/laconian_eval/replay tests/benchmark +uv run mypy src +``` + +Expected: all commands exit 0; pytest reports no failed/skipped required benchmark test, Ruff prints +no findings, and mypy prints `Success: no issues found`. + +## Milestone 2B: Implement Runtime + +- [ ] Execute the 10 Runtime tasks in order. Runtime Task 2 waits for Evaluation Task 3 types; Runtime Task 7 waits for Evaluation Tasks 4 and 8 evidence types. +- [ ] Generate state/event enums, transition table, evidence selectors, reachability, liveness, caller/ref/reason matrices, and broker policy from `CampaignStateSchemaV1` only; reject table-only, broker-only, wildcard, unreachable, cross-kind, or wedged edges. +- [ ] Implement `unresolved_hold_root`, strict hold/dismissal plan and caller identity, the four atomic hold consumers, `protocol_authority_drift`, protected-main fallback/freeze, and the universal fresh pair/policy/registry gate. +- [ ] Implement both active credential-exposure fields, provisional/permanent denylist members, `CREDENTIAL_EXPOSURE_PENDING`, ordered effect receipts, calculated predecessor-linked progress roots, terminal chain equality, final STOP/supplement consumption, and exposure-over-drift precedence. +- [ ] Add the campaign-state `active_publication_terminal_containment_root`, the exact + `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` event and current-main broker row. Runtime Task 3 is the + sole owner in `campaign.publication_wire` of `PublicationMergeDenylistEntryV1`, + `PublicationMergeDenylistV1`, `PublicationTerminalContainmentPreflightV1`, + `PublicationPreContainmentTerminalRouteV1`, `PublicationTerminalContainmentIntentV1`, and + `PublicationTerminalContainmentFinalityV1`; Publication imports them by object identity. Reject + shadow schemas, wildcard callers, non-monotone denylist changes, and a terminal transition that + fails to clear the matching active root while preserving the successor denylist. +- [ ] Store the state-writer App key only in the external broker. Actions has no state key/token secret. The minimal reusable writer job performs only OIDC bootstrap plus the pinned broker client and receives no installation token. +- [ ] Build exact canonical SHA-1 blob/tree/commit objects with frozen identity bytes and publish only through smart-HTTP receive-pack using all-zero expected-absent bootstrap or exact-old-OID successor leases; reconcile absent/exact/divergent response-loss outcomes. +- [ ] Bind five-component default-tier reservations and trusted charges; no long-context price class can authorize, reserve, or reconcile spend. +- [ ] Allow automatic retry only for a proven no-result/no-usage 429 whose tier/applied/read/write statuses are the matching `not_applicable_definitely_rejected` values. +- [ ] Implement the three private Runtime live methods and prove no serialized capability and no dependency on replay handlers. +- [ ] Create `.github/workflows/benchmark-publication-state.yml` in Runtime Task 9. Prove four-job + provider separation and the exact three-App topology. In the same task, bootstrap the canonical + `campaign.release` security-attestor records, safe `campaign.release_broker` verifier, secret-free + OIDC client, and `benchmark-preflight.yml` `preflight_rulesets` job/row. Its external broker reuses + the release-finalizer installation, returns permissions exactly `administration:write`, + `contents:read`, and `metadata:read`, closes the token before returning safe evidence, and has a + GET-only endpoint policy. +- [ ] Obtain one state/accounting review and one OIDC/Actions/authority review. +- [ ] Gate: + +```bash +uv run pytest -p no:cacheprovider tests/campaign tests/capsule tests/test_openai_provider.py tests/test_ci_contract.py -q +uv run ruff check src/laconian_eval/campaign tests/campaign .github/workflows +uv run mypy src +``` + +Expected: all commands exit 0; pytest reports no failed/skipped required campaign test, Ruff prints +no findings, and mypy prints `Success: no issues found`. + +## Milestone 3: Implement Publication + +- [ ] Execute all 15 Publication tasks after stable Slice 1–3 types exist. +- [ ] Publication Task 7 creates `campaign/publication.py`, the private constructor, and four exact live methods; it modifies the reusable state workflow created by Runtime Task 9. Task 8 modifies those interfaces. +- [ ] Publication Task 10 imports, class-bound revalidates, and does not re-export the six Runtime-owned state-bound + merge-denylist/containment primitives by object identity; it owns the terminal algorithm and all + remaining branch/marker/check/queue/guard/dequeue/fence/barrier/finality evidence types. Runtime + must not import a Publication-owned algorithm/evidence type into its state schema. +- [ ] Publication Task 10 extends the Runtime-created attestor substrate only with the + `postmerge_rule_suite` caller row; Task 11 adds only `release_preparation` and the + release-finalizer operation rows. The exact caller jobs are `security_attestor`, + `publisher_effect`, `publication_terminalizer`, and `release_finalizer`; no later task changes the + already frozen preflight workflow. +- [ ] Keep complete and invalid-prefix plans/states/events disjoint. Invalid-prefix publication ends at `INVALID_PREFIX_MERGED` or `INVALID_PREFIX_MERGED_INVALID` and can never create a result release, correction, documentation, presentation, or social effect. +- [ ] Persist intent before every initial/correction branch, PR, tag, draft, asset, publish, finalization, or invalidation effect; test create-or-adopt/reconcile at every response-loss and receipt-CAS window. +- [ ] Admit only `merge_commit` with parents `[base, head]` and exact tree. Persist `PostMergeAdmissionEvidenceV1` or `PostMergeAdmissionFailureV1`, including double-read current main, unchanged result subtree for a verified first-parent descendant, approvals/checks/actor, and timely historical passing non-bypass rule-suite evidence. +- [ ] Cover all six post-merge broker exceptions: the three success events `RESULT_MERGED`, + `INVALID_PREFIX_MERGED`, `CORRECTION_MERGE_RECORDED`, and the three phase-bound failure events + `RESULT_MERGE_INVALIDATED`, `INVALID_PREFIX_MERGE_INVALIDATED`, and + `CORRECTION_INVALIDATED(kind="correction_publication_invalidation", + publication_outcome="merged_invalid")`. +- [ ] Implement the separate terminal-containment algorithm for every active initial/correction + publication prefix in this order: reconcile ordinary transports and freeze the exact ordinary or + write-ambiguity source; build preflight/route/intent, append every candidate selector to the + permanent successor denylist, and seal publisher ledger/vault prefixes with zero outstanding + requests, dispatches, or live tokens; accept exactly one expected-OID + `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` CAS (`null -> intent_sha256`) before any guard/dequeue/ + fence action; run at most eight stable global guard rounds; construct the exact two-inventory + `PublicationTerminalMergeBarrierV1`, including authenticated dequeue/timeline and, only when + needed and pilot-proven, a fresh failed `merge_group` validator run; double-read protected `main` + and walk its complete first-parent chain; construct the one source-class-matching premerge or + merge-won `PublicationTerminalContainmentFinalityV1`; then apply one phase-exact terminal CAS that + clears only the matching active root and preserves the successor denylist forever. While the root + is active, deny constructive mint, enqueue/merge admission, release authorization, a new + publication/correction intent, exposure/hold state changes, and unrelated successors. +- [ ] Every active-prefix `no_pr|closed`, write ambiguity, and reconciliation-unavailable route must + pass through containment; it cannot use a direct root-null terminal edge. Ordinary premerge and + merge-won finality carry the exact stable `PublicationNoLaterEffectsEvidenceV1` where required. + Write-ambiguity and reconciliation-unavailable variants instead bind their strict sealed + failure-only evidence and never fabricate stable external state, object absence, or a no-later + root. Any merge observed before terminal CAS switches to the phase-exact failed-admission route. +- [ ] Freeze the exact five `PostMergeAdmissionFailureV1.failure_kind` members: + `ordinary`, `protocol_authority_drift_race`, `credential_exposure_race`, + `reconciliation_unavailable`, and `publication_write_ambiguity_merge_race`. Freeze the independent + 19-member schema-ordered `failed_predicates` vocabulary: + `unexpected_merge_parent`, `unexpected_merge_method`, `pr_identity_mismatch`, + `base_oid_mismatch`, `head_oid_mismatch`, `result_tree_mismatch`, + `checks_or_approvals_invalid`, `merge_actor_invalid`, `historical_rules_invalid`, + `main_containment_invalid`, `workflow_root_mismatch`, `observation_inconsistent`, + `publication_prefix_not_admitted_before_merge`, `publication_close_lost_to_merge`, + `publication_reopened_after_close`, `protocol_authority_drift`, + `credential_exposure_race`, `publication_reconciliation_unavailable`, and + `publication_write_ambiguity_merge_race`. Tests exhaust every predicate under its allowed failure + kind and strict source class (`normal_postmerge_admission`, `ordinary_terminal_disposition`, or + `write_ambiguity`), all current-main descendant/movement branches, attestor pass/failure/not-run + nullability, and every terminal consumer. +- [ ] Implement both acyclic release graphs. Initial is + `InitialPreauthorizedResultReleasePlanV1 -> closed passing SecurityAttestorReceiptV1 -> ExecutableResultReleasePlanV1(intent_kind="initial") -> ResultReleaseIntentV1`. + Correction is original prepublication `CorrectionIntentV1` with nested + `CorrectionReleaseIntentPlanV1` -> publication receipt -> admitted correction merge -> closed + passing security-attestor receipt -> `ExecutableResultReleasePlanV1(intent_kind="correction")`; + there is no second correction intent. A failing attestation feeds only phase-exact invalidation. + Initial tag target is the admitted initial merge; correction tag target remains the original + intent's deterministic approved head, while the observed correction merge stays mandatory + admission/lineage evidence and cannot retarget the tag. + Follow with phase-exact delivery resolutions and accepted receipt wrappers, + `ReleaseFinalizerOperationSetV1`, `ReleaseNoLaterEffectsEvidenceV1`, and exactly one initial or + correction finalization/invalidation. Every publisher, security-attestor, and release-finalizer + credential subject has a signed request-start before every dispatch, terminal transport receipt, + append-only phase ledger/vault log, and exactly one terminal disposition; request ordinal `n+1` + cannot dispatch until `n` is terminal. A mint followed by abort before the first or next request + closes as a signed minted-and-closed zero-request disposition; delivery unknown requires the + broker-signed unrecoverability proof and zero operation dispatches. Terminal evidence recomputes + zero outstanding requests/dispatches/live tokens, denies later mint and same-token post-boundary + dispatch, and archives only canary-free safe projections. +- [ ] Reconcile releases with fully paginated authenticated draft lookup, exact-ID reads, published-only by-tag recovery, upload-host asset POST, paginated asset listing, and the sole draft-to-published PATCH. Treat timeout/422/502 with relist/adopt; divergent or `starter` assets terminate. +- [ ] Verify the immutable-Releases setting, exact Release fields/assets, pinned tool digest, and `gh release verify` output as `ImmutableReleaseVerificationV1`; make no claim that a Release or Git history is undeletable. +- [ ] Handle credential exposure before publication, with a complete PR open, after merge, and after release; close an open complete PR, withdraw latest after release, preserve immutable history truth, and require a clean corrected lineage before promotion. +- [ ] Admit a nonnull hold only to the four exact atomic consumers: dismissal; premerge typed STOP; held `RESULT_MERGED -> RELEASE_PLAN_INVALIDATED`; and held `RELEASED -> CORRECTION_INTENT_AUTHORIZED`, each binding and clearing the predecessor hold while every other publication/release/correction edge requires null hold and active-progress roots. +- [ ] At `COMPLETE_PUBLICATION_PR_OPEN`, require credential pending CAS, publisher-only closure of that exact PR, ordered close-effect receipt, and final credential STOP; a merge race switches only to the existing postmerge invalidation/correction path. +- [ ] Obtain one supply-chain/publication review and one complete-DAG review. +- [ ] Gate: + +```bash +uv run pytest -p no:cacheprovider tests/campaign tests/benchmark tests/test_ci_contract.py tests/test_release_bundle.py -q +uv run ruff format --check . +uv run ruff check . +uv run mypy src +``` + +Expected: all commands exit 0; pytest reports no failed/skipped required publication test, Ruff +prints no formatting/lint findings, and mypy prints `Success: no issues found`. + +## Milestone 4: Full offline synthetic rollout + +- [ ] Reconstruct the complete T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 object closure and raw-object archive, then all 36 generation capsules, 36 hard-score sets, 36 judge attachments, audit, analysis, complete bundle, publication intent/plan/receipt prefixes, queue/guard/fence/containment evidence, merge admission, both variants of the preauthorized→attested→executable release graph, accepted release receipt wrappers, operation-set/no-later evidence, terminal finalization, and final active latest pointer without provider or network access. +- [ ] Exercise the full matrix: paired-tag creation-suite replay/recreation and update/delete-bypass rejection; malformed reviewer DAG/signature/archive vectors; 429 exact retry; definitely rejected terminal; zero-call judge attachment; partial resume; every STOP parent/reason/caller allow and deny; all hold/dismissal consumers; moved/deleted/drifted-tag main fallback; budget exhaustion; both invalid-prefix merge outcomes; complete merge success/failure; all six post-merge exceptions; every terminal-containment source/prefix and queue/guard/dequeue/fence/current-main branch; all five failure kinds, all 19 schema-ordered failure predicates, and security-attestor result nullability; both correction invalidation families and all four publication outcomes; correction success from `RELEASE_BLOCKED` and `RELEASED`; every branch/PR/tag/draft/asset/publish effect-response/receipt-CAS loss window; every publisher/security-attestor/release-finalizer request, response-loss, closure, no-mint, minted-abort-before-first/next-request, post-boundary-dispatch denial, and reconciliation-unavailable window; expected-absent and competing receive-pack races; paginated draft and asset reads; timeout/422/502 reconciliation; divergent and `starter` assets; and credential exposure before/during/after drift, with complete PR open, after merge, and after release, including every pending-progress crash point and cross-pending/campaign/incident rejection. +- [ ] Rebuild the human report only from published-style artifacts and compare every checksum. +- [ ] Scan every synthetic artifact for canaries, credential patterns, environment dumps, private paths, unsafe Markdown/HTML, duplicate paths, and unbound files. +- [ ] Run twice from clean temporary roots: + +```bash +uv sync --all-extras --dev +uv run pytest -p no:cacheprovider -q +uv run pytest -p no:cacheprovider -q +uv run ruff format --check . +uv run ruff check . +uv run mypy src +git diff --check +``` + +Expected: dependency sync exits 0; both pytest runs pass with identical required test counts and no +live calls; Ruff/mypy exit 0 with no findings; `git diff --check` prints nothing. + +- [ ] Record commit/platform/timestamps/exit/test count for both runs and obtain two independent reviews with no unresolved P0/P1 finding. + +## Milestone 5: Configure external trust boundaries + +This milestone changes external state and needs explicit maintainer authorization at execution time. + +- [ ] Confirm by secret-name/presence metadata only that `benchmark-live` contains `OPENAI_API_KEY`; never retrieve or print its value. Independently attest restriction, spend guard, sole consumers, and rotate/revoke procedure. +- [ ] Protect `benchmark-live` and `benchmark-publish` with required reviewers, no self-review/admin bypass, and approved deployment refs. Keep repository `GITHUB_TOKEN` read-only and global Actions PR approval disabled. +- [ ] Register exactly three pairwise-distinct repository-scoped Apps: state writer, publisher, and + release finalizer. All App private keys and installation tokens exist only in their measured + external broker vaults; `benchmark-publish` and every other Actions scope contain no App credential + secret and authenticate to brokers only by exact job-scoped OIDC. The release-finalizer + installation includes `administration:write`, while the separate `security_attestor` broker role + mints its token downscoped in canonical order to `administration:write`, `contents:read`, and + `metadata:read`. Although `administration:write` is GitHub's required permission name for the + immutable-Releases setting endpoint, the attestor's fixed endpoint/query policy grants no mutation + path; signed safe receipts may retain the preregistered nonsecret App identity. +- [ ] Protect `benchmark-authority/*` for brokered expected-old-OID receive-pack only; protect result branches and `main` with exact actors/checks and human merge. Configure exactly two disjoint tag-pattern rulesets for T0 and T1: the one registered `User/always` operator may bypass creation only, while update and deletion have zero bypass actors. Both tags are annotated-only and immutable after creation. Enable immutable Releases and record the setting without claiming object undeletability. +- [ ] Register the workflow-backed `laconian/publication-pr-validate` required check with exact + GitHub Actions source App and C0 workflow hash on both `pull_request` and + `merge_group:checks_requested`; publish it on the PR head or temporary merge-group SHA + respectively. The publisher-App terminal guard is evidence consumed by that validator, not a + base required-check context. Freeze a repository-owned active `PublicationBranchRulesetPolicyV1` + with one-entry `MERGE`/`ALLGREEN`, minimum/maximum entries `1`, zero minimum wait, build + concurrency `1`, exactly that one strict required check, no protected-main bypass/direct merge, + and a positive check-response timeout whose seconds equal exactly `60 *` the observed GitHub + `check_response_timeout_minutes`; publisher bypass exists only for the deterministic head pattern. Observation uses + `includes_parents=false` and rejects inherited/unlisted rulesets. Retain historical passing rule + suites promptly and confirm 90-day artifact retention. +- [ ] Capture and independently sign the safe repository trust record, including exact three-App permissions, OIDC broker policy, returned attestor permissions, stable two-ruleset policy, both unique historical creation rule suites, immutable setting, actors, and timestamps—never tokens, keys, PEMs, or raw privileged responses. A creation receipt requires zero matching earlier creation suites and exactly one matching after-OID suite; replay, deletion/recreation, ambiguous suites, update, or delete operations fail closed. + +No live provider workflow may run until this milestone is complete and reviewed. + +## Milestone 6: Run the non-evidentiary live pilot + +- [ ] Freeze pilot C0, derive the literal 15-member `WorkflowInventoryV1`, activate both pilot tag-pattern rulesets, and have the registered operator create protected annotated pilot T0 peeling exactly to C0 with its unique creation-suite receipt. +- [ ] Add and commit-sign Rstat, Rjudge, and Rsecurity serially in registry order; create envelopes only after each signed commit; create B0 with only the three envelopes and `ProtocolAttestationBundleV1`; have the same operator create protected annotated pilot T1 on B0 with its own unique creation-suite receipt. +- [ ] Run secret-free pilot preflight: double-read both refs/policy, verify the complete raw Git closure/archive, signatures, stable ruleset policy, creation suites, `ProtocolAttestationTagBindingV1`, campaign registry, SDK/lock, price evidence, `StateWriterGitIdentityV1`, and generation-context expectation before approving provider jobs. +- [ ] Verify at most 24 generation and 24 judge attempts, zero retry, USD 5 exposure, exact explicit/30m/default wire, response paths/statuses/digests, returned-model consistency, checkpoints, and broker receipts. +- [ ] Run the disposable live platform pilot for terminal containment: create a one-PR + `MERGE`/`ALLGREEN` queue; prove complete two-pass global inventory and an observable `LOCKED` + entry; dequeue exactly, re-enqueue under a new merge group, and authorize a rerun retaining the + workflow-run ID with `run_attempt == source_run_attempt + 1`; prove the fresh failed required + validator removes or blocks the entry and the permanent denylist fails every later group. Accept + an unrelated protected-main descendant only through a complete first-parent walk whose every + advance is the rollout-proved two-parent queue merge, and reject a synthetic single-parent + advance. Capture the real artifact API 302, strip Authorization/cookies before following the one + allowlisted Location, safely extract the unique decision JSON from the bounded ZIP, and probe + every required App endpoint/permission. Any unsupported queue state, timeline, rerun, redirect, + same-SHA validator, or permission behavior blocks Milestone 7; it never weakens the contract. +- [ ] Treat pilot output as operational evidence only. Any protocol or implementation change creates a new pilot T0/T1 pair, reviewer commits, envelopes, B0, bundle and tag binding; pair-specific objects are never reused, though identical content-addressed C0 subobjects may recur. Revoke or rotate the key when incident policy requires. + +## Milestone 7: Execute the confirmatory campaign + +- [ ] After implementation is frozen and reverified, construct the final pair in exact order: activate both final tag rulesets; registered operator creates annotated T0 on frozen C0; Rstat/Rjudge/Rsecurity add one signed statement commit each; verifier creates B0 with only envelopes/bundle delta; the same operator creates annotated T1 on B0; persist both unique creation suites. +- [ ] Preflight double-reads both refs/policy, verifies the complete T0/C0/reviewer/B0/T1 closure, raw-object archive, registries, statements, signatures, envelopes, bundle/root/tag binding, 15-member workflow root, 1,440 rows, 36×40 partition, requested models, first-batch fit, and USD 75 cap before authority bootstrap or credential access. +- [ ] Approve each generation and judge batch separately; before the next approval verify authority OID, state/hold, spend/inventory, receipt, and exact suffix. Seal all 36 generation, hard-score, and judge attachments. +- [ ] On STOP, budget exhaustion, ambiguity, missing authority, or credential incident, make zero later calls/downloads and take only the schema-authorized invalid-prefix/containment route. +- [ ] Rotate or revoke the provider key after the final provider batch and immediately on credential incident. + +## Milestone 8: Audit, analyze, collect, publish, and release + +- [ ] Seal the provider inventory, complete the two identity-bound commit/reveal chains and adjudication, then seal deterministic analysis and three independent model outcomes. +- [ ] Collect only a complete bundle; otherwise finalize only the safe invalid prefix. +- [ ] Authorize initial publication intent before the exact publisher branch/PR effects. Human review + and the protected one-entry `MERGE`/`ALLGREEN` merge queue are mandatory; reconstruct queue/guard/fence, + publication-success finality, post-merge evidence/failure, and the applicable one of six + post-merge events. If terminalization starts first, persist the separate containment-start event + before guard/dequeue/fence work and finish only through its exact barrier/current-main/finality + terminal route, preserving the denylist and clearing the active root. +- [ ] For a valid complete merge, build the immutable preauthorized plan, obtain the purpose-bound + closed passing security-attestor receipt, derive the executable plan, and authorize the initial + `ResultReleaseIntentV1` before the + exact tag/draft/assets/publish effects. Reconcile every crash window, close every attestor/finalizer + token and ledger, prove no later effects, and transition to `RELEASED` only through the exact + terminal finalization. +- [ ] A correction is append-only original intent with nested `CorrectionReleaseIntentPlanV1` → + publication → admitted merge, followed by exactly one disjoint branch: closed passing + security-attestor receipt → executable plan → tag/release receipts → finalization; or closed + failure evidence → phase-specific invalidation with no executable plan/effect. There is no second + correction intent, and the observed merge cannot retarget the preauthorized approved-head tag. A + new correction after `merged_invalid` explicitly supersedes the failed correction and + contaminated merge; prior latest remains unchanged until successful finalization. + +## Milestone 9: Present the released result + +- [ ] Require `RELEASED`, active/nonwithdrawn latest pointer, null `unresolved_hold_root`, null active credential-exposure incident/progress and publication-containment roots, no open incident or correction, and fresh verification of the exact terminal finalization, accepted release receipt chain, immutable external objects, and zero-live-token no-later evidence. +- [ ] Update localized READMEs, `evals/README.md`, website, changelog, dated release note, presentation, and social package only from the committed complete bundle. Keep historical alpha material unchanged. +- [ ] Every number names model, campaign, interval, gate, denominator, confidence interval, and limitations; explain positive `concise - if`; never call visible-token reduction billed-output, total-token, monetary, or universal savings. +- [ ] Invalid-prefix terminal outcomes remain only in their reviewed authority/incident history; they + trigger no release, documentation, site, presentation, release-note, social, or correction effect + and never enter this promotion milestone. + +## Completion definition + +Implementation is complete when all four slice plans, synthetic reconstruction, quality gates, and two independent reviews are green. A result campaign is publishable only when its complete lineage is `RELEASED`, active and nonwithdrawn, public checksums are durable, provider credentials are contained as planned, and every public claim derives from that exact bundle. Positive, negative, and inconclusive model outcomes are acceptable; invalid-prefix outcomes remain incident evidence rather than releases. diff --git a/docs/superpowers/plans/2026-08-30-public-benchmark-runtime.md b/docs/superpowers/plans/2026-08-30-public-benchmark-runtime.md new file mode 100644 index 0000000..dfd7990 --- /dev/null +++ b/docs/superpowers/plans/2026-08-30-public-benchmark-runtime.md @@ -0,0 +1,3249 @@ +# Public Three-Model Benchmark Campaign Runtime Implementation Plan + +> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. + +**Goal:** Add the fail-closed campaign authority, exact spend accounting, bounded batch planning, closed retry policy, resumable provider controller, and GitHub Actions credential boundary required to run the pilot and three-model campaign. + +**Architecture:** Keep a campaign control plane beside, not inside, the generation capsule. `CampaignStateSchemaV1` is the sole source for states, events, evidence discriminators, caller/ref policy, reachability, and terminality; generated Python projections and broker policy are checked against that one schema. GitHub Actions never receives a state-writer App key or installation token. Its fixed reusable state job presents GitHub OIDC plus a canonical mutation request to an external broker, and the broker alone constructs canonical Git SHA-1 objects and advances the protected authority ref through smart-HTTP `receive-pack` with an exact old-OID lease. A secret-free prepare job reserves exact worst-case exposure and seals one contiguous `BatchPlanV1`; the protected read-only provider job reconstructs the winning receipt before its single controller step maps `OPENAI_API_KEY`. Live hard-score and judge sealing are available only through an in-memory authority capability and the three private Runtime methods. + +**Tech Stack:** Python 3.11+, Pydantic 2 strict/frozen models, integer micro-USD arithmetic, existing canonical JSON and descriptor-bound capsule primitives, pytest, Hypothesis-free deterministic property loops, Ruff, mypy, GitHub Actions with full-SHA pins, and the OpenAI Responses adapter with SDK retries disabled. + +--- + +## Execution contract + +- Approved design: `docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md`, especially Sections 6.2, 6.5–6.6, 7, 8, 12, 14, and 16. +- Normative design commit: `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. +- Maintainer approval record: governance-only commit + `d6b147aefb0bab0e64a41541a67e2c1b8f4d00ad`, recording the exact user message + `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126` on 2026-08-31. +- Milestone 0 is approved. Runtime implementation is unblocked only after this synchronized plan is + reviewed and committed; pilot and publication gates remain closed until their named tests and + reviews pass. +- Any future normative amendment re-blocks every affected Runtime task until that amendment receives + separate explicit maintainer approval recorded by commit; implementation or live work may not + infer approval from this plan sync. +- Master roadmap: `docs/superpowers/plans/2026-08-30-public-benchmark-roadmap.md`. +- Prerequisite slice: `docs/superpowers/plans/2026-08-30-public-benchmark-foundations.md`. +- Evaluation types consumed by judge-phase batches: `docs/superpowers/plans/2026-08-30-public-benchmark-evaluation-audit.md`. +- This slice does not publish repository content, create releases, or implement statistical estimators. +- The provider controller has repository read permission only. The only step that receives `OPENAI_API_KEY` is the repository-owned controller invocation after receipt consumption. +- Every money value is an integer count of USD micro-units. Floats and binary floating-point conversions are forbidden in scheduling, reservation, reconciliation, and cap checks. +- The full campaign cap is exactly `75_000_000` micro-USD. The pilot cap is exactly `5_000_000` micro-USD. +- Confirmatory generation permits at most five 429 retries per request; the pilot permits zero. No other automatic retry class exists. +- The Actions hard timeout is 180 minutes. The controller soft deadline is 165 minutes from its monotonic start and must leave a verified checkpoint before a resumable exit. +- Every state-mutation caller uses literal concurrency group `laconian-public-benchmark-state` and + `cancel-in-progress: false`; the external broker additionally enforces the exact authority old-OID + lease, so workflow concurrency is never treated as the CAS. +- Every task uses focused RED, observes the named failure, implements the minimum GREEN behavior, runs the stated regression gate, and commits before the next task. + +## File boundary + +```text +src/laconian_eval/campaign/__init__.py public campaign types only +src/laconian_eval/campaign/models.py shared strict scalars and GitHub identities +src/laconian_eval/campaign/artifact_wire.py cross-slice inner artifact envelope/authorization +src/laconian_eval/campaign/tag_binding.py exact paired annotated-tag and raw Git-object verification +src/laconian_eval/campaign/preflight.py stable campaign registry and exposure seal +src/laconian_eval/campaign/state_schema.py sole canonical CampaignStateSchemaV1 source +src/laconian_eval/campaign/state.py generated state/event models and pure transitions +src/laconian_eval/campaign/state_broker.py OIDC request/receipt types and closed caller policy +src/laconian_eval/campaign/authority_git.py canonical SHA-1 objects and receive-pack lease verifier +src/laconian_eval/campaign/authority.py trusted-chain reconstruction and pure mutation packages +src/laconian_eval/campaign/broker_wire.py shared cycle-free broker policy/signing registry wire +src/laconian_eval/campaign/publication_wire.py Runtime-owned initial-publication receipt/append wire +src/laconian_eval/campaign/release_wire.py sole shared release effect/receipt/append wire +src/laconian_eval/campaign/release.py canonical security-attestor substrate, extended by Publication +src/laconian_eval/campaign/release_broker.py safe attestor policy verifier; no token-bearing vault code +src/laconian_eval/campaign/spend.py exact reservations and reconciliation ledger +src/laconian_eval/campaign/retry.py closed retry taxonomy and deterministic backoff +src/laconian_eval/campaign/batch.py bounded prefix plan and single-use job receipt +src/laconian_eval/campaign/controller.py sequential generation/judge orchestration +src/laconian_eval/campaign/benchmark_adapter.py neutral context/attempt artifact adapters +src/laconian_eval/campaign/runtime.py private authority capability and three live methods +src/laconian_eval/providers/base.py structured status and Retry-After evidence +src/laconian_eval/providers/openai.py fail-closed OpenAI error classification +src/laconian_eval/capsule/attempts.py policy-neutral campaign-compatible backoff evidence +src/laconian_eval/capsule/execution.py one-attempt execution seam used by controller +tools/benchmark_capture_trust_boundary.py read-only safe repository-settings snapshot +tools/benchmark_preflight_stage.py fixed secret-free preflight adapter +tools/benchmark_prepare_batch.py fixed secret-free batch preparer +tools/benchmark_run_batch.py sole step-scoped provider-key controller +tools/benchmark_post_batch.py fixed key-free result/authority adapter +tools/benchmark_hard_score_stage.py authority-verified hard-score/prepare-judge tool +tools/benchmark_seal_judge_stage.py authority-verified seal-judge tool +tools/benchmark_state_broker_client.py fixed OIDC/mutation client; receives no App token +tools/benchmark_release_broker_client.py fixed secret-free attestor OIDC client +.github/workflows/benchmark-preflight.yml secret-free tag/preflight dispatch +.github/workflows/benchmark-batch.yml prepare/provider/state-writer bounded batch +.github/workflows/benchmark-dismiss-hold.yml no-input approved benign-hold recovery +.github/workflows/benchmark-publication-state.yml minimal reusable OIDC state-writer boundary +tools/benchmark_prepare_hold_dismissal.py fixed read-only dismissal-candidate builder +tests/campaign/ focused runtime tests +tests/test_openai_provider.py structured provider-error and Retry-After regressions +tests/capsule/test_attempts_v2.py campaign backoff-attempt evidence regressions +tests/capsule/test_delivery_certainty.py delivery-certainty classification regressions +tests/capsule/test_execution.py one-attempt execution-seam regressions +tests/capsule/test_resume.py resumable checkpoint integration regressions +tests/test_public_contract.py cumulative Slice 3 export and command ownership +tests/test_ci_contract.py exact Runtime workflow inventory contract +tests/fixtures/public-benchmark-input-v1/ synthetic schema/workflow fixtures for this slice +evals/manifests/public-benchmark-gpt-5.6-*.yaml live manifests, owned only by roadmap freeze +benchmarks/campaigns/public-three-model-v1/ live package records, owned only by roadmap freeze +benchmarks/protocols/public-three-model-v1/ live protocol bytes, owned only by roadmap freeze +benchmarks/runbooks/public-benchmark.md Runtime operator and recovery runbook +``` + +The campaign package may import capsule canonicalization, verification, finalize, and checkpoint APIs. Capsule modules must not import the campaign package. This one-way dependency prevents generic local capsule verification from acquiring GitHub or spend authority. + +## Stable runtime interfaces + +The implementation must expose these names: + +```text +CampaignPhase = Literal["generation", "judge"] +CampaignMode = Literal["pilot", "confirmatory"] +``` + +The generated `CampaignStateName` projection must contain exactly, and only, the following values; +the tuple is generated from `CampaignStateSchemaV1` rather than copied into production code: + +```python +CampaignStateName = Literal[ + "PREFLIGHTED", + "GENERATION_ACTIVE", + "GENERATION_RESUMABLE", + "GENERATION_COMPLETE", + "HARD_SCORE_COMPLETE", + "JUDGE_ACTIVE", + "JUDGE_RESUMABLE", + "JUDGE_COMPLETE", + "PROVIDER_EVIDENCE_VERIFIED", + "AUDIT_COMPLETE", + "ANALYSIS_COMPLETE", + "BUNDLE_COLLECTED", + "COMPLETE_PUBLICATION_PR_OPEN", + "RESULT_MERGED", + "RELEASED", + "RELEASE_BLOCKED", + "STOPPED_INVALID", + "BUDGET_INCOMPLETE", + "INVALID_FINALIZED", + "INVALID_PUBLICATION_PR_OPEN", + "INVALID_PREFIX_MERGED", + "INVALID_PREFIX_MERGED_INVALID", +] +``` + +```text +FULL_CAP_USD_MICROS = 75_000_000 +PILOT_CAP_USD_MICROS = 5_000_000 +HARD_TIMEOUT_SECONDS = 10_800 +SOFT_DEADLINE_SECONDS = 9_900 +CHECKPOINT_MARGIN_SECONDS = 900 + +CampaignSeedV1 +CampaignPlanIndexV1 +VerifiedCampaignInputPackageV1 +CampaignPreflightSealV1 +CampaignRegistryPayloadV1 +CampaignRegistryV1 +CampaignStateSchemaV1 +StateWriterGitIdentityV1 +StateBrokerCallerPolicyV1 +CampaignEventMutationSourceV1 +AuthorityMutationRequestV1 +AuthorityMutationReceiptV1 +AuthorityRefReconciliationReceiptV1 +BrokerTokenDeliveryIsolationPolicyV1 +BrokerSigningKeyV1 +BrokerSigningIdentityV1 +BrokerCallerAuthorizationReceiptV1 +BrokerTokenRequestDispatchReceiptV1 +BrokerTokenRedactedSuccessArchiveV1 +BrokerTokenSafeSuccessProjectionV1 +BrokerTokenRequestTransportReceiptV1 +BrokerResponseZeroizationReceiptV1 +BrokerTokenUnrecoverabilityReceiptV1 +BrokerTokenClosureDispatchReceiptV1 +BrokerTokenDeleteAttemptV1 +BrokerTokenDenialProbeV1 +BrokerVaultScopeIdentityV1 +BrokerVaultAuditEntryV1 +BrokerVaultAuditLogV1 +BrokerVaultAuditPrefixV1 +PublicationBranchReceiptV1 +PublicationPRReceiptV1 +InitialBranchReceiptAppendV1 +InitialPRReceiptAppendV1 +InitialPublicationReceiptAppendV1 +PublicationMergeDenylistEntryV1 +PublicationMergeDenylistV1 +PublicationTerminalContainmentPreflightV1 +PublicationPreContainmentTerminalRouteV1 +PublicationTerminalContainmentIntentV1 +PublicationTerminalContainmentFinalityV1 +ReleaseEffectAuthorizationV1 +ReleaseEffectResultV1 +AnnotatedTagEffectResultsV1 +InstallationTokenRevocationReceiptV1 +FinalReleaseVerificationReceiptV1 +TagReceiptV1 +DraftReleaseReceiptV1 +ReleaseAssetReceiptV1 +PublishReceiptV1 +InitialTagReceiptAppendV1 +InitialDraftReleaseReceiptAppendV1 +InitialAssetReceiptsAppendV1 +InitialPublishReceiptAppendV1 +InitialReleaseReceiptAppendV1 +VerifiedPhasePlanV1 +CredentialScanReceiptV1 +InvalidEventDismissalPlanV1 +InvalidEventDismissalEvidenceV1 +InvalidEventNondismissibilityEvidenceV1 +HeldResultMergedConsumptionV1 +ProtocolAuthorityDriftEvidenceV1 +CredentialExposurePendingV1 +CredentialExposureEffectReceiptV1 +CredentialExposureProgressRootV1 +CredentialExposureSupplementV1 +TerminalCredentialExposureConsumptionV1 +AuthorityMutationV1 +CheckpointInventoryV1 +BatchPreparationRequestV1 +BatchRunResultV1 +RepositoryTrustBoundaryAttestationV1 +MainFallbackLivenessPolicyV1 +ArtifactEnvelopeV1 +UploadAuthorizationV1 + +apply_campaign_event( + ReconstructedAuthorityV1, + CampaignEventV1, + expected_state_sha256: str | null, + expected_unresolved_hold_root: str | null, + expected_active_credential_exposure_incident_id: str | null, + expected_active_credential_exposure_pending_root: str | null, + expected_authority_ref_oid: str | null +) -> AuthorityMutationV1 + +dismiss_invalid_event_hold( + ReconstructedAuthorityV1, + InvalidEventDismissalPlanV1, + InvalidEventDismissalEvidenceV1, + expected_authority_ref_oid: str +) -> AuthorityMutationV1 + +append_initial_publication_receipt( + ReconstructedAuthorityV1, + InitialPublicationReceiptAppendV1, + expected_state_sha256: str, + expected_authority_ref_oid: str +) -> AuthorityMutationV1 + +append_initial_release_receipt( + ReconstructedAuthorityV1, + InitialReleaseReceiptAppendV1, + expected_state_sha256: str, + expected_authority_ref_oid: str +) -> AuthorityMutationV1 + +build_terminal_credential_exposure_consumption( + ReconstructedAuthorityV1, + CredentialExposureIncidentEvidenceV1 +) -> TerminalCredentialExposureConsumptionV1 + +require_ordinary_effect_gate(ReconstructedAuthorityV1) -> None + +prepare_batch( + CampaignRegistryV1, + ReconstructedAuthorityV1, + SpendLedgerV1, + CheckpointInventoryV1, + BatchPreparationRequestV1 +) -> PreparedBatchV1 + +consume_job_receipt( + PreparedBatchV1, + ProviderJobIdentityV1, + PriceAttestationV1 +) -> ConsumedBatchReceiptV1 + +run_batch( + PreparedBatchV1, + ConsumedBatchReceiptV1, + ReconstructedAuthorityV1, + ProviderFactory, + monotonic_ns +) -> BatchRunResultV1 + +laconian_eval.campaign.runtime._reconstruct_verified_runtime +laconian_eval.campaign.runtime.Runtime.hard_score +laconian_eval.campaign.runtime.Runtime.prepare_judge +laconian_eval.campaign.runtime.Runtime.seal_judge +``` + +The Runtime stable interface exports `require_ordinary_effect_gate` from `laconian_eval.campaign`. +It first proves the active incident-ID/pending-root pair invariant and reconstructs the monotone +publication merge-denylist root, then gates every ordinary credential, effect, and event on the hold +root, both active-exposure fields, and `active_publication_terminal_containment_root` being null. +Typed exposure/containment consumers and the two closed receipt-append families bypass it only +through generated exact `CampaignStateSchemaV1`/non-event broker rows, never through a caller flag +or alternate helper. Every bypass byte-preserves or performs the one schema-authorized transition +of the denylist/containment roots. + +`_reconstruct_verified_runtime` is the only constructor and requires the authority-only in-memory +verified generation-context capability. The capability and wrappers are never serialized. There is +no public campaign-authority CLI or second console entry point. The existing public console remains +`laconian_eval.cli:main`; its seven offline handlers live only under `laconian_eval.replay` and +cannot import Runtime, its constructor, or its capability type. + +Public errors carry a stable code and constant message, never paths, keys, response text, raw provider exception bodies, workflow inputs, or untrusted artifact bytes. + +### Task 1: Define canonical campaign and GitHub identity records + +**Files:** + +- Create: `src/laconian_eval/campaign/__init__.py` +- Create: `src/laconian_eval/campaign/models.py` +- Create: `src/laconian_eval/campaign/artifact_wire.py` +- Create: `tests/campaign/__init__.py` +- Create: `tests/campaign/test_models.py` +- Create: `tests/campaign/test_artifact_wire.py` + +#### Step 1: RED-test strict shared records + +- [ ] Add payload factories only for Runtime-owned strict Git transport/ref-observation identities, + `ProviderJobIdentityV1`, `PriceAttestationV1`, + `WorkflowIdentityV1`, `ArtifactIdentityV1`, `GitHubAppInstallationIdentityV1`, + `StateWriterGitIdentityV1`, + `ArtifactEnvelopeV1`, and `UploadAuthorizationV1`. +- [ ] Assert every model is strict, frozen, `extra="forbid"`, canonicalizable, and rejects bool-as-int, noncanonical lowercase SHA-1/SHA-256, zero IDs, blank actors, control characters, duplicate IDs, and timezone-naive timestamps. +- [ ] Assert `ProviderJobIdentityV1` contains exactly `workflow_run_id`, `run_attempt`, `job_id`, and UUID4 `batch_attempt_id`. +- [ ] Define strict frozen `PriceAttestationV1` with price-snapshot hash, exact rate/source-URL + roots, requested service-tier literal `default`, bounded current-source capture hash and + observation time, workflow run/attempt, numeric + provider job/deployment ID, approval actor numeric ID/login, exact approval timestamp, captured + approval API-record digest, disposition literal `approved`, and self digest. Reviewer identity is + the approval actor; the job/deployment/run/attempt are the ones in `ProviderJobIdentityV1` and its + environment record. Require the source observation to precede approval by at most 24 hours and + receipt consumption to follow approval. A caller-created path, stale capture, mismatched actor/ + job/snapshot/rates, non-approved/dismissed record, or changed API record grants no authority. +- [ ] Require, at model validation and again when consuming authority, the exact equality + `price_snapshot.service_tier == price_attestation.requested_service_tier == "default"`. + Reject a missing/non-default tier or any fixture, reservation, batch, receipt, or replay whose + price-root binding cannot reproduce that equality. +- [ ] Assert `GitHubAppInstallationIdentityV1` binds numeric app and installation IDs, exact app slug + and bot login, repository ID, closed role `state_writer|publisher|release_finalizer`, permissions + attestation hash, and identity digest. The three roles require three pairwise-distinct App and + installation IDs; a generic `github-actions[bot]` identity is invalid. The state-writer App + private key exists only in the external broker. Publisher and release-finalizer credentials are + broker-minted only for separately approved `benchmark-publish` jobs. No App private key or App + installation token is an Actions, repository, organization, or environment secret. +- [ ] Define exact `StateWriterGitIdentityV1` fields: `schema_version == "StateWriterGitIdentityV1"`; + positive + `state_writer_app_account_id`; case-sensitive `state_writer_app_login`; literal ASCII author and + committer name `Laconian Benchmark State Writer`; literal ASCII author and committer email + `laconian-benchmark-state-writer@users.noreply.github.com`; and class-bound digest. Reject any + extra field, Unicode substitution, Git-profile lookup, different author/committer bytes, login + outside `[A-Za-z0-9-]+(?:\[bot\])?`, NUL/CR/LF/`<`/`>` or other control character, or digest + mismatch. Its domain separator is + `laconian-state-writer-git-identity-v1` and canonical UTF-8 has no terminal newline. +- [ ] Model `security_attestor` as a downscoped read-only capability of the same + `release_finalizer` installation, never as a fourth App identity: it may receive only + `administration:write`, `contents:read`, and `metadata:read`; `administration:write` is GitHub's + required permission name for the immutable-Releases settings read, while the attestor's fixed + endpoint/query policy contains no mutation. Release-writing tokens from that App omit + Administration permission. +- [ ] Assert repr and validation errors never expose a secret/path canary. +- [ ] Own the cross-slice wire contract now, before any provider artifact exists. In + `artifact_wire.py`, define strict `ArtifactEnvelopeV1` with the closed producer literals + `generation_batch|generation_evidence_set|hard_score|judge_request|judge_attempt_batch|judge_attachment_set|provider_evidence|audit_packet|audit_evidence|analysis_evidence|complete_collector|invalid_prefix_finalizer|publication_package|publication_receipt|release_package|release_receipt|correction_bundle`; + repository/run/attempt/job/batch and immutable input/workflow identities; nullable + environment/deployment/approval tuple; `payload_kind: canonical_file|root_ustar`; safe payload + name/length/digest; nullable materialized-root digest; mutually exclusive direct credential-scan + receipt digest vs transitive source-receipt root; and self digest. Direct + `generation_batch|judge_attempt_batch` require only the direct receipt; deterministic derived + provider projections require only the transitive root; all other producers require both null. + `root_ustar` requires `root-payload.tar` and a root digest; `canonical_file` requires a null root. +- [ ] Define detached `UploadAuthorizationV1` with envelope digest, exact inner filename + `laconian-artifact.zip`, inner byte length/digest, payload length/digest, optional direct-receipt + digest, pattern-policy digest, exact-key-scan completion literal, canonical scan time, and self + digest. It is local authorization metadata and is forbidden inside the authorized ZIP. Add golden + canonical vectors and reject any attempt to embed an inner/service archive digest in the envelope, + which would create a self cycle. The record itself is nonsecret: after upload, the key-free + recorder nests it in the exact numeric artifact locator stored by the protected authority Git + commit. “Detached” means outside the ZIP it authorizes, not ephemeral or omitted from authority. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_models.py tests/campaign/test_artifact_wire.py -q +``` + +Expected RED: import fails because `laconian_eval.campaign` does not exist. + +#### Step 2: GREEN the strict base layer + +- [ ] Implement a private `CampaignModel` with `ConfigDict(strict=True, frozen=True, extra="forbid")`. +- [ ] Use decimal integer validators for GitHub numeric IDs and exact lowercase patterns for SHA-1 and SHA-256. +- [ ] Use the existing `canonical_json` and `stable_digest` functions; do not add a second canonical JSON implementation. +- [ ] Define `campaign_record_sha256(domain, model)` so it class-bound revalidates before hashing and excludes only the record's own digest field. +- [ ] Export only stable public records from `campaign/__init__.py`. +- [ ] Rerun the focused test to GREEN. + +#### Step 3: Add hostile-boundary and canonical vectors + +- [ ] Add a hard-coded canonical JSON vector for each identity record and independently compute its domain-separated digest in the test. +- [ ] Forge model instances with `model_construct`, hostile string subclasses, and stateful `model_dump`; public hashing must reject them with content-free `CampaignRecordError`. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_models.py tests/campaign/test_artifact_wire.py tests/capsule/test_canonical.py -q +``` + +Expected GREEN: PASS; the strict identity/artifact models and every hostile canonical vector pass. + +#### Step 4: Commit + +- [ ] Review `git diff --check` and commit: + +```bash +git add src/laconian_eval/campaign/__init__.py src/laconian_eval/campaign/models.py src/laconian_eval/campaign/artifact_wire.py tests/campaign/__init__.py tests/campaign/test_models.py tests/campaign/test_artifact_wire.py +git commit -m "feat: define canonical campaign identities" +``` + +### Task 2: Bind immutable input tags and seal preflight + +Do not start this task until Evaluation Task 3 has committed +`src/laconian_eval/benchmark/protocol_review.py` and its canonical package exports. The gate imports +the Evaluation-owned protocol-review types/helpers named below, checks defining-module and object +identity, and must be GREEN before any Runtime schema, fixture, or preflight code is added. + +**Files:** + +- Create: `src/laconian_eval/campaign/tag_binding.py` +- Create: `src/laconian_eval/campaign/preflight.py` +- Create: `src/laconian_eval/campaign/broker_wire.py` +- Create: `src/laconian_eval/campaign/spend.py` +- Create: `tests/campaign/test_tag_binding.py` +- Create: `tests/campaign/test_input_package.py` +- Create: `tests/campaign/test_preflight.py` +- Create: `tests/campaign/test_broker_wire.py` +- Create: `tests/campaign/test_spend.py` +- Create: `tests/campaign/test_trust_boundary.py` +- Create: `tests/campaign/test_state_schema_fixture.py` +- Create: `tools/benchmark_capture_trust_boundary.py` +- Create: `tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json` +- Create: `tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.sha256` +- Create: `tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-sol.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-terra.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-luna.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/campaign.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/campaign-seed.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/price-snapshot.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/reviewers.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/protocol-reviewers.yaml` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/repository-trust-boundary.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/repository-trust-boundary-signature.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/tag-operator-registry.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/tag-ruleset-policy.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/invalid-event-dismissal-policy.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/main-fallback-liveness-policy.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/protocol-bundle-builder-git-identity.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/state-writer-git-identity.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmark/security/campaign-state-schema.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/hard-score.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/judge.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/statistics.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/audit.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/retry.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/checkpoint.json` +- Create: `tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/publication.json` +- Modify: `src/laconian_eval/campaign/__init__.py` + +This task implements Runtime integration and synthetic tagged-repository fixtures only; neutral +protocol-review schemas remain Evaluation-owned. It must not create the +live `evals/manifests/public-benchmark-*`, `benchmarks/campaigns/public-three-model-v1/*`, or +`benchmarks/protocols/public-three-model-v1/*` records. The roadmap's post-implementation freeze +task owns those paths after all workflows, protocols, tests, and independent reviews exist. + +Evaluation owns `src/laconian_eval/benchmark/protocol_review.py` and every neutral protocol-review +schema/helper: operator/ruleset/workflow types, statements, stable REST/GraphQL/local evidence, +`InputTagMessageV1`, `ProtocolAttestationTagMessageV1`, `ProtocolBundleBuilderGitIdentityV1`, +envelopes, bundle, tag binding, `TagRulesetObservationReceiptV1`, +`ArchivedApiReceiptBindingV1`, archive, raw-object grammar, digest preimages, and +network-free importer. Runtime imports those exact classes/functions, checks `__module__` and object +identity, and class-bound revalidates their outputs; it must not define, subclass, copy, or re-export +a second schema. Runtime owns only repository/GitHub observation orchestration in `tag_binding.py`, +stable `CampaignRegistryV1`/preflight, `MainFallbackLivenessPolicyV1`, and campaign state/authority. +In particular, Runtime imports package exports `CanonicalJSONV1Error`, `canonical_json_v1`, and +`parse_canonical_json_v1` by object identity with their sole definitions in +`laconian_eval.benchmark.attachments`, and imports `ProtocolSubjectKindV1` plus immutable +`PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1` by object identity with their sole definitions in +`laconian_eval.benchmark.protocol_review`. It defines no JSON encoder/parser, copied Literal/tuple, +or compatibility export. Runtime's LF-domain helpers call the imported canonical encoder directly; +they never use Evaluation's internal NUL-domain `canonical_json_v1_digest`. + +#### Step 1: RED-test tag resolution without credentials + +- [ ] Test the deterministically paired annotated-only refs + `benchmark-input-YYYYMMDD.N` and `benchmark-attestations-YYYYMMDD.N` in temporary Git + repositories, including the complete serial reviewer/bundle closure. +- [ ] Reject a lightweight or tag-of-tag ref, branch/raw commit, wrong suffix/namespace, moving/deleted + alias, malformed date/sequence, mismatched tag object or peeled C0/B0, dirty checkout, unavailable + object, shallow closure, replace/graft, mixed campaign, or any tag/commit/tree/blob byte that does + not reproduce both expected hashes. +- [ ] Patch `os.environ` with a credential canary and prove tag verification neither reads nor serializes `OPENAI_API_KEY`. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_tag_binding.py -q +``` + +Expected RED: `tag_binding` imports fail. + +#### Step 2: GREEN exact paired-tag and object-closure binding + +- [ ] Implement `bind_protocol_review_pair(repository, input_tag_ref, companion_tag_ref)` with + non-shell Git plumbing through a narrow subprocess runner. Permit only the two exact ref regexes + and the same nonzero suffix; pass exact raw tag/commit/tree/blob bytes to Evaluation's fixed parser/ + verifier rather than trusting porcelain or implementing a Runtime parser. +- [ ] Verify T0/C0/Rstat/Rjudge/Rsecurity/B0/T1, exact fixed paths/deltas/parents/messages/identities, + all raw-object hashes, bundle/root, operator/ruleset roots, and signatures before returning the + complete `ProtocolAttestationTagBindingV1`. Record each double-read observation separately; no + observation time/request ID/ETag enters identity. +- [ ] Run preflight twice for the same immutable pair with different observation times and assert the + same tag binding, campaign registry/ID, authority ref, seed-derived order, and plans; only separate + receipts differ. +- [ ] Use a fixed environment allowlist for Git subprocesses and reject replace objects, grafts, + alternates that escape the verified object database, shallow missing closure, ambient Git identity, + and any attempt to repair/recreate a ref in place. +- [ ] Rerun the focused test to GREEN. + +#### Step 3: RED-test the real tagged campaign input package + +- [ ] Load the three named manifests above and require exactly the public model IDs + `gpt-5.6-sol`, `gpt-5.6-terra`, and `gpt-5.6-luna`, native-v2 settings, medium generation + reasoning, medium verbosity, requested `service_tier: default`, the frozen response + corpus/arms/runner hashes, 480 rows per + manifest, and no fourth or missing manifest. +- [ ] Define `CampaignSeedV1` as strict canonical JSON with exactly `schema_version == "1"`, + `algorithm == "public-hex-seed-v1"`, a preregistered public `campaign_seed` of exactly 64 + lowercase hexadecimal characters, and `seed_sha256 == + stable_digest("laconian-campaign-seed-v1", payload_without_digest)`. The plaintext seed is an + immutable tagged input, not a post-run reveal or caller-supplied workflow value. +- [ ] Define `campaign.yaml` as the strict C0-only `CampaignInputPackageV1` index binding the three + manifest paths and hashes, exact `mode: pilot|confirmatory`, `campaign-seed.json`, + `price-snapshot.yaml`, `reviewers.yaml`, `protocol-reviewers.yaml`, the repository trust-boundary attestation + and detached signature, all seven protocol + paths/hashes, corpus/arm/runner/dependency hashes, mode-independent caps, the exact + tag-operator, tag-ruleset, publication-branch-ruleset, invalid-event-dismissal, + main-fallback-liveness, protocol-bundle-builder, state-writer, + `BrokerTokenDeliveryIsolationPolicyV1`, and ordered exact three `BrokerSigningKeyV1` security + members/digests plus `broker_signing_keys_root_sha256`, and its own digest. The broker roles are + exactly `publisher`, `release_finalizer`, `security_attestor` in that order; decoded SPKI bytes, + validity windows, Ed25519 algorithm, per-key digest, fixed-three-leaf duplicate-last Merkle tree, + and final wrapper root must all recompute. Reject the entire + `benchmarks/protocol-reviews//` subtree and every statement, envelope, attestation root, + companion binding, B0/T1 value, or placeholder in C0 and `CampaignInputPackageV1`. +- [ ] Import Evaluation-owned exact three-field `WorkflowInventoryV1`, exact 15-member + `BENCHMARK_WORKFLOW_PATHS_V1`, and `build_workflow_inventory`. Call the builder over the + verified `C0` tree in the frozen literal `BENCHMARK_WORKFLOW_PATHS_V1` order and never sorts, + reorders, or accepts caller-supplied entries. The schema contains exactly `schema_version`, + `members`, and `workflow_root`; every member contains exactly `path` and `sha256`. It computes + `SHA256(UTF8("laconian-workflow-inventory-v1\n") || CanonicalJSONV1(inventory without exactly + workflow_root))`. Action-pin/policy proofs remain separate C0 evidence and are not implicit + inventory fields. No workflow hash or + inventory root is a source-code constant before the live freeze. + Runtime Task 2 tests build a synthetic temporary `C0` containing all 15 paths; they do not depend on + future Slice 4 files or the then-partial cumulative `tests/test_ci_contract.py`. + `campaign.yaml`, all three later statements/envelopes, their bundle/tag binding, and the registry + bind the same reconstructed root. + Publication Task 13 adds the final cross-slice test proving its completed 15-workflow enumeration + exactly equals this production constant and verifies the real-byte root. Live `C0` population is + owned only by the roadmap freeze. Unknown/missing/duplicate workflows or a hash from any commit + other than exact verified C0, including mutable `main`, fails. + + The path tuple itself is the following literal UTF-8 byte order; only member hashes/root wait for + the verified `C0` bytes: + + ```python + BENCHMARK_WORKFLOW_PATHS_V1 = ( + ".github/workflows/audit-pr-validate.yml", + ".github/workflows/benchmark-analysis.yml", + ".github/workflows/benchmark-audit.yml", + ".github/workflows/benchmark-batch.yml", + ".github/workflows/benchmark-collect-complete.yml", + ".github/workflows/benchmark-dismiss-hold.yml", + ".github/workflows/benchmark-docs-validate.yml", + ".github/workflows/benchmark-evidence.yml", + ".github/workflows/benchmark-finalize-invalid.yml", + ".github/workflows/benchmark-hard-score.yml", + ".github/workflows/benchmark-preflight.yml", + ".github/workflows/benchmark-publication-state.yml", + ".github/workflows/benchmark-publish.yml", + ".github/workflows/benchmark-release.yml", + ".github/workflows/publication-pr-validate.yml", + ) + ``` +- [ ] Require fixture `price-snapshot.yaml` to exercise service tier literal `default`, canonical + UTC observation time, and five separate non-null integer micro-USD rates for every frozen model: + ordinary-uncached input, cache-read input, cache-write input, visible output, and reasoning output. + Each dimension carries its own exact official + HTTPS source URLs, rounding version, and one independent verification attestation. During + implementation, synthetic fixture rates/URLs are explicitly non-live. The final freeze task + re-checks then-current official sources and commits the real exact rates; an unverifiable or + changed rate blocks that task rather than accepting a blank, estimated, or stale value. +- [ ] Require a nonnull reviewed cache-write rate for every frozen model alias and an attestation + that literal `prompt_cache_options: {"mode":"explicit","ttl":"30m"}`, recursive absence of + every `prompt_cache_breakpoint`, and the exact `cache_write_tokens` usage field are supported + by the tagged API contract. Missing support/rate blocks the tag; preflight may not assume writes are + free or silently map them to cached reads. +- [ ] Add a dedicated precredential RED test node for the approved SDK 3.3.1 contract. Import the + exact Foundation-owned `BenchmarkSDKContractError` and + `require_benchmark_sdk_contract` objects from `laconian_eval.providers`, assert their owner module + is `laconian_eval.providers.openai`, and call exactly + `require_benchmark_sdk_contract(c0_uv_lock_bytes=verified_c0.read_regular_file("uv.lock"), + expected_c0_uv_lock_sha256=verified_input_package.uv_lock_sha256)`. The package member hash is + independently bound by `VerifiedCampaignInputPackageV1`; no caller/workflow scalar supplies it. + The internally constructed strict record requires OpenAI Python SDK version exactly `3.3.1`, + exact C0 lock bytes/hash, the literal typed request-model fields, all canonical response paths, + and its self digest. Instrument environment access, credential lookup, provider/client construction, + OIDC/App-token mint, and network mutation; every `BenchmarkSDKContractError`, including the closed + `serializer-projection` code, has the same fail-closed behavior and must occur before any of them. + Runtime neither enumerates a smaller error-code subset nor defines a wrapper, copied constant, or + second validator. The pure `_public_benchmark_responses_kwargs` serializer projection remains + Foundation-owned: Runtime calls it only through the verified Foundation provider contract and + does not define, copy, alias, or re-export it. Run + this RED node explicitly: + + ```bash + uv run pytest -p no:cacheprovider tests/campaign/test_preflight.py::test_openai_sdk_3_3_1_lock_and_models_verify_before_any_credential -q + ``` + + Expected RED: the Foundation-owned SDK/lock precredential verifier is absent. GREEN imports that + exact object into secret-free preflight and reruns the same call immediately before every + provider-key mapping; all credential/client/provider spies remain zero on failure. +- [ ] The synthetic package exercises `mode: pilot`; after the live pilot gate, the confirmatory + freeze is a separately reviewed commit/tag whose package declares + `mode: confirmatory`. Mode comes only from the verified tagged package and is bound into campaign + identity; no CLI, workflow input, or environment value may override it. A mode edit always creates + a new tag, registry, plan index, and campaign ID. +- [ ] Require live `reviewers.yaml` to preregister exactly two distinct maintainer-supplied GitHub + numeric account IDs/logins for the human audit plus their required commit-signing verification + mode and optional exact key fingerprints. Its canonical digest is the audit-reviewer-registry hash. + Synthetic identities are permitted only in tests. Do not create the live file or + input tag until the final freeze receives both real identities; missing, duplicate, fabricated, + or unverified identities fail preflight. Task 2 fixtures use explicitly synthetic identities. +- [ ] After Slice 2 Task 3 commits its neutral reviewer/context contract, load the benchmark-owned strict + `ProtocolReviewerRegistryV1` from `protocol-reviewers.yaml`; Runtime must import/class-bound + revalidate that type and must not define or re-export a second class. It contains exactly three + role-bound `ProtocolReviewerBindingV1` + records in order `statistical_method`, `blind_judge_audit_protocol`, `security_evidence`, each with + a distinct non-bot numeric GitHub account ID/login, closed signing verification mode, and exact + mode-compatible fingerprint plus canonical ASCII Git author/committer name and email used in its + reviewer commit. Keyed modes require a fingerprint; `github_verified_commit` + requires null; `security_evidence` always requires non-null and therefore cannot use + `github_verified_commit`. Its canonical digest is independent of the two-person audit registry; + no identity is inferred from an attestation line. Live freeze requires all three real bindings, + while fixtures are explicitly synthetic. This is an explicit Task 2 integration edge on Slice 2 + Task 3; tag/Git/pricing work may proceed earlier, but preflight cannot turn GREEN without it. + Slice 2 Task 8 later extends the already-owned context into the post-judge provider bridge. +- [ ] Import/class-bound revalidate Evaluation-owned one-operator `TagOperatorRegistryV1` from C0 with positive repository/account IDs, + case-sensitive login, canonical tagger name/email, entry digest, and registry digest. Both digests + use their exact newline domains and omit only their own self field; T0/T1 and the post-tag binding + must match the same entry. Apply the normative 1-80-byte tokenized printable-ASCII name grammar, + 3-254-byte single-`@` email grammar, unsigned non-zero-padded bounded epoch, and literal `+0000` to + registry and tag bytes identically. +- [ ] Load Runtime-owned exact C0 `InvalidEventDismissalPolicyV1` with repository ID, nonempty ascending strict + `{account_id,login}` eligible list, exact digest, and no role/team/App/deploy-key/ambient-maintainer + expansion. Load Runtime-owned exact `MainFallbackLivenessPolicyV1` and Evaluation-owned exact + two-entry `TagRulesetPolicyV1` from their fixed paths and reproduce all three digests before any + review or preflight value is accepted. +- [ ] Define/import only the Runtime-owned shared cycle-free broker registry wire in + `campaign.broker_wire`: exact `BrokerTokenDeliveryIsolationPolicyV1`, `BrokerSigningKeyV1`, and + `BrokerSigningIdentityV1`. The isolation policy has exactly the approved GitHub origin/version/ + token endpoint, ordered roles `publisher,release_finalizer,security_attestor`, one + `{broker_role,vault_measurement_sha256}` per role in that order, and literal true fields + `github_tls_terminates_inside_token_vault`, + `complete_response_validation_precedes_token_commit`, + `token_commit_precedes_executor_visibility`, + `failed_token_commit_zeroizes_response_bytes`, + `executor_accepts_only_committed_token_handles`; literal false fields + `raw_token_bytes_leave_token_vault`, `raw_token_bytes_enter_actions`, and + `unknown_delivery_allows_operation_dispatch`; followed by + `broker_token_delivery_isolation_policy_sha256`; its domain is + `laconian-broker-token-delivery-isolation-policy-v1\n`, omitting only that digest. A signing key has + exactly schema/role/key ID/`Ed25519`/base64url SPKI/not-before/not-after/self digest under + `laconian-broker-signing-key-v1\n`. A signing identity has exactly registry digest, nested key, + three-key root and self digest under `laconian-broker-signing-identity-v1\n`. Publication imports + these identical class objects; Runtime preflight rejects a second class/module, preflight-selected + key, unknown key, wrong role/order/algorithm/window/root, invalid SPKI, or policy/vault measurement + mismatch before any live authority or broker token request exists. +- [ ] In the same sole-owner `campaign.broker_wire` module, RED-test and implement the complete + cycle-free broker/vault wire imported by Publication. Every class is strict/frozen/extra-forbid, + uses the Evaluation-owned canonical encoder, verifies its nested duplicated digests, and has no + raw token/JWT/header/cookie field. Freeze these exact ordered schemas and domains: + + - `BrokerVaultScopeIdentityV1`: `schema_version,scope_kind,campaign_id, + campaign_registry_sha256,repository_id,publication_id,publication_attempt,correction_id, + bundle_kind,sealed_root_sha256,publication_plan_sha256,authorizing_intent_sha256,release_phase, + preauthorized_release_plan_sha256,release_intent_sha256,security_attestation_purpose, + security_attestation_subject_sha256,scope_identity_sha256`, with the exact publication/release/ + security nullability matrix and domain `laconian-broker-vault-scope-identity-v1\n`; + - `BrokerCallerAuthorizationReceiptV1`: campaign/registry/repository and nested scope pair, + `broker_role,broker_policy_sha256,authorized_policy_row_sha256,caller_workflow_ref, + caller_workflow_sha256,caller_job,job_workflow_ref,job_workflow_sha256,required_ref_class, + oidc_issuer,oidc_audience,oidc_subject,oidc_repository,oidc_ref,oidc_sha,oidc_environment, + run_id,run_attempt,check_run_id,actor,authenticated_at`, nested signing identity/signature and + final digest. The signature and record domains are + `laconian-broker-caller-authorization-signature-v1\n` and + `laconian-broker-caller-authorization-receipt-v1\n`; issuer is exactly GitHub's token issuer, + while raw JWT/App JWT and caller-supplied claim projections are forbidden; + - `BrokerTokenRequestDispatchReceiptV1`: exact campaign/registry/repository/scope/role/App, + broker policy/row and nested caller authorization, isolation-policy/vault-measurement roots, + operation key, positive credential ordinal, vault transaction/request IDs and dispatch time, + literal POST installation-token endpoint/API/accept/authentication values, ordered requested + permissions, exact request body/payload root, nested signing identity/signature and digest under + `laconian-broker-token-request-dispatch-{signature,receipt}-v1\n`. It is durably signed before + the first request byte and contains no terminal or response field; + - `BrokerTokenRedactedSuccessArchiveV1`: exact + `schema_version,redacted_response_canonical_json_base64,token_replacement_fingerprint_sha256, + redacted_response_sha256,redacted_success_archive_sha256` under + `laconian-broker-token-redacted-success-archive-v1\n`; and + `BrokerTokenSafeSuccessProjectionV1`: exact + `schema_version,installation_id,repository_selection,repository_ids,permissions, + token_fingerprint_sha256,expires_at,safe_success_projection_sha256` under + `laconian-broker-token-safe-success-projection-v1\n`. Decoded archive bytes preserve the full + 201 response with only token text replaced, and the compact projection is a total deterministic + extraction; + - `BrokerTokenRequestTransportReceiptV1`: exact campaign/registry/repository/scope/role/App, + broker policy/row, nested caller authorization, isolation/vault roots, operation key/credential + ordinal/transaction, nested dispatch receipt, request/dispatch/terminal/nullable completion, + literal dispatch/method/endpoint/API/accept/authentication, requested permissions/body/payload, + `outcome=successful_201|definite_denial|delivery_unknown`, nullable status, returned permissions/ + repository IDs, nullable token fingerprint/expiry/vault-commit time, commit count, nullable safe- + projection kind/root, nullable exact redacted archive and compact projection, nested signing + identity/signature and digest under + `laconian-broker-token-request-transport-{signature,receipt}-v1\n`. Success is exact committed + 201/count-one/full match; definite denial is only 401/403/404/422 with no token; every other, + response-loss, malformed, or failed-commit result is delivery-unknown/count-zero and cannot + dispatch an operation; + - `BrokerResponseZeroizationReceiptV1`: exact campaign/registry/repository/scope/role/transaction/ + transport root, `zeroization_outcome`, buffer count, literal zero raw-token/handle counts, vault + measurement, time, signing identity/signature and digest under the response-zeroization signature/ + receipt domains; and `BrokerTokenUnrecoverabilityReceiptV1`: exact campaign/registry/repository/ + scope/role/App/operation/credential/isolation fields, nested delivery-unknown transport receipt, + status/transaction/outcome, literal zero commit/handle/dispatch/export/accessible-token counts, + `uncommitted_response_bytes_zeroized=true`, vault measurement, nested zeroization receipt, + predecessor audit entry, signing identity/signature/time/digest under + `laconian-broker-token-unrecoverability-{signature,receipt}-v1\n`. The total outcome mapping is + response loss -> `no_complete_response_received`, invalid response -> + `complete_response_validation_failed`, valid 201 plus failed durable commit -> + `durable_token_commit_failed`; + - `BrokerTokenClosureDispatchReceiptV1`: exact scope/role/App/policy, operation key/credential, + request/fingerprint/commit/expiry, `operation=delete|denial_probe`, ordinal/request/time and its + literal DELETE-or-GET endpoint tuple, signing identity/signature/digest under the closure-dispatch + signature/receipt domains. `BrokerTokenDeleteAttemptV1` has exact role/App/policy/ordinal/request, + nested delete dispatch, times, DELETE endpoint tuple, fingerprint, + `outcome=confirmed_204|response_lost|observed_non_204`, nullable status/safe response and + `transport_receipt_sha256` under `laconian-broker-token-delete-attempt-v1\n`. + `BrokerTokenDenialProbeV1` has the analogous exact repository/App/policy/fingerprint/ordinal/ + request, nested probe dispatch, times, GET repository endpoint tuple, + `outcome=denied_401|response_lost|observed_retryable`, nullable status/safe response and digest + under `laconian-broker-token-denial-probe-v1\n`; + - `BrokerVaultAuditEntryV1`: exact nested scope, role/App, gapless ordinal/predecessor, nullable + transaction/operation/credential, closed event kind, nullable fingerprint, source receipt, + recomputed request/operation/live counts, time and digest under + `laconian-broker-vault-audit-entry-v1\n`. `BrokerVaultAuditLogV1` contains the same scope/role/App, + complete ordered entries, three literal zero final counts, signing identity/signature/seal time + and root under the audit-log signature/record domains. `BrokerVaultAuditPrefixV1` contains exact + scope/digest, publisher role/App, `prefix_purpose=containment_start|barrier_complete| + pre_fence_attachment`, paired broker-ledger prefix, count/entries/last digest, recomputed three + counts, signing identity/signature/time/root under the vault-prefix signature/record domains. + + Generate independent golden vectors for every field tuple/domain/signature omission, request- + start/terminal bijection, response-loss branch, delete/probe first-decisive outcome, scope/role/App/ + signing-key join and the vault event table. Crash immediately before/after every durable append, + network dispatch, vault commit, zeroization, delete and probe; replay must produce either the exact + terminal record or a closed unrecoverability branch, with zero raw-token export and no operation + dispatch from unknown delivery. `tests/test_public_contract.py` asserts every listed package export + is object-identical to `campaign.broker_wire`, and Publication has no copy or alias. +- [ ] Require the seven canonical protocol files to be byte-complete projections of the implemented + hard-score, judge, statistics, audit, retry, checkpoint, and publication contracts. Tests + independently recompute every protocol hash and reject a file generated from a different source + revision or containing an unknown/free-form execution field. +- [ ] Consume, but do not redefine, Evaluation's singular field + `audit_protocol_sha256: Sha256`. Runtime Task 2 derives it only by descriptor-reading and hashing + the verified C0 member + `benchmarks/protocols/public-three-model-v1/audit.json` at the exact peeled input commit. Require + that same field and value in `CampaignInputPackageV1`, `VerifiedCampaignInputPackageV1`, the + typed `CampaignPreflightSealV1`/`PREFLIGHT_SEALED` evidence, authority genesis, and each typed + downstream consumer that needs it. `CampaignRegistryV1` binds it only indirectly through + `payload.campaign_input_package_sha256`; reject a caller/workflow scalar, a mutable-`main` byte + source, a second audit digest alias, or disagreement with the audit member of the ordered + seven-protocol inventory. + Preserve Evaluation's separate `audit_sampling_protocol_sha256`, + `audit_commit_reveal_protocol_sha256`, and `audit_adjudication_protocol_sha256` bindings unchanged; + the singular aggregate field neither replaces nor derives those granular bindings. +- [ ] Import and class-bound revalidate Evaluation-owned `ProtocolReviewStatementV1`, the three + mode-discriminated signature-evidence variants, `VerifiedProtocolAttestationV1`, and + `ProtocolAttestationBundleV1`; Runtime must not define a shadow class. A statement contains exactly + the approved identity/T0/C0/workflow/subjects/time fields and `statement_sha256`, and contains no + reviewer-commit OID, signature evidence, envelope/bundle/T1 digest, or future placeholder. Its + digest is `SHA256(UTF8("laconian-protocol-review-statement-v1\n") || CanonicalJSONV1(statement + without exactly statement_sha256))`; `subject_root` uses the exact ordered subjects array and + `laconian-protocol-review-subjects-root-v1\n`. +- [ ] Require the exact ordered subject kinds for `statistical_method`: + `corpus_case_root`, `estimand_protocol_sha256`, `statistical_protocol_sha256`, + `bootstrap_protocol_sha256`, `outcome_classification_protocol_sha256`, and + `false_fail_sensitivity_protocol_sha256`; for `blind_judge_audit_protocol`: + `hard_score_protocol_sha256`, `judge_prompt_sha256`, `judge_schema_sha256`, + `audit_sampling_protocol_sha256`, `audit_commit_reveal_protocol_sha256`, and + `audit_adjudication_protocol_sha256`; and for `security_evidence`: + `provider_request_contract_sha256`, `retry_spend_protocol_sha256`, + `campaign_state_schema_sha256`, `workflow_endpoint_policy_sha256`, + `artifact_security_protocol_sha256`, `publication_correction_protocol_sha256`, + `publication_branch_ruleset_policy_sha256`, `identity_registry_bundle_sha256`, + `state_writer_git_identity_sha256`, `broker_token_delivery_isolation_policy_sha256`, + `broker_signing_keys_root_sha256`, `tag_operator_registry_sha256`, `tag_ruleset_policy_root`, and + `invalid_event_dismissal_policy_sha256`. Every subject is exactly `{kind, sha256}`; unknown, + duplicate, cross-role, reordered, common-root-as-subject, or identity-mismatched data fails. +- [ ] Import `ProtocolSubjectKindV1` and `PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1` from + `laconian_eval.benchmark` and assert object identity with + `laconian_eval.benchmark.protocol_review`; derive statement validation from that immutable mapping, + not the prose list above or a Runtime tuple. Likewise import `CanonicalJSONV1Error`, + `canonical_json_v1`, and `parse_canonical_json_v1` from `laconian_eval.benchmark`, assert object + identity with `laconian_eval.benchmark.attachments`, and route every Runtime wire preimage/parser + through those exact objects. `tests/test_public_contract.py` rejects a copied Literal/mapping, + wrapper encoder/parser, local re-export, or use of the internal NUL-domain digest helper. +- [ ] A `VerifiedProtocolAttestationV1` is exactly + `{schema_version,statement,signature_evidence,attestation_sha256}` and is created only after its + reviewer commit. Each evidence variant has exactly `schema_version`, `verification_mode`, + `commit_oid`, `commit_object_sha256`, `parent_commit_oid`, `statement_path`, + `github_rest_verification`, and `github_graphql_signature`; SSH/OpenPGP additionally and only have + `fingerprint`, `keyring_sha256`, and `local_signature_verification`. Freeze exact + `GitHubCommitVerificationProjectionV1` REST fields including repository/commit/API/endpoint, + `verified=true`, `reason=valid`, payload, signature, `verified_at`, and self digest; freeze exact + `GitHubSignatureProjectionV1` GraphQL fields including repository/commit/query digest, numeric + signer/login, `is_valid=true`, `state=VALID`, and self digest. REST payload/signature byte-match the + raw signed commit; GraphQL signer byte-matches the registry. Keyed modes additionally reconstruct + and locally verify the embedded signature against only the frozen keyring and exact fingerprint. +- [ ] Keep variable GitHub transport evidence only in strict + `GitHubSignatureObservationReceiptV1` records with repository/commit/projection roots, + `observed_at`, request IDs, ETags, raw/canonical response hashes, TLS endpoint identity, and exact + self digest. Transport receipts are excluded from statements, envelopes, B0, tag binding, + campaign registry/ID, seed, and plans; two observations with different timestamps/request IDs/ + ETags must reproduce byte-identical stable projections and campaign identity. Tests state the + trust boundary explicitly: offline replay verifies archived bytes/projections and keyed signatures + but cannot independently authenticate GitHub as the origin of `github_verified_commit` evidence. +- [ ] Use Evaluation's raw-object/DAG verifier to verify the exact noncyclic Git topology + `T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1`. T0/T1 are unsigned annotated tags with + deterministic paired refs. Rstat/Rjudge/Rsecurity each have one exact parent and add only their + role's fixed statement path; B0 has one parent and adds only three fixed envelope paths plus + `bundle.json`. C0/T0/input package contain no protocol-review subtree or future value; B0 contains + no B0/T1 self-reference. Verify exact tree deltas and every raw object with both SHA-1 OID and + `GitObjectSHA256V1 = SHA256(type SP decimal-size NUL content)`. +- [ ] Exercise Evaluation's closed raw tag/commit grammar: exact ordered headers, one blank line, exact canonical + tag message plus LF, frozen tagger/reviewer/builder identity, whole-second epoch, literal `+0000`, + and exact messages. T0 message contains exactly `schema_version,input_tag_ref,companion_tag_ref, + peeled_c0_oid,protocol_reviewer_registry_sha256,tag_operator_registry_sha256, + tag_ruleset_policy_root,workflow_root`; T1 contains exactly + `schema_version,input_tag_ref,input_tag_oid,input_tag_object_sha256,companion_tag_ref, + bundle_commit_oid,bundle_commit_object_sha256,protocol_attestation_bundle_sha256, + protocol_attestations_root,tag_operator_registry_sha256,tag_ruleset_policy_root`. Reviewer commits + contain only tree/one parent/frozen author+committer/one mode-compatible `gpgsig` and exact + `laconian protocol review : \n`; B0 contains only tree/one parent/ + frozen builder author+committer and exact bundle message, with no signature. Reject lightweight or tag-of-tag refs, a fifth/duplicate/unknown header, + embedded tag signature, multiple commit signatures, `encoding`, `mergetag`, CR/NUL/non-NFC, + alternate timezone/message/config identity, second parent, executable/symlink/submodule mode, or + extra/missing/renamed tree entry. Golden fixtures pin the full raw bytes, both hashes, parents, + paths, and deltas for T0, C0, all R*, B0, and T1. +- [ ] Use Evaluation's exact `ProtocolAttestationBundleV1` builder for the three complete envelopes + in role order and exact `ProtocolAttestationTagBindingV1` builder only after T1 exists. The binding records T0/C0, three + reviewer commits, B0/T1, bundle/root, workflow/operator/ruleset roots, and canonical complete + object-closure inventory; it is first persisted only in preflight/authority and copied downstream + only through the sealed campaign registry. +- [ ] Use Evaluation-owned exact `TagOperatorRegistryV1`, the two-entry stable-semantic-order + `TagRulesetPolicyV1`, fresh `TagRulesetObservationReceiptV1`, and one unique historical + `TagCreationRuleSuiteReceiptV1` for each tag. The creation-authorizer ruleset contains only creation + plus the sole frozen `User/always` operator bypass; the disjoint immutability ruleset contains + update then deletion and no bypass actors. Map raw rule-suite `result` to `overall_result`, preserve + `evaluation_result`, map actor ID/name, and allowlist only rule source type/ID, enforcement, result, + and rule type. T0/T1 creation must be `overall_result=bypass`, `evaluation_result=fail`, all-zero + before OID, exact tag-object after OID, and two distinct nonreplayed suite IDs; update/delete bypass, + delete/recreate, wrong actor, namespace squat, ambiguous suite, or extra applicable ruleset fails. + The stable policy root uses exactly `laconian-tag-ruleset-policy-v2\n`; observation and creation + receipts use their exact v1 newline domains and omit only their named self fields. Current policy + receipts and historical creation receipts remain outside campaign identity. +- [ ] Call Evaluation's exact `ProtocolReviewObjectArchiveV1` builder/importer over Runtime-captured + safe bytes: ordered raw Git objects; lexicographically ordered + safe raw/canonical API blobs; and ordered `ArchivedApiReceiptBindingV1` wrappers for GitHub + signatures, ruleset observations, T0 creation, and T1 creation. Enforce one-to-one indexed + receipt-hash-to-blob-path linkage, exact receipt discriminator/self digest, no orphan/duplicate/ + aliased/missing blob, and no headers/cookies/authorization/query secret in raw bytes. Its + network-free importer reconstructs all object headers/hashes/trees/deltas and all receipt/projection + hashes before accepting the archive. `object_closure_root` hashes only ordered + `{oid,type,size,git_object_sha256}` projections under + `laconian-protocol-review-object-closure-v1\n`; the outer archive digest hashes the complete archive + without exactly its self field under `laconian-protocol-review-object-archive-v1\n`. The already + computed closure root is an ordinary outer field, so neither preimage is circular. +- [ ] Because the approved prose tables are not an algorithmic extraction format, manually + transcribe and review the canonical schema fixture at + `tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json` in the RED fixture + commit. After that commit is independently reviewed, compute its digest with the platform + `shasum` implementation and apply the exact printed 64-hex value to the separate checked-in + `campaign-state-schema.canonical.sha256` sidecar as exactly + `campaign-state-schema.canonical.json`. The test parses that + closed grammar and independently hashes the JSON bytes; no Python/production generator writes or + updates either fixture. Require the synthetic input-package member + `tests/fixtures/public-benchmark-input-v1/benchmark/security/campaign-state-schema.json` to be a + byte-identical copy of that owner fixture and bind the same digest as the + `campaign_state_schema_sha256` subject. Task 3's generator must later equal those literal bytes; + the live input tag remains owned by the roadmap freeze. + + Freeze/review the literal first, then run this independent command, which imports no production + module. Only after a reviewer compares the output with the frozen bytes may the exact output line + be added to the sidecar by `apply_patch` and the fixture test committed: + + ```bash + git add tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json + git commit -m "test: freeze reviewed campaign state schema fixture" + shasum -a 256 tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json + git add tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.sha256 \ + tests/campaign/test_state_schema_fixture.py \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/campaign-state-schema.json + git commit -m "test: bind reviewed campaign state schema digest" + uv run pytest -p no:cacheprovider tests/campaign/test_state_schema_fixture.py -q + ``` + + Expected before the sidecar/copy commit: the fixture test fails only because the reviewed digest + sidecar/copy is absent. Expected after applying exactly the reviewed `shasum` output: PASS, with + the sidecar digest equal to an independent `hashlib.sha256` calculation and the package member + byte-equal to the owner literal. No sentinel, unknown hash, self-blessing generator, or + amend/regeneration of the reviewed fixture commit exists. +- [ ] Depend on Evaluation's table-driven golden preimage tests for operator/ruleset/workflow/ + statements/projections/receipts/local verification/envelopes/bundle/binding/archive, then add + Runtime integration tests proving only `CampaignRegistryPayloadV1`, `CampaignRegistryV1`, + dismissal/main-fallback/state records are Runtime-owned. Runtime must call the exact neutral + newline-domain helpers and reject a circular preimage, wrong domain, omitted ordinary field, + included self field, ambient transport field, or schema object whose `__module__`/identity differs. +- [ ] Add independent canonical vectors for the delivery-isolation policy, each of the three signing + keys, every leaf/node/root preimage (including literal `N22=node(L2,L2)`), and each campaign-bound + signing identity. Build expected bytes and SHA-256 values without production helpers; reject a + promoted odd leaf, sentinel leaf, reordered role, caller-supplied root, padded base64url, non- + Ed25519 SPKI, expired/not-yet-valid key, duplicate key ID, wrong campaign registry, or any extra/ + omitted field. Run the focused owner test before preflight: + + ```bash + uv run pytest -p no:cacheprovider tests/campaign/test_broker_wire.py -q + ``` + + Expected RED: the shared broker-wire module and fixed-three-key root verifier are absent. +- [ ] Define strict `RepositoryTrustBoundaryAttestationV1` as a nonsecret, canonical snapshot binding + the numeric repository ID and owner/name; the two environment IDs, names, deployment policies, + reviewer rules, prevent-self-review/admin-bypass settings, and safe configuration digests; every + input/result/authority/result-branch/`main` ruleset ID, enforcement mode, target pattern, bypass or + allowed-actor set, and canonical API-record digest; the three pairwise-distinct App installation + identities and permission-attestation hashes; default repository `GITHUB_TOKEN: read`; the global + Actions create/approve-PR toggle `false`; immutable Releases enabled; artifact retention `90`; and + the ordered required-check + names with exact workflow path/hash plus expected source GitHub App ID. It also binds the numeric + settings-capture actor, canonical capture time, ordered safe settings-API-record root, and its own + digest. No secret value, PEM, token, environment secret metadata, or free-form response body is + permitted. +- [ ] Define a detached `RepositoryTrustBoundarySignatureV1` binding the attestation digest, the + preregistered `security_evidence` reviewer ID/login, signing mode and exact key fingerprint from + `protocol-reviewers.yaml`, signature algorithm/bytes digest, and self digest. Verify it over domain-separated + canonical attestation bytes. The `security_evidence` protocol attestation separately binds the + trust-boundary and identity-registry subject roots through its exact subject inventory; neither + record may claim or derive its own containing Git object ID. +- [ ] Add exact-settings tests with fake paginated GitHub responses. Secret-free preflight re-fetches + every endpoint readable by its repository token and canonical-compares it with the captured + records. Admin-only settings require a separately produced signed observation no older than 24 + hours at dispatch; a changed/unreadable/partial setting, App permission, source-App check binding, + ruleset, retention value, or signature blocks preflight. Never weaken this to a human checkbox. +- [ ] Implement `tools/benchmark_capture_trust_boundary.py` as a separate read-only maintainer tool, + never a workflow or public CLI command. It consumes a fixed directory of already captured safe + canonical GET records plus the detached security-reviewer signature, projects only the schema's + allowlisted fields, and writes canonical attestation bytes. It accepts no credential, endpoint, + role subset, secret metadata, arbitrary response body, or mutation capability. Tests prove raw + header/cookie/credential canaries never reach output, logs, or errors and every omitted page or + record fails. The later fixed `security_attestor` job obtains fresh evidence only through its + downscoped external-broker capability with ordered permissions `administration:write`, + `contents:read`, `metadata:read` and a GET-only endpoint policy. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_trust_boundary.py tests/campaign/test_input_package.py -q +``` +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_input_package.py -q +``` + +Expected RED: the strict input-package loader and real frozen files do not exist. + +#### Step 4: RED-test the complete secret-free registry and seed-derived order + +- [ ] Build fixture manifests for Sol, Terra, and Luna from Slice 1 and assert exactly three 480-row parent plans. +- [ ] Assert `CampaignPlanIndexV1` contains exactly 36 unique 40-row shard plans whose disjoint + ordered union equals all 1,440 parent rows. Its canonical base order is bytewise + `(model_id UTF-8, scenario_uid raw SHA-256 bytes)`; its published permutation is the only order + accepted by generation batches and the only shard order used to flatten later judge requests. +- [ ] Freeze `order_algorithm == "numpy-pcg64-permutation-v1"`, `order_domain == + "laconian-shard-order-v1"`, and derive the unsigned 128-bit seed from the first 16 bytes of + `SHA256(domain || NUL || campaign_seed ASCII || NUL || peeled_input_commit ASCII || NUL || + judge_protocol_sha256 ASCII)`. Feed that integer to `numpy.random.Generator(PCG64(seed))` and call + `permutation(36)` exactly once. Add a hard-coded golden 36-index permutation and derived-seed + vector, computed independently in the test rather than by the production helper. +- [ ] Require `CampaignPlanIndexV1` to bind the canonical shard hashes, exact permutation, + seed/domain/algorithm, ordered shard hashes, and its own digest. When hard-score completes, the + judge-phase `BatchPlanV1` must traverse `JudgeRequestAttachmentV1` records in this same ordered + shard sequence and each attachment's sealed request order; it binds the resulting ordered request + IDs and attachment-index root before any judge call. +- [ ] Assert pilot mode selects one shared scenario, both locales, four arms, one repetition, three generation models, no retries, at most 24 generation attempts, and at most 24 judge attempts. +- [ ] Reject arbitrary model names, arbitrary shell values, missing or extra manifests, a non-medium generation protocol, a changed case/arm/runner hash, price snapshot mismatch, projected exposure above cap, or a first batch that cannot fit. +- [ ] Build `VerifiedCampaignInputPackageV1`, then bind the complete verified input package into + `CampaignPreflightSealV1`, the `PREFLIGHT_SEALED` evidence, and authority genesis. Those typed + records, not `CampaignRegistryV1`, retain and revalidate the operational preflight material: + +```text +mode, input tag object and peeled commit, +current preflight workflow path/SHA-256, exact 15-workflow inventory/root, three manifest/parent-plan hashes, +literal `uv.lock` path and `uv_lock_sha256`, +ordered 36 shard hashes, exact tagged `src/laconian_eval/benchmark/hard_score.py` source SHA-256, +hard-score/judge/statistical protocol path/hash fields and the Evaluation-owned singular +`audit_protocol_sha256: Sha256`, +the plaintext `CampaignSeedV1` and its hash, `CampaignPlanIndexV1` hash, +all seven ordered protocol hashes, five-dimension price snapshot/source roots, the exact two audit-reviewer account/signing +bindings and audit-reviewer-registry hash, the exact three role-bound protocol-reviewer bindings and +protocol-reviewer-registry hash, +the complete `ProtocolAttestationTagBindingV1`, all three verified envelopes/root and bundle hash, +tag-operator, stable tag-ruleset, and publication-branch-ruleset roots, invalid-event-dismissal and +main-fallback-liveness roots, exact broker-token-delivery-isolation policy, ordered three broker +signing keys and their recomputed root, +the exact `StateWriterGitIdentityV1` and `CampaignStateSchemaV1` member hashes, +the repository trust-boundary attestation/signature hashes and ordered settings-record root, +planned initial calls, planned maximum attempts, +requested service-tier root (every generation/judge request exactly `default`), explicit/30m cache-policy root and recursive no-breakpoint proof, projected reserved +micro-USD, and cap micro-USD +``` + + `VerifiedCampaignInputPackageV1` contains only the C0-derived members of that list and its own + package digest. `CampaignPreflightSealV1`/`PREFLIGHT_SEALED` evidence adds the post-C0 verified + envelopes, complete companion binding, exact registry, receipts needed for live admission, and + the separately typed plan/budget evidence before authority genesis copies the complete seal. + +- [ ] Define `CampaignRegistryPayloadV1` with exactly these fields, in canonical schema order, and + no mode, seed, plan, audit-protocol, price, trust-boundary, state-writer, state-schema, workflow- + inventory object, receipt, or transport-metadata field: + + ```text + campaign_input_package_sha256 + audit_reviewer_registry_sha256 + protocol_reviewer_registry_sha256 + workflow_root + protocol_attestation_tag_binding + tag_operator_registry_sha256 + tag_ruleset_policy_root + publication_branch_ruleset_policy_sha256 + invalid_event_dismissal_policy_sha256 + main_fallback_liveness_policy_sha256 + broker_token_delivery_isolation_policy_sha256 + broker_signing_keys + broker_signing_keys_root_sha256 + protocol_attestations_root + protocol_attestation_bundle_sha256 + ``` + + `protocol_attestation_tag_binding` is the complete strict + `ProtocolAttestationTagBindingV1`. Define `CampaignRegistryV1` with exactly + `schema_version`, `campaign_id`, `payload`, and `campaign_registry_sha256`. The registry digest is + `SHA256(UTF8("laconian-campaign-registry-v1\n") || CanonicalJSONV1(payload))`; `campaign_id` is + exactly `benchmark-` plus its first 32 lowercase hex characters. Observation/signature/ruleset/ + creation receipts and archive transport metadata are not payload fields. The key array contains + exactly the three C0 keys in publisher/release-finalizer/security-attestor order and reproduces the + fixed-three-leaf duplicate-last Merkle/root construction; the delivery-isolation policy and branch + ruleset policy are byte-copied from their verified C0 members. Full seed, plans, audit + protocol, workflow inventory, and the rest of the preflight list remain separately typed in the + verified input package, preflight seal/evidence, authority genesis, and downstream records; their + registry binding is indirect through `campaign_input_package_sha256` except for the payload fields + explicitly listed above. + +Derive the hard-scorer source hash by descriptor-reading that one path from verified `C0`; derive +the hard-score protocol hash and `audit_protocol_sha256` from their exact members of the seven-file +tagged protocol inventory. Neither is accepted as a manifest/CLI/workflow scalar. Re-hash both +protocol members during verified-input-package load, bind their paths and hashes into the typed +preflight seal and authority genesis, and reject a self-consistent substituted package whose digest +does not equal `CampaignRegistryPayloadV1.campaign_input_package_sha256`. + +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_preflight.py -q +``` + +Expected RED: registry models and `seal_preflight` are absent. + +#### Step 5: Implement the minimal tagged package and deterministic preflight + +- [ ] Implement a strict `load_campaign_input_package(tag_root: Path) -> VerifiedCampaignInputPackageV1` + that opens only the fixed paths above, rejects symlinks/aliases/duplicates/unknown members, and + proves every path and digest is reachable from the exact peeled input commit. Workflow inputs may + select only the immutable tag; they may not override seed, reviewer, price, model, or protocol. +- [ ] Construct the exact stable `CampaignRegistryPayloadV1`, compute + `campaign_registry_sha256 = SHA256(UTF8("laconian-campaign-registry-v1\n") || + CanonicalJSONV1(payload))`, and derive `campaign_id = "benchmark-" + + campaign_registry_sha256[:32]`. Re-run preflight with different observation times/request IDs/ + ETags/API response order and require byte-identical payload, registry digest, campaign ID, + authority-ref name, seed-derived order, and plans. Mutating any T0/C0/R*/B0/T1 object, stable + projection, signature, bundle, operator/policy root, or C0 input instead creates a different + registry; no transport receipt may do so. +- [ ] Materialize and validate every parent plan and `ShardPlanV1` through Slice 1 APIs; never reconstruct plan IDs in campaign code. +- [ ] Construct and revalidate `CampaignPlanIndexV1` from the tagged plaintext seed and verified + shard plans. Store the full `CampaignSeedV1` in `VerifiedCampaignInputPackageV1`, bind it into the + typed preflight seal/evidence and authority genesis, and copy it only into separately typed + downstream consumers that require bootstrap, judge blinding, shard ordering, or audit sampling. + `CampaignRegistryV1` contains neither the seed nor its direct fields. +- [ ] Bind the one `campaign_registry_sha256` and complete companion-tag binding in + `PREFLIGHT_SEALED`, authority genesis, every event/mutation/request/receipt, `BatchPlanV1`, + generation context/expectation, provider/audit/analysis handoff, and collector/publication/release + interfaces. Reject a component copied from another internally valid tag pair before any plan, + credential, provider call, artifact read, or mutation. +- [ ] Import and class-bound revalidate Foundations-owned `ResolvedPriceSnapshotV1`; implement only + the strict integer-micro-USD projection and pure `token_charge_usd_micros` / + `project_worst_case_exposure` functions in `spend.py`. Preserve the exact five Foundation field + names and source evidence without redeclaration. Each token component rounds up independently; + all ledger inputs and outputs are strict nonnegative integers. +- [ ] Calculate worst-case request exposure through those pure functions and enforce exactly `5_000_000` pilot or `75_000_000` confirmatory micro-USD. +- [ ] Emit a canonical `PreflightSummaryV1` that contains counts, price URLs, reservations, and hashes but no prompts, outputs, credentials, arbitrary paths, or environment values. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/benchmark/test_protocol_review.py tests/campaign/test_tag_binding.py tests/campaign/test_input_package.py tests/campaign/test_preflight.py tests/campaign/test_broker_wire.py tests/campaign/test_spend.py tests/campaign/test_trust_boundary.py tests/campaign/test_state_schema_fixture.py tests/test_public_contract.py -q +``` + +Expected GREEN: PASS; the verified input package, typed preflight seal/evidence, authority genesis, +and separately typed consumers carry the single C0-derived `audit_protocol_sha256` together with +all unchanged granular audit bindings, while the exact four-field registry binds them only through +its exact payload. + +#### Step 6: Commit + +- [ ] Commit the tag and preflight slice: + +```bash +git add src/laconian_eval/campaign/__init__.py \ + src/laconian_eval/campaign/tag_binding.py \ + src/laconian_eval/campaign/preflight.py \ + src/laconian_eval/campaign/broker_wire.py \ + src/laconian_eval/campaign/spend.py \ + tools/benchmark_capture_trust_boundary.py \ + tests/campaign/test_tag_binding.py \ + tests/campaign/test_input_package.py \ + tests/campaign/test_preflight.py \ + tests/campaign/test_broker_wire.py \ + tests/campaign/test_spend.py \ + tests/campaign/test_trust_boundary.py \ + tests/campaign/test_state_schema_fixture.py \ + tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json \ + tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.sha256 \ + tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-sol.yaml \ + tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-terra.yaml \ + tests/fixtures/public-benchmark-input-v1/evals/manifests/public-benchmark-gpt-5.6-luna.yaml \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/campaign.yaml \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/campaign-seed.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/price-snapshot.yaml \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/reviewers.yaml \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/protocol-reviewers.yaml \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/repository-trust-boundary.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/campaigns/public-three-model-v1/repository-trust-boundary-signature.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/tag-operator-registry.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/tag-ruleset-policy.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/invalid-event-dismissal-policy.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/main-fallback-liveness-policy.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/protocol-bundle-builder-git-identity.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/state-writer-git-identity.json \ + tests/fixtures/public-benchmark-input-v1/benchmark/security/campaign-state-schema.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/hard-score.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/judge.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/statistics.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/audit.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/retry.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/checkpoint.json \ + tests/fixtures/public-benchmark-input-v1/benchmarks/protocols/public-three-model-v1/publication.json +git commit -m "feat: seal benchmark campaign preflight" +``` + +### Task 3: Implement the normative state machine and invalid-event holds + +**Files:** + +- Create: `src/laconian_eval/campaign/state_schema.py` +- Create: `src/laconian_eval/campaign/state.py` +- Create: `src/laconian_eval/campaign/state_broker.py` +- Create: `src/laconian_eval/campaign/authority_git.py` +- Create: `src/laconian_eval/campaign/authority.py` +- Create: `src/laconian_eval/campaign/publication_wire.py` +- Create: `src/laconian_eval/campaign/release_wire.py` +- Create: `tools/benchmark_state_broker_client.py` +- Create: `tests/campaign/test_state_schema.py` +- Create: `tests/campaign/test_state.py` +- Create: `tests/campaign/test_state_broker.py` +- Create: `tests/campaign/test_authority_git.py` +- Create: `tests/campaign/test_authority.py` +- Create: `tests/campaign/test_publication_wire.py` +- Create: `tests/campaign/test_release_wire.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +#### Step 1: RED-test the sole canonical state schema + +- [ ] Treat + `tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.json` as the sole + checked-in literal fixture owned by `tests/campaign/test_state_schema_fixture.py`. It is manually + transcribed from the exact approved Section 7.4 tables because the prose/table rendering is not an + algorithmically complete extraction source. After the RED fixture commit is independently + reviewed, use the separately reviewed + `tests/fixtures/campaign-state-schema-v1/campaign-state-schema.canonical.sha256` sidecar created in + Task 2; this plan contains no guessed digest or sentinel. The test independently canonicalizes and + hashes the literal bytes, requires the closed sidecar line to match, checks every reviewed + state/event/parent/bundle/evidence/terminality/caller/ref + row, and byte-compares the synthetic input-package copy without importing `campaign.state_schema` + or any production generator. +- [ ] Define one versioned canonical `CampaignStateSchemaV1` production projection and generate the state-name, + event-name, parent/bundle/evidence-discriminator, terminality, caller/ref, and reachability/liveness + projections from it. Require its canonical bytes to equal the independently reviewed literal + fixture before using its digest. Test that production `state.py` and broker policy round-trip to + the same schema digest. A hand-written second production transition list, table-only edge, + broker-only edge, unknown enum, unreachable event, or nonterminal state without an authorized + success/invalidation/STOP/correction continuation fails. +- [ ] Canonicalize schema, event, state, hold, request, and receipt records as RFC 8785 JSON, UTF-8 + without terminal newline, UTC RFC 3339 timestamps, canonical JSON integers, lowercase SHA-256 + roots, and 40-lowercase-hex Git SHA-1 OIDs. Reject missing/extra/null-where-forbidden fields, + duplicate/reordered schema arrays, floats, bool-as-int, or a digest that omits any field except its + own final digest. +- [ ] RED verification command: + + ```bash + uv run pytest -p no:cacheprovider tests/campaign/test_state_schema_fixture.py -q + ``` + + Expected RED: until the manually transcribed literal, its independently reviewed post-commit + SHA-256 sidecar, and the byte-identical synthetic input-package copy are all checked in; + production output cannot update or bless any expected byte or digest. +- [ ] Generate canonical schema bytes and require byte equality plus digest equality with both the + literal owner fixture and Task 2's synthetic `benchmark/security/campaign-state-schema.json` + member and its `security_evidence` subject. Any drift requires a new normative amendment and + reapproval; a test cannot update its expected digest from production output. +- [ ] Assert the generated state tuple is exactly + `PREFLIGHTED`, `GENERATION_ACTIVE`, `GENERATION_RESUMABLE`, `GENERATION_COMPLETE`, + `HARD_SCORE_COMPLETE`, `JUDGE_ACTIVE`, `JUDGE_RESUMABLE`, `JUDGE_COMPLETE`, + `PROVIDER_EVIDENCE_VERIFIED`, `AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, `BUNDLE_COLLECTED`, + `COMPLETE_PUBLICATION_PR_OPEN`, `RESULT_MERGED`, `RELEASED`, `RELEASE_BLOCKED`, + `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, + `INVALID_PUBLICATION_PR_OPEN`, `INVALID_PREFIX_MERGED`, and + `INVALID_PREFIX_MERGED_INVALID`. Reject any untyped publication-open state/event, cross-kind merge/close + events, or a release/correction/promotion edge from either invalid-prefix terminal state. +- [ ] Generate and parameterize every approved edge in design Section 7.4, including same-state + publication/correction intent and receipt records, the two typed correction invalidation kinds, + the same-state `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` root transition and every phase-exact + containment terminal consumer, + `RELEASE_BLOCKED + CORRECTION_RESULT_RELEASED -> RELEASED`, and + `RELEASED + CORRECTION_RESULT_RELEASED -> RELEASED`. Assert invalid-prefix publication uses only + `INVALID_PUBLICATION_PR_OPEN` and ends only in `INVALID_PREFIX_MERGED` or + `INVALID_PREFIX_MERGED_INVALID`. + +- [ ] Cover every illegal source/event pair, a STOP-to-live jump, partial-to-complete jump, release-blocked continuation, duplicate event, skipped parent, wrong phase-plan, wrong spend hash, wrong inventory root, and unresolved hold. +- [ ] `CORRECTION_RESULT_RELEASED` is the sole release-blocked escape: require the exact next + `correction_attempt`; predecessor correction record/root; prior pointer digest; new pointer digest; + correction-lineage digest; publication/merge/release receipt digests; result-tree, annotated-tag, + and release-asset roots; identical prior/new bundle-kind literals; and prior/new release-status + literals, while retaining the entire + blocked-state/event history. Runtime treats these as opaque strict hashes and sequence invariants: + Slice 4 alone constructs and verifies the richer pointer/lineage records before creating the event. + Reject every other event from `RELEASE_BLOCKED`; `campaign.state` must never import a Slice 4 + publication type. +- [ ] `RELEASE_PLAN_INVALIDATED` must bind a closed failure phase plus the canonical blocked-external- + objects digest and observed tag/release/asset roots, including an explicit empty/pre-tag record. + Runtime validates only the strict opaque phase/hash invariants and retains them in state evidence; + Slice 4 owns the nested exact `ReleaseExternalObjectsInventoryV1` construction/re-fetch and its + `current_external_objects_root_sha256`. A post-call failure may not use the preflight-empty form, + and no later event can erase or relabel an observed orphan object. +- [ ] Assert each event is single-use, parent-bound, canonical, and carries an exact source workflow/actor or reviewer identity. +- [ ] Freeze `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` as the only event that may change publication + containment roots. Its exact event contains the full ordered containment publication identity, + literal event type, positive parent transition, nested exact + `PublicationTerminalContainmentIntentV1` plus its digest, predecessor denylist root, nested exact + successor `PublicationMergeDenylistV1` plus its root, `publisher_broker_phase="terminalizing"`, + nested signed `PublisherBrokerPhaseLedgerPrefixV1(prefix_purpose="containment_start")` and + `BrokerVaultAuditPrefixV1(prefix_purpose="containment_start")` plus both roots, all three zero + outstanding/live counts, `constructive_mint_disabled=true`, source workflow + `benchmark-publish.yml`, source job `publication_terminalizer`, frozen source-workflow SHA, + `source_ref_class="protected_current_main"`, `occurred_at`, and event digest. The prefix pair must + byte-match identity/purpose, paired-ledger root/count/time, recompute zero open request/dispatch/ + token counts, and precede the accepted mutation receipt. Reject a free source job, caller-provided + zero count, plan-bound-main-only row, start with nonnull hold, start with incomplete active exposure, + a second active containment, or any ordinary event that changes either publication root. +- [ ] For `GENERATION_SET_SEALED`, require exactly the ordered 36 capsule hashes, + `generation_context_expectation_sha256`, and `verified_generation_context_root`. Neither root may + be omitted, reconstructed later, or replaced by a serialized raw context. +- [ ] GREEN verification command: + + ```bash + uv run pytest -p no:cacheprovider tests/campaign/test_state_schema_fixture.py tests/campaign/test_state_schema.py tests/campaign/test_state.py -q + ``` + + Expected GREEN: PASS; production-generated canonical bytes, both checked-in fixture copies, the + independently frozen SHA-256 literal, and every exact reviewed schema row agree byte-for-byte. +- [ ] Generate the ordinary `PERMANENT_STOP` caller/parent/reason rows from the schema exactly: + batch from `PREFLIGHTED|GENERATION_RESUMABLE|GENERATION_ACTIVE|HARD_SCORE_COMPLETE|JUDGE_RESUMABLE|JUDGE_ACTIVE` + for provider/reservation/delivery/identity/ledger/security evidence; hard-score from + `GENERATION_COMPLETE` for generation-context/hard-score integrity; evidence from `JUDGE_COMPLETE` + for coverage/provider-evidence failure; audit from `PROVIDER_EVIDENCE_VERIFIED` for identity/ + nonparticipation/reveal/adjudication protocol failure; analysis from `AUDIT_COMPLETE` for + statistical/provenance/integrity failure; complete collection from `ANALYSIS_COMPLETE` for bundle + coverage/lineage failure; publish from `BUNDLE_COLLECTED|COMPLETE_PUBLICATION_PR_OPEN` for exactly + `publication_lineage_failure|publication_reconciliation_unavailable`, with the unavailable form + binding its sealed disposition set/receipt and the open-PR row requiring its exact publisher close + receipt; and dismiss-hold only for one of those + same parent/reason rows plus its exact nondismissible hold. There is no `any nonterminal` wildcard. +- [ ] Generate the exact `credential_exposure` caller/parent matrix from the schema. Require + `CredentialExposureIncidentEvidenceV1`, safe metadata only, and the exact current authority, + state, ledger, artifact-inventory, active-plan, hold, denylist, and containment roots. Freeze these + rows without category expansion: + + | Caller | Exact allowed current parents | Additional restriction | + |---|---|---| + | `benchmark-batch.yml` | `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE` | affected artifact belongs to the exact current batch plan/run | + | `benchmark-hard-score.yml` | `GENERATION_COMPLETE` | affected generation artifact is an exact hard-score input or scan output | + | `benchmark-evidence.yml` | `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, `AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, or `BUNDLE_COLLECTED` without an active initial-publication prefix | designated cross-phase inventory/scanner and exact inventoried artifact/phase plan | + | `benchmark-evidence.yml` | `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED` without an active initial-publication prefix, `INVALID_PREFIX_MERGED`, or `INVALID_PREFIX_MERGED_INVALID` | pending/effects then only strict terminal supplement; state remains invalid and cannot resume | + | `benchmark-audit.yml` | `PROVIDER_EVIDENCE_VERIFIED` | affected artifact is an exact audit input/output | + | `benchmark-analysis.yml` | `AUDIT_COMPLETE` | affected artifact is an exact analysis input/output | + | `benchmark-collect-complete.yml` | `ANALYSIS_COMPLETE` | affected artifact is an exact collection input or proposed bundle member | + | `benchmark-publish.yml` | `BUNDLE_COLLECTED` with an active complete prefix, `COMPLETE_PUBLICATION_PR_OPEN`, `INVALID_FINALIZED` with an active invalid prefix, `INVALID_PUBLICATION_PR_OPEN`, bare `RELEASE_BLOCKED`, bare `RELEASED`, or an active correction before valid merge | exact publication/correction artifact; no-PR/close-or-merge race, invalid supplement, bare-state correction start, or publication-family invalidation only | + | `benchmark-release.yml` | `RESULT_MERGED` before or after initial release intent, or an active correction after valid merge | exact release-plan/correction artifact or release object; release-plan or release-family correction invalidation only | + | `benchmark-dismiss-hold.yml` | every premerge credential-exposure STOP parent except `COMPLETE_PUBLICATION_PR_OPEN` and `BUNDLE_COLLECTED` with an active initial-publication prefix | exact current nondismissible hold and independently verified incident; no postmerge, correction, or supplement row | + + Every row grants exactly `CREDENTIAL_EXPOSURE_PENDING`, zero or more next-ordinal + `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` events, and its one phase-exact terminal consumer. Premerge + direct rows end only in `PERMANENT_STOP(reason=credential_exposure)`; invalid terminal rows end in + the strict supplement; postmerge and correction rows end only in the listed release/correction + invalidation or correction intent. Complete/invalid publication prefixes require exact + no-PR/close/merge-race partitioning. Exhaustively test the full caller × parent × event × ref + Cartesian product, every excluded `PREFLIGHTED`/prefix/terminal cell, and that containment already + started forbids a new pending/progress CAS. +- [ ] Replace every open-ended STOP or generic security branch with the approved closed 24-value + `PermanentStopReasonV1` and its strict reason-discriminated evidence union. Generate one exhaustive + caller × current-parent × trigger-ref × reason × evidence row set from + `CampaignStateSchemaV1`; no `any nonterminal`, role/team/maintainer wildcard, reason alias, mixed + variant, broker-only edge, or table-only edge exists. Assert every reachable nonterminal state has + an allowed success, invalidation, STOP, correction, dismissal, exposure-progress, or safe-invalid + continuation. + + ```text + provider_authentication_failure + provider_permission_failure + provider_delivery_ambiguity + provider_contract_mismatch + reservation_ledger_mismatch + batch_identity_mismatch + artifact_integrity_failure + generation_context_integrity_failure + hard_score_integrity_failure + provider_evidence_incomplete + audit_identity_failure + audit_nonparticipation + audit_reveal_failure + audit_adjudication_failure + analysis_statistical_failure + analysis_provenance_failure + analysis_integrity_failure + bundle_coverage_failure + bundle_lineage_failure + publication_lineage_failure + publication_reconciliation_unavailable + invalid_event_nondismissible + credential_exposure + protocol_authority_drift + ``` + + The first 22 values use exact reason-discriminated `OrdinaryStopEvidenceV1`: schema/campaign, + reason, parent state/authority, current state/ledger/inventory/plan/hold roots, + `source_records_root`, strict `detail`, time, and self digest under + `laconian-ordinary-stop-evidence-v1\n`. Freeze the literal reason-to-detail field map from Section + 7.4; fields from another variant, a shared optional bag, empty/duplicate/reordered source records, + or a supplied root are invalid. `credential_exposure` and `protocol_authority_drift` use only their + separate exact evidence schemas. +- [ ] Define `InvalidEventNondismissibilityEvidenceV1` with exactly + `schema_version,campaign_id,campaign_registry_sha256,parent_state,parent_authority_oid,hold_id, + hold_sha256,rejected_request_sha256,failed_validation,source_records_root,observed_at, + nondismissibility_evidence_sha256` under + `laconian-invalid-event-nondismissibility-evidence-v1\n`; its nonempty validation array and source + root reproduce the accepted current hold. Define `HeldResultMergedConsumptionV1` with exactly + `schema_version,kind="nondismissible",campaign_id,campaign_registry_sha256, + parent_state="RESULT_MERGED",parent_authority_oid,hold_id,hold_root_sha256, + hold_admission_event_sha256,nondismissibility_evidence_sha256,consumption_sha256` under + `laconian-held-result-merged-consumption-v1\n`. The release-plan invalidation embeds this exact + consumption, clears the current hold atomically, and cannot name a future event/successor. Golden + vectors reject a stale/rebound hold, mismatched rejection/validation set, opaque nondismissibility + root, half-consumption, or use at any other parent. +- [ ] Add exact `ProtocolAuthorityDriftEvidenceV1` and the literal premerge drift STOP matrix for + moved/deleted/substituted T0/T1, changed raw object, stable policy mismatch, registry mismatch, or + fresh double-read failure that proves drift. The evidence binds campaign registry, both sealed and + current ref/object/policy observations, caller/current parent/ref, optional consumed hold, and an + exact complete-publication-PR close receipt only at that parent. Drift STOP never restores live + authority; after merge use only release invalidation/correction. Every eligible state remains + reachable through the protected-main `benchmark-evidence.yml` fallback when T0 is missing or moved. + Its fields are exactly schema/campaign/registry, parent state/authority/hold, tag-binding root, + nullable observed T0/T1 OIDs, observed ruleset root, nonempty ordered failed predicates, verification + receipts root, nullable exact PR-close receipt, time, and self digest under + `laconian-protocol-authority-drift-evidence-v1\n`. The predicate vocabulary is exactly + `input_ref_moved|input_ref_deleted|companion_ref_moved|companion_ref_deleted|object_oid_mismatch| + raw_object_sha256_mismatch|closure_mismatch|ruleset_drift|tag_creator_mismatch| + creation_authorization_mismatch|signature_identity_mismatch|topology_mismatch|cross_campaign_replay`. + Freeze the local rows exactly as: batch at `PREFLIGHTED|GENERATION_RESUMABLE|GENERATION_ACTIVE| + HARD_SCORE_COMPLETE|JUDGE_RESUMABLE|JUDGE_ACTIVE` on T0; hard-score at + `GENERATION_COMPLETE` on T0; evidence at `JUDGE_COMPLETE` on T0; audit at + `PROVIDER_EVIDENCE_VERIFIED`, analysis at `AUDIT_COMPLETE`, collection at `ANALYSIS_COMPLETE`, and + publish at `BUNDLE_COLLECTED|COMPLETE_PUBLICATION_PR_OPEN`, all on exact plan-bound main. Duplicate + those 13 parents exactly once for protected-current-main `benchmark-evidence.yml` fallback; only the + open-PR row requires/permits the exact close receipt. No other caller/parent/ref cell exists. +- [ ] Add constructive `CREDENTIAL_EXPOSURE_PENDING` and + `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` self-loop events. Pending atomically writes the exact + `CredentialExposurePendingV1` and `denylist/provisional/.json`, advances transition, + initializes the calculated `CredentialExposureProgressRootV1`, and sets both + `active_credential_exposure_incident_id` and `active_credential_exposure_pending_root` in the same + successor. Pending has exactly campaign/ + incident, parent/current state and authority, ledger/inventory/plan/hold roots, nullable concurrent- + drift root, ascending affected artifacts, scanner/provisional-denylist roots, canonical complete + pending-effect inventory, time, and self digest under + `laconian-credential-exposure-pending-v1\n`; no suspected bytes enter it. Effect appends exactly the next + zero-padded ordinal `CredentialExposureEffectReceiptV1`, advances the predecessor-linked effect + chain/root, and changes no campaign state. Each receipt has exactly campaign/incident/pending and + predecessor roots, ordinal/kind/external-object/idempotency key, requested/observed terminal state, + receipt root, time, and self digest. Every progress self-loop preserves the same nonnull active + incident ID and active pending root while advancing only the incident's predecessor-linked + progress/effect root. The six-field progress projection has no self field; its empty, + link, and outer roots use exactly the three normative newline domains and bind campaign, incident, + originating pending digest, previous active root, ordinal, and receipt digest. The final + credential-exposure `PERMANENT_STOP` consumes + the exact completed progress root, writes the permanent denylist, and atomically clears both + active exposure fields. `CredentialExposureSupplementV1` is the strict `supplement_kind` union of + `ProtocolDriftCredentialExposureSupplementV1` and + `InvalidLineageCredentialExposureSupplementV1`, never one nullable bag. The drift variant has + exactly schema/kind/campaign/incident/pending/final-evidence/original-drift-STOP/consumed-active- + root/terminal-effect-root/recorded-at/self-digest fields under + `laconian-protocol-drift-credential-exposure-supplement-v1\n`. The invalid-lineage variant has + exactly schema/kind/campaign/incident/parent-state/parent-authority/invalid-origin-event and + evidence roots/pending/final-evidence/consumed-active-root/terminal-effect-root/nullable exact + invalid-PR-close receipt/recorded-at/self digest under + `laconian-invalid-lineage-credential-exposure-supplement-v1\n`; its parent-to-origin mapping is + exactly `STOPPED_INVALID -> PERMANENT_STOP`, `BUDGET_INCOMPLETE -> BUDGET_EXHAUSTED`, + `INVALID_FINALIZED|INVALID_PUBLICATION_PR_OPEN -> INVALID_PREFIX_SEALED`, + `INVALID_PREFIX_MERGED -> INVALID_PREFIX_MERGED`, and + `INVALID_PREFIX_MERGED_INVALID -> INVALID_PREFIX_MERGE_INVALIDATED`. Both consume the exact active + progress root, clear both fields in one successor, preserve state, and grant no live resume. + Pending/effect events require `active_publication_terminal_containment_root=null`. Exposure newly + detected after containment start performs external credential revocation/rotation and pauses the + same evidence-preserving containment run, but may not install/advance a campaign exposure root or + rewrite its immutable pre-containment route. + Cover exposure-before-drift, drift-during-exposure, exposure-after-drift, open-PR + close, crash after pending and after every effect, idempotent adoption, complete terminal inventory, + and denial of every ordinary mutation/effect/credential while pending. +- [ ] Define and export the one Runtime-owned terminal consumer used by post-merge Publication + events; Publication imports the identical object and may not duplicate or flatten it: + + ```python + class TerminalCredentialExposureConsumptionV1(CapsuleModel): + schema_version: Literal["TerminalCredentialExposureConsumptionV1"] + campaign_id: BoundedNonBlankString + campaign_registry_sha256: Sha256 + incident_id: BoundedNonBlankString + credential_exposure_pending_sha256: Sha256 + predecessor_active_pending_root: Sha256 + terminal_effect_receipts_root: Sha256 + credential_exposure_incident_evidence: CredentialExposureIncidentEvidenceV1 + concurrent_protocol_authority_drift_evidence_sha256: Sha256 | None + consumed_unresolved_hold_id: BoundedNonBlankString | None + consumed_unresolved_hold_root_sha256: Sha256 | None + consumption_sha256: Sha256 + ``` + + Its digest is exactly + `SHA256(UTF8("laconian-terminal-credential-exposure-consumption-v1\n") || + CanonicalJSONV1(record without exactly consumption_sha256))`. + `build_terminal_credential_exposure_consumption` accepts only reconstructed authority and the + final strict incident evidence. It requires the same campaign/registry/incident/pending digest, + recomputes the predecessor progress root and terminal effect chain from every ordinal receipt, + requires `terminal_effect_receipts_root` to equal that chain, and copies the concurrent drift + root from the originating pending record. Both hold fields are null when no hold was current; + otherwise both identify the one hold copied into the pending/final evidence. It accepts no caller + root, inventory, ID, Boolean, callback, or mutable lookup. Cross-incident, cross-pending, + cross-campaign, missing/gapped/reordered effect, terminal-chain, drift-root, half-null/wrong-hold, + and digest-recomputed substitution vectors all fail before a terminal candidate is built. +- [ ] Extend the generated phase-aware exposure matrix. Besides the approved premerge parents, + pending/effect self-loops are admitted at `RESULT_MERGED`, bare `RELEASE_BLOCKED|RELEASED`, a + nonterminal correction prefix, and artifact-bearing `STOPPED_INVALID|BUDGET_INCOMPLETE| + INVALID_FINALIZED|INVALID_PUBLICATION_PR_OPEN|INVALID_PREFIX_MERGED| + INVALID_PREFIX_MERGED_INVALID`, only for emergency containment and only while the active + publication-containment root is null. Their only terminal consumers + are: exposure-race `RESULT_MERGE_INVALIDATED` for an open complete PR that merged; pre- or + post-intent `RELEASE_PLAN_INVALIDATED` at `RESULT_MERGED`; `CORRECTION_INTENT_AUTHORIZED` for bare + `RELEASE_BLOCKED|RELEASED`; the matching publication-family correction invalidation before a + valid correction merge; or correction-release invalidation after its valid merge. Each requires + `TerminalCredentialExposureConsumptionV1`, clears both active fields and the matching optional + hold atomically, and preserves/records the contaminated roots. Invalid-lineage parents use the + exact supplement before ordinary typed invalid-prefix plan invalidation, except a merge-before- + close race which consumes through `INVALID_PREFIX_MERGE_INVALIDATED`. Metadata/drift/nondismissible + variants forbid that consumer and require the active pair null. After invalidating an active + correction, only a new correction ID that explicitly supersedes the terminalized prefix and + contaminated exposure root may continue. Exercise every prefix and a crash/replay at every + pending/effect/final-CAS boundary; no prefix can wedge or resume its ordinary next phase. +- [ ] Define the six state-bound containment wire primitives now in Runtime-owned + `laconian_eval.campaign.publication_wire`: `PublicationMergeDenylistEntryV1`, + `PublicationMergeDenylistV1`, `PublicationTerminalContainmentPreflightV1`, + `PublicationPreContainmentTerminalRouteV1`, `PublicationTerminalContainmentIntentV1`, and + `PublicationTerminalContainmentFinalityV1`. Freeze their exact approved ordered fields, + nullability, discriminators, LF domains, nested-root equality, and export identities before the + state schema consumes them. Runtime owns only these six state/start/finality join records plus the + initial publication receipt/append wire; Publication Task 10 imports them by object identity and + owns the guard/dequeue/fence/reconciliation algorithm and every other publication evidence type. + `tests/test_public_contract.py` and `test_publication_wire.py` reject an owner moved into + `campaign.publication`, an alias, subclass, flattened dict, forward-schema substitute, or second + digest helper. This direction removes any Runtime→future-Publication implementation dependency. +- [ ] Freeze Runtime's exact containment join rather than duplicating the Publication schemas. The + shared phrase “full containment publication identity” is expanded in this fixed order whenever + Runtime compares an owner object: `campaign_id`, `campaign_registry_sha256`, `publication_id`, + nullable `publication_attempt`, nullable `correction_id`, `bundle_kind`, + `publication_plan_sha256`, `authorizing_intent_sha256`, `repository_id`, `parent_state`, + `source_authority_parent_oid`, `authority_phase`, `branch_name`, `expected_base_oid`, + `expected_head_oid`, `pull_request_marker`, `publication_head_commit_trailer`. Initial publication + requires positive attempt/null correction; correction requires null attempt/nonempty correction. + The state/root integration tests independently freeze the owner classes' ordered field tuples, + exact LF domains, and these joins: + + - denylist genesis is null-predecessor/zero-count/empty, every successor copies all entries and + appends exactly one, and no campaign event may remove or rewrite an entry; + - containment preflight has exactly one ordinary/ambiguity source, exact pre-containment protected- + main/marker/global-queue observations, ascending candidate PRs with a signed observation + bijection, and the exact merged subset; + - the pre-containment route's literal route/failure/event/outcome map is reconstructed, with active + exposure only for complete/correction and an already accepted strict supplement plus null active + pair for invalid-prefix; + - intent joins expected source authority/next transition, preflight main OID, predecessor and exact + one-entry successor denylists, branch-ruleset/workflow roots and the phase-derived premerge/ + merge-won event pair; it contains no accepted receipt or post-CAS evidence; + - finality accepts only `ordinary_premerge|write_ambiguity_premerge|ordinary_merge_won| + write_ambiguity_merge_won`, the exact containment-start mutation receipt, matching intent/ + successor denylist/source, a terminal parent distinct from the immutable source parent, direct + premerge barrier/fenced pair or nested merge-won evidence, sealed publisher disposition set and + the intent-derived required terminal event. + + Test missing/extra/reordered fields, wrong owner identity, wrong source/finality cross-product, + self-cycle, source/terminal-parent confusion, nonmonotone denylist, missing zero-residual barrier, + unpaired signed prefixes, exposure-route substitution, and any digest omitting an ordinary field. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_publication_wire.py tests/campaign/test_state_schema.py tests/campaign/test_state.py -q +``` + +Expected RED: the canonical schema, generated projection, and transition function are absent. + +#### Step 2: GREEN schema-generated pure transition models + +- [ ] Implement `CampaignStateSchemaV1` first and generate the discriminated `CampaignEventV1` + union, `CampaignStateName`, evidence-discriminator checks, transition dispatcher, terminal-state + checks, and reachability matrix into `state.py`. The generated file carries its source-schema + digest and fails tests if regenerated bytes differ; no task may edit the generated enum/mapping by + hand. +- [ ] Define `CampaignStateV1` with the exact Section 7 field tuple, including + `campaign_registry_sha256`, both exact tag-object bindings, peeled C0/B0 identities, transition/ + parent/event/state roots, phase plan, spend ledger, artifact inventory, correction/publication + roots, nullable `unresolved_hold_root`, nullable `active_credential_exposure_incident_id`, nullable + `active_credential_exposure_pending_root`, STOP/incident fields, source identity, nonnull + `publication_merge_denylist_root_sha256`, nullable + `active_publication_terminal_containment_root`, + `state_writer_git_identity_sha256`, and state digest. Null means proven absence, never unchecked; + freeze the pair invariant + `(active_credential_exposure_incident_id is null) == + (active_credential_exposure_pending_root is null)`. A nonnull incident ID must equal the incident + identifier embedded in the active `CredentialExposurePendingV1`; its originating pending digest + and reconstructed `CredentialExposureProgressRootV1` must both recompute from that same incident + ID. A digest-valid root for another incident is invalid. Every mutation request and broker replay + binds predecessor and successor values for the hold root, both active exposure fields, both + publication-containment roots, and the campaign registry. Genesis installs the exact canonical + empty `PublicationMergeDenylistV1` record/root and null active containment. Every ordinary event + byte-preserves both roots; containment start alone appends one denylist entry and changes + `null -> terminal_containment_intent_sha256`; the matching phase-exact consumer alone preserves + that denylist and changes the same intent root to null. +- [ ] Define exact broker-owned `InvalidEventHoldV1` and its digest. Create a hold only for one + authenticated, authorized-source, hold-worthy rejection after pre-auth/transient/benign-sibling + outcomes have been excluded; invalid input cannot be used as an unbounded storage/DoS primitive. + It contains exactly `schema_version,campaign_id,hold_id,rejected_request_sha256, + parent_authority_oid,parent_state,parent_transition_number,current_state_root,spend_ledger_root, + artifact_inventory_root,active_phase_plan_root,source_workflow,source_actor_id, + source_actor_login,failed_validation,held_at,invalid_event_hold_sha256`, is written only at + `holds//hold.json`, and uses the exact `laconian-invalid-event-hold-v1\n` preimage. +- [ ] Implement exact hold admission: pre-auth garbage, temporary reads, wrong repository/run/ + campaign, duplicate accepted request, benign sibling, and stale CAS produce only broker audit denial + and no campaign transition/hold. Only a request that already passed repository, OIDC/App, + caller/callee, transport, and sealed-registry checks but then fails event schema, parent, hash, + required evidence, or literal edge may cause broker-owned `INVALID_EVENT_HELD` by expected-OID + CAS. The exact `InvalidEventHoldV1` fields/path/digest are frozen; at most one hold exists and a + racing request is audit-denied without another state transition. Hold admission is generated from + the full reconstructed authority configuration, not the state name alone: any active initial- + publication prefix, `COMPLETE_PUBLICATION_PR_OPEN`, any nonnull terminal-containment root, or `RELEASED` or + `RELEASE_BLOCKED` with any nonterminal correction prefix forbids `INVALID_EVENT_HELD`, because no + later correction phase is an approved hold consumer. Only bare `RELEASED` may consume a newly + admitted hold through `CORRECTION_INTENT_AUTHORIZED`; at `RESULT_MERGED`, including after an + initial release intent/receipt prefix, the only held exit is `RELEASE_PLAN_INVALIDATED`. Exhaustive + prefix vectors prove every admitted hold has a reachable atomic consumer and no active publication, + containment, or correction prefix can be wedged by a new hold. +- [ ] Replace the old free-standing dismissal mutation with C0-frozen + `InvalidEventDismissalPolicyV1`, strict `InvalidEventDismissalPlanV1`, and + `InvalidEventDismissalEvidenceV1`. The plan has exactly the approved fields from campaign and + registry/policy roots through hold/parent, eligible dismisser, proof, dispatcher/ref, + `expected_no_effects_root`, `planned_at`, and self digest; the evidence has exactly campaign/hold, + plan root, parent, proof/no-effects, dismisser ID/login/signature root, `dismissed_at`, and self + digest. Use only proof kinds `authenticated_noop|byte_identical_applied_replay` and the exact + newline domains. The selected identity is in the C0 policy and distinct from the rejected source. + `INVALID_EVENT_DISMISSED` is a canonical + expected-OID self-loop event: transition/state digest advances, state name and every unrelated root + remain unchanged, and exactly the current hold root becomes null. +- [ ] Enforce the schema-generated parent, bundle kind, source workflow/ref, caller-specific actor, + reason, strict evidence discriminator, hold root, active-exposure incident-ID/pending-root pair, + and terminality predicates + before constructing the next state. A nonnull hold is admitted only by dismissal, the exact + premerge nondismissible/credential/drift STOP consumer, `RESULT_MERGED` release invalidation, or + typed held-`RELEASED` correction intent; each binds and clears it. Every other ordinary, + publication, release, correction, promotion, or safe-finalization edge requires the hold root null, + both members of the active-exposure pair null, and the active containment root null. The sole + exceptions are containment start, its post-CAS barrier/finality work and phase-exact terminal + consumer; terminal-ready exposure already named by the immutable route is consumed atomically by + that terminal event and cannot advance after containment starts. +- [ ] Rerun `test_state.py` to GREEN. + +#### Step 3: RED-test the external OIDC broker and canonical Git lease + +- [ ] Feed shuffled, missing, duplicated, expired, superseded, and forked authority commits/records; + accept only one exhaustive parent-linked chain rooted at the exact protected canonical ref + `refs/heads/benchmark-authority/{campaign_id}`. Operator-supplied artifact subsets and "latest by + name" discovery are never authority. +- [ ] Build two deterministic mutation requests with the same expected canonical-ref OID and race + them through one fake external broker. Exactly one receive-pack lease succeeds; the sibling fails atomically, and + reconstructing from the winning ref yields its exact state, spend, hold, inventory, and artifact + locator roots. +- [ ] Mutation and broker replay tests must reject every half-null active-exposure pair, a nonnull ID + that differs from the pending/progress incident, a pending root copied from another incident, a + progress event that changes either active field, and a terminal STOP/supplement candidate that + clears only one. Replay the complete pending -> each progress effect -> terminal STOP and pending + -> each progress effect -> drift supplement chains; require pending to set both, every progress + commit to preserve both byte-for-byte, and the terminal commit to clear both atomically. Inject a + stale expected pair, cross-incident receipt, response-loss adoption, and competing expected-OID + candidate; only the byte-identical candidate with the exact predecessor pair may be adopted. +- [ ] Test `StateBrokerCallerPolicyV1` against signed fake GitHub OIDC tokens. Require current GitHub + JWKS, `typ=JWT`, `alg=RS256`, matching `kid`, issuer + `https://token.actions.githubusercontent.com`, frozen audience and the repository's exact OIDC + subject-customization/immutable-subject configuration state and digest (never an assumed default + `sub` format), + `nbf <= iat <= now < exp`, age at most five minutes, and never-before-seen `jti`. Build the exact + projection fields `repository`, `repository_id`, `repository_owner`, `repository_owner_id`, + `actor`, `actor_id`, `ref`, `ref_type`, `sha`, `event_name`, `workflow`, `workflow_ref`, + `workflow_sha`, `job_workflow_ref`, `job_workflow_sha`, `run_id`, `run_attempt`, `check_run_id`, + and `runner_environment`; the reusable state job has no + environment claim. Verify API run/job records and reject missing/extra/mismatched claims, reruns + with an unauthorized triggering actor, unlisted caller/ref/event, PR ref, or reused `jti`. +- [ ] Make `actor`/`actor_id` caller-discriminated. Every normal caller and rerun REST + `triggering_actor` must equal the one plan-authorized frozen tag operator; only + `benchmark-dismiss-hold.yml` instead requires the exact current dismissal-plan/C0-policy eligible + account/login, distinct from the rejected source actor. An initial actor, ambient maintainer, + environment reviewer, role/team/App, or operator fallback cannot satisfy dismissal authority. +- [ ] Generate the broker caller/ref/event matrix from `CampaignStateSchemaV1`. Every tag/main event + requires its prebound caller SHA except exactly these six ordinary post-merge admission events: + `RESULT_MERGED`, `INVALID_PREFIX_MERGED`, `CORRECTION_MERGE_RECORDED`, + `RESULT_MERGE_INVALIDATED`, `INVALID_PREFIX_MERGE_INVALIDATED`, and + `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, + publication_outcome=merged_invalid)`. Each exception requires exact merge/current-main + containment, unchanged result subtree, caller/callee C0 workflow bytes, direct `merge_commit` + plan semantics, and the matching admission evidence/failure root; it grants no other event or + write authority. Keep them distinct from the four protected-current-main classes: drift routes; + publication terminal-containment start/barrier/finality; exact exposure pending/progress/phase- + terminal/supplement; and safe-invalid continuation. Each class requires current-main caller and + reusable workflow bytes equal their frozen C0 members, fresh pair/policy/registry evidence, and + its one phase-exact row. Publication containment additionally binds the accepted intent/root and, + when main advanced, exact first-parent `PublicationContainmentMainAdvanceProofV1`; it never + rewrites the original OIDC run SHA or grants a constructive publication/release effect. +- [ ] Freeze the exhaustive top-level caller/ref/event table below and generate it from the same state + schema as the transition matrix. A comma-separated cell names literal events, not a category or + wildcard. Every main exception is limited to the six admission events or four current-main classes + above; all other main rows require the plan-bound SHA. + + | Caller workflow | Required triggering ref | Exact allowed event types | + |---|---|---| + | `benchmark-preflight.yml` | exact campaign input tag | `PREFLIGHT_SEALED` | + | `benchmark-batch.yml` | exact campaign input tag | `BATCH_RECEIPT_CONSUMED`, `NO_DISPATCH_PROVED`, `VERIFIED_PARTIAL`, `GENERATION_SET_SEALED`, `JUDGE_SET_SEALED`, `PERMANENT_STOP`, `BUDGET_EXHAUSTED`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-hard-score.yml` | exact campaign input tag | `HARD_SCORE_SET_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-evidence.yml` | exact campaign input tag; protected current `main` only for drift, exact cross-phase exposure, terminal-invalid supplement, or safe-invalid continuation | `EVIDENCE_INVENTORY_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`; on current main, only the phase-exact containment/supplement or drift event | + | `benchmark-audit.yml` | exact plan-bound `main` | `AUDIT_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-analysis.yml` | exact plan-bound `main` | `ANALYSIS_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-collect-complete.yml` | exact plan-bound `main` | `COMPLETE_BUNDLE_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-finalize-invalid.yml` | exact campaign input tag, or protected current `main` only for safe-invalid continuation | `INVALID_PREFIX_SEALED` | + | `benchmark-dismiss-hold.yml` | exact plan-bound `main` | `INVALID_EVENT_DISMISSED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | + | `benchmark-publish.yml` | exact plan-bound `main`; protected current `main` additionally only for exact postmerge admission, publication containment, exposure, and drift rows | `PUBLICATION_INTENT_AUTHORIZED`, `PUBLICATION_TERMINAL_CONTAINMENT_STARTED`, `COMPLETE_PUBLICATION_PR_OPENED`, `INVALID_PUBLICATION_PR_OPENED`, `COMPLETE_PUBLICATION_PLAN_INVALIDATED`, `INVALID_PUBLICATION_PLAN_INVALIDATED`, `RESULT_MERGED`, `RESULT_MERGE_INVALIDATED`, `INVALID_PREFIX_MERGED`, `INVALID_PREFIX_MERGE_INVALIDATED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`, `CORRECTION_INTENT_AUTHORIZED`, `CORRECTION_PUBLICATION_RECORDED`, `CORRECTION_MERGE_RECORDED`, and all four publication-family `CORRECTION_INVALIDATED` outcomes `unmerged_invalid|merged_invalid|fenced_write_ambiguity|reconciliation_unavailable`; separately only `initial_publication_receipt_append` | + | `benchmark-release.yml` | exact plan-bound `main`; protected current `main` additionally only for exact postmerge exposure and drift rows | `RESULT_RELEASE_INTENT_AUTHORIZED`, `RESULT_RELEASED`, `RELEASE_PLAN_INVALIDATED`, `CORRECTION_TAG_RECORDED`, `CORRECTION_RELEASE_RECORDED`, `CORRECTION_RESULT_RELEASED`, release-family `CORRECTION_INVALIDATED`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`; separately only `initial_release_receipt_append` | + + `benchmark-publish.yml` is the sole caller for containment start/finality and the publication + receipt append; `benchmark-release.yml` is the sole release receipt append caller. The two PR + validators and docs validator never call the broker; `benchmark-publication-state.yml` is the + exact callee, never an independent event caller. Generate a negative vector for every unlisted + caller/ref/event/non-event cell and require denial before OIDC exchange or App-token mint. +- [ ] Keep the non-state broker matrix separate from the generated campaign-event matrix. It has + exactly two rows. `benchmark-publish.yml` on protected plan-bound main may request only + `initial_publication_receipt_append` at matching `BUNDLE_COLLECTED|INVALID_FINALIZED`, exact active + intent, null hold/exposure/containment roots, and next `branch -> pull_request` receipt. Separately, + `benchmark-release.yml` on protected plan-bound main may request only + `initial_release_receipt_append` at `RESULT_MERGED`, authoritative initial `release-intent.json`, + null hold/exposure/containment roots, and next `tag -> draft_release -> assets -> publish` receipt. + Both retain campaign state and every root byte-for-byte. They grant no correction, invalid-prefix, + event, arbitrary path, generic receipt, or same-state append capability; every other caller/ref/ + state/kind combination is denied before OIDC exchange or App-token mint. +- [ ] Implement `MainFallbackLivenessPolicyV1` from C0 with exact repository, protected + `refs/heads/main`, required check, workflow root, ordered 15 member paths, and exact newline-domain + digest. For moved/deleted T0/T1, only the existing protected-main `benchmark-evidence.yml` may + read frozen closure/authority and request the typed drift STOP or safe-invalid continuation; it + must prove current-main contains byte-identical C0 workflow members and the required protected-main + check is passing. This adds no App, workflow, environment, secret, provider/publication/release + authority, or restored-ref resume path. +- [ ] Apply one universal fresh gate immediately before every provider-key mapping, OIDC exchange, + App-token mint/use, artifact access/download, or external effect. The responsible workflow/tool/ + broker freshly double-reads T0/T1, verifies exact annotated-tag and peeled object OIDs/raw hashes, + reconstructs the exact stable two-ruleset projection from fresh receipts, and matches the sealed + tag binding plus `campaign_registry_sha256`. Temporary read failure yields no token, effect, or + state; cached preflight, environment approval, intent, prior receipt, idempotent retry, or + response-loss recovery never bypasses the gate. It then reconstructs hold, exposure, permanent + publication denylist and active-containment roots. A nonnull containment root denies every + constructive mint/dispatch/merge admission/release authorization; only its intent-bound barrier, + merge-won classification, resumption proof and terminal finality row remain. Proven drift admits + only the exact drift/exposure/close/safe-invalid exceptions generated by the schema. +- [ ] Prove the external broker alone holds the state-writer App private key and minted installation + token. The Actions client sends only OIDC plus canonical `AuthorityMutationRequestV1`; no token, + key, JWT signer, arbitrary URL, path, packfile, commit, or App credential returns to Actions. + Credential canaries must be absent from request/receipt bytes, logs, errors, child environments, + and generated artifacts. +- [ ] Define `AuthorityMutationRequestV1` as the exact strict three-member `mutation_kind` union. + `campaign_event` has the sole variant field `campaign_event_source: + CampaignEventMutationSourceV1`, whose exact fields are + `schema_version,transition_number,event_type,event_record,event_sha256,required_member_paths, + required_member_sha256s,recorded_at,source_sha256`; the parallel member arrays are positive, + equal-length, canonical-order and duplicate-free and hash under + `laconian-campaign-event-mutation-source-v1\n`. `initial_publication_receipt_append` has only the + nested exact `InitialPublicationReceiptAppendV1`; `initial_release_receipt_append` has only the + nested exact `InitialReleaseReceiptAppendV1`. The exact ordered common fields are + `schema_version,mutation_kind,,campaign_id,campaign_registry_sha256, + authority_ref,mutation_mode,expected_current_oid,proposed_tree_oid,commit_timestamp, + state_writer_git_identity_sha256,predecessor_unresolved_hold_root, + successor_unresolved_hold_root,predecessor_active_credential_exposure_incident_id, + successor_active_credential_exposure_incident_id, + predecessor_active_credential_exposure_pending_root, + successor_active_credential_exposure_pending_root, + predecessor_publication_merge_denylist_root_sha256, + successor_publication_merge_denylist_root_sha256, + predecessor_active_publication_terminal_containment_root, + successor_active_publication_terminal_containment_root,oidc_run_identity_sha256,request_id, + idempotency_key,request_sha256` under + `laconian-authority-mutation-request-v1\n`. Each append's parent/time/idempotency key equals the + outer expected OID/commit time/key and byte-preserves every state/root field. + Missing/extra fields, caller-supplied packfile/commit/arbitrary path, reused idempotency key with + different bytes, or mismatch against the signed OIDC identity is denied before App-token minting. +- [ ] Own the closed, acyclic §7.6 initial-publication and initial-release receipt wires in + `publication_wire.py` and `release_wire.py`; Publication imports and re-exports these identical + objects and never defines a second copy. The common release receipts are usable by both initial + and correction flows, while only the two publication and four release append variants authorize a + non-state authority commit. + +- [ ] Keep OIDC/JWKS/API transport evidence outside the authority identity projection. The exact + state-broker projection contains only repository, repository_id, repository_owner, + repository_owner_id, actor, actor_id, ref, ref_type, sha, event_name, workflow, workflow_ref, + workflow_sha, job_workflow_ref, job_workflow_sha, run_id, run_attempt, check_run_id, and + runner_environment. The signed broker request carries only its digest. Raw typ/alg/kid/issuer/ + audience/subject/jti/time claims, triggering-actor API evidence and JWKS/run/job receipts remain + broker audit inputs, not extra projection fields. The reusable state job has no environment claim; + reject any exported raw-OIDC projection schema, deployment/approval field, job-name field, + caller-supplied claim projection, or raw-token metadata that could confer authority. +- [ ] Define the two initial-publication effect receipts exactly in publication_wire.py. + PublicationBranchReceiptV1 contains, in order, schema_version, campaign_id, + campaign_registry_sha256, publication_id, positive publication_attempt, intent_sha256, + operation created|adopted, branch_name, base_oid, head_oid, + branch_create_delivery_resolution_sha256, publisher_credential_disposition_sha256, + publisher App actor, request_receipts_root, and receipt_sha256. PublicationPRReceiptV1 contains + schema_version, the same campaign/registry/publication/attempt/intent, branch_receipt_sha256, + operation created|adopted, positive pull_request_number, pull_request_node_id, exact HTTPS URL, + base/head OIDs, marker, merge_eligibility_receipt_sha256, + merge_eligibility_delivery_resolution_sha256, pr_create_delivery_resolution_sha256, + pr_marker_discovery_sha256, eligibility and PR-create publisher credential disposition roots, + publisher App actor, request_receipts_root, and receipt_sha256. Their domains are respectively + laconian-publication-branch-receipt-v1\n and laconian-publication-pr-receipt-v1\n, omitting + only receipt_sha256. +- [ ] Define InitialPublicationReceiptAppendV1 as the strict receipt_kind union of + InitialBranchReceiptAppendV1 and InitialPRReceiptAppendV1. Every variant contains exactly, in + order, schema_version, mutation_kind=initial_publication_receipt_append, literal receipt_kind, + campaign_id, campaign_registry_sha256, publication_id, positive publication_attempt, bundle_kind, + authorizing_intent_sha256, publication_plan_sha256, authority_parent_oid, + campaign_state_sha256_before, campaign_state_sha256_after, nullable predecessor_append_sha256, + literal receipt_path, class-bound receipt_payload, append_idempotency_key, recorded_at, and + append_sha256. Branch is kind branch/path branch-receipt.json/null predecessor/ + PublicationBranchReceiptV1/domain laconian-initial-branch-receipt-append-v1\n; PR is kind + pull_request/path pr-receipt.json/immediate branch predecessor/PublicationPRReceiptV1/domain + laconian-initial-pr-receipt-append-v1\n. recorded_at is the accepted + PUBLICATION_INTENT_AUTHORIZED time plus exactly one or two seconds, never a workflow clock. +- [ ] Define the shared release authorization/result wire exactly in release_wire.py. + ReleaseEffectAuthorizationV1 contains schema_version, intent_kind initial|correction, + campaign_id, campaign_registry_sha256, publication_id, nullable publication_attempt, nullable + correction_id, authorizing_intent_sha256, preauthorized_release_plan_sha256, + executable_release_plan_sha256, security_attestor_receipt_sha256, + tag_target_kind initial_merge|correction_approved_head, authorized_tag_target_oid, and + authorization_sha256. Initial requires positive attempt/null correction; correction requires + null attempt/path-safe correction ID. Its domain is + laconian-release-effect-authorization-v1\n, omitting only authorization_sha256. +- [ ] ReleaseEffectResultV1 contains exactly schema_version, effect_kind + tag_object|tag_ref|draft_release|asset|publish|final_verification, nested exact authorization, + effect_idempotency_key, api_method POST|PATCH|GET, endpoint_template, request_payload_sha256, + request_receipts_root, positive response_status, raw_response_sha256, + canonical_response_sha256, operation created|uploaded|published|adopted|verified, + external_object_observation_sha256, and effect_result_sha256. Its domain is + laconian-release-effect-result-v1\n. AnnotatedTagEffectResultsV1 contains exactly + schema_version, tag_effect_idempotency_key, tag-object result, tag-ref result, and + effect_results_root_sha256 under laconian-annotated-tag-effect-results-v1\n. The tag steps are + object ordinal 0 then ref ordinal 1 with the exact derived step keys; a one-step effect_kind=tag, + lightweight tag, reordered pair, or hidden partial result is invalid. +- [ ] InstallationTokenRevocationReceiptV1 contains exactly schema_version, campaign_id, + campaign_registry_sha256, publication_id, authorization_sha256, effect_kind + tag|draft_release|asset|publish|final_verification, subject_kind + complete_effect_result|partial_effect_prefix|failed_delivery_resolution, subject_root_sha256, + token_closure_projection_sha256, release-finalizer App identity, token_fingerprint_sha256, + token_vault_committed_at, token_expires_at, endpoint DELETE /installation/token, API version + 2022-11-28, outcome revoked_204|ambiguous_delivery_then_confirmed_unusable| + expired_then_confirmed_unusable, revoked_or_confirmed_unusable_at, and + revocation_receipt_sha256. Its domain is + laconian-installation-token-revocation-receipt-v1\n. It contains no free effect-result root, + issue-time alias, request-root alias or standalone denial-probe root; those facts reconstruct + through the exact signed closure projection. +- [ ] FinalReleaseVerificationReceiptV1 contains exactly schema/campaign/registry/publication, + authorization, final-verification ReleaseEffectResultV1, effect_delivery_resolution_sha256, + immutable_release_verification_sha256, final_external_objects_root_sha256, release-finalizer + actor, request_receipts_root, final-verification revocation, and receipt_sha256. Its domain is + laconian-final-release-verification-receipt-v1\n. +- [ ] Define the four shared outer receipt payloads exactly. TagReceiptV1 has authorization, + AnnotatedTagEffectResultsV1, separate tag-object and tag-ref delivery-resolution roots, tag + name/object/target, actor, the ordered object-then-ref request-receipt Merkle root, tag-token + revocation, and receipt digest. DraftReleaseReceiptV1, ReleaseAssetReceiptV1, and PublishReceiptV1 + each add effect_delivery_resolution_sha256 immediately after their class-bound effect result and + otherwise retain the approved exact object/operation/actor/request/revocation fields. Their + domains are laconian-tag-receipt-v1\n, laconian-draft-release-receipt-v1\n, + laconian-release-asset-receipt-v1\n, and laconian-publish-receipt-v1\n, omitting only each + receipt_sha256. Every nested authorization and effect result byte-matches; each success receipt + binds the complete exact-success delivery resolution, and asset payloads are exactly ordinals + [0,1] with one release ID and distinct names/IDs. +- [ ] Define InitialReleaseReceiptAppendV1 as the strict tag|draft_release|assets|publish union. + Every variant contains exactly, in order, schema_version, mutation_kind, + receipt_kind, campaign_id, campaign_registry_sha256, publication_id, positive + publication_attempt, authorizing_intent_sha256, preauthorized_release_plan_sha256, + executable_release_plan_sha256, security_attestor_receipt_sha256, authority_parent_oid, + campaign_state_sha256_before, campaign_state_sha256_after, nullable predecessor_append_sha256, + literal receipt_path, class-bound receipt_payload, append_idempotency_key, recorded_at, and + append_sha256. Paths/payloads are tag-receipt.json/TagReceiptV1, + draft-release-receipt.json/DraftReleaseReceiptV1, + asset-receipts.json/exact ordered two-member ReleaseAssetReceiptV1 tuple, and + publish-receipt.json/PublishReceiptV1. Their exact domains are + `laconian-initial-tag-receipt-append-v1\n`, + `laconian-initial-draft-release-receipt-append-v1\n`, + `laconian-initial-asset-receipts-append-v1\n`, and + `laconian-initial-publish-receipt-append-v1\n`, respectively. + recorded_at equals the accepted RESULT_RELEASE_INTENT_AUTHORIZED time plus exactly one, two, + three, or four seconds respectively. No wrapper omits publication_attempt/recorded_at or derives + time from an effect/retry/workflow clock. +- [ ] Add independent literal canonical vectors for every shared receipt/aggregate/append preimage + above. Initial release binds the acyclic + InitialPreauthorizedResultReleasePlanV1 -> passing SecurityAttestorReceiptV1 -> + ExecutableResultReleasePlanV1(intent_kind=initial) -> ResultReleaseIntentV1 graph: the + preauthorized and executable digests are distinct and each is recomputed from its nested object. + Correction binds CorrectionReleaseIntentPlanV1.plan_sha256 as preauthorization and the postmerge + `ExecutableResultReleasePlanV1.executable_release_plan_sha256` as executable while retaining the + immutable approved-head tag target and original `CorrectionIntentV1` digest. Reject legacy + one-plan aliases, equality + between the two initial plan digests, attestor substitution, merge-commit retargeting, omitted + delivery roots, wrong tag step, partial-effect success, cross-intent/cross-publication replay, + wrong append time/attempt/path/predecessor, or an aggregate/checkpoint that drops final + verification or token closure. + +- [ ] Require every shared wire class to be strict/frozen/extra-forbid and hash exactly its + approved newline domain while omitting only its named self field. Verify release effect chronology + as authorization -> dispatch/delivery resolution -> exact effect result or partial prefix -> + signed token closure -> revocation receipt -> outer receipt. Every minted token has one complete, + partial, or failed-resolution subject and one first-decisive closure; a 204 permits no later delete, + an ambiguous-loss outcome requires bound same-token denial probes, and expiry requires no earlier + decisive observation. Count every post-boundary operation-dispatch start, not merely successful + calls, and require zero. +- [ ] Export only Runtime-owned shared broker, initial-publication receipt/append, release receipt/ + append and containment state/event/request/receipt types plus + `append_initial_publication_receipt` and `append_initial_release_receipt` from `campaign.__init__`. + Extend `tests/test_public_contract.py` to prove Publication imports those identical class objects + from `campaign.broker_wire`, `campaign.publication_wire`, `campaign.release_wire`, state and + authority owners, never subclasses, aliases or locally flattened copies. The six Runtime-owned + denylist/containment package exports are owner-identical to `campaign.publication_wire`, present + exactly once in Runtime's owner manifest, and absent from Publication's owner manifest; Publication + only class-bound consumes them. Freeze the exact authorization field tuple, the two tag + delivery roots, each non-tag effect_delivery_resolution_sha256, both append attempt/time fields, + and both receipt-family unions. The public export set contains no OIDC raw-token projection or + broker secret/handle type. +- [ ] Construct canonical Git SHA-1 blobs, trees, and commits independently. Require repository + object format SHA-1, exact `100644` record blobs and `040000` trees, canonical raw-byte tree order, + no symlink/executable/submodule, exactly zero parents for bootstrap or one expected parent for a + successor, the frozen `StateWriterGitIdentityV1` author/committer lines, whole-second UTC epoch, + and message `laconian benchmark authority transition <20-digit-number>: \n` + for event commits. An initial-publication append instead uses exactly + `laconian benchmark authority state <20-digit-current-transition>: initial-publication-\n`; + an initial-release append uses the corresponding exact + `...: initial-release-\n`. Neither invents or increments a campaign transition. The + author/committer epoch and request commit time equal the nested event/append `recorded_at` exactly; + there is no fourth message grammar. + Author and committer epochs and `+0000` offsets are byte-identical; there is no + `encoding`, `gpgsig`, `mergetag`, or continuation header. Reject ambient Git config, alternate identity, extra + header/object/tree member, SHA-256 repository format, or noncanonical bytes. Recompute every OID + from exact `type SP decimal-size NUL content` bytes rather than trusting Git CLI output. +- [ ] Fake Git smart HTTP and require only discovery + `GET /OWNER/REPO.git/info/refs?service=git-receive-pack`, upload + `POST /OWNER/REPO.git/git-receive-pack`, and read-only ref/object reconciliation. Bootstrap sends + all-zero old SHA-1 OID with `expected_absent`; successors send the exact expected current OID. + The broker accepts only one-parent fast-forward history and exact missing object closure. REST ref + creation/update, Git Database writes, Contents writes, force, delete, alternate ref, extra packed + object, or inferred old OID is rejected. +- [ ] For transition one require `mutation_mode=expected_absent`, null expected OID, transition 1, + `PREFLIGHT_SEALED`, a parentless commit, and literal old OID + `0000000000000000000000000000000000000000`. Every successor requires + `mutation_mode=expected_current_oid`, the exact 40-lowercase-hex predecessor, and one-parent + fast-forward child. Response-loss reconciliation may retry only the byte-identical request while + the ref remains absent/unchanged. +- [ ] Prove an invalid event leaves the last state and every spend/artifact record byte-identical while atomically adding one hold. +- [ ] Exhaustively test both initial-publication and all four initial-release append variants: exact direct campaign/registry/ + publication/initial-intent/plan equality; payload self digest; App actor; fixed filename; strict + predecessor append; aggregate asset ordinals/order; distinct idempotency key; exact old-OID lease; + positive publication attempt, deterministic recorded time, and byte-identical campaign-state + blob/hash/transition/hold/pending/denylist/containment roots. Inject loss before and + after each object upload/ref update and require byte-identical adoption. Reject a missing/skipped/ + duplicate/reordered path, correction authorization, locally fabricated receipt, arbitrary payload, + state/event change, half-null gate, stale OID, and any generic non-state append. Require branch then + PR appends before either publication-open event, and all four release appends as authoritative + files before `RESULT_RELEASED`; `RELEASE_PLAN_INVALIDATED` may terminate a partial + prefix while preserving every already-recorded external object. +- [ ] Test dismissal only in the exact schema-enumerated states. Require the plan-selected C0-policy + identity to equal OIDC actor and rerun triggering actor, be distinct from the rejected-event source, + and produce the exact `INVALID_EVENT_DISMISSED` CAS. `benchmark-publish` environment approval is + additional provenance, never the identity authority; excluded states and actors fail closed. +- [ ] Exhaustively parameterize pre-auth/transient/benign-sibling denials versus authenticated + hold-worthy failures. Prove only the latter creates the one hold; dismissal then requires the exact + frozen eligible actor, strict plan, and no-effects proof. Identity/provenance/spend/delivery/ + credential/STOP/release/security defects use their typed consumer paths and cannot be relabeled as + a dismissible no-op under any actor or terminal state. +- [ ] Test nondismissible terminal paths: a pre-merge `PERMANENT_STOP` hold, the accepted post-merge + `RELEASE_PLAN_INVALIDATED -> RELEASE_BLOCKED` state transition, and post-release correction-lineage + evidence stages appended without rewriting history. A `correction_release` mutation leaves + `RELEASED` unchanged, but from `RELEASE_BLOCKED` the read-only recorder must derive both the + correction-release envelope and the separately verified `CORRECTION_RESULT_RELEASED` event in one + ordered candidate package. The broker installs the schema-required records in one deterministic + authority commit and one expected-old-OID receive-pack lease. +- [ ] Reject every predecessor-only durable-substitution/checkpoint schema or locator-rebinding + channel. The approved authority tree retains its exact canonical records and immutable event/ + receipt evidence, while transient Actions artifacts remain required inputs until their approved + terminal consumer has copied only the normative digests/receipts into authority. A missing or + expired referenced artifact is fatal; a protected merge tree, result tag, Release, asset, same-name + file, or caller mapping cannot substitute for it. Postmerge reconstruction instead verifies the + approved merge/admission, release-effect, final-verification, token-closure, and terminal- + containment records at their exact authority paths. Test expiration, same-bytes-at-another-path, + merge-tree/tag/asset substitution, incomplete ancestry, and an invented checkpoint member; each + fails without changing authority. +- [ ] Treat correction progress as the schema's same-state `CampaignEventV1` records, not as a + generic terminal-evidence mutation API. Runtime validates the exact event discriminator, + predecessor correction member, active correction ID/phase, authority roots, and unchanged + `RELEASED|RELEASE_BLOCKED` state where required; Publication owns construction and external-effect + verification. Require the distinct + `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, + publication_outcome=unmerged_invalid|merged_invalid)` and + `CORRECTION_INVALIDATED(kind=correction_release_invalidation)` schemas. Either invalidation makes + that correction ID terminal; continuation requires a new ID, and `merged_invalid` additionally + requires explicit supersession of the failed correction and contaminated merge. Reject a generic + invalidation alias, phase gap, duplicate terminalization, two active corrections, or stale lease. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_state_broker.py tests/campaign/test_authority_git.py tests/campaign/test_authority.py -q +``` + +Expected RED: broker policy, canonical object builder, receive-pack lease, and authority APIs are absent. + +#### Step 4: GREEN authority mutations + +- [ ] Implement no intermediate authority-envelope union. A candidate carries exactly one of the + three class-bound sources already present in `AuthorityMutationRequestV1`: exact + `CampaignEventMutationSourceV1`, `InitialPublicationReceiptAppendV1`, or + `InitialReleaseReceiptAppendV1`. Revalidate the source object, required-member manifest, + predecessor authority/state/root tuple, provenance and digest directly; a generic unchanged-state + append, predecessor-envelope hash, or fourth wrapper schema is rejected. +- [ ] Define `AuthorityMutationV1` as a strict frozen candidate package containing campaign ID, + `campaign_registry_sha256`, expected authority-ref OID (nullable only for initial creation), + predecessor authority-head/state/hold roots, predecessor active-exposure incident ID and pending + root, predecessor publication denylist and active-containment roots, predecessor correction/ + publication roots, one schema-ordered three-member mutation source, and all + resulting roots and active-exposure fields, + trusted artifact provenance, `state_writer_git_identity_sha256`, and mutation digest. The broker replays the + source before constructing one deterministic child commit; the initial-receipt variant retains + every state/root/transition field byte-for-byte. The containment-start candidate alone appends one + denylist snapshot and sets its intent root; its terminal consumer preserves that denylist and + clears only the matching active root. Candidates are composable only + through a pure builder, never by concatenating JSON. +- [ ] Implement `apply_campaign_event` so each event adds exactly the schema-required canonical + `events`, `evidence`, `corrections`, `publication`, `receipts`, or `incidents` members in one + candidate authority tree. A correction release receipt must already be the exact predecessor of + `CORRECTION_RESULT_RELEASED`; no concatenated JSON or caller-selected extra record is accepted. + Implement `dismiss_invalid_event_hold` only as construction of the exact + `INVALID_EVENT_DISMISSED` event from one verified `InvalidEventDismissalPlanV1` and matching + `InvalidEventDismissalEvidenceV1`; no untyped hold-mutation channel remains. +- [ ] Implement `append_initial_publication_receipt` and `append_initial_release_receipt` as the only + non-event builders. The publication builder reconstructs the exact active complete/invalid initial + intent at `BUNDLE_COLLECTED|INVALID_FINALIZED`, requires null hold/exposure/containment, verifies + campaign/registry/publication/positive attempt/bundle/intent/plan/actor and deterministic time, + and appends only branch then PR. The release builder class-bound + revalidates the Runtime-owned common receipt and append variant, reconstructs the authoritative + initial `release-intent.json`, requires `RESULT_MERGED`, null hold/pending/containment roots, exact direct + campaign/registry/publication/positive attempt/intent, separately recomputed + `InitialPreauthorizedResultReleasePlanV1` and `ExecutableResultReleasePlanV1` digests, exact + security-attestor receipt, and the next absent path in the four-row + order. It returns one mutation whose state blob/hash/transition and every nonreceipt tree member + are byte-identical. Neither builder can accept a correction receipt, raw bytes, path, callback, Boolean, + candidate OID, or caller-selected event. Publication supplies only the strict shared object. +- [ ] Define each authority Git commit as a canonical tree containing the current head record, + immutable envelope bytes, and the exact numeric artifact IDs/service/payload digests required to + reconstruct every ancestor. The commit has the previously observed authority-ref OID as its sole + parent. Reject every missing/expired referenced ancestor at every state. At or after + `RESULT_MERGED`, additionally verify the exact protected merge/admission records; at or after + `RESULT_RELEASED`, verify the annotated tag, published Release/assets, immutable-Release evidence, + final verification and token closures named by the accepted authority records. These external + objects do not replace an absent authority member or transient artifact required by an earlier + event. A mutable-ref lookup, merely same-named file, caller mapping, or invented durable checkpoint + is fatal. The protected authority Git history stores every canonical authority record and never + delegates record identity to Actions-artifact discovery. +- [ ] Implement `AuthorityTreeSchemaV1` with exact root blob `campaign-state.json` and optional root + trees `events`, `evidence`, `holds`, `receipts`, `corrections`, `publication`, `incidents`, and + `denylist`. Admit only the exact incident paths `incidents//pending.json`, + `incidents//effects/<8-digit-ordinal>.json`, terminal/supplement evidence paths, and + `denylist/provisional/.json` or `denylist/permanent/.json`; never a + generic incident/denylist filename or caller-selected path. + The publication append family admits only + `publication/initial//attempts/<20-digit-publication-attempt>/branch-receipt.json`, + then the same prefix's `pr-receipt.json`. The release append family admits only that exact attempt + prefix's `tag-receipt.json`, then `draft-release-receipt.json`, then `asset-receipts.json`, then + `publish-receipt.json`; each file + is the canonical matching Runtime-owned append variant and nested receipt payload. The prefix, + publication ID, filename, kind, predecessor append digest, and presence/absence of all earlier + members are derived from authority and cannot be supplied as a free path. Campaign-event + envelopes cannot create these six files, and either append family cannot create any other + tree member. + Preflight stores the empty publication denylist snapshot at + `denylist/publication/merge/.json`. Containment start additionally appends exactly its + successor snapshot, generic event, byte-identical intent-local `containment-start-event.json`, + `publication/containment//{intent,broker-prefix,vault-prefix}.json`; terminal finality + appends only the finality-derived content-addressed barrier, nullable fenced-write-ambiguity, + nullable merge-won, required finality and ordinary no-later/unavailable evidence members. Require + a stored zero-residual barrier, exact payload class/root/path derivation and immutable retention of + every older denylist/containment member. + Event paths are `events/<20-digit-transition>-.json`; content-addressed evidence + paths are exactly `evidence//.json`. Every successor retains every prior member + byte-for-byte. A campaign-event successor replaces only `campaign-state.json` and appends exactly + the current schema-required members; an initial-receipt successor retains `campaign-state.json` + byte-for-byte and appends only its one receipt path. + Reject deletion, rewrite, executable/symlink/submodule modes, unsafe/non-NFC names, duplicate + entries, or any path not admitted by the current event schema. +- [ ] Implement `tools/benchmark_state_broker_client.py` as a fixed, argument-closed OIDC client. + It accepts only the canonical mutation-request path and fixed broker audience/endpoint compiled + into the C0-reviewed tool, obtains one GitHub OIDC token, sends both once, and verifies the + canonical `AuthorityMutationReceiptV1`. It has no checkout, App ID, installation ID, private key, + installation token, packfile, arbitrary URL, retry mutation, or ref-write code. The external + broker class-bound revalidates every source record, reconstructs the predecessor, constructs the + exact Git objects, mints the state-writer installation token, performs one receive-pack lease, + discards the token within five minutes, and returns only the safe receipt. +- [ ] Implement `StateWriterGitIdentityV1` use end to end. Preflight matches the frozen tag member to + the installed App account and broker policy; `PREFLIGHT_SEALED`, every later event, every mutation + request/receipt, and every canonical commit bind the same digest. A changed App identity requires a + new tag/security attestation/campaign and cannot continue an existing authority ref. +- [ ] Implement `AuthorityMutationReceiptV1` as the same exact strict three-member union. The event + variant carries exactly `transition_number,event_type,event_sha256, + event_member_manifest_root_sha256`; each append variant carries only + `receipt_kind,receipt_path,append_sha256`. Its ordered common fields are + `schema_version,mutation_kind,,campaign_id,campaign_registry_sha256,request_id, + idempotency_key,authority_ref,mutation_mode,expected_old_oid,ordered_blob_oids,ordered_tree_oids, + candidate_commit_oid,observed_before_oid,observed_after_oid,outcome,endpoint_policy_sha256, + github_request_receipts,final_reconciliation_receipts,app_actor_id,app_actor_login, + state_writer_git_identity_sha256,oidc_run_identity_sha256`, then the exact predecessor/successor + hold, exposure incident, exposure pending, publication denylist and active-containment pairs, + `started_at,completed_at,receipt_sha256` under + `laconian-authority-mutation-receipt-v1\n`. Every discovery GET and + possibly delivered receive-pack POST appears once; response loss has null status/safe response, + and reconciliation observations cannot be omitted. On response loss adopt + only an exact fully reverified candidate; retry only while the ref is unchanged; any third OID or + byte disagreement is a terminal conflict. +- [ ] Define `AuthorityRefReconciliationReceiptV1` with exactly + `schema_version,repository_id,authority_ref,candidate_commit_oid,expected_old_oid, + observation_round,method,endpoint_template,request_id,request_dispatched_at, + response_completed_at,response_status,observed_ref_oid, + verified_candidate_object_closure_root_sha256,resolved_state,reconciliation_receipt_sha256` + under `laconian-authority-ref-reconciliation-receipt-v1\n`. Method/endpoint are the literal + authority-ref GET; round is `1|2`; 404 maps only to absent/null observation, 200 requires an OID, + and only an exact candidate may carry the verified closure root. Every mutation receipt contains + both ordered rounds with distinct request IDs and equal final resolution; `created|adopted_exact` + requires two exact-candidate reads after all possibly delivered receive-pack attempts. Test 404, + divergent/candidate byte mismatch, changed state between rounds, omitted lost write, reordered + round, and retry-after-third-OID as terminal failures. +- [ ] Compute `unresolved_hold_root` from the exact current active-hold projection and compute + `active_credential_exposure_pending_root` only through the normative empty/link/progress preimages; + neither root may be copied from a request. Require each exposure receipt to byte-match campaign, + incident, originating pending digest, predecessor progress root, and next ordinal before deriving + its successor root. +- [ ] Implement `require_ordinary_effect_gate` in `campaign.authority` with the exact signature + `require_ordinary_effect_gate(authority: ReconstructedAuthorityV1) -> None`; export it from + `campaign.__init__`. It first verifies the active incident-ID/pending-root pair invariant and + reconstructs the full monotone publication denylist, and admits an ordinary credential/effect/ + event only when `unresolved_hold_root`, `active_credential_exposure_incident_id`, + `active_credential_exposure_pending_root`, and `active_publication_terminal_containment_root` are all + proven null; typed atomic + consumers are admitted only by their generated schema rows. Keep `apply_campaign_event` pure: it + constructs a candidate bound to expected state, hold root, both active-exposure fields, denylist, + active containment, and authority-ref OID. The broker re-verifies every field immediately before + the receive-pack lease. +- [ ] Run state and authority files together to GREEN: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_publication_wire.py tests/campaign/test_release_wire.py tests/campaign/test_state_schema.py tests/campaign/test_state.py tests/campaign/test_state_broker.py tests/campaign/test_authority_git.py tests/campaign/test_authority.py -q +``` + +Expected GREEN: PASS; the schema-generated state machine, external broker policy, canonical Git +objects, smart-HTTP receive-pack leases, and reconstructed authority all pass. + +#### Step 5: Commit + +- [ ] Run `git diff --check` and commit: + +```bash +git add src/laconian_eval/campaign/__init__.py \ + src/laconian_eval/campaign/state_schema.py \ + src/laconian_eval/campaign/state.py \ + src/laconian_eval/campaign/state_broker.py \ + src/laconian_eval/campaign/authority_git.py \ + src/laconian_eval/campaign/authority.py \ + src/laconian_eval/campaign/publication_wire.py \ + src/laconian_eval/campaign/release_wire.py \ + tools/benchmark_state_broker_client.py \ + tests/campaign/test_state_schema.py \ + tests/campaign/test_state.py \ + tests/campaign/test_state_broker.py \ + tests/campaign/test_authority_git.py \ + tests/campaign/test_authority.py \ + tests/campaign/test_publication_wire.py \ + tests/campaign/test_release_wire.py \ + tests/test_public_contract.py +git commit -m "feat: add fail-closed campaign authority" +``` + +### Task 4: Extend exact pricing with reservations and reconciliation + +**Files:** + +- Modify: `src/laconian_eval/campaign/spend.py` +- Modify: `tests/campaign/test_spend.py` +- Modify: `src/laconian_eval/campaign/preflight.py` +- Modify: `tests/campaign/test_preflight.py` + +#### Step 1: RED-test exact ledger pricing + +- [ ] Import and class-bound revalidate Foundations-owned `ResolvedPriceSnapshotV1`, + `PriceDimensionV1`, and `PriceSourceEvidenceV1`; Runtime must not redeclare a price schema or + rename a dimension. Require these exact five field names verbatim: + `ordinary_uncached_input_per_million`, `cache_read_input_per_million`, + `cache_write_input_per_million`, `visible_output_per_million`, and + `reasoning_output_per_million`. Map their canonical decimal representations to a separate strict + integer-micro-USD projection without binary floating-point arithmetic, preserving dimension, + `source_url`, `effective_date`, `usd_per_million`, and `source_sha256` equality. +- [ ] Import Foundations-owned `AppliedCacheControlStatus`, `CacheReadStatus`, `CacheWriteStatus`, + `ServiceTierStatus`, and `ReasoningTokenAccounting` plus + `PublicBenchmarkResponseEvidenceV1`/`PublicBenchmarkProviderErrorEvidenceV1`; do not redeclare or + widen any status type. Preserve and verify exact `applied_cache_control_source_sha256`, + `cache_read_source_sha256`, `cache_write_source_sha256`, `service_tier_source_sha256`, + `usage_source_sha256`, `reasoning_tokens_source_sha256`, and `returned_model_source_sha256` + evidence together with `raw_response_sha256` and provider-error-only `error_source_sha256`. Only + the exact successful status tuple + `reported_exact/reported_zero/reported_zero/reported_default`, or the matching independently + proven `not_applicable_definitely_not_sent`/`not_applicable_definitely_rejected` tuple, may release + no-cache/default-tier reservation components; missing, mismatch, invalid, or nonzero evidence + remains charged/reserved and emits STOP as prescribed. +- [ ] Accept usage/tier/cache evidence only from Foundation's exact canonical response paths: + `response.service_tier`, `response.prompt_cache_options.mode`, + `response.prompt_cache_options.ttl`, `response.usage.input_tokens`, + `response.usage.input_tokens_details.cached_tokens`, + `response.usage.input_tokens_details.cache_write_tokens`, `response.usage.output_tokens`, + `response.usage.output_tokens_details.reasoning_tokens`, and `response.usage.total_tokens`. An + alternate/flattened/inferred path or failed source digest never authorizes reconciliation. +- [ ] Define golden vectors for ordinary-uncached input, cache-read input, cache-write input, + visible output, reasoning output, and zero tokens using: + +```python +def token_charge_usd_micros(tokens: int, rate_usd_micros_per_million: int) -> int: + numerator = tokens * rate_usd_micros_per_million + return (numerator + 999_999) // 1_000_000 +``` + +- [ ] Assert each of the five components rounds up independently and the sum is overflow-bounded. + For trusted usage require `ordinary_uncached_input_tokens + cache_read_tokens + + cache_write_tokens == input_tokens`, `visible_output_tokens + reasoning_output_tokens == + output_tokens`, and every exact response-path/source digest/status from Foundations. A missing, + mismatched, or invalid dimension retains its conservative reservation; neither cache status may + supply or alter the other. +- [ ] Make the imported `ResolvedPriceSnapshotV1`, integer-micro-USD projection, and + `PriceAttestationV1` require + `service_tier == requested_service_tier == "default"` and five separate, reviewed, non-null + integer micro-USD-per-million rates plus source evidence for ordinary-uncached input, cache reads, + cache writes, visible output, and reasoning output for every frozen requested model ID. A numeric + zero is valid only when explicitly sourced and reviewed. Recompute the versioned `<=272_000` + conservative input proof; no long-context price class, threshold, field, fallback, reservation, + or reconciliation path exists in the authorized vocabulary. +- [ ] Bind literal `prompt_cache_options: {"mode":"explicit","ttl":"30m"}` and recursive absence + of every `prompt_cache_breakpoint` into the snapshot, reservation, and receipt. Reject floats, + decimal exponent strings, negative values, bools, a missing/nullable rate, source-evidence + mismatch, or unsupported requested/returned model ID. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_spend.py -q +``` + +Expected RED: pricing primitives exist from Task 2, but reservation, reconciliation, and ledger models are absent. + +#### Step 2: RED-test append-only attempt reservations + +- [ ] Reserve one row for every initial attempt and every allowed retry in the frozen batch, each + with plan item, attempt number, input bound, cache policy, worst-case cache-write bound, output cap, + requested service tier `default`, the five exact price dimensions, price snapshot hash, and exact + worst-case micro-USD. Conservatively price + each possible input token at the maximum compatible ordinary-uncached/cache-read/cache-write rate unless the frozen + policy and request identity prove a narrower mutually exclusive component. +- [ ] Freeze the reproducible envelope with `P_u`, `P_r`, `P_w`, `P_v`, and `P_h` denoting the five + micro-USD-per-million rates. Generation reserves the integer ceiling of + `(272_000 * max(P_u, P_r, P_w) + 1_024 * max(P_v, P_h)) / 1_000_000`; judge substitutes `768` for + `1_024`. Keep the five component counts separate with + `ordinary_uncached + cache_read + cache_write <= 272_000`. Confirmatory reserves exactly six such + attempt envelopes per request; pilot reserves one. Test hard-coded generation, judge, six-attempt, + 40-request shard, cap-equality, and next-batch-does-not-fit vectors independently of production. +- [ ] Reconcile independently as `never_started`, `trusted_usage`, `definitely_rejected_zero`, or `retained_worst_case`. +- [ ] Prove missing usage, ambiguous delivery, runner loss, unverified checkpoint, and prior failed retry retain full exposure. +- [ ] Prove a later success never releases an earlier attempt reservation. +- [ ] Prove rerun/replacement reservations are additive and a receipt cannot be reused. +- [ ] Test a 429-retry-success chain with both attempts separately accounted: the definitely rejected + first attempt may become `definitely_rejected_zero` only under the frozen verified zero-billing + rule; otherwise it retains its reservation, while the successful attempt uses trusted usage. +- [ ] Assert `charged_or_reserved + next_batch_reservation <= cap` before a plan may be sealed; exact equality is allowed. + +#### Step 3: GREEN ledger types and verifier + +- [ ] Implement canonical `PriceMicrosProjectionV1`, `RequestReservationV1`, `SpendEventV1`, + `SpendLedgerV1`, and `SpendSummaryV1`; import `ResolvedPriceSnapshotV1` and the evidence/status + types from Foundations without defining aliases or duplicate models. +- [ ] Make `append_spend_event` require the exact predecessor ledger hash, strictly increasing row number, single-use reservation identity, and current campaign/price hashes. +- [ ] Implement a streaming verifier that recomputes totals and refuses unknown event kinds or nonterminal reconciliation gaps. +- [ ] Integrate `seal_preflight` with the exact pilot/full cap and projected attempt counts. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_spend.py tests/campaign/test_preflight.py -q +``` + +Expected GREEN: PASS; every reservation and five-component reconciliation is exact. + +#### Step 4: Commit + +- [ ] Commit spend and now-GREEN preflight together: + +```bash +git add src/laconian_eval/campaign/spend.py src/laconian_eval/campaign/preflight.py tests/campaign/test_spend.py tests/campaign/test_preflight.py +git commit -m "feat: enforce exact campaign spend exposure" +``` + +### Task 5: Replace broad retries with the closed campaign policy + +**Files:** + +- Create: `src/laconian_eval/campaign/retry.py` +- Create: `tests/campaign/test_retry.py` +- Modify: `src/laconian_eval/providers/base.py` +- Modify: `src/laconian_eval/providers/openai.py` +- Modify: `src/laconian_eval/capsule/attempts.py` +- Modify: `tests/test_openai_provider.py` +- Modify: `tests/capsule/test_attempts_v2.py` +- Modify: `tests/capsule/test_delivery_certainty.py` + +#### Step 1: RED-test provider error evidence + +- [ ] Keep legacy `GenerationRequest`, `GenerationResult`, and `ProviderError` bytes unchanged. + Extend public-benchmark fixtures around Foundations-owned + `PublicBenchmarkProviderErrorEvidenceV1.structured_status` and add a campaign-owned sanitized + Retry-After evidence record without exposing response headers or exception bodies. +- [ ] Assert 401/403 are definite rejections with permanent STOP classification; structured 429 is definite rejection; timeout, connection, 408, 409, 5xx, and unknown status have unknown delivery. +- [ ] Assert SDK retries remain exactly zero. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/test_openai_provider.py -q +``` + +Expected RED: the campaign-owned Retry-After projection and exact public-benchmark 429 evidence +matrix are absent, and current 409/5xx behavior is broader than the campaign contract. + +#### Step 2: RED-test `RetryPolicyV1` + +- [ ] Freeze these constants: + +```python +RETRY_POLICY_VERSION = "openai-429-full-jitter-v1" +BASE_BACKOFF_MS = 1_000 +MAX_EXPONENTIAL_BACKOFF_MS = 60_000 +MAX_RETRY_AFTER_MS = 300_000 +``` + +- [ ] Accept `Retry-After` only as ASCII delta-seconds `0..300`; any other value is recorded as unusable and falls back to jitter. +- [ ] Derive `exponential_bound_ms = min(60_000, 1_000 * 2 ** (attempt - 1))`. +- [ ] Derive an inclusive integer jitter in `[0, exponential_bound_ms]` from the campaign seed, `"retry-jitter-v1"` domain, batch hash, plan item ID, and attempt number. Do not use ambient randomness. +- [ ] Retry only when `structured_status == 429`, delivery certainty is + `definitely_rejected`, and the complete Foundation evidence proves that no Responses result and no + usage exist: response ID and returned model/tier are null; usage is wholly unavailable with no + counts; applied-cache, cache-read, cache-write, and service-tier statuses are each exactly + `not_applicable_definitely_rejected`; and every independent source digest validates. Retry count + must also remain, no STOP/hold may exist, the next attempt reservation must exist, and the + deadline must cover backoff + timeout + durable work + the 900-second checkpoint margin. +- [ ] Assert pilot maximum retries is exactly zero and confirmatory maximum retries is exactly five, + derived only from the verified manifest/phase plan. A sixth retry, SDK retry, retry of any other + status/certainty, workflow override, or unreserved attempt is rejected before sleep or dispatch. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_retry.py tests/capsule/test_delivery_certainty.py -q +``` + +Expected RED: campaign retry module and evidence schema are absent; legacy fixed exponential expectations fail. + +#### Step 3: GREEN closed taxonomy and evidence + +- [ ] Implement `RetryEvidenceV1` with status, certainty, raw safe Retry-After, bounded value, exponential bound, seed-derivation digest, chosen delay, source, attempt reservation hash, deadline remainder, and decision. +- [ ] Keep `RawAttemptV2` policy-neutral: validate terminal/backoff structural consistency but stop enforcing `100 * 2 ** n`. Bind exact campaign retry policy through spend/controller evidence instead. +- [ ] Update OpenAI classification and sanitizer boundaries. Header lookup failures become unusable Retry-After, never untrusted text in public errors. +- [ ] Run provider, attempt, delivery, and retry tests to GREEN: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_retry.py tests/test_openai_provider.py tests/capsule/test_attempts_v2.py tests/capsule/test_delivery_certainty.py -q +``` + +Expected GREEN: PASS; only the exact definitely-rejected 429 evidence receives a bounded retry. + +#### Step 4: Commit + +- [ ] Commit: + +```bash +git add src/laconian_eval/campaign/retry.py src/laconian_eval/providers/base.py src/laconian_eval/providers/openai.py src/laconian_eval/capsule/attempts.py tests/campaign/test_retry.py tests/test_openai_provider.py tests/capsule/test_attempts_v2.py tests/capsule/test_delivery_certainty.py +git commit -m "feat: enforce closed live retry policy" +``` + +### Task 6: Seal bounded batch plans and consume one job receipt + +**Files:** + +- Create: `src/laconian_eval/campaign/batch.py` +- Create: `tests/campaign/test_batch.py` +- Modify: `src/laconian_eval/campaign/models.py` +- Modify: `src/laconian_eval/campaign/spend.py` +- Modify: `src/laconian_eval/campaign/__init__.py` + +#### Step 1: RED-test deterministic contiguous-prefix selection + +- [ ] Given registry order, predecessor ledger, checkpoint inventory, remaining time, and cap, assert the selected work is the largest contiguous prefix that fits all frozen call, reservation, and time bounds. +- [ ] Do not begin the judge half of this task until Slice 2's owning hard-score/judge task has + committed `JudgeRequestAttachmentV1`, its exact verifier, ordered request-ID semantics, and the + generation-context/index interface used before judge execution. The generation half may proceed + earlier. This prerequisite is inherited by Task 7 and is an explicit partial-order edge; campaign + code must not recreate a Slice 2 record. +- [ ] Reject reordering, gaps, duplicate request IDs, a shard/request outside the remaining suffix, + an enlarged plan, a stale predecessor, wrong workflow/registry/tag-pair hash, wrong price hash, + nonnull hold, nonnull active exposure root, nonnull active publication-containment root, a + nonreconstructing/mismatched publication denylist root, or STOP. +- [ ] Assert `BatchPlanV1` binds campaign, `campaign_registry_sha256`, complete companion-tag binding, + phase, mode, both tag objects/peeled commits, workflow SHA-256, requested service-tier literal/root, + predecessor state/spend/inventory/hold/active-exposure/publication-denylist/active-containment + roots, ordered shard/request + identities, per-attempt reservation hashes, maximum attempts, worst-case reservation, price + snapshot hash, all five rate/source roots, literal explicit/30m cache policy, recursive + no-breakpoint proof, monotonic allowance, soft deadline, and plan hash. +- [ ] Define `VerifiedPhasePlanV1` as the full immutable campaign-phase index from which contiguous + batches are sliced. Generation contains the seed-ordered 36 shard units and every ordered plan-row + ID. Judge contains the same 36 shard slots, each verified `JudgeRequestAttachmentV1` hash, and its + exact ordered request IDs, including empty tuples for zero-call attachments. Bind its digest in + every `BatchPlanV1` and `CampaignStateV1.active_phase_plan_sha256`. +- [ ] Assert an empty remaining suffix cannot produce a provider batch. +- [ ] Define strict frozen `CheckpointInventoryEntryV1` with phase, verified phase-plan ordinal, + exact plan-item/request ID, nullable checkpoint `ArtifactIdentityV1`, capsule/checkpoint/provenance + hashes, terminal-attempt hash, and next-plan index. Define `CheckpointInventoryV1` with campaign, + phase, verified phase-plan hash, all entries in ordinal order, predecessor inventory root, and + class-bound inventory root. Missing work is represented by a null checkpoint in its fixed slot, + never by deleting/reordering a slot. +- [ ] Define strict frozen `BatchPreparationRequestV1` with campaign ID, phase, mode, + `WorkflowIdentityV1`, UUID4 batch-attempt ID, expected authority-ref OID, expected state/spend/ + hold/active-exposure/publication-denylist/active-containment/inventory/phase-plan roots, and a + bounded monotonic allowance. It has no model, retry, price, + cap, order, URL, command, or free-form override; those come only from registry/authority. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_batch.py -q +``` + +Expected RED: batch planner is absent. + +#### Step 2: RED-test single-use receipt ordering + +- [ ] Prove `ConsumedBatchReceiptV1` binds one exact `ProviderJobIdentityV1`, current-price reviewer + attestation with all five non-null rate/source dimensions, reservation event/hash, batch plan, + `state_writer_git_identity_sha256`, and winning `AuthorityMutationReceiptV1`. +- [ ] Reject reused, missing, duplicate, superseded, run-attempt-mismatched, job-mismatched, and batch-attempt-mismatched receipts before provider construction. +- [ ] Instrument the provider factory and environment accessor and assert the consumed receipt and + winning remote `BATCH_RECEIPT_CONSUMED` authority commit and mutation receipt are durable before + the first API-key + environment lookup. Local fsync or an uploaded candidate is insufficient: re-fetch the protected + authority ref, reconstruct it from the winning OID, and match the exact workflow run, run attempt, + numeric provider job ID, UUID4 batch-attempt ID, plan, reservation, and receipt. +- [ ] Immediately before the provider step evaluates `OPENAI_API_KEY`, rerun the universal fresh + pair/policy/registry gate and the exact Foundation-owned + `require_benchmark_sdk_contract(c0_uv_lock_bytes=verified_c0.read_regular_file("uv.lock"), + expected_c0_uv_lock_sha256=verified_input_package.uv_lock_sha256)` call over the same verified C0 + member. Inject failure + at each read/model check and prove the provider secret expression is never evaluated, no provider + is constructed, no OIDC/App token is minted, no artifact is downloaded, and no state is changed. +- [ ] A rerun identity must append a new reservation and plan; it cannot claim a prior unused receipt. +- [ ] Race two pre-key consumers against the same expected authority-ref OID. Exactly one external + broker receive-pack lease wins; the loser never evaluates an `OPENAI_API_KEY` expression or constructs a + provider. Crash the winner after the broker lease but before the key-bearing step and prove no-input recovery + emits `NO_DISPATCH_PROVED` only when the exact GitHub job-step timeline says the key-bearing step + never started and no controller-start/attempt evidence exists. Any uncertain or started step + fails closed to `PERMANENT_STOP`; an `ACTIVE` state is never silently reused. + +#### Step 3: GREEN planner and receipt consumer + +- [ ] Implement `select_contiguous_batch` as a pure function with stable tie-free order. +- [ ] Implement `prepare_batch` so it appends reservation events and seals `PreparedBatchV1` without reading credentials. +- [ ] Implement `consume_job_receipt` with exact current-price attestation and an exclusive-create + receipt marker, producing a canonical `BATCH_RECEIPT_CONSUMED` candidate bound to the expected + remote authority-ref OID. It grants no credential authority by itself. +- [ ] Run receipt consumption in a separate key-free `receipt-writer` job. After `prepare`, start + both the environment-approved provider job and receipt-writer: the provider's first read-only step + waits boundedly and makes no provider import/call, while receipt-writer exhaustively lists the + exact run-attempt jobs, requires one statically named provider job plus its deployment approval, + binds that numeric job ID, and calls the fixed reusable OIDC state job so the external broker can + perform the expected-old-OID lease. No App PEM/token material enters either job. The provider wait + step re-fetches and reconstructs the winning ref; + only its next step may evaluate/map `OPENAI_API_KEY`. The later key-free `post` job records + completion/resume/STOP evidence and cannot retroactively authorize a call. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_batch.py tests/campaign/test_spend.py tests/campaign/test_authority.py -q +``` + +Expected GREEN: PASS; the contiguous planner and single-use receipt consumer satisfy every test. + +#### Step 4: Commit + +- [ ] Commit: + +```bash +git add src/laconian_eval/campaign/__init__.py src/laconian_eval/campaign/batch.py src/laconian_eval/campaign/models.py src/laconian_eval/campaign/spend.py tests/campaign/test_batch.py +git commit -m "feat: bind one live job to one batch receipt" +``` + +### Task 7: Run exact generation and judge suffixes + +This task may start its generation/context and hard-score/prepare-judge integration after Slice 2 +Tasks 3–4. Do not implement or turn GREEN the `Runtime.seal_judge` provider-evidence half, and do +not commit this serialized task, until Slice 2 Task 8 owns/exports +`VerifiedBenchmarkProviderEvidenceV1` and its loader. This preserves task-by-task execution without +duplicating the neutral post-judge bridge. + +**Files:** + +- Create: `src/laconian_eval/campaign/controller.py` +- Create: `src/laconian_eval/campaign/benchmark_adapter.py` +- Create: `src/laconian_eval/campaign/runtime.py` +- Create: `tools/benchmark_hard_score_stage.py` +- Create: `tools/benchmark_seal_judge_stage.py` +- Create: `tests/campaign/test_controller.py` +- Create: `tests/campaign/test_benchmark_adapter.py` +- Create: `tests/campaign/test_runtime.py` +- Modify: `src/laconian_eval/campaign/__init__.py` +- Modify: `src/laconian_eval/capsule/execution.py` +- Modify: `tests/capsule/test_execution.py` +- Modify: `tests/capsule/test_resume.py` +- Modify: `tests/test_public_contract.py` + +#### Step 1: RED-test a one-attempt capsule seam + +- [ ] Extract a private-to-capsule/public-to-campaign `execute_next_attempt` seam that executes exactly one already-verified next plan item under the capsule lock and returns canonical attempt/event hashes. +- [ ] Preserve `resume_capsule(path, *, provider_factory)` unchanged for local use. +- [ ] Prove no campaign callback, spend model, GitHub record, or API key enters generic capsule verification. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/capsule/test_execution.py tests/capsule/test_resume.py -q +``` + +Expected RED: the one-attempt seam is not exported. + +#### Step 2: RED-test every controller boundary + +- [ ] Before provider construction and before every initial call/retry, independently rerun the + universal fresh pair/policy/registry gate and revalidate registry/tag binding, batch plan, receipt, + state hash, nullable hold/active-exposure/active-publication-containment roots, reconstructed + permanent publication-denylist root, spend hash, checkpoint inventory root, STOP + marker, reservation, SDK `3.3.1`/lock/model projection, and exact next request. Any temporary read + failure, drift, hold, or pending exposure performs zero key access/call and routes only through its + exact schema-authorized evidence path. +- [ ] Define strict frozen `BatchRunResultV1` with campaign/phase, batch-plan and consumed-receipt + hashes, closed outcome `phase_complete|resumable|stopped`, ordered attempt/retry/spend evidence + hashes, successor spend and checkpoint-inventory roots, safe inner-archive identities and scan + receipt hashes, exactly one candidate campaign event, and class-bound result digest. Credential + values, private paths, provider exception bodies, and detached `UploadAuthorizationV1` bytes are + forbidden. Export it from `campaign.__init__` and pin its fields in controller/public-contract + tests. +- [ ] Prove provider parallelism is one and requests never leave frozen order or batch membership. +- [ ] Cover generation and judge phases through a protocol adapter; generation consumes `ShardPlanV1` and judge consumes the verified `JudgeRequestAttachmentV1` index produced after all 36 hard-score request sets are sealed. The judge batch plan binds both the attachment index hash and its exact ordered hard-pass request IDs. +- [ ] RED-test the exact Slice 3→Slice 2 judge-attempt handoff. From controller evidence, construct + every field of neutral `JudgeAttemptEvidenceV1`, including boundary/request/blind parents, attempt/ + retry/reservation/spend/delivery hashes, requested and returned service tier, safe raw-response hash, + usage, judgment, terminal evidence, and self digest. Build all 36 `JudgeAttemptBoundaryV1` records + in frozen request-root order, including empty zero-call boundaries; then the exact + `JudgeAttemptRootIndexV1`. Reject a missing/extra/reordered request, retry-chain gap, nonterminal + final attempt, campaign type leakage, or a controller field without a benchmark-owned counterpart. +- [ ] Ordinary terminal definite rejections continue to the next item; 401/403, ambiguity, receipt/spend/provenance mismatch, credential incident, or missing authority append STOP and make zero later calls. +- [ ] After durably recording returned usage/cost, treat nonzero cache writes under the frozen + explicit/no-breakpoint policy, or actual input usage above the plan row's conservative bound, as a + permanent policy incident: retain/charge the correct exposure, append STOP, and make zero later + calls. Never discard billable evidence merely because it violates the request contract. +- [ ] Require both adapters to pass exact `service_tier="default"` at the provider wire and preserve + the provider-returned service tier plus closed accounting status + `reported_default|not_applicable_definitely_not_sent|not_applicable_definitely_rejected|missing|mismatch` + in every generation/judge attempt and spend event. Either exact `not_applicable_*` value is valid + only for its matching delivery proof when no Responses object or usage exists (including + a structured retryable 429); it does not block the otherwise-authorized 429 retry. For + response-received or unknown delivery, missing/non-`default` returned tier never releases a + reservation: record any trusted billable usage, otherwise retain worst case, append a content-free + permanent policy incident/STOP, and make zero later calls. Test an ambient project tier configured + differently and prove omission/`auto` is never emitted on the request wire. +- [ ] A structured 429 followed by success records two attempts, two reservations, one retry evidence row, and no hidden SDK retry. +- [ ] Inject the exact key canary into each possible upload-candidate family in turn: checkpoint tar, + sidecar, attempt journal, provider metadata, spend/state candidate, safe summary, and controller + archive. While the key is still in process scope, require the controller to scan the immutable + final archive bytes against the exact key and the frozen credential patterns. A pre-upload match + emits only content-free local scan-failure evidence, quarantines or deletes the unsafe archive, + returns no upload locator, and makes zero later provider calls; it must not falsely claim remote + `credential_exposure`. Any match discovered after an upload or possible download instead enters + the exact pending → ordered containment-effect receipts → final STOP/supplement protocol, and no + immediate one-step incident/STOP helper is permitted. +- [ ] Prove a controller crash or exit before a complete `CredentialScanReceiptV1` leaves no + upload-authorized archive. The receipt binds campaign, batch, payload role, exact payload digest, + payload byte length, pattern-policy hash, exact-key-scan boolean, scan completion time, and receipt digest; + it never includes the key, a matched excerpt, an environment value, or a private path. +- [ ] RED-test cross-phase post-upload credential discovery separately from local pre-upload scan + failure. First CAS exact `CredentialExposurePendingV1` plus provisional denylist; then execute only + the frozen complete containment inventory, record each external effect as the next + `CredentialExposureEffectReceiptV1` expected-OID self-loop, and finally consume the exact progress + root with the schema-selected terminal consumer: direct premerge credential-exposure STOP, + `ProtocolDriftCredentialExposureSupplementV1`, `InvalidLineageCredentialExposureSupplementV1`, or + the exact postmerge/correction invalidation or correction-intent record. Inject a crash after + pending, after + each effect, after an external success before its receipt, before final CAS, and during an open-PR + close/merge race; resume by exact idempotent state observation only, never by re-enabling provider + or downloads. Test exposure-before-drift, drift-during-exposure, and exposure-after-drift ordering. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_controller.py -q +``` + +Expected RED: controller APIs are absent. + +#### Step 3: RED-test deadline and checkpoint behavior + +- [ ] Use a fake monotonic clock. Start a request only when remaining time covers request timeout, maximum possible next backoff, journal allowance, and 900-second checkpoint margin. +- [ ] At every logical shard boundary, finalize the shard, pack the strict uncompressed tar checkpoint, verify its sidecar and restored capsule, and append inventory evidence. +- [ ] On voluntary exit, checkpoint the verified partial shard and emit `VERIFIED_PARTIAL` only after upload provenance is available. +- [ ] A forced loss before verified upload can use `NO_DISPATCH_PROVED` only when every reservation is durably `never_started`; otherwise emit `PERMANENT_STOP`. +- [ ] An `AMBIGUOUS_INFLIGHT` item is never resumed. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_controller.py::test_soft_deadline_checkpoints_before_resumable_exit tests/campaign/test_controller.py::test_forced_loss_requires_zero_dispatch_proof tests/campaign/test_controller.py::test_ambiguous_delivery_stops_without_retry -q +``` + +#### Step 4: GREEN sequential controller + +- [ ] Implement immutable `GenerationPhaseAdapter` and `JudgePhaseAdapter` with a shared `ControllerProtocol`. Neither adapter accepts arbitrary imports or callables from workflow input. +- [ ] After Slice 2 commits its neutral layer/context APIs, implement + `seal_generation_context(registry, verified_input_package, preflight_seal, verified_phase_plan, + generation_evidence, output_root) -> + VerifiedGenerationContextIndexV1` in `campaign.benchmark_adapter`. It calls the benchmark-owned + `write_layer_root_index` for the exact 36 generation capsule/sidecar pairs and + `write_generation_context_index` for + `GENERATION/generation-context.json`, copying campaign seed, peeled commit, exact tagged + hard-scorer source path/hash, hard-score/judge/statistics protocol paths/hashes, and the exact + Evaluation-owned `audit_protocol_sha256: Sha256` already derived by Task 2 from verified C0 + `benchmarks/protocols/public-three-model-v1/audit.json` bytes at the peeled input commit, + plus the unchanged `audit_sampling_protocol_sha256`, + `audit_commit_reveal_protocol_sha256`, and `audit_adjudication_protocol_sha256` bindings, + exact two audit-reviewer and three role-bound protocol-reviewer bindings/signing modes, both + reviewer-registry digests, the exact workflow inventory/root, seed, protocol members, and other + C0-derived fields from class-bound `VerifiedCampaignInputPackageV1`; the three ordered verified + envelopes/root and complete companion-tag binding from class-bound `CampaignPreflightSealV1` and + the exact payload fields of verified `CampaignRegistryV1`; and the registry digest from that + registry. Require the input-package digest to equal + `registry.payload.campaign_input_package_sha256` and the seal to bind the same registry digest. + Re-open and + re-hash the exact tagged source/protocol members and require equality rather than copying an + unverified scalar. Adapter tests independently substitute the statistics member/hash and require + rejection before context publication or analysis authority can exist. + Fresh-reload both outputs and byte-compare all 36 ordered parents. Campaign imports neutral + benchmark types; benchmark code never imports a campaign type. +- [ ] Bind the resulting generation layer-root digest and + `generation_context_index_sha256` into the accepted `GENERATION_SET_SEALED` event evidence and its + authority commit. The read-only hard-score preparer reconstructs canonical authority, extracts + that expected context digest, and passes it to the neutral benchmark loader through a sealed fixed + package; no operator, workflow input, or `laconian-benchmark` flag supplies it. A context and + generation index that are internally rehashed but disagree with this authority-bound digest fail + before hard-score construction. +- [ ] Import neutral `GenerationContextExpectationV1` from `laconian_eval.benchmark.context`. + Before proposing `GENERATION_SET_SEALED`, construct it from the verified campaign registry, + predecessor authority root, generation layer-root digest, and context digest; write its canonical + bytes only at `GENERATION_COMPLETE/generation-context-expectation.json` in the authority candidate. + The event payload binds the expectation self digest plus the context and generation-root digests; + the broker's receive-pack lease yields the final authority root, which is deliberately absent from the expectation + preimage and therefore creates no self-cycle. +- [ ] In `campaign.runtime`, implement the only constructor + `_reconstruct_verified_runtime`. It descriptor-opens the exact retained expectation, verifies + predecessor and accepted final authority roots, `GENERATION_SET_SEALED` payload, registry/tagged + hard-scorer/protocol/workflow roots, context and generation-root digests, and constructs the + authority-only generation-context capability in memory. The capability is non-Pydantic, + non-serializable, unpickleable, absent from `campaign.__init__`, and cannot be supplied by a path, + hash, CLI, workflow input, environment value, provider index, or caller callback. +- [ ] Define exactly `Runtime.hard_score`, `Runtime.prepare_judge`, and `Runtime.seal_judge` on the + object returned by that constructor. Each method keeps the same in-memory capability while calling + Evaluation-owned neutral builders. Stale predecessor/final roots, another campaign's copied + expectation, rehashed substitutions, descriptor races, direct `Runtime()` construction, or public + replay invocation fail before an output root is created. +- [ ] Require `Runtime.hard_score` to seal all 36 ordered hard-score request sets, + `Runtime.prepare_judge` to bind the same 36 slots and exact ordered hard-pass request IDs, and + `Runtime.seal_judge` to fresh-load all 36 judge-attempt boundaries plus the external in-memory + expectation and return `VerifiedBenchmarkProviderEvidenceV1`. The generation transition binds the + exact 36 capsule hashes, `generation_context_expectation_sha256`, and + `verified_generation_context_root`; the judge transition binds all 36 judge attachment hashes. +- [ ] Make `tools/benchmark_hard_score_stage.py` accept exactly `--authority-root`, + `--generation-index`, `--generation-root`, `--hard-score-output-root`, and + `--judge-request-output-root`; it calls `_reconstruct_verified_runtime` once and then + `Runtime.hard_score` and `Runtime.prepare_judge`. Make `tools/benchmark_seal_judge_stage.py` accept + exactly `--authority-root`, `--generation-index`, `--generation-root`, `--hard-score-root`, + `--judge-request-root`, `--judge-attempt-root`, and `--output-root`; it calls only + `Runtime.seal_judge`. Both use `allow_abbrev=False`, exclusive outputs, content-free errors, no raw + identity/digest/mode options, and never serialize the verified capability. After the judge/provider + root is written, `Runtime.seal_judge` fresh-calls + `load_verified_benchmark_provider_evidence( + generation_expectation=runtime_capability.expectation, + provider_index_path=provider_index_path, generation_root=generation_root, + hard_score_root=hard_score_root, judge_request_root=judge_request_root, + judge_attempt_root=judge_attempt_root, judge_root=judge_root)`; the loader must exact-compare that external in-memory wrapper with every serialized + expectation, predecessor/final authority root, context, workflow, and four-root binding. It never + reconstructs a verified expectation from provider-index bytes. +- [ ] Implement the exact adapter boundary + `seal_judge_attempt_root(*, attempt_root: Path, request_root_index: LayerRootIndexV1, + request_attachments: Sequence[JudgeRequestAttachmentV1], + batch_results: Sequence[BatchRunResultV1]) -> VerifiedJudgeAttemptRootV1` in + `campaign.benchmark_adapter`. It maps only class-bound controller/receipt/spend/delivery evidence + and verified request attachments into benchmark-owned neutral `index` and `boundaries` values, + calls `write_judge_attempt_root(attempt_root, index=index, boundaries=boundaries)` once at an empty + owned root, then calls + `load_verified_judge_attempt_root(attempt_root, + expected_request_root_index_sha256=request_root_index.layer_root_index_sha256, + request_attachments=request_attachments)` and byte-compares all 36 boundaries/index before + returning that verified wrapper. + The fixed layout is `ATTEMPTS/judge-attempts/index.json` plus `000.json` through `035.json`; + workflow input cannot supply paths, ordinals, parents, attempts, or digests. Export the adapter and + pin it in `test_benchmark_adapter.py`/`tests/test_public_contract.py`. +- [ ] Implement `run_batch` as a small loop around boundary validation, one attempt, spend reconciliation, retry decision, journal verification, seal/checkpoint, and state event construction. +- [ ] Ensure `ProviderFactory` is constructed only after receipt consumption and that credential values remain `repr=False` and outside result objects. +- [ ] Before returning from the single key-bearing invocation, build every direct + `generation_batch` or `judge_attempt_batch` upload candidate + from exactly three fixed members: canonical envelope, canonical embedded + `credential-scan-receipt.json`, and the separately scanned payload. The receipt binds only the + payload, so no digest is self-referential. Scan every uncompressed source/member byte stream before + packing; checkpoint payloads remain strict uncompressed USTAR and JSON/sidecars are scanned as raw + canonical bytes. Compression by the later artifact ZIP cannot substitute for this source scan. + Pack those three members into the deterministic inner file `laconian-artifact.zip`. Scan every + inner-ZIP byte again with the exact `OPENAI_API_KEY` plus frozen patterns and write a detached local + `UploadAuthorizationV1` binding that inner ZIP's digest/length and embedded receipt digest. That + authorization is a closed controller record, never an uploaded member or public artifact. Fsync + and immediately re-hash all bytes. After scrubbing the key, pass the canonical safe authorization + record to the key-free artifact recorder; only the resulting exact locator/authority commit may + make it durable. The secret-free post step may give + `actions/upload-artifact` exactly that one file and no directory or glob. GitHub's + service-generated outer ZIP must contain exactly one regular member named + `laconian-artifact.zip`; its service digest is separate from the detached authorization. Absence, + mismatch, an extra uploaded path, or incomplete scan means zero upload. Do not claim the service + wrapper itself was key-scanned and do not defer the inner/member exact-key scan to public + projection, where the key is intentionally unavailable. +- [ ] After the key-bearing invocation has exited and its environment is scrubbed, secret-free code + may deterministically build `generation_evidence_set`/generation-context and + `judge_attachment_set` projections. Their envelopes must have a null direct scan-receipt field and + the ordered Merkle root of every exact reachable direct receipt. Reload every direct locator, + receipt, and payload before deriving that root. Never run a projection while the key is mapped and + never claim its newly packed bytes received an exact-key scan. +- [ ] Rerun controller and capsule regression tests to GREEN: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_controller.py tests/campaign/test_benchmark_adapter.py tests/campaign/test_runtime.py tests/capsule/test_execution.py tests/capsule/test_resume.py tests/test_public_contract.py -q +``` + +Expected GREEN: PASS; the exact generation/judge suffixes, sealed roots, private Runtime methods, +checkpoint recovery, and credential-scan handoff pass together. + +#### Step 5: Commit + +- [ ] Commit: + +```bash +git add src/laconian_eval/campaign/__init__.py src/laconian_eval/campaign/controller.py src/laconian_eval/campaign/benchmark_adapter.py src/laconian_eval/campaign/runtime.py tools/benchmark_hard_score_stage.py tools/benchmark_seal_judge_stage.py src/laconian_eval/capsule/execution.py tests/campaign/test_controller.py tests/campaign/test_benchmark_adapter.py tests/campaign/test_runtime.py tests/capsule/test_execution.py tests/capsule/test_resume.py tests/test_public_contract.py +git commit -m "feat: run bounded resumable benchmark batches" +``` + +### Task 8: Seal the private Runtime and replay isolation boundary + +**Files:** + +- Modify: `src/laconian_eval/campaign/runtime.py` +- Modify: `src/laconian_eval/campaign/controller.py` +- Modify: `tools/benchmark_hard_score_stage.py` +- Modify: `tools/benchmark_seal_judge_stage.py` +- Create: `tests/campaign/test_runtime_boundary.py` +- Modify: `tests/test_public_contract.py` + +#### Step 1: RED-test the import and call graph + +- [ ] Assert Runtime has exactly these live method owners and no public constructor: + +```text +laconian_eval.campaign.runtime.Runtime.hard_score +laconian_eval.campaign.runtime.Runtime.prepare_judge +laconian_eval.campaign.runtime.Runtime.seal_judge +laconian_eval.campaign.runtime._reconstruct_verified_runtime +``` + +- [ ] Prove `Runtime()` raises, `_reconstruct_verified_runtime` is absent from + `campaign.__init__.__all__`, and neither the Runtime object nor its capability can be Pydantic- + dumped, JSON encoded, pickled, copied into a provider index, or accepted from a caller-supplied + callback/path/hash. No shared state-writer or authority-mutation callable is reachable from these + methods. +- [ ] Inspect the existing `laconian_eval.cli:main` graph. Its exact seven public commands remain + `hard-score`, `prepare-judge`, `seal-judge`, `sample-audit`, `seal-audit`, `analyze`, and `verify`; + every handler imports only `laconian_eval.replay`. Prove replay cannot import `campaign.runtime`, + `campaign.publication`, either private constructor, the capability type, broker client, or + authority writers. Runtime cannot import replay handlers. +- [ ] Pin the compatible dispatcher signature exactly as + `main(argv: Sequence[str] | None = None, *, program: str | None = None) -> int`. + `program="laconian-benchmark"` selects only the seven offline handlers, `program="laconian"` + preserves the legacy parser/entrypoint, and omitted `program` derives the installed script name. + Runtime tools never call `main`, and this plan introduces no eighth command or live CLI hook. +- [ ] Prove there is no `laconian_eval.campaign.cli`, second console script, public campaign + parser, generic writer entrypoint, or workflow invocation of `laconian_eval.cli:main`. This task + tests only the three now-existing Runtime methods; Publication Task 7 creates the four future + `laconian_eval.campaign.publication.Publication.campaign.evaluation_stage.sample_audit`, + `.seal_audit`, `.analyze`, and `.verify` methods plus + `laconian_eval.campaign.publication._reconstruct_verified_publication`. Publication Task 15 proves the final seven-live + tuple without inventing future modules or imports here. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_runtime_boundary.py tests/test_public_contract.py -q +``` + +Expected RED: FAIL because Runtime construction/export and replay import boundaries are not yet +closed. + +#### Step 2: Implement the minimal private boundary and verify GREEN + +- [ ] Make Runtime construction token-gated by a module-private sentinel produced only after exact + authority reconstruction. Keep the capability in private slots and make serialization/copy + attempts fail with content-free errors. +- [ ] Make both fixed stage tools import only `_reconstruct_verified_runtime` plus the three exact + methods, use fixed literal paths supplied by their workflows, and expose no reusable parser or + arbitrary method name. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_runtime_boundary.py tests/test_public_contract.py tests/test_cli.py -q +``` + +Expected GREEN: PASS; only the private Runtime construction path owns the three live methods and +all seven public replay commands remain offline. + +#### Step 3: Commit + +- [ ] Commit: + +```bash +git add src/laconian_eval/campaign/runtime.py src/laconian_eval/campaign/controller.py tools/benchmark_hard_score_stage.py tools/benchmark_seal_judge_stage.py tests/campaign/test_runtime_boundary.py tests/test_public_contract.py +git commit -m "feat: isolate private benchmark runtime methods" +``` + +### Task 9: Add OIDC-brokered preflight and live-batch workflows + +**Files:** + +- Create: `.github/workflows/benchmark-preflight.yml` +- Create: `.github/workflows/benchmark-batch.yml` +- Create: `.github/workflows/benchmark-dismiss-hold.yml` +- Create: `.github/workflows/benchmark-publication-state.yml` +- Create: `src/laconian_eval/campaign/release.py` +- Create: `src/laconian_eval/campaign/release_broker.py` +- Create: `tools/benchmark_release_broker_client.py` +- Create: `tools/benchmark_preflight_stage.py` +- Create: `tools/benchmark_prepare_batch.py` +- Create: `tools/benchmark_run_batch.py` +- Create: `tools/benchmark_post_batch.py` +- Create: `tools/benchmark_prepare_hold_dismissal.py` +- Create: `tests/campaign/test_workflow_policy.py` +- Create: `tests/campaign/test_release_broker.py` +- Create: `tests/campaign/test_security_attestor_credential_finality.py` +- Modify: `tests/test_ci_contract.py` + +#### Step 1: RED-test workflow policy structurally + +- [ ] Parse YAML and reject aliases/merge keys before schema inspection. +- [ ] `benchmark-preflight.yml` must be no-input `workflow_dispatch` only, have top-level + `permissions: {}`, the literal shared concurrency group, no environment, and no secret expression. + Require `github.ref_type == "tag"`, exact input-tag grammar, tag-object/peeled-commit verification, + and prove the actual `GITHUB_WORKFLOW_REF` path plus running workflow bytes/hash equal that exact + `C0` workflow-inventory member; default-branch/branch dispatch or a mutable workflow copy fails. It + has a read-only `prepare-preflight` job with exactly `contents: read` and + `pull-requests: read`, used in part to double-read T0/T1 and re-fetch the exact + C0/Rstat/Rjudge/Rsecurity/B0 object closure, statements, envelopes, bundle, GitHub projections, + policy observations, and both historical creation-suite receipts. It emits a cycle-free preflight + attestation subject. A following job named exactly `security_attestor` has + only `id-token: write`, no environment or repository token permission, and invokes the hash-bound + secret-free `benchmark_release_broker_client.py` with exact OIDC audience + `laconian-security-attestor-broker`. The external measured broker owns the existing + release-finalizer App key/token, selects only the frozen `preflight_rulesets` caller row, performs + the exact tag/publication-ruleset GET allowlist, closes the token, and returns only signed safe pass + or failure evidence. A read-only sealing job accepts only a closed passing receipt before it can + build the `PREFLIGHT_SEALED` candidate; failure has no authority candidate. Its state-mutation job + calls only the same-repository reusable `benchmark-publication-state.yml` with the canonical + `PREFLIGHT_SEALED` request. No App/installation ID is a credential input or secret mapping, and no + key, token, state credential, arbitrary pack, or write-capable repository token exists in Actions. + Signed safe receipts may contain only the preregistered nonsecret App/installation identity needed + for actor verification. The external broker creates + `refs/heads/benchmark-authority/{campaign_id}` only with `expected_absent` and the all-zero old + SHA-1 OID; an existing divergent ref or simultaneous creator fails atomically. +- [ ] Preflight verifies the exact two-ruleset model and historical creation evidence before + registry sealing: fresh current observations reproduce the stable C0 policy; T0 and T1 each have + one different authenticated creation suite with all-zero before OID, exact after tag-object OID, + frozen operator, top-level `bypass`/`fail`, and sole active creation-rule `fail`. It persists the + exact API wrappers/blobs and `ProtocolReviewObjectArchiveV1`, then double-reads both refs again; + movement/deletion/substitution between reads yields no authority bootstrap. +- [ ] Create the canonical security-attestor records in `campaign.release`, and the policy verifier + in `campaign.release_broker`; the latter imports those class objects and never redefines, + subclasses, aliases, or re-exports them. Freeze the common three-row + `SecurityAttestorCallerPolicyV1`, but implement only the independently callable + `preflight_rulesets` row here. Its ordered requested/returned permissions are exactly + `administration:write`, `contents:read`, `metadata:read`; the endpoint policy is GET-only. The + Actions client contains no App identity/key/token/header/handle, and fake-broker finality tests + cover no-request, denial, delivery-unknown unrecoverability, permission mismatch, successful + closure, zero outstanding requests/dispatches/live tokens, and denial of any later mint. +- [ ] `benchmark-batch.yml` must be no-input `workflow_dispatch` only from the immutable input tag, + use the literal shared concurrency group, and contain + exactly four jobs: secret-free `prepare`, key-free narrow `receipt-writer`, environment-gated + read-only `provider`, and provider-secret-free `post`. Each state mutation crosses the fixed + `benchmark-publication-state.yml` OIDC boundary; the external broker uses the frozen state-writer + App and exact expected-old-OID receive-pack lease. No Actions job receives an App token, and no + job can create its own commit, packfile, endpoint, ref, or mutation event. +- [ ] Under top-level deny, batch `prepare` declares exactly `contents: read, actions: read`; + `receipt-writer` declares only the reads required to bind jobs/deployments plus `id-token: write` + inside the reusable boundary; provider uses the exact scopes below; and `post` has only read scopes + plus the reusable OIDC call. No implicit workflow permission is accepted. The broker-held App + token, never either repository token, performs each authority mutation. +- [ ] `prepare-preflight`, batch `prepare`, and batch `provider` check out the registry-recorded + detached commit with `persist-credentials: false` and reverify the input tag object. State-writer + jobs do not check out candidate code; the reusable state job contains no checkout at all. +- [ ] The provider job has `permissions: {contents: read, actions: read, deployments: read}`, + `environment: benchmark-live`, `timeout-minutes: 180`, and no repository-write scope. +- [ ] The provider and receipt-writer both depend on `prepare`, not on each other. Provider is + statically named and first enters the protected environment/read-only wait step. Receipt-writer + uses the run-attempt jobs/deployment/approval APIs to discover and bind its exact numeric identity, + constructs the canonical mutation request, and presents GitHub OIDC only through the reusable + state job. The provider's bounded wait accepts only the canonical broker receipt and winning + OID/digest for itself. Its next + key-bearing step maps only `${{ secrets.OPENAI_API_KEY }}` and no App credential or write token. + Expression-location and job-graph tests enforce this order; a missing/ambiguous provider job or + approval times out with zero broker mutation and zero key lookup. +- [ ] The literal secret expression `${{ secrets.OPENAI_API_KEY }}` appears exactly once, under + `env` of the single fixed `tools/benchmark_run_batch.py` step. It is absent from workflow/job env, + checkout, setup, artifact download/upload, post-controller, state-broker calls, and `always()` + steps. The four fixed workflow tools accept only closed literal paths and derive every model, + phase, event, price, retry, ref, and authority ID from verified records; none is a public console + entry point or reusable arbitrary parser. +- [ ] Immediately before that one secret expression is evaluated, the provider job reruns both the + universal fresh pair/policy/registry gate and the identical Foundation-owned + `require_benchmark_sdk_contract` call and requires its literal `None` success return. The + reusable state job's broker reruns the universal gate immediately before OIDC exchange/App-token + mint and receive-pack; every later App boundary reruns it before token mint/effect. Static and + dynamic tests make a temporary read failure produce no credential access, download, mutation, or + external effect even after environment approval or an earlier winning receipt. +- [ ] `benchmark-dismiss-hold.yml` is no-input `workflow_dispatch` only. A read-only inspector + first requires exact `refs/heads/main` and the dismissal plan's pre-bound current-main SHA; it + verifies the caller and reusable workflow bytes against the campaign's C0-derived workflow root + and derives the one campaign/authority-ref identity only from the accepted plan/authority package. + It accepts no tag/PR/other branch, campaign/ref/hash input, or latest/by-name authority discovery. + The inspector reconstructs that exact canonical ref and proves there is exactly one dismissible + benign hold; a separate read-only `authorize-dismissal` job uses `benchmark-publish` only to + capture a distinct human approval; and a no-environment state job presents only its canonical + dismissal request and OIDC to the reusable broker boundary. The fixed + `tools/benchmark_prepare_hold_dismissal.py` binds the C0 policy, exact hold, source/trigger/eligible + dismisser numeric identities, expected ref OID, strict plan, and dismissal evidence. The resulting + `INVALID_EVENT_DISMISSED` self-loop advances transition/state hash while leaving state name, spend, + inventory, correction, publication, active-exposure, publication-denylist, and active-containment + roots unchanged and removing only the exact + hold from the unresolved-hold root. It accepts no hold ID, actor, + reason, ref, campaign, or event input. The broker performs one exact old-OID lease and the + workflow no-ops only when the exact dismissal is already canonical. +- [ ] The protected-main required check implements exact `MainFallbackLivenessPolicyV1`: while any + campaign is nonterminal it verifies all 15 current-main workflow members remain byte-identical to + C0. The existing `benchmark-evidence.yml` can therefore run without a tag trigger after T0/T1 is + moved/deleted and request only typed drift STOP, exact open-PR close where required, exposure + containment, or already-sealed safe-invalid continuation. Tests reject admin-bypassed protection, + changed current-main bytes, restored-ref live resume, provider/publication/release/correction + authority, or any new workflow/App/environment/secret. +- [ ] `benchmark-publication-state.yml` is a same-repository `workflow_call` reusable workflow with + exact job ID `state_writer`, no environment, no checkout, no artifact action, no generated shell, + no caller-controlled action, and no secret. The entire job contains only GitHub's OIDC bootstrap + and one full-SHA-pinned, argument-closed broker-client invocation. `id-token: write` is job-scoped; + `state-cas` is only a reviewed step ID, never an asserted OIDC claim. The broker requires the fully + qualified caller and called `workflow_ref`/`job_workflow_ref`, both workflow SHAs, exact run/job/ + check-run identity, and the same trigger ref; bare paths or synthetic `workflow_ref@C0` checks fail. +- [ ] Generate workflow caller/ref/actor/event admission from the sole state schema, including the + exact 24 STOP reasons, strict evidence variants, all literal drift and credential pending/effect/ + final/supplement rows, every publication-containment start/resumption/finality row, protected-main + fallback rows, hold/exposure/denylist/containment-root gates, and all deny cells. Compare the + generated rows byte-for-byte with Task 3's exhaustive caller/ref/event table and its separate two- + row non-event append table; neither test may maintain a permissive hand-written subset. + Normal callers/reruns require the frozen operator; dismiss-hold requires the plan-selected eligible + dismisser and matching rerun trigger actor. No wildcard caller, actor, state, reason, ref, or + environment-reviewer authority is permitted. +- [ ] In `test_workflow_policy.py`, construct one canonical request for each of the three closed + `AuthorityMutationRequestV1` variants and one request for every admitted event row. Assert the + reusable job transmits only OIDC plus those canonical bytes, the broker class-bound revalidates the + matching Runtime-owned source/append object, and predecessor/successor hold, exposure incident, + exposure progress, publication denylist, and active-containment roots equal the reconstructed + transition. For containment start, assert the authenticated run SHA becomes the immutable + `containment_main_oid`; a later current-main resumption requires the exact signed first-parent + advance proof and cannot rewrite that OIDC identity. For every deny vector, instrument OIDC + exchange, state-writer mint, publisher/release-finalizer mint, receive-pack, provider secret lookup, + and network dispatch and require all counters remain zero. +- [ ] Pin the exact ordered 15-path workflow tuple from the approved design and recompute its C0 + member hashes/root. Runtime creates only its four owned workflow files; synthetic C0 fixtures + supply the eleven later-owned members. Reject missing, extra, reordered, mutable-main, or + independently supplied workflow roots. Publication Task 13 replaces the synthetic boundary with + the complete real-byte cross-slice proof. +- [ ] Freeze exactly three pairwise-distinct installed App identities: + `state_writer`, `publisher`, and `release_finalizer`. The first is usable only inside the external + state broker; the latter two require `benchmark-publish`. Pre-register the one + `security_attestor` capability as a downscoped token from the existing release-finalizer + installation with only `administration:write`, `contents:read`, and `metadata:read`; it is not a + fourth App. The fixed endpoint/query policy uses the Administration permission only for the + immutable-Releases settings read and grants no mutation endpoint. Runtime owns the common + canonical records/client and the `benchmark-preflight.yml` `preflight_rulesets` row; Publication + Task 10 adds the `benchmark-publish.yml` `postmerge_rule_suite` row, and Publication Task 11 adds + the `benchmark-release.yml` `release_preparation` row. The later fixed publication job runs with + `environment: benchmark-publish`, has exact main/ref/plan/OIDC policy, no + provider key or model/artifact bytes, and release-writing tokens from the same installation omit + Administration permission. +- [ ] Reject `pull_request_target`, `workflow_run`, cron, arbitrary shell inputs, unpinned actions, third-party actions in the key-bearing job, `set -x`, persisted checkout credentials, and dynamic `uses`. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_workflow_policy.py tests/campaign/test_release_broker.py tests/campaign/test_security_attestor_credential_finality.py tests/test_ci_contract.py -q +``` + +Expected RED: workflow files are missing. + +#### Step 2: Implement the minimal four Runtime-owned workflows + +- [ ] Pin every action to a full 40-character commit. Use the repository's existing checkout/setup pins and the approved artifact pins. +- [ ] In `prepare-preflight`, seal the verified tagged registry and emit a receipt-bound + cycle-free attestation subject, then let only the distinct `security_attestor` job obtain a closed + safe pass/failure projection through OIDC. A read-only sealing job emits `PREFLIGHT_SEALED` only + from the passing projection. Its reusable state call gives no repository write permission and + sends only OIDC plus the canonical request. Before doing so it writes and network-free reloads the + exact protocol-review archive, stable projections, policy/creation receipts, tag binding, and + four-field campaign registry, then performs the second exact ref read. The external broker + independently reruns the universal gate and re-verifies the pair, registry, + candidate, Git identity, and expected-absent ref, then constructs and installs the deterministic + parentless authority commit through the all-zero-old-OID receive-pack command. `benchmark-batch` + cannot prepare work + until reconstruction from that canonical ref yields `PREFLIGHTED`. +- [ ] In `prepare`, retrieve authority/checkpoint artifacts by exact numeric ID and exact workflow-run provenance, reconstruct state, create reservations, and upload only the safe prepared batch. +- [ ] Give `prepare` one closed recovery branch for an already canonical `GENERATION_ACTIVE` or + `JUDGE_ACTIVE` receipt. It loads the prior provider run/job only from that receipt, exhaustively + re-fetches the exact job-step timeline and controller/artifact inventory, and may emit + `NO_DISPATCH_PROVED` only when the key-bearing step provably never started and no dispatch marker + exists. Receipt-writer/provider are skipped; `post` sends the recovery candidate through the same + reusable broker boundary. A started/uncertain step emits `PERMANENT_STOP`, while verified partial evidence emits + `VERIFIED_PARTIAL`. No workflow input selects run, job, receipt, event, or recovery mode. +- [ ] In `receipt-writer`, resolve the exact provider job/deployment/approval identity through + GitHub APIs. Combine the prepared official-source capture with that exact approved job/deployment + record to construct `PriceAttestationV1`, require its source observation to be no more than 24 + hours before approval, bind the current frozen five price/source roots, default tier, + explicit/30m cache policy, recursive no-breakpoint proof, and captured approval API digest, then + consume the receipt and win the Task 6 external-broker receive-pack lease. No workflow input or operator + path may supply an attestation, rate, actor, or job identity. In `provider`, re-read and + reconstruct that winning canonical ref before mapping the secret. Disable shell tracing and + ambient proxy credentials and run sequentially. The key-bearing step itself constructs and + exact-key/pattern scans every immutable direct generation/judge-attempt upload archive and emits + its scan receipt. A later secret-free post step uploads only + digest-identical `laconian-artifact.zip` files as the sole path of their service artifacts; + missing receipt/authorization means zero upload. +- [ ] If any post-upload scanner or later phase detects credential material, do not construct an + ordinary batch STOP. The detector first requests the pending CAS; broker/workflows then admit only + the frozen complete containment inventory. That CAS sets the active incident ID and pending root + together; each next expected-OID `CredentialExposureEffectReceiptV1` self-loop preserves both, + and only the generated phase-exact STOP, strict supplement-union member, release/correction + invalidation, or bare-state correction intent consumes the final progress root and clears both + together. A pending/progress CAS is forbidden once publication terminal containment has started; + later exposure only revokes/rotates externally and resumes that same evidence-preserving + containment route. Crash recovery re-observes each exact external object/ + idempotency key; it never re-enables provider credentials, artifact downloads, publication, or + live progression while the pending root is nonnull. +- [ ] After a judge-phase batch completes the final frozen request suffix, the secret-free post step + reconstructs the exact authority ref and runs the Runtime-owned fixed + `tools/benchmark_seal_judge_stage.py --authority-root AUTHORITY --generation-index + GENERATION_INDEX --generation-root GENERATION --hard-score-root HARD --judge-request-root REQUESTS + --judge-attempt-root ATTEMPTS --output-root OUT`. The tool keeps the authority-verified context + capability in-process and calls `Runtime.seal_judge`; public replay `seal-judge` is + forbidden in the live workflow. All paths are fixed workflow literals, never artifact + interpolation. `ATTEMPTS` is exactly the adapter-written, + fresh-loaded `JudgeAttemptRootIndexV1` plus its 36 fixed boundary files. Reload all 36 + `JudgeAttachmentV1` records (including zero-call attachments), and create the + `JUDGE_SET_SEALED` candidate. Generation completion analogously creates + `GENERATION_SET_SEALED`. Before that generation event, the Slice 3 adapter writes the generation + `LayerRootIndexV1` and `GENERATION/generation-context.json`, binding the campaign seed, peeled + commit, tagged hard-scorer source, hard-score/judge/statistics protocols, and the unchanged + Evaluation-owned `audit_protocol_sha256: Sha256` from Runtime Task 2's verified peeled-C0 audit + member, alongside unchanged `audit_sampling_protocol_sha256`, + `audit_commit_reveal_protocol_sha256`, and `audit_adjudication_protocol_sha256`, + workflow-inventory root, `campaign_registry_sha256`, complete companion-tag binding, both + reviewer registries, the three-role `protocol_attestations_root`, and + the 36 capsule/sidecar pairs. It also writes the exact authority-package + `GENERATION_COMPLETE/generation-context-expectation.json`; the candidate/event and artifact + inventory bind the generation root, context, and expectation digests. These generation/judge set projections have null direct + scan receipts and bind/recompute the complete transitive direct-receipt root; the provider-evidence + verifier later rejects any missing/substituted receipt or false direct-scan claim. The external + broker alone commits either event to the + canonical authority ref; + `benchmark-evidence.yml` therefore cannot begin until the authoritative state is + `JUDGE_COMPLETE`. +- [ ] The fixed reusable job and broker reconstruct only same-run receipt-bound candidate evidence + by numeric artifact identity. The broker attempts one exact old-OID receive-pack command; a stale + sibling fails without selecting a newer candidate, and response-loss recovery adopts only the + byte-identical expected commit. Tests reject REST ref writes and any force/delete command. +- [ ] Workflow-policy tests prove no state App/installation ID credential expression or secret + mapping, private-key name/value, JWT, installation token, publisher credential, or + release-finalizer write credential occurs anywhere in Actions YAML, tool inputs, artifacts, logs, + or child environments. Signed safe receipts may retain only preregistered nonsecret identity + metadata. Every repository + `GITHUB_TOKEN` remains read-only. Altering the reusable workflow, broker client digest, caller/ + callee identity, mutation request, returned permissions, or Git-identity digest fails before ref + mutation. +- [ ] Set every authority artifact to `retention-days: 90` and preserve exact API artifact IDs/service digests in successor provenance. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_workflow_policy.py tests/campaign/test_release_broker.py tests/campaign/test_security_attestor_credential_finality.py tests/test_ci_contract.py -q +``` + +Expected GREEN: PASS; all four Runtime-owned workflows and the external-broker boundary satisfy the +closed policy. + +#### Step 3: Prove no secret use in PR/fork CI + +- [ ] Extend `test_ci_contract.py` to scan every workflow for provider secret references and assert only `benchmark-batch.yml` contains the one approved occurrence. +- [ ] Assert all PR/fork jobs retain read-only repository permissions and cannot dispatch live work. +- [ ] Add crash/race fixtures for pre-key lease loss, post-lease/pre-key crash, `ACTIVE` with a provably + skipped key step, and `ACTIVE` with an uncertain/started key step. Only the first provable case may + use `NO_DISPATCH_PROVED`; all others make zero new calls and remain stopped until invalid + finalization. +- [ ] Run all workflow contract tests. + +#### Step 4: Commit + +- [ ] Commit: + +```bash +git add .github/workflows/benchmark-preflight.yml .github/workflows/benchmark-batch.yml .github/workflows/benchmark-dismiss-hold.yml .github/workflows/benchmark-publication-state.yml src/laconian_eval/campaign/release.py src/laconian_eval/campaign/release_broker.py tools/benchmark_release_broker_client.py tools/benchmark_preflight_stage.py tools/benchmark_prepare_batch.py tools/benchmark_run_batch.py tools/benchmark_post_batch.py tools/benchmark_prepare_hold_dismissal.py tests/campaign/test_release_broker.py tests/campaign/test_security_attestor_credential_finality.py tests/campaign/test_workflow_policy.py tests/test_ci_contract.py +git commit -m "ci: add protected benchmark batch workflows" +``` + +### Task 10: Rehearse pilot bounds and the full offline runtime + +**Files:** + +- Create: `tests/campaign/test_runtime_synthetic.py` +- Create: `benchmarks/runbooks/public-benchmark.md` +- Modify: `tests/campaign/test_preflight.py` +- Modify: `tests/campaign/test_controller.py` + +#### Step 1: RED-test the pilot contract end to end + +- [ ] First construct the complete synthetic T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 Git DAG from fixed + bytes, both active rulesets, the one operator, three reviewer signatures, stable REST/GraphQL/local + evidence, two unique creation suites, and exact API blobs/wrappers. Pin every raw Git SHA-1 and + `GitObjectSHA256V1`; network-free import the complete `ProtocolReviewObjectArchiveV1`, run preflight + twice with different volatile observation metadata, and require the same campaign registry, ID, + plans, and authority genesis. Delete/move/substitute each tag between the two reads and require zero + credential, external effect, or authority creation. +- [ ] Import Evaluation Task 14's `tests.benchmark.helpers.build_synthetic_public_campaign` fixture + and extract its frozen C0 input-package Git blob plus the exact broker-key and delivery-isolation + subject digests. Parse those bytes only through the Evaluation-owned canonical parser, reconstruct + the ordered `publisher`, `release_finalizer`, `security_attestor` records from Runtime's sole-owner + `BrokerSigningKeyV1` and the policy from Runtime's sole-owner + `BrokerTokenDeliveryIsolationPolicyV1`, and require byte-for-byte equality with the frozen blob. + Recompute each key leaf/node/root, the policy digest, and the fourteen-member + `security_evidence` subject root using the object-identical + `PROTOCOL_REVIEW_SUBJECT_KINDS_BY_ROLE_V1`. Negative vectors delete/reorder/duplicate a key, change + a policy Boolean, restore the obsolete eleven-member subject tuple, or substitute a copied type or + canonical encoder; each fails before registry seal, credential lookup, or authority construction. +- [ ] Materialize one shared scenario in both locales, four arms, one repetition, and all three models. +- [ ] Assert 24 generation calls, no generation retries, at most 24 judge calls, no judge retries, and total authorized exposure no greater than `5_000_000` micro-USD. +- [ ] Interrupt after a deterministic request, pack/restore the exact partial capsule, generate a new batch receipt, and resume only the exact suffix. +- [ ] Reject any pilot setting or workflow input that permits a 25th generation or judge attempt. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_runtime_synthetic.py::test_pilot_is_bounded_to_48_total_attempts -q +``` + +Expected RED: FAIL because the integrated pilot fixture and its end-to-end runtime wiring are absent. + +#### Step 2: Implement the minimal provider-offline runtime wiring and run GREEN + +- [ ] Use deterministic fake/replay providers to execute all 36 generation shards through multiple batches, including one 429 retry, one ordinary rejection, one partial checkpoint, and exact suffix resume. +- [ ] Drive every state event from the one generated matrix, including one dismissible hold, + nondismissible STOP, moved/deleted-tag drift through protected-main fallback, and one post-upload + credential incident through pending, every inventoried effect, direct final STOP, both strict + supplement variants, every postmerge/correction consumer class, and complete/invalid publication + close-versus-merge races. Also rehearse ordinary and write-ambiguity publication terminal + containment: start commits the monotone denylist and active intent root, crash/restart preserves + them, premerge and merge-won finality each clear only the matching root, and all constructive + authority remains denied in between. + Inject crashes after each exposure CAS/effect and prove exact-root adoption plus zero ordinary work + while held/pending. Rerun the exact Foundation-owned `require_benchmark_sdk_contract` call and + universal fresh gates before every synthetic + credential/effect boundary. +- [ ] Drive deterministic hard-score fixture attachments, then run all 36 judge attachments through the same controller contract. +- [ ] Reconstruct the authority-only in-memory capability and invoke exactly + `Runtime.hard_score`, `Runtime.prepare_judge`, and `Runtime.seal_judge`; prove no public replay + handler, serialized capability, public campaign CLI, or caller-supplied expected root participates. +- [ ] Assert exact ordered coverage, distinct receipts per provider job, charged/reserved totals below `75_000_000`, no unresolved holds, and zero calls after a synthetic STOP branch. +- [ ] Reconstruct every state/spend/checkpoint artifact from exact IDs and hashes at the end. +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign/test_runtime_synthetic.py -q +``` + +Expected GREEN: PASS with the exact 1,440-row runtime, bounded retry, private Runtime capability, +checkpoint-resume, receipt, spend, and STOP assertions above. + +#### Step 3: Write the operator and broker runbook + +- [ ] Document exact no-input workflow dispatches for preflight, batch approval, resume, + no-dispatch proof, STOP, hold dismissal, and invalid-prefix handoff; document external broker + health, OIDC audience/JWKS/subject checks, receive-pack lease receipts, response-loss + reconciliation, App-key rotation, provider-key revocation, and the three fixed App identities. + There is no public campaign-authority command. The seven public replay commands remain offline and + non-evidentiary. +- [ ] State plainly that GitHub environment approval is per job, every resumed batch needs another approval, artifacts expire after 90 days, and no live call is permitted before all setup gates in the roadmap pass. +- [ ] Include expected safe summaries and escalation actions; never include a secret value or an instruction to print it. +- [ ] State that `security_attestor` is a release-finalizer-App downscope, not a fourth App; its + broker-minted token has the exact ordered permissions `administration:write`, `contents:read`, + `metadata:read`, is constrained to the fixed read-only endpoint policy, and never coexists with a + release-write token. +- [ ] Document the human preflight ceremony in order: configure/record both tag rulesets; registered + operator creates annotated T0 and its creation receipt; three registry reviewers add/sign only + their fixed-path statements serially; secret-free verifier builds B0/envelopes/bundle; the same + operator creates paired annotated T1 and its distinct receipt; archive/import; preflight double + read; only then pilot dispatch. Document protected-main fallback, exact eligible hold dismissal, + pending credential-containment recovery, and the rule that a changed object/policy requires a new + pair and new campaign rather than repair/restored-ref resume. + +#### Step 4: Run the slice regression gate + +- [ ] Run: + +```bash +uv run pytest -p no:cacheprovider tests/campaign tests/capsule tests/test_openai_provider.py tests/test_providers.py tests/test_runner.py tests/test_reporting.py tests/test_cli.py tests/test_ci_contract.py -q +uv run ruff format --check . +uv run ruff check . +uv run mypy src +git diff --check +``` + +Expected GREEN: every command exits 0. No provider credential or network access is used. + +#### Step 5: Commit + +- [ ] Commit: + +```bash +git add tests/campaign/test_runtime_synthetic.py benchmarks/runbooks/public-benchmark.md tests/campaign/test_preflight.py tests/campaign/test_controller.py +git commit -m "test: rehearse bounded benchmark runtime" +``` + +## Slice completion gate + +- [ ] Every focused and regression command above is freshly green. +- [ ] `tests/campaign/test_workflow_policy.py` parses every workflow and proves that the literal secret + expression occurs exactly once in the approved `run-batch` step; a separate credential-canary scan + over generated test artifacts proves no secret value appears. Do not use a repository-wide raw + string-count assertion because legitimate sanitizer and policy tests name `OPENAI_API_KEY`. +- [ ] `rg -n "pull_request_target|workflow_run|set -x" .github/workflows/benchmark-*.yml` returns no match. +- [ ] A fresh synthetic run proves exact 1,440-row generation order, bounded retries, per-attempt accounting, checkpoint resume, judge-phase reuse, and STOP-before-next-call. +- [ ] The same run first proves exact T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 raw-object vectors, + stable/API archive reconstruction, two-read policy/receipt binding, stable campaign identity, + exhaustive hold/drift/exposure root transitions, and SDK/universal precredential gates without + GitHub/provider network access or secrets. +- [ ] Independent security review confirms the provider job is read-only and the provider secret is + step-scoped; Actions contains no state App key/token; the reusable OIDC boundary, exact broker + caller matrix, SHA-1 object construction, and receive-pack old-OID leases match the approved + design. +- [ ] Independent statistical/evidence review confirms request identities and usage fields match the approved protocol. +- [ ] No live workflow is dispatched by this implementation plan. Live pilot authorization remains a separate maintainer action after the roadmap setup gate. diff --git a/docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md b/docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md new file mode 100644 index 0000000..f9ee573 --- /dev/null +++ b/docs/superpowers/specs/2026-08-30-public-three-model-benchmark-design.md @@ -0,0 +1,10282 @@ +# Public Three-Model Benchmark Pipeline Design + +**Date:** 2026-08-30 + +**Status:** Constructive-liveness, credential-finality, and exact-wire amendment approved; +implementation may proceed only after the implementation plans are synchronized to this approved +normative commit + +**Historical maintainer approval:** 2026-08-30 (approval of the pre-amendment design) + +**Prior amendment approval:** On 2026-08-30, the maintainer/user in this Codex task explicitly approved +the normative design at commit `46147ef62b5bb009421d58928e879d92247d84b5` with the exact message +`Одобряю amendment 46147ef`. That approval remains historical evidence for the prior normative +design; it did not approve the later attestation-transport amendment whose separate approval is +recorded below. + +**Current amendment approval:** On 2026-08-31, the maintainer/user in this Codex task explicitly +approved the normative design at commit `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126` with the exact +message `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. This governance-only +successor records that approval without changing normative behavior. Approval of +`55b90582ae461cf7a3dc072d53d8b03e79fb3614` remains historical evidence for the prior approved +design. Implementation may proceed only after the implementation plans are synchronized to the +newly approved normative commit. + +**Approved amendment scope:** This revision closes constructive-liveness, credential-finality, and +exact-wire gaps without changing the benchmark estimand, workload, model set, statistical gates, +public replay surface, workflow inventory, or three-App inventory. It (1) gives every in-flight +publication PR one phase-aware terminal disposition, including every merge-before-close race, (2) +defines exact branch/PR/check/release transport reconciliation and complete terminal check-suite +enumeration, (3) closes every publisher, security-attestor, and release-finalizer token lineage on +both success and failure, (4) separates receipt-free release preauthorization from attestation, +executable intent, effect delivery, and final reconciliation, and (5) admits the two initial- +publication and four initial-release receipt appends through two closed, state-byte-identical +authority mutation families rather than undefined generic write channels. Fixed jobs acquire more +precise caller/endpoint policies, but no workflow file or App role is added. + +**Scope:** Publication-grade response benchmark for GPT-5.6 Sol, Terra, and Luna, executed through +GitHub Actions with immutable generation, judging, human-audit, and publication evidence + +## 1. Decision + +Laconian will run one preregistered response benchmark campaign against three OpenAI models: +`gpt-5.6-sol`, `gpt-5.6-terra`, and `gpt-5.6-luna`. Each model is an independent experiment. The +project will not pool the three models into a universal family claim. + +The selected architecture is a staged capsule pipeline: + +```text +protected annotated input tag and serial signed protocol-review chain + -> protected annotated attestation-bundle companion tag + -> secret-free preflight + -> frozen resumable batch plans + -> sharded generation capsules + -> sealed hard-score/judge-request attachments + -> blind semantic-judge attachments + -> two-person commit-reveal audit + -> capsule-bound semantic aggregation and inference + -> read-only bundle collection + -> separately approved minimal publication PR + -> protected result tag and checksum-bound release +``` + +The full campaign is confirmatory. It publishes a registry entry and the appropriate evidence +whether its outcome is positive, negative, inconclusive, or operationally invalid. A favorable +result is not a publication condition. + +## 2. Context + +The repository already has: + +- a response corpus with 12 shared scenarios, each localized in English and Russian; +- four byte-pinned response arms: `baseline`, `concise`, `caveman`, and `if`; +- deterministic hard constraints and semantic rubrics; +- an append-only generation capsule with captured inputs, a materialized plan, request journaling, + delivery-certainty tracking, resume verification, and seal grammar/reservation foundations; +- a synthetic replay smoke path that validates basic data flow; and +- a methodology that forbids public efficiency claims without denominators, confidence intervals, + judge provenance, and human audit. + +The synthetic replay result is not model evidence. The current capsule path is also not yet +connected end-to-end to capsule-bound judging, scoring, inference, audit, and publication. GitHub +currently has no live-benchmark workflow, benchmark environment, benchmark secret, or protected +benchmark-tag ruleset. + +The current public CLI also confers no campaign authority or evidentiary capability, and the +repository has no complete scenario-shard projection, live structured judge, campaign spend +ledger, or reasoning/verbosity request path. Those are prerequisites, not capabilities this +document assumes already exist. + +The design therefore completes the evidence path before spending API budget or publishing a +performance statement. + +## 3. Goals + +- Measure whether `if` produces shorter successful responses than the exact concise instruction + `Answer concisely.` for each selected model. +- Prevent a failed, incomplete, or semantically inferior answer from winning because it is short. +- Preserve the English/Russian and repeated-generation dependence in statistical inference. +- Make provider requests, retries, judgments, human labels, estimators, and outcome rules + reproducible and auditable. +- Bound API exposure before credentials become available and during execution. +- Make resume fail closed when request delivery is ambiguous. +- Separate provider-secret execution from repository-write publication authority. +- Publish immutable evidence and honest limitations for every started confirmatory campaign. +- Produce result-specific documentation and social copy only after evidence review, merge, and the + verified `RELEASED` transition. + +## 4. Non-goals + +- Combining activation accuracy with response brevity or quality. +- Claiming compatibility with a named agent host from stored activation expectations. +- Treating translations or repetitions as independent scenarios. +- Claiming universal Laconian superiority from three model-specific experiments. +- Using `baseline` or Caveman as a substitute for the primary `if` versus `concise` hypothesis. +- Publishing the existing replay fixture as live evidence. +- Creating a continuously running benchmark, leaderboard, scheduled spend, or PR-triggered live + provider job. +- Posting automatically to social accounts. +- Hiding a valid negative or inconclusive result. + +## 5. Approaches considered + +### A. One monolithic live workflow + +One job would prepare, generate, judge, score, and publish. It is operationally simple but gives a +large failure domain, weak checkpoint behavior, a serious hosted-job timeout risk, and an unsafe +temptation to combine provider secrets with repository-write permissions. + +### B. Staged capsule pipeline — selected + +Small logical generation and judge shards produce hash-bound artifacts, while bounded resumable +batch-controller jobs amortize GitHub environment approvals across multiple shards. Human labels +and statistical attachments reference immutable upstream hashes. A read-only collector seals the +publication bundle; a separate minimal environment-gated job copies only that exact bundle and +creates the publication PR without the provider secret. This is the smallest architecture that +meets the methodology and failure-safety requirements. + +### C. Per-request workflow fan-out + +One job per request minimizes lost work but creates thousands of jobs, a much larger Actions +supply-chain surface, more difficult rate coordination, and unwieldy artifact collection. The +selected design instead keeps all matched observations for one model/scenario together. + +## 6. Confirmatory experimental contract + +### 6.1 Scope and calls + +The full response campaign contains: + +| Dimension | Value | +|---|---:| +| Generation models | 3 | +| Independent scenarios | 12 | +| Localized cases per scenario | 2 (`en`, `ru`) | +| Arms | 4 | +| Repetitions | 5 | +| Planned generation responses | 1,440 | +| Potential judge decisions | up to 1,440 | + +Activation cases remain a separate suite and do not enter response metrics. + +Each model has its own native-v2 manifest. Across the four arms for one model, the provider, +requested model, user prompt, generation settings, tool availability, instruction placement, and +repetition remain fixed. Only the captured arm instruction bytes differ. + +### 6.2 Generation settings + +All three models use the Responses API with explicit, captured settings: + +- literal request wire field `service_tier: "default"`; +- `reasoning.effort: medium`; +- `text.verbosity: medium`; +- `max_output_tokens: 1024`, including visible and reasoning output tokens; +- no tools; +- no conversation carry-over or prior response; +- `store: false`; +- literal `prompt_cache_options: {"mode": "explicit", "ttl": "30m"}` and no cache + breakpoint; +- no temperature value sent; and +- the existing `system_suffix` instruction placement. + +Explicit reasoning and verbosity prevent provider-default drift from silently changing the +experiment. A setting change creates a new protocol hash and cannot be pooled with the campaign. +The source and resolved manifest schemas, request model, request-config hash, plan rows, provider +kwargs, and capsule verifier must all carry these fields. Preflight fails if the exact wire request +does not contain `service_tier: "default"`, `reasoning: {effort: medium}`, and +`text: {verbosity: medium}`. The service-tier key on the wire is exactly `service_tier`; aliases, +SDK-only configuration, environment defaults, and omission are forbidden. The request serializer, +provider projection, attempt journal, response evidence, ledger, and verifier bind this literal +field end to end as `service_tier="default"`. Returned-tier evidence is the exact +`service_tier` field from the canonical raw Responses API result plus its source digest; a renamed, +derived, or SDK-default assertion is not returned-tier evidence. Reasoning mode is omitted and the +omission is itself part of the captured request configuration. + +Every response attempt records returned-tier evidence and exactly one closed service-tier +accounting status: + +```text +reported_default | not_applicable_definitely_not_sent | +not_applicable_definitely_rejected | missing | mismatch +``` + +`reported_default` requires returned provider evidence that the effective service tier was +`default`. `not_applicable_definitely_not_sent` is valid only when independent durable evidence +proves the request was never dispatched and therefore received no response and incurred no usage. +`not_applicable_definitely_rejected` is valid only when independent durable evidence proves a +structured definitely-rejected transport response with no Responses API result and no usage; +the retry-eligible 429 case remains governed by section 8. Neither status may be inferred from a +missing field. If any Responses API result is received, or if delivery is unknown, missing +returned-tier evidence is `missing`; any non-`default` evidence is `mismatch`. Either retains the +full worst-case exposure, durably appends STOP, and permits zero later provider calls. + +Cache reads and cache writes are distinct request, evidence, usage, pricing, reservation, +reconciliation, and accounting dimensions. For every generation and judge request, the tagged +wire contract has exactly this cache-control member: + +```json +"prompt_cache_options": {"mode": "explicit", "ttl": "30m"} +``` + +`prompt_cache_key` and deprecated `prompt_cache_retention` are absent. The canonical `instructions` +and recursively every object inside canonical `input` contain no `prompt_cache_breakpoint` key; +the verifier rejects that key at any depth before serialization. No other cache-control member is +allowed. The [Responses create reference](https://developers.openai.com/api/reference/cli/resources/responses/methods/create) +defines these GPT-5.6+ fields, and the dated +[prompt-caching guide](https://developers.openai.com/api/docs/guides/prompt-caching) states that +explicit mode with no explicit breakpoint neither uses prompt caching nor creates cache writes. +The request bytes, provider kwargs, and captured projection must be byte-equivalent on these +members; SDK defaults or omission cannot satisfy the contract. + +The tagged live protocol also binds OpenAI Python SDK version `3.3.1` and the exact C0-derived +`uv.lock` member hash. Preflight imports that pinned distribution, verifies that its typed request +and response models expose every frozen field/path, and rejects a different installed version, +lock member, serializer projection, or response model before credentials. + +The canonical raw-response paths are exactly: + +```text +response.service_tier +response.prompt_cache_options.mode +response.prompt_cache_options.ttl +response.usage.input_tokens +response.usage.input_tokens_details.cached_tokens +response.usage.input_tokens_details.cache_write_tokens +response.usage.output_tokens +response.usage.output_tokens_details.reasoning_tokens +response.usage.total_tokens +``` + +No alternate, flattened, inferred, billing-dashboard, or SDK convenience path is response +evidence. A Responses result must echo applied options exactly as +`response.prompt_cache_options.mode == "explicit"` and +`response.prompt_cache_options.ttl == "30m"`; missing or different applied-option evidence is a +request-contract mismatch that retains worst-case exposure, appends STOP, and permits zero later +calls. The separate applied-cache-control status has exactly this closed vocabulary: + +```text +reported_exact | not_applicable_definitely_not_sent | +not_applicable_definitely_rejected | missing | mismatch | invalid +``` + +The exact two strings map to `reported_exact`; a proven no-dispatch or definitely rejected/no-usage +attempt maps to its corresponding `not_applicable_*`; absent/null evidence maps to `missing`; any +different well-formed value maps to `mismatch`; and wrong types or source-digest failure map to +`invalid`. Unknown delivery maps to `missing`. Every attempt stores `cache_read_tokens` only from +`response.usage.input_tokens_details.cached_tokens` and `cache_write_tokens` only from +`response.usage.input_tokens_details.cache_write_tokens`, each with its raw-response source digest. +For a complete response, both must be nonnegative integers, each must not exceed `input_tokens`, +their sum must not exceed `input_tokens`, and +`ordinary_uncached_input_tokens = input_tokens - cache_read_tokens - cache_write_tokens`. + +The cache-read status enum and cache-write status enum are separate fields but have the same exact +closed vocabulary: + +```text +reported_zero | reported_nonzero | not_applicable_definitely_not_sent | +not_applicable_definitely_rejected | missing | invalid +``` + +The evidence-to-status mapping is exhaustive. A proven never-dispatched attempt has null tokens and +`not_applicable_definitely_not_sent` for both fields. A structured definitely-rejected attempt +independently proven to have no Responses result and no usage has null tokens and +`not_applicable_definitely_rejected` for both. For a Responses result, an exact integer zero maps +to `reported_zero`, a positive integer maps to `reported_nonzero`, an absent or null path maps to +`missing`, and a wrong type, negative value, bound violation, inconsistent total, or source-digest +failure maps to `invalid`. Unknown delivery without a trustworthy result maps to `missing` for +both. No other transition is valid, and the status of one dimension cannot supply or change the +other. + +Only `reported_exact/reported_zero/reported_zero` across applied-control/read/write, or the matching +triple of independently proven `not_applicable_*` statuses, satisfies the no-read/no-write contract. +Any nonzero cache read retains the read charge, appends STOP, and permits zero later calls. Any +nonzero cache write is first reconciled and charged at the frozen cache-write rate, then appends +STOP and permits zero later calls. `missing`, `mismatch`, or `invalid` retains the affected +dimension's full conservative reservation; an applied-control failure retains all three input +components. It appends STOP after a Responses result or unknown delivery and permits zero later +calls. Missing write detail never becomes zero. Here and in section +8, “response” means a Responses API result, not a structured definitely-rejected transport response +independently proven to have no result and no usage. + +Every frozen requested model ID has a reviewed, non-null cache-write rate even though writes are +forbidden. +`price_snapshot.service_tier` and `price_attestation.requested_service_tier` are both exactly +`"default"`; a mismatch stops before key access. The price snapshot binds separate +ordinary-uncached-input, cache-read-input, cache-write-input, visible-output, and reasoning-output +prices and their source evidence. + +The versioned conservative input-exposure rule is frozen and proves an upper bound of at most +`272_000` input tokens for each request attempt. The price snapshot, batch plan, and ledger reserve +only under the ordinary `default`-tier price schedule at that bound. Long-context pricing is not an +authorized price class and must not be used to authorize, reserve, or reconcile campaign spend; +an attempt that cannot be proven within the bound stops before dispatch. + +Provider evidence must capture `output_tokens_details.reasoning_tokens` in addition to total +provider `output_tokens`. The visible-response token count is defined as provider output tokens +minus reasoning tokens. A missing, negative, or inconsistent reasoning-token breakdown makes a +token-based result unavailable rather than silently treating hidden reasoning as visible prose. + +The requested model IDs and the public model identifiers returned by the API are both retained. +Successful responses for one model campaign must resolve consistently. A mixed returned-model +identifier invalidates that model campaign rather than being silently pooled. + +### 6.3 Randomization + +The existing seeded arm-order algorithm remains the request-order contract within each localized +case and repetition. A separate predeclared campaign seed determines shard order, bootstrap +resampling, and human-audit sampling. Each derived seed is the first 128 bits of +`SHA256(domain || NUL || campaign_seed || NUL || input_tag_commit || NUL || judge_protocol_sha256)`, +interpreted as an unsigned big-endian integer. Domain strings, canonical encodings, ordering, +PRNG, and algorithm versions are captured before any live call. + +Case text, constraints, rubric, arm bytes, runner source, dependencies, judge protocol, and +statistical protocol are hashed by the immutable input tag. Editing any of them requires a new tag +and campaign ID. + +### 6.4 Corpus neutrality and warning severity + +Hard constraints must be grounded in the user prompt. Before the live pilot, the 14 localized +`max_sentences` constraints that were added by the evaluator but not requested by the prompt are +removed from the confirmatory corpus. Only `user-decline-en` and `user-decline-ru`, whose prompts +explicitly require exactly two sentences, retain sentence-count gates. This prevents an invented +brevity cap from preferentially excluding longer arms. + +Every semantic `material_warning` also receives a frozen severity. The two `safety-medical` +localized cases are `critical`; the `preserve-command` and `safety-financial` warnings are +`material`. The audit's zero-tolerance critical-warning rule applies only to the preregistered +`critical` set. The neutrality edit, warning severities, and resulting case hashes are reviewed and +frozen before the pilot; no change is allowed after observing pilot outputs without a new protocol +identity. + +### 6.5 Independent reviewer identity registries + +The input tag contains two independent, typed identity registries. `AuditReviewerRegistryV1` +contains exactly two distinct audit reviewers. Each ordered entry binds the reviewer ID, numeric +GitHub account ID, exact GitHub login, signing-verification mode, signing fingerprint (including an +explicit null only when the frozen verification mode permits no fingerprint), and role. Its +canonical bytes and digest are audit-registry-specific and bind every audit commitment, reveal, +adjudication, approval, and collector check. + +`ProtocolReviewerRegistryV1` contains exactly three distinct protocol reviewers in this exact role +order: + +1. `statistical_method`; +2. `blind_judge_audit_protocol`; and +3. `security_evidence`. + +Each ordered protocol entry binds its numeric GitHub account ID, exact GitHub login, +signing-verification mode, signing fingerprint, and canonical ASCII Git author/committer name and +email used by its reviewer commit. The `security_evidence` fingerprint is +non-null regardless of the other roles' allowed modes. The protocol registry has canonical bytes +and a digest distinct from the audit registry. + +The verified C0 tree also contains +`benchmark/security/tag-operator-registry.json`, exact `TagOperatorRegistryV1`. It has exactly +`schema_version`, positive numeric `repository_id`, `operators`, and +`tag_operator_registry_sha256`. `operators` contains exactly one `TagOperatorProjectionV1` with +exactly positive numeric `operator_account_id`, case-sensitive `operator_login`, ASCII +`tagger_name`, ASCII `tagger_email`, and `tag_operator_sha256`. `tag_operator_sha256` is SHA-256 of +`UTF8("laconian-tag-operator-v1\n") || CanonicalJSONV1(entry without exactly +tag_operator_sha256)`. `tag_operator_registry_sha256` is SHA-256 of +`UTF8("laconian-tag-operator-registry-v1\n") || CanonicalJSONV1(registry without exactly +tag_operator_registry_sha256)`; the stored entry digest remains inside that registry preimage. +No root is included in its own preimage. Null, +duplicate, role/team/App/deploy-key identity, control character, non-ASCII tagger identity, or a +second operator is forbidden. The C0 input registry, T0/T1 messages, +`ProtocolAttestationTagBindingV1`, and `CampaignRegistryV1` bind this same registry digest. + +The verified C0 tree additionally contains `benchmark/security/tag-ruleset-policy.json`, exact +stable `TagRulesetPolicyV1` from section 6.5.3. Its digest is the ordered +`tag_ruleset_policy_root`. These C0 members and digests are required by the input registry and, +together with the token-delivery-isolation policy, broker-key root and dismissal policy below, are +the final five ordered `security_evidence` statement subjects: +`broker_token_delivery_isolation_policy_sha256`, `broker_signing_keys_root_sha256`, +`tag_operator_registry_sha256`, `tag_ruleset_policy_root`, then +`invalid_event_dismissal_policy_sha256`. + +C0 also freezes `benchmark/security/invalid-event-dismissal-policy.json`, exact +`InvalidEventDismissalPolicyV1`, with exactly `schema_version`, `repository_id`, +`eligible_dismissers`, and `invalid_event_dismissal_policy_sha256`. `eligible_dismissers` is a +nonempty ascending numeric-account-ID array of strict `{account_id, login}` projections; no role, +team, App, deploy key, repository-role, or ambient maintainer expansion is allowed. Its digest is +SHA-256 of `UTF8("laconian-invalid-event-dismissal-policy-v1\n") || CanonicalJSONV1(policy without +exactly invalid_event_dismissal_policy_sha256)`. The C0 input registry, security statement, +campaign payload, and `CampaignRegistryV1` bind this digest. + +The verification-mode vocabulary is closed: + +- `github_verified_commit` requires a GitHub commit-verification record with `verified: true`, + matching numeric account ID/login, and a null `signing_fingerprint`; +- `ssh_sha256` requires the same identity match and a non-null OpenSSH fingerprint matching + `SHA256:`; and +- `openpgp_fingerprint` requires the same identity match and a non-null uppercase 40- or 64-hex + primary-key fingerprint. + +No other mode or fingerprint form is valid. Because `security_evidence` requires a non-null +fingerprint, that role cannot use `github_verified_commit`. A non-null fingerprint is mandatory for +either keyed mode and forbidden for `github_verified_commit`; a mode/fingerprint mismatch rejects +the registry before any attestation is evaluated. + +### 6.5.1 Non-self-referential protocol-review topology + +The protocol review uses two protected, annotated-only tags and this serial construction order: + +```text +T0 -> C0 -> Rstat -> Rjudge -> Rsecurity -> B0 <- T1 +``` + +Here `T0` is `refs/tags/benchmark-input-YYYYMMDD.N`, an annotated tag whose target peels exactly to +the input commit `C0`. `T1` is the deterministically paired +`refs/tags/benchmark-attestations-YYYYMMDD.N`, an annotated tag whose target peels exactly to the +bundle commit `B0`. A lightweight tag, tag-of-tag target, different suffix, alternate ref namespace, +or ambiguous peel is invalid. Both ref patterns are protected against update and deletion by +rulesets, but authority is conferred only by the verified object identities and raw-object hashes, +never by a mutable ref name or by the ruleset alone. + +For the input-tag basename ``, the exact campaign review paths are: + +```text +benchmarks/protocol-reviews//statements/01-statistical-method.json +benchmarks/protocol-reviews//statements/02-blind-judge-audit-protocol.json +benchmarks/protocol-reviews//statements/03-security-evidence.json +benchmarks/protocol-reviews//attestations/01-statistical-method.json +benchmarks/protocol-reviews//attestations/02-blind-judge-audit-protocol.json +benchmarks/protocol-reviews//attestations/03-security-evidence.json +benchmarks/protocol-reviews//bundle.json +``` + +The entire `benchmarks/protocol-reviews//` path is absent from `C0`. In particular, `C0` and +`T0` contain no protocol-review statement, verified attestation envelope, +`protocol_attestations_root`, companion-tag binding, or claim about a future reviewer, bundle, or +companion-tag object. `CampaignInputPackageV1`, which is derived only from verified `C0` inputs, +likewise forbids those values. It does contain the ordered exact three cycle-free +`BrokerSigningKeyV1` public-key records and their recomputed `broker_signing_keys_root_sha256`; C0 +therefore fixes the receipt signers before any preflight-produced registry or receipt exists. It +also contains the exact `BrokerTokenDeliveryIsolationPolicyV1`, including all three reviewed vault +measurements. This absence and the policy/key-root presence are explicit preflight checks. + +`Rstat` has exactly one parent, `C0`, and its tree delta adds only the first statement path as a +regular non-executable blob. `Rjudge` has exactly one parent, `Rstat`, and adds only the second +statement path. `Rsecurity` has exactly one parent, `Rjudge`, and adds only the third statement +path. Each is authored and commit-signed by the registry identity for its role. It retains every +parent tree entry byte-for-byte; a modification, deletion, rename, mode change, second path, second +parent, merge header, or reordered reviewer is invalid. The serial order is normative even if the +reviews were prepared concurrently. + +After all three reviewer commits exist and their signatures have been independently verified, a +secret-free verifier creates `B0` with exactly one parent, `Rsecurity`. Its tree retains the parent +unchanged and adds only the three exact attestation-envelope paths and `bundle.json`, all as regular +non-executable blobs. `B0` contains no reference to its own OID or raw-object hash and no reference +to `T1`. Only after `B0` exists may the operator create `T1`. Changing any `C0`, reviewer, statement, +envelope, bundle, tag message, tagger field, or tag object requires a new T0/T1 pair and new +reviewer commits; repair in place is forbidden. + +For every Git object in this protocol, `GitObjectSHA256V1` is SHA-256 over the exact bytes: + +```text +" \0" || object-content +``` + +`` is the literal Git object type, the decimal length has no sign or leading zero, and +`object-content` is the exact unmodified content. This raw-object SHA-256 is distinct from the +repository's 40-lowercase-hex SHA-1 object ID. Both values are required wherever an object is +bound. Re-encoding JSON, stripping a signature header, changing a tag message, or hashing only +object content cannot reproduce this digest. + +The frozen operator registry supplies one exact `TagOperatorProjectionV1` with positive numeric +GitHub account ID, case-sensitive login, canonical ASCII tagger name/email, and its digest. The +same registered operator creates T0 and T1. The operator may also be one or more of the three +registered reviewers only when that overlap is explicit in the frozen registries; the tag-creation +act never substitutes for any required reviewer statement or commit signature. Creation is possible +only through the exact operator's authorized `User` bypass of the creation-authorizer ruleset; its +historical rule-suite result is therefore exactly `bypass`, not `pass`. A namespace squat, +pre-existing unbound ref, missing or differently authorized creation bypass, wrong/extra/exempt actor, +update/delete bypass, or different operator for T0 and T1 invalidates the pair. + +The operator registry and raw tag-object parser share one lexical grammar. Serialized `tagger_name` +is 1–80 bytes total and consists of one or more nonempty non-space ASCII tokens from `0x21..0x7e` +excluding `<` and `>`, joined by exactly one +`0x20`; leading/trailing/repeated whitespace and every tab/control/non-ASCII byte are forbidden. +`tagger_email` is 3–254 printable non-space ASCII bytes, contains exactly one `@`, has nonempty +local/domain sides, neither side starts or ends with `.`, neither contains `..`, and `<`, `>`, +controls, whitespace are forbidden. The epoch is ASCII `0` or `[1-9][0-9]*`, integer range +`0..253402300799`, with no sign or leading zero; timezone is literally +`+0000`. Registry bytes that do not satisfy this grammar are invalid, and T0/T1 reproduce the same +name/email bytes exactly. + +Raw Git object grammar is closed. T0 and T1 are unsigned annotated tags whose content contains, in +order, exactly `object <40-lowercase-hex-oid>`, `type commit`, `tag `, and +`tagger +0000`, followed by one blank line, exact +strict CanonicalJSON message bytes, and one LF. T0 uses `InputTagMessageV1` with exactly +`schema_version`, `input_tag_ref`, `companion_tag_ref`, `peeled_c0_oid`, +`protocol_reviewer_registry_sha256`, `tag_operator_registry_sha256`, +`tag_ruleset_policy_root`, and `workflow_root`; it may name the deterministic future T1 +ref but contains no future commit, object, envelope, bundle, root, or receipt. T1 uses +`ProtocolAttestationTagMessageV1` with exactly `schema_version`, `input_tag_ref`, `input_tag_oid`, +`input_tag_object_sha256`, `companion_tag_ref`, `bundle_commit_oid`, +`bundle_commit_object_sha256`, `protocol_attestation_bundle_sha256`, +`protocol_attestations_root`, `tag_operator_registry_sha256`, and `tag_ruleset_policy_root`; it +binds T0 and B0 but contains no T1 OID, T1 raw-object digest, or +self-digest. An embedded tag signature or any fifth header is forbidden. + +Each R* commit contains, in order, exactly `tree`, one `parent`, frozen reviewer `author` and +`committer` headers with identical whole-second epoch and `+0000`, and one mode-compatible `gpgsig` +header with Git continuation lines, followed by one blank line and the exact ASCII message +`laconian protocol review : ` plus one LF. Each protocol-registry entry +therefore also freezes its canonical ASCII author/committer name and email. B0 contains exactly +`tree`, one `parent`, frozen `ProtocolBundleBuilderGitIdentityV1` author and committer with identical +whole-second epoch and `+0000`, one blank line, and +`laconian protocol attestation bundle : ` plus one LF; it +has no signature header. The builder identity has exactly `schema_version`, literal +`name_ascii="Laconian Protocol Bundle Builder"`, literal +`email_ascii="laconian-protocol-bundle-builder@users.noreply.github.com"`, and +`protocol_bundle_builder_git_identity_sha256`. That digest is SHA-256 of +`UTF8("laconian-protocol-bundle-builder-git-identity-v1\n") || CanonicalJSONV1(identity without +exactly protocol_bundle_builder_git_identity_sha256)`. Every identity comes from verified C0 data. `encoding`, `mergetag`, a +second/unknown/duplicate header, multiple signatures, tag signatures, CR, NUL, non-NFC or ambiguous +Unicode, alternate timezone, extra blank line, alternate message, and any system/global/local Git +configuration or author/committer environment influence are rejected. Golden vectors fix the +complete raw bytes, SHA-1 OID, and `GitObjectSHA256V1` of both tags, all three reviewer commits, and +B0; negative vectors cover every forbidden header, identity, timestamp, message, signature, config, +namespace, creator, and bypass variant. + +### 6.5.2 Statements, verified envelopes, and bundle + +Every object described here uses strict `CanonicalJSONV1`: UTF-8, NFC strings, bytewise-sorted +object keys, schema-order arrays, JSON integers only, no booleans or strings where integers are +required, no floats, no duplicate keys, no insignificant whitespace, and no terminal newline. +Missing, extra, coercible, non-NFC, incorrectly ordered, or digest-mismatched data is invalid. + +`ProtocolReviewStatementV1` has exactly these top-level fields: + +```text +schema_version +role +protocol_registry_sha256 +reviewer_numeric_account_id +reviewer_login +verification_mode +signing_fingerprint +input_tag_ref +input_tag_oid +input_tag_object_sha256 +peeled_c0_oid +peeled_c0_sha256 +workflow_root +subjects +subject_root +signed_at +statement_sha256 +``` + +`schema_version` is exactly `ProtocolReviewStatementV1`; the role and reviewer fields byte-match +the corresponding ordered protocol-registry entry. `input_tag_ref` is the full T0 ref; +`input_tag_oid` and `peeled_c0_oid` are exact 40-lowercase-hex SHA-1 OIDs; the two SHA-256 fields use +`GitObjectSHA256V1`. `signed_at` is whole-second UTC RFC 3339. `statement_sha256` is the +domain-separated SHA-256 with separator `laconian-protocol-review-statement-v1` over the canonical +object with only `statement_sha256` omitted. The statement contains every substantive reviewer +claim, including the complete T0/C0, registry, workflow, subject, identity, mode, and time binding. +It contains no reviewer-commit OID, signature evidence, attestation-envelope digest, bundle value, +T1 value, or placeholder for a value that becomes known only after the commit is created. + +The exact role-to-subject inventories are: + +| Role | Ordered `subjects` kinds | +|---|---| +| `statistical_method` | `corpus_case_root`, `estimand_protocol_sha256`, `statistical_protocol_sha256`, `bootstrap_protocol_sha256`, `outcome_classification_protocol_sha256`, `false_fail_sensitivity_protocol_sha256` | +| `blind_judge_audit_protocol` | `hard_score_protocol_sha256`, `judge_prompt_sha256`, `judge_schema_sha256`, `audit_sampling_protocol_sha256`, `audit_commit_reveal_protocol_sha256`, `audit_adjudication_protocol_sha256` | +| `security_evidence` | `provider_request_contract_sha256`, `retry_spend_protocol_sha256`, `campaign_state_schema_sha256`, `workflow_endpoint_policy_sha256`, `artifact_security_protocol_sha256`, `publication_correction_protocol_sha256`, `publication_branch_ruleset_policy_sha256`, `identity_registry_bundle_sha256`, `state_writer_git_identity_sha256`, `broker_token_delivery_isolation_policy_sha256`, `broker_signing_keys_root_sha256`, `tag_operator_registry_sha256`, `tag_ruleset_policy_root`, `invalid_event_dismissal_policy_sha256` | + +Each subject is exactly `{kind, sha256}`. A role's statement must contain every listed subject once +in that order and may contain no subject assigned to another role, no unlisted subject, and no +duplicate. Common fields such as registry, C0, and workflow roots remain top-level and are forbidden +inside `subjects`. `subject_root` is exactly +`SHA256(UTF8("laconian-protocol-review-subjects-root-v1\n") || CanonicalJSONV1(the exact ordered +subjects array))`; no statement field or implicit metadata enters that preimage. + +`VerifiedProtocolAttestationV1` has exactly `schema_version`, `statement`, `signature_evidence`, +and `attestation_sha256`. `statement` is the complete canonical `ProtocolReviewStatementV1`, +byte-identical to the blob at that role's fixed statement path. `attestation_sha256` uses separator +`laconian-verified-protocol-attestation-v1` over the canonical envelope with only that field omitted. +An envelope is created after its reviewer commit; it is verifier evidence, not reviewer-authored +content, and cannot alter or supplement a substantive statement. + +`signature_evidence` is a closed mode-discriminated union. Every variant contains exactly +`schema_version`, `verification_mode`, `commit_oid`, `commit_object_sha256`, `parent_commit_oid`, +`statement_path`, `github_rest_verification`, and `github_graphql_signature`. The schema version is +`GitHubVerifiedCommitEvidenceV1`, `SSHVerifiedCommitEvidenceV1`, or +`OpenPGPVerifiedCommitEvidenceV1` according to the statement's mode. The commit and parent OIDs, +raw-object SHA-256, path, reviewer identity, and mode must reconstruct from the reviewed Git object +and registry rather than from the envelope. The two keyed variants additionally contain exactly +`fingerprint`, `keyring_sha256`, and `local_signature_verification`; those fields are forbidden in +the GitHub-only variant. + +`github_rest_verification` is stable allowlisted `GitHubCommitVerificationProjectionV1` and +contains exactly `schema_version`, positive numeric `repository_id`, `commit_oid`, literal +`api_version`, literal `endpoint`, `verified: true`, `reason: "valid"`, `payload`, `signature`, +`verified_at`, and `rest_projection_sha256`. The API version and endpoint are fixed protocol +constants: `X-GitHub-Api-Version: 2022-11-28` and +`GET /repos/{owner}/{repo}/git/commits/{commit_oid}` with no alternate endpoint. The digest uses +separator `laconian-github-commit-verification-projection-v1` over the +canonical projection with only its digest omitted. `payload` byte-equals the signed commit payload +reconstructed from the raw commit object and `signature` byte-equals its embedded signature. + +`github_graphql_signature` is stable allowlisted `GitHubSignatureProjectionV1` and contains exactly +`schema_version`, the same numeric `repository_id`, `commit_oid`, fixed `query_sha256`, positive +numeric `signer_database_id`, `signer_login`, `is_valid: true`, `state: "VALID"`, and +`graphql_projection_sha256`. Its digest uses separator +`laconian-github-signature-projection-v1` with only its digest omitted. The signer database ID/login +are exact projections of GraphQL `signer.databaseId`/`signer.login` and byte-match the registry; +the boolean/enum values are exact projections of `isValid`/`state`. Online freeze and preflight obtain both projections over +authenticated TLS from GitHub for the exact repository/commit and compare them to the independently +fetched raw commit. A null signer, mismatched repository/commit/projection, missing or extra field, +or GitHub status accepted without the raw object is invalid. + +This composite trust model intentionally omits GraphQL `payload`, `signature`, `verifiedAt`, +`type`, `email`, and `wasSignedByGitHub` from the stable projection: REST plus the raw object binds +payload, signature, and verification time, while GraphQL binds only signer identity and +validity/state. If the fixed query selects an omitted field, it may appear only in the volatile raw +response carried by `GitHubSignatureObservationReceiptV1`; it is non-authoritative and cannot +change the stable projection or any campaign identity. + +Variable transport evidence is forbidden from envelopes, B0, `ProtocolAttestationTagBindingV1`, +`CampaignRegistryV1`, campaign ID, seeds, and plans. Instead each online observation writes a +separate `GitHubSignatureObservationReceiptV1` containing exactly `schema_version`, +`repository_id`, `commit_oid`, `rest_projection_sha256`, `graphql_projection_sha256`, +`observed_at`, `request_ids`, `etags`, `raw_response_sha256s`, `canonical_response_sha256s`, +`tls_endpoint_identity`, and `github_signature_observation_receipt_sha256`. These receipts are +preflight/stage evidence only. Fresh observations may have different transport metadata but must +reconstruct byte-identical stable projections. Offline replay verifies the frozen projection/raw +Git-object relation and keyed signatures, but cannot independently authenticate GitHub as the +origin of a `github_verified_commit` projection. +The receipt digest is SHA-256 of +`UTF8("laconian-github-signature-observation-receipt-v1\n") || CanonicalJSONV1(receipt without +exactly github_signature_observation_receipt_sha256)`. + +For `ssh_sha256` and `openpgp_fingerprint`, `fingerprint` byte-matches the registry and statement, +and `keyring_sha256` identifies the frozen public-key material included in the +`identity_registry_bundle_sha256` subject. `local_signature_verification` contains exactly +`verified: true`, `signed_payload_sha256`, `signature_sha256`, `verifier_tool_sha256`, and +`verification_receipt_sha256`. An isolated verifier reconstructs the signed payload from the raw +commit, verifies the embedded signature against only that frozen keyring, and requires the verified +primary-key fingerprint to match. REST and GraphQL verification remain mandatory; local +verification is additional and cannot be replaced by GitHub's status. Key material, access tokens, +or a self-asserted verification result are forbidden in the envelope. +`verification_receipt_sha256` is exactly +`SHA256(UTF8("laconian-local-signature-verification-receipt-v1\n") || CanonicalJSONV1(the exact +five-field local_signature_verification record without exactly verification_receipt_sha256))`. + +`ProtocolAttestationBundleV1` at `bundle.json` contains exactly `schema_version`, +`protocol_registry_sha256`, `input_tag_ref`, `input_tag_oid`, `input_tag_object_sha256`, +`peeled_c0_oid`, `peeled_c0_sha256`, `workflow_root`, `attestations`, +`protocol_attestations_root`, and `protocol_attestation_bundle_sha256`. `attestations` embeds the +three complete verified envelopes in registry role order and each is byte-identical to its separate +attestation blob. `protocol_attestations_root` uses separator +`laconian-verified-protocol-attestations-root-v1` over that canonical ordered array. The bundle digest uses +separator `laconian-protocol-attestation-bundle-v1` over the canonical bundle with only its final +digest omitted. No B0 or T1 identity appears in the bundle. + +### 6.5.3 Post-tag binding and campaign identity + +After T1 exists, preflight constructs `ProtocolAttestationTagBindingV1`. It has exactly these +top-level fields: + +```text +schema_version +input_tag_ref +input_tag_oid +input_tag_object_sha256 +peeled_c0_oid +peeled_c0_sha256 +reviewer_commits +bundle_commit_oid +bundle_commit_object_sha256 +companion_tag_ref +companion_tag_oid +companion_tag_object_sha256 +protocol_registry_sha256 +workflow_root +protocol_attestations_root +protocol_attestation_bundle_sha256 +object_closure_root +tag_operator_registry_sha256 +tag_ruleset_policy_root +protocol_attestation_tag_binding_sha256 +``` + +`reviewer_commits` is the exact three-entry registry-role-ordered array of `{role, commit_oid, +commit_object_sha256}`. `object_closure_root` is the domain-separated digest of the canonical +OID/type/size/raw-object-SHA-256 inventory for T0, C0, all tree and blob objects needed to reconstruct +C0 and the four exact deltas, Rstat, Rjudge, Rsecurity, B0, and T1. C0 parent OIDs are recorded as +boundary links but pre-C0 ancestry is outside this campaign closure. + +`TagRulesetPolicyV1` has exactly `schema_version`, positive numeric `repository_id`, `rulesets`, and +`tag_ruleset_policy_root`. `rulesets` has exactly two projections in stable semantic order, +independent of API response order. Each projection has exactly `semantic_role`, distinct positive +`ruleset_id`, `source_type: "Repository"`, `source_id` equal to `repository_id`, `target: "tag"`, +`enforcement: "active"`, `include_patterns`, `exclude_patterns`, `rules`, and `bypass_actors`. +Both use the identical ordered includes `refs/tags/benchmark-input-*` then +`refs/tags/benchmark-attestations-*` and exact empty excludes. + +The first projection has `semantic_role: "creation_authorizer"`, only rule +`{type: "creation", parameters: null}`, and exactly one bypass actor +`{actor_id: , actor_type: "User", bypass_mode: "always"}`. The second has +`semantic_role: "immutability"`, rules exactly `{type: "update", parameters: null}` then +`{type: "deletion", parameters: null}`, and `bypass_actors: []`. The two distinct IDs and their +union are the complete applicable active inventory for both patterns. Any extra applicable, +`evaluate`, or disabled ruleset; overlap; extra/missing/reordered rule; changed include/exclude; +role, team, App, deploy-key, repository-role, organization-admin, or other exempt/bypass actor; or +unknown field is invalid. `tag_ruleset_policy_root` is SHA-256 of +`UTF8("laconian-tag-ruleset-policy-v2\n") || CanonicalJSONV1(policy without exactly +tag_ruleset_policy_root)`. Ruleset projections have no stored entry digest; their identity is their +exact canonical value inside that root. It excludes request IDs, +timestamps, ETags, response/list ordering, headers, pagination, and all transport metadata. The tag +binding digest uses `laconian-protocol-attestation-tag-binding-v1` with only its final digest +omitted. + +Current policy reads emit separate `TagRulesetObservationReceiptV1` records containing exactly +`schema_version`, `repository_id`, ordered `ruleset_ids`, `tag_ruleset_policy_root`, `observed_at`, +`request_ids`, `etags`, `raw_response_sha256s`, `canonical_response_sha256s`, `pagination_root`, and +`tag_ruleset_observation_receipt_sha256`. The digest is SHA-256 of +`UTF8("laconian-tag-ruleset-observation-receipt-v1\n") || CanonicalJSONV1(receipt without exactly +tag_ruleset_observation_receipt_sha256)`. They contain no creation actor or historical rule-suite +claim. Each fresh read must prove that exactly the two applicable active rulesets project to the +sealed root. + +Each tag creation instead requires a unique historical `TagCreationRuleSuiteReceiptV1` with exactly +`schema_version`, `repository_id`, positive unique `rule_suite_id`, `operation: "create"`, exact +`ref`, Git all-zero SHA-1 `before_sha`, exact annotated-tag-object OID `after_sha`, +`actor_account_id`, `actor_login`, `pushed_at`, `overall_result: "bypass"`, `evaluation_result: "fail"`, +`rule_evaluations`, `creation_authorizer_ruleset_id`, `creation_bypass_grant`, +`tag_ruleset_policy_root`, `request_ids`, `api_version`, `raw_response_sha256`, +`canonical_response_sha256`, `observed_at`, and `tag_creation_rule_suite_receipt_sha256`. +`rule_evaluations` contains exactly one stable element with exactly `rule_source_type: "ruleset"`, +`rule_source_id`, `enforcement: "active"`, `result: "fail"`, and `rule_type: "creation"`. +GitHub raw `rule_source.name` and optional evaluation details remain only in the safe raw response +blob; they are excluded from this stable projection, and an unknown stable field is rejected. +Elements would sort by `(rule_source_type,rule_source_id,rule_type)`, but cardinality is exactly one; +its source ID equals the sealed creation-authorizer ruleset. `creation_bypass_grant` is derived, not +reported per rule, and has exactly `actor_id`, `actor_login`, `source_ruleset_id`, and +`tag_ruleset_policy_root`; it is valid only because top-level actor ID/login and `overall_result=bypass` +match the one `TagOperatorRegistryV1` entry and its sealed `User/always` bypass in +`TagRulesetPolicyV1`. No claim is made that GitHub returns actor type or bypass mode per rule. +The receipt digest is SHA-256 of +`UTF8("laconian-tag-creation-rule-suite-receipt-v1\n") || CanonicalJSONV1(receipt without exactly +tag_creation_rule_suite_receipt_sha256)`. The creation rule's evaluation and grant identify only the frozen operator's exact `User/always` +bypass. Preflight requires one and only one authenticated historical suite for T0 and one different +suite for T1. A reused old suite, delete/recreate, nonzero `before_sha`, different `after_sha`, +wrong/extra/exempt actor, missing/ambiguous/multiple suite, unauthorized creation result, or any +update/deletion bypass is invalid. + +Raw-to-canonical mapping is exact: suite `result` maps to `overall_result`, suite +`evaluation_result` maps unchanged, suite `actor_id`/`actor_name` map to +`actor_account_id`/`actor_login`, and each raw evaluation maps only +`rule_source.type`, `rule_source.id`, `enforcement`, `result`, and `rule_type` to the stable element. +Top-level literals must be `bypass` and `fail`; the sole evaluation literals are `ruleset`, the +sealed ID, `active`, `fail`, and `creation`. Missing, duplicate, differently ordered, extra stable, +or contradicting values fail closed. +Receipt `operation: "create"` is a verifier-derived discriminator from the exact new ref, all-zero +`before_sha`, and nonzero annotated-tag-object `after_sha`; it is not claimed to be a GitHub API +response field. + +Both receipt types are preflight/stage/archive evidence and are excluded from tag binding, +`CampaignRegistryV1`, campaign ID, seeds, and plans. Rechecking unchanged objects and semantic +policy therefore derives identical identity regardless of observation metadata. + +The durable archive is `ProtocolReviewObjectArchiveV1`, containing exactly `schema_version`, +`object_closure_root`, `objects`, `api_blobs`, `api_receipts`, and +`protocol_review_object_archive_sha256`. `objects` uses the same canonical object order with each +entry exactly `{oid, type, size, git_object_sha256, raw_content_base64}`. It +stores exact raw content bytes for every object in the closure, not merely an inventory. A +network-free importer decodes every entry, reconstructs `type SP decimal-size NUL content`, verifies +both hashes, reconstructs all trees/commits/tags and exact deltas, and rejects a missing, extra, +duplicate, reordered, or byte-mismatched object before replay. + +`object_closure_root` is SHA-256 of `UTF8("laconian-protocol-review-object-closure-v1\n") || +CanonicalJSONV1(the ordered entries projected to exactly oid,type,size,git_object_sha256)`; entries +have no stored self digest. `protocol_review_object_archive_sha256` is SHA-256 of +`UTF8("laconian-protocol-review-object-archive-v1\n") || CanonicalJSONV1(the complete archive +without exactly protocol_review_object_archive_sha256)`. The already-computed closure root is an +ordinary field in the outer preimage, so neither digest is circular. + +`api_blobs` is ordered lexicographically by `path`; each entry has exactly `path`, `kind`, +`sha256`, and `raw_bytes_base64`. Paths use exactly +`api///.response` or the corresponding +`.canonical.json`. `kind` is exactly `safe_raw_response` or +`canonical_projection`. Decoded bytes must hash to `sha256`; canonical projections must parse as +their named strict schema and reproduce every `canonical_response_sha256`, while safe raw response +bytes reproduce every `raw_response_sha256`. `api_receipts` is an ordered array of strict +`ArchivedApiReceiptBindingV1` elements with exactly `receipt_kind`, `receipt_sha256`, `receipt`, +`raw_blob_paths`, and `canonical_blob_paths`. Kind order is `github_signature`, +`tag_ruleset_observation`, `t0_creation_suite`, then `t1_creation_suite`; repeated observations +sort by `(observed_at,receipt_sha256)`. Path arrays have equal cardinality and index `i` maps +one-to-one to receipt raw/canonical hash array index `i`; singular creation fields are normalized +to one-element arrays only by this wrapper. Every path occurs exactly once globally; no blob is +unreferenced, multiply referenced, missing, or keyed by an undefined observation ID. Raw bytes are +exact safe response-body bytes, excluding HTTP headers, authorization, cookies, and query secrets; +a secret-bearing blob is invalid. +`receipt_kind` must match the embedded receipt's schema discriminator and `receipt_sha256` must +equal that receipt's recomputed exact self digest. At every index, the archived raw/canonical blob +entry's `sha256` must equal the corresponding embedded receipt hash. The wrapper has no self field; +its exact canonical value is bound only by `protocol_review_object_archive_sha256`. +Offline replay recomputes every receipt hash from these bytes and the canonical projection, but API +bytes remain platform observation evidence, not independent cryptographic provenance or proof of +GitHub origin. + +The post-tag binding is first persisted only in secret-free preflight evidence and the append-only +campaign authority; those are its only live authority sources. Downstream records and the final +offline archive may copy it only through the sealed `CampaignRegistryV1`. It is forbidden from C0, +all statements, all reviewer commits, B0, T0, and T1. This separation is what removes the hash +cycle: the immutable DAG is completed first, and only then is its complete object binding +constructed. + +`CampaignInputPackageV1` remains a C0-only package and contains neither attestations nor an +attestation root. Preflight instead builds a `CampaignRegistryPayloadV1` containing the exact +`campaign_input_package_sha256`, both reviewer-registry digests, `workflow_root`, the complete +`ProtocolAttestationTagBindingV1`, `tag_operator_registry_sha256`, `tag_ruleset_policy_root`, +`publication_branch_ruleset_policy_sha256`, +`invalid_event_dismissal_policy_sha256`, +`main_fallback_liveness_policy_sha256`, +`broker_token_delivery_isolation_policy_sha256`, +ordered exact `broker_signing_keys: BrokerSigningKeyV1`, +`broker_signing_keys_root_sha256`, +`protocol_attestations_root`, and +`protocol_attestation_bundle_sha256`. `campaign_registry_sha256` is the SHA-256 with separator +`laconian-campaign-registry-v1` over the canonical payload. `campaign_id` is exactly +`benchmark-` followed by the first 32 lowercase hex characters of that digest. +`CampaignRegistryV1` contains exactly `schema_version`, `campaign_id`, `payload`, and +`campaign_registry_sha256`; it rejects any ID not derived from its payload. Thus T1, B0, all three +review commits, their verified signatures, and the stable tag-ruleset policy bind campaign identity +without requiring any containing Git object to hash itself. +The registry key array byte-equals the reviewed C0 input-package array; its root uses leaves +`SHA256(UTF8("laconian-broker-signing-key-leaf-v1\n") || CanonicalJSONV1(key))`, binary nodes +`SHA256(UTF8("laconian-broker-signing-key-node-v1\n") || left || right)`, and final wrapper +`SHA256(UTF8("laconian-broker-signing-keys-root-v1\n") || CanonicalJSONV1({count:3,merkle_root}))`. +For the fixed three leaves `L0,L1,L2`, odd-node handling is literal duplication: +`N01=node(L0,L1)`, `N22=node(L2,L2)`, and `merkle_root=node(N01,N22)`; promotion or a sentinel leaf +is invalid. +No preflight-selected or merely root-claiming key is admissible. + +Cardinality, order, numeric account ID, login, verification mode, fingerprint, canonical bytes, +and digest are all security boundaries. A login rename, numeric-ID mismatch, missing required +fingerprint, reordered role, duplicate identity, or cross-registry lookup fails closed. Neither +registry, its members, signatures, approvals, statements, envelopes, tags, nor roots may substitute +for the other. + +### 6.6 Frozen workflow inventory + +The C0 workflow endpoint policy includes strict `MainFallbackLivenessPolicyV1` with exactly +`schema_version`, `repository_id`, `protected_ref: "refs/heads/main"`, `required_check_name`, +`workflow_root`, `member_paths`, and `main_fallback_liveness_policy_sha256`; member paths are the +exact ordered 15-member inventory. Its digest is SHA-256 of +`UTF8("laconian-main-fallback-liveness-policy-v1\n") || CanonicalJSONV1(policy without exactly +main_fallback_liveness_policy_sha256)`. The input registry and campaign registry bind it, and +main ruleset/admission receipts bind the exact required check and policy digest. + +The protocol freezes this exact 15-member workflow path inventory, in this literal UTF-8 byte +order: + +```text +.github/workflows/audit-pr-validate.yml +.github/workflows/benchmark-analysis.yml +.github/workflows/benchmark-audit.yml +.github/workflows/benchmark-batch.yml +.github/workflows/benchmark-collect-complete.yml +.github/workflows/benchmark-dismiss-hold.yml +.github/workflows/benchmark-docs-validate.yml +.github/workflows/benchmark-evidence.yml +.github/workflows/benchmark-finalize-invalid.yml +.github/workflows/benchmark-hard-score.yml +.github/workflows/benchmark-preflight.yml +.github/workflows/benchmark-publication-state.yml +.github/workflows/benchmark-publish.yml +.github/workflows/benchmark-release.yml +.github/workflows/publication-pr-validate.yml +``` + +Only these member paths and their order are source constants. C0 is the fully verified peeled +commit of the protected input tag used as the campaign code/input authority. For each path, the +member SHA-256 is derived from the exact bytes read from that verified C0 tree; no member hash is a +source constant. +`WorkflowInventoryV1` has exactly `schema_version`, `members`, and `workflow_root`. `members` is +the exact ordered 15-element array above; each member has exactly `path` and `sha256`. +`workflow_root` is exactly +`SHA256(UTF8("laconian-workflow-inventory-v1\n") || CanonicalJSONV1(inventory without exactly +workflow_root))`. The inventory rejects a +missing, extra, renamed, reordered, duplicated, nonregular, or byte-mismatched member. The root is +therefore derived only after C0 and all 15 member bytes have been verified; it is never accepted +from an input field without reconstruction. + +All three protocol-review statements, verified envelopes, the bundle, the post-tag binding, the +generation-context expectation and final generation context, every provider projection, and +publication verification bind this same reconstructed +`workflow_root`. A different workflow subset, reordered inventory, or independently supplied root +cannot authorize a live stage or publication. + +## 7. Execution architecture + +### 7.1 Input tag, preflight, and generation-context expectation + +The operator supplies the completed protected pair T0/T1 from section 6.5. Both are annotated-only; +T0 peels to the exact C0 to execute and T1 peels to the exact B0 that closes the serial review DAG. +The manually dispatched workflow rejects branch refs, lightweight or nested tags, moving aliases, +malformed or unpaired names, uncommitted manifests, arbitrary model input, and arbitrary shell +input. + +A secret-free preflight: + +1. reads both full refs and records their exact object OIDs before accepting any campaign data; +2. downloads the exact section 6.5 campaign object closure, verifies every raw object against both + its Git SHA-1 OID and `GitObjectSHA256V1`, reconstructs every tree and exact delta, and rejects a + missing, extra, substituted, malformed, or unreachable object; +3. verifies T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 topology, fixed paths, canonical statements, + envelopes, bundle, role order, subject roots, REST and GraphQL signature receipts, and required + local keyed-signature checks; +4. reads both refs again and requires byte-identical ref/OID pairs, reconstructs the closed stable + `TagRulesetPolicyV1`, verifies fresh current-read receipts and the two unique historical + `TagCreationRuleSuiteReceiptV1` records with exact authorized creation bypasses, and constructs + `ProtocolAttestationTagBindingV1`; any movement, deletion/recreation, suite replay/ambiguity, + creation race, peel change, wrong creator/after-OID, unauthorized creation or update/delete + bypass, or semantic policy mismatch discards the candidate preflight; +5. validates the three static manifests and all captured C0-only inputs; +6. constructs the canonical `CampaignRegistryV1`, derives `campaign_id` from + `campaign_registry_sha256`, and uses that digest as the common downstream campaign binding; +7. materializes one 480-row parent plan for each model and one ordered campaign-plan index; +8. deterministically projects 36 immutable model/scenario shard plans; +9. verifies that the shard plans are disjoint and that their ordered union is exactly the 1,440 + parent rows, with no gap or duplicate; +10. calculates planned call and token exposure; +11. binds the dated price snapshot, calculation rules, and official source URLs; +12. calculates projected campaign and worst-batch reservations and verifies that the first batch + can start under the fixed budget policy; and +13. publishes only a preflight summary, registry digest, and safe verification receipts for + environment review. + +Before `PREFLIGHT_SEALED`, missing or temporarily unavailable refs, Git objects, REST/GraphQL +responses, or ruleset reads produce a safe no-launch result: they create no campaign authority, +state transition, reservation, provider dispatch, or external write, and the unchanged candidate +may be checked again. A proven mismatch, malformed object, or drift also produces no launch; it +cannot be waived or repaired under the same pair. After `PREFLIGHT_SEALED`, a transient read +failure produces no new state and no external effect, while proven deletion, ref movement, +raw-object mismatch, topology substitution, reviewer/signature mismatch, ruleset drift, or +cross-campaign replay emits the phase-authorized `PERMANENT_STOP` and forbids further live work. +A STOPped pair is never resumed by restoring a ref; continuation requires a new pair and campaign +identity. + +No provider credential is available during preflight. The workflow does not scrape provider +pricing as a security or correctness boundary. Before approving a live batch, the environment +reviewer checks the frozen source URLs against the committed snapshot and records an attestation. +If the current rate cannot be verified or differs, the reviewer does not approve; revised rates +require a new input tag and campaign identity. + +After the generation layer is final and before hard scoring, the campaign authority constructs an +authority-bound `GenerationContextExpectationV1`. It binds the campaign ID, +`campaign_registry_sha256`, both reviewer-registry digests, `protocol_attestations_root`, the exact +predecessor campaign-authority root, the complete generation-layer root, the expected digest of the +canonical generation-context payload, and the common `workflow_root`. The canonical payload +carries the tagged hard-scorer source hash, hard-score protocol hash, judge protocol hash, +statistical protocol hash, audit protocol hash, provider-projection root, and every generation +capsule root. Those bindings are retained unchanged in hard-score attachments, judge projections, +provider-evidence inventory, analysis, and publication evidence. + +The `GENERATION_SET_SEALED` event and resulting `GENERATION_COMPLETE` authority record contain the +required fields `generation_context_expectation_sha256` and +`verified_generation_context_root` in addition to the 36 ordered capsule hashes. To avoid a hash +self-cycle, the expected context digest is computed over the canonical context payload without the +expectation-link field; the expectation then binds that expected digest, and the final authority +record binds both the reconstructed context root and the separately computed expectation digest. +Verification requires both values to match their independently reconstructed objects. + +This authority is a non-serializable campaign capability. Only campaign-side reconstruction of the +predecessor authority root and final generation-layer roots may construct +`VerifiedGenerationContextExpectationV1`, and it exists only in memory for the authorized stage. +No serialized file, raw hash, identifier, CLI or workflow input, environment value, or nested +provider-index field creates, carries, or confers this capability. A caller that merely supplies +the correct bytes or digest remains unauthorized. + +### 7.2 Logical shards and bounded batch controller + +Generation uses 36 logical capsules: `3 models x 12 scenarios`. A capsule keeps both languages, +all four arms, and all five repetitions together, for 40 planned responses. This preserves matched +data and bounds the loss from a failed checkpoint independently of the number of capsules handled +by one provider job. + +`ShardPlanV1` binds campaign ID, model ID, scenario UID, parent-manifest hash, parent-plan hash, +derivation-version, ordered request identities, row count, and its own hash. A capsule is prepared +from this captured projection; selective execution from an unmodified full manifest is forbidden. +Aggregation binds the ordered set of all 36 generation-capsule hashes, and no pair crosses capsule +or run identity. + +GitHub applies environment protection to each job, not once to an entire campaign. The workflow +therefore uses a resumable bounded batch controller rather than 36 generation plus 36 judge +environment jobs. Each manual `workflow_dispatch` or resume uses four pairwise +credential-separated roles/jobs: + +1. a secret-free batch-prepare job that imports the exact campaign registry, predecessor ledger, + checkpoint inventory, and immutable ordered plan and deterministically constructs one + `BatchPlanV1` for a contiguous prefix of remaining work; +2. one protected, repository-read-only `benchmark-live` provider job, whose single controller step + consumes the won receipt and plan sequentially with provider parallelism exactly one; +3. a key-free receipt/state-writer job whose fixed minimal reusable state-writer boundary invokes + the broker-held state-writer GitHub App to compare-and-swap the exact reservation receipt and + authority predecessor; +4. a key-free post/state-writer job that validates and uploads every completed or partial logical + capsule and append-only attempt journal, then invokes that same broker-held App through the fixed + minimal reusable boundary to compare-and-swap the successor ledger and authority state. + +Dependency edges, a bounded wait before the controller step, and single-use handoff receipts ensure +the provider controller cannot begin until the receipt/state writer's expected-OID compare-and-swap +has won. The repository `GITHUB_TOKEN` is read-only in all four jobs. + +`BatchPlanV1` binds campaign ID, `campaign_registry_sha256`, phase (`generation` or `judge`), both +tag object OIDs and raw-object SHA-256 values, peeled C0 and B0 object bindings, workflow-file hash, +predecessor-ledger hash, ordered shard and request identities, maximum request attempts, worst-case +reservation, price-snapshot hash, monotonic-time allowance, soft deadline, and its own hash. The +plan size is a deterministic function of the remaining authorized exposure, +remaining ordered work, and frozen call/time bounds; it cannot be enlarged after approval. The +key-free receipt/state writer finalizes the reservation receipt with the exact `workflow_run_id`, +`run_attempt`, `job_id`, and `batch_attempt_id`; the protected provider job accepts only the +corresponding CAS-winner receipt. Only its single hash-verified provider-controller step may map +`OPENAI_API_KEY`, and only after that receipt is verified. + +The controller may cross logical shard boundaries, but it never reorders requests or begins an +item outside the frozen batch. It seals and checkpoints at every logical shard boundary and also +uploads a verified partial checkpoint before a voluntary soft-deadline exit. Ordinary terminal +provider rejections remain evidence and do not stop later items; a campaign STOP condition does. +Every provider-call boundary verifies the exact current ledger and STOP state. + +The execution contract also uses: + +- one repository-wide state-mutation concurrency group and `cancel-in-progress: false` across live + batches, state sealing, collection, publication, and release finalization; +- a three-hour hard job timeout plus the runner soft deadline in section 8; +- `contents: read` and only the additional read permission needed to retrieve exact artifacts; +- checkout of preflight-recorded detached C0 without persisted credentials, followed before each + credential-bearing step by a fresh double-read of both exact refs and verification of the sealed + `campaign_registry_sha256`, T0/C0 and T1/B0 object bindings, stable ruleset policy root with fresh + observation receipts, and no-drift + condition; and +- timestamps for every provider attempt. + +One environment approval authorizes only that exact bounded batch, not the whole campaign. A resume +is a new batch and requires another approval; the number of approvals is therefore the number of +generation and judge batches actually needed. This limitation is disclosed in the operator runbook +instead of implying that GitHub offers a workflow-wide approval. + +### 7.3 Checkpoints and resume + +Each shard checkpoint is an uncompressed tar archive rather than a direct directory upload. The +archive retains `.laconian.lock`, file modes, exact relative paths, and the complete append-only +capsule. It has a SHA-256 sidecar and a unique name containing campaign, model, scenario, batch, +and run-attempt identity. + +Before credentials become available on resume, the job: + +1. selects the exact artifact ID from the exact workflow-run ID, run attempt, both tag-object + bindings, peeled C0/B0 bindings, `campaign_registry_sha256`, workflow-file hash, environment + deployment, batch-attempt ID, and upload service digest; latest-by-name lookup is forbidden; +2. enforces archive byte size, member count, per-file, aggregate, path-depth, and time bounds; +3. rejects PAX/GNU sparse records, absolute paths, backslashes, NUL, non-NFC or empty components, + `.`/`..`, links, devices, FIFOs, duplicate normalized paths, and unexpected members; +4. extracts in one fd-relative pass into a new `0700` directory with no-follow/exclusive-create + semantics, fsyncs it, and atomically publishes it; generic `tar -xf` and `extractall` are + forbidden; +5. runs full capsule verification; and +6. compares the manifest, plan, protocol, model, and shard hashes with the preflight registry. + +Resume never changes existing plan identities or releases uncertain exposure. It creates a new +bounded `BatchPlanV1` only for the exact remaining suffix. `AMBIGUOUS_INFLIGHT` is not automatically +continued. A missing checkpoint after runner loss also cannot be silently recreated under the same +attempt identity. The operator must preserve the failed attempt and use the documented invalidation +or explicit new-attempt flow. + +### 7.4 Normative campaign state machine + +`CampaignStateV1` is the only dispatcher authority. Each canonical record contains schema version, +campaign ID, monotonically increasing transition number, current state, previous-state hash, +triggering `CampaignEventV1` type and hash, `campaign_registry_sha256`, both tag-object bindings, +peeled C0/B0 bindings, active phase-plan hash, spend-ledger hash, artifact-inventory Merkle root, +`unresolved_hold_root`, `active_credential_exposure_incident_id`, +`active_credential_exposure_pending_root`, optional STOP/incident ID, exact workflow/job or reviewer identities, +nonnull `publication_merge_denylist_root_sha256`, nullable +`active_publication_terminal_containment_root`, +`state_writer_git_identity_sha256`, and its own hash. Every event is single-use and parent-bound. +Authority genesis stores the complete `CampaignRegistryV1` and +`ProtocolAttestationTagBindingV1`; every successor event must reproduce their digests unchanged. +Every phase plan, reservation, ledger, capsule, hard-score set, judge projection, audit packet, +analysis attachment, evidence inventory, bundle, publication/correction intent and receipt, merge +evidence, result tag, release asset, and replay registry binds the same +`campaign_registry_sha256`. Supplying component hashes without that common registry digest confers +no authority. +Every state or hold mutation runs under the repository-wide concurrency group and performs a +compare-and-swap against the exact last valid state, unresolved-hold root, and active pending root. +The two active exposure fields are both null or both nonnull. An ordinary successor must reproduce +both null; only the exposure events below may install, advance, consume, or clear them. +Preflight installs the canonical empty `PublicationMergeDenylistV1` root. Every ordinary successor +byte-preserves both publication-containment fields. Only +`PUBLICATION_TERMINAL_CONTAINMENT_STARTED` may advance the denylist root and set a previously null +active containment root; only its exact premerge or merge-won terminal consumer may clear that +active root, and no event ever removes a denylist entry. Containment start requires the exposure +pair either null or already terminal-ready with its exact pending record and every inventoried +effect receipt complete. No exposure pending/progress event and no invalid-event hold may be +installed while the containment root is nonnull. The eventual terminal consumer binds and clears +an already-active terminal-ready exposure pair atomically while preserving the denylist forever. +A newly detected exposure after containment start denies further broker dispatch, leaves the +active containment root and denylist intact, and requires external credential revocation/rotation +before the same evidence-preserving containment run can resume; it cannot mutate the immutable +pre-containment route or silently create a second campaign root. + +For every containment schema in this document, **full containment publication identity** expands +in place, in this exact order, to `campaign_id`, `campaign_registry_sha256`, `publication_id`, +nullable `publication_attempt`, nullable `correction_id`, `bundle_kind`, +`publication_plan_sha256`, `authorizing_intent_sha256`, `repository_id`, `parent_state`, +`source_authority_parent_oid`, `authority_phase`, `branch_name`, `expected_base_oid`, +`expected_head_oid`, `pull_request_marker`, and `publication_head_commit_trailer`. Initial +publication has a positive attempt and null correction; correction has a null attempt and a +nonempty correction ID. `source_authority_parent_oid` is the parent reconstructed before the +containment CAS. It is never aliased to the accepted containment successor or to a later terminal +event parent. + +`PUBLICATION_TERMINAL_CONTAINMENT_STARTED` is a nonterminal same-state, transition-plus-one +`CampaignEventV1` accepted only by expected-OID CAS. It has exactly `schema_version`, the full +containment publication identity, `event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED"`, positive +`parent_transition_number`, nested exact +`terminal_containment_intent: PublicationTerminalContainmentIntentV1`, +`terminal_containment_intent_sha256`, `predecessor_merge_denylist_root_sha256`, nested exact +`successor_merge_denylist: PublicationMergeDenylistV1`, +`successor_merge_denylist_root_sha256`, `publisher_broker_phase="terminalizing"`, +`publisher_broker_phase_ledger_prefix: +PublisherBrokerPhaseLedgerPrefixV1(prefix_purpose="containment_start")`, +`publisher_broker_phase_ledger_prefix_sha256`, nested exact +`publisher_vault_audit_prefix: BrokerVaultAuditPrefixV1(prefix_purpose="containment_start")`, +`publisher_vault_audit_prefix_sha256`, +`outstanding_token_request_count=0`, `outstanding_operation_dispatch_count=0`, +`live_token_count=0`, +`constructive_mint_disabled=true`, `source_workflow="benchmark-publish.yml"`, +`source_job="publication_terminalizer"`, +`source_workflow_sha256`, `source_ref_class="protected_current_main"`, `occurred_at`, and +`campaign_event_sha256`. The accepted mutation atomically appends the intent and successor denylist, +advances authority, preserves the state name, and sets the active root to the intent digest. It is +allowed only for an active initial complete/invalid publication prefix or a correction publication +prefix; write ambiguity remains allowed when preflight already observed one merged candidate so the +unresolved remainder is still tombstoned. The hold root is null at start; the exposure pair may be +null or may be the exact already-active, fully inventoried, terminal-ready pair named by the route +and consumed by the terminal event. No exposure event may advance it after start. The signed +phase-ledger/vault prefixes recompute the monotone terminalizing transition, every closed request and +zero live tokens; the counts are not free assertions. While the active root is nonnull, every +constructive token, enqueue/merge admission, release authorization, new publication/correction +intent and unrelated successor is denied. Only post-CAS barrier work, exact merge-won +classification, or the event-type pair named by the intent may proceed. Crash recovery resumes from +this root. The terminal consumer's immediate parent is the containment authority OID or a preserving +descendant; the original source parent is checked separately through the intent, never incorrectly +required to equal the final event parent. +The two nested containment-start prefixes have byte-identical publication/scope identity and +purpose; the vault prefix's paired-ledger digest equals the nested ledger-prefix digest, every +duplicated root/count/time recomputes, and the event's three zero counts equal both prefixes. +Source workflow SHA is the frozen C0 member and workflow/job/ref fields byte-equal the exact +caller-policy row. + +Only a request that has already passed authenticated exact-repository/run/campaign, OIDC/App, +caller/callee, transport, and sealed-registry checks is hold-worthy. If that request then fails +event schema, parent, hash, required evidence, or a literal allowed-edge check, the broker uses the +existing state-writer authority to append internal `INVALID_EVENT_HELD` by expected-OID CAS. Pre-auth +garbage, temporary reads, wrong repository/run/campaign, and a verified benign sibling/stale CAS +request receive only an append-only broker audit denial and cannot create a campaign hold. + +`InvalidEventHoldV1` has exactly `schema_version`, `campaign_id`, `hold_id`, +`rejected_request_sha256`, `parent_authority_oid`, `parent_state`, `parent_transition_number`, +`current_state_root`, `spend_ledger_root`, `artifact_inventory_root`, `active_phase_plan_root`, +`source_workflow`, `source_actor_id`, `source_actor_login`, `failed_validation`, `held_at`, and +`invalid_event_hold_sha256`, using `laconian-invalid-event-hold-v1`. The broker appends exact +`holds//hold.json`; the state name is unchanged, transition number advances, and +`unresolved_hold_root` becomes that hold root. At most one unresolved hold exists. A racing later +request is audit-denied without another state transition. Every entrypoint blocks provider +dispatch, artifact download, and ordinary external effects while the root is nonnull. +The hold digest is SHA-256 of `UTF8("laconian-invalid-event-hold-v1\n") || +CanonicalJSONV1(hold without exactly invalid_event_hold_sha256)`. +The generated liveness schema permits a broker-owned hold only in states and reconstructed +authority phases with at least one legal hold-consuming edge: every prepublication state listed in +the ordinary STOP table except `COMPLETE_PUBLICATION_PR_OPEN`, `BUNDLE_COLLECTED` only when it has +no active initial-publication prefix, `RESULT_MERGED`, and bare `RELEASED`. Any active initial- +publication prefix, `COMPLETE_PUBLICATION_PR_OPEN`, or `RELEASED`/`RELEASE_BLOCKED` tree with a +nonterminal correction `intent`, publication, merge, tag, or release prefix is ineligible; a state- +name-only check is forbidden. Because every publication intent requires a null hold, no initial PR +can exist while a hold is current. The schema forbids holds in +budget/invalid-finalization/publication and other terminal states. The rejected external request +never becomes an event; only the broker-authored `INVALID_EVENT_HELD` request/event/commit mutates +authority. + +The versioned `CampaignStateSchemaV1` canonical state/event schema is the single source of truth +for state names, event names, allowed parent-state and bundle-kind combinations, required evidence, +and terminality. The table below is a generated human-readable rendering of that schema, and tests +load the same schema rather than maintaining a second transition list. Any table/schema drift, +unknown enum value, or event whose evidence discriminator does not match its parent is rejected. +The same source generates a reachability/liveness matrix over every state, event, caller workflow, +trigger-ref rule, reason/evidence discriminator, and terminal/resumption outcome. Broker policy and +tests consume that matrix; every admitted event must be reachable, every nonterminal state must have +an authorized success, invalidation, STOP, or correction continuation, and no table-only or +broker-only edge is permitted. +For `GENERATION_SET_SEALED`, the schema's exact required-evidence set is the ordered 36 capsule +hashes, `generation_context_expectation_sha256`, and `verified_generation_context_root`; neither +root is optional, derivable after the transition, or replaceable by a raw context payload. + +The closed `PERMANENT_STOP.reason` enum is exactly, in schema order: + +```text +provider_authentication_failure +provider_permission_failure +provider_delivery_ambiguity +provider_contract_mismatch +reservation_ledger_mismatch +batch_identity_mismatch +artifact_integrity_failure +generation_context_integrity_failure +hard_score_integrity_failure +provider_evidence_incomplete +audit_identity_failure +audit_nonparticipation +audit_reveal_failure +audit_adjudication_failure +analysis_statistical_failure +analysis_provenance_failure +analysis_integrity_failure +bundle_coverage_failure +bundle_lineage_failure +publication_lineage_failure +publication_reconciliation_unavailable +invalid_event_nondismissible +credential_exposure +protocol_authority_drift +``` + +No category name, alias, unknown reason, or wildcard is accepted. `OrdinaryStopEvidenceV1` is a +strict discriminated union for the first 22 reasons. Every variant has exactly `schema_version`, +`campaign_id`, `reason`, `parent_state`, `parent_authority_oid`, `current_state_root`, +`spend_ledger_root`, `artifact_inventory_root`, `active_phase_plan_root`, +`unresolved_hold_root`, `source_records_root`, `detail`, `observed_at`, and +`ordinary_stop_evidence_sha256`. The digest excludes itself and uses +`laconian-ordinary-stop-evidence-v1`. `detail` is itself strict: provider reasons contain +`provider_id`, `attempt_id`, `request_root`, and the applicable authentication, permission, +delivery, or contract receipt root; reservation/batch reasons contain `batch_plan_sha256`, +`reservation_root`, and `ledger_reconciliation_root`; artifact/generation/hard-score/provider- +evidence reasons contain `failed_artifact_root`, `expected_root`, and `verification_root`; audit +reasons contain `audit_packet_root`, `reviewer_or_reveal_root`, and `adjudication_root`; analysis +reasons contain `analysis_plan_root`, `statistical_or_provenance_root`, and `verification_root`; +bundle reasons contain `bundle_root`, `expected_inventory_root`, and `coverage_or_lineage_root`; +`publication_lineage_failure` contains `publication_plan_root`, `branch_pr_root`, +`lineage_verification_root`, and nullable `publication_pr_terminal_disposition_sha256`; and +`publication_reconciliation_unavailable` contains `publication_plan_root`, +`publisher_credential_disposition_set_sha256`, `reconciliation_unavailable_receipt_sha256`, and +nullable `publication_pr_terminal_disposition_sha256`; and +`invalid_event_nondismissible` contains `hold_id`, +`hold_sha256`, and `nondismissibility_evidence_root`. Fields belonging to another variant are +forbidden. `source_records_root` is the ordered Merkle root of the named, already sealed records; +empty, duplicate, reordered, or unbound records fail validation. + +The last root above is not opaque. `InvalidEventNondismissibilityEvidenceV1` has exactly +`schema_version`, `campaign_id`, `campaign_registry_sha256`, `parent_state`, +`parent_authority_oid`, `hold_id`, `hold_sha256`, `rejected_request_sha256`, ordered nonempty +`failed_validation`, `source_records_root`, `observed_at`, and +`nondismissibility_evidence_sha256`. It reproduces the accepted `InvalidEventHoldV1` request, +validation set and current hold identity; its domain is +`laconian-invalid-event-nondismissibility-evidence-v1\n`, omitting only its final digest. The +ordinary STOP detail's `nondismissibility_evidence_root` must equal this exact digest. + +The reason-to-`detail` mapping is literal: the four provider variants use exactly +`provider_id,attempt_id,request_root,failure_receipt_root`; reservation uses +`batch_plan_sha256,reservation_root,ledger_reconciliation_root`; batch identity uses +`batch_plan_sha256,reservation_root,batch_identity_verification_root`; artifact uses +`failed_artifact_root,expected_root,verification_root`; generation-context uses +`generation_context_expectation_sha256,observed_context_root,verification_root`; hard-score uses +`hard_score_plan_root,observed_hard_score_root,verification_root`; provider-evidence uses +`evidence_inventory_root,expected_inventory_root,verification_root`; all four audit variants use +`audit_packet_root,reviewer_or_reveal_root,adjudication_root`; all three analysis variants use +`analysis_plan_root,statistical_or_provenance_root,verification_root`; both bundle variants use +`bundle_root,expected_inventory_root,coverage_or_lineage_root`; publication uses +`publication_plan_root,branch_pr_root,lineage_verification_root, +publication_pr_terminal_disposition_sha256`; publication reconciliation unavailable uses exactly +`publication_plan_root,publisher_credential_disposition_set_sha256, +reconciliation_unavailable_receipt_sha256,publication_pr_terminal_disposition_sha256`; and +nondismissible hold uses +`hold_id,hold_sha256,nondismissibility_evidence_root`. Each comma-separated list is the complete +field set for that discriminator; no shared optional or alternate detail field exists. + +Every absence/close/merge terminalization of an initial or correction publication segment before a +valid admitted merge uses one strict phase-aware terminal-disposition record rather than guessing a +platform-assigned PR number or treating state name as effect phase. +`PublicationPRTerminalDispositionV1` has exactly these ordered fields: + +```text +schema_version +campaign_id +campaign_registry_sha256 +publication_id +publication_attempt +correction_id +bundle_kind +publication_plan_sha256 +authorizing_intent_sha256 +parent_state +authority_parent_oid +authority_phase +branch_receipt_sha256 +pull_request_receipt_sha256 +branch_name +expected_base_oid +expected_head_oid +branch_create_delivery_resolution_sha256 +pull_request_marker +pull_request_number +pull_request_node_id +pull_request_url +observed_base_oid +observed_head_oid +observed_merge_oid +pr_marker_discovery_sha256 +pr_create_delivery_resolution_sha256 +identity_mismatch_predicates +outcome +branch_outcome +close_kind +close_delivery_resolution_sha256 +close_receipt_sha256 +closed_observation_sha256 +terminal_guard_set_sha256 +recorded_at +publication_pr_terminal_disposition_sha256 +``` + +The two close-evidence hashes above are class-bound. `PublicationCloseReceiptV1` has exactly +`schema_version="PublicationCloseReceiptV1"`, `campaign_id`, `campaign_registry_sha256`, +`publication_id`, nullable `publication_attempt`, nullable `correction_id`, `bundle_kind`, +`publication_plan_sha256`, `authorizing_intent_sha256`, `pull_request_number`, +`pull_request_node_id`, `pull_request_url`, `base_oid`, `head_oid`, +`close_idempotency_key`, `operation="publisher_closed"|"publisher_close_adopted"`, +`actor: GitHubAppInstallationIdentityV1(role="publisher")`, +`publisher_credential_disposition_sha256`, `request_receipts_root_sha256`, `closed_at`, and +`close_receipt_sha256`. Initial and correction +attempt nullability follows the enclosing disposition. Its domain is +`laconian-publication-close-receipt-v1\n`, omitting only `close_receipt_sha256`. + +`PublicationClosedObservationV1` has exactly +`schema_version="PublicationClosedObservationV1"`, the same campaign/registry/publication/ +attempt/correction/bundle/plan/intent and PR identity fields, `observed_state="closed"`, +`observed_merged=false`, nullable `observed_merge_oid` fixed to null, `closed_at`, +`first_read_receipt_sha256`, `second_read_receipt_sha256`, `observed_at`, and +`closed_observation_sha256`. Both authenticated reads bind the same exact PR as closed and unmerged +on either side of the close/discovery work immediately before candidate construction; a later +reopen neither rewrites the accepted terminal history nor can escape the permanent denylist: the +fresh Actions validator re-reads that root and fails the PR-head/merge-group required check. The +publisher terminal guard itself remains distinct protocol evidence. Its domain is +`laconian-publication-closed-observation-v1\n`, omitting only `closed_observation_sha256`. Both +records use RFC 8785 JSON, canonical whole-second UTC, exact identity equality, and no raw response +or credential bytes. + +`PublicationPRStateObservationV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent and PR identity, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/pulls/{pull_request_number}"`, +`state="open"|"closed"`, `merged`, nullable `merge_oid`, `base_oid`, `head_oid`, nullable +`closed_at`, nullable `merged_at`, `raw_response_sha256`, `canonical_response_sha256`, +`request_receipt_sha256`, `observed_at`, and `pr_state_observation_sha256`. Its state/merged/time +tuple must be GitHub-consistent and actor/base/head/marker identity is revalidated from the same +authenticated projection. Its domain is `laconian-publication-pr-state-observation-v1\n`, omitting +only its final digest. + +`PublicationPRCloseDeliveryResolutionV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent and PR identity, `close_idempotency_key`, nested +exact `pre_dispatch_pr_observation: PublicationPRStateObservationV1`, ordered `attempts`, nested +exact `first_final_pr_observation: PublicationPRStateObservationV1`, nested exact +`second_final_pr_observation: PublicationPRStateObservationV1`, +`resolution=already_closed_no_dispatch|publisher_close_confirmed|publisher_close_adopted| +merge_won`, `final_state="closed"|"merged"`, nullable `final_merge_oid`, +nullable `prior_close_receipt_sha256`, +`publisher_credential_disposition_sha256`, `delivery_ambiguity=false`, `recorded_at`, and +`close_delivery_resolution_sha256`. Each attempt has +exactly positive `ordinal`, `request_id`, `dispatch_state="not_dispatched"|"dispatched"`, `method="PATCH"`, +`endpoint_template="/repos/{owner}/{repo}/pulls/{pull_request_number}"`, +`request_payload_sha256`, `outcome=not_dispatched|definitely_rejected_no_side_effect|closed_200| +non_2xx_resolved_closed|merge_won`, nullable `response_status`, +nullable `safe_response_sha256`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, and `transport_receipt_sha256`. The +nested receipt is operation `pull_request_close`, attempt kind `pr_close`, has the same ordinal and +recomputed digest, and every duplicated field byte-equals this attempt. Confirmed close requires 200; +definite rejection permits only 400, 401, 403, or 404 plus safe proof; non-2xx resolved close permits +only 409 or 422 plus the final reads; response-loss has null status. Timeout, 5xx, 202, inconsistent +reads, or an unclassified transport leaves ambiguity and cannot be sealed. +Non-dispatch requires only `outcome=not_dispatched` with null response fields; dispatch requires +another outcome. Safe response is nonnull only for definite rejection. + +`already_closed_no_dispatch` requires the authenticated pre-read already closed/unmerged and every +attempt non-dispatched. Any possibly delivered publisher close ending closed/unmerged requires +`publisher_close_confirmed|publisher_close_adopted` and a byte-matching nonnull +`PublicationCloseReceiptV1`. `merge_won` preserves the authenticated merge; its prior-close receipt +is nonnull exactly when a close write was confirmed or reconciled before reopen/merge, and otherwise +null. The two final reads have equal stable PR-state projections after excluding request/receipt/ +observation time fields; their request IDs are distinct, the first completes before the second +dispatch, and `recorded_at` equals the second authenticated source time. +Its domain is `laconian-publication-pr-close-delivery-resolution-v1\n`, omitting only its final +digest. Thus a lost close response cannot be relabeled as a pre-existing close. + +`PublicationPRMarkerPageReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, `repository_id`, `operation_kind="pull_request_create"| +"terminal_guard_discovery"|"pull_request_close"|"terminal_merge_barrier_read"| +"terminal_reconciliation_read"`, +`operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `operation_request_ordinal`, +`publisher_credential_subject_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, `observation_round=1|2`, +nullable positive `operation_round_ordinal`, nullable +`observation_stage="pre"|"post"|"final"|"containment_preflight"| +"containment_pre_action"|"containment_first"|"containment_second"`, +positive `page_ordinal`, `query_template`, `request_url`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `transport_terminal_at`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="publisher_app_installation_token_vault"`, `response_status=200`, nullable +`previous_link`, nullable `next_link`, ordered nested exact `pull_requests`, +`raw_response_sha256`, `canonical_response_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `pr_marker_page_receipt_sha256`. Each pull-request member has +exactly positive `number`, nonblank `node_id`, exact ASCII HTTPS `url`, positive `actor_id`, +`actor_login`, `base_oid`, `head_oid`, `state="open"|"closed"`, `merged`, nullable `merge_oid`, +nullable `closed_at`, nullable `merged_at`, `pull_request_marker`, and +`canonical_member_sha256`; fields are total projections of each response-array member in API +order. Raw/canonical/member hashes use the exact same rules as check pages. Identity, App, +credential, operation key, page, request/status and times byte-equal the generic publisher +transport wrapper; page `observation_round`, operation round and stage byte-equal the wrapper and +follow the closed matrix. The wrapper's `source_observation_sha256` equals this page +digest; the page does not +contain that wrapper digest, so the graph is acyclic. The signature and record domains are +`laconian-publication-pr-marker-page-signature-v1\n` and +`laconian-publication-pr-marker-page-receipt-v1\n`. Its signature preimage is +`UTF8(signature domain) || CanonicalJSONV1(record without exactly broker_signature_base64url and +pr_marker_page_receipt_sha256)`; its record digest is `SHA256(UTF8(record domain) || +CanonicalJSONV1(record without exactly pr_marker_page_receipt_sha256))`, including the verified +signature. The signing-key validity window includes `transport_terminal_at`. + +`PublicationPRMarkerArchiveV1` has exactly `schema_version`, the same publication/operation/ +credential identity, nullable positive `operation_round_ordinal`, nullable +`observation_stage="pre"|"post"|"final"|"containment_preflight"| +"containment_pre_action"|"containment_first"|"containment_second"`, ordered `blobs`, ordered `page_bindings`, and +`pr_marker_archive_sha256`. Each blob has exactly `path`, `sha256`, and `raw_bytes_base64`; each +binding has exactly `observation_round=1|2`, positive gapless `page_ordinal`, +`page_receipt_sha256`, and `raw_blob_path`. Bindings are all round-one pages followed by all +round-two pages. The blob array has the identical positional order, decoded bytes reproduce the +page raw-body hash, and paths are exactly +`publication-pr-marker/.response`; pages, bindings and blobs form a bijection. +Its domain is `laconian-publication-pr-marker-archive-v1\n`, omitting only its final digest. + +`PublicationPRMarkerObservationV1` is one complete authenticated round. It has exactly +`schema_version`, the same publication/repository/marker/head/base/expected-OID/query identity, +`operation_kind`, `operation_idempotency_key`, positive `credential_attempt_ordinal`, nullable +positive `operation_round_ordinal`, nullable `observation_stage="pre"|"post"|"final"| +"containment_preflight"|"containment_pre_action"|"containment_first"|"containment_second"`, +`observation_round=1|2`, positive `page_count`, ordered nested exact +`pages: PublicationPRMarkerPageReceiptV1` all with that round, nested exact +`archive: PublicationPRMarkerArchiveV1`, `pr_marker_archive_sha256`, +`pagination_complete=true`, ordered `matching_pull_requests`, `observed_at`, and +`marker_observation_sha256`. Page ordinals are gapless, signed Links are complete, and archive +bindings/blobs contain exactly this round. Matches are the canonical number-ordered exact-marker +projection across all page members. `observed_at` equals the maximum page +`response_completed_at`. Its domain is `laconian-publication-pr-marker-observation-v1\n`, omitting +only its final digest. + +`PublicationPRMarkerDiscoveryV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, `repository_id`, `pull_request_marker`, `head_owner_login`, `head_branch_name`, +`base_branch_name`, `expected_base_oid`, `expected_head_oid`, +`query_template="GET /repos/{owner}/{repo}/pulls?state=all&head={head_owner_login}:{head_branch_name}&base={base_branch_name}&per_page=100"`, +`first_observation: PublicationPRMarkerObservationV1(observation_round=1)`, +`second_observation: PublicationPRMarkerObservationV1(observation_round=2)`, +ordered `matching_pull_requests`, `observed_at`, and `marker_discovery_sha256`. Each match has +exactly positive `number`, nonblank `node_id`, exact ASCII HTTPS `url`, `actor_id`, `actor_login`, +`base_oid`, `head_oid`, `state=open|closed`, `merged`, nullable `merge_oid`, nullable `closed_at`, +and nullable `merged_at`; the state/merged/nullability tuple must be GitHub-consistent. From a list +response, `merged` is derived exactly as `merged_at != null`, and `merge_oid` equals GitHub's +`merge_commit_sha` exactly when merged and is null otherwise; no nonexistent direct `merged` API +field is assumed. The query +parameters use branch labels, never OIDs; each returned base/head SHA is then compared separately +with the two expected OIDs. Both reads occur only after every PR-create dispatch has terminated and +no further PR-create write dispatch is authorized, fully follow authenticated `Link` pagination, +and produce the +same number-ordered projections; response-loss classifications are derived from those reads rather +than assumed before them. Every round-one wrapper terminal precedes the first round-two dispatch; +the two nested matching projections byte-equal the aggregate array, and `observed_at` equals the +second observation's authenticated time. Every page, generic wrapper and archive binding forms the +exact acyclic bijection above. Its domain is +`laconian-publication-pr-marker-discovery-v1\n`, omitting only its final digest. + +`PublicationBranchObservationV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent identity, `repository_id`, `branch_name`, +`expected_head_oid`, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/git/ref/heads/{branch_name}"`, +`status="absent"|"exact"|"conflicting"`, nullable `observed_head_oid`, `response_status`, +`raw_response_sha256`, `canonical_response_sha256`, `request_receipt_sha256`, `observed_at`, and +`branch_observation_sha256`. `absent` requires 404 and null head; `exact` requires 200 and the +expected head; `conflicting` requires 200 and a different head. Its domain is +`laconian-publication-branch-observation-v1\n`, omitting only its final digest. +For this branch record, `PublicationPRStateObservationV1`, and every later publisher non-page GET +observation, `request_receipt_sha256` means exactly the append-before-send +`PublisherOperationRequestDispatchReceiptV1.operation_request_dispatch_receipt_sha256`, never the +terminal wrapper digest. The matching `PublisherOperationTransportReceiptV1` points one-way to the +observation digest in `source_observation_sha256`; identity, operation/global ordinal, coordinates, +request, method/endpoint/payload/status and times form a bijection. No observation points back to +the terminal wrapper, so the graph is acyclic. + +`ConflictingPublicationObjectsV1` has exactly `schema_version`, the same identity, ordered +`entries`, and `conflicting_publication_objects_root_sha256`. Each entry has exactly +`object_kind="branch"|"pull_request"|"check_run"`, `object_id`, `expected_head_oid`, nullable +`observed_base_oid`, `observed_head_oid`, `observed_state`, and `source_observation_sha256`. +Entries are sorted by kind order branch, pull request, check run and then canonical object ID; every +stable differing branch, marker PR, or same-App/context check from delivery/guard reconciliation is +included exactly once. Its domain is `laconian-conflicting-publication-objects-v1\n`, omitting only +the final root; the explicit empty record is valid when there is no conflict. + +`PublicationBranchCreateDeliveryResolutionV1` has exactly `schema_version`, the same campaign/ +registry/publication/attempt/correction/bundle/plan/intent identity, `branch_idempotency_key`, +`branch_name`, `expected_head_oid`, ordered `attempts`, `first_ref_read_receipt_sha256`, +`second_ref_read_receipt_sha256`, `resolved_branch_status=absent|exact|conflicting`, nullable +`observed_head_oid`, `publisher_credential_disposition_sha256`, `delivery_ambiguity=false`, +`recorded_at`, and +`branch_create_delivery_resolution_sha256`. Each attempt has exactly positive `ordinal`, `request_id`, +`dispatch_state=not_dispatched|dispatched`, `method="POST"`, +`endpoint_template="/repos/{owner}/{repo}/git/refs"`, `request_payload_sha256`, +`outcome=not_dispatched|definitely_rejected_no_side_effect|created_exact| +response_lost_resolved_exact|response_lost_resolved_conflict|non_2xx_resolved_exact| +non_2xx_resolved_conflict`, nullable `response_status`, nullable +`safe_response_sha256`, nullable `observed_head_oid`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, and `transport_receipt_sha256`. The +nested receipt is operation/attempt kind `branch_create`, has the same ordinal and recomputed +digest, and every duplicated field byte-equals this attempt. The two final +authenticated ref reads occur only after every dispatched transport has terminated and byte-equal +one another. `absent` requires every attempt non-dispatched or definitely rejected and both reads +prove 404; `exact` requires both reads resolve the exact planned head; `conflicting` records the one +stable different head. A non-2xx resolution permits only status 409 or 422 and derives exact versus +conflicting solely from the two reads. Timeout, connection loss, 5xx, 202, or any result whose +delivery cannot be settled by the two reads leaves ambiguity and therefore cannot be sealed. +`recorded_at` equals the second authenticated read's source time. Its domain is +`laconian-publication-branch-create-delivery-resolution-v1\n`, omitting only its final digest. + +`PublicationPRCreateDeliveryResolutionV1` has exactly `schema_version`, the same campaign/ +registry/publication/attempt/correction/bundle/plan/intent identity, +`pull_request_idempotency_key`, ordered `attempts`, nested exact `final_marker_discovery`, nullable +`resolved_pull_request_number`, `resolved_status="none"|"exact"|"conflicting"`, +`publisher_credential_disposition_sha256`, `delivery_ambiguity=false`, `recorded_at`, and +`delivery_resolution_sha256`. Each attempt has exactly positive `ordinal`, `request_id`, +`dispatch_state=not_dispatched|dispatched`, `method="POST"`, +`endpoint_template="/repos/{owner}/{repo}/pulls"`, `request_payload_sha256`, +`outcome=not_dispatched|definitely_rejected_no_side_effect|created_exact| +non_2xx_resolved_exact`, nullable `response_status`, nullable `safe_response_sha256`, +nullable `resolved_pull_request_number`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, and `transport_receipt_sha256`. The +nested receipt is operation `pull_request_create`, attempt kind `pr_create`, has the same ordinal +and recomputed digest, and every duplicated field byte-equals this attempt. `not_dispatched` has all +response fields null. `definitely_rejected_no_side_effect` requires status `400`, `401`, `403`, or +`404` and a class-bound safe response proving the request could not create an object. `created_exact` +requires `201` and the exact resolved PR. `non_2xx_resolved_exact` permits +only 409 or 422 plus final discovery of that unique exact PR. Timeout, connection loss, 5xx, 202, +or any other ambiguous result cannot be labeled rejected. + +`none` requires a null top-level number, every attempt non-dispatched/definitely rejected, and zero +admissible plan-bound matches. `exact` requires a positive number and exactly one admissible +plan-bound match; additional nonadmissible matches remain conflict evidence but do not replace it. +`conflicting` is every stable fully resolved projection that is neither `none` nor `exact`. Its +number is null when no admissible match is merged; when one or more admissible matches are merged it is the +number of the deterministic selected match, sorted first by authenticated `merged_at` and then by +ascending PR number. Every other duplicate, foreign or mismatched match is preserved in +`ConflictingPublicationObjectsV1` and every unmerged candidate head is terminally guarded. An +unresolved attempt forbids terminalization. The resolution domain is +`laconian-publication-pr-create-delivery-resolution-v1\n`, omitting only its final digest; arrays +are ordinal-ordered with no gaps or duplicates. `recorded_at` byte-equals +`final_marker_discovery.observed_at`; retry time or a local clock cannot change it. + +Check-run reads are class-bound rather than anonymous page hashes. The ref-level check-run endpoint +is forbidden for completeness because GitHub limits it to runs from the 1,000 most recent check +suites. `PublicationCheckRunProjectionV1` has exactly positive `check_suite_id`, positive +`check_run_id`, `head_oid`, positive `app_id`, `app_slug`, `context`, `status`, nullable +`conclusion`, nullable `external_id`, nullable `started_at`, nullable `completed_at`, and +`canonical_response_sha256`. +Status is exactly `queued|in_progress|completed|waiting|requested|pending`; `completed` requires a +nonnull conclusion from exactly `success|failure|neutral|cancelled|skipped|timed_out| +action_required|stale` and nonnull completion time, while every noncompleted status requires both +null. + +`PublicationCheckSuiteProjectionV1` has exactly positive `check_suite_id`, `head_oid`, positive +`app_id`, `app_slug`, and `canonical_response_sha256`. +`PublicationCheckSuitePageReceiptV1` has exactly `schema_version`, +the full campaign/registry/publication/attempt/correction/bundle/plan/intent identity, +`repository_id`, `operation_kind="merge_eligibility"|"terminal_guard"| +"terminal_reconciliation_read"`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `operation_request_ordinal`, `head_oid`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, positive `publisher_app_id`, +`publisher_app_slug`, `publisher_credential_broker_policy_sha256`, +`authorized_policy_row_sha256`, `publisher_credential_subject_sha256`, +`token_fingerprint_sha256`, `token_vault_committed_at`, +`token_expires_at`, +`method="GET"`, `endpoint_template`, `query_template`, `request_url`, `api_version="2022-11-28"`, +`accept_header="application/vnd.github+json"`, +`authentication_kind="publisher_app_installation_token_vault"`, +nullable positive `operation_round_ordinal`, nullable +`observation_stage="post"|"final"`, `observation_round=1|2`, positive `page_ordinal`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `transport_terminal_at`, +`response_status=200`, nonnegative `total_count`, +ordered `check_suites: PublicationCheckSuiteProjectionV1`, nullable `previous_link`, nullable +`next_link`, `raw_response_sha256`, `canonical_response_sha256`, `authenticated_at`, and +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, `page_receipt_sha256`. `authenticated_at` equals the broker-signed +`response_completed_at`. Every page requires +`token_vault_committed_at <= request_dispatched_at < token_expires_at` and +`request_dispatched_at <= response_completed_at <= transport_terminal_at`; response status/body +and page receipt are terminal at +that time, which is inside the nested signing key's inclusive validity window. +`PublicationCheckRunPageReceiptV1` has the same exact pagination fields plus +positive `check_suite_id`, the fixed `check_context`, and ordered +`check_runs: PublicationCheckRunProjectionV1` instead of suites. Their domains are respectively +`laconian-publication-check-suite-page-receipt-v1\n` and +`laconian-publication-check-run-page-receipt-v1\n`, omitting only the final page digest. +Their signature domains are exactly +`laconian-publication-check-suite-page-signature-v1\n` and +`laconian-publication-check-run-page-signature-v1\n`; each signature preimage is +`UTF8(the matching signature domain) || CanonicalJSONV1(record without exactly +broker_signature_base64url and page_receipt_sha256)`. Each record digest is +`SHA256(UTF8(the matching record domain) || CanonicalJSONV1(record without exactly +page_receipt_sha256))`, including the verified signature, and verifies under the +policy/registry publisher key whose `not_before <= transport_terminal_at <= not_after`. +The suite endpoint template is exactly +`/repos/{owner}/{repo}/commits/{head_oid}/check-suites`; the run endpoint is exactly +`/repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs`; each concrete query template adds +only the class-bound App/context/filter/per-page parameters described below. These literal method/ +endpoint fields byte-equal the generic wrapper rather than being inferred from request URL text. +Every suite/run projection's head, App ID/slug and run `context` byte-equal the enclosing +observation and raw GitHub `name`; a mismatch fails closed. +Every page's full identity, operation/key/ordinal, App installation, policy/row, credential-subject +digest, token fingerprint and token times byte-equal its enclosing observation and the exact +same-operation `PublisherCredentialSubjectV1`. The operation projection nests one exact +`PublisherOperationTransportReceiptV1` wrapper whose `source_observation_sha256` equals this page +digest; the broker ledger names the wrapper's distinct transport digest and its start entry names +the wrapper's nested dispatch digest. Those three domain-separated digests are never +interchangeable; cross-campaign, cross-operation or cross-token page reuse is invalid. +The wrapper and page also have byte-equal identity, operation/key/credential subject and ordinal, +request ID, method/endpoint, page, token provenance and dispatch time; wrapper +`observation_round` equals page `observation_round` and operation-round/stage follow the closed +matrix; wrapper outcome is +`read_200`, response status/completion equal the page, and +`attempt_terminal_at = page.transport_terminal_at`. Its nested dispatch receipt reproduces the +page request and operation-request ordinal. Any disagreement is invalid even when both signatures +verify independently. +`publisher_app_id = app_identity.app_id` and `publisher_app_slug = app_identity.app_slug`; both also +byte-equal the selected policy and sealed registry publisher-App member. The concrete suite query's +`app_id` is derived only from that sealed identity. A page that filters on any other App, including +another installed App with a matching context, is invalid. +For either page, `raw_response_sha256` is SHA-256 of the exact archived HTTP response-body bytes and +`canonical_response_sha256` is SHA-256 of RFC 8785 canonical JSON for the complete parsed response +body. Each member projection's `canonical_response_sha256` is instead SHA-256 of RFC 8785 canonical +JSON for that exact unprojected response-array member; its selected fields must equal that parsed +member. The archived page bytes, parsed page object, member order and all projections are therefore +one replayable mapping; a synthetic member hash or unreferenced response member is invalid. + +`PublicationCheckApiArchiveV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent identity, `repository_id`, `operation_kind`, +`operation_idempotency_key`, `credential_attempt_ordinal`, `head_oid`, nullable positive +`operation_round_ordinal`, nullable `observation_stage="post"|"final"`, +`observation_round=1|2`, ordered `blobs`, ordered `page_bindings`, and +`check_api_archive_sha256`. Each blob has exactly `path`, `sha256`, and `raw_bytes_base64`; decoded +bytes reproduce `sha256`, and paths are exactly +`publication-check-api/.response`. Each binding has exactly +`page_kind="check_suite"|"check_run"`, nullable positive `check_suite_id`, positive +`page_ordinal`, `page_receipt_sha256`, and `raw_blob_path`. Suite bindings require null suite ID; +run bindings require the enclosing suite ID. Bindings are ordered by all suite pages then ascending +suite ID/run page, and form a bijection over every nested page receipt and blob: receipt raw hash, +blob hash and decoded exact response bytes all match. The `blobs` array uses exactly that same +binding order, with `blobs[i].path = page_bindings[i].raw_blob_path`; no alternate path sort or +permutation is valid. Bytes are response bodies only and exclude +headers, authorization and cookies. Its domain is +`laconian-publication-check-api-archive-v1\n`, omitting only its final digest. + +`PublicationCheckSuiteRunEnumerationV1` has exactly `schema_version`, positive `check_suite_id`, +`query_template="GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs?check_name=laconian%2Fpublication-terminal-guard&filter=all&per_page=100"`, +positive `page_count`, ordered nested exact +`page_receipts: PublicationCheckRunPageReceiptV1`, `pagination_complete=true`, ordered +`check_runs: PublicationCheckRunProjectionV1`, and `enumeration_sha256`. Every member repeats that +suite ID and the array is sorted by ascending unique check-run ID. Its domain is +`laconian-publication-check-suite-run-enumeration-v1\n`, omitting only its final digest. + +`PublicationCheckRunsSemanticSnapshotV1` has exactly `schema_version`, `head_oid`, positive +`publisher_app_id`, `publisher_app_slug`, +`check_context="laconian/publication-terminal-guard"`, ordered `check_suites`, ordered `check_runs`, +`publisher_context_state="none"|"all_success"|"all_failure"|"mixed_or_nonterminal"`, nullable +`sole_publisher_context_check_run_id`, and `check_runs_semantic_snapshot_sha256`. Each suite member +has exactly `check_suite_id`, `head_oid`, `app_id`, and `app_slug`; each run member has exactly +`check_suite_id`, `check_run_id`, `head_oid`, `app_id`, `app_slug`, `context`, `status`, nullable +`conclusion`, nullable `external_id`, nullable `started_at`, and nullable `completed_at`. Arrays use +the same complete canonical order and status/nullability rules as the source observation. The +snapshot is a total projection: it preserves all external IDs and GitHub lifecycle times but +excludes only operation/credential/policy/token/request, pagination, archive, raw/canonical-response, +signature and observation-time provenance. Its domain is +`laconian-publication-check-runs-semantic-snapshot-v1\n`, omitting only its final digest. + +`PublicationCheckRunsObservationV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent identity, `repository_id`, `branch_name`, +`operation_kind="merge_eligibility"|"terminal_guard"|"terminal_reconciliation_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`publisher_credential_broker_policy_sha256`, `authorized_policy_row_sha256`, +`publisher_credential_subject_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, +`head_oid`, nullable positive `operation_round_ordinal`, nullable +`observation_stage="post"|"final"`, `observation_round=1|2`, +`check_context="laconian/publication-terminal-guard"`, positive `publisher_app_id`, +`publisher_app_slug`, +`check_suites_query_template="GET /repos/{owner}/{repo}/commits/{head_oid}/check-suites?app_id={publisher_app_id}&check_name=laconian%2Fpublication-terminal-guard&per_page=100"`, +positive `suite_page_count`, `suite_pagination_complete=true`, ordered nested exact +`suite_page_receipts: PublicationCheckSuitePageReceiptV1`, ordered positive unique +`check_suite_ids`, ordered nested exact +`suite_run_enumerations: PublicationCheckSuiteRunEnumerationV1`, nested exact +`check_api_archive: PublicationCheckApiArchiveV1`, ordered +`check_runs: PublicationCheckRunProjectionV1`, `publisher_context_state="none"|"all_success"| +"all_failure"|"mixed_or_nonterminal"`, nullable `sole_publisher_context_check_run_id`, +`semantic_snapshot: PublicationCheckRunsSemanticSnapshotV1`, +`check_runs_semantic_snapshot_sha256`, +`observed_at`, and `check_runs_observation_sha256`. The suite IDs are the complete ascending +publisher-App suite projection for the head; there is exactly one enumeration per suite in that +order. Its App ID/slug and query substitution obey the same four-way App equality as every page. +The nested semantic snapshot is the exact total projection of these suite/run arrays and its +duplicated digest recomputes. +The nested archive identity/round byte-equals the observation and covers exactly all its +suite/run pages. Every nested page repeats the observation's operation/credential provenance. The aggregate contains every run for the fixed context regardless of external ID, sorted by +ascending unique `(check_suite_id,check_run_id)`. `none` requires an empty aggregate; +`all_success|all_failure` require a nonempty aggregate in which every member is completed with that +conclusion; every other projection is mixed/nonterminal. The sole ID is nonnull exactly when the +aggregate cardinality is one. Unsupported pagination, an API cap, a suite/run identity mismatch, +or any incomplete page set fails closed. Its domain is +`laconian-publication-check-runs-observation-v1\n`, omitting only its final digest. + +For both page types, receipt count equals `page_count`, ordinals start at one without gaps, page one +has null previous link, every next link byte-equals the next page's signed `request_url` and that +page's previous link byte-equals the prior page's signed `request_url`; only the final page has null +next link. Every page repeats one stable `total_count`; the +deduplicated aggregate cardinality equals it, response objects equal the page projections, and no +ID appears twice. Suite enumeration binds every suite projection's head/App identity; its run +enumeration binds that suite ID and fixed context. Observation `observed_at` is the maximum +broker-signed response-completion time, and every nested page repeats its round. A bare hash or +boolean cannot substitute for these nested receipts. +Every page `query_template` byte-equals its enclosing suite/run literal. `request_url` is the +canonical HTTPS expansion on `api.github.com` with an explicit positive `page` equal to +`page_ordinal`; page one is the literal expansion plus `page=1`, and every later URL equals the +preceding signed `next_link`. Links have the same owner/repository/path and `per_page=100`; only the +positive `page` parameter may change. Suite-page links preserve exactly `app_id` and `check_name` and forbid +`filter`; run-page links preserve exactly `check_name` and `filter=all` and forbid `app_id`. Each +projection's canonical member digest maps to its exact containing response member. +For every page and publisher operation request, concrete URL `{owner}/{repo}` is substituted only +from the sealed campaign-registry repository identity; the page/operation `repository_id`, publisher +App installation repository ID and that registry member are equal. A caller-provided owner/repo or +a signed observation from another repository is invalid even when the head OID happens to match. + +`PublicationPostGuardVerificationReceiptV1` has exactly `schema_version`, the same identity, +`branch_name`, `head_oid`, the fixed context, `guard_external_id`, positive `guard_check_run_id`, +`guard_delivery_resolution_sha256`, nested exact +`first_check_runs_observation: PublicationCheckRunsObservationV1`, nested exact +`second_check_runs_observation: PublicationCheckRunsObservationV1`, +`verified_guard_check_run_id`, `all_publisher_context_runs_completed_failure=true`, `verified_at`, +and `post_guard_verification_receipt_sha256`. The two observations have identical identity/query +and byte-equal recomputed `PublicationCheckRunsSemanticSnapshotV1` digests; the +first is round one, the second +round two, every first-round response completes before the first second-round dispatch, and their +request IDs/receipt roots/times are distinct. Both have `publisher_context_state=all_failure`. +The verified ID equals the guard ID and names a member with the exact guard external ID; every +other publisher-App/context member is also completed failure, so platform selection cannot expose +a success or pending run. `verified_at` equals the second observation's authenticated `observed_at`. Its +domain is `laconian-publication-post-guard-verification-receipt-v1\n`, omitting only its final +digest. + +`PublicationFinalCheckRunsObservationSetV1` has exactly `schema_version`, the same identity, +`set_kind="guarded"|"guarded_reconciliation"|"no_guard"|"merge_observed"`, nullable +`historical_guard_snapshot_sha256`, nullable `no_guard_reason`, ordered `guarded_head_oids`, ordered +`post_guard_verification_receipts: PublicationPostGuardVerificationReceiptV1`, ordered +`final_check_runs_observations: PublicationCheckRunsObservationV1`, `observed_at`, and +`final_check_runs_observation_set_sha256`. `guarded` requires null reason; all three arrays have +identical positive length and ascending unique head order, and each final observation byte-equals +its receipt's second observation; its historical snapshot root is null. It is the immutable snapshot +named by `PublicationTerminalGuardSetV1`. +`guarded_reconciliation` requires null reason, a nonnull historical snapshot digest equal to that +stable guard set's exact `guarded` object, and the same three ordered positive arrays. The receipt +array and heads byte-equal the historical snapshot, but every final observation is a fresh +`operation_kind="terminal_reconciliation_read"` inventory using the reconciliation-read credential +subject. For each head its recomputed semantic-snapshot digest equals the historical receipt's +second observation's snapshot digest; +both states are `all_failure`, and the fresh response begins only after the historical response is +terminal. The historical verification-receipt array is intentionally shared; no fresh final- +observation page, token, operation-wrapper or dispatch digest is reused. +`no_guard` requires a null historical root and exact reason +`absent_branch_and_zero_marker_matches`, three empty arrays, the class-bound final absent-branch and +zero-match marker reads in the enclosing reconciliation, and no terminal-guard dispatch or live +write token. Closed eligibility dispositions and their inventoried observations may exist. +`merge_observed` requires null historical root and null reason, empty guarded/receipt arrays, exactly one final observation +for the selected merged head, an exact merged-PR marker in the enclosing reconciliation, and no +unmerged candidate head. Successful admission additionally requires that observation to have +`publisher_context_state=all_success` and a nonnull sole ID; failed admission preserves any other +stable complete state. It is constructed before any release authorization. +`observed_at` is the latest fresh member or enclosing authenticated no-guard read time. Its domain is +`laconian-publication-final-check-runs-observation-set-v1\n`, omitting only its final digest. + +Every success-check dispatch is likewise closed before a PR effect or terminal guard. +`PublicationMergeEligibilityDeliveryResolutionV1` has exactly `schema_version`, the same identity, +`branch_name`, `head_oid`, `check_context="laconian/publication-terminal-guard"`, +`eligibility_idempotency_key`, `external_id`, +`check_inventory_protocol="complete_check_suite_enumeration_v1"`, +ordered `attempts`, nested exact +`first_check_runs_observation: PublicationCheckRunsObservationV1`, nested exact +`second_check_runs_observation: PublicationCheckRunsObservationV1`, ordered +`lineage_check_run_ids`, nullable `sole_publisher_context_check_run_id`, +nullable `sole_lineage_check_run_id`, `resolved_status="none"|"exact_success"|"conflicting"`, +`publisher_credential_disposition_sha256`, `delivery_ambiguity=false`, `recorded_at`, and +`eligibility_delivery_resolution_sha256`. Each attempt has exactly positive `ordinal`, +`request_id`, `dispatch_state=not_dispatched|dispatched`, `method="POST"`, +`endpoint_template="/repos/{owner}/{repo}/check-runs"`, `request_payload_sha256`, +`outcome=not_dispatched|definitely_rejected_no_side_effect|created_exact`, nullable +`response_status`, nullable `safe_response_sha256`, +nullable `resolved_check_run_id`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, and `transport_receipt_sha256`. The +nested receipt is operation `merge_eligibility`, attempt kind `check_create`, has the same ordinal +and recomputed digest, and every duplicated field byte-equals this attempt. The lineage-ID array is the exact +ascending subset of the second observation whose external ID equals this intent's `external_id`; +all-publisher/context membership is represented only in the nested observations. `not_dispatched` +has all response/result fields null; +`definitely_rejected_no_side_effect` permits only 400, 401, 403, or 404 plus a class-bound safe +response; `created_exact` requires 201 and its exact check-run ID. +The POST body has exactly `name`, `head_sha`, `external_id`, `status="completed"`, and +`conclusion="success"`; it omits output, actions, URLs and timestamps, and the attempt payload hash +is the RFC 8785 canonical digest of those exact authority-derived fields. +Timeout, connection loss, 5xx, 202, 409, or 422 is never a definite rejection. Both authenticated +reads fully paginate after all dispatches have terminated and no further dispatch is authorized, +use round one then round two, have distinct signed request/receipt roots, complete every round-one +response before the first round-two dispatch, and have byte-equal recomputed semantic-snapshot +digests. `none` requires empty observations and +lineage IDs, null sole IDs, and no possibly delivered attempt. `exact_success` requires the +complete aggregate to contain exactly one publisher-App/context run, every possibly delivered +attempt to resolve to that same one lineage run, equal nonnull sole publisher/lineage IDs, and +`publisher_context_state=all_success`. +Every other stable, fully inventoried projection is `conflicting`; it cannot authorize PR creation +but may be consumed by terminal guarding. The accepted `PublicationMergeEligibilityReceiptV1` +exists only for `exact_success`; its check-run ID equals both sole IDs and its embedded delivery +root byte-equals this record. A later same-App/context run with another external ID therefore blocks +eligibility rather than becoming invisible. `recorded_at` equals the final observation source time. Its domain is +`laconian-publication-merge-eligibility-delivery-resolution-v1\n`, omitting only its final digest. +An unresolved, late, or differently owned success check forbids both PR creation and terminal +authority. + +The platform invariant is itself closed evidence. `PublicationBranchRulesetPolicyV1` has exactly +`schema_version`, `repository_id`, `protected_base_ref="refs/heads/main"`, +`publication_head_ref_pattern`, `allowed_ruleset_source_type="Repository"`, `enforcement="active"`, +`pull_request_required=true`, positive `minimum_approvals`, `dismiss_stale_reviews=true`, +`require_last_push_approval=true`, `required_conversation_resolution=true`, ordered +`allowed_merge_methods`, +`merge_queue_required=true`, `merge_queue_merge_method="MERGE"`, +`merge_queue_grouping_strategy="ALLGREEN"`, `merge_queue_minimum_entries_to_merge=1`, +`merge_queue_minimum_entries_to_merge_wait_minutes=0`, +`merge_queue_maximum_entries_to_merge=1`, `merge_queue_build_concurrency=1`, positive +`merge_queue_check_response_timeout_seconds`, `direct_merge_forbidden=true`, +`publication_validator_workflow_path=".github/workflows/publication-pr-validate.yml"`, +`publication_validator_workflow_sha256`, ordered +`publication_validator_triggers=["pull_request","merge_group:checks_requested"]`, +`publication_validator_job="publication-pr-validate"`, +`publication_validator_source_app_id`, +ordered `required_checks`, `main_bypass_actors=[]`, +`main_force_push_allowed=false`, `main_deletion_allowed=false`, +`publication_head_creation_restricted=true`, `publication_head_update_restricted=true`, +`publication_head_bypass_actor_kind="Integration"`, `publication_head_bypass_app_id`, +`publication_head_bypass_mode="always"`, `publication_head_update_allows_fetch_and_merge=false`, +`publication_head_force_push_allowed=false`, +`publication_head_deletion_allowed=false`, ordered `source_ruleset_ids`, and +`publication_branch_ruleset_policy_sha256`. Queue fields are literal REST projections: +`merge_queue_minimum_entries_to_merge_wait_minutes` equals +`merge_queue.parameters.min_entries_to_merge_wait_minutes`, `merge_queue_build_concurrency` equals +`merge_queue.parameters.max_entries_to_build`, and `merge_queue_check_response_timeout_seconds` +equals `60 * merge_queue.parameters.check_response_timeout_minutes`; no rounding or local default is +permitted. Each required-check entry has exactly `context`, +`source_kind="Integration"`, positive `source_app_id`, `strict=true`, and +`do_not_enforce_on_create=true`. The array has exactly one member: +`laconian/publication-pr-validate` from the frozen GitHub Actions App ID. The publisher-App +`laconian/publication-terminal-guard` is protocol evidence consumed by that validator, not a base +required-check context: GitHub evaluates base required checks on the temporary `merge_group` SHA, +where no publisher-App check is created. The publisher bypass App +ID equals the registered publisher App; +the head pattern matches only the deterministic publication/correction branches, and no publisher +grant applies to protected main. The policy domain is +`laconian-publication-branch-ruleset-policy-v1\n`, omitting only its final digest. +Protected-main merges are possible only through that one-entry queue; direct merge, jump/solo +override, auto-merge outside the queue and every human/App/team bypass are absent. The frozen +validator runs on both PR head and `merge_group.checks_requested`, resolves the selected PR/head, +verifies the intent-bound publisher eligibility/terminal-guard evidence and active campaign-state +authority, reads the current benchmark-authority denylist before deciding, and fails any PR or merge +group selected by a terminal tombstone. It publishes its required context on the event SHA: the PR +head for `pull_request` and the temporary merge-group SHA for `merge_group`. + +`PublicationBranchRulesetObservationReceiptV1` has exactly `schema_version`, `repository_id`, +`policy_sha256`, ordered `first_read_raw_response_sha256s`, ordered +`first_read_request_receipt_sha256s`, ordered `second_read_raw_response_sha256s`, ordered +`second_read_request_receipt_sha256s`, `first_projection_sha256`, `second_projection_sha256`, +`first_merge_queue_configuration_sha256`, `second_merge_queue_configuration_sha256`, +`validator_workflow_blob_sha256`, +`observed_at`, and `observation_receipt_sha256`. Both fully paginated authenticated reads derive the +same exact policy projection, IDs, enforcement and empty main-bypass set; the projection equals the +sealed registry and `PublicationPlanV1`. Applicable-rule reads for both base and head prove every +source type is `Repository`; any organization/enterprise inherited ruleset makes this protocol +unsupported and fails publication-intent authorization before any branch/check/PR effect. Each repository-owned ruleset detail is fetched with the existing +security-attestor App installation's `Administration: write` permission because GitHub omits +`bypass_actors` without ruleset write access; the fixed job's endpoint policy nevertheless permits +only authenticated GETs and returns no token to general workflow steps. Its domain is +`laconian-publication-branch-ruleset-observation-receipt-v1\n`, omitting only its final digest. +Both reads also reproduce the exact repository merge-queue configuration and the C0-frozen +validator bytes/triggers/job/App. Missing queue requirement, non-`MERGE`, non-`ALLGREEN`, a minimum +or maximum other than one, nonzero minimum-entry wait, build concurrency other than one, any bypass/direct merge, missing +`merge_group:checks_requested`, or wrong workflow/App makes publication unsupported before intent. +Rollout additionally blocks unless the pilot proves that a one-entry MERGE group preserves the +required two-parent/tree admission contract and that a `LOCKED` queue entry remains observable +until an authenticated dequeue, failed required-check removal, or base-ref merge. To enable the +failed-run alternative, the pilot first records a one-PR LOCKED group with a successful frozen +Actions App/context check, installs a tombstone, and proves a post-CAS authority-reading failure on +the same merge-group SHA becomes merge-authoritative, invalidates the old success and removes/blocks +the entry before main advances. If any predicate fails, that alternative is unsupported and only +authenticated dequeue plus causal removal and post-action snapshots can establish the barrier. +The ordered Merkle root of the pre-effect and post-effect observation receipts is the +`publication_branch_ruleset_observation_root_sha256` bound by every eligibility/guard receipt. +Missing source-App binding, stale/disabled rules, an extra main bypass, a mismatched branch pattern, +or a publisher update grant on main fails closed. + +Terminal-check delivery is also reconciled exactly. `PublicationTerminalGuardDeliveryResolutionV1` +has exactly `schema_version`, the same identity, `branch_name`, `head_oid`, the fixed context, +`guard_idempotency_key`, `guard_external_id`, ordered `superseded_check_run_ids`, ordered +`attempts`, nested exact `first_check_runs_observation: PublicationCheckRunsObservationV1`, nested +exact `second_check_runs_observation: PublicationCheckRunsObservationV1`, ordered +`lineage_guard_check_run_ids`, positive `designated_guard_check_run_id`, +`all_publisher_context_runs_completed_failure=true`, +`publisher_credential_disposition_sha256`, `delivery_ambiguity=false`, `recorded_at`, and +`guard_delivery_resolution_sha256`. Any registered- +publisher run for the head/context that is pending or not completed failure is terminated by a +`PublicationGuardUpdateAttemptV1`, with exactly +`schema_version`, positive `ordinal`, `operation="updated_to_failure"`, `request_id`, +`dispatch_state="not_dispatched"|"dispatched"`, `method="PATCH"`, +`endpoint_template="/repos/{owner}/{repo}/check-runs/{check_run_id}"`, positive +`target_check_run_id`, `request_payload_sha256`, closed `outcome`, nullable `response_status`, +nullable `safe_response_sha256`, nullable `resolved_check_run_id`, and +`transport_receipt_sha256`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`; its nested receipt is operation +`terminal_guard`, attempt kind `guard_update`, has the same ordinal and recomputed digest, and every +duplicated field byte-equals this attempt. Its PATCH body replaces `external_id` with the exact +`guard_external_id` and has exactly `status="completed"`, `conclusion="failure"`; it omits every +optional output/action/time field. After those updates, a final attempt may be +`PublicationGuardCreateAttemptV1` with the same fields except +`operation="created_failure"`, `method="POST"`, +`endpoint_template="/repos/{owner}/{repo}/check-runs"`, no target ID, and nested transport attempt +kind `guard_create`. Both use outcomes +`not_dispatched`, `definitely_rejected_no_side_effect`, `delivered_exact`, +or `non_2xx_resolved_exact`. Confirmed delivery requires 200 for +PATCH or 201 for POST. Definite rejection permits only 400, 401, 403, or 404 plus class-bound safe +proof; response-loss has null status; non-2xx resolved exact permits only 409 or 422 and exact +post-read adoption. Every possibly delivered attempt must resolve to its one exact check-run ID. +`not_dispatched` requires its namesake outcome and null status/safe-response/resolved ID; +`dispatched` requires another outcome. Safe response is nonnull only for definite rejection, and +resolved ID is nonnull exactly for a delivered/resolved outcome. +The create body has exactly `name`, `head_sha`, `external_id`, `status="completed"`, and +`conclusion="failure"`. PATCH hashes RFC 8785 over exactly its three listed fields; POST hashes it +over exactly its five listed fields. +`superseded_check_run_ids` is the ascending distinct update-target array. The designated guard ID +is the confirmed/adopted create result when present, otherwise the lowest-ordinal confirmed/adopted +update result, otherwise the smallest preexisting member already carrying the guard external ID. + +Both nested post-dispatch observations fully paginate all publisher-App check suites and every check +run for this head and fixed context. Their lineage-ID array is the exact external-ID subset. They +use round one then round two, have distinct signed request/receipt roots, complete every first-round +response before the first second-round dispatch, and have byte-equal recomputed semantic-snapshot +digests. +Both have `publisher_context_state=all_failure`, the designated guard +ID is a lineage member and equals the receipt's check-run ID, and no success, pending, queued, +in-progress, neutral, skipped, or cancelled run remains. A nonlineage member may remain only as +completed failure, and at least one designated guard-lineage member exists. Thus `none`, +`exact_success`, and `conflicting` eligibility projections +are all terminalizable; only unresolved delivery is not. `recorded_at` equals the final observation source time. Its domain is +`laconian-publication-terminal-guard-delivery-resolution-v1\n`, omitting only its final digest. + +`PublicationTerminalGuardReceiptV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent identity, `branch_name`, `head_oid`, +`check_context="laconian/publication-terminal-guard"`, +`guard_idempotency_key`, `guard_external_id`, +`actor: GitHubAppInstallationIdentityV1(role="publisher")`, positive `check_run_id`, +`status="completed"`, `conclusion="failure"`, `publication_branch_ruleset_policy_sha256`, +`publication_branch_ruleset_observation_root_sha256`, nullable +`superseded_merge_eligibility_receipt_sha256`, `eligibility_delivery_resolution_sha256`, +`guard_delivery_resolution_sha256`, `operation="updated_to_failure"|"created_failure"| +"adopted_failure"`, `request_receipts_root_sha256`, +`publisher_credential_disposition_sha256`, +`post_guard_check_run_verification_receipt_sha256`, `guarded_at`, and +`terminal_guard_receipt_sha256`. Its domain is +`laconian-publication-terminal-guard-receipt-v1\n`, omitting only its final digest. The ruleset +maps `updated_to_failure` only to a confirmed 200 PATCH, `created_failure` only to a confirmed 201 +POST, and `adopted_failure` only to an exact response-loss/non-2xx/preexisting lineage adoption in +the delivery resolution; the receipt check-run ID is its designated guard ID. +Its post-guard hash names the exact `PublicationPostGuardVerificationReceiptV1`; that receipt's +identity, head/context, guard ID/external ID and delivery-resolution digest byte-equal this receipt. +The publisher credential digest byte-equals the delivery resolution's exact +`PublisherOperationCredentialDispositionV1(operation_kind="terminal_guard", +credential_status="minted_then_closed")`; `guarded_at` is the later of the verification time and +the token closure time. A not-minted guard disposition is therefore unconstructible. +The ruleset does not require this App-bound context on protected main. It permits no update to the +intent-bound branch/head except the publisher's preauthorized protocol, and no protocol-authorized +publisher action may restore a terminal guard to success. The guard is durable protocol evidence +read by the validator. The sole platform-enforced anti-merge gate is the GitHub Actions App check +`laconian/publication-pr-validate`, which runs on both PR-head and merge-group SHAs, re-reads the +authority denylist/terminal evidence, and fails every tombstoned selector. Closing a PR alone is not +treated as irreversible. + +One terminal decision may have more than one possibly mergeable head. The class-bound +`PublicationTerminalGuardSetV1` has exactly `schema_version`, the same identity, +`branch_create_delivery_resolution_sha256`, `pr_create_delivery_resolution_sha256`, positive +`round_count`, ordered `rounds`, ordered `final_guarded_head_oids`, +`final_branch_observation_sha256`, `final_pr_marker_discovery_sha256`, +`final_check_runs_observation_set_sha256`, `conflicting_publication_objects_root_sha256`, +`publisher_credential_dispositions_root_sha256`, `guarded_at`, and +`terminal_guard_set_sha256`. Each `PublicationTerminalGuardRoundV1` has exactly `schema_version`, +the same identity, positive gapless `round_ordinal`, nested exact +`pre_guard_discovery_disposition: PublisherOperationCredentialDispositionV1( +operation_kind="terminal_guard_discovery")`, `pre_guard_discovery_disposition_sha256`, +`pre_guard_branch_observation_sha256`, nested +exact `pre_guard_pr_marker_discovery`, ordered `candidate_head_oids`, ordered +`eligibility_delivery_resolution_sha256s`, ordered `terminal_guard_delivery_resolutions`, ordered +`terminal_guard_receipts`, ordered `post_guard_check_run_verification_receipt_sha256s`, +nested exact `post_guard_discovery_disposition: PublisherOperationCredentialDispositionV1( +operation_kind="terminal_guard_discovery")`, `post_guard_discovery_disposition_sha256`, +`post_guard_branch_observation_sha256`, nested exact `post_guard_pr_marker_discovery`, ordered +`post_guard_candidate_head_oids`, `round_outcome="expanded"|"stable"`, and `round_sha256`, using +domain `laconian-publication-terminal-guard-round-v1\n` and omitting only its final digest. + +Every persisted round has exactly two global read-only discovery dispositions. A pre-read which +already proves an authenticated merge and precedes every guard dispatch routes directly to the +existing merge-won terminal branch and constructs no guard round or guard set. The two operation idempotency keys are +`SHA256(UTF8("laconian-terminal-guard-discovery-key-v1\n") || CanonicalJSONV1({campaign_id, +publication_id,publication_attempt,correction_id,round_ordinal,stage}))`, with `stage` exactly `pre` +or `post`; no per-head guard key may own those reads. Each disposition's final projection contains +exactly its one branch observation followed by its one complete two-round marker discovery, uses +that round ordinal/stage on every wrapper/page/archive, and has terminal status +`discovery_complete`. Each candidate head instead has one distinct `terminal_guard` disposition +whose key is derived from the same identity, round ordinal and lowercase head OID; it owns only that +head's guard writes and post-write check inventories. + +Before round one, all branch, PR and eligibility-success transports have terminated and no success- +check, branch-create, or PR-create dispatch remains authorized. Each candidate array is the sorted +unique complete union of the planned head, exact/conflicting branch observations, every possibly +delivered branch head, and every exact-marker PR head. Every candidate has one empty-or-resolved +eligibility resolution, one fully reconciled guard delivery whose transports terminate within that +round before its post-reads, one guard receipt, and one post-guard verification proving every +publisher-App/context run in the complete suite inventory is failure. Post-guard branch +and PR reads then recompute the union. Equality yields `stable`; a strict superset yields `expanded` +and the next round's pre-observations/candidates byte-equal that post projection. A missing head, +shrink, substitution, unresolved write, non-superset change, or more than eight rounds fails closed. +The final round is uniquely stable; its head array and post observations equal the set's three +final branch/PR fields. Its `final_check_runs_observation_set_sha256` names the exact guarded +`PublicationFinalCheckRunsObservationSetV1`: heads equal `final_guarded_head_oids`, verification +receipts equal the final round's post-guard receipt array, and final observations equal those +receipts' second observations. The credential root is the canonical aggregate of every discovery, +eligibility and guard disposition in exact round/stage/head order; the later unique terminal- +reconciliation-read disposition is +added by `PublicationNoLaterEffectsEvidenceV1` after the stable set. `guarded_at` equals its latest +authenticated source time. The set domain is +`laconian-publication-terminal-guard-set-v1\n`, omitting only its final digest. This pre-read, +guard, post-read loop has no hash cycle and cannot seal while a newly discovered head is unguarded. + +#### Fenced publication-write ambiguity + +The five ordinary publication delivery-resolution classes remain closed and retain +`delivery_ambiguity=false`. A response-lost write that is not ordered before an authoritative +server-side effect observation is never represented by `response_lost_resolved_*`, a +synthetic zero-effect disposition, or a no-later claim. It is represented only by the failure-only +grammar below. + +In this subsection, **full publication identity** means the full containment publication identity +defined before the state event above. All ordinary initial/correction/bundle/phase rules continue +to apply. Any nested pre-containment source that still spells its field `authority_parent_oid` +must byte-equal the enclosing `source_authority_parent_oid`; post-CAS records instead use the +distinct `containment_authority_oid` and terminal events use their immediate accepted parent. + +`PublicationWriteAmbiguitySubjectV1` has exactly, in order, +`schema_version="PublicationWriteAmbiguitySubjectV1"`, the full publication identity, +`operation_kind`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `operation_request_ordinal`, positive +`source_attempt_ordinal`, +`attempt_kind`, `method`, `endpoint_template`, +`request_payload_sha256`, nullable `target_branch_name`, nullable +`target_head_oid`, nullable positive `target_check_run_id`, nullable positive +`target_pull_request_number`, `effect_class="merge_enabling"|"safety_monotone"`, +nested exact `request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, +`operation_transport_receipt_sha256`, +`source_credential_disposition_sha256`, +`transport_outcome="response_lost_unresolved"`, nullable `response_status`, +nullable `response_completed_at`, nullable `resolved_object_id`, nullable +`resolved_object_root_sha256`, nullable `source_observation_sha256`, +`request_dispatched_at`, `attempt_terminal_at`, and +`write_ambiguity_subject_sha256`. + +The operation is exactly `branch_create`, `merge_eligibility`, +`pull_request_create`, `terminal_guard`, or +`pull_request_close`; the first three map to `merge_enabling` and the last two +to `safety_monotone`. Target nullability is operation-derived: branch create names +branch/head; eligibility names head; PR create names branch/head and has null assigned PR number; +guard names head and names a check-run ID only for update; close names the exact PR number. The +nested receipts and the source disposition have the same full identity, operation/key/ordinals, request, +method/endpoint/payload/target and times; both digests recompute. The terminal receipt is dispatched, +has its exact nonnull start receipt, outcome `response_lost_unresolved`, and all five +response/result/source fields above null. This new outcome is legal only in this subject and in its +exact publisher transport projection; it is forbidden in every ordinary delivery resolution. The +subject domain is `laconian-publication-write-ambiguity-subject-v1\n`, omitting only its +final digest. + +The source ordinal byte-equals the selected member of the corresponding write-attempt array and is +gapless within that source operation; the operation-request ordinal is the independently gapless +global dispatch ordinal for the credential attempt. Arbitrarily delayed delivery is part of the +failure model: for any of these five non-idempotent or safety-monotone writes, a lost request may be +delivered before read one, between the two reads, after read two, or after a proposed terminal +event. Therefore no later observation, including two equal observations, may transform +`response_lost_unresolved` into an ordinary exact/absent/closed resolution. Only the persistent +denylist, post-CAS merge barrier and sealed ambiguity-fence graph below can terminalize it. The sole +ordinary response-loss exception is immutable single-assignment branch-ref creation after the +reserved branch name is observed exact or occupied; that exception is not an ambiguity subject. + +`PublicationWriteAmbiguitySetV1` has exactly +`schema_version="PublicationWriteAmbiguitySetV1"`, the full publication identity, positive +`subject_count`, ordered nested exact +`subjects: PublicationWriteAmbiguitySubjectV1`, ordered distinct +`merge_enabling_subject_sha256s`, ordered distinct +`safety_monotone_subject_sha256s`, and `write_ambiguity_set_sha256`. The +subject array is nonempty and sorted by +`(operation_rank,operation_idempotency_key,credential_attempt_ordinal,operation_request_ordinal)`, +where rank is branch, eligibility, PR create, guard, close. `subject_count` equals the array length. +The two digest arrays are exact stable +projections of that array, preserve its order, are disjoint, and their union is complete. Its domain +is `laconian-publication-write-ambiguity-set-v1\n`, omitting only its final digest. + +`PublicationMergeDenylistEntryV1` has exactly +`schema_version="PublicationMergeDenylistEntryV1"`, the full publication identity, +`source_kind="ordinary_terminal_disposition"|"write_ambiguity"`, nullable +`publication_pr_terminal_disposition_sha256`, nullable `write_ambiguity_set_sha256`, +`reason="publication_terminal_disposition_fenced"| +"publication_write_delivery_ambiguous_fenced"`, ordered distinct `denied_branch_names`, ordered +distinct `denied_head_oids`, ordered distinct `denied_head_commit_trailers`, ordered distinct +`denied_pull_request_node_ids`, ordered distinct `denied_pull_request_markers`, +ordered distinct positive `denied_pull_request_numbers`, ordered distinct +`denied_operation_idempotency_keys`, `created_at`, and +`merge_denylist_entry_sha256`. Names, markers and keys use ascending UTF-8 byte order, OIDs +ascending lowercase hexadecimal and PR numbers ascending numeric order. The arrays are the complete +nonempty union derivable from the plan, ambiguity subjects and already authenticated candidate +observations; a PR number/node may be absent because a late PR has not yet been assigned. The frozen +validator denies iff any constituent PR has a denied node ID/number, same-repository head branch, +head OID, exact canonical marker line, or exact canonical head-commit trailer. Operation keys are +audit-only and never claimed as a GitHub match source. Future intent admission rejects reuse of a +denied branch/head/marker/trailer. The OR predicate and one-entry constituent resolution are C0- +frozen. Exactly one +source digest is nonnull. The ordinary source is only a fully built exact +`PublicationPRTerminalDispositionV1(outcome="no_pr"|"closed")` and derives reason +`publication_terminal_disposition_fenced`; the ambiguity source is only the exact failure set and +derives reason `publication_write_delivery_ambiguous_fenced`. The entry +domain is `laconian-publication-merge-denylist-entry-v1\n`, omitting only its digest. + +`PublicationMergeDenylistV1` has exactly +`schema_version="PublicationMergeDenylistV1"`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, nullable +`predecessor_merge_denylist_root_sha256`, nonnegative `entry_count`, ordered +nested exact `entries: PublicationMergeDenylistEntryV1`, and +`publication_merge_denylist_root_sha256`. Preflight installs the canonical empty record +with null predecessor, count zero and an empty array; every successor reproduces every prior entry +byte-for-byte, sets its predecessor to the prior root, increments the count and appends exactly one +new entry. No entry is removed or rewritten. Its domain is +`laconian-publication-merge-denylist-v1\n`, omitting only its final root. + +`PublicationMergeQueuePreflightObservationV1` has exactly +`schema_version="PublicationMergeQueuePreflightObservationV1"`, the full publication +identity, `source_kind="ordinary_terminal_disposition"|"write_ambiguity"`, +`source_sha256`, +`operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, positive `pull_request_number`, +`repository_node_id`, positive `repository_database_id`, `pull_request_node_id`, +`pull_request_state="open"|"closed"|"merged"`, `merged`, nullable +`merged_at`, nullable `merge_oid`, `base_oid`, `head_oid`, +`observed_main_oid`, nullable nested exact `merge_queue_entry`, +`graphql_document_sha256`, `graphql_variables_sha256`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `response_status=200`, +`graphql_errors=[]`, `raw_response_sha256`, +`canonical_response_sha256`, nested exact `raw_response_blob`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, `observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and +`merge_queue_preflight_observation_sha256`. Its state/merge/nullability, queue-entry +projection, raw archive, query/variables, dispatch bijection, signature omission and canonical +mapping rules are byte-for-byte those of `PublicationMergeQueueObservationV1` below. +`source_sha256` equals the selected terminal disposition or ambiguity set and contains no +preflight/intent/successor-state digest, so the graph is acyclic. Its record/signature domains are +`laconian-publication-merge-queue-preflight-observation-v1\n` and +`laconian-publication-merge-queue-preflight-observation-signature-v1\n`. + +`PublicationProtectedMainObservationV1` has exactly +`schema_version="PublicationProtectedMainObservationV1"`, the full publication identity, +`observation_phase="pre_containment"|"post_action_first"|"post_action_second"`, nullable +`source_kind="ordinary_terminal_disposition"|"write_ambiguity"`, nullable +`source_sha256`, nullable `terminal_containment_intent_sha256`, nullable +`containment_authority_oid`, nullable `successor_merge_denylist_root_sha256`, +`operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/git/ref/heads/main"`, +`observed_main_oid`, `response_status=200`, `raw_response_sha256`, +`canonical_response_sha256`, nested exact `raw_response_blob`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `observed_at`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `protected_main_observation_sha256`. Pre- +containment requires source kind/digest nonnull and all three post-CAS fields null; either post phase +requires the reverse. The ref target is a commit and supplies the lowercase OID. Raw archive, +append-before-send bijection, one-way terminal-wrapper link, chronology and exact signature/digest +omissions are identical to other publisher non-page reads. Its domains are +`laconian-publication-protected-main-observation-signature-v1\n` and +`laconian-publication-protected-main-observation-v1\n`. + +`PublicationTerminalContainmentPreflightV1` has exactly +`schema_version="PublicationTerminalContainmentPreflightV1"`, the full publication identity, +`containment_kind="ordinary_terminal_disposition"|"write_ambiguity"`, nullable +`publication_pr_terminal_disposition_sha256`, nullable +`write_ambiguity_set_sha256`, nested exact +`protected_main_observation: PublicationProtectedMainObservationV1( +observation_phase="pre_containment")`, +`protected_main_observation_sha256`, nested exact +`marker_discovery: PublicationPRMarkerDiscoveryV1`, +`marker_discovery_sha256`, nested exact +`pre_containment_queue_inventory: PublicationMergeQueueInventoryObservationV1( +observation_scope="pre_containment",observation_stage="pre_containment",snapshot_ordinal=0)`, +`pre_containment_queue_inventory_sha256`, ordered distinct positive `candidate_pull_request_numbers`, +ordered nested exact +`queue_observations: PublicationMergeQueuePreflightObservationV1`, ordered +matching `queue_observation_sha256s`, +ordered distinct positive `merged_candidate_pull_request_numbers`, +`merge_state="all_unmerged"|"merge_observed"`, +`observed_main_oid`, `publication_branch_ruleset_observation_root_sha256`, +`observed_at`, and `containment_preflight_sha256`. Exactly one source digest is +nonnull and equals the selected source. Candidate numbers are the ascending unique union of every +source candidate, fresh complete marker discovery and every denylist-affected global queue entry; +queue observations form a bijection in +that order. The protected-main observation supplies `observed_main_oid`. `all_unmerged` requires an +empty merged array; `merge_observed` requires it to be the exact positive subset of merged queue/ +marker observations. An ordinary fully resolved source that observes a merge still installs the +containment CAS before failed admission so every remaining candidate is fenced; it never skips the +persistent denylist. A write-ambiguity source does the same for the whole set, preserves every +immutable merge, and fences every remaining unmerged affected candidate. Its domain is +`laconian-publication-terminal-containment-preflight-v1\n`, omitting only its final digest. + +`PublicationPreContainmentTerminalRouteV1` is the cycle-free route discriminator built +before containment. It has exactly `schema_version="PublicationPreContainmentTerminalRouteV1"`, +the full publication identity, +`source_kind="ordinary_terminal_disposition"|"write_ambiguity"`, `source_sha256`, +`route_kind="initial_complete_stop"|"initial_complete_plan_invalidation"| +"initial_invalid_plan_invalidation"|"correction_unmerged_invalidation"`, +`source_failure_code="publication_lineage_failure"|"base_moved"|"head_moved"|"plan_mismatch"| +"closed_unmerged"|"terminal_invalid_lineage"|"protocol_authority_drift"| +"credential_exposure"|"publication_reconciliation_unavailable"| +"publication_write_delivery_ambiguous_fenced"`, +nullable `credential_exposure_route_state="active_pending"|"accepted_supplement"`, +`source_failure_evidence_root_sha256`, `premerge_terminal_event_type="PERMANENT_STOP"| +"COMPLETE_PUBLICATION_PLAN_INVALIDATED"|"INVALID_PUBLICATION_PLAN_INVALIDATED"| +"CORRECTION_INVALIDATED"`, `premerge_terminal_reason_or_outcome`, `created_at`, and +`pre_containment_terminal_route_sha256`. The ordinary source names an exact +`no_pr|closed` disposition. `publication_lineage_failure` names a pre-existing exact +`OrdinaryStopEvidenceV1(reason="publication_lineage_failure")` and maps only to +`initial_complete_stop/PERMANENT_STOP/publication_lineage_failure`. The five plan-failure +codes name respectively the already authenticated base observation, branch observation, +plan-verification receipts, terminal disposition, or lineage-verification receipts and map: +complete bundle to `initial_complete_plan_invalidation/COMPLETE_PUBLICATION_PLAN_INVALIDATED`, +invalid-prefix to +`initial_invalid_plan_invalidation/INVALID_PUBLICATION_PLAN_INVALIDATED`, and correction to +`correction_unmerged_invalidation/CORRECTION_INVALIDATED/unmerged_invalid`. +`publication_write_delivery_ambiguous_fenced` names only the ambiguity set and maps complete +to `initial_complete_stop/PERMANENT_STOP`, invalid-prefix to +`initial_invalid_plan_invalidation/INVALID_PUBLICATION_PLAN_INVALIDATED`, and correction to +`correction_unmerged_invalidation/CORRECTION_INVALIDATED/fenced_write_ambiguity`. +`protocol_authority_drift` names the exact pre-containment `ProtocolAuthorityDriftEvidenceV1` and +maps complete to `initial_complete_stop/PERMANENT_STOP/protocol_authority_drift`, invalid-prefix +to `initial_invalid_plan_invalidation/INVALID_PUBLICATION_PLAN_INVALIDATED/ +protocol_authority_drift`, and correction to +`correction_unmerged_invalidation/CORRECTION_INVALIDATED/unmerged_invalid` with +`invalidation_cause=protocol_authority_drift`. `credential_exposure` has two disjoint forms. +Complete initial publication and correction require `credential_exposure_route_state=active_pending` +and name the exact active `CredentialExposurePendingV1` plus completed effect-prefix root; their +terminal events atomically consume that exposure chain. Invalid-prefix publication requires +`credential_exposure_route_state=accepted_supplement`, an exact already-accepted +`CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED` event and `CredentialExposureSupplementV1`, and both +active exposure fields null before containment starts; its later plan-invalidation record copies +the supplement/origin/effect roots but does not consume them a second time. The active form maps +complete to `initial_complete_stop/PERMANENT_STOP/credential_exposure` and correction to +`correction_unmerged_invalidation/CORRECTION_INVALIDATED/unmerged_invalid` with +`invalidation_cause=credential_exposure`; the accepted-supplement form maps only to +`initial_invalid_plan_invalidation/INVALID_PUBLICATION_PLAN_INVALIDATED/credential_exposure`. +Every non-exposure code requires `credential_exposure_route_state=null`. +`publication_reconciliation_unavailable` names the exact +sealed `PublisherReconciliationUnavailableReceiptV1`, its disposition-set root, and empty signed +release-authorization-ledger root; it maps complete to +`initial_complete_stop/PERMANENT_STOP/publication_reconciliation_unavailable`, invalid-prefix to +`initial_invalid_plan_invalidation/INVALID_PUBLICATION_PLAN_INVALIDATED/ +publication_reconciliation_unavailable`, and correction to +`correction_unmerged_invalidation/CORRECTION_INVALIDATED/reconciliation_unavailable`. These three +routes still require an independently authenticated exact `no_pr|closed` terminal disposition; +their source evidence root is the canonical Merkle root of the exact named evidence tuple. No source +evidence in this record contains a containment intent, accepted CAS receipt, barrier, no-later root, +terminal event or successor OID. The broker reconstructs the one literal row from the source +identity/bundle/phase/cause; a caller-supplied alternative is invalid. Its domain is +`laconian-publication-pre-containment-terminal-route-v1\n`, omitting only its digest. + +`PublicationTerminalContainmentIntentV1` has exactly +`schema_version="PublicationTerminalContainmentIntentV1"`, the full publication identity, +`containment_kind="ordinary_terminal_disposition"|"write_ambiguity"`, +`expected_authority_oid`, positive `expected_transition_number`, nested exact +nullable `publication_pr_terminal_disposition: PublicationPRTerminalDispositionV1`, nullable +`publication_pr_terminal_disposition_sha256`, nullable nested exact +`write_ambiguity_set: PublicationWriteAmbiguitySetV1`, nullable `write_ambiguity_set_sha256`, nested exact +`containment_preflight: PublicationTerminalContainmentPreflightV1`, +`containment_preflight_sha256`, `containment_main_oid`, nested exact +`predecessor_merge_denylist: PublicationMergeDenylistV1`, +`predecessor_merge_denylist_root_sha256`, nested exact +`successor_merge_denylist: PublicationMergeDenylistV1`, +`successor_merge_denylist_root_sha256`, +`publication_branch_ruleset_policy_sha256`, `workflow_root`, nested exact +`premerge_terminal_route: PublicationPreContainmentTerminalRouteV1`, +`premerge_terminal_route_sha256`, `premerge_terminal_event_type`, +`merge_won_terminal_event_type`, `created_at`, and +`terminal_containment_intent_sha256`. The expected OID equals +`source_authority_parent_oid`; the successor denylist is the one legal append containing this +matching containment entry. Exactly one nested source/digest pair is nonnull and byte-equals that +entry. The ordinary pair is an exact `no_pr|closed` disposition and the ambiguity pair is the exact +failure set. The nested route has the same source kind/digest and its duplicated digest and premerge +event recompute. The merge-won event is uniquely phase-derived: initial complete maps to +`RESULT_MERGE_INVALIDATED`, initial invalid-prefix to +`INVALID_PREFIX_MERGE_INVALIDATED`, and correction to +`CORRECTION_INVALIDATED` with `publication_outcome=merged_invalid`. The two event +fields cannot be caller-selected. The preflight repeats the same source pair, identity and ruleset root; +`containment_main_oid` equals its protected-main OID. CAS admission rechecks that ruleset +and denies any later constructive dispatch. The intent contains no accepted mutation receipt, new authority OID, queue +observation, fence run, broker finality, or terminal-event field. Its domain is +`laconian-publication-terminal-containment-intent-v1\n`, omitting only its final digest. + +Every field named `containment_authority_mutation_receipt` in this specification is the same exact +join, never a generic campaign-event receipt. It is +`AuthorityMutationReceiptV1(mutation_kind="campaign_event", +event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED")`; its event digest names the exact start +event that nests this intent and its signed containment-start prefix pair, and its candidate commit +and observed-after OIDs both equal `containment_authority_oid`. Its predecessor/successor +publication denylist roots equal the intent's predecessor/successor roots, and its predecessor/ +successor active containment roots are exactly `null -> terminal_containment_intent_sha256`. +Start-event `occurred_at` equals both signed start-prefix observation times and is no later than the +receipt `started_at <= completed_at`. Every post-CAS read, dequeue, rerun, timeline query, barrier +dispatch, fence attachment and terminal-finality observation occurs at or after receipt completion. +Identity, expected old/source OID, transition number, event member manifest and duplicated receipt +digest all recompute. A receipt for another event, candidate, root transition, intent or time order +is invalid everywhere, including through a nested barrier, fenced record or merge-won object. + +`PublicationMergeQueueObservationV1` has exactly +`schema_version="PublicationMergeQueueObservationV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, +`operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, +`observation_phase="after_intent_pre_action"|"after_action_first"|"after_action_second"`, +`observation_stage="containment_pre_action"|"containment_first"|"containment_second"`, +`containment_snapshot_ordinal=0|1|2`, +positive `observation_ordinal`, positive `pull_request_number`, +`repository_node_id`, positive `repository_database_id`, `pull_request_node_id`, +`pull_request_state="open"|"closed"|"merged"`, +`merged`, nullable `merged_at`, nullable `merge_oid`, `base_oid`, `head_oid`, +`observed_main_oid`, nullable nested exact `merge_queue_entry`, +`graphql_document_sha256`, `graphql_variables_sha256`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `response_status=200`, +`graphql_errors=[]`, `raw_response_sha256`, +`canonical_response_sha256`, nested exact `raw_response_blob`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, `observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `merge_queue_observation_sha256`. Phase, stage and snapshot are a literal bijection: +`after_intent_pre_action/containment_pre_action/0`, +`after_action_first/containment_first/1`, or +`after_action_second/containment_second/2`; no cross-product is valid. A nonnull +queue entry has exactly `entry_id`, `merge_queue_id`, `enqueued_at`, +`state="AWAITING_CHECKS"|"LOCKED"|"MERGEABLE"|"QUEUED"|"UNMERGEABLE"`, +nullable `base_commit_oid`, nullable `head_commit_oid`, nonnegative `position`, +`jump`, and `solo`; null means that exact PR is not a queue member. The full +`pull_request_state="merged"` iff `merged=true`, `merged_at` and `merge_oid` are nonnull; open or +closed requires `merged=false` and both fields null. `repository_database_id` byte-equals the sealed +numeric `repository_id`; the opaque node ID is preserved separately. `raw_response_blob` has exactly `path`, `sha256`, and `raw_bytes_base64`; +decoded bytes reproduce `raw_response_sha256`, and path is +`publication-merge-queue/.response`. Identity, +operation/key/ordinals, request, token subject and times byte-equal the nested dispatch receipt. The +separately inventoried terminal wrapper points one-way to this observation digest in +`source_observation_sha256`; the observation does not name the wrapper, so the graph is acyclic. +Signature and record domains are +`laconian-publication-merge-queue-observation-signature-v1\n` and +`laconian-publication-merge-queue-observation-v1\n`; the signature preimage omits exactly +the signature and final digest and the record digest omits exactly the final digest. + +The observation is the decoded and signed result of exactly one `POST /graphql` whose +UTF-8 query bytes are C0-frozen as: + +~~~graphql +query PublicationMergeQueueState($owner:String!,$repo:String!,$number:Int!){repository(owner:$owner,name:$repo){id databaseId ref(qualifiedName:"refs/heads/main"){target{... on Commit{oid}}} pullRequest(number:$number){id number state merged mergedAt mergeCommit{oid} baseRefOid headRefOid mergeQueueEntry{id enqueuedAt state position jump solo baseCommit{oid} headCommit{oid} mergeQueue{id}}}}} +~~~ + +Variables are exactly `{owner: nonempty ASCII GitHub owner, repo: nonempty ASCII GitHub +repository name, number: integer 1..2^31-1}`; no other variable, field or fragment is legal. +Repository/PR IDs, ref OID, state/merge and queue projections are total mappings from that one +response. A missing PR, null repository/ref, GraphQL error, malformed/partial body or inconsistent +OID fails the read and cannot become an observation. + +`PublicationMergeQueueInventoryPageReceiptV1` has exactly +`schema_version="PublicationMergeQueueInventoryPageReceiptV1"`, the full publication +identity, `observation_scope="pre_containment"|"post_containment"`, nullable +`source_kind`, nullable `source_sha256`, nullable +`terminal_containment_intent_sha256`, nullable `containment_authority_oid`, nullable +`successor_merge_denylist_root_sha256`, +`operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, +`observation_stage="pre_containment"|"post_containment_pre_action"| +"post_containment_first"|"post_containment_second"`, `snapshot_ordinal=0|1|2`, +`inventory_pass_ordinal=1|2`, positive `page_ordinal`, nullable `after_cursor`, +`graphql_document_sha256`, `graphql_variables_sha256`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `response_status=200`, +`graphql_errors=[]`, `repository_node_id`, positive +`repository_database_id`, `observed_main_oid`, `merge_queue_id`, +nonnegative `total_count`, `has_next_page`, nullable `end_cursor`, +`position_base=0|1`, ordered nested exact +`entries: PublicationMergeQueueInventoryEntryV1`, `raw_response_sha256`, +`canonical_response_sha256`, nested exact `raw_response_blob`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, `observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `inventory_page_receipt_sha256`. Each +`PublicationMergeQueueInventoryEntryV1` has exactly +`schema_version="PublicationMergeQueueInventoryEntryV1"`, +`entry_id`, `enqueued_at`, `state`, nonnegative +`position`, `jump`, `solo`, nullable `base_commit_oid`, +nullable `head_commit_oid`, `pull_request_node_id`, positive +`pull_request_number`, `pull_request_state="open"|"closed"|"merged"`, +`merged`, nullable `merged_at`, nullable `merge_oid`, +`base_ref_name`, `base_ref_oid`, `head_ref_name`, +`head_ref_oid`, nullable `head_commit_message_sha256`, nullable +`head_commit_trailer`, `body_sha256`, and `canonical_entry_sha256`. +Pre-containment requires source fields nonnull, all post-CAS fields null, its namesake stage and +`snapshot_ordinal=0`. Post-containment requires the reverse: pre-action maps to zero, first to one +and second to two. Operation key/scope distinguish the two ordinal-zero reads. +The GraphQL `databaseId` field is nullable on the wire. Rollout nevertheless requires it to +be a positive integer equal to the sealed numeric `repository_id`; null is an explicit +unsupported-platform failure, never substituted with the opaque node ID. +Null head commit requires both message fields null and makes that entry affected but ineligible for +a barrier until a later complete page resolves it. A nonnull head commit preserves the exact +message hash and projects the one canonical Laconian trailer or null; the raw page proves parsing. + +The fixed UTF-8 query is: + +~~~graphql +query PublicationMainMergeQueue($owner:String!,$repo:String!,$after:String){repository(owner:$owner,name:$repo){id databaseId ref(qualifiedName:"refs/heads/main"){target{... on Commit{oid}}} mergeQueue(branch:"main"){id entries(first:100,after:$after){totalCount pageInfo{hasNextPage endCursor} nodes{id enqueuedAt state position jump solo baseCommit{oid} headCommit{oid message} pullRequest{id number state merged mergedAt mergeCommit{oid} baseRefName baseRefOid headRefName headRefOid body}}}}}} +~~~ + +Variables are exactly `{owner,repo,after}`, with `after=null` on page one and +the prior nonnull end cursor thereafter. Repository/ref/queue/pageInfo and every node/PR are nonnull; +the nullable database ID is subject to the rollout gate above. Page ordinals and cursors are +gapless, total count is constant, the final page has `hasNextPage=false`, and aggregate +cardinality equals total count. Within a pass, entry IDs and PR node IDs/numbers are independently +unique, positions are unique and exactly the contiguous interval +`position_base..position_base+total_count-1` in aggregate queue order, and the base is the +single value frozen by the pilot and policy root. Every raw page is archived; +null/inconsistent pagination fails closed. The page signature preimage is +`UTF8("laconian-publication-merge-queue-inventory-page-signature-v1\n") || +CanonicalJSONV1(page without exactly broker_signature_base64url and +inventory_page_receipt_sha256)`; the record digest uses +`laconian-publication-merge-queue-inventory-page-v1\n` and omits exactly its final digest. + +`PublicationMergeQueueInventoryObservationV1` has exactly +`schema_version="PublicationMergeQueueInventoryObservationV1"`, the same scope/source-or- +intent identity, `observation_stage`, `snapshot_ordinal=0|1|2`, +`inventory_pass_count=2`, positive `pages_per_pass`, positive `page_count`, +`position_base=0|1`, ordered nested exact +`pages: PublicationMergeQueueInventoryPageReceiptV1`, ordered exact +`all_entries: PublicationMergeQueueInventoryEntryV1`, ordered `affected_entry_ids`, +`publication_merge_denylist_root_sha256`, `observed_main_oid`, +`canonical_inventory_state_sha256`, `raw_archive_root_sha256`, `observed_at`, and +`inventory_observation_sha256`. Pages satisfy the complete chain above, are ordered by +`(inventory_pass_ordinal,page_ordinal)`, +`page_count=2*pages_per_pass`, and form two independently complete passes. Their operation +identity, stage, snapshot, key, policy root and position base are byte-equal. The second pass begins +only after every first-pass request terminates. Each pass produces exactly the same ordered +`all_entries` canonical bytes, total count, main OID, queue ID, final cursor semantics and +canonical inventory digest; otherwise no observation exists. The published `all_entries` +array is that common typed aggregate, with a bijection to every page member of either pass and no +extra or omitted entry. Affected IDs are the exact entry subset selected by the denylist's frozen +OR predicate; filtering never removes entries from the archive. A pre-containment observation uses +the already constructed candidate successor denylist root containing the source entry, not the +installed predecessor root. Entry selectors derive only from plan/source evidence that precedes +preflight; newly discovered PR numbers/nodes remain preflight/barrier evidence and do not +retroactively rewrite the entry. `raw_archive_root_sha256` is SHA-256 of +`UTF8("laconian-publication-merge-queue-inventory-raw-archive-v1\n")` followed by the +length-prefixed decoded raw page bytes in canonical page order. The entry domain is +`laconian-publication-merge-queue-inventory-entry-v1\n` and the observation domain is +`laconian-publication-merge-queue-inventory-observation-v1\n`; each omits exactly its +own final digest. + +`PublicationMergeQueueTimelinePageReceiptV1` has exactly +`schema_version="PublicationMergeQueueTimelinePageReceiptV1"`, the full publication +identity, `terminal_containment_intent_sha256`, `containment_authority_oid`, +positive `pull_request_number`, `pull_request_node_id`, +`operation_kind="terminal_merge_barrier_read"`, `operation_idempotency_key`, +positive `credential_attempt_ordinal`, positive `operation_request_ordinal`, +positive `page_ordinal`, nullable `after_cursor`, +`graphql_document_sha256`, `graphql_variables_sha256`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `response_status=200`, +`graphql_errors=[]`, nonnegative `total_count`, `has_next_page`, +nullable `end_cursor`, ordered nested exact `events`, +`raw_response_sha256`, `canonical_response_sha256`, nested exact +`raw_response_blob`, `publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `timeline_page_receipt_sha256`. Events are +a strict discriminated union. Every member has `event_kind="added_to_merge_queue"| +"removed_from_merge_queue"|"merged"`, `event_node_id`, `occurred_at`, +nullable nested exact `actor` and `canonical_event_sha256`; actor, when present, +has exactly `typename` and nullable `login`, matching the fixed query without an invented node ID. +Added has nonnull +`queue_id` and every remove/merge-only field null. Removed has nullable wire +`queue_id`, nullable `before_commit_oid`, nullable `reason` and all +merge-only fields null. Merged has null queue/before/reason, nullable `commit_oid`, nullable +`merge_ref_name`. A removal selected as causal barrier +evidence additionally requires a nonnull actor login, queue ID, reason and an exact earlier matching +added event with the same queue ID; a +merge selected for failed admission requires nonnull commit OID. + +The fixed query is: + +~~~graphql +query PublicationPRMergeQueueTimeline($owner:String!,$repo:String!,$number:Int!,$after:String){repository(owner:$owner,name:$repo){databaseId pullRequest(number:$number){id timelineItems(first:100,after:$after,itemTypes:[ADDED_TO_MERGE_QUEUE_EVENT,REMOVED_FROM_MERGE_QUEUE_EVENT,MERGED_EVENT]){totalCount pageInfo{hasNextPage endCursor} nodes{__typename ... on AddedToMergeQueueEvent{id createdAt actor{__typename login} mergeQueue{id}} ... on RemovedFromMergeQueueEvent{id createdAt actor{__typename login} beforeCommit{oid} mergeQueue{id} reason} ... on MergedEvent{id createdAt actor{__typename login} commit{oid} mergeRefName}}}}}} +~~~ + +Variables/cursor rules and dispatch-wrapper bijection are identical to one complete inventory pass; +page/cardinality mismatch fails closed. The page signature is over +`UTF8("laconian-publication-merge-queue-timeline-page-signature-v1\n") || +CanonicalJSONV1(page without exactly broker_signature_base64url and +timeline_page_receipt_sha256)`, and the record domain is +`laconian-publication-merge-queue-timeline-page-v1\n` omitting only its final digest. +`PublicationMergeQueueTimelineReceiptV1` has exactly +`schema_version="PublicationMergeQueueTimelineReceiptV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, positive +`pull_request_number`, `pull_request_node_id`, +`operation_kind="terminal_merge_barrier_read"`, `operation_idempotency_key`, +positive `credential_attempt_ordinal`, positive `page_count`, ordered nested exact +`page_receipts: PublicationMergeQueueTimelinePageReceiptV1`, ordered nested exact +`events`, `pagination_complete=true`, `raw_archive_root_sha256`, +`observed_at`, and `timeline_receipt_sha256`. Pages/cursors are gapless and +every page repeats those exact identity/key/PR fields. The aggregate preserves all three event kinds +in API order and is a bijection to all page members. `raw_archive_root_sha256` is SHA-256 of +`UTF8("laconian-publication-merge-queue-timeline-raw-archive-v1\n")` followed by the +length-prefixed decoded raw page bytes in page order. A delivery-ambiguous dequeue or failed-fence +removal is causally settled only by an exact added→post-action removed pair for that PR/queue, +followed by two global inventories with no affected entry; a merged event routes failed admission. +The selected pair's queue IDs, actor login and removal reason are nonnull and equal where +applicable; no other timeline event may be silently discarded. Its domain is +`laconian-publication-merge-queue-timeline-receipt-v1\n`, omitting exactly its final digest. + +`PublicationMergeQueueDequeueTargetProofV1` has exactly +`schema_version="PublicationMergeQueueDequeueTargetProofV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, nested exact +`pre_action_queue_observation: PublicationMergeQueueObservationV1( +observation_phase="after_intent_pre_action")`, +`pre_action_queue_observation_sha256`, positive `target_pull_request_number`, +`target_pull_request_node_id`, `target_merge_queue_entry_id`, positive +`action_ordinal`, `constructed_at`, and `dequeue_target_proof_sha256`. The +observation is unmerged with a nonnull entry; every PR/node/entry/head/intent/CAS field byte-equals +the proof and current active authority/denylist read. It contains no dispatch, action outcome, +barrier or finality root. Its domain is +`laconian-publication-merge-queue-dequeue-target-proof-v1\n`, omitting only its digest. + +`PublicationMergeQueueDequeueAttemptV1` has exactly +`schema_version="PublicationMergeQueueDequeueAttemptV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, +`operation_kind="terminal_merge_barrier_dequeue"`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `operation_request_ordinal`, positive `ordinal`, +`client_mutation_id`, `request_id`, +`dispatch_state="not_dispatched"|"dispatched"`, `method="POST"`, +`endpoint_template="/graphql"`, `graphql_document_sha256`, +`graphql_variables_sha256`, `request_payload_sha256`, +nested exact `target_authorization_proof: PublicationMergeQueueDequeueTargetProofV1`, +`target_authorization_proof_sha256`, +positive `target_pull_request_number`, `target_pull_request_node_id`, nullable +`target_merge_queue_entry_id`, +`outcome="not_dispatched"|"dequeued_exact"|"delivery_ambiguous"|"definite_rejection"`, +nullable `response_status`, nullable `graphql_errors_sha256`, nullable +`returned_client_mutation_id`, nullable `returned_merge_queue_entry_id`, nullable +`returned_pull_request_node_id`, nullable positive `returned_pull_request_number`, nullable +`raw_response_sha256`, nullable `canonical_response_sha256`, nullable nested exact +`raw_response_blob`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1( +operation_kind="terminal_merge_barrier_dequeue")`, `transport_receipt_sha256`, and +`merge_queue_dequeue_attempt_sha256`. `dequeued_exact` requires dispatch, +status 200, the canonical empty-error hash, echoed client mutation ID, exact returned entry/PR +node/number and nonnull archived raw/canonical response hashes. Every dispatched attempt has a +nonnull target entry ID. `delivery_ambiguous` covers response loss with null status/response fields +and any received response not proving exact success or definite pre-mutation rejection; received +bytes and their blob/hash are nonnull. Definite rejection is only a class-bound pre-mutation +401/403/404 and archives its body. HTTP 200 with errors, null/partial data or identity mismatch is +delivery-ambiguous and never definite. The raw blob has exactly `path`, `sha256` and +`raw_bytes_base64`, and all response/status/hash fields byte-equal the generic terminal transport +receipt. The +client mutation ID recomputes solely from this record's intent, PR node and ordinal. Its domain is +`laconian-publication-merge-queue-dequeue-attempt-v1\n`, omitting only its final digest. +The nested target proof digest byte-equals the generic dispatch/terminal wrapper +`target_authorization_proof_sha256` and all duplicated target fields. A not-dispatched attempt still +preserves the proof but has no start receipt. + +The dequeue mutation UTF-8 bytes are C0-frozen as: + +~~~graphql +mutation PublicationDequeue($id:ID!,$clientMutationId:String!){dequeuePullRequest(input:{id:$id,clientMutationId:$clientMutationId}){clientMutationId mergeQueueEntry{id enqueuedAt state position jump solo baseCommit{oid} headCommit{oid} mergeQueue{id} pullRequest{id number}}}} +~~~ + +Variables are exactly `{id: target_pull_request_node_id, clientMutationId: +"publication-dequeue/" + lowercase_hex(SHA256(UTF8("publication-dequeue-v1") || BYTE(0x00) || +HEXDECODE(terminal_containment_intent_sha256) || BYTE(0x00) || +UTF8(target_pull_request_node_id) || BYTE(0x00) || U64BE(ordinal)))}`. The ID is the PullRequest node ID required by +`DequeuePullRequestInput.id`, never the queue-entry ID. Query and mutation bodies are +canonical RFC 8785 `{query,variables}` JSON with content type +`application/json` and no batching. Every request has append-before-send and one terminal +receipt; malformed/partial bodies are archived and fail closed. + +Required-check fence evidence is a closed typed aggregate rather than a bag of response blobs. +`PublicationMergeFenceWorkflowRunObservationV1` has exactly `schema_version`, the full publication +identity, intent/CAS/denylist roots, operation key/credential/request ordinals, +`evidence_kind="rerun_source_success"|"post_containment_fence_failure"`, +`workflow_run_id`, positive `run_attempt`, positive `check_suite_id`, frozen workflow +path/ref/commit/blob/root, +`event="merge_group"`, `action="checks_requested"`, `merge_group_ref`, base/head OIDs, ordered +exact one-member PR identity, `status="completed"`, `conclusion="success"|"failure"`, requested/started/ +completed times, actor/triggering-actor identities, method/endpoint/request IDs and times, +`response_status=200`, canonical/raw response hashes and blob, credential subject and dispatch receipt, signing +identity/signature, and `workflow_run_observation_sha256`. +The workflow response is the sole source of `check_suite_id`; a caller-provided suite or run ID is +invalid. + +`PublicationMergeFenceCheckRunPageReceiptV1` has exactly `schema_version`, the same full +publication/evidence/authority/operation identity, positive `workflow_run_id`, positive +`run_attempt`, positive `check_suite_id`, `attempt_kind="fence_check_run_page"`, positive gapless +`page_ordinal`, `per_page=100`, nonnegative `total_count`, nullable validated previous/next Link, +ordered nested exact +`check_runs: PublicationCheckRunProjectionV1`, method/endpoint/request/times, +`response_status=200`, canonical/raw response hashes and blob, credential subject, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, signing identity/signature, and +`fence_check_run_page_receipt_sha256`. The endpoint is exactly +`GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs?check_name=laconian%2Fpublication-pr-validate&filter=all&per_page=100&page={page_ordinal}`. + +`PublicationMergeFenceCheckRunDiscoveryV1` has exactly `schema_version`, the same full +publication/evidence/authority identity, `workflow_run_id`, `run_attempt`, `check_suite_id`, +`merge_group_head_oid`, Actions App ID/slug, `check_name="laconian/publication-pr-validate"`, +operation key/credential ordinal, positive `page_count`, ordered nested exact +`pages: PublicationMergeFenceCheckRunPageReceiptV1`, ordered distinct positive +`matching_check_run_ids`, positive `selected_check_run_id`, `raw_archive_root_sha256`, +`observed_at`, and `check_run_discovery_sha256`. The suite ID byte-equals the authenticated +workflow-run response. Page one dispatches only after the workflow-run source record and terminal +wrapper exist; every later page dispatches only after its predecessor wrapper. Complete signed Link +pagination archives every returned run in that suite, all page counts equal the final enumerated +length, and the direct selected-run read starts only after discovery completes; +exactly one run may match the merge-group head, Actions App, check name and evidence-kind-derived +terminal conclusion. That unique ID is selected. Zero or multiple matches, capped/repeated pages, +an unarchived run or a cross-origin Link fails closed. Response-derived suite/run IDs may +parameterize only serialized continuation requests under the already authority-derived aggregate +key; they never enter a mint request or operation key. + +`PublicationMergeFenceCheckRunObservationV1` has the same authority/operation/evidence coordinates, +nested exact `check_run_discovery: PublicationMergeFenceCheckRunDiscoveryV1`, +`check_run_discovery_sha256`, the selected positive check-suite/check-run IDs, Actions App ID/slug, +`name="laconian/publication-pr-validate"`, the same merge-group head OID, +`status="completed"`, `conclusion="success"|"failure"`, `started_at`, `completed_at`, `external_id`, nullable +`decision_artifact_sha256_from_output`, exact direct-GET pre-dispatch/raw archive/signature fields, +and +`check_run_observation_sha256`. The workflow/check run attempt, group/PR/head and conclusion agree; +suite/run IDs byte-equal the discovery selection, and +`workflow.requested_at <= workflow.started_at <= check.started_at <= check.completed_at <= +workflow.completed_at`. +Source-success requires +both conclusions `success`, the exact source-time predicate below, and a null decision +digest. Fence-failure requires both conclusions `failure`; the check output contains exactly the +lowercase selected decision digest in the frozen field and no alternative digest. A direct +`GET /repos/{owner}/{repo}/check-runs/{check_run_id}` is legal only after complete discovery and +only for its selected ID. + +`PublicationMergeFenceArtifactPageReceiptV1` has exactly `schema_version`, the same authority and +operation identity, positive `workflow_run_id`, positive `run_attempt`, positive gapless +`page_ordinal`, `per_page=100`, nullable validated previous/next Link, nonnegative `total_count`, ordered exact +artifact entries, method/endpoint/request/times, `response_status=200`, canonical/raw response hashes and blob, +credential subject/dispatch receipt, signing identity/signature, and +`artifact_page_receipt_sha256`. Each +`PublicationMergeFenceArtifactEntryV1` has exactly +`schema_version="PublicationMergeFenceArtifactEntryV1"`, positive `artifact_id`, `node_id`, `name`, +nonnegative `size_in_bytes`, `expired=true|false`, `created_at`, `expires_at`, +`archive_download_url`, and `artifact_entry_sha256`. Complete signed Link pagination inventories +every artifact for this run; count, IDs, ordering and archive root recompute, and missing/capped/ +repeated/cross-origin pages fail closed. + +`PublicationMergeFenceArtifactRedirectReceiptV1` has exactly `schema_version`, the full evidence +identity, positive `artifact_id`, `archive_format="zip"`, operation coordinates, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1( +attempt_kind="workflow_artifact_redirect")`, `operation_request_dispatch_receipt_sha256` for authenticated +`GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip`, `response_status=302`, +`authorization_header_present_on_api_request=true`, `location_url_sha256`, parsed +`location_host`, `location_path_sha256`, `location_query_sha256`, `location_expires_at`, +`redirect_count=1`, `raw_location_exported=false`, `response_body_sha256` for the exact empty/bounded body, terminal time, signing +identity/signature, and `artifact_redirect_receipt_sha256`. Location host must match the frozen +GitHub Actions artifact-object-store allowlist, the location digest is computed inside the broker +without persisting the pre-signed query, expiry must exceed the next dispatch plus skew, and +userinfo, fragment, non-HTTPS, IP literals, private/link-local targets and extra redirects are +forbidden. This record contains no terminal transport wrapper/digest or evidence-set digest. + +`PublicationMergeFenceArtifactArchiveReceiptV1` has exactly `schema_version`, the same evidence +identity and artifact ID, nested exact redirect receipt/digest, a distinct signed object-store +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1( +attempt_kind="workflow_artifact_archive")`, `operation_request_dispatch_receipt_sha256`, +`method="GET"`, exact validated location digest, +`authentication_kind="none"`, `authorization_header_present=false`, `cookie_header_present=false`, +`redirect_follow_count=0`, positive `maximum_archive_bytes`, observed content length, +`response_status=200`, `content_type="application/zip"`, `zip_sha256`, nested exact bounded raw ZIP +blob, dispatch/completion times, signing identity/signature, and `artifact_archive_receipt_sha256`. +The publisher token is stripped before the cross-origin request; the signed broker operation +projection still inventories this credential-free follow as `workflow_artifact_archive`, while no +vault token is attached to its wire headers. Size overrun, range/chunk mismatch, redirect or host +change fails before extraction. This record contains no terminal transport wrapper/digest; the +token/App fields in its append-before-send receipt are provenance only. + +`PublicationMergeFenceArtifactExtractionReceiptV1` has exactly `schema_version`, the same identity, +artifact/archive digests, frozen limits for entry count, total uncompressed bytes, per-entry bytes, +compression ratio, path depth and filename bytes, ordered exact ZIP-member inventory, +`selected_path="publication-merge-fence/decision.json"`, `selected_json_sha256`, nested exact +`decision_artifact: PublicationMergeFenceDecisionArtifactV1`, `decision_artifact_sha256`, +`extracted_at`, signing identity/signature, and `artifact_extraction_receipt_sha256`. Extraction is +one fd-relative no-follow pass into a new private directory; absolute/traversal/backslash/NUL or +non-NFC paths, duplicates after normalization/case-folding, links, devices, encryption, unsupported +methods, bad CRC/size, nested archives and every unexpected selected-path multiplicity fail closed. +The selected canonical JSON bytes reproduce both decision digests. + +`PublicationMergeFenceArtifactInventoryV1` has exactly `schema_version`, the same identity/run, +ordered nested exact pages, page/archive roots, ordered distinct `candidate_artifact_ids`, +`expired_candidate_count=0`, ordered nested exact redirect/archive/extraction receipts for every +candidate artifact, positive `selected_artifact_id`, +`selected_decision_artifact_sha256`, `observed_at`, and `artifact_inventory_sha256`. Candidate IDs +are the complete ascending projection of every paginated entry whose exact name is +`laconian-publication-merge-fence-decision`, including expired entries; validity therefore requires +that every such entry is nonexpired. Every candidate is downloaded and safely inspected; exactly +one extracted decision matches the full campaign/intent/CAS/run-attempt/ +group/PR/App/context identity and the check-output digest. Zero matches, two matches, a divergent +candidate, an expired candidate, an omitted download or an extra receipt fails closed. + +`PublicationMergeFenceEvidenceSetV1` has exactly `schema_version`, the full identity, +`evidence_kind="rerun_source_success"|"post_containment_fence_failure"`, +`containment_authority_mutation_receipt_sha256`, nested exact +`workflow_run_observation: PublicationMergeFenceWorkflowRunObservationV1`, +`workflow_run_observation_sha256`, nested exact +`check_run_observation: PublicationMergeFenceCheckRunObservationV1`, +`check_run_observation_sha256`, nullable nested exact +`artifact_inventory: PublicationMergeFenceArtifactInventoryV1`, nullable +`artifact_inventory_sha256`, nullable nested exact +`decision_artifact: PublicationMergeFenceDecisionArtifactV1`, nullable +`decision_artifact_sha256`, ordered exact `transport_wrapper_sha256s`, +`raw_archive_root_sha256`, `observed_at`, and `fence_evidence_set_sha256`. +The mutation-receipt digest byte-equals the exact accepted containment-start receipt resolved at +`containment_authority_oid` and later nested by the barrier; an evidence set without that join is +invalid. Source-success requires both observations to carry the source-success kind, terminal success and +each source workflow/check `completed_at < containment_authority_mutation_receipt.started_at` for +the exact accepted start receipt; both artifact pairs and the check-output decision digest are +null. Their later GET dispatch/completion and evidence-set `observed_at` may be at or after that +receipt's `completed_at`: those times authenticate immutable old success and are not execution +times. It makes no tombstone-decision claim. Fence-failure requires both observations to carry the +failure kind/conclusion, all four artifact fields nonnull, and the selected extracted decision/ +check-output digest to reproduce an authority read at or after the same receipt's `completed_at`. +No mixed arm is valid. + +For every signed HTTP source record `R` among the workflow-run observation, fence check-run page, +check-run observation, artifact page, artifact redirect and artifact archive, with respect to +generic operation-lifecycle receipts `R` nests its append-before-send +`PublisherOperationRequestDispatchReceiptV1 D` and no terminal wrapper or evidence set. It may +nest only the class-bound local prerequisites named by its own schema. The unique later +`PublisherOperationTransportReceiptV1 T` nests that same `D`, byte-equals the request/status/times/ +raw hash and points one-way with `T.source_observation_sha256` equal to `R`'s recomputed named final +digest. `R` never names `T`. +`transport_wrapper_sha256s` is the exact request-order bijection of those wrappers. Extraction and +inventory are local descendants with no transport wrapper. Thus the only edge order is +`D -> R -> T -> evidence set`; every raw body and ZIP is archived once. `observed_at` is the maximum +authenticated/extraction time. All duplicated run/check/group/PR/authority/decision fields and the +check-output/inventory/decision digests are byte-equal. Its domain is +`laconian-publication-merge-fence-evidence-set-v1\n`, omitting only its digest. + +The evidence signature and record domains are literal: + +| Type | Signature domain | Record domain | +|---|---|---| +| `PublicationMergeFenceWorkflowRunObservationV1` | `laconian-publication-merge-fence-workflow-run-observation-signature-v1\n` | `laconian-publication-merge-fence-workflow-run-observation-v1\n` | +| `PublicationMergeFenceCheckRunPageReceiptV1` | `laconian-publication-merge-fence-check-run-page-receipt-signature-v1\n` | `laconian-publication-merge-fence-check-run-page-receipt-v1\n` | +| `PublicationMergeFenceCheckRunObservationV1` | `laconian-publication-merge-fence-check-run-observation-signature-v1\n` | `laconian-publication-merge-fence-check-run-observation-v1\n` | +| `PublicationMergeFenceArtifactPageReceiptV1` | `laconian-publication-merge-fence-artifact-page-receipt-signature-v1\n` | `laconian-publication-merge-fence-artifact-page-receipt-v1\n` | +| `PublicationMergeFenceArtifactRedirectReceiptV1` | `laconian-publication-merge-fence-artifact-redirect-receipt-signature-v1\n` | `laconian-publication-merge-fence-artifact-redirect-receipt-v1\n` | +| `PublicationMergeFenceArtifactArchiveReceiptV1` | `laconian-publication-merge-fence-artifact-archive-receipt-signature-v1\n` | `laconian-publication-merge-fence-artifact-archive-receipt-v1\n` | +| `PublicationMergeFenceArtifactExtractionReceiptV1` | `laconian-publication-merge-fence-artifact-extraction-receipt-signature-v1\n` | `laconian-publication-merge-fence-artifact-extraction-receipt-v1\n` | + +For every table row, the signature preimage is `UTF8(signature-domain) || +CanonicalJSONV1(record without exactly broker_signature_base64url and the row's final digest)`; the +record digest is `SHA256(UTF8(record-domain) || CanonicalJSONV1(record without exactly its final +digest))`, including the verified signature. The signing fields are literally +`broker_signing_identity` and `broker_signature_base64url`. Record-only domains are +`PublicationMergeFenceCheckRunDiscoveryV1` -> +`laconian-publication-merge-fence-check-run-discovery-v1\n`, +`PublicationMergeFenceArtifactInventoryV1` -> +`laconian-publication-merge-fence-artifact-inventory-v1\n`, +`PublicationMergeFenceArtifactEntryV1` -> +`laconian-publication-merge-fence-artifact-entry-v1\n`, and the evidence-set domain above. Each +record-only type hashes canonical JSON omitting exactly its named final digest. No inferred +capitalization transform, generic standard omission or domain alias is valid. + +`PublicationMergeFenceRerunTargetProofV1` has exactly +`schema_version="PublicationMergeFenceRerunTargetProofV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, +`workflow_path=".github/workflows/publication-pr-validate.yml"`, `workflow_ref`, +`workflow_commit_oid`, `workflow_blob_sha256`, `workflow_root`, positive +`workflow_run_id`, positive `source_run_attempt`, `event="merge_group"`, +`action="checks_requested"`, `merge_group_ref`, `merge_group_base_oid`, +`merge_group_head_oid`, positive `pull_request_number`, `pull_request_node_id`, +`pull_request_head_oid`, `actions_app_id`, `actions_app_slug`, +`check_name="laconian/publication-pr-validate"`, nested exact +`source_run_evidence_set: PublicationMergeFenceEvidenceSetV1( +evidence_kind="rerun_source_success")`, +`source_run_evidence_set_sha256`, +`observed_at`, and `rerun_target_proof_sha256`. The signed read receipts/blobs +inside the evidence set form a complete bijection to the authenticated run/check-discovery reads +and prove the exact +one-PR merge group, frozen workflow, App/context and prior run. The source run/check IDs, suite, +attempt, group/head/PR/App/context and authenticated workflow-run repository ID byte-equal the +target fields and the full identity's `repository_id`; both source completions are strictly before +the accepted containment mutation receipt's `started_at`, while their later evidence reads may +complete after that receipt. It contains no post-CAS failed-fence artifact, rerun dispatch or +outcome. Its domain is `laconian-publication-merge-fence-rerun-target-proof-v1\n`, +omitting only its digest. + +`PublicationMergeFenceRerunAttemptV1` records every authorized rerun attempt, including failures. +It has exactly `schema_version="PublicationMergeFenceRerunAttemptV1"`, the full publication +identity, intent/CAS/denylist roots, `operation_kind="terminal_merge_fence_rerun"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, nested exact +`target_proof: PublicationMergeFenceRerunTargetProofV1`, `target_proof_sha256`, positive +`workflow_run_id`, positive `source_run_attempt`, positive `expected_run_attempt`, +`dispatch_state="not_dispatched"|"dispatched"`, nullable nested exact +`dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, nullable +`dispatch_receipt_sha256`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1( +operation_kind="terminal_merge_fence_rerun")`, `transport_receipt_sha256`, +`outcome="not_dispatched"|"rerun_accepted_201"|"delivery_ambiguous"|"definite_rejection"`, +nullable `response_status`, nullable `safe_response_sha256`, `recorded_at`, and +`rerun_attempt_sha256`. Target fields byte-equal the proof, workflow run is the original target, +and `expected_run_attempt=source_run_attempt+1` without overflow. Not-dispatched has null dispatch +pair and response fields; every dispatched member has the exact append-before-send dispatch pair. +Accepted requires status 201 and a closed safe response; ambiguity covers response loss or a +received response that cannot prove rejection/no-effect; definite rejection is only authenticated +pre-effect 401/403/404. A later required-fence receipt may select only an accepted attempt and must +then authenticate that exact expected attempt; attempts before it remain inventoried and none may +dispatch after the selected accepted attempt. Its domain is +`laconian-publication-merge-fence-rerun-attempt-v1\n`, omitting only its digest. + +`PublicationRequiredMergeFenceRunReceiptV1` has exactly +`schema_version="PublicationRequiredMergeFenceRunReceiptV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, +`workflow_path=".github/workflows/publication-pr-validate.yml"`, `workflow_ref`, +`workflow_commit_oid`, `workflow_blob_sha256`, `workflow_root`, +positive `workflow_run_id`, positive `run_attempt`, positive +`check_suite_id`, positive `check_run_id`, `actions_app_id`, +`actions_app_slug`, `check_name="laconian/publication-pr-validate"`, +`event="merge_group"`, `action="checks_requested"`, +`merge_group_ref`, `merge_group_base_oid`, `merge_group_head_oid`, +positive `pull_request_number`, `pull_request_node_id`, +`pull_request_head_oid`, `trigger_kind="new_merge_group"|"authorized_rerun"`, +nullable nested exact +`selected_rerun_attempt: PublicationMergeFenceRerunAttemptV1`, nullable +`selected_rerun_attempt_sha256`, +`requested_at`, `started_at`, +`completed_at`, `status="completed"`, `conclusion="failure"`, +`decision="denied_by_publication_merge_denylist"`, `observed_authority_ref`, +`observed_authority_oid`, positive `observed_transition_number`, +`observed_active_publication_terminal_containment_root`, +`observed_merge_denylist_root_sha256`, `decision_authority_read_at`, nested exact +`fence_evidence_set: PublicationMergeFenceEvidenceSetV1( +evidence_kind="post_containment_fence_failure")`, `fence_evidence_set_sha256`, +`decision_artifact_sha256`, `request_receipts_root_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and +`required_merge_fence_run_receipt_sha256`. The merge group contains exactly this one PR. +`PublicationMergeFenceDecisionArtifactV1` has exactly `schema_version`, the full publication +identity, workflow/run/group/PR identity, every `observed_*` field above, +`decision_authority_read_at`, `decision`, `created_at`, and `decision_artifact_sha256`; its domain is +`laconian-publication-merge-fence-decision-artifact-v1\n`. Its extracted archive path and bytes are +the frozen member named by the evidence set; the set's typed run/check discovery/page/redirect/ +archive records and ordered request root form the exact response/wrapper/raw-archive bijection. +The evidence workflow response's repository ID equals the full identity's `repository_id`, its +suite/run IDs equal the complete discovery selection, and `request_receipts_root_sha256` is the +canonical ordered root of `fence_evidence_set.transport_wrapper_sha256s`. +For `new_merge_group`, both selected-rerun-attempt fields are null and +`run_attempt=1`; original request/start may precede the CAS. For +`authorized_rerun`, the exact selected `PublicationMergeFenceRerunAttemptV1( +outcome="rerun_accepted_201")`/digest is nonnull, selects +`POST /repos/{owner}/{repo}/actions/runs/{workflow_run_id}/rerun`, proves a 201 terminal response +under the C0-frozen `actions:write` row, and dispatches after the CAS; +the original `requested_at` may predate the CAS but `started_at` is not before rerun dispatch. The +receipt `workflow_run_id` equals the attempt's original target run and +`run_attempt=selected_rerun_attempt.expected_run_attempt= +selected_rerun_attempt.source_run_attempt+1`; the fresh evidence set independently authenticates +that exact new attempt, check, artifact and decision. Target proof and dispatch/transport fields +recompute for this frozen workflow, event/action, one-PR merge-group SHA, App/context and original +run; caller-selected run IDs or adoption of a later retry are invalid. In both cases +`decision_authority_read_at` is at or after the containment CAS and before +decision/check completion, and the observed authority OID +equals that CAS OID or a descendant preserving the same active-containment and denylist roots. The +evidence set's selected decision artifact reproduces every `observed_*` field. A skipped, neutral, +cancelled, stale, success, unauthorized/pre-CAS rerun, wrong-App/context/workflow or multi-PR check +is invalid. Signature and record domains are +`laconian-publication-required-merge-fence-run-signature-v1\n` and +`laconian-publication-required-merge-fence-run-receipt-v1\n`. Its signature preimage omits exactly +`broker_signature_base64url` and `required_merge_fence_run_receipt_sha256`; its record digest +omits exactly only `required_merge_fence_run_receipt_sha256` and includes the verified signature. + +`PublicationTerminalMergeSnapshotV1` has exactly +`schema_version="PublicationTerminalMergeSnapshotV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, +`barrier_scope="all_candidates"|"residual_unmerged_after_merge_won"`, ordered distinct +`excluded_merged_candidate_pull_request_numbers`, `snapshot_ordinal=1|2`, nested exact +`protected_main_observation: PublicationProtectedMainObservationV1`, +`protected_main_observation_sha256`, nested exact +`marker_discovery: PublicationPRMarkerDiscoveryV1`, +`marker_discovery_sha256`, nested exact +`merge_queue_inventory: PublicationMergeQueueInventoryObservationV1( +observation_scope="post_containment")`, `merge_queue_inventory_sha256`, ordered distinct positive +`candidate_pull_request_numbers`, ordered nested exact +`queue_observations: PublicationMergeQueueObservationV1`, ordered matching +`queue_observation_sha256s`, `all_denied_queue_entries_absent=true`, +`all_candidates_unmerged=true`, `observed_main_oid`, +`canonical_external_snapshot_sha256`, `observed_at`, and +`snapshot_sha256`. For all-candidates scope the excluded array is empty. For residual scope it is +the exact merged-candidate number array from the enclosing merge-won evidence and those candidates +are omitted from every unmerged/queue-absence assertion, but retained in the signed source +archives. Candidates are otherwise the sorted union of preflight, source, prior action +observations, this complete fresh marker discovery and every denylist-affected global inventory +entry; each has exactly one queue observation, and +the array is empty iff that union is empty. Every queue observation has a null entry and an unmerged +PR. The global inventory may retain unrelated entries but has an empty `affected_entry_ids` array. +Snapshot ordinal byte-equals its inventory ordinal and maps protected-main/queue observation phase +to `post_action_first`/`after_action_first` or `post_action_second`/`after_action_second`. +The protected-main observation supplies the OID even when there are no candidates. Snapshot two +begins only after every snapshot-one request terminates. The two canonical external digests exclude +only receipt/request/time fields and byte-equal. `observed_at` is the maximum authenticated source +time of its main observation, marker discovery, complete inventory and every queue observation; it +is not caller-selected. Its domain is +`laconian-publication-terminal-merge-snapshot-v1\n`, omitting only its final digest. + +`PublicationMainFirstParentCommitV1` has exactly +`schema_version="PublicationMainFirstParentCommitV1"`, nested exact +`commit_observation: PublicationMainCommitObservationV1`, +`commit_observation_sha256`, `commit_oid`, ordered +`parent_oids`, `committed_at`, `message_sha256`, nullable +`merge_commit_laconian_trailer`, ordered nested exact `associated_pull_requests`, +positive `selected_merged_pull_request_number`, nested exact +`selected_head_commit_observation: PublicationHeadCommitObservationV1`, +`selected_head_commit_observation_sha256`, and `canonical_commit_sha256`. Each PR +member has exactly positive `number`, `node_id`, +`state="open"|"closed"`, `merged`, nullable `merged_at`, nullable +`merge_commit_oid`, `base_ref_name`, `base_oid`, `head_ref_name`, +`head_oid`, nullable `pull_request_marker`, and `canonical_pr_sha256`. +Every commit requires exactly two distinct parent OIDs, as proved by the rollout's one-entry +`MERGE`-queue protection contract, and exactly one selected member with `merged=true`, +nonnull merged time, `merge_commit_oid=commit_oid`, protected main as base and all complete +identity fields; zero or multiple candidates fail closed. The selected head OID binds an already +archived exact head-commit read whose canonical trailer is tested against the successor denylist. +The merge commit trailer is preserved separately and never substituted for the publication +head-commit trailer. A single-parent, octopus, direct-push, squash/rebase or otherwise +nonconforming main-advance member is a protection-bypass failure, never an unrelated safe advance. +Its domain is +`laconian-publication-main-first-parent-commit-v1\n`, omitting exactly its final digest. + +`PublicationMainCommitObservationV1` is one signed step in the separately reconstructed main +first-parent walk. It has exactly `schema_version="PublicationMainCommitObservationV1"`, the full +publication identity, `terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, `observation_stage="containment_advance"`, `commit_oid`, +`method="GET"`, `endpoint_template="/repos/{owner}/{repo}/git/commits/{commit_oid}"`, +`request_url`, `request_id`, `request_dispatched_at`, `response_completed_at`, +`response_status=200`, `observed_commit_oid`, ordered `parent_oids`, `tree_oid`, `committed_at`, +`message_sha256`, nullable `merge_commit_laconian_trailer`, `canonical_response_sha256`, +`raw_response_sha256`, nested exact `raw_response_blob`, `publisher_credential_subject_sha256`, +nested exact `request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, `observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `main_commit_observation_sha256`. Observed and requested OIDs +are equal and every commit field is the total authenticated Git-object projection. Raw bytes are +archived; dispatch/transport wrappers and signature bind the same identity/key/ordinal/time. Its +signature and record domains are `laconian-publication-main-commit-observation-signature-v1\n` and +`laconian-publication-main-commit-observation-v1\n` with exact signed-record omissions. The +enclosing semantic commit byte-equals this observation's OID/parents/time/message/trailer. + +`PublicationHeadCommitObservationV1` is the immutable selected-PR head read. It has exactly +`schema_version="PublicationHeadCommitObservationV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `classifying_main_commit_oid`, positive +`selected_merged_pull_request_number`, `head_oid`, +`operation_kind="terminal_merge_barrier_read"`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `operation_request_ordinal`, +`observation_stage="containment_advance"`, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/git/commits/{head_oid}"`, `request_url`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `response_status=200`, +`observed_commit_oid`, ordered `parent_oids`, `tree_oid`, `message_sha256`, ordered nested exact +`parsed_trailers`, nullable `selected_publication_head_commit_trailer`, +`canonical_response_sha256`, `raw_response_sha256`, nested exact `raw_response_blob`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, `observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `head_commit_observation_sha256`. The observed OID equals +`head_oid`; parents/tree/message are total projections of the immutable Git commit response. +Each parsed trailer has exactly `ordinal`, `key`, and `value` and is the complete canonical +`git interpret-trailers --parse` equivalent over the authenticated message bytes. The selected +trailer is null only when neither Laconian publication/correction trailer exists; otherwise it is +the unique exact `Laconian-Publication-Attempt: ...` or `Laconian-Correction-ID: ...` line. +Duplicates, both classes, invalid UTF-8/control bytes or parse disagreement fail closed. Raw bytes +are archived and every request/identity/time field byte-equals the signed dispatch/transport +wrapper. Its signature and record domains are +`laconian-publication-head-commit-observation-signature-v1\n` and +`laconian-publication-head-commit-observation-v1\n` with the exact signed-record omissions. +The enclosing first-parent commit nests this exact object for its selected PR head, and all +commit/PR/head/trailer fields byte-equal; the successor denylist independently tests this selected +trailer rather than the main merge commit message. + +`PublicationMainComparePageReceiptV1` has exactly `schema_version`, the full +publication identity, `terminal_containment_intent_sha256`, +`containment_authority_oid`, `operation_kind="terminal_merge_barrier_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, +`page_kind="compare"|"commit_pull_requests"`, nullable `commit_oid`, positive +`page_ordinal`, `method="GET"`, `endpoint_template`, +`request_url`, `request_id`, `request_dispatched_at`, +`response_completed_at`, `response_status=200`, nullable `previous_link`, +nullable `next_link`, `raw_response_sha256`, +`canonical_response_sha256`, nested exact `raw_response_blob`, +`publisher_credential_subject_sha256`, nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, +`operation_request_dispatch_receipt_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `main_compare_page_receipt_sha256`. Compare +maps only to `/repos/{owner}/{repo}/compare/{from_oid}...{to_oid}` and has null commit; +PR classification maps only to `/repos/{owner}/{repo}/commits/{commit_oid}/pulls`. +Both use complete signed Link pagination and archive every member/body. Signature and record domains +are `laconian-publication-main-compare-page-signature-v1\n` and +`laconian-publication-main-compare-page-receipt-v1\n`. The signature preimage is its signature +domain plus `CanonicalJSONV1(record without exactly broker_signature_base64url and +main_compare_page_receipt_sha256)`; the record digest is its record domain plus +`CanonicalJSONV1(record without exactly main_compare_page_receipt_sha256)`, including the verified +signature. + +`PublicationMainAdvanceCompareReceiptV1` has exactly `schema_version`, the same +identity/intent/CAS/from/to OIDs, `compare_status="ahead"`, +`merge_base_oid`, positive `ahead_by`, `behind_by=0`, positive +`total_commits`, ordered distinct `compare_commit_oids`, ordered nested exact +`pages: PublicationMainComparePageReceiptV1`, ordered nested exact +`first_parent_commits: PublicationMainFirstParentCommitV1`, +`raw_archive_root_sha256`, `observed_at`, and +`main_advance_compare_receipt_sha256`. Compare pages enumerate every commit in GitHub's complete +comparison result, including side-branch commits; their canonical OID projection byte-equals +`compare_commit_oids`. `ahead_by=total_commits=len(compare_commit_oids)` after complete +`per_page=100&page=n` pagination. The distinct first-parent array is reconstructed by authenticated +`PublicationMainCommitObservationV1` GETs walking from `to_main_oid` through parent index zero back +to `from_main_oid`, with a finite bound of `ahead_by`, no cycle and no skipped OID; it is never +claimed equal to the compare list. In forward order, the first member's first parent equals +`from_main_oid`, every later member's first parent equals the prior `commit_oid`, and the last +member equals `to_main_oid`. Every walk member has exactly two parents, one complete commit-PR page +chain and an exact selected head-commit observation; any other parent cardinality or missing +classification fails as a protection bypass. Missing/capped pagination, +non-ahead status, ancestry gaps or an unclassified merge commit fails closed. Its domain is +`laconian-publication-main-advance-compare-receipt-v1\n`. + +`PublicationContainmentMainAdvanceProofV1` has exactly +`schema_version="PublicationContainmentMainAdvanceProofV1"`, the full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`from_main_oid`, `to_main_oid`, nested exact +`compare_receipt: PublicationMainAdvanceCompareReceiptV1`, +`compare_receipt_sha256`, ordered nested exact `first_parent_commits`, ordered +`intervening_merge_pull_request_numbers`, ordered +`intervening_merge_commit_oids`, `all_intervening_merges_unaffected=true`, +`no_affected_merged_event=true`, `observed_at`, and +`main_advance_proof_sha256`. The signed compare is exactly +`ahead`; the commit array is the complete first-parent path from the containment baseline +exclusive to the post-action OID inclusive and is byte-for-byte equal, in the same order, to +`compare_receipt.first_parent_commits`; the outer array is not an independently selectable copy. +Every intervening merge is class-bound to a PR and +fails every denylist selector independently across PR node ID, number, same-repository branch, head +OID, canonical marker and the selected head-commit trailer. A missing body/head classification or +zero/multiple selected merge PRs fails closed. Force-push, deletion, unknown ancestry or an affected +merge fails closed. +Its domain is `laconian-publication-containment-main-advance-proof-v1\n`. + +`PublisherBarrierCredentialDispositionSetV1` is the acyclic credential prefix consumed by +the barrier. It has exactly `schema_version="PublisherBarrierCredentialDispositionSetV1"`, +the same full publication identity, +`terminal_containment_intent_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, positive `disposition_count`, ordered nested +exact `dispositions: PublisherOperationCredentialDispositionV1`, +nested exact `broker_phase_ledger_prefix: +PublisherBrokerPhaseLedgerPrefixV1(prefix_purpose="barrier_complete")`, +`broker_phase_ledger_prefix_sha256`, nested exact +`vault_audit_log_prefix: BrokerVaultAuditPrefixV1(prefix_purpose="barrier_complete")`, +`vault_audit_log_prefix_sha256`, +`outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, `observed_at`, +nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and +`publisher_barrier_credential_dispositions_root_sha256`. Count equals array length. Members +are the complete canonical-rank-ordered set of every +`terminal_merge_barrier_read|terminal_merge_barrier_dequeue|terminal_merge_fence_rerun` +credential attempt from source-bound preflight through barrier completion, including denial, +permission mismatch, unknown mint, read abort and retry. Every request/page/action used by +preflight or barrier maps to exactly one member and there is no extra member. The ledger/vault roots +end at the latest member closure and recompute zero open requests/dispatches/live tokens. This +prefix references no barrier, attachment, final disposition set or sealed ledger. Its signature and +record domains are +`laconian-publisher-barrier-credential-disposition-set-signature-v1\n` and +`laconian-publisher-barrier-credential-disposition-set-v1\n` with the exact signed-record +omission rules. +The nested barrier prefix pair has byte-identical identity and `barrier_complete` purpose; its vault +pair digest equals the ledger-prefix digest, duplicated roots/counts/time recompute, and the outer +zero counters equal both prefixes. + +`PublicationTerminalMergeBarrierV1` has exactly +`schema_version="PublicationTerminalMergeBarrierV1"`, the full publication identity, +nested exact `terminal_containment_intent: PublicationTerminalContainmentIntentV1`, +`terminal_containment_intent_sha256`, nested exact +`containment_authority_mutation_receipt: AuthorityMutationReceiptV1( +mutation_kind="campaign_event",event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED")`, +`containment_authority_mutation_receipt_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `containment_main_oid`, +`barrier_scope="all_candidates"|"residual_unmerged_after_merge_won"`, ordered distinct +`excluded_merged_candidate_pull_request_numbers`, nested exact +`pre_action_queue_inventory: PublicationMergeQueueInventoryObservationV1( +observation_scope="post_containment",observation_stage="post_containment_pre_action", +snapshot_ordinal=0)`, +`pre_action_queue_inventory_sha256`, ordered nested exact +`pre_action_queue_observations: PublicationMergeQueueObservationV1( +observation_phase="after_intent_pre_action",containment_snapshot_ordinal=0)`, ordered nested +exact `dequeue_attempts: PublicationMergeQueueDequeueAttemptV1`, ordered nested exact +`fence_rerun_attempts: PublicationMergeFenceRerunAttemptV1`, ordered nested exact +`fence_runs: PublicationRequiredMergeFenceRunReceiptV1`, ordered nested exact +`timeline_receipts: PublicationMergeQueueTimelineReceiptV1`, ordered nested exact +`candidate_actions`, nested exact +`first_post_action_snapshot: PublicationTerminalMergeSnapshotV1( +snapshot_ordinal=1,barrier_scope=barrier_scope)`, +nested exact +`second_post_action_snapshot: PublicationTerminalMergeSnapshotV1( +snapshot_ordinal=2,barrier_scope=barrier_scope)`, +ordered distinct positive `candidate_pull_request_numbers`, +`barrier_method="already_clear"|"dequeue"|"fresh_failed_required_run"| +"dequeue_and_fence"`, `all_pre_action_entries_accounted=true`, +`all_denied_queue_entries_absent=true`, `all_candidates_unmerged=true`, +`main_delta="unchanged"|"unrelated_descendant"`, nullable nested exact +`main_advance_proof: PublicationContainmentMainAdvanceProofV1`, nullable +`main_advance_proof_sha256`, `main_safe=true`, +`future_enqueue_requires_new_merge_group=true`, +`canonical_external_snapshot_sha256`, +nested exact +`publisher_barrier_credential_disposition_set: PublisherBarrierCredentialDispositionSetV1`, +`publisher_barrier_credential_dispositions_root_sha256`, `recorded_at`, and +`terminal_merge_barrier_sha256`. + +`all_candidates` is the premerge branch. `residual_unmerged_after_merge_won` is legal only when the +containment preflight recorded `merge_observed`; its candidate arrays exclude exactly the immutable +merged-candidate set named by the enclosing merge-won evidence and include every remaining affected +identity. A zero-residual barrier is still constructed from the two complete global snapshots. +For all-candidates scope the barrier exclusion array and both snapshot exclusion arrays are empty. +For residual scope all three arrays byte-equal the enclosing merge-won evidence's exact merged-PR +array. The barrier candidate array, pre-action inventory affected projection, pre-action queue +observations, both snapshot candidate arrays and candidate actions are byte-identical sorted +complements of that exclusion within the complete affected set. Pre-action queue observations form +an exact PR-order bijection to that projection and every member has stage +`containment_pre_action`, snapshot ordinal zero and `after_intent_pre_action`; no post-action read +can justify `already_absent`. +Each candidate action has exactly `pull_request_number`, +`pre_action_queue_observation_sha256`, ordered `dequeue_attempt_sha256s`, nullable +`selected_dequeue_attempt_sha256`, ordered `fence_rerun_attempt_sha256s`, nullable +`selected_fence_run_receipt_sha256`, nullable `timeline_receipt_sha256`, +nullable `selected_fence_trigger_kind="new_merge_group"|"authorized_rerun"`, +nullable `selected_removal_event_sha256`, nullable `selected_action_resolution_sha256`, and +`action_resolution="already_absent"|"dequeued_exact"|"removed_after_response_loss"| +"removed_after_failed_fence"`. Candidate actions partition the global dequeue-attempt, +fence-rerun-attempt, accepted-fence and timeline arrays by PR; each digest appears exactly once and +no attempt/run/timeline is missing or extra. The union is closed: `already_absent` requires a null +pre-action entry, both attempt arrays empty and every selected/timeline field null. `dequeued_exact` +requires a nonempty dequeue array whose selected member is the unique exact `dequeued_exact` +attempt and has no fence selection. `removed_after_response_loss` requires a selected +`delivery_ambiguous` dequeue plus nonnull timeline/causal removal and no fence selection. +`removed_after_failed_fence` requires exactly one selected fresh post-CAS failed required-validator +receipt, a nonnull trigger kind byte-equal to that receipt's `trigger_kind`, and a nonnull +timeline/selected causal removal pair after that +failure and before both post-action snapshots. Exactly one trigger arm holds. `new_merge_group` +requires `run_attempt=1`, null selected-rerun object/digest in the selected run, and no selected +rerun attempt in this action; its rerun-attempt array may contain only earlier nondecisive attempts +for other old run/group identities and none may target the selected new run. `authorized_rerun` +requires the selected run's exact nonnull +`PublicationMergeFenceRerunAttemptV1(outcome="rerun_accepted_201")` digest to occur exactly once in +this action's nonempty rerun-attempt array and requires `run_attempt=source_run_attempt+1` with full +target/source-evidence equality. Dequeue attempts in either arm are empty or end in a recorded +delivery ambiguity. Every other action has a null trigger. Earlier +no-mint/not-dispatched/rejection/ambiguous attempts remain in order; no action attempt may dispatch +after the first decisive exact dequeue or selected accepted fence. `selected_action_resolution_sha256` +is the domain-separated digest of the selected attempt, trigger, fence, timeline and removal tuple +and is null only for `already_absent`. If no decisive resolution +exists, the barrier is unconstructible and its complete attempt prefix remains failure evidence. +`already_clear` means every action is already +absent; `dequeue` means at least one confirmed/causally settled dequeue and no fence; +`fresh_failed_required_run` the inverse; the combined method has both. Fence presence is determined +by a selected failed-fence receipt in either trigger arm, never merely by an accepted rerun. A delivery-ambiguous action +requires its selected timeline removal before both later global inventories. The two snapshots have equal main OIDs, +marker/candidate semantics and canonical external state. `unchanged` requires that OID equal +`containment_main_oid` and both advance-proof fields null; `unrelated_descendant` +requires a nonnull recomputed proof to the common post-action OID. A zero-candidate barrier is proved by two +signed protected-main observations plus two zero-match marker discoveries, never by a free boolean. +Any newly merged affected candidate not already present in the residual scope's exact exclusion +array, or any unsafe/unknown main change, forbids this schema and routes through +exact merge-won/failed-admission evidence or fails closed. The queue `LOCKED` entry must remain observable until exact dequeue, +failed required-check removal or completed merge; rollout is unsupported unless the pilot +establishes that contract. The barrier domain is +`laconian-publication-terminal-merge-barrier-v1\n`, omitting only its final digest. +`recorded_at` equals the nested barrier-disposition-set `observed_at` and is not before either +snapshot time or any selected dequeue, timeline or fence completion time. + +The broker exposes three containment-scoped publisher rows. Their operation names, sorted +permission arrays, endpoint sets and target constraints are byte-for-byte the literal broker matrix +in section 7.6; this local summary cannot narrow or widen them. The barrier-read row is legal for +the source-bound preflight and for intent/CAS-bound post-action reads, the dequeue row only for the +fixed mutation and broker-derived proof, and the rerun row only for the exact authenticated frozen +workflow/run/group/App/context proof. Dequeue and rerun are +legal only after the accepted containment CAS. The pilot must prove those exact GitHub-App installation permissions work; a broader +admin or contents-write grant is invalid. Each credential is minted only after the persistent +tombstone CAS, except the explicitly source-bound read-only preflight credential. Requests are gapless and serialized: ordinal `n+1` cannot dispatch before +ordinal `n` has a terminal receipt. A mint followed by executor abort before the first or +next request still closes as a signed minted-and-closed read-abort disposition with zero open +requests and no synthesized observation; terminalization requires a later fresh attempt that +constructs the barrier or observes `merge_won`. + +Containment operation keys are broker-derived, never caller-selected. Here `LP(x)` is +U32BE byte length followed by exact UTF-8 bytes, an absent value is the empty string, and stage ranks +are preflight=1, pre-action=2, action=3, first=4, second=5, advance=6. A barrier-read key is exactly +`"publication-containment-read/" + lowercase_hex(SHA256( +UTF8("laconian-publication-containment-read-key-v1\n") || +LP(source_or_intent_sha256) || LP(containment_authority_oid_or_empty) || U8(stage_rank) || +U8(snapshot_ordinal_or_zero) || LP(logical_aggregate_class) || LP(canonical_target)))`. Preflight uses the source +digest and empty authority; every post-CAS read uses the intent digest and containment authority. +`canonical_target` is computed before mint and before the aggregate's first request as +`/` plus lowercase hex SHA-256 of +`UTF8("laconian-publication-containment-target-v1\n")`, then the following exact LP fields: + +| Aggregate class | Exact authority-known LP field sequence | +|---|---| +| `protected_main` | `repository_id`, literal `refs/heads/main` | +| `marker_discovery` | `pull_request_marker` | +| `queue_pr` | zero-padded 20-digit affected PR number | +| `queue_inventory` | `repository_id`, literal `refs/heads/main`, barrier scope | +| `queue_timeline` | zero-padded 20-digit affected PR number | +| `fence_evidence` | source workflow-run ID, source run attempt, frozen workflow-blob digest, Actions App ID, literal check name, merge-group head OID, affected PR number | +| `main_advance` | containment baseline OID, authenticated current-run OIDC SHA | + +Intent/source digest, authority OID, stage/snapshot and class remain in the outer operation-key +preimage. Queue/entry node IDs, check-suite/run IDs, artifact IDs/URLs and archive digests are +response-derived and appear only in signed observations/pages; none enters this target or changes +the aggregate key. A main-advance token is minted only after the current-run SHA is authenticated; +its first protected-main read must equal that SHA or the aggregate aborts. +`logical_aggregate_class` is one of `protected_main`, `marker_discovery`, `queue_pr`, +`queue_inventory`, `queue_timeline`, `fence_evidence`, or `main_advance`; it and target are constant +for the complete logical aggregate. Request attempt kind, observation round, inventory pass and page +are deliberately excluded from the operation key and are bound only by each append-before-send/ +terminal wrapper. Thus every page/round of one aggregate shares one key/disposition and different +aggregate/stage/target scopes cannot collide. +The class/source-to-coordinate map is literal: protected-main `pre_containment`, +`post_action_first`, `post_action_second` map to `containment_preflight/0`, +`containment_first/1`, `containment_second/2`; queue-PR `after_intent_pre_action`, +`after_action_first`, `after_action_second` map to `containment_pre_action/0`, +`containment_first/1`, `containment_second/2`; inventory `pre_containment`, +`post_containment_pre_action`, `post_action_first`, `post_action_second` map to +`containment_preflight/0`, `containment_pre_action/0`, `containment_first/1`, +`containment_second/2`. Timeline and fence evidence use `containment_action` with null snapshot; +compare/main/head commit reads use `containment_advance` with null snapshot. No other +class/stage/snapshot triple is valid. +A dequeue key is exactly +`"publication-containment-dequeue/" + lowercase_hex(SHA256( +UTF8("laconian-publication-containment-dequeue-key-v1\n") || +HEXDECODE(dequeue_target_proof_sha256) || U64BE(action_ordinal)))`. A rerun key is exactly +`"publication-containment-rerun/" + lowercase_hex(SHA256( +UTF8("laconian-publication-containment-rerun-key-v1\n") || +HEXDECODE(rerun_target_proof_sha256) || U64BE(source_run_attempt + 1)))`. Every credential request, +subject, dispatch/transport receipt, action schema and disposition recomputes the applicable key, +target-proof digest and coordinates. Any different target, free key or cross-stage reuse is denied +before mint or dispatch. + +`PublisherWriteAmbiguityFenceAttachmentV1` has exactly +`schema_version="PublisherWriteAmbiguityFenceAttachmentV1"`, the same full publication +identity, `write_ambiguity_set_sha256`, +`terminal_containment_intent_sha256`, +`containment_authority_mutation_receipt_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `terminal_merge_barrier_sha256`, +`publisher_barrier_credential_dispositions_root_sha256`, positive `subject_count`, +ordered `write_ambiguity_subject_sha256s`, ordered +`source_credential_disposition_sha256s`, +nested exact `pre_attachment_broker_phase_ledger_prefix: +PublisherBrokerPhaseLedgerPrefixV1(prefix_purpose="pre_fence_attachment")`, +`pre_attachment_broker_phase_ledger_root_sha256`, nested exact +`pre_attachment_vault_audit_prefix: +BrokerVaultAuditPrefixV1(prefix_purpose="pre_fence_attachment")`, +`pre_attachment_vault_audit_log_root_sha256`, `observed_authority_oid`, positive +`observed_transition_number`, `observed_active_publication_terminal_containment_root`, +`observed_publication_merge_denylist_root_sha256`, `authority_observed_at`, +`outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, +`canonical_external_state_claimed=false`, `admission_authorized=false`, +`release_authorized=false`, `attached_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and +`publisher_write_ambiguity_fence_attachment_sha256`. Count/subject array byte-equal the +ambiguity set. The source-disposition array is aligned one-for-one; duplicates are legal when +several lost requests share one credential disposition, and each subject's source disposition, +operation/key/credential/request/transport tuple recomputes. The authority read follows the barrier +and observes the same active intent and permanent denylist. The pre-attachment broker root is +exactly the just-appended `terminalizing -> terminal_reconciling` transition; the attachment +names no attachment-ledger entry or final set. Its signature and record domains are +`laconian-publisher-write-ambiguity-fence-attachment-signature-v1\n` and +`laconian-publisher-write-ambiguity-fence-attachment-v1\n` with exact signed-record +omissions. +The nested pre-attachment prefix pair has byte-identical identity and +`pre_fence_attachment` purpose; its vault pair digest equals the ledger-prefix digest, duplicated +roots/counts/time recompute, and the attachment zero counters equal both prefixes. + +`PublicationFencedWriteAmbiguityV1` has exactly +`schema_version="PublicationFencedWriteAmbiguityV1"`, the full publication identity, +`terminal_route="initial_complete_premerge"|"initial_invalid_premerge"| +"correction_premerge"`, `terminal_event_type`, nested exact +`write_ambiguity_set: PublicationWriteAmbiguitySetV1`, +`write_ambiguity_set_sha256`, nested exact +`terminal_containment_intent: PublicationTerminalContainmentIntentV1( +containment_kind="write_ambiguity")`, `terminal_containment_intent_sha256`, nested exact +`containment_authority_mutation_receipt: AuthorityMutationReceiptV1( +mutation_kind="campaign_event",event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED")`, +`containment_authority_mutation_receipt_sha256`, nested exact +`successor_merge_denylist: PublicationMergeDenylistV1`, +`successor_merge_denylist_root_sha256`, nested exact +`terminal_merge_barrier: PublicationTerminalMergeBarrierV1`, +`terminal_merge_barrier_sha256`, nested exact +`publisher_write_ambiguity_fence_attachment: +PublisherWriteAmbiguityFenceAttachmentV1`, +`publisher_write_ambiguity_fence_attachment_sha256`, nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1( +finality_status="write_ambiguity_fenced_sealed")`, +`publisher_credential_disposition_set_sha256`, nested exact +`release_authorization_ledger_snapshot: +PublicationReleaseAuthorizationLedgerSnapshotV1`, +`release_authorization_ledger_root_sha256`, nullable `merge_observation_sha256`, +`delivery_ambiguity=true`, `late_external_effects_possible=true`, +`canonical_external_state_claimed=false`, `admission_authorized=false`, +`release_authorized=false`, `outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, nullable +`no_later_effects_root_sha256`, `recorded_at`, and +`fenced_write_ambiguity_sha256`. + +`terminal_event_type` is exact and route-derived: +`initial_complete_premerge -> PERMANENT_STOP`, +`initial_invalid_premerge -> INVALID_PUBLICATION_PLAN_INVALIDATED`, and +`correction_premerge -> CORRECTION_INVALIDATED`; it byte-equals the intent's nested route and is +not caller-selectable. All three routes require the exact established +`PublicationTerminalMergeBarrierV1`, a null merge +observation and a null no-later root. If preflight or barrier work observes a merge/main change, this +schema is forbidden; the exact ambiguity/containment roots instead extend the phase-specific +`PostMergeAdmissionFailureV1` and route to `RESULT_MERGE_INVALIDATED`, +`INVALID_PREFIX_MERGE_INVALIDATED`, or correction `merged_invalid`. The release-ledger snapshot has identical +scope, an empty entry array and zero authorization/mint/dispatch counts. `recorded_at` +equals the sealed publisher-set time and signed empty release-ledger time and is not before barrier +time. This record is forbidden from every ordinary delivery resolution, +`reconciliation_sourced_zero_effect`, `PublicationNoLaterEffectsEvidenceV1`, +`PublicationSuccessFinalityEvidenceV1`, successful merge admission, release preparation, +documentation and social authority. Its domain is +`laconian-publication-fenced-write-ambiguity-v1\n`, omitting only its final digest. + +The normative hash DAG is acyclic through the final disposition set: ambiguity-source dispatch/terminal/ +closure receipts → source dispositions → ambiguity subjects/set → preflight read receipts and +closed dispositions → preflight → denylist and intent → accepted containment CAS → post-CAS +receipts/observations/actions → their closed dispositions → complete barrier-disposition subset → +barrier → `terminalizing -> terminal_reconciling` prefix → fence attachment → attachment ledger +entry → sealed ledger/vault → final disposition set. It then has exactly two disjoint suffixes. +Premerge is final set → fenced ambiguity record → premerge finality → terminal authority event. +Merge-won is final set → `PublicationContainmentMergeWonEvidenceV1` → merge-won finality → +`PostMergeAdmissionFailureV1` → phase-exact merge-invalidation event; no fenced ambiguity record is +constructed on that suffix. +A barrier naming a final set, attachment naming its own ledger/final set, subject disposition naming +the subject/set, or any reverse digest is invalid. +Every ambiguity/intent/CAS/denylist/barrier/subset root duplicated by the applicable fenced record +or merge-won evidence, attachment and final set is byte-equal. Attachment subjects are the exact ordered projection of the outer +ambiguity set; aligned source dispositions are exactly the final set's +`write_delivery_ambiguous` members. The barrier prefix is the exact canonical subset of the final +set, with no extra/missing source or containment member. + +`PublicationContainmentMergedCandidateV1` has exactly +`schema_version="PublicationContainmentMergedCandidateV1"`, positive +`pull_request_number`, `pull_request_node_id`, `pull_request_marker`, +`pull_request_url`, `observed_base_oid`, `head_oid`, `merge_oid`, `merged_at`, +`observed_main_oid`, ordered +distinct `source_observation_sha256s`, ordered distinct +`conflicting_publication_object_sha256s`, and `merged_candidate_sha256`. Sources +are a nonempty exact subset of preflight, queue, marker, timeline and protected-main observations +whose authenticated fields agree. Conflicting objects are preserved, never selected away. Its +domain is `laconian-publication-containment-merged-candidate-v1\n`, omitting its digest. + +`PublicationContainmentMergeWonEvidenceV1` has exactly +`schema_version="PublicationContainmentMergeWonEvidenceV1"`, the full publication identity, +`source_kind="ordinary_terminal_disposition"|"write_ambiguity"`, `source_sha256`, +nested exact +`terminal_containment_intent: PublicationTerminalContainmentIntentV1`, +`terminal_containment_intent_sha256`, nested exact +`containment_authority_mutation_receipt: AuthorityMutationReceiptV1( +mutation_kind="campaign_event",event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED")`, +`containment_authority_mutation_receipt_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, positive `merged_candidate_count`, ordered +nested exact `merged_candidates: PublicationContainmentMergedCandidateV1`, nullable +`selected_merge_won_candidate_sha256`, ordered distinct +`merged_candidate_pull_request_numbers`, nonnegative `residual_candidate_count`, +ordered distinct `residual_candidate_pull_request_numbers`, nested exact +`residual_terminal_merge_barrier: PublicationTerminalMergeBarrierV1( +barrier_scope="residual_unmerged_after_merge_won")`, +`residual_terminal_merge_barrier_sha256`, nullable nested exact +`merge_won_terminal_disposition: PublicationPRTerminalDispositionV1(outcome="already_merged")`, +nullable `merge_won_terminal_disposition_sha256`, nullable nested exact +`publisher_write_ambiguity_fence_attachment: +PublisherWriteAmbiguityFenceAttachmentV1`, nullable +`publisher_write_ambiguity_fence_attachment_sha256`, nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1`, +`publisher_credential_disposition_set_sha256`, +`canonical_external_state_claimed=false`, `admission_authorized=false`, +`release_authorized=false`, `recorded_at`, and +`containment_merge_won_evidence_sha256`. Counts equal array lengths; the two PR arrays are +disjoint and their union is the complete affected candidate set. The residual barrier is required +even at count zero and fences exactly the residual array. Ordinary source requires its exact +original `no_pr|closed` disposition in the intent, a nonnull independently reconstructed merge-won +disposition, a nonnull selected-candidate digest, null attachment pair and stable-or-unavailable +sealed publisher finality. The selected candidate is the deterministic first tuple by authenticated +`merged_at`, then ascending PR number, then merge OID. Its number/node/URL/marker/observed +base/head/merge OID/merged time byte-project exactly into the +`PublicationPRTerminalDispositionV1(outcome="already_merged")`; that disposition's `recorded_at` +equals the selected merged time. No observation from another candidate may fill any field. Write +ambiguity requires the ambiguity set, null ordinary merge-won disposition, a null selected- +candidate digest, nonnull exact attachment pair and `write_ambiguity_fenced_sealed` finality. It preserves every merged +candidate; no selected merge may erase another candidate/conflict. `recorded_at` equals the sealed +publisher-set `observed_at`, is not before the residual barrier time or any candidate `merged_at`, +and, for write ambiguity, is not before attachment `attached_at`. Its domain is +`laconian-publication-containment-merge-won-evidence-v1\n`, omitting its digest. + +`PublicationTerminalContainmentFinalityV1` is the only object that an active-containment +terminal consumer may use. It has exactly +`schema_version="PublicationTerminalContainmentFinalityV1"`, the full publication identity, +`finality_kind="ordinary_premerge"|"write_ambiguity_premerge"|"ordinary_merge_won"| +"write_ambiguity_merge_won"`, `source_kind`, `source_sha256`, nested exact +`terminal_containment_intent: PublicationTerminalContainmentIntentV1`, +`terminal_containment_intent_sha256`, nested exact +`containment_authority_mutation_receipt: AuthorityMutationReceiptV1( +mutation_kind="campaign_event",event_type="PUBLICATION_TERMINAL_CONTAINMENT_STARTED")`, +`containment_authority_mutation_receipt_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `terminal_authority_parent_oid`, nullable +nested exact `terminal_merge_barrier: PublicationTerminalMergeBarrierV1`, nullable +`terminal_merge_barrier_sha256`, nullable nested exact +`fenced_write_ambiguity: PublicationFencedWriteAmbiguityV1`, nullable +`fenced_write_ambiguity_sha256`, nullable nested exact +`merge_won_evidence: PublicationContainmentMergeWonEvidenceV1`, nullable +`merge_won_evidence_sha256`, nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1`, +`publisher_credential_disposition_set_sha256`, `required_terminal_event_type`, +`recorded_at`, and `terminal_containment_finality_sha256`. The source matrix is closed: +`ordinary_premerge|ordinary_merge_won` require +`source_kind=ordinary_terminal_disposition`, while both write-ambiguity kinds require +`source_kind=write_ambiguity`; no cross-pair exists. Premerge ordinary requires the source +disposition, all-candidates barrier and stable/unavailable set, with both +ambiguity/merge pairs null. Premerge ambiguity requires the source set, barrier, exact fenced record +and fenced set, with merge pair null. Either merge-won branch requires only the exact merge-won +pair; direct barrier/fenced pairs are null because they are nested by that evidence. Every +duplicated intent/CAS/denylist/source/finality root recomputes. The terminal parent is the current +containment authority OID or a descendant that byte-preserves active intent and denylist; it is +distinct from `source_authority_parent_oid`. Premerge kinds require +`required_terminal_event_type=terminal_containment_intent.premerge_terminal_event_type`; merge-won +kinds require equality to its `merge_won_terminal_event_type`. +For ordinary premerge, `recorded_at` equals the sealed publisher-set time; for ambiguity premerge it +equals the fenced record time; for either merge-won kind it equals the merge-won evidence time. +Its domain is `laconian-publication-terminal-containment-finality-v1\n`, omitting its digest. + +The normal constructive sibling is `PublicationMergeEligibilityReceiptV1`, with exactly +`schema_version`, the same campaign/registry/publication/attempt/correction/bundle/plan/intent, +`branch_name`, `head_oid`, the same literal `check_context`, +`actor: GitHubAppInstallationIdentityV1(role="publisher")`, positive `check_run_id`, +`status="completed"`, `conclusion="success"`, the same policy and observation roots, +`eligibility_delivery_resolution_sha256`, `request_receipts_root_sha256`, `eligible_at`, and +`publisher_credential_disposition_sha256`, `merge_eligibility_receipt_sha256`. Its domain is +`laconian-publication-merge-eligibility-receipt-v1\n`, omitting only its final digest. The +publisher creates/adopts this preauthorized check on the exact head immediately before PR create; +the credential digest byte-equals the embedded delivery resolution's exact +`PublisherOperationCredentialDispositionV1(operation_kind="merge_eligibility")`, whose token is +closed before any PR-create token may be minted; +the PR receipt and opened event bind it, and post-merge admission proves it was the sole complete- +success check for that App-bound context at merge. Repository provisioning, publication authorization, and every +pre-effect observation instead prove that the sole branch-protection required check is +`laconian/publication-pr-validate` from the frozen GitHub Actions App. The publisher eligibility and +terminal-guard context is distinct protocol evidence consumed by that validator. A terminal guard is a later publisher-App check on the same head/context +and names the eligibility receipt it supersedes exactly when delivery resolution is +`exact_success`; the receipt field is null for `none|conflicting`, while the conflicting resolution +and guard-delivery `superseded_check_run_ids` inventory every actual run/effect. After terminal authority no caller may mint a +new success check. Every attempt and correction uses a distinct head commit whose exact commit +message includes respectively `Laconian-Publication-Attempt: /<20-digit-attempt>` +or `Laconian-Correction-ID: `; intent admission proves that head OID is absent from +the ordered root of all prior terminal publication lineages. A same-head retry is rejected, so a +terminal failure check cannot wedge a later legal replan. + +`schema_version` is exactly `PublicationPRTerminalDispositionV1`; `bundle_kind` is `complete` or +`invalid_prefix`; `outcome` is exactly `no_pr`, `closed`, or `already_merged`. Initial publication +uses a positive canonical `publication_attempt`, null `correction_id`, and an `authority_phase` of `initial_intent`, +`initial_branch_receipt`, `initial_pr_receipt`, or `initial_opened`. The first three phases require +the corresponding `BUNDLE_COLLECTED` or `INVALID_FINALIZED` parent; `initial_opened` requires the +matching `COMPLETE_PUBLICATION_PR_OPEN` or `INVALID_PUBLICATION_PR_OPEN` parent. Correction +publication uses null `publication_attempt`, a nonempty authoritative correction ID, +`bundle_kind=complete`, a +`RELEASE_BLOCKED` or `RELEASED` parent, and phase `correction_intent` or +`correction_publication_receipt`. Every field is present. `branch_receipt_sha256` is null exactly +at `initial_intent` and in both correction phases; it is nonnull in every later initial phase. +`pull_request_receipt_sha256` is nonnull exactly at `initial_pr_receipt`, `initial_opened`, or +`correction_publication_receipt`; response loss may therefore leave it null while exact-marker +discovery independently observes a PR in an earlier authority phase. +`branch_create_delivery_resolution_sha256`, `pr_marker_discovery_sha256`, and +`pr_create_delivery_resolution_sha256` are always the exact nonnull class-bound resolutions for +this intent. `branch_outcome` is exactly `absent`, `exact`, or `conflicting` and equals the branch +resolution. `terminal_guard_set_sha256` is nonnull for `closed`, for `no_pr` with +`branch_outcome=exact|conflicting` or PR delivery status `conflicting`, and for `already_merged` whenever any guard dispatch may have +delivered. It is null for `no_pr` exactly when branch outcome is absent, PR delivery status is +`none`, marker discovery has zero matches, and no guard dispatch occurred; a check/branch/PR +conflict always requires the complete set. It may be null for +`already_merged` only when pre-guard discovery proved the merge and no guard dispatch occurred. +Every nonnull set is fully reconciled and post-write reverified before terminal candidate +construction. `close_delivery_resolution_sha256` is null exactly for `no_pr` and otherwise names +the exact close/merge resolution. +The PR delivery status is `none|conflicting` with null number for `no_pr`; `closed` requires +`exact` with number equal to the disposition. `already_merged` permits `exact` or `conflicting` and +requires the same positive selected merged number. In the conflicting case the selected discovery +match is the deterministic earliest authenticated merge described by the delivery resolution; all +other matches remain conflict evidence and cannot authorize admission or release. + +For `no_pr`, the PR number, node ID, URL, observed base/head, merge OID, close kind, close receipt, +and closed observation are all +null; the phase is `initial_intent`, `initial_branch_receipt`, or `correction_intent`, the create- +delivery resolutions prove no branch or PR request remains ambiguous, and bounded, fully paginated +exact-marker discovery proves zero unique admissible plan PR. Foreign, duplicate, or mismatched +marker matches are not called absent: they are fully inventoried as conflicts and every candidate +head is guarded. A non-absent branch or any conflict additionally requires the complete guard set; +only an absent branch with zero marker matches permits that set null. For `closed`, the PR number is a positive canonical +integer, node ID/URL and observed base/head are nonempty, the merge OID is null, and +`closed_observation_sha256` names the authenticated closed-PR observation. +`close_kind=publisher_closed` additionally requires the exact nonnull publisher-App +`close_receipt_sha256`; `close_kind=observed_already_closed` requires that receipt null and proves +the PR was already closed unmerged before the handler could act. The former requires close +resolution `publisher_close_confirmed|publisher_close_adopted`; the latter requires +`already_closed_no_dispatch`. Both require the exact failed +guard set over every possibly mergeable head; a later reopen cannot pass the required check or +merge because the Actions validator re-reads the persistent denylist, irrespective of the +publisher-App guard context. For +`already_merged`, the same PR identity fields and a lowercase 40-hex observed merge OID are +nonnull, closed observation is null, and close resolution is `merge_won`. If that resolution has a +nonnull prior-close receipt, `close_kind=publisher_closed_then_reopened_merged` and +`close_receipt_sha256` byte-equals it; otherwise both fields are null; +authenticated discovery +proves that this exact PR merged +before close completed. Expected base/head always equal the plan; observed base/head preserve the +authenticated PR even when they differ. `identity_mismatch_predicates` is the canonical schema- +ordered subset of `base_oid_mismatch` and `head_oid_mismatch`, empty exactly when both match, and +must byte-equal the consuming plan-invalidation or failed-admission predicates. The marker and +marker-discovery root are always nonnull and intent-bound. When the guard set is nonnull, the +disposition marker-discovery digest equals its `final_pr_marker_discovery_sha256`, and +`branch_outcome`/observed branch head derive from its exact final branch observation. When the set +is null, they equal the terminal pre-guard observations. For a PR outcome, the discovery match's +number/node/URL/base/head/state/merge tuple byte-equals both final close-resolution observations and +the closed observation or merge-won projection as applicable; no independently valid observation +from another round may be substituted; +`recorded_at` is deterministic canonical whole-second UTC: for `no_pr` it equals the final +`PublicationPRMarkerDiscoveryV1.observed_at`, for `closed` it equals the authenticated current PR +`closed_at` reproduced by the strict closed observation, and for `already_merged` it equals the +authenticated PR `merged_at`. The +class-bound terminal observation in `pr_marker_discovery_sha256` must reproduce that same source +timestamp. Initial complete, initial invalid-prefix, and +correction identities cannot substitute for one another. + +Canonical bytes are RFC 8785 JSON in the exact field set above, UTF-8 without a terminal newline. +The digest is +`SHA256(UTF8("laconian-publication-pr-terminal-disposition-v1\n") || +CanonicalJSONV1(record without exactly publication_pr_terminal_disposition_sha256))`. Missing, +extra, half-null identity groups, mismatched phase/parent/receipt, guessed PR numbers, +uninventoried or unguarded duplicate marker matches, fabricated close effects, and `closed` after a +merge are rejected. `no_pr` or +`closed` may authorize only the +phase-appropriate typed STOP, supplement, plan invalidation, or correction invalidation; +`already_merged` may authorize only the matching typed failed-admission event. The latter event +must embed this exact record and no caller may relabel a merged PR as absent or closed. + +`credential_exposure` is not encoded as generic `security`, `artifact_failure`, or another alias. +For that reason, `CampaignStateSchemaV1` requires a +`CredentialExposureIncidentEvidenceV1` root. Its exact top-level fields are: + +```text +schema_version +campaign_id +incident_id +reason +parent_state +parent_authority_oid +current_state_root +spend_ledger_root +artifact_inventory_root +active_phase_plan_root +unresolved_hold_root +credential_exposure_pending_sha256 +consumed_active_pending_root +terminal_effect_receipts_root +concurrent_protocol_authority_drift_evidence_sha256 +secret_kind +affected_artifacts +scanner_receipt +credential_containment +artifact_quarantine_receipt_sha256 +no_further_campaign_download_receipt_sha256 +publication_pr_terminal_disposition_sha256 +complete_publication_pr_disposition +complete_publication_pr_close_receipt_sha256 +invalid_publication_pr_disposition +invalid_publication_pr_close_receipt_sha256 +detected_at +credential_exposure_incident_evidence_sha256 +``` + +`reason` is exactly `credential_exposure`. `secret_kind` is exactly one of +`openai_api_key`, `state_writer_app_private_key`, `publisher_app_private_key`, +`release_finalizer_app_private_key`, `github_app_installation_token`, `github_oidc_id_token`, +`repository_github_token`, or `unclassified_suspected_credential`; a secret value, matching +substring, authorization header, environment dump, or raw provider/GitHub response is forbidden. +`schema_version` is exactly `CredentialExposureIncidentEvidenceV1`; `incident_id` matches +`credexp-[0-9a-f]{32}` and is single-use within the campaign. +`unresolved_hold_root` is the exact current hold root or literal null only when absence is proven. +`credential_exposure_pending_sha256` must name the unique unresolved pending record consumed by +this final event. `consumed_active_pending_root` equals the predecessor state's active progress root +and `terminal_effect_receipts_root` equals its completed effect chain. +`concurrent_protocol_authority_drift_evidence_sha256` is the exact drift root when +drift coexists and is literal null only when the pending record's fresh check proved no drift. +`affected_artifacts` is a nonempty array in ascending numeric artifact-ID order. Each element has +exactly `artifact_id`, `artifact_sha256`, `upload_service_digest`, `source_workflow_ref`, +`source_workflow_sha`, `upload_run_id`, `upload_run_attempt`, `upload_job_id`, +`upload_check_run_id`, `uploaded_at`, `deletion_status`, and `deletion_receipt_sha256`. +`deletion_status` is exactly `deleted`, `already_expired`, `deletion_not_available`, or +`pending_at_stop`; its receipt binds the exact API request/result or the verified reason deletion +was unavailable or pending. Duplicate artifact IDs are forbidden. + +`scanner_receipt` has exactly `scanner_protocol_sha256`, `scanner_tool_sha256`, `scanner_rule_id`, +`scanner_run_id`, `scanner_run_attempt`, `scanner_check_run_id`, `verification_mode`, and +`verification_receipt_sha256`; `verification_mode` is `exact_known_value`, `credential_pattern`, or +`independent_safe_metadata_confirmation`. `credential_containment` has exactly `status` and +`receipt_sha256`, where status is `revoked`, `rotated`, or `cryptographically_expired`. +`cryptographically_expired` is allowed only for a GitHub installation, OIDC, or repository token +whose signed issuance/expiry and current invalidity verify; long-lived key kinds require `revoked` +or `rotated`, and an unclassified pattern requires a receipt for containment of every candidate +credential class identified by the safe scanner rule. The quarantine and no-further-download +receipts bind an authority-installed denylist for every affected artifact; they prove that no later +campaign job may download it, not that a prior public download did not occur. +`publication_pr_terminal_disposition_sha256` is nonnull exactly when an initial or correction +publication segment is active before a valid admitted merge and its PR absence/close/merge must be +terminalized. It is null in every other phase, including `RESULT_MERGED`, an initial release prefix, +a correction after valid merge, and a bare post-merge state. When nonnull it names the one exact +`PublicationPRTerminalDispositionV1` built from reconstructed authority and fully paginated marker +discovery. For an initial prefix, the two legacy phase-specific disposition fields below are strict +projections of that record; for a correction prefix they are both `not_applicable` while the shared +root is nonnull and correction-bound. No caller-supplied PR number or status is accepted. +`complete_publication_pr_disposition` is exactly `not_applicable`, `no_pr`, +`closed_before_stop`, `merged_before_close`, or `closed_then_reopened_merged`. It may be applicable only at +`COMPLETE_PUBLICATION_PR_OPEN` or at `BUNDLE_COLLECTED` with an authoritative active initial +complete-publication intent/branch/PR prefix. `no_pr` is allowed only at that pre-open prefix when +bounded exact-marker discovery proves no unique admissible or merged plan PR and every conflict +head is guarded; its close receipt is null. `closed_before_stop` +requires shared outcome `closed` and authorizes only the existing premerge credential STOP. Its +close receipt is nonnull and equal for `publisher_closed`, or null for +`observed_already_closed`, whose nonnull strict closed observation is carried by the shared record. +`merged_before_close` requires a null close receipt, independently proves that the +intent-bound PR became merged before the close effect could complete, and authorizes only typed +`RESULT_MERGE_INVALIDATED`. `closed_then_reopened_merged` instead requires the shared +`publisher_closed_then_reopened_merged` close kind and byte-identical nonnull prior-close receipt, +and authorizes the same failed-admission event. Every other parent or a `BUNDLE_COLLECTED` tree with no active initial +prefix uses `not_applicable` and a null close receipt. A merged PR is never described as closed, and +no disposition can substitute for another. Its projection maps shared outcome +`no_pr|closed` to `no_pr|closed_before_stop`; `already_merged` maps to `merged_before_close` when +the shared close receipt is null and `closed_then_reopened_merged` when it is nonnull, and +its close-receipt field byte-equals the shared record's nullable field. +`invalid_publication_pr_disposition` is independently exactly `not_applicable`, +`no_pr`, `closed_before_supplement`, `merged_before_close`, or +`closed_then_reopened_merged`. It may be applicable only at +`INVALID_PUBLICATION_PR_OPEN` or at `INVALID_FINALIZED` with an authoritative active initial +invalid-prefix intent/branch/PR prefix. `no_pr` is allowed only at that pre-open prefix when bounded +exact-marker discovery proves no unique admissible or merged plan PR and every conflict head is +guarded; its close receipt is null. `closed_before_supplement` requires +shared outcome `closed` and authorizes only the invalid-lineage supplement followed by the ordinary +typed invalid-prefix plan invalidation. Its close receipt is nonnull/equal for `publisher_closed` +or null with the shared nonnull strict observation for `observed_already_closed`; +`merged_before_close` requires a null close +receipt and authorizes only race-form `INVALID_PREFIX_MERGE_INVALIDATED`; +`closed_then_reopened_merged` requires the shared nonnull prior-close receipt and authorizes that +same race event. Every other parent or an +`INVALID_FINALIZED` tree with no active initial prefix uses `not_applicable` and a null close +receipt. Complete and invalid-prefix dispositions cannot both be applicable. +Its projection maps shared outcome `no_pr|closed` to +`no_pr|closed_before_supplement`; `already_merged` maps by null versus nonnull prior-close receipt +to `merged_before_close|closed_then_reopened_merged`, and its close-receipt field +byte-equals the shared record's nullable field. For an active correction, shared `no_pr` or `closed` +authorizes only `CORRECTION_INVALIDATED(... publication_outcome=unmerged_invalid)`, while +`already_merged` authorizes only its `merged_invalid` sibling. Both initial-projection fields remain +`not_applicable` in that correction case. + +Canonical bytes are RFC 8785 JSON over those exact fields excluding the final digest, UTF-8 with no +terminal newline; timestamps are UTC RFC 3339, IDs are canonical integers, roots are lowercase +64-hex SHA-256, and extra, missing, null-where-forbidden, duplicate, or reordered array members are +rejected. The final digest is SHA-256 of +`UTF8("laconian-credential-exposure-incident-evidence-v1\n") || CanonicalJSONV1(evidence without +exactly credential_exposure_incident_evidence_sha256)`. The evidence is safe metadata only and cannot +contain the suspected credential bytes. + +The same closed reason enum contains `protocol_authority_drift`. It is a STOP reason from every +post-seal prepublication state, including `PREFLIGHTED`, and the same evidence class is also the +non-STOP defect evidence for the exact post-merge and correction routes below. It requires +`ProtocolAuthorityDriftEvidenceV1` with exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `parent_state`, `parent_authority_oid`, `unresolved_hold_root`, +`protocol_attestation_tag_binding_sha256`, `observed_input_ref_oid`, +`observed_companion_ref_oid`, `observed_tag_ruleset_policy_root`, `failed_predicates`, +`verification_receipts_root`, `publication_pr_terminal_disposition_sha256`, `observed_at`, and +`protocol_authority_drift_evidence_sha256`. `parent_state` and `parent_authority_oid` always name +the exact current state/phase, including a reconstructed correction prefix. An observed ref OID is null only when an exact +authenticated absence receipt proves deletion. `failed_predicates` is a nonempty canonical ordered +subset of `input_ref_moved`, `input_ref_deleted`, `companion_ref_moved`, +`companion_ref_deleted`, `object_oid_mismatch`, `raw_object_sha256_mismatch`, `closure_mismatch`, +`ruleset_drift`, `tag_creator_mismatch`, `creation_authorization_mismatch`, `signature_identity_mismatch`, `topology_mismatch`, and +`cross_campaign_replay`. Its digest is SHA-256 of +`UTF8("laconian-protocol-authority-drift-evidence-v1\n") || CanonicalJSONV1(evidence without +exactly protocol_authority_drift_evidence_sha256)`. The event changes no external object, cannot adopt +restored refs, and its prepublication STOP use enters `STOPPED_INVALID`. The terminal-disposition +root is nonnull exactly at a `BUNDLE_COLLECTED` parent with an active initial complete-publication +prefix, at `COMPLETE_PUBLICATION_PR_OPEN`, or during an active correction before a valid merge; it +is null at every other parent. For the initial prefix, `no_pr` or `closed` permits the typed drift +STOP, while `already_merged` permits only +`RESULT_MERGE_INVALIDATED(failure_kind=protocol_authority_drift_race)`. For a correction prefix, +`no_pr` or `closed` permits only publication-family `CORRECTION_INVALIDATED(cause=protocol_authority_drift, +publication_outcome=unmerged_invalid)`, while `already_merged` permits only its `merged_invalid` +sibling with the drift-race failure. After a valid initial or correction merge the exact release- +invalidation route binds this evidence with a null disposition. At bare `RELEASE_BLOCKED` or +`RELEASED`, only the drift-typed correction-intent route applies. No post-merge form emits STOP. +When `unresolved_hold_root` is nonnull, drift evidence binds that consumed root and the STOP +successor sets it null; null means proven absence, never “not checked.” + +`InvalidEventDismissalEvidenceV1` has exactly `schema_version`, `campaign_id`, `hold_id`, +`hold_sha256`, `invalid_event_dismissal_plan_sha256`, `parent_authority_oid`, `parent_state`, `proof_kind`, `no_effects_root`, +`dismissal_reviewer_account_id`, `dismissal_reviewer_login`, `dismissal_signature_root`, +`dismissed_at`, and `invalid_event_dismissal_evidence_sha256`, using +`laconian-invalid-event-dismissal-v1`. `proof_kind` is exactly `authenticated_noop` or +`byte_identical_applied_replay`; either proves no state, ledger, artifact, reservation, credential, +provider, or external effect. `benchmark-dismiss-hold.yml`, under approval by an actor distinct +from the rejected source/trigger, appends `holds//dismissal.json` and +`INVALID_EVENT_DISMISSED` by expected-OID CAS. This is a self-loop: state name is unchanged, +transition advances, and exactly that one current `unresolved_hold_root` becomes null. +The dismissal digest is SHA-256 of `UTF8("laconian-invalid-event-dismissal-v1\n") || +CanonicalJSONV1(evidence without exactly invalid_event_dismissal_evidence_sha256)`. + +Before that workflow requests a mutation it seals `InvalidEventDismissalPlanV1` with exactly +`schema_version`, `campaign_id`, `campaign_registry_sha256`, +`invalid_event_dismissal_policy_sha256`, `hold_id`, `hold_sha256`, `parent_state`, +`parent_authority_oid`, `eligible_dismisser_account_id`, `eligible_dismisser_login`, `proof_kind`, +`authorized_dispatcher_workflow`, `authorized_dispatcher_ref`, `expected_no_effects_root`, +`planned_at`, and `invalid_event_dismissal_plan_sha256`. The dispatcher fields are exactly +`benchmark-dismiss-hold.yml` and the plan-bound protected-main ref. The selected +identity is one frozen eligible projection and is distinct from the rejected request actor. Its +digest is SHA-256 of `UTF8("laconian-invalid-event-dismissal-plan-v1\n") || CanonicalJSONV1(plan +without exactly invalid_event_dismissal_plan_sha256)`. Dismissal evidence binds this plan root and +exact approved actor; an ambient maintainer, changed plan, or plan for another hold is rejected. + +For a nondismissible verified defect before merge, a valid `PERMANENT_STOP` cites the hold and takes +the enumerated invalid path and its successor explicitly clears `unresolved_hold_root`; its +ordinary evidence binds the consumed hold root. At `RESULT_MERGED`, `RELEASE_PLAN_INVALIDATED` +binds and consumes the hold and enters `RELEASE_BLOCKED`. At `RELEASED`, the applicable typed +correction nondismissible/exposure/invalidation/drift intent binds and consumes it while preserving +terminal history. +Dismissal is the only other consuming exit. The only two no-prior-hold exceptions are `credential_exposure` and +`protocol_authority_drift`; their typed evidence must prove the exact current hold root or proven +absence as specified above. At `RESULT_MERGED`, the defect uses `RELEASE_PLAN_INVALIDATED`; at `RELEASED`, the state +remains terminal and the defect starts a new correction lineage with an explicit `supersedes` hash. + +`HeldReleasedConsumptionV1` is a strict `kind`-discriminated union of exactly four records; no +wrapper, generic evidence hash, or fallback member exists. The consuming `CorrectionIntentV1` +also embeds `CorrectionDefectRecordV1`, which has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `parent_state="RELEASED"`, `parent_authority_oid`, `defect_class`, +`defect_code`, `evidence_sha256`, `hold_root_sha256`, and `correction_defect_record_sha256`, using +domain `laconian-correction-defect-record-v1\n`. Its evidence hash equals the selected union +member's `consumption_sha256`; it is outside that member so neither digest is self-referential. + +`NondismissibleHeldReleasedConsumptionV1` has exactly +`schema_version="NondismissibleHeldReleasedConsumptionV1"`, `kind="nondismissible"`, +`campaign_id`, `campaign_registry_sha256`, `parent_state="RELEASED"`, `parent_authority_oid`, +`hold_id`, `hold_root_sha256`, `hold_admission_event_sha256`, nested exact +`nondismissibility_evidence: InvalidEventNondismissibilityEvidenceV1`, and +`consumption_sha256`. The nested evidence names the same released parent/OID and accepted hold; its +rejected-request and failed-validation projection byte-equals the accepted `InvalidEventHoldV1`. +Its domain is `laconian-nondismissible-held-released-consumption-v1\n`, omitting only its final +digest. + +`ExposureHeldReleasedConsumptionV1` has exactly +`schema_version="ExposureHeldReleasedConsumptionV1"`, `kind="exposure"`, `campaign_id`, +`campaign_registry_sha256`, `parent_state="RELEASED"`, `parent_authority_oid`, `hold_id`, +`hold_root_sha256`, `hold_admission_event_sha256`, nested exact +`terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1`, and +`consumption_sha256`. The terminal consumer's campaign/registry, incident parent/OID, and consumed +hold identity equal this record. Its domain is +`laconian-exposure-held-released-consumption-v1\n`, omitting only its final digest. + +`InvalidationHeldReleasedConsumptionV1` has exactly +`schema_version="InvalidationHeldReleasedConsumptionV1"`, `kind="invalidation"`, `campaign_id`, +`campaign_registry_sha256`, `parent_state="RELEASED"`, `parent_authority_oid`, `hold_id`, +`hold_root_sha256`, `hold_admission_event_sha256`, +`source_kind="initial_release_invalidation"|"correction_release_invalidation"`, +`typed_invalidation_evidence_sha256`, `terminal_invalidation_record_path`, +`terminal_invalidation_record_sha256`, `invalidation_event_path`, `invalidation_event_sha256`, and +`consumption_sha256`. Both paths are canonical authority-derived paths, never caller-selected. The +event path resolves in accepted ancestry to exactly one `RELEASE_PLAN_INVALIDATED` or release-family +`CORRECTION_INVALIDATED` event; that event transitively binds the separate terminal invalidation +record and typed evidence roots, which must equal the two fields here. Its domain is +`laconian-invalidation-held-released-consumption-v1\n`, omitting only its final digest. + +`DriftHeldReleasedConsumptionV1` has exactly +`schema_version="DriftHeldReleasedConsumptionV1"`, `kind="drift"`, `campaign_id`, +`campaign_registry_sha256`, `parent_state="RELEASED"`, `parent_authority_oid`, `hold_id`, +`hold_root_sha256`, `hold_admission_event_sha256`, nested exact +`protocol_authority_drift_evidence: ProtocolAuthorityDriftEvidenceV1`, and `consumption_sha256`. +The drift evidence names that same released parent/OID/hold. Its domain is +`laconian-drift-held-released-consumption-v1\n`, omitting only its final digest. + +For every member, campaign/registry/parent/hold fields equal reconstructed current authority and +`hold_admission_event_sha256` names the accepted `INVALID_EVENT_HELD` event whose rejected request, +failed validation and installed hold equal the selected evidence. The union is nonnull exactly when +a bare `RELEASED` parent has one unresolved hold and is forbidden at `RELEASE_BLOCKED` or during an +active correction prefix. Kind maps one-to-one to defect class/code +`nondismissible_hold/nondismissible_invalid_event`, +`credential_exposure/post_merge_credential_exposure`, +`invalidation_hold/accepted_release_invalidation`, or +`protocol_authority_drift/persistent_protocol_authority_drift`; the sibling +`CorrectionDefectRecordV1` must reproduce that mapping and consumption digest. The consuming intent +CAS clears exactly the hold. Non-exposure variants require the active exposure pair and terminal +exposure field null; exposure requires and clears the exact nonnull pair. No member may name the +future correction intent/event, successor OID, or successor state root. All four use RFC 8785 JSON +and the stated LF-terminated domain. +Correction invalidations have exactly two distinct kinds: +`correction_publication_invalidation` and `correction_release_invalidation`. Their schemas, +allowed parents, and evidence are distinct; a generic correction-invalidation alias is forbidden. + +`CREDENTIAL_EXPOSURE_PENDING` and `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` are constructive closed +events. The pending event requires exactly `CredentialExposurePendingV1`, +`incidents//pending.json`, and +`denylist/provisional/.json`; it is a self-loop that advances the transition and sets +the two active pending fields. The effect event requires exactly one next ordinal +`CredentialExposureEffectReceiptV1` at +`incidents//effects/<8-digit-ordinal>.json`; that schema has exactly +`schema_version`, `campaign_id`, `incident_id`, `pending_root`, +`predecessor_active_pending_root`, `effect_ordinal`, `effect_kind`, +`external_object_id`, `idempotency_key`, `requested_state_root`, `observed_terminal_state`, +`request_receipts_root`, `recorded_at`, and `credential_exposure_effect_receipt_sha256`, whose digest +is SHA-256 of `UTF8("laconian-credential-exposure-effect-receipt-v1\n") || +CanonicalJSONV1(receipt without exactly credential_exposure_effect_receipt_sha256)`. The event +is a self-loop that advances transition and pending-progress root without changing campaign state. +Every receipt's `campaign_id` and `incident_id` byte-equal its unique originating +`CredentialExposurePendingV1`, and `pending_root` equals that record's +`credential_exposure_pending_sha256`; a cross-campaign, cross-incident, or cross-pending value is +invalid even when the predecessor progress root and ordinal otherwise verify. + +When an active initial or correction publication prefix may have a PR, its pending inventory has +exactly one `effect_kind="publication_pr_terminal_disposition"` ordinal rather than an unconditional +close item. `observed_terminal_state` is exactly `no_pr`, `closed`, or `already_merged`. +`external_object_id` is the canonical PR number for `closed|already_merged` and the literal +`none` for `no_pr`; `request_receipts_root` binds complete bounded exact-marker discovery, +the strict publisher-close-plus-observation or already-closed observation for `closed`, or exact +PR/merge/current-main observation for `already_merged`. `no_pr` is legal only before an +authoritative PR-open receipt and proves zero unique admissible or merged plan PRs while preserving +and guarding every conflict; `closed` requires one exact close-kind +branch; `already_merged` binds the observed merge and preserves any reconciled prior close instead +of claiming none occurred. All three outcomes complete that one ordinal. For an initial complete +prefix they map to `no_pr`, `closed_before_stop`, and either `merged_before_close` or +`closed_then_reopened_merged`; for an initial invalid prefix, to `no_pr`, +`closed_before_supplement`, and the same receipt-qualified merged pair; for a correction prefix, to unmerged no-PR invalidation, unmerged closed-PR +invalidation, and race-form `merged_invalid`. Outcome/disposition mismatch, a second PR ordinal, or +claiming close after merge is rejected. +For this effect kind, `requested_state_root` is not generic: it equals the recomputed +`publication_pr_terminal_disposition_sha256`. The receipt's terminal state, external PR ID, +request-receipt root, branch/PR/create/check/guard/close roots and observations are the exact +class-bound projection of that record, and the final incident, supplement or failed-admission +consumer embeds those same canonical bytes. Substituting a disposition from another valid effect +chain is rejected. + +`CredentialExposureProgressRootV1` is a calculated projection, not a stored self-containing +record. Its exact fields are `schema_version`, `campaign_id`, `incident_id`, +`credential_exposure_pending_sha256`, `last_effect_ordinal`, and `effect_chain_root`. +The initial projection uses `last_effect_ordinal: null` and +`effect_chain_root = SHA256(UTF8("laconian-credential-exposure-effect-chain-empty-v1\n") || +CanonicalJSONV1({campaign_id,incident_id,credential_exposure_pending_sha256}))`. +`active_credential_exposure_pending_root` is +`SHA256(UTF8("laconian-credential-exposure-progress-root-v1\n") || +CanonicalJSONV1(the exact six-field projection))`; it has no stored self field. Effect ordinals +start at integer 1, advance by exactly one, and path-format as eight zero-padded decimal digits. +Each successor `effect_chain_root` is +`SHA256(UTF8("laconian-credential-exposure-effect-chain-link-v1\n") || +CanonicalJSONV1({predecessor_active_pending_root,effect_ordinal, +credential_exposure_effect_receipt_sha256}))`; the next progress root is then computed from that +chain root and ordinal. `terminal_effect_receipts_root` is exactly the final `effect_chain_root`. + +`TerminalCredentialExposureConsumptionV1` is the one strict post-merge terminal projection. Its +exact fields are `schema_version`, `campaign_id`, `campaign_registry_sha256`, `incident_id`, +`credential_exposure_pending_sha256`, `predecessor_active_pending_root`, +`terminal_effect_receipts_root`, nested exact `credential_exposure_incident_evidence`, +`concurrent_protocol_authority_drift_evidence_sha256`, nullable +`consumed_unresolved_hold_id`, nullable `consumed_unresolved_hold_root_sha256`, and +`consumption_sha256`. The two hold fields are both null or both identify the one current hold copied +through pending/final evidence. Its digest is +`SHA256(UTF8("laconian-terminal-credential-exposure-consumption-v1\n") || +CanonicalJSONV1(record without exactly consumption_sha256))`. Construction replays every ordinal, +requires one campaign/registry/incident/pending root, equates the predecessor progress and terminal +effect-chain roots to the final incident evidence, and copies the originating concurrent-drift +root. It contains no consuming-event hash, successor authority OID, or future root; terminal +event construction is therefore acyclic. Cross-incident, gapped, reordered, substituted-drift, or +half-null-hold records fail before a terminal event is built. + +The pending and effect events are permitted from exactly the existing premerge parents +`GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, +`JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, +`AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, `BUNDLE_COLLECTED`, and +`COMPLETE_PUBLICATION_PR_OPEN`; from `RESULT_MERGED`; from `RELEASE_BLOCKED` or `RELEASED` with no +active correction or with exactly one valid nonterminal correction prefix; and from the +artifact-bearing invalid states `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, +`INVALID_PUBLICATION_PR_OPEN`, `INVALID_PREFIX_MERGED`, and +`INVALID_PREFIX_MERGED_INVALID`. These added rows grant emergency containment only and do not +authorize live resume, release, correction promotion, documentation, or social effects. Pending +requires both active fields null; effect requires both to match the exact incident and current +progress root. `INVALID_EVENT_HELD` is ineligible whenever a `RELEASED` or `RELEASE_BLOCKED` +authority tree contains an active nonterminal correction prefix; the generated guard reconstructs +the correction phase rather than considering the campaign-state name alone. + +The terminal consumer is phase-exact. Existing premerge parents use +`PERMANENT_STOP(reason=credential_exposure)`. A complete initial-publication prefix, whether still +at `BUNDLE_COLLECTED` or already `COMPLETE_PUBLICATION_PR_OPEN`, uses that STOP after `no_pr` proof +or `closed_before_stop`; if its PR is externally merged before close, only +`RESULT_MERGE_INVALIDATED` may consume the completed chain and it enters `RELEASE_BLOCKED`. +An invalid-prefix initial-publication prefix, whether still at `INVALID_FINALIZED` or already +`INVALID_PUBLICATION_PR_OPEN`, uses the invalid-lineage supplement after `no_pr` proof or +`closed_before_supplement`, then the ordinary typed plan invalidation; if its PR is externally +merged first, only race-form `INVALID_PREFIX_MERGE_INVALIDATED` consumes the chain and enters +`INVALID_PREFIX_MERGED_INVALID`. +`RESULT_MERGED` uses `RELEASE_PLAN_INVALIDATED`, both before and after an authoritative initial +release intent. Bare `RELEASE_BLOCKED` or `RELEASED` uses `CORRECTION_INTENT_AUTHORIZED`; a held +`RELEASED` parent additionally admits typed `protocol_authority_drift` as the fourth discriminator +beside nondismissible, exposure, and invalidation evidence. An active correction before a valid +correction merge uses its publication-family `CORRECTION_INVALIDATED`; after a valid merge it uses +its release-family `CORRECTION_INVALIDATED`. Each post-merge consumer requires the exact +`TerminalCredentialExposureConsumptionV1`, clears the active incident/root pair and matching +optional hold atomically, preserves every contaminated merge/tag/Release/history root, and blocks +the ordinary next phase. Terminalizing an active correction requires the next correction ID to +supersede both that failed prefix and the exposure root. +Every active initial-publication prefix was created with a null hold and is itself hold-ineligible; +therefore either initial merge-before-close event requires `unresolved_hold_root=null`. An active +correction prefix is likewise hold-ineligible. Optional-hold consumption applies only to the +separately enumerated `RESULT_MERGED` release-invalidation and bare `RELEASED` correction-start +forms, never to an initial or correction PR race. + +The artifact-bearing invalid states use `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED` as a self-loop, +except for the invalid-prefix merge-before-close race above. For +`INVALID_PUBLICATION_PR_OPEN`, or `INVALID_FINALIZED` with an active initial invalid prefix, its +inventoried effects include publisher-App closure of that exact invalid-prefix PR before the +supplement when a PR exists; every other such parent forbids a PR-close field. +The supplement records containment and disclosure, consumes the exact progress root, clears both +active fields, requires the hold root null, preserves the terminal/invalid state, and grants no live +authority. A `STOPPED_INVALID` parent is no longer restricted to a prior drift reason. + +For every terminal form, final validation requires each `pending_effect_inventory` item and ordinal +exactly once, `consumed_active_pending_root` equal to the predecessor state's current progress root, +and `terminal_effect_receipts_root` equal to its completed chain before both active fields clear. +All ordinary events require the active pair null. + +The allowed durable transitions are: + +Every phase-qualified terminal row below has two disjoint admission forms. The direct form is legal +only when no active publication/correction effect prefix exists, for a normal postmerge admission +that was not sourced from terminal disposition, or for release-only invalidation after publication +admission; it additionally requires `active_publication_terminal_containment_root=null` and cannot +carry containment fields. A root-null active publication/correction prefix is eligible only to +start containment, never to skip it. Every `no_pr|closed` terminal disposition, every publication +write ambiguity, and every terminal-disposition merge race must first accept containment start and +then use the containment form. The containment form is legal only after the immediately bound +`PUBLICATION_TERMINAL_CONTAINMENT_STARTED` successor (or a descendant that byte-preserves its +active root and denylist), and requires nested exact `PublicationTerminalContainmentFinalityV1`, +`source_authority_parent_oid` equal to the intent's source parent, `authority_parent_oid` equal to +the finality terminal parent, the same permanent successor denylist, +`active_publication_terminal_containment_root_before=terminal_containment_intent_sha256`, and +`active_publication_terminal_containment_root_after=null`. `no_pr|closed` uses exactly +`ordinary_premerge` or `write_ambiguity_premerge`; any authenticated merged candidate uses exactly +`ordinary_merge_won` or `write_ambiguity_merge_won`. A reconciliation-unavailable terminal +disposition therefore takes the premerge form only for `no_pr|closed` and the merge-won form only +for `already_merged`. The terminal CAS preserves the denylist and atomically clears the active +root. No other transition below may consume, clear, replace, or silently preserve a nonnull active +containment root. + +| From | Event and required evidence | To | Authorized next action | +|---|---|---|---| +| none | `PREFLIGHT_SEALED`: valid annotated T0/T1 pair, double-read object closure and ruleset receipts, canonical `CampaignRegistryV1` and companion binding, plans, budget, price snapshot, canonical `StateWriterGitIdentityV1`, parentless authority commit, and atomic `expected_absent` ref creation | `PREFLIGHTED` | prepare generation batch | +| `PREFLIGHTED` or `GENERATION_RESUMABLE` | `BATCH_RECEIPT_CONSUMED`: exact unused reservation/job tuple and current-price attestation | `GENERATION_ACTIVE` | execute frozen generation batch | +| `GENERATION_ACTIVE` | `NO_DISPATCH_PROVED`: exact job evidence proves zero provider dispatch and releases only never-started reservations | `GENERATION_RESUMABLE` | prepare a new exact batch attempt | +| `GENERATION_ACTIVE` | `VERIFIED_PARTIAL`: exact successor ledger, no STOP, suffix remains | `GENERATION_RESUMABLE` | prepare exact next suffix | +| `GENERATION_ACTIVE` | `GENERATION_SET_SEALED`: all 36 capsule hashes, `generation_context_expectation_sha256`, and `verified_generation_context_root` | `GENERATION_COMPLETE` | deterministic hard score | +| `GENERATION_COMPLETE` | `HARD_SCORE_SET_SEALED`: all 36 request-set hashes | `HARD_SCORE_COMPLETE` | prepare judge batch | +| `HARD_SCORE_COMPLETE` or `JUDGE_RESUMABLE` | `BATCH_RECEIPT_CONSUMED`: exact unused reservation/job tuple and current-price attestation | `JUDGE_ACTIVE` | execute frozen judge batch | +| `JUDGE_ACTIVE` | `NO_DISPATCH_PROVED`: exact job evidence proves zero provider dispatch and releases only never-started reservations | `JUDGE_RESUMABLE` | prepare a new exact batch attempt | +| `JUDGE_ACTIVE` | `VERIFIED_PARTIAL`: exact successor ledger, no STOP, suffix remains | `JUDGE_RESUMABLE` | prepare exact next suffix | +| `JUDGE_ACTIVE` | `JUDGE_SET_SEALED`: all 36 judge-attachment hashes | `JUDGE_COMPLETE` | provider-evidence integrity validation | +| `JUDGE_COMPLETE` | `EVIDENCE_INVENTORY_SEALED`: exact generation/hard-score/judge coverage | `PROVIDER_EVIDENCE_VERIFIED` | create blind audit packet | +| `PROVIDER_EVIDENCE_VERIFIED` | `AUDIT_SEALED`: both reveal chains and signed adjudication or explicit unresolved records | `AUDIT_COMPLETE` | semantic aggregation/inference | +| `AUDIT_COMPLETE` | `ANALYSIS_SEALED`: deterministic scores, bootstrap, sensitivity, outcomes | `ANALYSIS_COMPLETE` | run complete collector | +| `ANALYSIS_COMPLETE` | `COMPLETE_BUNDLE_SEALED`: exact full allowlist and checksum | `BUNDLE_COLLECTED` | prepare publication plan | +| `BUNDLE_COLLECTED` | `PUBLICATION_INTENT_AUTHORIZED`: exact `bundle_kind=complete`, deterministic branch/PR identities, effect roots, actors, and idempotency keys | `BUNDLE_COLLECTED` | create or adopt exact complete branch/PR | +| `BUNDLE_COLLECTED`, `COMPLETE_PUBLICATION_PR_OPEN`, `INVALID_FINALIZED`, `INVALID_PUBLICATION_PR_OPEN`, `RELEASE_BLOCKED`, or `RELEASED`, each with the exact active publication/correction prefix and null active containment root | `PUBLICATION_TERMINAL_CONTAINMENT_STARTED`: ordinary source requires exact `no_pr|closed`; either source permits preflight `merge_state=all_unmerged|merge_observed`; both require cycle-free preflight, one monotone denylist append, signed terminalizing broker/vault prefixes with zero open requests/dispatches/live tokens, and expected-OID CAS | same state name with active containment root | if preflight was all-unmerged run only the post-CAS all-candidates barrier; if it observed a merge classify merge-won and fence the residual set | +| `BUNDLE_COLLECTED` | `COMPLETE_PUBLICATION_PR_OPENED`: exact prior intent, `bundle_kind=complete`, sealed complete-bundle root, publication plan, and adopted/created branch/PR receipts | `COMPLETE_PUBLICATION_PR_OPEN` | review and required CI | +| `BUNDLE_COLLECTED` | `COMPLETE_PUBLICATION_PLAN_INVALIDATED`: base/head moved or plan check failed, bundle digest unchanged; an active containment prefix requires exact premerge finality and clears its root | `BUNDLE_COLLECTED` | direct form may replan normally; containment form may authorize only a new positive attempt that explicitly supersedes the terminal root and uses fresh branch/head/marker/trailer absent from every denylist selector | +| `BUNDLE_COLLECTED` with active initial complete intent/branch/PR prefix and observed merged PR | `RESULT_MERGE_INVALIDATED`: exact `PostMergeAdmissionFailureV1`, merge-won containment finality when containment is active, `PublicationPRTerminalDispositionV1(outcome=already_merged)` for ordinary source or null for write ambiguity, discovered/adopted prefix objects, immutable merge and no-release proof; reconciliation-unavailable instead binds its sealed failure-only set/receipt and zero release-authorization ledger without claiming stable external state; drift or exposure additionally requires its class-bound nested evidence/consumer | `RELEASE_BLOCKED` | start a correction that supersedes the contaminated pre-open publication prefix, every merged candidate, and any exposure root | +| `COMPLETE_PUBLICATION_PR_OPEN` | `RESULT_MERGED`: approved complete-bundle PR, exact matching sealed-root lineage, merge receipt, and `PostMergeAdmissionEvidenceV1` | `RESULT_MERGED` | prepare release plan | +| `COMPLETE_PUBLICATION_PR_OPEN` | `RESULT_MERGE_INVALIDATED`: intent-bound PR is already merged but exact post-merge admission fails; an active containment prefix requires exact merge-won finality, merge-before-close binds the exact terminal disposition for ordinary source, drift or exposure binds its class-bound nested evidence/consumer, and every form preserves immutable merge/no-release evidence | `RELEASE_BLOCKED` | start a correction that explicitly supersedes every contaminated merge and any exposure root | +| `COMPLETE_PUBLICATION_PR_OPEN` | `COMPLETE_PUBLICATION_PLAN_INVALIDATED`: exact complete-bundle PR closed, sealed complete-bundle root unchanged; an active containment prefix requires exact premerge finality and clears its root | `BUNDLE_COLLECTED` | authorize only a new positive attempt that supersedes any terminal root and uses fresh branch/head/marker/trailer absent from every denylist selector | +| `RESULT_MERGED` | `RESULT_RELEASE_INTENT_AUTHORIZED`: deterministic tag/draft-release/asset/publish identities, roots, actors, and idempotency keys | `RESULT_MERGED` | create or adopt exact initial release effects | +| `RESULT_MERGED` | `RESULT_RELEASED`: exact prior release intent, protected annotated result tag, immutable published release, checksum-bound assets, and create/adopt receipts | `RELEASED` | documentation/social follow-up | +| `RESULT_MERGED` | `RELEASE_PLAN_INVALIDATED`: verified tree, bundle, security, provenance, or credential-exposure defect before or after release intent; if held or exposure is active, evidence binds the exact terminal consumer and successor clears the applicable roots | `RELEASE_BLOCKED` | start a correction lineage; do not tag/release | +| bare `RELEASE_BLOCKED` or `RELEASED` | `CORRECTION_INTENT_AUTHORIZED`: exact append-only intent, parent authority OID, plans, object names/roots, prior/new latest pointers, and idempotency keys; a held `RELEASED` parent is allowed only for exact nondismissible/exposure/invalidation/drift discriminator and evidence, and active exposure requires its terminal projection; the successor clears every consumed root | same campaign state | execute or recover exact correction publication effect | +| `RELEASE_BLOCKED` or `RELEASED` | `CORRECTION_PUBLICATION_RECORDED`, `CORRECTION_MERGE_RECORDED`, `CORRECTION_TAG_RECORDED`, or `CORRECTION_RELEASE_RECORDED`: exact next correction phase and adopted/created effect receipt | same campaign state | execute or recover exact next phase | +| `RELEASE_BLOCKED` or `RELEASED` with active correction `intent.json` or `publication-receipt.json` parent and no valid merge receipt | `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, publication_outcome=unmerged_invalid|fenced_write_ambiguity)`: exact absent/closed PR and publication failure evidence; an active containment prefix requires the source-class-matching premerge finality, preserves its denylist and clears its root; active exposure additionally requires terminal consumption | same campaign state | correction lineage terminal; a new correction ID supersedes the failed prefix and any exposure root | +| `RELEASE_BLOCKED` or `RELEASED` with active correction `intent.json` or `publication-receipt.json` parent, observed merged PR, and no valid merge receipt | `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, publication_outcome=merged_invalid)`: exact `PostMergeAdmissionFailureV1`, source-class-matching merge-won finality when containment is active, every contaminated merge/exposure, typed terminal consumption when active, and ordinary no-later-effects evidence | same campaign state | correction lineage terminal; a new correction ID explicitly supersedes the failed correction, every contaminated merge, and any exposure root | +| `RELEASE_BLOCKED` or `RELEASED` with active correction publication prefix whose required reconciliation exhausts | `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, publication_outcome=reconciliation_unavailable)`: exact sealed unavailable disposition set/receipt, all request/dispatch pairs closed, zero live token and zero release authorization; exact PR terminal disposition is `no_pr|closed|already_merged`; an active prefix uses premerge finality for the first two outcomes and merge-won finality for the third, but no stable external-state/no-later claim is made | same campaign state | correction lineage terminal and release remains blocked; a new correction must supersede it and freshly reconcile before any success | +| `RELEASE_BLOCKED` or `RELEASED` with active correction valid `merge-receipt.json`, `tag-receipt.json`, or `release-receipt.json` parent | `CORRECTION_INVALIDATED(kind=correction_release_invalidation)`: exact release-phase failure and external-object evidence; active exposure additionally requires terminal consumption | same campaign state | correction lineage terminal; a new correction ID supersedes the failed prefix and any exposure root | +| `RELEASE_BLOCKED` | `CORRECTION_RESULT_RELEASED`: exact correction lineage and complete corrected publication/merge/release evidence | `RELEASED` | documentation/social follow-up from corrected latest pointer | +| `RELEASED` | `CORRECTION_RESULT_RELEASED`: exact append-only correction lineage and complete corrected publication/merge/release evidence | `RELEASED` | preserve prior terminal history; follow the new latest pointer | +| `PREFLIGHTED`, `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, `AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, `BUNDLE_COLLECTED`, or `COMPLETE_PUBLICATION_PR_OPEN` | `PERMANENT_STOP`: exact parent-specific reason/evidence; nondismissible/credential/drift evidence binds any consumed hold root and successor clears it; credential exposure also consumes completed active progress root; an active initial complete prefix requires exact shared `no_pr` or `closed` disposition, while `already_merged` is excluded to the failed-admission row | `STOPPED_INVALID` | prefix/STOP finalizer only | +| any ready/resumable provider state | `BUDGET_EXHAUSTED`: next minimum batch cannot fit | `BUDGET_INCOMPLETE` | prefix/STOP finalizer only | +| `STOPPED_INVALID` or `BUDGET_INCOMPLETE` | `INVALID_PREFIX_SEALED`: exact completed prefix and missing suffix; unresolved hold and active pending incident are both null | `INVALID_FINALIZED` | publish registry/incident only | +| `INVALID_FINALIZED` | `INVALID_PUBLICATION_PLAN_INVALIDATED`: base/head moved, plan check failed, fenced write ambiguity, credential exposure, protocol drift, or an active invalid publication prefix exhausts exact reconciliation with the sealed unavailable receipt/set; prefix digest unchanged, PR disposition exact when ordinary, and an active containment prefix requires matching premerge finality and clears its root | `INVALID_FINALIZED` | direct form may replan normally; containment form may authorize only a new positive attempt that supersedes the terminal root and uses fresh branch/head/marker/trailer absent from every denylist selector | +| `INVALID_FINALIZED` | `PUBLICATION_INTENT_AUTHORIZED`: exact `bundle_kind=invalid_prefix`, deterministic branch/PR identities, effect roots, actors, and idempotency keys | `INVALID_FINALIZED` | create or adopt exact invalid-prefix branch/PR | +| `INVALID_FINALIZED` | `INVALID_PUBLICATION_PR_OPENED`: exact prior intent, `bundle_kind=invalid_prefix`, sealed prefix root, publication plan, and adopted/created branch/PR receipts | `INVALID_PUBLICATION_PR_OPEN` | review and required CI, no performance claim | +| `INVALID_FINALIZED` with active initial invalid intent/branch/PR prefix and observed merged PR | `INVALID_PREFIX_MERGE_INVALIDATED`: exact `PostMergeAdmissionFailureV1`, matching merge-won finality when containment is active, ordinary `PublicationPRTerminalDispositionV1(outcome=already_merged)` or null for write ambiguity, discovered/adopted prefix objects and every immutable merge; exposure additionally requires its class-bound terminal consumer | `INVALID_PREFIX_MERGED_INVALID` | terminal disclosed invalid-prefix merge; no release, correction, or promotion | +| `INVALID_PUBLICATION_PR_OPEN` | `INVALID_PREFIX_MERGED`: approved invalid-prefix PR, exact sealed-prefix lineage, merge receipt, and `PostMergeAdmissionEvidenceV1` | `INVALID_PREFIX_MERGED` | terminal registry/incident publication only | +| `INVALID_PUBLICATION_PR_OPEN` | `INVALID_PREFIX_MERGE_INVALIDATED`: intent-bound invalid-prefix PR is already merged but exact post-merge admission fails; an active containment prefix requires source-class-matching merge-won finality, merge-before-close binds the exact ordinary terminal disposition, and exposure binds its class-bound terminal consumer | `INVALID_PREFIX_MERGED_INVALID` | terminal disclosed invalid-prefix merge; no release, correction, or promotion | +| `INVALID_PUBLICATION_PR_OPEN` | `INVALID_PUBLICATION_PLAN_INVALIDATED`: exact invalid-prefix PR closed, fenced write ambiguity, or exact sealed reconciliation-unavailable failure with no success authority; sealed prefix root unchanged and an active containment prefix requires matching premerge finality and clears its root | `INVALID_FINALIZED` | authorize only a new positive attempt that supersedes any terminal root and uses fresh branch/head/marker/trailer absent from every denylist selector | +| `PREFLIGHTED`, `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, `AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, `BUNDLE_COLLECTED` with no active initial-publication prefix, `RESULT_MERGED`, or bare `RELEASED`, with both roots null and no active correction prefix | `INVALID_EVENT_HELD`: exact broker-owned `InvalidEventHoldV1`, authenticated hold-worthy rejection, expected-OID CAS | same state | exact consumer only | +| the same phase-qualified hold-eligible states with one current hold and active pending null | `INVALID_EVENT_DISMISSED`: exact plan/evidence, expected-OID CAS | same state | clear exactly that hold and resume only unchanged-state authority | +| any exact exposure-eligible state with no active pending incident | `CREDENTIAL_EXPOSURE_PENDING`: exact pending record plus provisional denylist, expected-OID CAS | same state | containment only | +| any exact exposure-eligible state with matching active pending incident | `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`: next inventoried effect receipt, expected-OID CAS | same state | next containment effect or final event only | +| `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, `INVALID_PUBLICATION_PR_OPEN`, `INVALID_PREFIX_MERGED`, or `INVALID_PREFIX_MERGED_INVALID` with matching active exposure incident | `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`: terminal `CredentialExposureSupplementV1` after pending record and containment receipts; consumes active root and preserves state | same state | no live resume; only the pre-existing safe invalid-prefix continuation, when any, remains possible | + +Within the generated `PERMANENT_STOP` transition, the `credential_exposure` reason has exactly +these allowed parents: +`GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, +`JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, +`AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, `BUNDLE_COLLECTED`, and +`COMPLETE_PUBLICATION_PR_OPEN`. The event must reproduce every current authority, state, ledger, +artifact-inventory, active-plan, and hold root from its parent. `PREFLIGHTED` is excluded because no +provider-bearing artifact has been uploaded; `RESULT_MERGED` uses `RELEASE_PLAN_INVALIDATED`, and +`RELEASED` uses correction lineage. The reason is also forbidden from `STOPPED_INVALID`, +`BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, `INVALID_PUBLICATION_PR_OPEN`, `INVALID_PREFIX_MERGED`, +`INVALID_PREFIX_MERGED_INVALID`, +`RELEASE_BLOCKED`, correction states, and every terminal state. These restrictions apply to the +STOP reason, not to the separately enumerated pending/progress and terminal-consumer rows above. +Neither a generic incident event nor a reason alias can bypass this parent set. Noncredential +artifact corruption, traversal, inventory, or provenance defects remain under their existing +phase-specific reason discriminators and cannot be mislabeled `credential_exposure`. + +An active job that exits at the soft deadline is resumable only through `VERIFIED_PARTIAL`. A lost +job without that event uses `NO_DISPATCH_PROVED` only when durable job and provider evidence proves +that the entire batch made zero dispatches and every released reservation is `never_started`; +otherwise ambiguity emits `PERMANENT_STOP`. Audit nonparticipation or an unrevealed commitment emits +a reason-specific `PERMANENT_STOP`; an explicitly signed unresolved adjudication is instead a valid +`AUDIT_SEALED` event whose affected model outcome is inconclusive. No dispatcher may jump from a +partial, STOP, budget, or release-blocked state into live execution or complete collection. An +unresolved `InvalidEventHoldV1` blocks every ordinary transition; only the exact consuming edges +enumerated above or the exposure emergency pending/progress/final flow are admitted. + +`RESULT_MERGED` is accepted only from `COMPLETE_PUBLICATION_PR_OPEN`. Its event must reproduce +`bundle_kind=complete`, the exact `COMPLETE_BUNDLE_SEALED` root, `BUNDLE_COLLECTED` root, +`PublicationPlanV1` root, approved head, PR, merge commit, and resulting tree root as one matching +lineage. An invalid-prefix root, mixed root, absent discriminator, or +`INVALID_PUBLICATION_PR_OPEN` parent is an invalid event and creates a hold without mutation. +`INVALID_PREFIX_MERGED` and `INVALID_PREFIX_MERGED_INVALID` are terminal: neither accepts a +result-release, correction-release, documentation, website, release-note, or social-promotion +event. The former means that the safe registry/incident prefix was human-reviewed and validly +merged; the latter additionally discloses that exact merge failed admission and makes no claim that +its lineage was valid. Closing instead of merging either PR +kind requires its type-specific invalidation event; cross-kind close/merge events and generic +`PUBLICATION_PR_OPEN` are not schema values and are testable rejection cases. An +`INVALID_PUBLICATION_PLAN_INVALIDATED` close receipt is terminal for that exact invalid-prefix plan, +branch, and PR: a platform reopen cannot restore protocol authority and the failed required guard +prevents merge; none can be reused, no release/promotion is authorized, and +`INVALID_FINALIZED` permits only creation of a new plan with a new branch/PR identity over the same +unchanged sealed prefix root. + +### 7.5 Correction side-effect protocol + +Correction authority is stored only in the append-only tree of +`refs/heads/benchmark-authority/`. Every correction ID is exactly the 37-byte ASCII +string matching `corr-[0-9a-f]{32}`, is single-use within its campaign, and byte-equals every path, +intent, receipt, event and idempotency-key projection; slash, dot, Unicode and normalization aliases +are unrepresentable. For correction ID ``, the only +authoritative paths are the ordered members under +`corrections//`: `intent.json`, `publication-receipt.json`, `merge-receipt.json`, +`tag-receipt.json`, `release-receipt.json`, and exactly one of `finalization.json` or +`invalidation.json`. Every record binds the campaign ID, correction ID, exact prior campaign-state +hash, prior authority commit OID, prior correction-phase record hash, monotonically increasing +phase number, `supersedes` root, and its own canonical digest. Files are append-only; an absent +later member means the phase has not been durably recorded. + +Before any external correction write, `CORRECTION_INTENT_AUTHORIZED` installs `intent.json` by one +expected-OID, non-force, fast-forward authority compare-and-swap. The intent binds the complete +correction publication and release plans; exact base/head/result-tree and sealed-bundle roots; +branch, PR marker, annotated-tag name/message/target, draft-release name/body, ordered asset names +and digests; prior and proposed latest-result pointers; allowed App actors; and a distinct +idempotency key for publication, tag, draft/assets, publish, and each receipt CAS. Each key is the +domain-separated canonical digest of campaign ID, correction ID, phase, plan root, object name, and +expected target/root. GitHub does not provide one universal idempotency header for these effects, +so exact names, immutable targets, embedded intent markers, actors, and roots are the semantic +idempotency boundary; the design makes no stronger platform claim. + +If exposure is active at a bare `RELEASE_BLOCKED` or `RELEASED` parent, the intent additionally +binds the exact `TerminalCredentialExposureConsumptionV1`; its one CAS clears the active pair and +matching optional hold. The `RELEASED` exposure form also contains the withdrawal below, while the +`RELEASE_BLOCKED` form forbids withdrawal because no released latest pointer exists. Ordinary +correction intents forbid terminal exposure consumption and require the active pair null. +For protocol drift at a bare `RELEASE_BLOCKED` or `RELEASED` parent, the intent instead binds the +exact current-parent `ProtocolAuthorityDriftEvidenceV1`, requires both its terminal-disposition root +and the active exposure pair null, and grants no other defect class. A released drift intent appends +`latest_status=withdrawn_due_to_protocol_authority_drift`; the blocked form has no prior released +pointer to withdraw. + +When a correction starts from `RELEASED` because of credential exposure, the same intent CAS also +appends `latest_status=withdrawn_due_to_credential_exposure`, incident root, and contaminated +tag/Release/history roots. This status invalidates consumption and promotion without deleting or +rewriting the historical latest-pointer event. Only successful `CORRECTION_RESULT_RELEASED` may +append the next active latest pointer. + +The publisher may create or adopt only the intent-bound branch and PR, and immediately before PR +create it installs the same exact successful App-bound merge-eligibility check. The strict +correction `publication-receipt.json` carries the branch-create, eligibility-check, and PR-create +delivery-resolution roots, final marker-discovery root, eligibility receipt root, and exact +branch/PR identities. A +key-free state-writer step then persists it with `CORRECTION_PUBLICATION_RECORDED` by expected-OID CAS. +After protected human merge, it reconstructs the PR approvals, required checks, merge actor, merge +commit, result tree, and sealed-root lineage and persists `merge-receipt.json` with +`CORRECTION_MERGE_RECORDED`. The release finalizer may then create or adopt only the exact annotated +tag and persists `tag-receipt.json` with `CORRECTION_TAG_RECORDED`. It creates or adopts the exact +draft release, reconciles every asset name and digest, performs at most one publish transition, and +persists `release-receipt.json` with `CORRECTION_RELEASE_RECORDED`. Every receipt CAS has the exact +previous authority OID and phase record as parent; a competing or skipped parent fails without +changing authority. + +Recovery is mandatory and idempotent. Before retrying an effect, the fixed tool queries the exact +intent-bound ref, PR marker, tag name, release ID/name, and asset names. If nothing exists, it +performs the effect once. If an object already exists with the exact actor, immutable target, +embedded idempotency marker, and content/root, it adopts the object and records the missing receipt +without duplicating it. A mismatched object is never overwritten, force-updated, deleted, or +silently orphaned. A crash after tag creation, during draft asset upload, after draft completion, +or after publish is recovered by adopting all exact existing objects, uploading only absent +intent-bound assets while the release is still a draft, and performing publish only if it remains +draft. An immutable published release with exact assets is adopted; any conflicting or incomplete +immutable object terminates through correction-release invalidation. All retries, queries, +adoptions, conflicts, and returned object IDs/digests are terminal evidence. +Correction draft discovery, serialized finalization, timeout/422/502 asset reconciliation, and +published-release verification use the same exact endpoint and `starter`-asset rules in section +7.6; a by-tag lookup is never treated as a draft lookup. + +The two invalidation variants are one closed wire union. `CorrectionInvalidationV1` has exactly +`schema_version="CorrectionInvalidationV1"`, `campaign_id`, `campaign_registry_sha256`, +`correction_id`, `parent_state="RELEASE_BLOCKED"|"RELEASED"`, nullable +`source_authority_parent_oid`, `authority_parent_oid`, +`correction_intent_sha256`, +`invalidation_kind="correction_publication_invalidation"|"correction_release_invalidation"`, +nullable `publication_outcome="unmerged_invalid"|"merged_invalid"| +"fenced_write_ambiguity"|"reconciliation_unavailable"`, +`invalidation_cause="ordinary"|"credential_exposure"| +"protocol_authority_drift"|"publication_reconciliation_unavailable"| +"publication_write_ambiguity_fenced"|"release_reconciliation_unavailable"`, nullable nested exact +`terminal_containment_finality: PublicationTerminalContainmentFinalityV1`, nullable +`terminal_containment_finality_sha256`, nullable +`successor_merge_denylist_root_sha256`, nullable +`active_publication_terminal_containment_root_before`, nullable +`active_publication_terminal_containment_root_after`, nullable nested exact +`fenced_write_ambiguity: PublicationFencedWriteAmbiguityV1`, nullable +`fenced_write_ambiguity_sha256`, nullable nested exact +`publication_pr_terminal_disposition: PublicationPRTerminalDispositionV1`, nullable +`publication_no_later_effects_root_sha256`, nullable nested exact +`post_merge_admission_failure: PostMergeAdmissionFailureV1`, nullable +`post_merge_admission_failure_sha256`, nullable nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1`, nullable +`publisher_credential_disposition_set_sha256`, nullable nested exact +`reconciliation_unavailable_receipt: PublisherReconciliationUnavailableReceiptV1`, nullable +`reconciliation_unavailable_receipt_sha256`, nullable +`release_authorization_ledger_root_sha256`, nullable +`release_plan_invalidation_evidence_sha256`, nullable +`release_finalizer_operation_set: ReleaseFinalizerOperationSetV1`, nullable +`release_finalizer_operation_set_sha256`, nullable +`release_reconciliation_unavailable_receipt: ReleaseReconciliationUnavailableReceiptV1`, nullable +`release_reconciliation_unavailable_receipt_sha256`, nullable +`release_no_later_effects_root_sha256`, nullable +`protocol_authority_drift_evidence_sha256`, nullable +`terminal_exposure_consumption_sha256`, `prior_latest_pointer_root_sha256`, +`proposed_latest_pointer_root_sha256`, `terminal_event_type="CORRECTION_INVALIDATED"`, +`recorded_at`, and `correction_invalidation_sha256`. All nullable fields are present. Both pointer +roots equal the active intent and remain byte-identical across invalidation. The digest domain is +`laconian-correction-invalidation-v1\n`, omitting only its final digest. + +The publication variant requires a nonnull outcome and null release evidence/roots. Its exact +outcome matrix is: + +| Publication outcome | Required nonnull fields and exact nullability | +|---|---| +| `unmerged_invalid` | exact `no_pr|closed` disposition, publication no-later root, and ordinary-premerge containment finality; publisher-unavailable/fenced/post-merge fields null | +| `merged_invalid` | nested post-merge failure/digest; the direct normal-admission arm has null containment finality, disposition and no-later root, while an active-containment ordinary/ambiguity race has merge-won finality and respectively exact disposition/no-later or both null; publisher-unavailable/fenced-premerge fields null | +| `fenced_write_ambiguity` | cause `publication_write_ambiguity_fenced`, nested exact `PublicationFencedWriteAmbiguityV1(terminal_route=correction_premerge)` and write-ambiguity-premerge containment finality; ordinary disposition/no-later/post-merge/unavailable fields null | +| `reconciliation_unavailable` | nested sealed unavailable disposition set/receipt and exact empty release-ledger root; `no_pr|closed` uses ordinary-premerge finality and null post-merge failure, while `already_merged` requires the exact post-merge failure with merge-won finality; both no-later roots null | + +The unavailable row requires `invalidation_cause=publication_reconciliation_unavailable`, the +receipt's `required_terminal_event_type=CORRECTION_INVALIDATED`, and `recorded_at` equal the +receipt/set/publisher-ledger/vault-log/release-ledger sealed time. It makes no stable external-state, +admission, merge-validity or release claim. Ordinary unmerged and containment-race merged outcomes +use the ordinary/exposure/drift/ambiguity cause fields below and set `recorded_at` to their selected +no-later closure time. Direct normal `merged_invalid` instead copies the nested +`PostMergeAdmissionFailureV1.recorded_at`. The release variant requires null publication outcome/disposition and +publisher-unavailable/post-merge fields plus a nonnull exact release-plan-invalidation root. Its +ordinary/exposure/drift form has a nonnull release no-later root, null release-unavailable objects +and its time equals release no-later close. Its `release_reconciliation_unavailable` form instead +nests the exact failure-only release operation set/receipt and duplicated digests from that +evidence, requires the release no-later root null, and records their common sealed time. +A cross-variant field, unavailable cause on a non-unavailable outcome, or free scalar root without +its required nested object is invalid. + +Every containment-form publication outcome has a nonnull exact containment finality/digest, +successor denylist, source parent, immediate terminal parent, before root equal to the intent digest +and after root null. The finality terminal parent equals `authority_parent_oid`; its intent source +parent equals `source_authority_parent_oid`. The correction terminal CAS byte-preserves the denylist +and clears the active root. The release-invalidation variant has every containment/fence field null +and its source parent null. The direct normal `merged_invalid` arm likewise has every containment/ +fence field null, has `source_authority_parent_oid=authority_parent_oid` as required by its nested +post-merge failure, and does not mutate the denylist. No nullable scalar root is +accepted without its nested exact object. + +A `correction_publication_invalidation` is allowed only with `intent.json` or +`publication-receipt.json` as parent and before a valid merge receipt. Its `publication_outcome` is +exactly `unmerged_invalid`, `merged_invalid`, `fenced_write_ambiguity`, or +`reconciliation_unavailable`. +`unmerged_invalid` binds the reason, exact publisher +actor, shared `PublicationPRTerminalDispositionV1(outcome=no_pr|closed)`, every discovered +branch/PR object, and the unchanged proposed latest pointer. Each non-unavailable, +non-ambiguity invalidation has a closed +`cause=ordinary|credential_exposure|protocol_authority_drift`; fenced ambiguity has only +`publication_write_ambiguity_fenced`. The exposure form requires the exact +terminal consumption projection and clears the active pair. The drift form requires exact +current-parent `ProtocolAuthorityDriftEvidenceV1`, whose terminal-disposition root equals the +invalidation's record, and requires the active pair null. The ordinary form forbids both emergency +objects and also requires that pair null. A `closed` record accepts exactly its strict close-kind +branch; no-PR, publisher-closed, and observed-already-closed evidence cannot substitute. + +`merged_invalid` is the terminal escape when the intent-bound correction PR is already merged but +`PostMergeAdmissionEvidenceV1` fails, so no valid `merge-receipt.json` can be written. It binds the +immutable PR/base/head, observed merge SHA and parents, merge/current-main trees, merge actor/method, +checks/approvals, current-main containment, all GitHub request receipts, and the exact +`PostMergeAdmissionFailureV1` root. It records the contaminated merge/exposure root and proves no correction +tag, Release, asset, latest-pointer event, documentation, or promotion was authorized. It never +pretends the merge was absent and never manufactures a merge receipt. A merge-before-close +exposure requires the race-form failure whose terminal projection byte-equals the invalidation's +projection. +Protocol-drift `merged_invalid` requires +`PostMergeAdmissionFailureV1(failure_kind=protocol_authority_drift_race)` whose nested drift +evidence and terminal disposition byte-equal the invalidation; its terminal exposure projection is +null. Ordinary merged invalidation uses `failure_kind=ordinary` and forbids both emergency objects. + +A `correction_release_invalidation` is allowed only after a valid `merge-receipt.json`, with that +receipt or a later tag/release receipt as parent; it binds the merge/tree roots, every created or +adopted tag/release/asset object, failure and reconciliation receipts, and proof that prior immutable +objects and the latest pointer were not changed. It uses the same three-member closed cause rule: +exposure requires terminal consumption, drift requires exact current-parent drift evidence with a +null terminal disposition, and ordinary invalidation forbids both. Either invalidation kind is installed as +`invalidation.json` with `CORRECTION_INVALIDATED` by one expected-OID CAS, makes that correction +lineage terminal, and leaves the campaign in `RELEASE_BLOCKED` or `RELEASED` as it was. Cross-phase +use, both kinds, a generic alias, or invalidation after finalization is rejected. A new attempt +requires a new correction ID and new external names; after any exposure terminalization, its intent +must explicitly supersede the failed correction root and exposure root, and after `merged_invalid` +also the contaminated merge. The prior +latest pointer remains unchanged until a later correction fully finalizes. + +Only after all five phase records verify may finalization run. `CorrectionFinalizationV1` has +exactly `schema_version="CorrectionFinalizationV1"`, `campaign_id`, +`campaign_registry_sha256`, `correction_id`, `parent_state="RELEASE_BLOCKED"|"RELEASED"`, +`authority_parent_oid`, `correction_intent_sha256`, `correction_lineage_root_sha256`, +`supersedes_event_sha256`, `superseded_terminal_root_sha256`, +`prior_latest_pointer_root_sha256`, `new_latest_pointer_root_sha256`, +`publication_receipt_sha256`, `publication_merge_receipt_sha256`, `tag_receipt_sha256`, +`release_receipt_sha256`, `corrected_result_tree_root_sha256`, +`annotated_tag_object_root_sha256`, `ordered_release_asset_root_sha256`, nested exact +`publication_success_finality: PublicationSuccessFinalityEvidenceV1`, +`publication_success_finality_root_sha256`, nested exact +`release_no_later_effects: ReleaseNoLaterEffectsEvidenceV1`, +`release_no_later_effects_root_sha256`, `publisher_broker_phase_ledger_root_sha256`, +`release_finalizer_broker_phase_ledger_root_sha256`, `publisher_live_token_count=0`, +`release_finalizer_live_token_count=0`, `terminal_event_type="CORRECTION_RESULT_RELEASED"`, +`recorded_at`, and `correction_finalization_sha256`. Every receipt is the accepted, immediately +preceding correction-lineage phase member; every duplicated identity, plan, merge, tree, tag, +release, asset, finality and ledger root byte-equals its nested source. The supersedes event/root +and prior pointer equal the intent; the new pointer is a distinct append-only successor whose bytes +name this correction and exact release. `recorded_at` equals the release no-later closure/event time +and is not before publication-success sealing. Its domain is +`laconian-correction-finalization-v1\n`, omitting only its final digest. Extra nullable phase fields, +a missing phase receipt, a scalar-only finality root, or a prior/new pointer rewrite is invalid. + +`CORRECTION_RESULT_RELEASED` is the +sole escape from `RELEASE_BLOCKED`; it binds the correction-lineage root, exact predecessor and +`supersedes` event, prior/new latest pointers, publication/merge/tag/release receipts, corrected +result-tree root, annotated-tag object root, and complete ordered release-asset root. Its exact +`finalization.json` also nests the merge-bound `PublicationSuccessFinalityEvidenceV1` and the final +`ReleaseNoLaterEffectsEvidenceV1`, repeats both roots, and requires both broker ledgers sealed with +zero live tokens; the release proof includes the final immutable verification delivery resolution. +The finalization/event time equals the release no-later final closure time. The state +writer installs `finalization.json`, the new latest pointer, the terminal correction evidence root, +and the escape event in one ordered authority commit and publishes it with one expected-OID, +non-force, fast-forward CAS. A correction from already `RELEASED` appends the same evidence while +state remains `RELEASED`; it cannot rewrite prior state, history, pointer events, tags, or releases. + +### 7.6 Initial publication and release side-effect protocol + +Initial complete and invalid-prefix publication uses the same preauthorize/create-or-adopt/receipt +discipline as correction; “initial” does not mean best-effort. `publication_id` is campaign-stable, +is 1 through 64 ASCII bytes, and matches +`[a-z0-9](?:[a-z0-9_-]{0,62}[a-z0-9])?`; `/`, `.`, `..`, controls, non-ASCII, and every Unicode +normalization alias are therefore unrepresentable. Every replan increments `publication_attempt` +in the closed range `1..99999999999999999999`, and its path form is the unique zero-padded +20-digit decimal encoding. Authority records live only under +`publication/initial//attempts/<20-digit-publication-attempt>/` with exact ordered members `intent.json`, +`branch-receipt.json`, `pr-receipt.json`, `merge-receipt.json`, optional `release-intent.json`, +optional `tag-receipt.json`, optional `draft-release-receipt.json`, optional +`asset-receipts.json`, optional `publish-receipt.json`, and zero terminal members while the attempt +is active but exactly one append-only `finalization.json` or `invalidation.json` when it becomes +terminal. Invalid-prefix publication forbids every release member. Reconstruction derives phase +from the accepted members plus campaign state/event; an active prefix is never inferred from state +name alone. + +Unless a record below states another literal explicitly, every named `*V1` wire record introduced +in sections 7.4 through 7.6 has `schema_version` exactly equal to its class name. This rule supplies +no omitted field and permits no generic or versionless alias. + +Before a publisher effect, `PUBLICATION_INTENT_AUTHORIZED` installs `intent.json` by authority CAS +while state remains `BUNDLE_COLLECTED` or `INVALID_FINALIZED`. It binds bundle kind, sealed root, +publication ID and attempt, base/head/result tree, deterministic branch name, exact commit bytes/OID, +the required attempt/correction commit-message trailer, the ordered root of prior terminal head +OIDs, PR base/title/body and embedded plan marker, expected publisher actor, +`PublicationBranchRulesetPolicyV1`, checks/approval policy, merge expectations, and separate +domain-separated idempotency keys for branch creation and delivery resolution, eligibility-check +creation and delivery resolution, PR creation and delivery resolution, every receipt, marker +discovery, terminal-guard creation, PR close, merge observation, and invalidation. No branch, check, +PR close-delivery, terminal-reconciliation-read, or PR may exist before that intent is authoritative, +and its head OID must be absent from all prior +terminal publication lineages. + +The fixed publisher queries the exact branch and PR marker before each effect. An absent branch is +created once at the intent-bound commit; an exact existing branch is adopted. An absent PR is +created once from that branch to the exact base only after the publisher App creates/adopts the +exact successful `PublicationMergeEligibilityReceiptV1` check on the head; an open or already merged PR is adopted only when +number, actor, base/head, title/body marker, sealed root, and plan all match. Branch and PR receipts +are persisted before `COMPLETE_PUBLICATION_PR_OPENED` or `INVALID_PUBLICATION_PR_OPENED` advances +state. If the human merge succeeds but the merge-event CAS or response is lost, recovery reconstructs +`PostMergeAdmissionEvidenceV1`, adopts that exact merge, persists `merge-receipt.json`, and emits +the same merge event; it never opens a replacement PR. + +The shared `GitHubAppInstallationIdentityV1` wire object has exactly `schema_version`, `app_id`, +`installation_id`, `app_slug`, `bot_login`, `repository_id`, `role`, +`permissions_attestation_sha256`, and `identity_sha256`. Its schema literal is +`GitHubAppInstallationIdentityV1`; all three numeric IDs are positive canonical integers; `role` is +exactly `state_writer`, `publisher`, or `release_finalizer`; strings are bounded nonblank safe +metadata. Its digest domain is `laconian-github-app-installation-identity-v1\n` and omits only +`identity_sha256`. The role, IDs, slug/login, repository, and permissions must equal the sealed +registry projection; an ambient Actions/bot identity is not this type. + +`BrokerTokenDeliveryIsolationPolicyV1` has exactly `schema_version`, +`api_origin="https://api.github.com"`, `api_version="2022-11-28"`, +`installation_token_endpoint="POST /app/installations/{installation_id}/access_tokens"`, ordered +`broker_roles=["publisher","release_finalizer","security_attestor"]`, +ordered exact `vault_implementation_measurements`, +`github_tls_terminates_inside_token_vault=true`, +`complete_response_validation_precedes_token_commit=true`, +`token_commit_precedes_executor_visibility=true`, +`failed_token_commit_zeroizes_response_bytes=true`, +`executor_accepts_only_committed_token_handles=true`, +`raw_token_bytes_leave_token_vault=false`, `raw_token_bytes_enter_actions=false`, +`unknown_delivery_allows_operation_dispatch=false`, and +`broker_token_delivery_isolation_policy_sha256`. The token vault treats receipt, validation and +durable encrypted commit of the complete GitHub response as one fail-closed transaction. A token +handle becomes usable only after that transaction commits a fingerprint, issued/expiry times and +the exact returned permissions; no partial or uncommitted response bytes are addressable by the +request executor. A crash or transport loss before commit therefore cannot create an accessible +bearer credential even if GitHub created one internally. Its domain is +`laconian-broker-token-delivery-isolation-policy-v1\n`, omitting only its final digest. The exact +policy is a C0 input-package member and security-review subject and is byte-copied into the campaign +registry. An implementation or measurement that cannot enforce every literal fails closed before +token mint; no assumed server-processing deadline, token-expiry estimate, installation suspension, +or later resumption is an admissible substitute. +`vault_implementation_measurements` contains exactly one +`{broker_role,vault_measurement_sha256}` member per ordered role and no duplicate measurement key; +each deployed vault must reproduce its role member before accepting a request. + +`BrokerSigningKeyV1` has exactly `schema_version`, `broker_role="publisher"| +"release_finalizer"|"security_attestor"`, `key_id`, `algorithm="Ed25519"`, +`public_key_spki_der_base64url`, `not_before`, `not_after`, and `broker_signing_key_sha256`; it has no +campaign root. Its domain is `laconian-broker-signing-key-v1\n`, omitting only its final digest. +The registry's `broker_signing_keys_root_sha256` is the domain-separated ordered Merkle root of +exactly one key per role in that order, and decoded public SPKI bytes reproduce the key material. +`BrokerSigningIdentityV1` has exactly `schema_version`, `campaign_registry_sha256`, nested exact +`signing_key: BrokerSigningKeyV1`, `broker_signing_keys_root_sha256`, and +`broker_signing_identity_sha256`. Its domain is `laconian-broker-signing-identity-v1\n`, omitting +only its final digest; the key/root byte-equal the cycle-free registry payload. Every broker policy +nests that campaign-bound identity. A ledger signature is unpadded base64url Ed25519 over its exact +domain-separated canonical preimage and verifies under the nested SPKI bytes; an unknown key, +algorithm, validity window or registry root fails closed. + +`BrokerCallerAuthorizationReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, +nested exact `scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`broker_policy_sha256`, `authorized_policy_row_sha256`, `caller_workflow_ref`, +`caller_workflow_sha256`, `caller_job`, `job_workflow_ref`, `job_workflow_sha256`, +`required_ref_class`, `oidc_issuer="https://token.actions.githubusercontent.com"`, `oidc_audience`, +`oidc_subject`, `oidc_repository`, `oidc_ref`, `oidc_sha`, `oidc_environment`, positive +`run_id`, positive `run_attempt`, positive `check_run_id`, `actor`, `authenticated_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, and +`caller_authorization_receipt_sha256`. Repository, caller/callee workflow blobs, ref/SHA, +environment, run and check-run identity are freshly resolved through the GitHub OIDC JWKS and API +and byte-equal the one exact role policy row; a caller-supplied claim projection, mutable workflow +ref, union of rows, or stale authorization is invalid. `authorized_policy_row_sha256` is the +recomputed digest of that exact member and `broker_policy_sha256` is its enclosing policy digest. +The receipt contains neither the raw OIDC JWT nor an App JWT. Its signature preimage is +`UTF8("laconian-broker-caller-authorization-signature-v1\n") || CanonicalJSONV1(record without +exactly broker_signature_base64url and caller_authorization_receipt_sha256)` and its record domain +is `laconian-broker-caller-authorization-receipt-v1\n`, omitting only the final digest. The nested +key role equals `broker_role` and is valid at `authenticated_at`. + +`BrokerTokenRequestDispatchReceiptV1` is the append-before-send mint record and has exactly +`schema_version`, `campaign_id`, `campaign_registry_sha256`, `repository_id`, +nested exact `scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, `broker_policy_sha256`, +`authorized_policy_row_sha256`, nested exact +`caller_authorization: BrokerCallerAuthorizationReceiptV1`, +`caller_authorization_receipt_sha256`, `broker_token_delivery_isolation_policy_sha256`, +`vault_measurement_sha256`, `operation_idempotency_key`, positive `credential_attempt_ordinal`, +`vault_transaction_id`, `request_id`, `request_dispatched_at`, `method="POST"`, +`endpoint_template="/app/installations/{installation_id}/access_tokens"`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="app_jwt"`, ordered `requested_permissions`, nested exact `request_body`, +`request_payload_sha256`, nested exact `broker_signing_identity: BrokerSigningIdentityV1`, +`broker_signature_base64url`, and `token_request_dispatch_receipt_sha256`. It is durably appended +and signed before the first request byte may cross the vault network boundary; its timestamp is the +actual dispatch boundary. Its duplicated identity, policy/row, caller authorization, transaction, +request, permissions and request-body fields byte-equal the terminal transport receipt. The request +body and payload rules are the same exact rules defined below. Its signature preimage uses +`laconian-broker-token-request-dispatch-signature-v1\n`; its record domain is +`laconian-broker-token-request-dispatch-receipt-v1\n`, omitting only its final digest. Neither a +terminal outcome nor any response-derived field occurs in this acyclic pre-dispatch record. + +`BrokerTokenRedactedSuccessArchiveV1` has exactly `schema_version`, +`redacted_response_canonical_json_base64`, `token_replacement_fingerprint_sha256`, +`redacted_response_sha256`, and `redacted_success_archive_sha256`. Decoding the base64 yields the +RFC 8785 bytes of the complete parsed GitHub 201 body with exactly the `token` string replaced by +`token_replacement_fingerprint_sha256`; `expires_at`, the permissions object, +`repository_selection`, every full repository object and every other official response member are +otherwise preserved. Parsing and canonicalizing those decoded bytes is idempotent and reproduces +`redacted_response_sha256`; raw token bytes are absent. Its archive domain is +`laconian-broker-token-redacted-success-archive-v1\n`, omitting only the final archive digest. + +`BrokerTokenSafeSuccessProjectionV1` is the compact authority projection and has exactly +`schema_version`, positive `installation_id`, +`repository_selection="selected"`, ordered positive `repository_ids`, ordered +`permissions`, `token_fingerprint_sha256`, `expires_at`, and +`safe_success_projection_sha256`. `installation_id` comes from the request path; every other field +is deterministically extracted from the nested redacted archive. Permissions are the complete unique +lexicographically ordered `resource:level` projection of the response `permissions` object and +repositories are the complete ascending ID projection of the response's full repository objects. +Unknown, duplicate or ill-typed response members fail parsing; no raw token bytes are +representable. Its domain is +`laconian-broker-token-safe-success-projection-v1\n`, omitting only its final digest. The canonical +projection is stored in the sealed broker evidence archive, so its digest, repository selection, +permissions and expiry are independently replayable offline. + +`BrokerTokenRequestTransportReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, +nested exact `scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, +`broker_policy_sha256`, `authorized_policy_row_sha256`, +`caller_authorization_receipt_sha256`, nested exact +`caller_authorization: BrokerCallerAuthorizationReceiptV1`, +`broker_token_delivery_isolation_policy_sha256`, `vault_measurement_sha256`, +`operation_idempotency_key`, positive +`credential_attempt_ordinal`, `vault_transaction_id`, nested exact +`request_dispatch_receipt: BrokerTokenRequestDispatchReceiptV1`, +`token_request_dispatch_receipt_sha256`, `request_id`, `request_dispatched_at`, `transport_terminal_at`, +nullable `response_completed_at`, `dispatch_state="dispatched"`, `method="POST"`, +`endpoint_template="/app/installations/{installation_id}/access_tokens"`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="app_jwt"`, ordered `requested_permissions`, nested exact +`request_body`, `request_payload_sha256`, +`outcome="successful_201"|"definite_denial"|"delivery_unknown"`, nullable positive +`response_status`, ordered `returned_permissions`, ordered positive `returned_repository_ids`, +nullable `token_fingerprint_sha256`, nullable `token_expires_at`, +nullable `token_vault_committed_at`, `durable_token_commit_count=0|1`, nullable +`safe_response_projection_kind="redacted_success_json"|"response_body_commitment"`, nullable +`safe_response_projection_sha256`, nullable nested exact +`safe_success_archive: BrokerTokenRedactedSuccessArchiveV1`, nullable nested exact +`safe_success_projection: BrokerTokenSafeSuccessProjectionV1`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, and +`token_request_transport_receipt_sha256`. `request_body` has exactly +`repository_ids=[repository_id]` and `permissions`; the latter is the lexicographically keyed JSON +object obtained by splitting every unique requested `resource:level` at the colon and assigning +that exact `read|write` level. Its RFC 8785 bytes reproduce `request_payload_sha256`; omitting +`repository_ids`, adding another repository or permission, or using installation-wide defaults is +invalid. + +The nested caller-authorization and dispatch receipts are byte-equal projections of the terminal +receipt and their duplicated digests recompute. Caller authentication completes no later than +request dispatch. The dispatch receipt is the unique append-only start record for this +campaign/role/operation/key/credential ordinal and vault transaction; the terminal receipt is its +unique completion. A request without that durable start record is forbidden, and a started request +blocks role phase advance or sealing until exactly one terminal receipt or class-bound +unrecoverability receipt has been appended. +Their nested scope identities and recomputed scope digests are identical and equal the enclosing +role-specific credential subject/disposition scope; operation keys are derived inside that scope +and cannot authorize cross-publication, cross-release or cross-attestation replay. + +`request_dispatched_at <= transport_terminal_at`. Success requires status 201, +`request_dispatched_at <= response_completed_at <= token_vault_committed_at = +transport_terminal_at`, commit count one, exact returned +permissions, `returned_repository_ids=[repository_id]`, fingerprint, expiry and a safe projection +of the complete response with only the raw `token` value replaced by its fingerprint. It requires +a nonnull nested redacted archive and safe-success projection whose request installation and +extracted repository/permission/fingerprint/expiry fields byte-equal the receipt, and +`0 < token_expires_at - token_vault_committed_at <= maximum_token_ttl_seconds` from the exact role +policy. Definite +denial permits exactly 401, 403, 404 or 422, requires +`request_dispatched_at <= response_completed_at = transport_terminal_at`, a safe projection, commit +count zero, null vault-commit time, null success archive/projection and empty returned/token fields. +Delivery unknown covers +timeout/connection loss, response loss after possible server commit, malformed payload, every +HTTP status other than documented-denial 401/403/404/422 or a valid committed 201, plus a valid +parsed 201 whose durable vault commit fails; its status and safe +projection kind/hash and response completion are all null for response loss, with dispatch no later +than terminal. For any received unknown response they are all nonnull and +`request_dispatched_at <= response_completed_at <= transport_terminal_at`; commit count and all +returned/token/commit-time fields are zero/null and both success objects are null. The vault transaction +ID is unique across campaign/role and is the same ID used by any enclosing unrecoverability receipt. +The isolation-policy root and vault measurement byte-equal the campaign registry and the exact +`broker_role` measurement member; commit count one is invalid without that join. +Broker-policy/row digests equal the role-specific policy and exact operation/purpose row selected +by identity, phase, caller/ref, operation key, permissions and endpoints; cross-row unions or an +unlisted row digest are invalid. +For success, projection kind is `redacted_success_json` and its hash equals the nested archive's +recomputed `redacted_response_sha256`; the compact projection separately recomputes and is a total +extraction from those archived bytes. For every +received non-success or malformed response, kind is `response_body_commitment` and its hash is +`SHA256(UTF8("laconian-broker-token-response-body-commitment-v1\n") || exact response-body bytes)`; +the bytes themselves are never exported because an unexpected body may contain a bearer secret. +A valid parsed 201 followed by failed durable commit uses the response-body-commitment kind, +retains status 201, but has empty returned repositories/permissions and null fingerprint/expiry/ +commit time because no usable token record exists. +The signature preimage is +`UTF8("laconian-broker-token-request-transport-signature-v1\n") || CanonicalJSONV1(record without +exactly broker_signature_base64url and token_request_transport_receipt_sha256)`; key role equals +`broker_role` and is valid at `transport_terminal_at`. The record domain is +`laconian-broker-token-request-transport-receipt-v1\n`, omitting only its final digest. + +`BrokerResponseZeroizationReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, +nested exact `scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, `vault_transaction_id`, +`token_request_transport_receipt_sha256`, +`zeroization_outcome="no_response_buffer_received"|"uncommitted_buffer_zeroized"`, nonnegative +`uncommitted_buffer_count`, `raw_token_export_count=0`, `executor_token_handle_issue_count=0`, +`vault_measurement_sha256`, `zeroized_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, and +`response_zeroization_receipt_sha256`. No-response requires count zero; buffer-zeroized requires a +positive count and complete destruction before executor visibility. It names only the already- +terminal delivery-unknown request and never a later unrecoverability receipt or audit root. Its +signature and record domains are respectively +`laconian-broker-response-zeroization-signature-v1\n` and +`laconian-broker-response-zeroization-receipt-v1\n`. The signature preimage omits exactly +`broker_signature_base64url` and `response_zeroization_receipt_sha256`; the record-digest preimage +omits exactly `response_zeroization_receipt_sha256` and includes the verified signature. + +`BrokerTokenUnrecoverabilityReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, +nested exact `scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, `broker_token_delivery_isolation_policy_sha256`, +`token_request_receipt_sha256`, nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1(outcome="delivery_unknown")`, +`token_request_transport_outcome="delivery_unknown"`, nullable +`response_status`, `vault_transaction_id`, +`vault_transaction_outcome="no_complete_response_received"|"complete_response_validation_failed"| +"durable_token_commit_failed"`, `durable_token_commit_count=0`, +`executor_token_handle_issue_count=0`, `operation_dispatch_count=0`, +`raw_token_export_count=0`, `accessible_token_count=0`, +`uncommitted_response_bytes_zeroized=true`, `vault_measurement_sha256`, nested exact +`response_zeroization_receipt: BrokerResponseZeroizationReceiptV1`, +`response_zeroization_receipt_sha256`, +`vault_audit_predecessor_entry_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, `observed_at`, and +`token_unrecoverability_receipt_sha256`. The request receipt and nullable status use the same +class-bound delivery-unknown transport result as the enclosing broker disposition; the duplicated +request digest is the nested receipt's recomputed final digest. The unique vault +transaction is absent from every successful-token commit and handle-issuance ledger and is present +once in the append-only audit log with the selected outcome and zero counters. Validation failure +includes malformed or unexpected 2xx and never permits extracting a token field; commit failure is +recordable only because executor visibility follows durable commit. The measurement byte-equals the +C0-reviewed implementation measurement for the isolation policy. The signature preimage is +`UTF8("laconian-broker-token-unrecoverability-signature-v1\n") || CanonicalJSONV1(record without +exactly broker_signature_base64url and token_unrecoverability_receipt_sha256)` and verifies under +the nested signing key whose `signing_key.broker_role` equals the receipt `broker_role` and whose +validity window includes `observed_at`. The record digest uses +`laconian-broker-token-unrecoverability-receipt-v1\n`, omitting only its final digest. Raw or partial +token bytes are unrepresentable. A receipt proves only that this protocol has no accessible token +or dispatch from the ambiguous request; it does not claim that GitHub failed to create an internal, +cryptographically unreachable token. +Vault outcome mapping is total and exact: transport/response loss selects +`no_complete_response_received`; any complete invalid, malformed or unexpected response selects +`complete_response_validation_failed`; and only a valid parsed 201 followed by failed durable commit +selects `durable_token_commit_failed`. These map to the nested request receipt's delivery-unknown +status/body/transaction fields with no alternative classification. +The nested zeroization receipt has the same role/transaction/request/measurement, its digest +recomputes, and `zeroized_at <= observed_at`; response loss selects `no_response_buffer_received`, +whereas every received invalid response or failed commit selects `uncommitted_buffer_zeroized`. +Its exact audit entry is the predecessor named by the unrecoverability receipt; the next audit entry +names the completed unrecoverability receipt, so neither object hashes its own future log root. +All three nested scope identities and digests byte-equal. +The role mapping is closed: publisher uses the publisher App identity, release finalizer uses the +release-finalizer App identity, and security attestor also uses the release-finalizer App identity +but selects the distinct `security_attestor` vault measurement and broker signing key. The nested +signing key's role and the policy measurement member both equal `broker_role`; App role alone never +selects a key or measurement. + +`BrokerVaultScopeIdentityV1` has exactly `schema_version`, `scope_kind="publication"|"release"| +"security_attestation"`, `campaign_id`, `campaign_registry_sha256`, `repository_id`, nullable +`publication_id`, nullable positive `publication_attempt`, nullable `correction_id`, nullable +`bundle_kind="complete"|"invalid_prefix"`, nullable `sealed_root_sha256`, nullable +`publication_plan_sha256`, nullable `authorizing_intent_sha256`, nullable +`release_phase="pre_intent"|"release_intent"|"tag_receipt"|"draft_release_receipt"| +"asset_receipts"|"publish_receipt"`, nullable `preauthorized_release_plan_sha256`, nullable +`release_intent_sha256`, nullable `security_attestation_purpose`, nullable +`security_attestation_subject_sha256`, and `scope_identity_sha256`. Publication scope requires the +full class-bound publication identity and null release/security fields, including null release +phase and preauthorized plan. Release scope requires that same publication identity, one exact +release phase and null security fields. At `pre_intent`, release intent is null and the preauthorized +plan is nullable only for the explicit no-plan preparation failure; at every later release phase +both preauthorized plan and accepted release intent are nonnull and byte-equal reconstructed +authority. Security scope requires one closed purpose and its exact cycle-free subject digest; +publication fields are present iff that purpose is publication-bound. Every security scope has a +null release intent. `release_preparation` alone has `release_phase=pre_intent` and a nonnull exact +preauthorized plan; the other security purposes have both release phase and preauthorized plan +null. Thus neither an attestor scope nor a pre-intent reconciliation hashes a future intent that +transitively contains its own evidence. +Every field byte-equals the enclosing disposition-set identity. Its domain is +`laconian-broker-vault-scope-identity-v1\n`, omitting only its final digest. + +`BrokerVaultAuditEntryV1` has exactly `schema_version`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, positive gapless `entry_ordinal`, nullable +`predecessor_entry_sha256`, nullable `vault_transaction_id`, nullable +`operation_idempotency_key`, nullable positive `credential_attempt_ordinal`, +`event_kind="token_request_started"|"token_request_terminal"|"token_committed"| +"operation_dispatch_started"|"operation_dispatch_terminal"|"token_delete_started"| +"token_delete_terminal"|"denial_probe_started"|"denial_probe_terminal"| +"uncommitted_response_zeroized"|"token_unrecoverable"|"token_closed"`, nullable +`token_fingerprint_sha256`, `source_receipt_sha256`, nonnegative +`outstanding_token_request_count_after`, nonnegative `outstanding_operation_dispatch_count_after`, +nonnegative `live_token_count_after`, `occurred_at`, and `entry_sha256`. Its domain is +`laconian-broker-vault-audit-entry-v1\n`, omitting only its final digest. The first predecessor is +null and each later predecessor is the prior entry digest; times are nondecreasing. Each start +increments its named outstanding count, each unique same-request terminal decrements it, successful +token commit increments live count, and exact token closure decrements live count. All other events +leave those counters unchanged. Counts are recomputed from the prefix and may never be negative. +Every event names the exact corresponding signed request, dispatch, terminal, delete, probe, +unrecoverability or closure receipt; start events name only acyclic pre-dispatch receipts. Unknown +mint paths contain no token-committed event and contain exactly one zeroization then unrecoverability +event for their unique vault transaction. No transaction, request or terminal event may be omitted, +duplicated or reassigned to another scope. + +`BrokerVaultAuditLogV1` has exactly `schema_version`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, `broker_role`, +`app_identity`, ordered nested exact `entries`, +`outstanding_token_request_count=0`, `outstanding_operation_dispatch_count=0`, +`live_token_count=0`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, `sealed_at`, and +`vault_audit_log_root_sha256`. The final scalar counts equal the last entry's recomputed counts +(or zero for an allowed empty log). The log is a bijection with the same role's signed broker-ledger +request/operation/closure evidence and with every request/closure/unrecoverability receipt in its +enclosing disposition set; its ordering is identical at equal timestamps. The log cannot seal with +an unmatched start or live committed token. Its signature preimage uses +`laconian-broker-vault-audit-log-signature-v1\n`; its record domain is +`laconian-broker-vault-audit-log-v1\n`, omitting only the final root. A bare audit root is valid only +when the enclosing finality object nests this exact recomputable signed log. +The nested signing identity's campaign registry and key root byte-equal the scope registry and +role-policy key; `signing_key.broker_role=broker_role` and +`signing_key.not_before <= sealed_at <= signing_key.not_after`. The App/role mapping is the closed +mapping above. A cross-role, expired, unknown or policy-divergent key invalidates the log. + +The event table is closed: + +| Event kind | Exact `source_receipt_sha256` type | Exact `occurred_at` | Counter delta `(request,operation,live)` | +|---|---|---|---| +| `token_request_started` | `BrokerTokenRequestDispatchReceiptV1` | request dispatch | `(+1,0,0)` | +| `token_request_terminal` | `BrokerTokenRequestTransportReceiptV1` | transport terminal | `(-1,0,0)` | +| `token_committed` | successful `BrokerTokenRequestTransportReceiptV1` | vault commit | `(0,0,+1)` | +| `operation_dispatch_started` | role-specific acyclic operation dispatch receipt | operation dispatch | `(0,+1,0)` | +| `operation_dispatch_terminal` | role-specific terminal transport receipt | transport terminal | `(0,-1,0)` | +| `token_delete_started` | `BrokerTokenClosureDispatchReceiptV1(operation="delete")` | delete dispatch | `(0,+1,0)` | +| `token_delete_terminal` | `BrokerTokenDeleteAttemptV1` | delete transport terminal | `(0,-1,0)` | +| `denial_probe_started` | `BrokerTokenClosureDispatchReceiptV1(operation="denial_probe")` | probe dispatch | `(0,+1,0)` | +| `denial_probe_terminal` | `BrokerTokenDenialProbeV1` | probe transport terminal | `(0,-1,0)` | +| `uncommitted_response_zeroized` | `BrokerResponseZeroizationReceiptV1` | zeroization completion | `(0,0,0)` | +| `token_unrecoverable` | `BrokerTokenUnrecoverabilityReceiptV1` | `observed_at` | `(0,0,0)` | +| `token_closed` | role-specific exact closure projection | `closed_at` | `(0,0,-1)` | + +All fields irrelevant to the selected event's exact source are null; vault transaction, operation +key/ordinal and fingerprint are nonnull exactly when present in that source and byte-equal it. The +predecessor of `token_unrecoverable` or `token_closed` equals the source receipt's +`vault_audit_predecessor_entry_sha256`, avoiding a receipt/log hash cycle. + +Throughout this protocol, `live_token_count` and `live_installation_token_count` count complete +bearer-token bytes or committed token handles accessible to any protocol broker, executor, workflow +or other protocol actor. A GitHub-internal token whose bytes never committed in the isolated vault +is not live under this definition because no protocol actor can authenticate with it. Every +delivery-unknown request remains explicitly inventoried by its unrecoverability receipt rather than +being silently treated as a denied mint. +For every committed token, `token_fingerprint_sha256` is exactly +`SHA256(UTF8("laconian-installation-token-fingerprint-v1\n") || exact UTF-8 token bytes)`, computed +only inside the vault; every request, dispatch, closure, probe and broker-ledger join reproduces that +same digest. `token_vault_committed_at` is not a claimed GitHub server issuance time. It equals the +successful authenticated token-request transport receipt's same-named field, which exists only +after the complete 201 response has validated and its token transaction has durably committed; +denial and delivery-unknown receipts retain their ordinary HTTP `response_completed_at` when a +response exists but have null token-vault commit time. `token_expires_at` byte-equals the successful +response's safe projection, and vault commit must precede expiry. Raw token bytes remain +unrepresentable. + +Publisher credentials have a closed broker lifecycle; a terminal check is not final while a +success-capable token remains live. `PublisherCredentialBrokerPolicyRowV1` has exactly +`schema_version`, `caller_workflow_ref`, `caller_workflow_sha256`, `caller_job`, +`job_workflow_ref`, `job_workflow_sha256`, `required_oidc_audience`, +`required_environment="benchmark-publish"`, `required_ref_class`, `protocol_phase`, +`credential_mode="installation_token"`, `operation_kind`, ordered `requested_permissions`, ordered +`endpoint_templates`, and `policy_row_sha256`. Its domain is +`laconian-publisher-credential-broker-policy-row-v1\n`, omitting only its final digest. There is +exactly one row per operation in the literal matrix below, in table order; each row's job, ref +class, phase, operation, permissions and endpoints are indivisible. The caller workflow ref/SHA +byte-equal the enclosing policy; the called-job workflow ref/SHA and OIDC audience byte-equal the +sealed registry and immutable reusable workflow blob. No digest of a caller-selected subset, +superset or union is valid. + +`PublisherCredentialBrokerPolicyV1` has exactly +`schema_version`, `campaign_registry_sha256`, `repository_id`, +`publisher_app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`broker_token_delivery_isolation_policy_sha256`, `caller_workflow_ref`, +`caller_workflow_sha256`, ordered nested exact +`allowed_rows: PublisherCredentialBrokerPolicyRowV1`, ordered +`monotonic_protocol_phases=["constructive","terminalizing","terminal_reconciling","sealed"]`, +`maximum_token_ttl_seconds=3600`, `maximum_reconciliation_attempts=3`, +`reconciliation_retry_schedule_seconds=[0,30,120]`, positive +`clock_and_transport_skew_margin_seconds`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`installation_token_enters_actions=false`, and +`publisher_credential_broker_policy_sha256`. The rows are closed to the frozen +`benchmark-publish.yml`: `publisher_effect` on exact plan-bound protected main may request +constructive `branch_create|merge_eligibility|pull_request_create`; +`publication_terminalizer` on protected current main may request terminalizing +`terminal_guard_discovery|terminal_guard|pull_request_close|terminal_merge_barrier_read| +terminal_merge_barrier_dequeue|terminal_merge_fence_rerun`; and that same fixed job may request +`terminal_reconciliation_read` only after every write-token disposition is closed. Constructive +permissions are the least-privilege applicable subset of `contents:write`, `checks:write`, +`pull_requests:write`, and `metadata:read`; terminalizing uses only `checks:write| +pull_requests:write|contents:read|pull_requests:read|merge_queues:read|merge_queues:write| +actions:read|actions:write|checks:read|metadata:read`; reconciliation uses only `contents:read|checks:read| +pull_requests:read|metadata:read`. A row cannot union permissions from another operation. Its +domain is `laconian-publisher-credential-broker-policy-v1\n`, omitting only its final digest. + +The row arrays byte-equal this literal operation matrix; no caller-selected subset or endpoint is +valid. Token mint uses `POST /app/installations/{installation_id}/access_tokens`, closure uses +`DELETE /installation/token`, and the denial probe uses `GET /repos/{owner}/{repo}` in every minted +row in addition to the operation endpoints below. +| Operation | Phase | Exact requested permissions | Exact operation endpoints | +|---|---|---|---| +| `branch_create` | `constructive` | `contents:write`, `metadata:read` | `GET /repos/{owner}/{repo}/git/ref/heads/{branch_name}`; `POST /repos/{owner}/{repo}/git/refs` | +| `merge_eligibility` | `constructive` | `checks:write`, `metadata:read` | `GET /repos/{owner}/{repo}/commits/{head_oid}/check-suites`; `GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs`; `POST /repos/{owner}/{repo}/check-runs` | +| `pull_request_create` | `constructive` | `metadata:read`, `pull_requests:write` | `GET /repos/{owner}/{repo}/pulls`; `GET /repos/{owner}/{repo}/pulls/{pull_request_number}`; `POST /repos/{owner}/{repo}/pulls` | +| `terminal_guard_discovery` | `terminalizing` | `contents:read`, `metadata:read`, `pull_requests:read` | `GET /repos/{owner}/{repo}/git/ref/heads/{branch_name}`; `GET /repos/{owner}/{repo}/pulls` | +| `terminal_guard` | `terminalizing` | `checks:write`, `metadata:read` | `GET /repos/{owner}/{repo}/commits/{head_oid}/check-suites`; `GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs`; `PATCH /repos/{owner}/{repo}/check-runs/{check_run_id}`; `POST /repos/{owner}/{repo}/check-runs` | +| `pull_request_close` | `terminalizing` | `metadata:read`, `pull_requests:write` | `GET /repos/{owner}/{repo}/pulls`; `GET /repos/{owner}/{repo}/pulls/{pull_request_number}`; `PATCH /repos/{owner}/{repo}/pulls/{pull_request_number}` | +| `terminal_merge_barrier_read` | `terminalizing` | `actions:read`, `checks:read`, `contents:read`, `merge_queues:read`, `metadata:read`, `pull_requests:read` | `POST /graphql` restricted to the three C0-frozen queue/timeline documents; `GET /repos/{owner}/{repo}/git/ref/heads/main`; `GET /repos/{owner}/{repo}/pulls`; `GET /repos/{owner}/{repo}/compare/{from_oid}...{to_oid}`; `GET /repos/{owner}/{repo}/git/commits/{commit_oid}`; `GET /repos/{owner}/{repo}/git/commits/{head_oid}`; `GET /repos/{owner}/{repo}/commits/{commit_oid}/pulls`; `GET /repos/{owner}/{repo}/actions/runs/{workflow_run_id}`; `GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs`; `GET /repos/{owner}/{repo}/check-runs/{check_run_id}`; `GET /repos/{owner}/{repo}/actions/runs/{workflow_run_id}/artifacts`; authenticated `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip` only to receive the validated 302; one credential-free `GET` to that exact allowlisted Location with Authorization/cookies stripped | +| `terminal_merge_barrier_dequeue` | `terminalizing` | `merge_queues:write`, `metadata:read` | `POST /graphql` restricted to the C0-frozen dequeue mutation and broker-derived PR node/client-mutation ID | +| `terminal_merge_fence_rerun` | `terminalizing` | `actions:write`, `metadata:read` | `POST /repos/{owner}/{repo}/actions/runs/{workflow_run_id}/rerun`, with the broker-authenticated frozen workflow/event/group/App/context target proof | +| `terminal_reconciliation_read` | `terminal_reconciling` | `checks:read`, `contents:read`, `metadata:read`, `pull_requests:read` | `GET /repos/{owner}/{repo}/git/ref/heads/{branch_name}`; `GET /repos/{owner}/{repo}/pulls`; `GET /repos/{owner}/{repo}/commits/{head_oid}/check-suites`; `GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs`; `GET /repos/{owner}/{repo}/git/ref/tags/{tag_name}`; `GET /repos/{owner}/{repo}/git/tags/{tag_oid}`; `GET /repos/{owner}/{repo}/releases`; `GET /repos/{owner}/{repo}/releases/{release_id}`; `GET /repos/{owner}/{repo}/releases/{release_id}/assets`; `GET /repos/{owner}/{repo}/contents/{latest_pointer_path}` | + +`PublisherCredentialSubjectV1` is the cycle-free post-mint/pre-operation authority object. It has +exactly `schema_version`, the full campaign/registry/publication/attempt/correction/bundle/plan/ +intent identity, `repository_id`, `operation_kind`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, `publisher_credential_broker_policy_sha256`, +`authorized_policy_row_sha256`, `app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`caller_authorization_receipt_sha256`, nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1(outcome="successful_201")`, +`token_request_receipt_sha256`, ordered `requested_permissions`, ordered `returned_permissions`, +`token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, and +`publisher_credential_subject_sha256`. The request digest recomputes; every identity, role/App, +policy/row, caller, operation/key/ordinal, permission and token field byte-equals the request and +the selected publisher policy row. Requested and returned permissions are equal. Its domain is +`laconian-publisher-credential-subject-v1\n`, omitting only its final digest. Because it contains no +operation attempt, closure, disposition or ledger root, it is constructible before the first +publisher API effect and may be safely named by dispatch/page receipts. A permission mismatch, +denial or unknown mint can never produce this subject. + +`PublisherOperationRequestDispatchReceiptV1` is the append-before-send record for every publisher +write or operation-owned GET, including the validated credential-free artifact-object-store follow. +It has exactly `schema_version`, the full campaign/ +registry/publication/attempt/correction/bundle/plan/intent identity, `repository_id`, +`operation_kind`, `operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, nullable positive `source_attempt_ordinal`, `attempt_kind`, nullable +positive `operation_round_ordinal`, nullable `observation_stage="pre"|"post"|"final"| +"containment_preflight"|"containment_pre_action"|"containment_action"| +"containment_first"|"containment_second"|"containment_advance"`, nullable +`containment_snapshot_ordinal=0|1|2`, nullable +`observation_round=1|2`, nullable +`page_ordinal`, `publisher_credential_broker_policy_sha256`, `authorized_policy_row_sha256`, +`publisher_credential_subject_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, nested exact +`caller_authorization: BrokerCallerAuthorizationReceiptV1(broker_role="publisher")`, +`caller_authorization_receipt_sha256`, `token_request_receipt_sha256`, +`token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, `request_id`, +`request_dispatched_at`, `method`, `endpoint_template`, `request_payload_sha256`, nullable +`target_object_id`, nullable `target_authorization_proof_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `operation_request_dispatch_receipt_sha256`. It is durably +appended before the first request byte crosses the network boundary. The policy/row, App, caller, +operation/key/ordinal and token provenance byte-equal the exact same-operation +`PublisherCredentialSubjectV1`; method/endpoint/payload/target equal the literal operation matrix and authority-derived +request. `token_vault_committed_at <= request_dispatched_at < token_expires_at`; the caller +authorization precedes or equals dispatch and the signing key is valid then. Its signature and +record domains are respectively `laconian-publisher-operation-request-dispatch-signature-v1\n` and +`laconian-publisher-operation-request-dispatch-receipt-v1\n`. The signature preimage is +`UTF8("laconian-publisher-operation-request-dispatch-signature-v1\n") || +CanonicalJSONV1(record without exactly broker_signature_base64url and +operation_request_dispatch_receipt_sha256)`; the record digest is SHA-256 of the record domain +followed by canonical JSON omitting exactly its final digest and including the verified signature. +It contains no outcome or +response-derived field. +For `attempt_kind=workflow_artifact_archive`, token/App fields are authorization provenance only: +the request URL is the exact prior redirect digest target and the wire request has neither +Authorization nor Cookie header as proved by `PublicationMergeFenceArtifactArchiveReceiptV1`. + +`PublisherOperationTransportReceiptV1` is the unique terminal mate for a publisher operation +attempt and has exactly `schema_version`, the same full identity, `repository_id`, `operation_kind`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, positive +`operation_request_ordinal`, nullable positive `source_attempt_ordinal`, `attempt_kind`, nullable +positive `operation_round_ordinal`, nullable `observation_stage="pre"|"post"|"final"| +"containment_preflight"|"containment_pre_action"|"containment_action"| +"containment_first"|"containment_second"|"containment_advance"`, nullable +`containment_snapshot_ordinal=0|1|2`, nullable +`observation_round=1|2`, nullable +`page_ordinal`, `publisher_credential_broker_policy_sha256`, `authorized_policy_row_sha256`, +nullable `publisher_credential_subject_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, `request_id`, +`dispatch_state="not_dispatched"|"dispatched"`, nullable nested exact +`request_dispatch_receipt: PublisherOperationRequestDispatchReceiptV1`, nullable +`operation_request_dispatch_receipt_sha256`, `method`, `endpoint_template`, +`request_payload_sha256`, nullable `target_object_id`, nullable +`target_authorization_proof_sha256`, `outcome`, nullable positive +`response_status`, nullable `response_completed_at`, nullable `safe_response_sha256`, nullable +`resolved_object_id`, nullable `resolved_object_root_sha256`, nullable +`source_observation_sha256`, `attempt_terminal_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `operation_transport_receipt_sha256`. For `dispatched`, the +nested start receipt is nonnull, its digest recomputes, every duplicated field byte-equals, and +`request_dispatched_at <= response_completed_at <= attempt_terminal_at` for a +received response; response loss has null status/completion/safe hash and dispatch no later than +terminal. Token validity is checked at the nested dispatch boundary; a response or reconciliation +may terminate after expiry and remains inventoried rather than becoming an unmatched start. A +delivery later resolved by class-bound reads names their final observation root. For +`not_dispatched`, the credential-subject digest, both nullable start fields, all response fields and every resolved/source field +are null, outcome is exactly `not_dispatched`, and `attempt_terminal_at` is the durable +no-dispatch decision time. Outcome/status/result nullability otherwise equals the one closed source +attempt matrix for its operation and attempt kind; a generic receipt cannot widen that enum. +Every source attempt's `transport_receipt_sha256` is the recomputed digest of this exact same-ordinal +receipt nested in `PublisherOperationTransportProjectionV1`; every reconciliation page or other GET +request hash is likewise in bijection with one such receipt, with its page/observation digest in +`source_observation_sha256`. Its signature preimage uses +`laconian-publisher-operation-transport-signature-v1\n`; it omits exactly +`broker_signature_base64url` and `operation_transport_receipt_sha256`. Its record +digest uses `laconian-publisher-operation-transport-receipt-v1\n`, omits exactly its final +digest and includes the verified signature. + +The broker advances a durable per-publication phase monotonically before minting. Entering +`terminalizing` irrevocably disables branch, eligibility-success, and PR-create token requests for +that attempt/head; `terminal_reconciling` disables every publisher write token; `sealed` denies all +requests. Workflow inputs cannot lower the phase. The external broker performs allowed calls and +returns only safe receipt hashes; no installation token or authorization header enters Actions. + +`PublisherNoMintReceiptV1` has exactly `schema_version`, the same full publication identity, +`repository_id`, `operation_kind`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, `authorized_policy_row_sha256`, +`reason="phase_forbidden"|"operation_not_required"|"superseded_before_request"`, +`token_request_count=0`, `operation_dispatch_count=0`, `recorded_at`, and +`no_mint_receipt_sha256`. Reason must equal reconstructed authority/phase and cannot replace a +required operation. Its domain is `laconian-publisher-no-mint-receipt-v1\n`, omitting only its final +digest. + +`BrokerTokenClosureDispatchReceiptV1` is the acyclic append-before-send record for token deletion +and denial probes. It has exactly `schema_version`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1`, `scope_identity_sha256`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, `broker_policy_sha256`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`token_request_receipt_sha256`, `token_fingerprint_sha256`, `token_vault_committed_at`, +`token_expires_at`, `operation="delete"|"denial_probe"`, positive `ordinal`, `request_id`, +`request_dispatched_at`, `method="DELETE"|"GET"`, `endpoint_template`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="isolated_installation_token_handle"`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1`, `broker_signature_base64url`, and +`token_closure_dispatch_receipt_sha256`. Delete maps only to `DELETE /installation/token`; probe +maps only to `GET /repos/{owner}/{repo}`. It is durably appended before the request crosses the +network boundary and contains no terminal outcome. Its full identity/policy/token fields byte-equal +the enclosing closure and disposition. Its signature and record domains are respectively +`laconian-broker-token-closure-dispatch-signature-v1\n` and +`laconian-broker-token-closure-dispatch-receipt-v1\n`. The signature preimage omits exactly +`broker_signature_base64url` and `token_closure_dispatch_receipt_sha256`; the record-digest preimage +omits exactly `token_closure_dispatch_receipt_sha256` and includes the verified signature. + +`PublisherTokenClosureProjectionV1` has exactly `schema_version`, the same campaign/registry/ +publication/attempt/correction/bundle/plan/intent identity, `repository_id`, `operation_kind`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`publisher_credential_broker_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`token_request_receipt_sha256`, ordered `requested_permissions`, ordered +`returned_permissions`, `token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, +`outcome="revoked_204"|"ambiguous_delivery_then_confirmed_unusable"| +"expired_then_confirmed_unusable"`, ordered nested exact +`delete_attempts: BrokerTokenDeleteAttemptV1`, `closure_boundary_at`, ordered nested exact +`denial_probe_attempts: BrokerTokenDenialProbeV1`, +`post_boundary_same_token_operation_dispatch_count=0`, +`vault_audit_predecessor_entry_sha256`, `closed_at`, and `token_closure_projection_sha256`. +`BrokerTokenDeleteAttemptV1` has exactly `schema_version`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1`, `broker_policy_sha256`, positive gapless +`ordinal`, `request_id`, nested exact +`dispatch_receipt: BrokerTokenClosureDispatchReceiptV1(operation="delete")`, +`token_closure_dispatch_receipt_sha256`, +`request_dispatched_at`, `transport_terminal_at`, nullable `response_completed_at`, +`dispatch_state="dispatched"`, `method="DELETE"`, `endpoint_template="/installation/token"`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="isolated_installation_token_handle"`, `token_fingerprint_sha256`, +`outcome="confirmed_204"|"response_lost"|"observed_non_204"`, nullable positive +`response_status`, nullable `safe_response_sha256`, and `transport_receipt_sha256`. Confirmed +requires status 204, response completion equal to transport terminal and the SHA-256 of empty +response bytes; response loss requires null status/response fields and dispatch no later than +transport terminal; observed non-204 permits every received positive HTTP status other than 204 +and requires both response fields with +`request_dispatched_at <= response_completed_at <= transport_terminal_at`. Every attempt has +`token_vault_committed_at <= request_dispatched_at < token_expires_at`; no delete is dispatched at +or after expiry, including on the expiry-confirmation path. Delete attempts are serialized: each later dispatch is strictly after the prior +`transport_terminal_at`, so the highest ordinal is also temporally last. +Its domain is `laconian-broker-token-delete-attempt-v1\n`, omitting only +`transport_receipt_sha256`. +The nested dispatch digest recomputes and every role/scope/App/policy/operation/key/credential/token/ +ordinal/request/method/endpoint/dispatch-time field byte-equals the terminal attempt and enclosing +closure. The audit start names that dispatch digest; its unique next same-request terminal names this +attempt digest. + +`BrokerTokenDenialProbeV1` has exactly `schema_version`, +`broker_role="publisher"|"release_finalizer"|"security_attestor"`, the same repository/App/ +`broker_policy_sha256` and token fingerprint, positive gapless `ordinal`, `request_id`, nested exact +`dispatch_receipt: BrokerTokenClosureDispatchReceiptV1(operation="denial_probe")`, +`token_closure_dispatch_receipt_sha256`, `request_dispatched_at`, +`transport_terminal_at`, nullable `response_completed_at`, +`method="GET"`, `endpoint_template="/repos/{owner}/{repo}"`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="isolated_installation_token_handle"`, +`outcome="denied_401"|"response_lost"|"observed_retryable"`, nullable positive +`response_status`, nullable `safe_response_sha256`, and +`denial_probe_sha256`. Denied requires status 401 and both response fields; response loss requires +null status/response fields; retryable permits every received positive HTTP status other than 401 +and requires both response fields. Every received probe has +`request_dispatched_at <= response_completed_at <= transport_terminal_at`; a lost response has +dispatch no later than terminal. Its domain is +`laconian-broker-token-denial-probe-v1\n`, omitting only its final digest; the request executor +uses the committed handle and never exports token bytes. The enclosing probe array is empty exactly +for `revoked_204` and nonempty for the other two outcomes; when nonempty it is serialized; +the nested dispatch digest and all duplicated identity/token/request/time fields recompute exactly; +the audit start/terminal pair names the dispatch and probe digests respectively. +For both terminal attempt types, audit fields not duplicated directly—scope identity, operation key, +credential ordinal, token-request digest and vault commit/expiry—are extracted only through the +nested exact dispatch receipt and must equal the enclosing closure; the terminal attempt cannot +override them. The three closure outcomes are first-decisive and disjoint. `revoked_204` requires +exactly one first/only observed 204 in a nonempty delete sequence; any earlier members are only +response-lost or observed-non-204, the boundary is that 204 response completion, no later delete or +denial-probe dispatch exists, and `closed_at=closure_boundary_at <= token_expires_at`. +`ambiguous_delivery_then_confirmed_unusable` requires no observed 204 anywhere, at least one lost +delete, and sets the boundary to the final delete transport terminal before expiry. Its nonempty +probe sequence starts strictly after the boundary and before expiry; every earlier probe is +response-lost/retryable, the final is `denied_401`, and `closed_at` equals that final response. +`expired_then_confirmed_unusable` requires no observed 204 whose response completes at or before +expiry and no earlier decisive unusability, and sets the boundary exactly to signed expiry. It +permits only a serialized pre-expiry-dispatched delete prefix; because each later delete dispatch +must follow the prior terminal, that prefix contains at most one 204 whose response completes +strictly after expiry. Every probe dispatch is strictly after both the boundary and the last delete +terminal, its final probe is `denied_401`, and `closed_at` equals that final response. Thus a delete +legally dispatched before expiry but confirmed 204 only after expiry is classified by the expiry +branch and still requires post-expiry denial proof. No path can satisfy another path's predicate. + +At the boundary the vault atomically marks this exact `(scope_identity,broker_role, +token_fingerprint_sha256)` handle non-dispatchable for every ordinary operation/effect. The +append-only vault log replays +`post_boundary_same_token_operation_dispatch_count=0` by counting every same-token +`operation_dispatch_started`/role-specific effect-dispatch-start after the boundary regardless of +its eventual success, error or response loss. Only closure delete and denial-probe starts are +excluded; a later fresh token fingerprint is a distinct lifecycle. The probe attempts themselves +are all bound by the closure digest. The closure's requested and returned arrays byte-equal the disposition; equality is +required only for `minted_then_closed`, while the permission-mismatch status requires inequality. +Every common delete/probe member's role, App, policy and fingerprint byte-equal its enclosing +closure. Role-to-App mapping is the same closed mapping as token request and unrecoverability +receipts. `broker_policy_sha256` equals `publisher_credential_broker_policy_sha256`, +`release_finalizer_broker_policy_sha256`, or `security_attestor_caller_policy_sha256` for the +corresponding broker role and no other mapping is valid. The closure's `token_request_receipt_sha256` equals the enclosing +disposition's nested request transport digest. +For every received delete/probe response, `safe_response_sha256` is SHA-256 of the exact response- +body bytes (the 204 body is empty); authorization/request headers and token bytes are never part of +that body or archive. Response loss has a null safe hash. +The closure projection domain is +`laconian-publisher-token-closure-projection-v1\n`, omitting only its final digest. + +`PublisherReconciliationAttachmentReceiptV1` has exactly `schema_version`, the same full +publication identity, `repository_id`, `operation_kind`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive `source_credential_attempt_ordinal`, +`zero_effect_source_disposition_sha256`, `operation_final_observation_root_sha256`, +`terminal_reconciliation_observation_sha256`, +`reconciliation_read_credential_subject_sha256`, `attached_at`, and +`reconciliation_attachment_receipt_sha256`. The source ordinal is lower, has the same operation/key +and names exactly one earlier no-dispatch disposition. The two observation roots byte-equal the +synthetic disposition's final projection and the second stable terminal-reconciliation observation; +the credential-subject digest is the recomputed exact +`PublisherCredentialSubjectV1(operation_kind="terminal_reconciliation_read")` used by every +attached observation/page, and is independent of the synthetic write operation's key and ordinal. +`attached_at` equals that second observation's authenticated `observed_at`, the enclosing synthetic +disposition's `closed_or_not_minted_at`, and its `reconciliation_attached` ledger entry's +`occurred_at`. Its domain is +`laconian-publisher-reconciliation-attachment-receipt-v1\n`, omitting only its final digest. + +Every operation has one class-bound `PublisherOperationCredentialDispositionV1` with exactly +`schema_version`, the same campaign/registry/publication/attempt/correction/bundle/plan/intent +identity, `repository_id`, `operation_kind`, `operation_idempotency_key`, `protocol_phase`, positive +`credential_attempt_ordinal`, +`publisher_credential_broker_policy_sha256`, `authorized_policy_row_sha256`, +`broker_phase_ledger_root_sha256`, +nested exact `operation_transport: PublisherOperationTransportProjectionV1`, +`operation_transport_root_sha256`, nested exact +`operation_final_observation: PublisherOperationFinalObservationProjectionV1`, +`operation_final_observation_root_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`credential_status="not_minted"|"mint_denied_no_dispatch"|"minted_then_closed"| +"minted_permission_mismatch_then_closed_no_dispatch"| +"mint_delivery_unknown_unrecoverable_no_dispatch"| +"reconciliation_sourced_zero_effect"`, ordered +`requested_permissions`, ordered +`returned_permissions`, nullable `token_request_receipt_sha256`, nullable nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1`, nullable +`publisher_credential_subject_sha256`, nullable nested exact +`publisher_credential_subject: PublisherCredentialSubjectV1`, nullable +`no_mint_receipt: PublisherNoMintReceiptV1`, nullable nested exact +`token_unrecoverability_receipt: BrokerTokenUnrecoverabilityReceiptV1`, nullable +`zero_effect_source_disposition_sha256`, nullable nested exact +`reconciliation_attachment_receipt: PublisherReconciliationAttachmentReceiptV1`, nullable +`token_fingerprint_sha256`, nullable `token_vault_committed_at`, nullable `token_expires_at`, nullable +nested exact `token_closure: PublisherTokenClosureProjectionV1`, +`closed_or_not_minted_at`, and +`credential_disposition_sha256`. `operation_kind` is exactly `branch_create`, +`merge_eligibility`, `pull_request_create`, `terminal_guard_discovery`, `terminal_guard`, +`pull_request_close`, `terminal_merge_barrier_read`, +`terminal_merge_barrier_dequeue`, `terminal_merge_fence_rerun`, or +`terminal_reconciliation_read`; phase, endpoint and caller equal the named policy row. Requested +permissions equal that row only when a token request occurred. No-request/synthetic dispositions +use empty arrays but retain the exact authorized row digest. Every nonnull credential subject has a +recomputed duplicated digest and byte-equal disposition identity, policy/row, App, request, +permission and token fields. +`not_minted` requires empty permission arrays, a nonnull exact no-mint receipt proving no token request and +no dispatch, and every request receipt/credential-subject/unrecoverability/source/attachment/token/closure field null. +`mint_denied_no_dispatch` requires a nonnull exact request transport with `definite_denial` and its +byte-equal duplicated digest, expected requested permissions, empty returned permissions, a null no-mint receipt, and null +credential-subject/unrecoverability/source/attachment/token/closure fields with zero dispatch. +`minted_then_closed` requires a nonnull exact `successful_201` request transport and digest, equal +requested and returned least-privilege arrays, a nonnull exact publisher credential subject, all +token/closure fields nonnull, authenticated token vault commit before expiry, +and the nested closure identity/permissions/token/times byte-equal the disposition. +`minted_permission_mismatch_then_closed_no_dispatch` requires the same successful request transport, +unequal returned permissions, a null credential subject, full token/closure fields and zero dispatch; it is terminally +inventoried but authorizes no API effect. +Both minted variants have null unrecoverability/source/attachment fields. +`mint_delivery_unknown_unrecoverable_no_dispatch` +requires a nested dispatched token-request transport with `delivery_unknown` whose outcome is not a class-bound definite denial +or valid captured token response—including timeout, connection loss, 202, 5xx, malformed or +unexpected 2xx, and response loss after possible server commit—exact requested and empty returned +permissions, a nonnull exact role-matching unrecoverability receipt, null no-mint/source/attachment/ +credential-subject/token/response-time/closure fields, and zero operation dispatch. Its terminal time equals the receipt's +`observed_at`; a later independent mint is a new credential-attempt ordinal and cannot reuse this +request or transaction. In every request-bearing status, the duplicated request digest is the +nested transport receipt's recomputed digest; disposition, unrecoverability receipt and transport +receipt reproduce the same role/App, broker policy, authorized row, requested permissions, +operation key, ordinal and vault transaction where applicable. Denial, success and unknown +transports all nest the exact caller authorization and dispatch receipt selected by that same row. +`reconciliation_sourced_zero_effect` is the one resolution-selected +zero-effect member after an earlier same-operation no-dispatch disposition. It has empty permission +arrays, null request digest/transport/credential-subject/no-mint/unrecoverability/token fields, a nonnull +`zero_effect_source_disposition_sha256` naming that earlier `not_minted`, denied, +permission-mismatched-and-closed, or unrecoverable member, a byte-matching nonnull exact attachment +receipt, the complete same-ordinal source attempts all represented by strict +`PublisherOperationTransportReceiptV1(dispatch_state="not_dispatched", +publisher_credential_subject_sha256=null)` members, zero dispatched write attempts, and exact final +observations sourced from the separately closed terminal-reconciliation read. It closes at its +final observation time and allows no write. On `stable_read_sealed`, the final read uses a fresh +least-privilege token and closes normally; failed attempts retain new ordinals. A caller may stop +retrying only by selecting the signed `reconciliation_unavailable_sealed` branch, which grants no +stable-state or success authority. +Ambiguous revocation and expiry use the nested class-bound closure proof above. The nested +projections recompute their duplicated roots and bind the +exact enclosing delivery resolution without hashing that resolution's final digest, avoiding a cycle. Its domain is +`laconian-publisher-operation-credential-disposition-v1\n`, omitting only its final digest; raw +token bytes are unrepresentable. + +The two disposition roots are exact acyclic projections. `PublisherOperationTransportProjectionV1` +has exactly `schema_version`, the same identity, `operation_kind`, `operation_idempotency_key`, +ordered `attempts`, `transport_terminal=true`, and `operation_transport_root_sha256`. Each strict +`PublisherOperationAttemptProjectionV1` has exactly positive `operation_request_ordinal`, nullable +positive `source_attempt_ordinal`, `attempt_kind`, nullable +positive `operation_round_ordinal`, nullable `observation_stage="pre"|"post"|"final"| +"containment_preflight"|"containment_pre_action"|"containment_action"| +"containment_first"|"containment_second"|"containment_advance"`, nullable +`containment_snapshot_ordinal=0|1|2`, nullable +`observation_round=1|2`, nullable `page_ordinal`, `request_id`, +`dispatch_state="not_dispatched"|"dispatched"`, `method`, `endpoint_template`, +`request_payload_sha256`, nullable `target_object_id`, nullable +`target_authorization_proof_sha256`, `outcome`, nullable `response_status`, +nullable `safe_response_sha256`, nullable `resolved_object_id`, nullable +`resolved_object_root_sha256`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, and +`transport_receipt_sha256`. Operation-request ordinals are gapless in actual dispatch/decision +order. Source-attempt ordinal is nonnull and gapless only within a source write-attempt array; it is +null for GET/page observations, whose round/stage/page coordinates are independently bound. The nested +terminal receipt's recomputed digest, global/source ordinals, source identity and every duplicated +field byte-equal the projection. +For a dispatched member its nested pre-dispatch receipt is the unique ledger start evidence; for a +non-dispatched member both nested start fields are null. The closed +operation matrix is: + +| Operation | Attempt kind and round/page | Literal method/endpoint | Allowed outcome set | +|---|---|---|---| +| `branch_create` | `branch_create`; source ordinal nonnull; all observation coordinates null | `POST /repos/{owner}/{repo}/git/refs` | the exact `PublicationBranchCreateDeliveryResolutionV1` write-attempt enum | +| `branch_create` | `branch_ref`; source/op-round null; stage `final`; observation round `1|2`; page null | `GET /repos/{owner}/{repo}/git/ref/heads/{branch_name}` | publisher read outcome enum | +| `merge_eligibility` | `check_create`; source ordinal nonnull; all observation coordinates null | `POST /repos/{owner}/{repo}/check-runs` | exact eligibility write-attempt enum | +| `merge_eligibility` | `check_suite_page|check_run_page`; source/op-round null; stage `final`; observation round `1|2`; positive page | the matching check suite/run GET endpoint | publisher read outcome enum | +| `pull_request_create` | `pr_create`; source ordinal nonnull; all observation coordinates null | `POST /repos/{owner}/{repo}/pulls` | exact PR-create write-attempt enum | +| `pull_request_create` | `pr_marker_page`; source/op-round null; stage `final`; observation round `1|2`; positive page | `GET /repos/{owner}/{repo}/pulls` | publisher read outcome enum | +| `terminal_guard_discovery` | `branch_ref`; source null; positive operation round; stage `pre|post`; observation round/page null | `GET /repos/{owner}/{repo}/git/ref/heads/{branch_name}` | publisher read outcome enum | +| `terminal_guard_discovery` | `pr_marker_page`; source null; positive operation round; stage `pre|post`; observation round `1|2`; positive page | `GET /repos/{owner}/{repo}/pulls` | publisher read outcome enum | +| `terminal_guard` | `guard_update|guard_create`; source and operation-round ordinals nonnull; observation coordinates null | respectively `PATCH /repos/{owner}/{repo}/check-runs/{check_run_id}` or `POST /repos/{owner}/{repo}/check-runs` | exact guard write-attempt enum | +| `terminal_guard` | `check_suite_page|check_run_page`; source null; positive operation round; stage `post`; observation round `1|2`; positive page | matching check suite/run GET endpoint | publisher read outcome enum | +| `pull_request_close` | `pr_close`; source ordinal nonnull; all observation coordinates null | `PATCH /repos/{owner}/{repo}/pulls/{pull_request_number}` | exact close write-attempt enum | +| `pull_request_close` | `pr_state`; source/op-round null; stage `pre`; observation round/page null, or stage `final`; observation round `1|2`; page null | `GET /repos/{owner}/{repo}/pulls/{pull_request_number}` | publisher read outcome enum | +| `pull_request_close` | `pr_marker_page`; source/op-round null; stage `final`; observation round `1|2`; positive page | `GET /repos/{owner}/{repo}/pulls` | publisher read outcome enum | +| `terminal_merge_barrier_read` | `protected_main_ref`; source/op-round/page/observation-round null; stage/snapshot exactly `containment_preflight/0|containment_first/1|containment_second/2` | `GET /repos/{owner}/{repo}/git/ref/heads/main` | publisher read outcome enum | +| `terminal_merge_barrier_read` | `pr_marker_page`; source/op-round null; stage/snapshot exactly preflight/0, first/1 or second/2; observation round `1|2`; positive page | `GET /repos/{owner}/{repo}/pulls` | publisher read outcome enum | +| `terminal_merge_barrier_read` | `merge_queue_pr_query`; source/op-round/page/observation-round null; stage/snapshot exactly preflight/0, pre-action/0, first/1 or second/2 | `POST /graphql` with the fixed queue-state document | publisher read outcome enum | +| `terminal_merge_barrier_read` | `merge_queue_inventory_page`; source/op-round/observation-round null; the same four stage/snapshot pairs; positive page | `POST /graphql` with the fixed inventory document | publisher read outcome enum | +| `terminal_merge_barrier_read` | `merge_queue_timeline_page`; source/op-round/round/snapshot null; stage `containment_action`; positive page | `POST /graphql` with the fixed timeline document | publisher read outcome enum | +| `terminal_merge_barrier_read` | `workflow_run|check_run|workflow_artifacts_page`; source/op-round/round/snapshot null; stage `containment_action`; page positive only for artifacts page | the exact Actions/direct-check/artifact-list GET endpoint in the policy row | publisher read outcome enum | +| `terminal_merge_barrier_read` | `fence_check_run_page`; source/op-round/round/snapshot null; stage `containment_action`; positive page | `GET /repos/{owner}/{repo}/check-suites/{check_suite_id}/check-runs` | publisher read outcome enum | +| `terminal_merge_barrier_read` | `workflow_artifact_redirect`; source/op-round/round/snapshot/page null; stage `containment_action` | authenticated `GET /repos/{owner}/{repo}/actions/artifacts/{artifact_id}/zip` | exactly `read_redirect_302` on a validated Location; every other terminal result uses the ordinary failure outcomes | +| `terminal_merge_barrier_read` | `workflow_artifact_archive`; source/op-round/round/snapshot/page null; stage `containment_action` | credential-free GET of the exact validated allowlisted Location | `read_200` only with Authorization/cookies absent and the bounded ZIP receipt; otherwise ordinary failure outcomes | +| `terminal_merge_barrier_read` | `main_compare_page|commit_pull_requests_page`; source/op-round/round/snapshot null; stage `containment_advance`; positive page | exact compare or commit-pulls GET endpoint | publisher read outcome enum | +| `terminal_merge_barrier_read` | `main_commit|head_commit`; source/op-round/round/snapshot/page null; stage `containment_advance` | respectively `GET /repos/{owner}/{repo}/git/commits/{commit_oid}` or `GET /repos/{owner}/{repo}/git/commits/{head_oid}` | publisher read outcome enum | +| `terminal_merge_barrier_dequeue` | `merge_queue_dequeue`; positive source ordinal equals dequeue `ordinal`; stage `containment_action`; all round/snapshot/page coordinates null | `POST /graphql` with the fixed dequeue document | exact dequeue enum | +| `terminal_merge_fence_rerun` | `workflow_rerun`; source/op-round/round/snapshot/page null; stage `containment_action` | `POST /repos/{owner}/{repo}/actions/runs/{workflow_run_id}/rerun` | `not_dispatched|rerun_accepted_201|delivery_ambiguous|definite_rejection` | +| `terminal_reconciliation_read` | `branch_ref|pr_marker_page|check_suite_page|check_run_page|release_inventory_page|latest_pointer`; source/op-round null; stage `final`; observation round `1|2`; page positive only for a page kind | the matching GET endpoint from the broker policy | publisher read outcome enum | + +Every ordinary row requires a null containment snapshot and target-authorization proof. Containment +read rows derive a nonnull proof only when selecting a protected target; dequeue requires the exact +pre-action queue-observation proof and rerun the exact target proof below. The publisher read +outcome enum is exactly `read_200|read_404|read_redirect_302|read_definite_denial| +read_response_lost|read_unexpected_status|read_malformed_response`. For every write row, +source-attempt ordinal and fields byte-equal the named write-attempt array while the global request +ordinal records interleaved GET/write protocol order; `attempt_kind` is the table literal, not an +absent source field. Write response/safe/result nullability is exactly the source matrix. Every GET +uses the lowercase SHA-256 of zero bytes as payload. Successful +`read_200|read_404` has that exact status, null safe-response field, and result/root nullability equal +to the class-bound observation. `read_redirect_302` is legal only for +`workflow_artifact_redirect`, requires exact status 302 and the signed validated-Location receipt, +and never forwards credentials to the follow-up. Definite denial permits only 401/403 plus the exact response-body +hash; response loss has null status/completion/body; unexpected status covers every other received +status and hashes its body; malformed response is a received nominally successful status whose +archived bytes fail the exact parser. Each request failure terminally closes its pre-dispatch +start and aborts only that reconciliation attempt—no unmatched request remains. +For GraphQL, status 200 plus nonempty `errors`, null/partial data, missing required nodes or +malformed bytes is `read_malformed_response` with the complete raw body archived; it is +never `read_200`. Dequeue outcomes are exactly +`not_dispatched|dequeued_exact|delivery_ambiguous|definite_rejection` as defined by its +attempt schema. Rerun exact success is only authenticated 201; response loss or any received result +that is neither 201 nor a proven pre-dispatch 401/403/404 is `delivery_ambiguous`. + +Pagination failure is an aggregate, never a per-request transport outcome. +`PublisherPaginationFailureReceiptV1` has exactly `schema_version`, the same full publication and +operation identity, `operation_idempotency_key`, positive `credential_attempt_ordinal`, +`publisher_credential_subject_sha256`, `reconciliation_round=1|2`, +`collection_kind="pr_marker"|"check_suite"|"check_run"|"release"|"asset"`, +`collection_key`, +`valid_page_receipt_sha256s`, nullable positive `last_valid_page_ordinal`, nullable +`expected_next_request_url`, +`failure_kind="terminal_request_failure"|"missing_required_next_link"|"invalid_link_chain"| +"cardinality_inconsistent"`, nullable `source_terminal_transport_receipt_sha256`, nullable +`source_terminal_outcome="read_definite_denial"|"read_response_lost"| +"read_unexpected_status"|"read_malformed_response"`, nullable `source_request_id`, nullable +`source_raw_response_sha256`, nullable nested exact `failed_response_blob`, nested exact +`archive_prefix: PublisherPaginationArchivePrefixV1`, `archive_prefix_root_sha256`, +`observed_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `pagination_failure_receipt_sha256`. Valid page roots are a +gapless page-one prefix in request order and are in bijection with the archive prefix; empty prefix +requires null last ordinal and nonempty prefix requires the last ordinal equal its length. +`collection_key` is exactly the publication marker digest for PR-marker pages, lowercase head OID +for check-suite pages, decimal check-suite ID for check-run pages, literal `repository` for the +release list, or decimal release ID for an asset list. +`PublisherPaginationArchivePrefixV1` has exactly `schema_version`, the same publication/operation/ +credential identity, `reconciliation_round`, `collection_kind`, `collection_key`, ordered +`entries`, and `archive_prefix_root_sha256`. Each entry has exactly positive gapless +`page_ordinal`, `page_kind="pr_marker"|"check_suite"|"check_run"|"release_inventory"`, nested +exact `page_receipt` as the matching class-bound signed page type, `page_receipt_sha256`, `path`, +`raw_response_sha256`, and `raw_bytes_base64`; path is +`publication-pagination////-.response`, +decoded bytes reproduce the raw hash, and entry order is ascending page ordinal. The entry array is +a bijection with the failure receipt's valid page roots and the existing class-bound page receipts; +identity, page ordinal and raw hash byte-equal those receipts. Its domain is +`laconian-publisher-pagination-archive-prefix-v1\n`, omitting only its final digest, and the failure +receipt's duplicated root must recompute from this nested object. +`failed_response_blob` has exactly `path`, `sha256`, and `raw_bytes_base64`; decoded bytes reproduce +the source raw hash and path is exactly +`publication-pagination-failures/.response` using lowercase hex. +`terminal_request_failure` requires the unique +failed generic wrapper digest, its exact terminal outcome and request ID, and `observed_at` equal +that wrapper's `attempt_terminal_at`. Only `read_response_lost` requires the blob and raw-response +digest null; denial, unexpected-status and malformed-response require both nonnull and replayable. +For every received failure, blob `sha256`, `source_raw_response_sha256` and wrapper +`safe_response_sha256` are byte-equal, and source/wrapper request ID, outcome and status are exact. +The other three kinds require null source-terminal wrapper/outcome, the exact last nominally +successful wrapper request ID and raw-response digest plus a nonnull replayable blob, +forbid a terminal-failure wrapper digest, and set `observed_at` to its response completion time; +their expected-next URL and Link/cardinality predicates are recomputed from the archived bytes and +the preceding valid page. The receipt identity, subject and collection equal the enclosing read +disposition, and its `reconciliation_round` equals every source wrapper `observation_round` and +class-bound page round in that failed collection; its signature and record domains are +`laconian-publisher-pagination-failure-receipt-signature-v1\n` and +`laconian-publisher-pagination-failure-receipt-v1\n`. Its signature preimage is +`UTF8(signature domain) || CanonicalJSONV1(record without exactly broker_signature_base64url and +pagination_failure_receipt_sha256)`; its record digest is `SHA256(UTF8(record domain) || +CanonicalJSONV1(record without exactly pagination_failure_receipt_sha256))`, including the verified +signature. A missing, invalid, repeated or cross-origin +Link therefore closes the aggregate read without inventing an additional request or a valid page. +For `stable_double_read`, the two rounds contain every exact branch, PR, complete check-suite/run, +release-ledger and pointer request receipt from the corresponding nested reconciliation observation +in protocol/page order, with no extra or omitted GET. For incomplete/unstable failure finality, the +projection instead contains the complete attempted prefix for zero to two rounds, with no fabricated +unrequested suffix. Its domain is +`laconian-publisher-operation-transport-projection-v1\n`, omitting only its final digest. + +`PublisherPartialContainmentReadV1` is the typed maximal prefix for an aborted barrier +read. It has exactly `schema_version="PublisherPartialContainmentReadV1"`, the same full +publication identity, +`operation_kind="terminal_merge_barrier_read"`, `operation_idempotency_key`, +positive `credential_attempt_ordinal`, `observation_stage`, nullable +`containment_snapshot_ordinal=0|1|2`, `logical_aggregate_class`, +`canonical_target`, positive `next_operation_request_ordinal`, ordered nested exact +`members`, `raw_archive_root_sha256`, `observed_at`, and +`partial_containment_read_sha256`. Each member has exactly +`member_kind="atomic_read"|"page_read"`, positive gapless +`operation_request_ordinal`, `attempt_kind`, nullable `observation_round=1|2`, +nullable positive `page_ordinal`, nested exact +`transport_receipt: PublisherOperationTransportReceiptV1`, +`transport_receipt_sha256`, nullable nested exact class-bound +`source_receipt_or_observation`, nullable `source_receipt_or_observation_sha256`, +and nullable nested exact `raw_response_blob`. Members are exactly ordinals +`1..next-1` in dispatch order; every wrapper is terminal. A decoded success has one exact +class-bound observation/page and received raw bytes; a failed terminal wrapper retains its raw body +when received and has no successful source object. No requested prefix member is omitted or added, +and no unrequested suffix is invented. The raw archive root is the domain-separated length-prefixed +concatenation of all received bodies in member order. Its domain is +`laconian-publisher-partial-containment-read-v1\n`, omitting only its digest. + +`PublisherReadAbortReceiptV1` is the signed record for a minted read credential whose +executor stops before the next request without fabricating that request. It has exactly +`schema_version="PublisherReadAbortReceiptV1"`, the same full publisher publication identity, +`operation_kind="terminal_merge_barrier_read"|"terminal_reconciliation_read"`, +`operation_idempotency_key`, `protocol_phase="terminalizing"|"terminal_reconciling"`, +positive `credential_attempt_ordinal`, +`publisher_credential_broker_policy_sha256`, `authorized_policy_row_sha256`, +`publisher_credential_subject_sha256`, `token_fingerprint_sha256`, +`abort_position="before_first_request"|"before_next_request"`, positive +`next_operation_request_ordinal`, ordered positive +`completed_operation_request_ordinals`, ordered +`terminal_transport_receipt_sha256s`, ordered +`completed_source_observation_sha256s`, +nullable nested exact `partial_containment_read: PublisherPartialContainmentReadV1`, nullable +`partial_containment_read_sha256`, +`pre_abort_broker_phase_ledger_root_sha256`, +`outstanding_operation_dispatch_count=0`, `aborted_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `publisher_read_abort_receipt_sha256`. Completed +ordinals are exactly `1..next-1`; terminal receipts are a bijection with them and all are +closed, while observation digests are exactly the successfully decoded subset. Before-first is +equivalent to next=1 and all three arrays empty. The broker durably appends the receipt after the +last terminal request, or after token issue for before-first, and atomically disables every later +dispatch for that credential attempt. It claims no missing observation. For barrier-read abort both +partial-prefix fields are nonnull and recompute; for +reconciliation-read abort both are null and its actual prefix is carried by the typed complete- +source/partial-source round grammar below. `aborted_at` is the receipt/final-projection observation time and is not +before every prefix terminal time. Its signature/record +domains are `laconian-publisher-read-abort-signature-v1\n` and +`laconian-publisher-read-abort-receipt-v1\n` with the exact signed-record omission rules: +the signature omits exactly signature+final digest and the record digest omits exactly its final +digest while including the verified signature. + +`PublisherPartialReconciliationSourceV1` is the typed maximal prefix inside the currently +unfinished reconciliation source. It has exactly `schema_version`, the same publication/ +operation/credential identity, `reconciliation_round=1|2`, +`source_kind="branch_ref"|"pr_marker"|"check_runs"| +"release_authorization_inventory"|"latest_pointer"`, positive +`first_operation_request_ordinal`, positive `next_operation_request_ordinal`, ordered nested exact +`members`, `raw_archive_root_sha256`, nullable `last_member_terminal_at`, and +`partial_reconciliation_source_sha256`. Each member has exactly +`member_kind="atomic_read"|"page_read"`, its global operation-request ordinal, `attempt_kind`, +nullable positive `page_ordinal`, nested exact terminal +`transport_receipt: PublisherOperationTransportReceiptV1`, `transport_receipt_sha256`, nested exact +class-bound successful `source_receipt_or_observation`, +`source_receipt_or_observation_sha256`, and nested exact `raw_response_blob`. Member ordinals are +the complete contiguous range from first through `next-1`; the array may be empty only when first +equals next, in which case the last time is null and the raw root is canonical empty. Otherwise the +last time equals the last wrapper terminal. Every page is valid but the source remains incomplete +because its authenticated Link requires the unissued next page; a terminal request failure belongs +to the failure grammar instead. The type's domain is +`laconian-publisher-partial-reconciliation-source-v1\n`, omitting only its digest. + +`PublisherPartialReconciliationRoundV1` is the replayable prefix when a round cannot complete. It +has exactly `schema_version`, the same publication/operation/credential identity, +`reconciliation_round=1|2`, `termination_kind="request_failure"|"read_abort"`, ordered nested exact +`completed_sources`, nullable nested exact +`partial_source_prefix: PublisherPartialReconciliationSourceV1`, nullable +`partial_source_prefix_sha256`, positive `first_operation_request_ordinal`, positive +`next_operation_request_ordinal`, nullable nested exact +`pagination_failure: PublisherPaginationFailureReceiptV1`, nullable nested exact +`terminal_failure_transport_receipt: PublisherOperationTransportReceiptV1`, +nullable `publisher_read_abort_receipt_sha256`, +`round_status="incomplete"`, `observed_at`, and `partial_round_sha256`. Each completed source has +exactly `source_kind="branch_ref"|"pr_marker"|"check_runs"| +"release_authorization_inventory"|"latest_pointer"`, one matching nested exact class-bound +observation, and its recomputed `source_observation_sha256`. Sources are the complete attempted +protocol prefix in that literal order and nest their signed page/raw archives. Request failure +requires exactly one of pagination failure or terminal failure nonnull and a null abort digest: any +paginated collection, including failure on page one with an empty valid prefix, uses the former; +only a non-page GET uses the latter; both partial-source fields are null. Read abort requires both +failure fields null, the exact nonnull enclosing `PublisherReadAbortReceiptV1` digest, and next +request ordinal equal that receipt. Its completed sources are the maximal fully decoded source +prefix before that unissued request. The partial-source pair is nonnull exactly when the executor +stopped inside the next source, including between valid pages, and is null when it stopped before +the round's first source or exactly between sources. Completed sources plus partial-source members +partition exactly this round's contiguous global-ordinal suffix for read abort. For request failure, +completed-source wrappers plus the selected pagination failure's ordered valid-page/terminal- +failure wrappers, or the selected atomic terminal-failure wrapper, partition that suffix instead. +The suffix is `first_operation_request_ordinal..next_operation_request_ordinal-1`. Round one starts +at ordinal one; round two starts one after the final wrapper of the complete round-one observation. +For read abort, all earlier complete-round records in the enclosing final-observation projection +plus this partial round jointly partition the abort receipt's global arrays `1..next-1` and +byte-equal them. A nonnull partial +source begins exactly one ordinal after the last completed source wrapper, or at the round's first +ordinal when no source completed, and ends at the round's `next` value. The selected failure and every +completed source wrapper are present in the enclosing transport projection with byte-equal +identity/global ordinal/round/request and one-way source digest. `observed_at` is the maximum source +authenticated time and failure terminal time for request failure; for read abort it equals the +enclosing abort receipt's `aborted_at`, including an empty prefix. Its domain is +`laconian-publisher-partial-reconciliation-round-v1\n`, omitting only its final digest. +Each tagged member is a closed union: branch_ref nests only +`PublicationBranchObservationV1`, pr_marker only +`PublicationPRMarkerDiscoveryV1`, check_runs only +`PublicationFinalCheckRunsObservationSetV1`, release authorization only its exact +inventory observation, and latest_pointer only `PublicationLatestPointerObservationV1`; +all other variant fields are absent. Every nested page/observation and generic wrapper has +`observation_round=reconciliation_round`, and the completed array is exactly the maximal +source-order prefix before the selected failure. + +`PublisherOperationFinalObservationProjectionV1` has exactly `schema_version`, the same identity, +`operation_kind`, `operation_idempotency_key`, ordered `observations`, `terminal_status`, +ordered nested exact `partial_rounds: PublisherPartialReconciliationRoundV1`, ordered nested exact +`pagination_failures: PublisherPaginationFailureReceiptV1`, nullable +`terminal_failure_transport_receipt_sha256`, nullable nested exact +`partial_containment_read: PublisherPartialContainmentReadV1`, nullable +`partial_containment_read_sha256`, nullable nested exact +`failed_containment_transport_receipt: PublisherOperationTransportReceiptV1`, nullable +`failed_containment_transport_receipt_sha256`, nullable nested exact +`read_abort_receipt: PublisherReadAbortReceiptV1`, nullable +`publisher_read_abort_receipt_sha256`, `observed_at`, +and `operation_final_observation_root_sha256`. Each observation has exactly +`observation_kind="branch_ref"|"pr_marker"|"pr_state"|"check_runs"| +"terminal_reconciliation"|"protected_main"|"merge_queue_preflight_pr"|"merge_queue_pr"| +"merge_queue_inventory"|"merge_queue_timeline"|"required_merge_fence_run"| +"main_commit"|"head_commit"|"main_advance_compare"`, `object_order_key`, and one +class-bound `observation_sha256` naming respectively `PublicationBranchObservationV1`, +`PublicationPRMarkerDiscoveryV1`, `PublicationPRStateObservationV1`, or +`PublicationCheckRunsObservationV1`; `terminal_reconciliation` instead names the exact +`PublicationTerminalReconciliationObservationV1` and appears zero to two times for the read operation. +The nine containment kinds respectively name +`PublicationProtectedMainObservationV1`, +`PublicationMergeQueuePreflightObservationV1`, +`PublicationMergeQueueObservationV1`, +`PublicationMergeQueueInventoryObservationV1`, +`PublicationMergeQueueTimelineReceiptV1`, +`PublicationRequiredMergeFenceRunReceiptV1`, and +`PublicationMainCommitObservationV1`, `PublicationHeadCommitObservationV1`, and +`PublicationMainAdvanceCompareReceiptV1`. +For unselected `not_minted|mint_denied_no_dispatch| +minted_permission_mismatch_then_closed_no_dispatch| +mint_delivery_unknown_unrecoverable_no_dispatch`, both nested projections have empty attempts/ +observations and terminal status `no_dispatch`; their time is that disposition's own denial, +no-mint, closure, or unrecoverability boundary. A resolution instead selects either a valid-permission +minted disposition or the later `reconciliation_sourced_zero_effect` member. A stable final read +selects a minted read disposition; unavailable finality may retain minted-and-closed read +dispositions with attempted prefixes and no selected digest. Only those selected or explicitly +unavailable read members carry the operation attempts/final observations below. +Entries use protocol order, then canonical object key. Exact membership/status is: branch has its +two final ref reads and status `absent|exact|conflicting`; eligibility has its two final check +inventories and `none|exact_success|conflicting`; PR create has its final marker discovery and +`none|exact|conflicting`; terminal-guard discovery has exactly one branch observation followed by +one complete two-round marker discovery for its bound round/stage and status +`discovery_complete`; guard has its two complete check inventories and `all_failure`; close has +its pre-read followed by two final PR reads and +`already_closed_no_dispatch|publisher_close_confirmed|publisher_close_adopted|merge_won`; terminal +reconciliation has: exactly round-one then round-two observations with equal recomputed canonical +external-state digests for `stable_double_read`; zero to one complete observations for +`reconciliation_incomplete`; or exactly two observations with unequal canonical-state digests for +`reconciliation_unstable`; its read abort uses `read_aborted`. The latter three statuses are legal +only inside the exact unavailable +finality branch and authorize no synthetic attachment, no-later claim, admission or release. +Barrier-read status is exactly +`barrier_read_complete|read_aborted_before_dispatch|read_aborted_partial|barrier_read_failed`; +dequeue status is its exact attempt outcome; rerun status is +`rerun_accepted|rerun_unresolved`. A barrier selects only complete read evidence; an +aborted/failed attempt remains inventoried and a fresh credential attempt is mandatory. An original +write whose terminal transport is `response_lost_unresolved` has status +`write_delivery_ambiguous`, names no later ordinary observation and can appear only in the +fenced-ambiguity finality branch. Dequeue/rerun dispositions fabricate no causal observations: +timeline removal and required-fence evidence belong to barrier-read members. Its +partial-round/pagination arrays and terminal-failure digest are empty/null for +`no_dispatch|stable_double_read|reconciliation_unstable|write_delivery_ambiguous| +barrier_read_complete|rerun_accepted|rerun_unresolved`. The containment-prefix/failure pairs are +null for all of those statuses. A read-abort status +has the exact nested abort receipt/digest nonnull; before-first has no other failure/prefix field and +before-next contains only actually completed prefixes. A reconciliation-read before-next abort has +exactly one partial round with `termination_kind=read_abort` and byte-equal abort digest/next request; +before-first has no partial round. A barrier-read abort carries its containment prefix only inside +the abort receipt and has no projection-level failed-containment pair. Every other status requires both abort fields +null. `reconciliation_incomplete` has exactly +one partial round for the first failed round; pagination failures contain exactly its failure or are +empty when its nonnull terminal wrapper failed a non-page request, and the duplicated terminal +wrapper digest follows the opposite nullability. All earlier valid sources/pages and wrappers are +nested by the partial round and transport projection. Projection `observed_at` equals the maximum +of every complete observation and the partial-round time; for any read-abort status it instead +equals the signed abort receipt's `aborted_at`. `barrier_read_failed` requires the exact last failed +terminal wrapper nested in both failure fields plus a nonnull maximal typed +`PublisherPartialContainmentReadV1`/digest whose last member is that same wrapper. Abort fields, +reconciliation partial rounds, pagination failures and ordinary terminal-failure digest are null; +every successful prefix member and the failed member are in exact wrapper/source/archive bijection. +Projection time uses that wrapper's terminal time; it +cannot name an unattempted suffix. `object_order_key` is exactly the ASCII tuple +`//`. Ordinary stage rank is `00` for the close +pre-read, `01|02` for a round-one/two source record, and `03` for a two-read aggregate such as +`PublicationPRMarkerDiscoveryV1`. Containment stage ranks are `10` preflight, +`11` pre-action, `12` action, `13` first snapshot, `14` second +snapshot and `15` main advance; no other value is valid. Kind ranks are `01` branch, +`02` PR marker, `03` PR state, `04` check runs, `05` terminal +reconciliation, `06` protected main, `07` queue-preflight PR, `08` queue PR, +`09` queue inventory, `10` queue timeline, `11` required fence run and +`12` main commit, `13` head commit and `14` main-advance compare. Canonical object ID is +exactly the branch name for branch observations, publication marker digest for PR-marker discovery, +zero-padded 20-digit PR number for PR state, lowercase head OID plus `/` plus check-set kind for +checks, or literal `aggregate` for terminal reconciliation. Keys are unique and the array is +ascending bytewise by the complete key. +For containment observations the canonical object ID is respectively `main/`, +`/preflight`, the zero-padded PR number, `inventory//`, +`timeline/`, +`fence///`, +`main-commit/`, `head-commit/`, +or `compare//`. These values are recomputed from the nested object and unique +within the operation. Coverage is transitive rather than a false top-level/page equality: every +successful transport `source_observation_sha256` maps either to one atomic top-level observation or +to exactly one nested page/request of one top-level aggregate; every nested member maps back to one +transport wrapper, with no extra/omitted wrapper or aggregate. +Its domain is +`laconian-publisher-operation-final-observation-projection-v1\n`, omitting only its final +digest. Both projection identities/operation keys byte-equal the disposition and enclosing +resolution, and their times precede or equal `closed_or_not_minted_at`. + +`PublisherBrokerLedgerEntryV1` has exactly `schema_version`, positive gapless `entry_ordinal`, +nullable `predecessor_entry_sha256`, nullable `operation_kind`, nullable +`operation_idempotency_key`, nullable positive `credential_attempt_ordinal`, +`entry_kind="phase_transition"|"token_request_started"| +"token_request_terminal"|"token_issued"|"operation_dispatch_started"| +"operation_dispatch_terminal"|"token_closed"|"no_mint"| +"token_unrecoverable"|"reconciliation_attached"|"read_aborted"| +"write_ambiguity_fence_attached"`, `phase_before`, `phase_after`, nullable +`request_terminal_outcome="definite_denial"|"successful_response"|"delivery_unknown"`, nullable +`response_status`, nullable `token_fingerprint_sha256`, nullable +`request_or_transport_receipt_sha256`, `occurred_at`, and `entry_sha256`. The first predecessor is +null and every later predecessor equals the prior entry; phases follow only +`constructive -> terminalizing -> terminal_reconciling -> sealed`, allowing a same-phase event but +never reversal. Entries have nondecreasing `occurred_at`; equal instants retain ordinal order. A +phase transition has null operation/attempt/request fields and an exact strict +phase advance; every other entry except `write_ambiguity_fence_attached` has the full operation key. +Only request-terminal has an outcome/ +status: definite denial permits exactly 401, 403, 404 or 422, success requires 201, and every timeout, +connection loss, 202, 5xx, malformed/unexpected 2xx or response loss after possible server commit +is `delivery_unknown` with nullable observed status. Token issue/operation-dispatch/close entries require the +fingerprint; unknown-mint request/terminal/unrecoverability entries have none. Its domain is +`laconian-publisher-broker-ledger-entry-v1\n`, +omitting only its final digest. + +Entry nullability and evidence are closed: `phase_transition` has null operation, ordinal, request +outcome/status, fingerprint and receipt; `write_ambiguity_fence_attached` has the separate exact +nullability below; every other kind has the full disposition key and same phase on both sides. +`token_request_started` names the exact +`BrokerTokenRequestDispatchReceiptV1` and `occurred_at` equals its `request_dispatched_at`; it has all other +nullable class fields null. `token_request_terminal` alone has the terminal outcome/status and names +the exact terminal token-request receipt, with `occurred_at=transport_terminal_at`. +`token_issued` names that successful receipt, carries its fingerprint, and occurs exactly at +`token_vault_committed_at`. `operation_dispatch_started` names exactly one +`PublisherOperationRequestDispatchReceiptV1`, carries the issued fingerprint, and occurs exactly at +its `request_dispatched_at`; `operation_dispatch_terminal` names its unique same-request +`PublisherOperationTransportReceiptV1`, carries the same fingerprint, and occurs exactly at +`attempt_terminal_at`. `token_closed` carries the same fingerprint and names the +recomputed full `PublisherTokenClosureProjectionV1` digest. `no_mint` names the disposition's exact +`PublisherNoMintReceiptV1` digest. +Its `occurred_at` equals that no-mint receipt's `recorded_at`. `token_unrecoverable` names its exact +`BrokerTokenUnrecoverabilityReceiptV1` digest and occurs at its `observed_at`. +`reconciliation_attached` names the exact `PublisherReconciliationAttachmentReceiptV1` digest and +has no fingerprint; its time equals `attached_at`. `read_aborted` has the full read +operation/key/credential ordinal, same phase on both sides, nonnull fingerprint, null request +outcome/status, and names the exact `PublisherReadAbortReceiptV1`; it follows that receipt's +pre-abort ledger root, has `occurred_at=aborted_at`, and precedes token closure. +`write_ambiguity_fence_attached` has null +operation/key/credential/fingerprint/outcome/status, phase before=after `terminal_reconciling`, and +names the exact `PublisherWriteAmbiguityFenceAttachmentV1` digest; it follows the attachment's +pre-attachment root and has `occurred_at=attached_at`. Every other nullable-field combination is invalid. +For a token-closed entry, disposition, full closure projection and ledger entry have byte-equal +identity, operation/key/ordinal and fingerprint; the entry receipt is exactly +`token_closure_projection_sha256`, and its `occurred_at` equals both closure `closed_at` and +disposition `closed_or_not_minted_at`. + +The disposition-to-entry sequence is exact and forbids extra synthetic members. `not_minted` has +only `no_mint`. `mint_denied_no_dispatch` has exactly `token_request_started` then +`token_request_terminal(definite_denial)`. A non-aborted minted status has exactly request-started, +request-terminal(successful-response), token-issued, then zero or more adjacent +`operation_dispatch_started, operation_dispatch_terminal` pairs bijective with exactly the +dispatched transport attempts, then token-closed; the permission-mismatch status has zero dispatch +pairs and neither branch admits `read_aborted`. Within one credential attempt requests are serialized, so no second start precedes its +predecessor terminal. Not-dispatched attempts create no ledger pair. The delivery-unknown status has exactly request-started, +request-terminal(delivery-unknown), then token-unrecoverable. A +`reconciliation_sourced_zero_effect` member has exactly one `reconciliation_attached` entry, whose +receipt binds its one earlier allowed source and final-observation root; such a member exists +exactly once iff a delivery resolution selects that synthetic disposition. No other entry kind or +ordering validates for a status. +A minted read-abort sequence is request-start, request-terminal(success), token-issued, zero or +more complete operation-dispatch start/terminal pairs, `read_aborted`, then token-closed. Fenced +finality has every barrier member closed, then exactly `terminalizing -> terminal_reconciling`, +`write_ambiguity_fence_attached`, and `terminal_reconciling -> sealed`; no reconciliation-read +token/request exists in that branch. +At every ledger prefix, outstanding request count is starts minus token-request terminals and +outstanding operation-dispatch count is operation starts minus matching operation terminals; both +are nonnegative. A phase transition, token closure, reconciliation attachment, or seal is forbidden +while either applicable count is nonzero. Every operation terminal matches exactly one earlier +unmatched start by full identity/key/credential/request ordinal and nested dispatch digest, and no +start is matched twice. The final signed counts are recomputed from the complete entry array rather +than trusted scalar assertions. + +`PublisherBrokerPhaseLedgerV1` has exactly `schema_version`, the same full identity, +`publisher_credential_broker_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, ordered nested exact `entries`, +`final_phase="sealed"`, `outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, `observed_at`, and +`ledger_root_sha256`. The broker signature preimage is +`UTF8("laconian-publisher-broker-ledger-signature-v1\n") || CanonicalJSONV1(record without exactly +broker_signature_base64url and ledger_root_sha256)` and verifies as specified above. The final root +is `SHA256(UTF8("laconian-publisher-broker-phase-ledger-v1\n") || CanonicalJSONV1(record without +exactly ledger_root_sha256))`, including the verified signature. The identity byte-equals the +broker policy and campaign-registry member. There is a bijection between +each disposition key `(operation_kind,operation_idempotency_key,credential_attempt_ordinal)` and +its request/no-mint plus terminal ledger entries. Every issued fingerprint has exactly one closure +entry, every dispatched operation request has one same-disposition start/terminal pair, an unknown mint has one +terminal plus one token-unrecoverable entry and no operation dispatch, and the final phase transition occurs only after +all prior entries close. Thus sealed/zero counts are replayed facts, not free assertions. +Every disposition's `broker_phase_ledger_root_sha256` is the exact hash-chain prefix ending at its +own no-mint, denial, token-unrecoverable, reconciliation-attached, or token-close entry: the field +equals that terminal entry's `entry_sha256`, and `closed_or_not_minted_at` equals its `occurred_at`. +The signed final ledger strictly extends every such prefix before its sealed phase transition. +Its `observed_at` equals that final sealed transition's `occurred_at`. +On stable-read finality, the selected `terminal_reconciliation_read` is the maximum credential- +attempt ordinal for that operation. Every synthetic attachment occurs after its second +reconciliation observation and before that read disposition's token-closed entry. On unavailable +finality there is no synthetic attachment; the maximum read-attempt ordinal is the final inventoried +failure. In either branch, the immediately following and last entry is the exact +`terminal_reconciling -> sealed` phase transition: no request, dispatch or attachment intervenes. +Stable seal time is not before read closure/probe or the second observation; unavailable seal time +is not before the final failed attempt and any partial observation. + +`PublisherBrokerPhaseLedgerPrefixV1` is the signed, recomputable nonfinal prefix used by terminal +containment. It has exactly `schema_version="PublisherBrokerPhaseLedgerPrefixV1"`, the same full +publication identity, `publisher_credential_broker_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, +`prefix_purpose="containment_start"|"barrier_complete"|"pre_fence_attachment"`, ordered nested +exact `entries: PublisherBrokerLedgerEntryV1`, positive `endpoint_entry_ordinal`, +`endpoint_phase="terminalizing"|"terminal_reconciling"`, nonnegative +`outstanding_token_request_count`, nonnegative `outstanding_operation_dispatch_count`, nonnegative +`live_token_count`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, `observed_at`, and `ledger_prefix_root_sha256`. Entries are exactly +gapless ordinals one through the endpoint and replay the three scalar counts; the endpoint digest +is the last entry digest and its time equals `observed_at`. Containment start ends at the accepted +`constructive -> terminalizing` transition with all counts zero. Barrier complete ends at the last +barrier-disposition closure in terminalizing with all counts zero. Pre-fence attachment ends at the +accepted `terminalizing -> terminal_reconciling` transition with all counts zero. Its signature and +record domains are `laconian-publisher-broker-ledger-prefix-signature-v1\n` and +`laconian-publisher-broker-ledger-prefix-v1\n`, omitting exactly signature+final root and final root +respectively. + +`BrokerVaultAuditPrefixV1` is the corresponding signed vault prefix. It has exactly +`schema_version="BrokerVaultAuditPrefixV1"`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1(scope_kind="publication")`, +`scope_identity_sha256`, `broker_role="publisher"`, +`app_identity: GitHubAppInstallationIdentityV1(role="publisher")`, the same `prefix_purpose`, +`paired_broker_phase_ledger_prefix_sha256`, nonnegative `entry_count`, ordered nested exact +`entries: BrokerVaultAuditEntryV1`, nullable `last_entry_sha256`, nonnegative +`outstanding_token_request_count`, nonnegative `outstanding_operation_dispatch_count`, nonnegative +`live_token_count`, nested exact `broker_signing_identity: +BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, `broker_signature_base64url`, +`observed_at`, and `vault_audit_prefix_root_sha256`. Its entries are the exact complete vault-log +prefix through every broker-ledger source at the paired ledger endpoint; the pair digest names the +enclosing exact ledger prefix, `entry_count=len(entries)`, and the last digest equals the final +entry or is null iff the count is zero. Its `observed_at` byte-equals the paired ledger prefix time. +The event bijection and all counts replay, and all three counts are zero for every containment purpose. Its signature and +record domains are `laconian-broker-vault-audit-prefix-signature-v1\n` and +`laconian-broker-vault-audit-prefix-v1\n` with the same exact omissions. Every later +`PublisherBrokerPhaseLedgerV1` and `BrokerVaultAuditLogV1` used by terminal finality must +byte-prefix-extend every nested signed prefix of the same scope and cannot reorder, replace, or +omit an entry. A bare ledger or vault prefix digest never proves containment finality. + +`PublisherReconciliationUnavailableReceiptV1` is the total failure-only terminal record for a +publication whose required fresh reconciliation cannot complete. It has exactly `schema_version`, +the same full publication identity, `publisher_credential_broker_policy_sha256`, +`authorized_policy_row_sha256`, ordered nested exact `read_attempt_summaries`, +`terminal_reason="persistent_mint_denial"|"persistent_permission_mismatch"| +"persistent_delivery_unknown"|"authenticated_read_unavailable"| +"unstable_external_state"`, +`stable_double_read_count=0`, `outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, +`final_broker_phase_ledger_root_sha256`, `vault_audit_log_root_sha256`, +`release_authorization_ledger_snapshot: PublicationReleaseAuthorizationLedgerSnapshotV1`, +`release_authorization_ledger_root_sha256`, +`canonical_external_state_claimed=false`, `admission_authorized=false`, +`release_authorized=false`, `terminal_invalidation_required=true`, +`required_terminal_event_type="PERMANENT_STOP"|"INVALID_PUBLICATION_PLAN_INVALIDATED"| +"RESULT_MERGE_INVALIDATED"|"INVALID_PREFIX_MERGE_INVALIDATED"|"CORRECTION_INVALIDATED"`, +`recorded_at`, and +`reconciliation_unavailable_receipt_sha256`. Each summary has exactly positive +`credential_attempt_ordinal`, `credential_disposition_sha256`, +`operation_transport_root_sha256`, `operation_final_observation_root_sha256`, ordered zero-to-two +`round_observation_sha256s`, and `terminal_status="no_dispatch"| +"reconciliation_incomplete"|"reconciliation_unstable"|"read_aborted"`. The three summaries are a complete +bijection over +all terminal-reconciliation credential attempts and preserve every denial, mismatch, unknown mint, +closed token and authenticated read prefix; their roots/digests recompute from the exact nested +dispositions in the enclosing set. A single observation is evidence only of that one read and +never a stable external-state claim. Exactly the policy's three attempts are terminal, use its +literal retry schedule from the prior terminal time, and freshly reauthorize before each mint; only +earlier stable success avoids exhaustion. “Persistent” means this exact three-attempt exhaustion, +not that the first two attempts share the final class; all three remain inventoried. The terminal +reason is derived from the final summary's exact disposition/status by this total mapping: + +| Final disposition and observation status | Exact terminal reason | +|---|---| +| `mint_denied_no_dispatch` / `no_dispatch` | `persistent_mint_denial` | +| `minted_permission_mismatch_then_closed_no_dispatch` / `no_dispatch` | `persistent_permission_mismatch` | +| `mint_delivery_unknown_unrecoverable_no_dispatch` / `no_dispatch` | `persistent_delivery_unknown` | +| `minted_then_closed` / `reconciliation_incomplete` | `authenticated_read_unavailable` | +| `minted_then_closed` / `read_aborted` | `authenticated_read_unavailable` | +| `minted_then_closed` / `reconciliation_unstable` | `unstable_external_state` | + +`not_minted`, `reconciliation_sourced_zero_effect`, any other disposition/status pair, or any +stable observation is forbidden in the three summaries. Two complete but unequal rounds select +`unstable_external_state` and retain both roots. An incomplete final summary with no complete +observation has its final-observation time equal the latest failed wrapper or pagination-failure +receipt; with one complete observation it is the maximum of that observation and the failed +wrapper/receipt time. `read_aborted` names the exact abort receipt in the final projection; its summary time is +`aborted_at`, its completed observations are exactly that receipt's prefix, and it consumes one of +the three retry attempts. Before-first has no round observation. The two broker roots equal the +enclosing sealed signed broker ledger and +vault log with recomputed zero counts. The nested release-authorization snapshot has the same +publication scope, an empty entry array, all three authorization/mint/dispatch counts zero, and a +recomputed signed root; `release_authorized=false` is its exact projection rather than a free +assertion. `recorded_at` byte-equals the enclosing disposition-set `observed_at`, broker-ledger +`observed_at`, vault-log `sealed_at`, and signed release-ledger snapshot `observed_at`. +`required_terminal_event_type` is derived only from identity/phase and terminal disposition: +initial complete `no_pr|closed` maps to `PERMANENT_STOP`; initial invalid-prefix `no_pr|closed` +maps to `INVALID_PUBLICATION_PLAN_INVALIDATED`; initial complete `already_merged` maps to +`RESULT_MERGE_INVALIDATED`; initial invalid-prefix `already_merged` maps to +`INVALID_PREFIX_MERGE_INVALIDATED`; and every correction maps to `CORRECTION_INVALIDATED`. +Its domain is +`laconian-publisher-reconciliation-unavailable-receipt-v1\n`, omitting only its final digest. This +record can authorize only the phase-exact initial `PERMANENT_STOP`, invalid-prefix plan +invalidation, correction-publication invalidation, or merge-failure edge enumerated in the state +table; it cannot appear in +`PublicationNoLaterEffectsEvidenceV1`, `PublicationSuccessFinalityEvidenceV1`, merge admission or +release preparation. + +`PublisherCredentialDispositionSetV1` has exactly `schema_version`, the same identity, +`publisher_credential_broker_policy_sha256`, ordered nested exact +`dispositions: PublisherOperationCredentialDispositionV1`, +`finality_status="stable_read_sealed"|"reconciliation_unavailable_sealed"| +"write_ambiguity_fenced_sealed"`, nullable +`terminal_reconciliation_read_disposition_sha256`, nullable +`terminal_merge_barrier_sha256`, nullable +`publisher_barrier_credential_dispositions_root_sha256`, nullable nested exact +`write_ambiguity_fence_attachment: PublisherWriteAmbiguityFenceAttachmentV1`, nullable +`publisher_write_ambiguity_fence_attachment_sha256`, nullable nested exact +`reconciliation_unavailable_receipt: PublisherReconciliationUnavailableReceiptV1`, +nullable `reconciliation_unavailable_receipt_sha256`, +`final_broker_phase="sealed"`, +`broker_phase_ledger: PublisherBrokerPhaseLedgerV1`, +`final_broker_phase_ledger_root_sha256`, nested exact +`broker_vault_audit_log: BrokerVaultAuditLogV1(scope_kind="publication",broker_role="publisher")`, +`vault_audit_log_root_sha256`, `outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, `observed_at`, and +`credential_dispositions_root_sha256`. Dispositions are complete and sorted by the literal total +key `(operation_rank,bound_round_or_0,bound_head_or_object_key, +operation_idempotency_key,credential_attempt_ordinal)`, where operation rank is branch, +eligibility, PR create, terminal-guard discovery, guard, close, barrier-read, barrier-dequeue, +fence-rerun, reconciliation-read, with numeric ranks `01..10` in that order; round is zero unless the authorized +operation key binds a positive guard/close/reconciliation round; and the bound head/object key is +the lowercase head OID, canonical PR number, or empty string exactly as the policy row defines. +Credential-attempt ordinals are gapless positive integers independently within each operation- +idempotency key. Denied, +unrecoverable or permission-mismatched attempts followed by a valid retry remain distinct members. +For `stable_read_sealed`, both unavailable and attachment pairs are null and the named read disposition is the +unique final selected member and a closed valid read-only token. Its ledger root is +the exact prefix ending at that read's close/attachment entry. The set's separate final broker root +equals the nested signed sealed ledger's recomputed `ledger_root_sha256`, which strictly extends +that prefix. Its vault root equals the nested signed log's recomputed root. The set `observed_at` +equals the ledger `observed_at`, vault-audit `sealed_at`, and final sealed transition time; every +disposition, ledger entry and audit entry obeys the exact source-receipt bijection above. Every +nested closure/unrecoverability predecessor digest names the exact prior audit entry, and the next +terminal audit entry names that closure/unrecoverability receipt. The set domain is +`laconian-publisher-credential-disposition-set-v1\n`, omitting only its final digest. +For `reconciliation_unavailable_sealed`, the named read disposition is null, the exact unavailable +receipt/digest are nonnull, the attachment pair is null, and it is root/count-equal to the two nested signed ledgers, every attempted read +disposition remains inventoried, and no synthetic attachment or stable reconciliation projection is +claimed. Sealing is allowed only after all request/operation pairs and tokens are closed; it grants +no success authority. +The barrier digest/subset pair is both null only outside terminal containment. Within terminal +containment it is always nonnull: premerge finality names the all-candidates barrier, and either +merge-won finality names the exact `residual_unmerged_after_merge_won` barrier nested by +`PublicationContainmentMergeWonEvidenceV1`, including its zero-candidate barrier. The subset is the +exact canonical disposition projection of that same barrier. Stable and unavailable finality both +follow this consuming-route rule; the fact that `PublicationTerminalContainmentFinalityV1` stores +merge-won barrier fields only through its nested evidence does not make the disposition-set fields +nullable. For `write_ambiguity_fenced_sealed` the reconciliation +read and unavailable pairs are null; barrier/subset and attachment pairs are nonnull and recompute. +No reconciliation-read disposition exists. The array inventories every ambiguity-source +disposition plus every barrier-read/dequeue/rerun attempt. The nested barrier subset is an exact +canonical subarray and the final signed ledger/vault byte-prefix-extend its two prefix roots; no +other disposition may intervene before the subset endpoint. The sealed ledger contains the exact +fence-attachment sequence, all three counts are zero, and neither the set nor attachment claims +stable external state, admission or release authority. + +Every branch, eligibility, PR-create, guard, and close delivery resolution names exactly one +resolution-selected disposition with matching identity, operation, idempotency key, transport root +and final-observation root: either the valid minted effect member or a later +`reconciliation_sourced_zero_effect` member. Earlier denied, mismatched, unknown-mint or no-request +members remain in the set but are not that resolution link. Its constructive or terminal receipt +repeats the selected disposition digest. A +terminal guard's post-dispatch check observations occur before its write token is closed; the final +guard set additionally names every exact `terminal_guard_discovery` disposition through its round +fields. Discovery members are resolution-selected only by that set, carry `discovery_complete`, and +can never be substituted for a per-head guard or an ordinary write resolution. A +stable guard snapshot is then re-read into a distinct `guarded_reconciliation` object with exactly +one read-only `terminal_reconciliation_read` disposition. The terminal/no-later record inventories every disposition in canonical operation, +round, head and attempt order and proves the broker ledger is in `sealed` with zero live tokens. + +The two initial publication effect receipts are exact closed wire records. Their ordered fields +and types are: + +```text +PublicationBranchReceiptV1 + schema_version = "PublicationBranchReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + publication_attempt: positive canonical integer + intent_sha256: lowercase SHA-256 + operation: "created" | "adopted" + branch_name: bounded nonblank string + base_oid: lowercase 40-hex Git OID + head_oid: lowercase 40-hex Git OID + branch_create_delivery_resolution_sha256: lowercase SHA-256 + publisher_credential_disposition_sha256: lowercase SHA-256 + actor: GitHubAppInstallationIdentityV1(role="publisher") + request_receipts_root: lowercase SHA-256 + receipt_sha256: lowercase SHA-256 + +PublicationPRReceiptV1 + schema_version = "PublicationPRReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + publication_attempt: positive canonical integer + intent_sha256: lowercase SHA-256 + branch_receipt_sha256: lowercase SHA-256 + operation: "created" | "adopted" + pull_request_number: positive canonical integer + pull_request_node_id: bounded nonblank string + pull_request_url: exact ASCII HTTPS URL + base_oid: lowercase 40-hex Git OID + head_oid: lowercase 40-hex Git OID + marker: bounded nonblank string + merge_eligibility_receipt_sha256: lowercase SHA-256 + merge_eligibility_delivery_resolution_sha256: lowercase SHA-256 + pr_create_delivery_resolution_sha256: lowercase SHA-256 + pr_marker_discovery_sha256: lowercase SHA-256 + eligibility_publisher_credential_disposition_sha256: lowercase SHA-256 + pr_create_publisher_credential_disposition_sha256: lowercase SHA-256 + actor: GitHubAppInstallationIdentityV1(role="publisher") + request_receipts_root: lowercase SHA-256 + receipt_sha256: lowercase SHA-256 +``` + +Their digest domains are respectively `laconian-publication-branch-receipt-v1\n` and +`laconian-publication-pr-receipt-v1\n`, over RFC 8785 JSON omitting only `receipt_sha256`. Every +identity, plan-bound branch/base/head/marker, actor, merge-eligibility check and its closed delivery, +PR create delivery and marker discovery, and parent receipt must +match reconstructed intent authority. The PR number is learned only from authenticated create/adopt discovery and can +never appear in the intent. + +Persisting those two receipts uses a second closed non-event family. +`InitialPublicationReceiptAppendV1` is a strict `receipt_kind`-discriminated union of +`InitialBranchReceiptAppendV1` and `InitialPRReceiptAppendV1`. Every variant has exactly +`schema_version`, `mutation_kind="initial_publication_receipt_append"`, literal `receipt_kind`, +`campaign_id`, `campaign_registry_sha256`, `publication_id`, positive `publication_attempt`, `bundle_kind`, +`authorizing_intent_sha256`, `publication_plan_sha256`, `authority_parent_oid`, +`campaign_state_sha256_before`, `campaign_state_sha256_after`, nullable +`predecessor_append_sha256`, literal `receipt_path`, one class-bound `receipt_payload`, +`append_idempotency_key`, `recorded_at`, and `append_sha256`. Branch uses schema +`InitialBranchReceiptAppendV1`, kind `branch`, path `branch-receipt.json`, null predecessor, payload +`PublicationBranchReceiptV1`, and domain `laconian-initial-branch-receipt-append-v1\n`. PR uses +schema `InitialPRReceiptAppendV1`, kind `pull_request`, path `pr-receipt.json`, predecessor equal to +the accepted branch append digest, payload `PublicationPRReceiptV1`, and domain +`laconian-initial-pr-receipt-append-v1\n`. Each domain hashes canonical JSON omitting only +`append_sha256`. + +`recorded_at` is deterministic canonical whole-second UTC and equals the accepted +`PUBLICATION_INTENT_AUTHORIZED` event's timestamp plus exactly one second for branch or two seconds +for PR. Only `benchmark-publish.yml` on the protected plan-bound main ref may request the family, +only while state remains the matching `BUNDLE_COLLECTED` or `INVALID_FINALIZED` with that exact +active intent, and only with null hold and active-exposure roots. Branch then PR is the sole order. +The wrapper parent OID, request expected OID, and reconstructed authority OID are equal; wrapper, +outer-request, and intent-authorized receipt-CAS idempotency keys are equal; both state hashes equal +the current byte-identical `campaign-state.json`. Each append retains the entire prior authority +tree byte-for-byte, appends only its one absent path, changes no state name/transition/root, and +creates no event. `*_PUBLICATION_PR_OPENED` is rejected until both exact appends exist; response +loss is reconciled only by adopting the exact external object and exact candidate authority commit. +This family cannot append a merge, invalidation, release, correction, arbitrary path, or generic +same-state record. + +After `RESULT_MERGED`, `RESULT_RELEASE_INTENT_AUTHORIZED` installs `release-intent.json` before any +release effect. It binds the deterministic annotated-tag bytes/OID/name/target, draft Release +name/body/marker, ordered asset names/byte sizes/digests, release-finalizer actor, immutable-Release +policy root, and distinct idempotency keys for tag, draft, each asset, publish, each receipt, and +finalization. The finalizer queries exact names first: it creates or adopts only a byte-identical +annotated tag; creates or adopts only the exact draft; uploads only an absent intent-bound asset +while draft; adopts an existing asset only when name, size, digest, release ID, and actor match; and +publishes only an exact complete draft. If publish succeeded but the response or `RESULT_RELEASED` +CAS was lost, it verifies the immutable published release, tag, every asset, and actor, adopts them, +persists the missing receipts, and emits `RESULT_RELEASED` once. + +Those missing initial-release receipts use one closed non-event authority family; they are not +`CampaignEventV1` self-loops. `InitialReleaseReceiptAppendV1` is a strict `receipt_kind` +discriminated union of `InitialTagReceiptAppendV1`, `InitialDraftReleaseReceiptAppendV1`, +`InitialAssetReceiptsAppendV1`, and `InitialPublishReceiptAppendV1`. Every variant has exactly +`schema_version`, `mutation_kind="initial_release_receipt_append"`, its literal `receipt_kind`, +`campaign_id`, `campaign_registry_sha256`, `publication_id`, positive `publication_attempt`, +`authorizing_intent_sha256`, +`preauthorized_release_plan_sha256`, `executable_release_plan_sha256`, +`security_attestor_receipt_sha256`, `authority_parent_oid`, +`campaign_state_sha256_before`, `campaign_state_sha256_after`, nullable +`predecessor_append_sha256`, literal `receipt_path`, one class-bound `receipt_payload`, +`append_idempotency_key`, `recorded_at`, and `append_sha256`. `recorded_at` is deterministic +canonical whole-second UTC: it equals the accepted `RESULT_RELEASE_INTENT_AUTHORIZED` event's +`recorded_at` plus exactly one, two, three, or four seconds for tag, draft, aggregate assets, or +publish respectively. No workflow clock, effect timestamp, or retry time may choose it. The four +variant domains are respectively +`laconian-initial-tag-receipt-append-v1`, +`laconian-initial-draft-release-receipt-append-v1`, +`laconian-initial-asset-receipts-append-v1`, and +`laconian-initial-publish-receipt-append-v1`, each followed by LF and canonical JSON omitting only +`append_sha256`. +The four `receipt_payload` types are respectively strict `TagReceiptV1`, +`DraftReleaseReceiptV1`, the exact ordered tuple of two `ReleaseAssetReceiptV1` values with ordinals +zero and one, and `PublishReceiptV1`; no raw JSON, union fallback, or locally flattened duplicate is +accepted. + +| Append variant | Exact `schema_version` | `receipt_kind` | Basename | Exact payload and payload digest domain | +|---|---|---|---|---| +| `InitialTagReceiptAppendV1` | `InitialTagReceiptAppendV1` | `tag` | `tag-receipt.json` | `TagReceiptV1`; `laconian-tag-receipt-v1\n`; omit only `receipt_sha256` | +| `InitialDraftReleaseReceiptAppendV1` | `InitialDraftReleaseReceiptAppendV1` | `draft_release` | `draft-release-receipt.json` | `DraftReleaseReceiptV1`; `laconian-draft-release-receipt-v1\n`; omit only `receipt_sha256` | +| `InitialAssetReceiptsAppendV1` | `InitialAssetReceiptsAppendV1` | `assets` | `asset-receipts.json` | two `ReleaseAssetReceiptV1`; each `laconian-release-asset-receipt-v1\n`; omit only its `receipt_sha256` | +| `InitialPublishReceiptAppendV1` | `InitialPublishReceiptAppendV1` | `publish` | `publish-receipt.json` | `PublishReceiptV1`; `laconian-publish-receipt-v1\n`; omit only `receipt_sha256` | + +Release planning uses a one-way, acyclic three-stage graph. The receipt-free initial member is +`InitialPreauthorizedResultReleasePlanV1`, with exactly `schema_version`, `intent_kind="initial"`, +`campaign_id`, `campaign_registry_sha256`, `publication_id`, positive `publication_attempt`, null +`correction_id`, `publication_plan_sha256`, `publication_merge_receipt_sha256`, +`admitted_merge_commit_oid`, `result_tree_oid`, `result_tree_sha256`, +`sealed_bundle_root_sha256`, `provenance_root_sha256`, `tag_target_kind="initial_merge"`, +`authorized_tag_target_oid`, `tag_name`, `tagger_name`, `tagger_email`, `tagger_timestamp`, +`tag_message_sha256`, `annotated_tag_bytes_sha256`, `expected_tag_object_oid`, +`draft_release_name`, `draft_release_body_sha256`, `release_marker`, ordered exact `assets`, +`tag_ruleset_policy_sha256`, `immutable_release_policy_sha256`, +`release_finalizer_app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`release_workflow_sha256`, `common_workflow_root_sha256`, exact `idempotency_keys`, and +`preauthorized_release_plan_sha256`. Each asset has exactly `asset_ordinal=0|1`, `name`, +`byte_length`, and `sha256`; the array is exactly `[0,1]`. `idempotency_keys` has exactly `tag`, +`tag_object`, `tag_ref`, `draft_release`, `asset_0`, `asset_1`, `publish`, `final_verification`, +`tag_receipt_append`, `draft_receipt_append`, `asset_receipts_append`, `publish_receipt_append`, and +`finalization`. The admitted merge and authorized tag target are the same lowercase Git OID. Its +domain is `laconian-initial-preauthorized-result-release-plan-v1\n`, omitting only its final digest; +it contains no attestor, executable-plan, intent, effect, preparation, invalidation or finalization +root. + +The correction preauthorization is the immutable nested `CorrectionReleaseIntentPlanV1`. It has +exactly `schema_version`, `intent_kind="correction"`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, null `publication_attempt`, exact path-safe +`correction_id`, `correction_publication_plan_sha256`, +`approved_head_oid`, `tag_target_kind="correction_approved_head"`, +`authorized_tag_target_oid`, the same tag/tagger/annotated-object, draft/marker/assets, policy, +finalizer/workflow and exact idempotency-key fields as the initial plan, and `plan_sha256`. +`authorized_tag_target_oid` equals the immutable correction publication plan's approved head OID. +Its domain is `laconian-correction-release-intent-plan-v1\n`, omitting only `plan_sha256`; that +digest is the correction `preauthorized_release_plan_sha256`. It contains no observed future merge, +attestor or executable-plan root. + +`ExecutableResultReleasePlanV1` has exactly `schema_version`, `intent_kind`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, nullable `correction_intent_sha256`, nested exact `preauthorized_plan` as one of +the two plan types above, +`preauthorized_release_plan_sha256`, nested exact +`security_attestor_receipt: SecurityAttestorReceiptV1(result="pass", +attestation_purpose="release_preparation")`, `security_attestor_receipt_sha256`, +`admitted_merge_receipt_sha256`, `observed_merge_commit_oid`, ordered +`observed_merge_parent_oids`, `observed_result_tree_oid`, `observed_result_tree_sha256`, +`observed_provenance_root_sha256`, `tag_target_kind`, `authorized_tag_target_oid`, +`expected_tag_object_oid`, and `executable_release_plan_sha256`. Initial identity has positive +attempt/null correction; correction has null attempt/path-safe correction ID. The preauthorized +plan digest is recomputed from the exact nested member and equals the attestor's same field; the +attestor digest is recomputed and equals its duplicated root. Observed merge facts equal the +accepted initial or correction merge receipt, while effect names/bytes/assets/idempotency keys are +copied only from the preauthorized member. Initial target equals its observed admitted merge `M`. +Correction target remains the immutable approved head from `CorrectionIntentV1`; the actual +correction merge `M` remains separately bound as admission lineage and never silently retargets the +tag. Its domain is `laconian-executable-result-release-plan-v1\n`, omitting only its final digest. +Neither predecessor points back to this executable root. +`correction_intent_sha256` is null for initial. For correction it equals the one active original +`CorrectionIntentV1.intent_sha256`, the attestor receipt's same field, and every downstream +`ReleaseEffectAuthorizationV1.authorizing_intent_sha256`; cross-intent replay is rejected. + +`ResultReleaseIntentV1`, installed only for initial release, has exactly +`schema_version="ResultReleaseIntentV1"`, the +initial identity, `publication_plan_sha256`, `publication_merge_receipt_sha256`, nested exact +`executable_release_plan: ExecutableResultReleasePlanV1(intent_kind="initial")`, +`preauthorized_release_plan_sha256`, `security_attestor_receipt_sha256`, +`executable_release_plan_sha256`, `authority_parent_oid`, `recorded_at`, and +`result_release_intent_sha256`. All three duplicated roots equal the nested executable graph. The +correction authorizing intent is instead the original immutable `CorrectionIntentV1`; no second +postmerge correction intent may rewrite its tag target. Its digest is +`SHA256(UTF8("laconian-result-release-intent-v1\n") || CanonicalJSONV1(record without exactly +result_release_intent_sha256))`. + +The shared nested release records have these exact ordered fields and types: + +```text +ReleaseEffectAuthorizationV1 + schema_version = "ReleaseEffectAuthorizationV1" + intent_kind: "initial" | "correction" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + publication_attempt: positive canonical integer | null + correction_id: path-safe correction ID | null + authorizing_intent_sha256: lowercase SHA-256 + preauthorized_release_plan_sha256: lowercase SHA-256 + executable_release_plan_sha256: lowercase SHA-256 + security_attestor_receipt_sha256: lowercase SHA-256 + tag_target_kind: "initial_merge" | "correction_approved_head" + authorized_tag_target_oid: lowercase 40-hex Git OID + authorization_sha256: lowercase SHA-256 + +ReleaseEffectResultV1 + schema_version = "ReleaseEffectResultV1" + effect_kind: "tag_object" | "tag_ref" | "draft_release" | "asset" | "publish" | "final_verification" + authorization: ReleaseEffectAuthorizationV1 + effect_idempotency_key: lowercase SHA-256 + api_method: "POST" | "PATCH" | "GET" + endpoint_template: bounded nonblank string + request_payload_sha256: lowercase SHA-256 + request_receipts_root: lowercase SHA-256 + response_status: positive canonical integer + raw_response_sha256: lowercase SHA-256 + canonical_response_sha256: lowercase SHA-256 + operation: "created" | "uploaded" | "published" | "adopted" | "verified" + external_object_observation_sha256: lowercase SHA-256 + effect_result_sha256: lowercase SHA-256 + +AnnotatedTagEffectResultsV1 + schema_version = "AnnotatedTagEffectResultsV1" + tag_effect_idempotency_key: lowercase SHA-256 + tag_object_effect_result: ReleaseEffectResultV1(effect_kind="tag_object") + tag_ref_effect_result: ReleaseEffectResultV1(effect_kind="tag_ref") + effect_results_root_sha256: lowercase SHA-256 + +InstallationTokenRevocationReceiptV1 + schema_version = "InstallationTokenRevocationReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization_sha256: lowercase SHA-256 + effect_kind: "tag" | "draft_release" | "asset" | "publish" | "final_verification" + subject_kind: "complete_effect_result" | "partial_effect_prefix" | "failed_delivery_resolution" + subject_root_sha256: lowercase SHA-256 + token_closure_projection_sha256: lowercase SHA-256 + app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer") + token_fingerprint_sha256: lowercase SHA-256 + token_vault_committed_at: canonical whole-second UTC + token_expires_at: canonical whole-second UTC + endpoint = "DELETE /installation/token" + api_version = "2022-11-28" + outcome: "revoked_204" | "ambiguous_delivery_then_confirmed_unusable" | "expired_then_confirmed_unusable" + revoked_or_confirmed_unusable_at: canonical whole-second UTC + revocation_receipt_sha256: lowercase SHA-256 + +FinalReleaseVerificationReceiptV1 + schema_version = "FinalReleaseVerificationReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization: ReleaseEffectAuthorizationV1 + effect_result: ReleaseEffectResultV1(effect_kind="final_verification") + effect_delivery_resolution_sha256: lowercase SHA-256 + immutable_release_verification_sha256: lowercase SHA-256 + final_external_objects_root_sha256: lowercase SHA-256 + actor: GitHubAppInstallationIdentityV1(role="release_finalizer") + request_receipts_root: lowercase SHA-256 + installation_token_revocation: InstallationTokenRevocationReceiptV1(effect_kind="final_verification") + receipt_sha256: lowercase SHA-256 +``` + +Their digest domains are respectively `laconian-release-effect-authorization-v1\n`, +`laconian-release-effect-result-v1\n`, and +`laconian-installation-token-revocation-receipt-v1\n`, omitting only each record's final digest. +`AnnotatedTagEffectResultsV1` uses `laconian-annotated-tag-effect-results-v1\n`, omitting only its +final root. +Every authorization revalidates the exact `ExecutableResultReleasePlanV1`: campaign/registry/ +publication and initial/correction XOR identity, preauthorized/executable/attestor roots and tag +target tuple byte-equal it. Initial authorizing intent is the exact `ResultReleaseIntentV1` and +targets admitted initial merge `M`; correction authorizing intent is the original +`CorrectionIntentV1` and targets its approved publication head. Every effect result and external +observation repeats the same authorization; a correction's observed merge `M` cannot replace the +authorized target. + +`ReleaseFinalizerTokenClosureProjectionV1` is the acyclic credential sibling. It has exactly +`schema_version`, the same full initial/correction release identity, `repository_id`, `release_phase`, +`effect_kind`, `effect_step_kind`, `effect_step_ordinal`, `effect_idempotency_key`, positive +`credential_attempt_ordinal`, `broker_role="release_finalizer"`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`release_finalizer_broker_policy_sha256`, `token_request_receipt_sha256`, ordered +`requested_permissions`, ordered `returned_permissions`, `token_fingerprint_sha256`, +`token_vault_committed_at`, `token_expires_at`, +`closure_outcome="revoked_204"|"ambiguous_delivery_then_confirmed_unusable"| +"expired_then_confirmed_unusable"`, ordered nested exact +`delete_attempts: BrokerTokenDeleteAttemptV1`, `closure_boundary_at`, ordered nested exact +`denial_probe_attempts: BrokerTokenDenialProbeV1`, +`post_boundary_same_token_operation_dispatch_count=0`, `vault_audit_predecessor_entry_sha256`, `closed_at`, +and `token_closure_projection_sha256`. It obeys the exact common serialized delete/probe and +outcome/boundary matrix defined above, substituting the release-finalizer role/App/policy; every +member and the successful nested request transport in its disposition byte-equal its identity, +fingerprint, permissions and token times. Its domain is +`laconian-release-finalizer-token-closure-projection-v1\n`, omitting only its final digest. Every +revocation receipt and credential disposition that refer to one token byte-equal this projection; +the revocation's time equals closure `closed_at` and adds the subject link only after the +delivery/prefix digest exists. + +Failure/recovery uses a closed result rather than hiding transport state. +`ReleaseEffectDeliveryResolutionV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, `release_phase`, `preauthorized_release_plan_sha256`, nullable nested exact +`authorization: ReleaseEffectAuthorizationV1`, `effect_kind`, `effect_step_kind`, +`effect_step_ordinal`, `effect_idempotency_key`, ordered `attempts`, nested exact +`first_external_object_observation: ReleaseExternalObjectObservationV1`, nested exact +`second_external_object_observation: ReleaseExternalObjectObservationV1`, +`resolved_status="not_dispatched"|"rejected_no_side_effect"|"exact_success"|"conflicting"`, +nullable nested exact +`effect_result: ReleaseEffectResultV1`, `release_finalizer_credential_disposition_sha256`, +`delivery_ambiguity=false`, `recorded_at`, and +`effect_delivery_resolution_sha256`. Each attempt has exactly positive `ordinal`, `request_id`, +`dispatch_state="not_dispatched"|"dispatched"`, the step's literal method and endpoint, +`request_payload_sha256`, `outcome=not_dispatched|definitely_rejected_no_side_effect| +delivered_exact|response_lost_resolved_exact|non_2xx_resolved_exact| +resolved_conflicting`, nullable `response_status`, nullable `safe_response_sha256`, and +nullable nested exact `transport_receipt: ReleaseOperationTransportReceiptV1`, and +nullable `transport_receipt_sha256`. Not-dispatched attempts require both transport fields null; +every dispatched attempt requires the exact nested terminal wrapper and recomputed duplicated +digest, whose attempt/effect/request/method/endpoint/payload/status fields byte-equal this attempt. +Status/nullability follows the same conservative matrices below: +non-dispatch has null response fields, definite rejection permits only 400/401/403/404 plus safe +proof, response-loss has null status, and non-2xx exact/conflict permits only 409 or 422 plus two +equal authenticated observations. `exact_success` alone embeds the byte-identical effect result; +`rejected_no_side_effect` requires at least one definite rejection, no possibly delivered attempt, +and two final absence observations; `not_dispatched` requires every attempt not dispatched and the +same stable absence. `conflicting` preserves the stable nonmatching object but cannot produce a +success receipt. The identity, authorization and literal effect tuple in both observations +byte-equal the resolution. The two final observations have identical canonical external state; +for exact success the effect result's observation digest equals the second observation digest. +`recorded_at` byte-equals the second authenticated observation's `observed_at`; retry or local time +cannot select it. Its domain is +`SHA256(UTF8("laconian-release-effect-delivery-resolution-v1\n") || CanonicalJSONV1(record without +exactly effect_delivery_resolution_sha256))`. +Initial identity requires a positive bounded attempt and null correction ID; correction identity +requires null attempt and its exact path-safe correction ID. +At `pre_intent`, authorization is null, every attempt is not dispatched, and only +`not_dispatched|conflicting` can result from authenticated pre-effect reads against the +preauthorized plan. At every later phase authorization is nonnull and byte-equals the executable +plan/intent roots. Exact success is forbidden without it. + +The effect tuple is not a cross-product. It is exactly `(tag,tag_object,0)`, +`(tag,tag_ref,1)`, `(draft_release,draft_release,0)`, `(asset,asset,0)`, `(asset,asset,1)`, +`(publish,publish,0)`, or `(final_verification,final_verification,0)`. The nested +`ReleaseEffectResultV1.effect_kind` equals `effect_step_kind`; aggregate `effect_kind=tag` never +appears as a step-result kind. + +`PartialAnnotatedTagEffectV1` has exactly `schema_version`, the same identity/authorization, +`tag_object_delivery_resolution: ReleaseEffectDeliveryResolutionV1(effect_kind="tag", +effect_step_kind="tag_object", effect_step_ordinal=0, resolved_status="exact_success")`, +`tag_object_effect_result: ReleaseEffectResultV1(effect_kind="tag_object")`, +`tag_ref_delivery_resolution: ReleaseEffectDeliveryResolutionV1(effect_kind="tag", +effect_step_kind="tag_ref", effect_step_ordinal=1, +resolved_status="rejected_no_side_effect"|"conflicting")`, and `partial_effect_root_sha256`. It uses +`laconian-partial-annotated-tag-effect-v1\n`, omitting only its final digest. The object success +precedes the ref failure; target/name/OID and derived step keys equal intent. The sibling +revocation receipt points to this completed prefix root, but the prefix never hashes that receipt, +avoiding a digest cycle. This is the only typed tag-object-without-ref partial preimage. +`PartialAssetEffectsV1` has exactly `schema_version`, the same identity/authorization, +`failed_asset_ordinal=0|1`, ordered `successful_prefix`, +`failed_asset_delivery_resolution: ReleaseEffectDeliveryResolutionV1(effect_kind="asset", +effect_step_kind="asset", resolved_status="rejected_no_side_effect"|"conflicting")`, and +`partial_effect_root_sha256`. A prefix entry has exactly `asset_ordinal`, an exact-success delivery +resolution and its byte-identical `ReleaseEffectResultV1(effect_kind="asset")`. Ordinal zero failure +requires empty prefix; ordinal one requires exactly successful ordinal zero. The failed resolution +has the named ordinal. Its domain is `laconian-partial-asset-effects-v1\n`, omitting only its final +digest. These two aggregate-prefix types are the only meaning of `partial_effect`; no single-step +delivery resolution has a partial status. +`FinalReleaseVerificationReceiptV1` uses +`laconian-final-release-verification-receipt-v1\n` and omits only `receipt_sha256`. +The effect result embeds the byte-identical authorization, and revocation repeats that +authorization digest, exact effect kind/subject root, and finalizer App identity. For the first two +outcomes revocation time is not before authenticated token-response completion or after token expiry; the ambiguous outcome +requires the exact failed-delivery receipt plus a successful post-revocation denial probe. +`expired_then_confirmed_unusable` instead requires observation at or after response-bound expiry, any DELETE +attempt receipt, a denied post-expiry authenticated probe, and proof of no successful use after +expiry. No token bytes, raw authorization header, +or secret response field is representable. + +`PostMergeAdmissionSubjectV1` is the cycle-free input to the postmerge security attestor. It has +exactly `schema_version`, `campaign_id`, `campaign_registry_sha256`, `repository_id`, +`intent_kind="initial"|"correction"`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, `authorizing_intent_sha256`, `result_plan_sha256`, positive +`pull_request_number`, `base_branch_name`, `base_oid`, `head_branch_name`, `head_oid`, +`observed_merge_commit_oid`, `observed_merge_tree_oid`, `current_main_oid`, +`current_main_containment_root_sha256`, positive `merge_actor_account_id`, +`merge_actor_login`, `merged_at`, and `postmerge_admission_subject_sha256`. Every field is projected +from the plan-bound PR and two stable authenticated merged observations; the merge commit has exact +parents/base-head relation and expected tree. It contains no security-attestor receipt, final +admission evidence, merge receipt or release plan. Its domain is +`laconian-postmerge-admission-subject-v1\n`, omitting only its final digest. + +The broader ruleset-read credential has its own closed caller and token lifecycle. +`SecurityAttestorCallerPolicyRowV1` has exactly `schema_version`, `campaign_registry_sha256`, +`repository_id`, `attestation_purpose="preflight_rulesets"|"postmerge_rule_suite"| +"release_preparation"`, `caller_workflow_path`, `caller_workflow_ref`, +`caller_workflow_sha256`, `callee_workflow_path`, `callee_workflow_ref`, +`callee_workflow_sha256`, `caller_job="security_attestor"`, +`oidc_audience="laconian-security-attestor-broker"`, `protected_environment`, +`allowed_event_name`, `required_ref_class`, `protocol_phase="observing"`, ordered +`requested_permissions=["administration:write","contents:read","metadata:read"]`, ordered +`get_endpoint_templates`, `token_mint_endpoint_template`, `token_delete_endpoint_template`, +`denial_probe_endpoint_template`, and `policy_row_sha256`. Caller/callee path, immutable refs and +blob SHAs equal the common workflow-root inventory; environment/event/ref are the exact +purpose-specific protected trigger. Its domain is +`laconian-security-attestor-policy-row-v1\n`, omitting only its final digest. + +`SecurityAttestorCallerPolicyV1` has exactly `schema_version`, `campaign_registry_sha256`, +`repository_id`, `app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`broker_token_delivery_isolation_policy_sha256`, ordered +`requested_permissions=["administration:write","contents:read","metadata:read"]`, ordered +`allowed_rows: SecurityAttestorCallerPolicyRowV1`, ordered +`monotonic_phases=["observing","sealed"]`, `maximum_token_ttl_seconds=3600`, positive +`clock_and_transport_skew_margin_seconds`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="security_attestor")`, +`installation_token_enters_actions=false`, and +`security_attestor_caller_policy_sha256`. The three rows are literal: `preflight_rulesets` is called only by frozen +`benchmark-preflight.yml` on the exact campaign input tag and may GET repository rulesets, +ruleset-by-ID and applicable branch/tag rules; `postmerge_rule_suite` is called only by frozen +`benchmark-publish.yml` on protected current main and may GET repository rulesets, rule-suite lists +and rule-suite-by-ID; `release_preparation` is called only by frozen `benchmark-release.yml` on +protected current main and may GET repository rulesets, rule-suite-by-ID and +`/repos/{owner}/{repo}/immutable-releases`. Every concrete endpoint is substituted only from sealed +repository/ref/ruleset/suite identity. Token mint, revoke and denial-probe endpoints are fixed +broker internals; every other method and all non-GET repository endpoints are denied. Its domain is +`laconian-security-attestor-caller-policy-v1\n`, omitting only its final digest. +Every caller authorization receipt selects one indivisible row and byte-equals its caller/callee +workflow, OIDC audience, environment, event, ref, phase, permissions and endpoints. The policy App, +broker signing key and isolation measurement equal the sealed registry role members. Token TTL and +dispatch-before-expiry checks use the common broker inequality and this policy's exact bound/skew. +The broker serializes exactly one ledger per deterministic operation key below. Entering `sealed` +irrevocably denies every later token request or GET for that key; a retry is another credential +attempt inside the same observing-phase ledger, never a second invocation ledger. + +For every purpose, `operation_idempotency_key` is exactly +`SHA256(UTF8("laconian-security-attestor-operation-v1\n") || CanonicalJSONV1({campaign_id, +campaign_registry_sha256,repository_id,attestation_purpose,intent_kind,publication_id, +publication_attempt,correction_id,correction_intent_sha256,preauthorized_release_plan_sha256, +postmerge_admission_subject_sha256,admitted_merge_receipt_sha256}))`, using the purpose matrix's +exact nullability. No workflow run ID, +retry ordinal, observation time or caller-selected nonce enters this preimage. + +`SecurityAttestorTokenClosureReceiptV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, `attestation_purpose`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`broker_role="security_attestor"`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`security_attestor_caller_policy_sha256`, `token_request_receipt_sha256`, ordered +`requested_permissions`, ordered `returned_permissions`, `token_fingerprint_sha256`, +`token_vault_committed_at`, `token_expires_at`, +`outcome="revoked_204"|"ambiguous_delivery_then_confirmed_unusable"| +"expired_then_confirmed_unusable"`, ordered nested exact +`delete_attempts: BrokerTokenDeleteAttemptV1`, `closure_boundary_at`, ordered nested exact +`denial_probe_attempts: BrokerTokenDenialProbeV1`, +`post_boundary_same_token_operation_dispatch_count=0`, `vault_audit_predecessor_entry_sha256`, `closed_at`, +and `closure_receipt_sha256`. It obeys the exact common serialized delete/probe and outcome/boundary +matrix with the security-attestor role, release-finalizer App identity and attestor policy. Identity, +repository, purpose/key/ordinal, policy, permissions, fingerprint, vault-commit and expiry byte-equal +the enclosing attestor disposition; its request digest equals that disposition's nested successful +request transport. Closure time is not after the enclosing pass/failure record's `observed_at`. Its domain is +`laconian-security-attestor-token-closure-receipt-v1\n`, omitting only its final digest. + +`SecurityAttestorCredentialSubjectV1` is the cycle-free post-mint/pre-GET authorization object. It +has exactly `schema_version`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1(scope_kind="security_attestation")`, +`scope_identity_sha256`, the same invocation identity, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, `security_attestor_caller_policy_sha256`, +`authorized_policy_row_sha256`, `app_identity: GitHubAppInstallationIdentityV1( +role="release_finalizer")`, `token_request_receipt_sha256`, ordered `requested_permissions`, +identical `returned_permissions`, `token_fingerprint_sha256`, `token_vault_committed_at`, +`token_expires_at`, and `security_attestor_credential_subject_sha256`. Its domain is +`laconian-security-attestor-credential-subject-v1\n`, omitting only its final digest. It contains +no GET dispatch, response, closure, ledger or audit root. + +`SecurityAttestorGetDispatchReceiptV1` is appended and signed before any request bytes leave the +vault. It has exactly `schema_version`, the same invocation/operation identity, positive +`credential_attempt_ordinal`, positive gapless `request_ordinal`, +`security_attestor_credential_subject_sha256`, `authorized_policy_row_sha256`, +`method="GET"`, `endpoint_template`, `request_url`, `request_payload_sha256`, `request_id`, +`request_dispatched_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="security_attestor")`, +`broker_signature_base64url`, and `get_dispatch_receipt_sha256`. Policy, subject, method/endpoint, +request and time are immutable before send. Its signature and record domains are +`laconian-security-attestor-get-dispatch-signature-v1\n` and +`laconian-security-attestor-get-dispatch-receipt-v1\n`, omitting the signature/final digest as in +the common signed-receipt rule. + +`SecurityAttestorGetTransportReceiptV1` has exactly `schema_version`, the same campaign/purpose and +nullable release identity, `repository_id`, `operation_idempotency_key`, positive +`credential_attempt_ordinal`, positive gapless `request_ordinal`, +`security_attestor_caller_policy_sha256`, `authorized_policy_row_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`token_fingerprint_sha256`, nested exact +`credential_subject: SecurityAttestorCredentialSubjectV1`, +`security_attestor_credential_subject_sha256`, nested exact +`dispatch_receipt: SecurityAttestorGetDispatchReceiptV1`, `get_dispatch_receipt_sha256`, +`method="GET"`, `endpoint_template`, `request_url`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="isolated_installation_token_handle"`, `request_id`, +`request_dispatched_at`, `transport_terminal_at`, nullable `response_completed_at`, +`outcome="read_200"|"read_404"|"response_lost"|"other_response"`, nullable positive +`response_status`, nullable `response_body_commitment_sha256`, nullable +`canonical_response_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="security_attestor")`, +`broker_signature_base64url`, and `get_transport_receipt_sha256`. The endpoint template is one exact +member of the purpose row; concrete owner/repository/ref/ruleset/suite IDs come only from sealed +identity/authority. Received responses have dispatch <= completion <= terminal, status/body +commitment nonnull and response-loss fields null; 200/404 map literally, while every other received +status is `other_response`. Canonical response is nonnull exactly for a parsed JSON response. +Body commitment is +`SHA256(UTF8("laconian-security-attestor-get-response-body-v1\n") || exact response-body bytes)`; +canonical response is SHA-256 of RFC 8785 parsed JSON. Its record domain is +`laconian-security-attestor-get-transport-receipt-v1\n`, omitting only its final digest. Ordered +subject/dispatch/terminal identities, row, request, method/endpoint, payload and dispatch time are +byte-equal. The subject's vault commit is not after dispatch and dispatch is strictly before token +expiry; response/terminal completion may occur after expiry. Terminal signature time lies in the +security-attestor signing-key validity window. +Ordered +receipts contain every request/page needed by the four observation roots; those roots and receipts +form a bijection, including prior/next pagination URLs enforced by their class-bound observation +schemas. Pass permits only the purpose matrix's expected successful statuses; any loss, other status, +missing/extra endpoint or incomplete page is failure evidence. + +`SecurityAttestorNoRequestReceiptV1` has exactly `schema_version`, the same invocation identity, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`security_attestor_caller_policy_sha256`, `authorized_policy_row_sha256`, +`reason="attestor_identity_mismatch"`, `token_request_count=0`, +`get_dispatch_count=0`, `recorded_at`, and `no_request_receipt_sha256`. Its domain is +`laconian-security-attestor-no-request-receipt-v1\n`, omitting only its final digest. + +`SecurityAttestorCredentialDispositionV1` has exactly `schema_version`, the same campaign, +purpose and nullable initial/correction release identity, `repository_id`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +`security_attestor_caller_policy_sha256`, `authorized_policy_row_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`credential_status="no_request"|"mint_denied_no_dispatch"|"minted_then_closed"| +"minted_permission_mismatch_then_closed_no_dispatch"| +"mint_delivery_unknown_unrecoverable_no_dispatch"`, ordered `requested_permissions`, ordered +`returned_permissions`, nullable `token_request_receipt_sha256`, nullable nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1`, nullable nested exact +`no_request_receipt: SecurityAttestorNoRequestReceiptV1`, nullable nested exact +`token_unrecoverability_receipt: BrokerTokenUnrecoverabilityReceiptV1`, nullable +`credential_subject: SecurityAttestorCredentialSubjectV1`, nullable +`security_attestor_credential_subject_sha256`, nullable +`token_fingerprint_sha256`, nullable `token_vault_committed_at`, nullable `token_expires_at`, ordered +`get_request_receipts: SecurityAttestorGetTransportReceiptV1`, nullable nested exact +`token_closure: SecurityAttestorTokenClosureReceiptV1`, `recorded_at`, and +`credential_disposition_sha256`. Its five statuses obey the same exact request outcome, +permission, retry-ordinal, unrecoverability and closure nullability matrix as the release-finalizer +disposition. No-request has a nonnull exact no-request receipt and all request/subject/token fields null; +every other status has that receipt null. No-request, denial, mismatch and unknown have null +credential subjects and zero GET dispatches; a valid minted member has the unique nonnull exact +subject/digest, contains the purpose row's complete GET receipt sequence and closes its token after +the last GET. Request digest/transport, role/App/policy, ordinal, fingerprint, vault time and closure are +byte-equal throughout; disposition, token-request transport, subject and every GET/no-request receipt repeat +the one purpose row digest. Its domain is +`laconian-security-attestor-credential-disposition-v1\n`, omitting only its final digest. + +`SecurityAttestorBrokerLedgerEntryV1` has exactly `schema_version`, positive gapless +`entry_ordinal`, nullable `predecessor_entry_sha256`, nullable `attestation_purpose`, nullable +`operation_idempotency_key`, nullable positive `credential_attempt_ordinal`, +`entry_kind="phase_transition"|"no_request"|"token_request_started"| +"token_request_terminal"|"token_issued"|"operation_dispatch_started"| +"operation_dispatch_terminal"|"token_closed"| +"token_unrecoverable"`, `phase_before="observing"|"sealed"`, +`phase_after="observing"|"sealed"`, nullable +`request_terminal_outcome="definite_denial"|"successful_response"|"delivery_unknown"`, nullable +`response_status`, nullable `token_fingerprint_sha256`, nullable +`request_or_transport_receipt_sha256`, `occurred_at`, and `entry_sha256`. Entries are hash-chained, +nondecreasing in time and same-phase except the unique final `observing -> sealed` transition. +No-request has one no-request entry naming its exact `SecurityAttestorNoRequestReceiptV1`. Denial +has request-started/terminal; valid or mismatched mint +adds token-issued, adjacent start/terminal pairs in bijection with every GET (zero for mismatch), then token-closed naming +the full closure digest; unknown adds terminal/token-unrecoverable. Request terminal outcome/status +and all other kind nullability are the shared publisher matrix. An operation start names the exact +`SecurityAttestorGetDispatchReceiptV1` and occurs at `request_dispatched_at`; its unique terminal +names the matching `SecurityAttestorGetTransportReceiptV1` and occurs at `transport_terminal_at`. +Both carry the same token fingerprint; no terminal may lack or reuse a start. Its domain is +`laconian-security-attestor-broker-ledger-entry-v1\n`, omitting only its +final digest. + +`SecurityAttestorBrokerLedgerV1` has exactly `schema_version`, the same invocation identity, +`security_attestor_caller_policy_sha256`, ordered nested exact `entries`, `final_phase="sealed"`, +`outstanding_token_request_count=0`, `outstanding_dispatch_count=0`, `live_token_count=0`, nested +exact `broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="security_attestor")`, +`broker_signature_base64url`, `observed_at`, and `ledger_root_sha256`. Signature preimage is +`UTF8("laconian-security-attestor-broker-ledger-signature-v1\n") || CanonicalJSONV1(record without +exactly broker_signature_base64url and ledger_root_sha256)`; the record domain is +`laconian-security-attestor-broker-ledger-v1\n`, omitting only its final root. Every disposition +key has exactly its class-bound entry sequence; every issued fingerprint closes once, every GET is +inventoried by one start/terminal pair, and the final transition occurs immediately after the +selected class-terminal entry only when replayed outstanding request/dispatch counts are zero: +no-request, definite-denial terminal, token-closed, or token-unrecoverable. + +`SecurityAttestorCredentialDispositionSetV1` has exactly `schema_version`, the same invocation +identity, `security_attestor_caller_policy_sha256`, ordered nested exact +`dispositions: SecurityAttestorCredentialDispositionV1`, +`selected_credential_disposition_sha256`, nested exact +`final_broker_ledger: SecurityAttestorBrokerLedgerV1`, +`final_broker_ledger_root_sha256`, nested exact +`broker_vault_audit_log: BrokerVaultAuditLogV1(scope_kind="security_attestation", +broker_role="security_attestor")`, `vault_audit_log_root_sha256`, +`final_phase="sealed"`, `outstanding_token_request_count=0`, +`outstanding_dispatch_count=0`, `live_token_count=0`, `observed_at`, and +`credential_disposition_set_sha256`. Dispositions contain every gapless credential-attempt ordinal; +denied/mismatched/unknown retries remain present. The selected digest names the unique maximum- +ordinal terminal member whose exact status and evidence feed this pass/failure: valid closed GET +for pass or observational failure, permission-mismatch closure for that post-mint failure, or +no-request/denial/unrecoverability for pre-mint failure. Final roots recompute from the nested signed +ledger and signed vault log. Their scope, App, policy, signing identities, request/dispatch pairs, +closures/unrecoverability events and zero counters form an exact bijection; `observed_at` equals the +ledger seal and audit-log `sealed_at`. Its +domain is `laconian-security-attestor-credential-disposition-set-v1\n`, omitting only its final +digest. +The set is the broker's complete prefix for that deterministic operation key through its unique +sealed transition; a second ledger/root or a later mint for the key is invalid. + +`SecurityAttestorReceiptV1` is pass-only and has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `attestation_purpose="preflight_rulesets"| +"postmerge_rule_suite"|"release_preparation"`, nullable `intent_kind`, nullable `publication_id`, +nullable `publication_attempt`, nullable `correction_id`, nullable +`correction_intent_sha256`, nullable `preauthorized_release_plan_sha256`, nullable +`postmerge_admission_subject_sha256`, nullable +`admitted_merge_receipt_sha256`, +`security_policy_sha256`, `security_attestor_caller_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, ordered exact +`requested_permissions=["administration:write","contents:read","metadata:read"]`, identical +`returned_permissions`, `endpoint_policy_sha256`, `token_request_receipt_sha256`, +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1(outcome="successful_201")`, +`token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, ordered +`get_request_receipt_sha256s`, nullable `tag_ruleset_observation_root_sha256`, nullable +`publication_branch_ruleset_observation_root_sha256`, nullable +`rule_suite_observation_root_sha256`, nullable `immutable_release_setting_observation_sha256`, +`result="pass"`, `failed_predicates=[]`, nested exact +`token_closure: SecurityAttestorTokenClosureReceiptV1`, +`selected_credential_disposition_sha256`, nested exact +`credential_disposition_set: SecurityAttestorCredentialDispositionSetV1`, `observed_at`, and +`security_attestor_receipt_sha256`. + +The purpose matrix is exact. `preflight_rulesets` has every publication/release identity and merge/ +plan/subject field null, nonnull tag and publication-ruleset roots, and null rule-suite/immutable roots. +`postmerge_rule_suite` has initial/correction XOR identity and a nonnull exact cycle-free postmerge +subject, but null admitted merge receipt and preauthorized plan; it has nonnull publication-ruleset +and rule-suite roots and null tag/immutable roots. +`release_preparation` has the same XOR identity, the byte-equal postmerge subject, nonnull +preauthorized plan and admitted merge receipt, +nonnull tag/publication/rule-suite/immutable roots, and every root equal to reconstructed authority. +`correction_intent_sha256` is null for preflight and initial identity and equals the active immutable +`CorrectionIntentV1` for either correction purpose. +The nested closure repeats the outer token identity exactly and is completed before candidate +construction. The selected disposition is the set's unique selected member; every duplicated +request/token/closure field and digest byte-equals it, and outer `get_request_receipt_sha256s` is +the ordered projection of its nested GET receipts' recomputed digests. Set observation time equals the pass +record's `observed_at`. The external broker, not an Actions step, mints the token, performs only its purpose's +GET allowlist, closes the token, and returns safe receipts; no token/header enters Actions. Its +domain is `laconian-security-attestor-receipt-v1\n`, omitting only its final digest. Every executable +release authorization names a `release_preparation` pass record. + +Failure is a different class, so a denied mint needs no fictional token. +`SecurityAttestorFailureEvidenceV1` has exactly `schema_version`, the same common campaign, +purpose and nullable release identity/plan/postmerge-subject/merge fields, +`failure_stage="pre_mint"|"post_mint"`, +`security_policy_sha256`, `security_attestor_caller_policy_sha256`, nullable `observed_app_identity`, +ordered `requested_permissions`, ordered `returned_permissions`, `endpoint_policy_sha256`, nullable +`pre_mint_outcome="no_request"|"definite_denial"|"delivery_unknown_unrecoverable"`, nullable +`token_request_receipt_sha256`, nullable nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1`, nullable nested exact +`token_unrecoverability_receipt: BrokerTokenUnrecoverabilityReceiptV1`, nullable +`token_fingerprint_sha256`, nullable `token_vault_committed_at`, +nullable `token_expires_at`, ordered `get_request_receipt_sha256s`, the same four nullable +observation roots, nonempty ordered `failed_predicates`, nullable nested exact +`token_closure: SecurityAttestorTokenClosureReceiptV1`, +`selected_credential_disposition_sha256`, nested exact +`credential_disposition_set: SecurityAttestorCredentialDispositionSetV1`, +`denial_or_transport_receipts_root_sha256`, +`observed_at`, and `security_attestor_failure_evidence_sha256`. `pre_mint` permits only +`attestor_identity_mismatch|token_request_denied|token_request_delivery_unknown_unrecoverable`, has +empty returned permissions/GET receipts and null token, closure and observation fields. Identity +mismatch selects `no_request`, empty requested permissions and null request/unrecoverability. +Denial selects `definite_denial`, exact requested permissions and exact nested denial request +transport/digest, and null +unrecoverability. Delivery unknown selects `delivery_unknown_unrecoverable`, exact requested +permissions and exact nested unknown transport/digest, plus an exact security-attestor-role unrecoverability receipt with +zero GET/operation dispatch. `post_mint` has null pre-mint outcome/unrecoverability and requires the complete token/closure tuple +and permits the remaining permission/repository/ruleset/suite/immutable/missing-observation +predicates in canonical order. Pre-mint failure selects its maximum-ordinal terminal +no-request/denied/unknown disposition; post-mint failure selects the valid closed GET or +permission-mismatch-and-closed disposition that feeds its predicates. The set/ledger counts and +observation time byte-equal the failure record; its outer GET hash array is the ordered digest +projection of the selected disposition's nested GET receipts (empty for no-GET failure). +Its domain is `laconian-security-attestor-failure-evidence-v1\n`, +omitting only its final digest. It cannot enter an executable plan or effect authorization. + +`ReleaseEffectResultV1` admits only this literal effect/method/endpoint/status/operation matrix; +`{owner}`, `{repo}`, IDs, names, and query parameters are substituted only from exact authority: + +| `effect_kind` | Semantic branch | `api_method` | Exact `endpoint_template` | `response_status` | `operation` | +|---|---|---|---|---:|---| +| `tag_object` | create | `POST` | `/repos/{owner}/{repo}/git/tags` | `201` | `created` | +| `tag_object` | adopt | `GET` | `/repos/{owner}/{repo}/git/tags/{tag_object_sha}` | `200` | `adopted` | +| `tag_ref` | create | `POST` | `/repos/{owner}/{repo}/git/refs` | `201` | `created` | +| `tag_ref` | adopt | `GET` | `/repos/{owner}/{repo}/git/ref/tags/{tag_name}` | `200` | `adopted` | +| `draft_release` | create | `POST` | `/repos/{owner}/{repo}/releases` | `201` | `created` | +| `draft_release` | adopt | `GET` | `/repos/{owner}/{repo}/releases/{release_id}` | `200` | `adopted` | +| `asset` | upload | `POST` | `/repos/{owner}/{repo}/releases/{release_id}/assets{?name,label}` | `201` | `uploaded` | +| `asset` | adopt | `GET` | `/repos/{owner}/{repo}/releases/assets/{asset_id}` | `200` | `adopted` | +| `publish` | publish | `PATCH` | `/repos/{owner}/{repo}/releases/{release_id}` | `200` | `published` | +| `publish` | adopt published | `GET` | `/repos/{owner}/{repo}/releases/{release_id}` | `200` | `adopted` | +| `final_verification` | verify | `GET` | `/repos/{owner}/{repo}/releases/{release_id}` | `200` | `verified` | + +For tag-object, tag-ref, draft-release, and publish POST/PATCH rows, +`request_payload_sha256` hashes the exact RFC 8785 canonical JSON request body authorized by the +intent. For asset upload it instead hashes the exact raw uploaded bytes and equals the intent-bound +asset SHA-256; the observation additionally binds exact `Content-Type`, query `name`, and optional +`label`. For GET it is the lowercase SHA-256 of zero bytes and no request body is sent. The request- +receipt root includes every prerequisite/list/pagination call in protocol order, while the row is +the one terminal create/adopt/verify observation. Raw and canonical response hashes bind that same +status/object. Timeout, 202, 204, 3xx, alternate endpoint, by-tag draft lookup, cross-kind operation, +or an adopted object observed only through a write response is not a valid effect result. + +The four receipt payloads have these exact ordered fields and types: + +```text +TagReceiptV1 + schema_version = "TagReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization: ReleaseEffectAuthorizationV1 + annotated_tag_effect_results: AnnotatedTagEffectResultsV1 + tag_object_delivery_resolution_sha256: lowercase SHA-256 + tag_ref_delivery_resolution_sha256: lowercase SHA-256 + tag_name: bounded nonblank string + tag_object_sha: lowercase 40-hex Git OID + target_commit_sha: lowercase 40-hex Git OID + actor: GitHubAppInstallationIdentityV1(role="release_finalizer") + request_receipts_root: lowercase SHA-256 + installation_token_revocation: InstallationTokenRevocationReceiptV1(effect_kind="tag") + receipt_sha256: lowercase SHA-256 + +DraftReleaseReceiptV1 + schema_version = "DraftReleaseReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization: ReleaseEffectAuthorizationV1 + effect_result: ReleaseEffectResultV1(effect_kind="draft_release") + effect_delivery_resolution_sha256: lowercase SHA-256 + operation: "created" | "adopted" + release_id: positive canonical integer + release_name: bounded nonblank string + release_body_sha256: lowercase SHA-256 + marker: bounded nonblank string + draft = true + actor: GitHubAppInstallationIdentityV1(role="release_finalizer") + request_receipts_root: lowercase SHA-256 + installation_token_revocation: InstallationTokenRevocationReceiptV1(effect_kind="draft_release") + receipt_sha256: lowercase SHA-256 + +ReleaseAssetReceiptV1 + schema_version = "ReleaseAssetReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization: ReleaseEffectAuthorizationV1 + effect_result: ReleaseEffectResultV1(effect_kind="asset") + effect_delivery_resolution_sha256: lowercase SHA-256 + asset_ordinal: 0 | 1 + operation: "uploaded" | "adopted" + release_id: positive canonical integer + asset_id: positive canonical integer + name: bounded nonblank string + byte_length: nonnegative canonical integer + sha256: lowercase SHA-256 + actor: GitHubAppInstallationIdentityV1(role="release_finalizer") + request_receipts_root: lowercase SHA-256 + installation_token_revocation: InstallationTokenRevocationReceiptV1(effect_kind="asset") + receipt_sha256: lowercase SHA-256 + +PublishReceiptV1 + schema_version = "PublishReceiptV1" + campaign_id: bounded nonblank string + campaign_registry_sha256: lowercase SHA-256 + publication_id: bounded nonblank string + authorization: ReleaseEffectAuthorizationV1 + effect_result: ReleaseEffectResultV1(effect_kind="publish") + effect_delivery_resolution_sha256: lowercase SHA-256 + operation: "published" | "adopted_published" + release_id: positive canonical integer + draft_before = true + draft_after = false + actor: GitHubAppInstallationIdentityV1(role="release_finalizer") + request_receipts_root: lowercase SHA-256 + installation_token_revocation: InstallationTokenRevocationReceiptV1(effect_kind="publish") + receipt_sha256: lowercase SHA-256 +``` + +Each payload uses the domain in the table above and canonical JSON omitting only +`receipt_sha256`. For a tag, its authorization is byte-identical to both nested effect-result +authorizations; for every other payload it is byte-identical to `effect_result.authorization`. +Every success receipt binds the complete exact-success delivery resolution for its nested effect +result. Tag binds two roots in object/ref order; each resolution's embedded effect result is +byte-identical to the corresponding aggregate result. Draft, each asset, publish and final +verification bind one same-step resolution whose embedded result byte-equals the receipt. A lost +response, retry or adoption path therefore cannot disappear from a success receipt. +Actor, campaign, registry, publication, intent, plan roots, security-attestor root, object identity, +idempotency key, and revocation bindings revalidate against authority. Outer and effect operations +map exactly: draft `created|adopted`, asset `uploaded|adopted`, and publish +`published -> published` or `adopted_published -> adopted`. The two asset payloads are ordered +strictly by ordinal `[0,1]`, share the one release ID and authorization, have distinct asset IDs and +names, and equal the two intent-bound sizes/digests. Extra, omitted, flattened, cross-effect, or +cross-publication fields fail canonical validation. +For draft, either asset, publish, and final verification, the outer `request_receipts_root` +byte-equals the nested effect result's root. For a tag it equals the deterministic ordered Merkle +root of the tag-object then tag-ref effect request-receipt roots, with domain +`laconian-annotated-tag-request-receipts-root-v1\n`. No outer root is independently selectable. + +The tag aggregate is always ordered object then ref. Its distinct step keys are +`SHA256(UTF8("laconian-release-tag-effect-step-idempotency-v1\n") || +CanonicalJSONV1({tag_effect_idempotency_key,step_ordinal,effect_kind}))` for exactly +`(0,"tag_object")` then `(1,"tag_ref")`. The object result binds the exact intent-authorized +annotated-tag bytes, OID, name, tagger, message and target; the ref result binds +`refs/tags/{tag_name}` to exactly that tag-object OID. The four exact operation pairs +`created/created`, `created/adopted`, `adopted/created`, and `adopted/adopted` are valid, always in +that order; a lightweight ref to the target commit is rejected. Receipt-level token revocation +retains `effect_kind="tag"`, uses `subject_kind=complete_effect_result`, and its subject root equals +the aggregate root. Every other success receipt likewise uses `complete_effect_result`; an +aggregate partial uses `partial_effect_prefix`, and a minted token whose step ends rejected or +conflicting uses `failed_delivery_resolution`. The revocation subject never hashes the revocation +receipt, and every minted token maps to exactly one such subject in no-later evidence. If the +object succeeds but the ref cannot be reconciled exactly, no `TagReceiptV1` exists; release +invalidation uses the exact partial-effect detail and inventories the orphan object. + +These shared payload types and append wrappers are normative exact wire records. Runtime owns their +single implementation but cannot alter this schema. The sole +`` path component and `<20-digit-publication-attempt>` component byte-equal the +authoritative publication plan, release intent and append wrapper; every nested payload binds the +same attempt through its byte-identical authorizing intent and plan roots. A plan ID, unpadded +attempt, directory alias, or normalized substitute is forbidden. + +Only `benchmark-release.yml` on the protected plan-bound main ref may request this family, and only +while canonical authority is `RESULT_MERGED`, its exact initial `release-intent.json` is current, +and both the unresolved-hold and active-exposure roots are null. The only admitted sequence is +`tag-receipt.json` -> `draft-release-receipt.json` -> one ordered two-member +`asset-receipts.json` -> `publish-receipt.json`; tag has null predecessor, every later append names +the immediately prior append digest, and each nested payload revalidates the same campaign, +registry, publication, intent, two release-plan roots, security-attestor receipt, actor, object, +and effect authorization. The append's `authority_parent_oid`, request +`expected_current_oid`, and reconstructed current authority OID are identical; its +`append_idempotency_key`, the outer request idempotency key, and the corresponding intent-authorized +receipt-CAS key are identical; and both state hash fields equal the one current +`campaign-state.json` digest. Each append uses one +expected-old-OID fast-forward CAS, retains +`campaign-state.json`, its digest, state name, transition number, hold root, active-exposure pair, +and every other tree member byte-for-byte, appends exactly the one next absent file, and creates no +event file. Missing, duplicate, reordered, correction, invalid-prefix, arbitrary-path, or generic +same-state appends are forbidden. `RESULT_RELEASED` requires all four accepted appends and their +exact nested receipts; it cannot manufacture or batch an omitted predecessor receipt. + +`HeldResultMergedConsumptionV1` has exactly +`schema_version="HeldResultMergedConsumptionV1"`, `kind="nondismissible"`, `campaign_id`, +`campaign_registry_sha256`, `parent_state="RESULT_MERGED"`, `parent_authority_oid`, `hold_id`, +`hold_root_sha256`, `hold_admission_event_sha256`, `nondismissibility_evidence_sha256`, and +`consumption_sha256`. Every hold identity equals the one current accepted hold and the evidence +proves its closed nondismissible defect; no future event or successor OID is present. Its domain is +`laconian-held-result-merged-consumption-v1\n`, omitting only `consumption_sha256`. + +`ReleasePreparationEvidenceV1` is the exact pre-intent subject. Its ordered fields are +`schema_version="ReleasePreparationEvidenceV1"`, `campaign_id`, `campaign_registry_sha256`, +`publication_id`, positive `publication_attempt`, `publication_plan_sha256`, +`publication_merge_receipt_sha256`, `sealed_bundle_root_sha256`, +`expected_result_tree_sha256`, `expected_provenance_root_sha256`, nullable +`candidate_preauthorized_release_plan_sha256`, nullable +`candidate_security_attestation_kind="pass"|"failure"`, nullable nested exact +`candidate_security_attestation_evidence`, nullable +`candidate_security_attestation_evidence_sha256`, nullable +`candidate_executable_release_plan_sha256`, +`preparation_receipts_root_sha256`, and `release_preparation_evidence_sha256`. The two candidate +plan fields and attestation union are exact class-bound attempted objects when nonnull; any +attestation requires a nonnull preauthorized plan. `pass` embeds `SecurityAttestorReceiptV1`; +`failure` embeds `SecurityAttestorFailureEvidenceV1`; its duplicated digest is the selected member's +final digest. Campaign, registry, publication, attempt, publication plan, bundle, merge +receipt, expected result tree and provenance roots byte-equal the enclosing invalidation and current +accepted `RESULT_MERGED` authority. At any post-intent phase the candidate preauthorized/executable +plans and `pass` attestor are nonnull and equal the three top-level authority roots. At pre-intent, +security-attestation failure requires a candidate preauthorized plan and exact nonnull `failure` +evidence but null candidate executable plan and null top-level successful-attestor/executable roots; +external-object conflict requires a valid preauthorized plan, `pass` receipt and executable plan; +verified +tree/bundle/provenance failure may have both null or a valid pair according to the recorded +preparation order. The record contains no intent, effect, terminal event, or successor OID. Its domain is +`laconian-release-preparation-evidence-v1\n`, omitting only its final digest. + +`ReleasePlanInvalidationEvidenceV1` is the strict class-bound evidence for initial +`RELEASE_PLAN_INVALIDATED`. It has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, positive `publication_attempt`, +`publication_plan_sha256`, `sealed_bundle_root_sha256`, nested exact `release_preparation`, nullable +`preauthorized_release_plan_sha256`, nullable `executable_release_plan_sha256`, nullable +`security_attestor_receipt_sha256`, `authority_parent_oid`, `release_phase`, `reason`, nullable +`release_intent_sha256`, nullable `tag_receipt_append_sha256`, nullable +`draft_release_receipt_append_sha256`, nullable `asset_receipts_append_sha256`, nullable +`publish_receipt_append_sha256`, nullable `current_external_objects_root_sha256`, nested exact +`detail`, nullable nested exact +`release_finalizer_operation_set: ReleaseFinalizerOperationSetV1`, nullable +`release_finalizer_operation_set_sha256`, nullable nested exact +`release_reconciliation_unavailable_receipt: ReleaseReconciliationUnavailableReceiptV1`, nullable +`release_reconciliation_unavailable_receipt_sha256`, nullable `no_later_effects_root_sha256`, +`recorded_at`, and +`release_plan_invalidation_evidence_sha256`. + +`ReleasePlanInvalidationDetailV1` is a closed `detail_kind` discriminator union; `detail_kind` +equals top-level `reason`, and each member has exactly the remaining fields listed here: + +| `detail_kind` | Exact remaining fields | +|---|---| +| `verified_tree_mismatch` | `expected_tree_oid`, nullable `observed_tree_oid`, `expected_result_tree_sha256`, nullable `observed_result_tree_sha256`, `verification_receipts_root_sha256` | +| `bundle_mismatch` | `expected_bundle_root_sha256`, nullable `observed_bundle_root_sha256`, `expected_inventory_root_sha256`, nullable `observed_inventory_root_sha256`, `verification_receipts_root_sha256` | +| `security_attestation_failure` | `expected_security_policy_sha256`, nullable `observed_security_policy_sha256`, nonempty canonical ordered `failed_predicates`, `security_attestor_failure_evidence_sha256`, `security_observation_receipts_root_sha256` | +| `provenance_failure` | `expected_provenance_root_sha256`, nullable `observed_provenance_root_sha256`, `verification_receipts_root_sha256` | +| `external_object_conflict` | `effect_kind`, `effect_step_kind`, nonnegative `effect_step_ordinal`, `object_kind`, `expected_object_root_sha256`, nullable `observed_object_id`, nullable `observed_object_root_sha256`, `delivery_state`, `effect_delivery_resolution_sha256`, nullable `partial_effect_root_sha256`, `observation_receipts_root_sha256`, nullable `installation_token_revocation_receipt_sha256` | +| `immutable_release_verification_failure` | `publish_receipt_append_sha256`, `final_verification_effect_delivery_resolution_sha256`, `expected_final_external_objects_root_sha256`, `observed_final_external_objects_root_sha256`, nonempty canonical ordered `failed_predicates`, `verification_receipts_root_sha256` | +| `credential_exposure` | nested exact `terminal_exposure_consumption: TerminalCredentialExposureConsumptionV1` | +| `protocol_authority_drift` | nested exact `protocol_authority_drift_evidence: ProtocolAuthorityDriftEvidenceV1` | +| `invalid_event_nondismissible` | nested exact `held_result_merged_consumption: HeldResultMergedConsumptionV1` | +| `release_reconciliation_unavailable` | `release_finalizer_operation_set_sha256`, `release_reconciliation_unavailable_receipt_sha256` | + +The security predicate order is exactly `attestor_identity_mismatch`, `token_request_denied`, +`token_request_delivery_unknown_unrecoverable`, +`returned_permissions_mismatch`, `repository_identity_mismatch`, +`result_tag_ruleset_mismatch`, `publication_branch_ruleset_mismatch`, `rule_suite_mismatch`, +`immutable_releases_not_enabled`, +`authenticated_observation_missing_or_invalid`. The immutable-verification order is exactly +`release_not_published`, `release_not_immutable`, `tag_identity_mismatch`, `asset_set_mismatch`, +`asset_digest_mismatch`, `actor_mismatch`, `verification_tool_mismatch`, +`verification_delivery_unresolved`. External-object `effect_kind` is `tag`, `draft_release`, +`asset`, or `publish`; `effect_step_kind` is `tag_object`, `tag_ref`, `draft_release`, `asset`, or +`publish`; `object_kind` is `tag_object`, `tag_ref`, `draft_release`, `asset`, or +`published_release`; and `delivery_state` is `preexisting_conflict`, `write_rejected`, +`pre_dispatch_local_rejection`, `ambiguous_then_conflict`, or `partial_effect`. A nullable observed root/OID is legal only with an +authenticated absence/inconsistency receipt in the member's exact receipt root. Fields from any +other member are forbidden. + +The external-conflict tuple is literal, not a cross-product: exactly +`(tag,tag_object,0,tag_object)`, `(tag,tag_ref,1,tag_ref)`, +`(draft_release,draft_release,0,draft_release)`, `(asset,asset,0|1,asset)`, or +`(publish,publish,0,published_release)`. `partial_effect` is legal only for tag-ref after an exact +tag-object result or for an enumerated asset ordinal after the prior ordered release steps; its +object inventory retains every orphan. The token-revocation receipt is null exactly for a +credentialless preexisting conflict or pre-dispatch local rejection whose class-bound ledger proves +no mint and no dispatch. It is nonnull for `write_rejected`, `ambiguous_then_conflict`, or +`partial_effect`, is bound to the exact failed effect authorization/result prefix, and also appears +in the no-later-effects evidence. +The separate immutable-verification observation additionally admits exactly +`(final_verification,final_verification,0,published_release)` with authenticated GET-by-release-ID +semantics; it is not an `external_object_conflict` detail tuple. +Every external-conflict member's delivery-resolution digest names the exact tuple/identity and its +two stable observations; the member's observed ID/root and observation-receipt root derive from the +second observation. `partial_effect_root_sha256` is nonnull exactly for `partial_effect` and names +`PartialAnnotatedTagEffectV1` for tag-ref or `PartialAssetEffectsV1` for asset. In those rows the +revocation uses `subject_kind=partial_effect_prefix`; a minted rejected/conflicting single step uses +`failed_delivery_resolution`. Credentialless preexisting/local rejection uses a not-dispatched +resolution plus exact release-finalizer no-request receipt and null revocation. In every case +invalidation `recorded_at` equals the enclosing `ReleaseNoLaterEffectsEvidenceV1.observed_at`, the +final broker sealed/closure time not before the second reconciliation read; the earlier failed-step observation time remains +bound by its delivery-resolution digest and is not required to equal final reconciliation. +The sole exception is `reason=release_reconciliation_unavailable`: its nested operation set has +`finality_status=reconciliation_unavailable_sealed`, its nested failure receipt/digests byte-equal +that set, `current_external_objects_root_sha256` and `no_later_effects_root_sha256` are null, and +every other reason-specific/emergency field is null. It preserves all completed effect resolutions +but claims no complete external state or release success. `recorded_at` equals the failure receipt, +operation-set, release-ledger and vault-audit sealed time. Every other reason requires a nonnull +current external-object root and stable no-later proof and has both unavailable objects null. + +`ReleaseDiscoveryMatchProjectionV1` has exactly `object_id`, `object_root_sha256`, `name`, nullable +`release_id`, nullable `actor_id`, `actor_login`, `source_page_ordinal`, +`raw_response_sha256`, and `canonical_response_sha256`. `ReleaseDiscoveryPageReceiptV1` has exactly +`schema_version`, `query_template`, positive gapless `page_ordinal`, `response_status=200`, ordered +`objects: ReleaseDiscoveryMatchProjectionV1`, nullable `previous_link`, nullable `next_link`, +`raw_response_sha256`, `canonical_response_sha256`, `authenticated_at`, and +`page_receipt_sha256`. Links chain exactly from page one/null previous through final/null next; IDs +are unique and page/API ordered. Its domain is +`laconian-release-discovery-page-receipt-v1\n`, omitting only its final digest. + +`ReleaseExternalObjectObservationV1` has exactly +`schema_version="ReleaseExternalObjectObservationV1"`, `campaign_id`, +`campaign_registry_sha256`, `publication_id`, nullable `publication_attempt`, nullable +`correction_id`, `release_phase`, `effect_kind`, `effect_step_kind`, `effect_step_ordinal`, +`object_kind`, `expected_object_root_sha256`, `observation_mode="direct"| +"paginated_name_discovery"`, nullable `direct_endpoint_template`, nullable +`direct_response_status`, nullable `direct_raw_response_sha256`, nullable +`direct_canonical_response_sha256`, nullable `discovery_query_template`, nullable positive +`discovery_page_count`, ordered nested exact +`discovery_pages: ReleaseDiscoveryPageReceiptV1`, ordered +`matching_objects: ReleaseDiscoveryMatchProjectionV1`, nullable `selected_object_read_endpoint`, +nullable `selected_object_read_status`, nullable `selected_object_read_raw_response_sha256`, +nullable `selected_object_read_canonical_response_sha256`, nullable `observed_object_id`, nullable +`observed_object_root_sha256`, `observed_state="absent"|"exact"|"conflicting"`, +`observation_receipts_root_sha256`, `observed_at`, and `observation_sha256`. Initial identity is +positive attempt/null correction; correction is null attempt/path-safe correction. + +Direct mode is exact for tag-object by OID, tag ref by name, publish by release ID, and final +verification by release ID. Its discovery/page/match/selected fields are null or empty; absent is an +authenticated 404 with null observed identity, while exact/conflicting is 200 with one nonnull +identity/root equal/different to expected. Paginated mode is exact for draft discovery through +fully paginated `GET /repos/{owner}/{repo}/releases?per_page=100` and asset discovery through +`GET /repos/{owner}/{repo}/releases/{release_id}/assets?per_page=100`; its direct fields are null, +every page is 200, and the complete matching array is sorted by canonical object ID. Zero matches +means absent/null selected identity even though every HTTP status is 200. Exactly one match is then +fetched by `GET /repos/{owner}/{repo}/releases/{release_id}` or +`GET /repos/{owner}/{repo}/releases/assets/{asset_id}` and yields exact/conflicting by root. Two or +more matches are conflicting, preserve all members, and have null selected-read and top-level +identity/root. A missing page, broken Link chain, by-tag draft lookup, duplicate hidden by +selection, or un-fetched unique match fails closed. `observed_at` is the final authenticated page +or selected/direct read time. Its digest is +`SHA256(UTF8("laconian-release-external-object-observation-v1\n") || CanonicalJSONV1(record without +exactly observation_sha256))`. + +`ReleaseExternalObjectsInventoryV1` has exactly +`schema_version="ReleaseExternalObjectsInventoryV1"`, the same full identity and `release_phase`, +ordered `observations`, nullable `empty_inventory_receipts_root_sha256`, and +`current_external_objects_root_sha256`. Observations use literal effect tuple order, then asset +ordinal, then object ID with null represented only by the absence sentinel and sorting before any +nonempty ID; duplicates are forbidden. Empty observations require a nonnull authenticated complete +absence-read root; nonempty observations require that field null. A pre-intent same-name conflict is +therefore nonempty even though authorized dispatch count is zero. Its digest is +`SHA256(UTF8("laconian-release-external-objects-inventory-v1\n") || CanonicalJSONV1(record without +exactly current_external_objects_root_sha256))`. + +`ReleaseLatestPointerObservationV1` has exactly `schema_version`, the same full identity, +`latest_pointer_path`, `expected_state="absent"|"exact"`, `observed_state="absent"|"exact"`, +nullable `expected_pointer_root_sha256`, nullable `observed_pointer_root_sha256`, `api_method="GET"`, +`endpoint_template`, `response_status`, `request_receipt_sha256`, `observed_at`, and +`latest_pointer_observation_sha256`. Absent/404 uses two null roots; exact/200 uses two equal nonnull +predecessor roots. Its domain is `laconian-release-latest-pointer-observation-v1\n`, omitting only +its final digest. + +`ReleaseReconciliationObservationV1` has exactly `schema_version`, the same full identity, +`authority_parent_oid`, `release_phase`, nested exact +`external_objects_inventory: ReleaseExternalObjectsInventoryV1`, nested exact +`latest_pointer_observation: ReleaseLatestPointerObservationV1`, +`canonical_release_external_state_sha256`, +`outstanding_release_write_dispatch_count=0`, `live_release_write_token_count=0`, +`broker_phase="terminal_reconciling"`, `observed_at`, and `reconciliation_observation_sha256`. +`observed_at` is the latest nested authenticated source time. Its domain is +`laconian-release-reconciliation-observation-v1\n`, omitting only its final digest. +`ReleaseReconciliationObservationSetV1` has exactly `schema_version`, the same identity, nested +exact `first_observation`, nested exact `second_observation`, `observed_at`, and +`reconciliation_observation_set_sha256`. The two observations have equal +`canonical_release_external_state_sha256`; their authenticated receipt roots are distinct and the +first time precedes the second. `observed_at` equals the second observation time. Its domain is +`laconian-release-reconciliation-observation-set-v1\n`, omitting only its final digest. + +`ReleaseReconciliationTokenClosureReceiptV1` has exactly `schema_version`, the same full identity, +`authority_parent_oid`, `release_phase`, `release_finalizer_broker_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`token_request_receipt_sha256`, ordered exact +`requested_permissions=["contents:read","metadata:read"]`, identical `returned_permissions`, +`token_fingerprint_sha256`, `token_vault_committed_at`, `token_expires_at`, +`reconciliation_observation_set_sha256`, nested exact +`token_closure: ReleaseFinalizerTokenClosureProjectionV1`, `closed_at`, and +`reconciliation_token_closure_receipt_sha256`. The token can call only final inventory/pointer GET +endpoints and has no write permission. Identity/times/fingerprint equal the nested closure, which +occurs after the second read. Its domain is +`laconian-release-reconciliation-token-closure-receipt-v1\n`, omitting only its final digest. It +requires no effect authorization, so pre-intent/no-plan reconciliation is constructible. + +`ReleaseFinalizerCallerV1` has exactly `schema_version`, `campaign_registry_sha256`, +`repository_id`, `caller_kind="initial_release"|"correction_release"`, +`caller_workflow_path`, `caller_workflow_ref`, `caller_workflow_sha256`, +`callee_workflow_path`, `callee_workflow_ref`, `callee_workflow_sha256`, +`caller_job="release_finalizer"`, `oidc_audience="laconian-release-finalizer-broker"`, +`protected_environment`, `allowed_event_name`, `required_ref_class="protected_current_main"`, and +`release_finalizer_caller_sha256`. Workflow paths, immutable refs, blob SHAs, environment and event +equal the common workflow-root and sealed registry. Its domain is +`laconian-release-finalizer-caller-v1\n`, omitting only its final digest. + +`ReleaseFinalizerOperationPolicyRowV1` has exactly `schema_version`, +`campaign_registry_sha256`, `repository_id`, nested exact +`caller: ReleaseFinalizerCallerV1`, `release_finalizer_caller_sha256`, +`release_phase="pre_intent"|"release_intent"|"tag_receipt"|"draft_release_receipt"| +"asset_receipts"|"publish_receipt"`, `operation_kind="release_effect"| +"terminal_reconciliation_read"`, `effect_kind`, `effect_step_kind`, +`effect_step_ordinal`, `method`, ordered `endpoint_templates`, ordered +`requested_permissions`, `token_mint_endpoint_template`, `token_delete_endpoint_template`, +`denial_probe_endpoint_template`, and `policy_row_sha256`. Effect tuple/nullability, method, +endpoints and permissions are exactly one row of the closed effect/read matrix; the nested caller +makes caller and operation one indivisible authorization rather than a caller×operation product. +Its domain is `laconian-release-finalizer-operation-policy-row-v1\n`, omitting only its final +digest. + +`ReleaseFinalizerBrokerPolicyV1` has exactly `schema_version`, `campaign_registry_sha256`, +`repository_id`, `app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, +`broker_token_delivery_isolation_policy_sha256`, ordered nested exact +`allowed_callers: ReleaseFinalizerCallerV1`, ordered nested exact +`operation_rows: ReleaseFinalizerOperationPolicyRowV1`, ordered +`monotonic_phases=["constructive","terminal_reconciling","sealed"]`, +`maximum_token_ttl_seconds=3600`, `maximum_reconciliation_attempts=3`, +`reconciliation_retry_schedule_seconds=[0,30,120]`, positive +`clock_and_transport_skew_margin_seconds`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="release_finalizer")`, +`installation_token_enters_general_actions_steps=false`, and +`release_finalizer_broker_policy_sha256`. Allowed callers are frozen `benchmark-release.yml` for +initial and its correction-release row on protected current main, with exact workflow/job SHAs from +the common root. Operation rows are exactly the effect tuple/method/endpoint matrix above plus one +read-only terminal-reconciliation row; write rows request only exact applicable +`contents:write|metadata:read`, and the read row requests only `contents:read|metadata:read` and the +exact GET inventory/pointer endpoints: `/git/ref/tags/{tag_name}`, +`/git/tags/{tag_oid}`, `/releases`, `/releases/{release_id}`, +`/releases/{release_id}/assets`, `/releases/assets/{asset_id}`, and +`/contents/{latest_pointer_path}`. Every row also fixes token mint, revoke and denial-probe endpoints. +Entering terminal reconciliation disables all write mints; sealed denies every later mint. Its +domain is `laconian-release-finalizer-broker-policy-v1\n`, omitting only its final digest. +Every `BrokerCallerAuthorizationReceiptV1` selects one exact operation row and its nested caller; +caller/callee workflow, OIDC audience/environment/event/ref, phase, effect tuple, permissions and +endpoints byte-equal that one row. A caller entry not nested by the row grants nothing. + +`ReleaseFinalizerCredentialSubjectV1` is the cycle-free post-mint/pre-effect object. It has exactly +`schema_version`, nested exact `scope_identity: BrokerVaultScopeIdentityV1(scope_kind="release")`, +`scope_identity_sha256`, the same full release identity, `release_phase`, `effect_kind`, +`effect_step_kind`, `effect_step_ordinal`, `effect_idempotency_key`, positive +`credential_attempt_ordinal`, `release_finalizer_broker_policy_sha256`, +`authorized_policy_row_sha256`, `app_identity: GitHubAppInstallationIdentityV1( +role="release_finalizer")`, `token_request_receipt_sha256`, ordered `requested_permissions`, +identical `returned_permissions`, `token_fingerprint_sha256`, `token_vault_committed_at`, +`token_expires_at`, and `release_finalizer_credential_subject_sha256`. Its domain is +`laconian-release-finalizer-credential-subject-v1\n`, omitting only its final digest; it contains no +effect, dispatch, response, closure, ledger or audit root. + +`ReleaseOperationDispatchReceiptV1` is appended and signed before send. It has exactly +`schema_version`, the same full release/effect/credential identity, positive `attempt_ordinal`, +`attempt_kind="effect_write"|"inventory_page"|"selected_object_read"| +"latest_pointer_read"`, nullable `reconciliation_round=1|2`, nullable positive `page_ordinal`, +`release_finalizer_credential_subject_sha256`, `authorized_policy_row_sha256`, `method`, +`endpoint_template`, `request_url`, `request_payload_sha256`, `request_id`, +`request_dispatched_at`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="release_finalizer")`, +`broker_signature_base64url`, and `operation_dispatch_receipt_sha256`. Its signature and record +domains are `laconian-release-operation-dispatch-signature-v1\n` and +`laconian-release-operation-dispatch-receipt-v1\n`. + +`ReleaseOperationTransportReceiptV1` is the unique signed terminal sibling. It has exactly +`schema_version`, the same full release/effect/credential/attempt identity, nested exact +`credential_subject: ReleaseFinalizerCredentialSubjectV1`, +`release_finalizer_credential_subject_sha256`, nested exact +`dispatch_receipt: ReleaseOperationDispatchReceiptV1`, `operation_dispatch_receipt_sha256`, +`method`, `endpoint_template`, `request_url`, `request_payload_sha256`, `request_id`, +`request_dispatched_at`, nullable `response_completed_at`, `transport_terminal_at`, +`outcome="response_observed"|"response_lost"`, nullable `response_status`, nullable +`safe_response_sha256`, nullable `source_observation_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="release_finalizer")`, +`broker_signature_base64url`, and `operation_transport_receipt_sha256`. Response-observed requires +status/completion and the class-bound safe body/observation fields; response-loss requires them +null. Subject, dispatch and terminal duplicated identity/request fields byte-equal; vault commit is +not after dispatch, dispatch is strictly before expiry, and response/terminal completion may occur +later. Signature and record domains are +`laconian-release-operation-transport-signature-v1\n` and +`laconian-release-operation-transport-receipt-v1\n`, with the common signature/final-digest +omissions. + +`ReleaseFinalizerNoRequestReceiptV1` has exactly `schema_version`, the same full release identity, +`release_phase`, `effect_kind`, `effect_step_kind`, `effect_step_ordinal`, +`effect_idempotency_key`, positive `credential_attempt_ordinal`, +`release_finalizer_broker_policy_sha256`, +`authorized_policy_row_sha256`, +`reason="pre_intent_no_authorization"|"phase_forbidden"|"effect_not_required"`, +`operation_dispatch_count=0`, `recorded_at`, and `no_request_receipt_sha256`. Its reason must equal +the reconstructed phase/detail and policy row; no-request cannot replace a required authorized +effect. Its domain is `laconian-release-finalizer-no-request-receipt-v1\n`, omitting only its final +digest. + +`ReleaseFinalizerCredentialDispositionV1` has exactly `schema_version`, the same full identity, +`release_phase`, `effect_kind`, `effect_step_kind`, `effect_step_ordinal`, +`effect_idempotency_key`, positive `credential_attempt_ordinal`, +`release_finalizer_broker_policy_sha256`, +`authorized_policy_row_sha256`, +`broker_phase_ledger_root_sha256`, nested exact +`operation_transport_projection: ReleaseOperationTransportProjectionV1`, +`operation_transport_projection_sha256`, +`credential_status="no_request"|"mint_denied_no_dispatch"|"minted_then_closed"| +"minted_permission_mismatch_then_closed_no_dispatch"| +"mint_delivery_unknown_unrecoverable_no_dispatch"`, ordered `requested_permissions`, ordered +`returned_permissions`, nullable `token_request_receipt_sha256`, nullable nested exact +`token_request_transport_receipt: BrokerTokenRequestTransportReceiptV1`, nullable +`no_request_receipt: ReleaseFinalizerNoRequestReceiptV1`, nullable nested exact +`token_unrecoverability_receipt: BrokerTokenUnrecoverabilityReceiptV1`, nullable +`credential_subject: ReleaseFinalizerCredentialSubjectV1`, nullable +`release_finalizer_credential_subject_sha256`, nullable +`token_fingerprint_sha256`, nullable `token_vault_committed_at`, +nullable `token_expires_at`, nullable nested exact +`token_closure_projection: ReleaseFinalizerTokenClosureProjectionV1`, `dispatch_count`, +`recorded_at`, and `credential_disposition_sha256`. `no_request` has empty permissions and null +request digest/transport/unrecoverability/subject/token/closure fields, a nonnull exact no-request receipt +and zero dispatch. Every other status has null no-request receipt. +`mint_denied_no_dispatch` has the exact `definite_denial` request transport, its byte-equal digest +expected requested permissions, empty returned +permissions, null unrecoverability/subject/token/closure and zero dispatch. `minted_then_closed` has an +exact `successful_201` request transport and digest, equal requested/returned permissions, null +unrecoverability, one exact nonnull credential subject/digest, full token fields and +class-bound closure projection; dispatch count equals its exact transport projection. +`minted_permission_mismatch_then_closed_no_dispatch` has the same successful request transport, +unequal returned permissions, full token/ +closure fields, null unrecoverability and zero dispatch. +`mint_delivery_unknown_unrecoverable_no_dispatch` has the exact `delivery_unknown` request +transport/digest and role-matching +`BrokerTokenUnrecoverabilityReceiptV1`, expected requested permissions, empty returned permissions, +null token/closure fields and zero dispatch. A later retry uses a new credential-attempt +ordinal and vault transaction. Denial, mismatch and unknown have a null subject, empty transport- +attempt array, `dispatch_count=0`, and `terminal_status=no_dispatch`. `no_request` instead has an +empty array and `terminal_status=not_dispatched`, and is the sole credentialless mapping for a +pre-intent resolution with `resolved_status=not_dispatched`; only the valid +minted disposition named by a delivery resolution carries its exact effect attempts. Its domain is +`laconian-release-finalizer-credential-disposition-v1\n`, omitting only its final digest. +The additional tuple `(terminal_reconciliation_read,terminal_reconciliation_read,0)` is legal only +for this credential type, uses the plan-bound reconciliation-read idempotency key and read-only +policy row, and has no `ReleaseEffectDeliveryResolutionV1`. Its transport projection is the two +ordered reconciliation rounds. The unique successful read attempt uses `minted_then_closed` and +its token/closure projection byte-equals the nested projection in +`ReleaseReconciliationTokenClosureReceiptV1`. + +`ReleaseOperationTransportProjectionV1` has exactly `schema_version`, the same identity/effect +tuple/key, ordered `attempts`, `dispatch_count`, `transport_terminal=true`, +`terminal_status="no_dispatch"|"not_dispatched"|"rejected_no_side_effect"|"exact_success"| +"conflicting"|"stable_double_read"|"reconciliation_incomplete"| +"reconciliation_unstable"`, and `operation_transport_projection_sha256`. Each strict +attempt has exactly positive `ordinal`, `attempt_kind="effect_write"|"inventory_page"| +"selected_object_read"|"latest_pointer_read"`, nullable `reconciliation_round`, nullable +`page_ordinal`, `request_id`, `dispatch_state="not_dispatched"|"dispatched"`, literal `method`, +`endpoint_template`, `request_payload_sha256`, `outcome`, nullable `response_status`, nullable +`safe_response_sha256`, nullable nested exact +`transport_receipt: ReleaseOperationTransportReceiptV1`, and nullable +`transport_receipt_sha256`. Effect-write attempts have null round/page, +byte-equal same-ordinal fields from the exact `ReleaseEffectDeliveryResolutionV1`, the literal tuple +method/endpoint, and its exact outcome/status/nullability matrix; terminal status equals that +resolution status. The terminal-reconciliation tuple has only dispatched GET attempts, round +`1|2`, page ordinal positive only for a paginated inventory, the zero-byte payload hash, +`outcome=read_200|read_404|read_definite_denial|read_response_lost| +read_unexpected_status|read_malformed_response`, with the same exact status/body nullability as the +publisher read wrapper. Each complete round contains every page, +selected-object, direct-object and latest-pointer request receipt from the matching nested +`ReleaseReconciliationObservationV1`, in literal tuple/page order; no request is omitted or added. +Every dispatched projection member nests the exact subject/dispatch/terminal wrapper and digest; +every duplicated field byte-equals it. A not-dispatched member has both wrapper fields null and +creates no ledger/audit start. The generic start/terminal pairs are therefore a bijection with +dispatched members. +Stable double-read has two complete equal semantic observations. Incomplete contains the exact +attempted prefix through its first terminal wrapper failure and zero or one complete observations; +unstable has two complete observations with unequal canonical release-state digests. Only the +failure-only reconciliation branch below admits the latter two statuses. +Dispatch count equals dispatched members. Its domain is +`laconian-release-operation-transport-projection-v1\n`, omitting only its final digest. Every +delivery resolution's disposition names the byte-exact projection of its attempts without pointing +back to the resolution digest. + +`ReleaseFinalizerBrokerLedgerEntryV1` has exactly `schema_version`, positive gapless +`entry_ordinal`, nullable `predecessor_entry_sha256`, nullable `effect_kind`, nullable +`effect_step_kind`, nullable `effect_step_ordinal`, nullable `effect_idempotency_key`, nullable +positive `credential_attempt_ordinal`, +`entry_kind="phase_transition"|"no_request"|"token_request_started"| +"token_request_terminal"|"token_issued"|"operation_dispatch_started"| +"operation_dispatch_terminal"|"token_closed"| +"token_unrecoverable"`, `phase_before`, `phase_after`, nullable +`request_terminal_outcome="definite_denial"|"successful_response"|"delivery_unknown"`, nullable +`response_status`, nullable `token_fingerprint_sha256`, nullable +`request_or_transport_receipt_sha256`, `occurred_at`, and `entry_sha256`. Entries form one +nondecreasing-time hash chain; phases follow only +`constructive -> terminal_reconciling -> sealed`, with same-phase nontransition entries and one +strict advance per transition. Phase transition alone has null effect/key/attempt/evidence fields. +Every other entry has the full disposition key. + +Status sequences and evidence are exact. `no_request` has one no-request entry naming its nested +`ReleaseFinalizerNoRequestReceiptV1`. Denial has request-started then request-terminal naming the +exact definite-denial request transport. Either minted status has request-started, +request-terminal(success), token-issued, a bijection over adjacent operation-dispatch start/ +terminal pairs +(zero for permission mismatch), then token-closed naming the full +`ReleaseFinalizerTokenClosureProjectionV1`; issue/dispatch/close carry one fingerprint. Unknown has +request-started, request-terminal(delivery-unknown), then token-unrecoverable naming the exact +unrecoverability receipt and no dispatch. Request status is the shared total token-request matrix; +all unmentioned nullable combinations or entry sequences are invalid. Its domain is +`laconian-release-finalizer-broker-ledger-entry-v1\n`, omitting only its final digest. +An operation start names the exact `ReleaseOperationDispatchReceiptV1`, carries the issued +fingerprint and occurs at its `request_dispatched_at`; its unique terminal names the matching +`ReleaseOperationTransportReceiptV1`, carries the same fingerprint and occurs at +`transport_terminal_at`. Every start has one terminal before closure/phase advance, and no terminal +may reuse or precede a start. +`ReleaseFinalizerBrokerLedgerV1` has exactly `schema_version`, the same full identity, +`release_finalizer_broker_policy_sha256`, +`app_identity: GitHubAppInstallationIdentityV1(role="release_finalizer")`, ordered nested exact +`entries`, `final_phase="sealed"`, `outstanding_token_request_count=0`, `outstanding_dispatch_count=0`, +`live_token_count=0`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="release_finalizer")`, +`broker_signature_base64url`, `observed_at`, and `ledger_root_sha256`. Signature/preimage/key +verification uses +`UTF8("laconian-release-finalizer-broker-ledger-signature-v1\n") || CanonicalJSONV1(record without +exactly broker_signature_base64url and ledger_root_sha256)`; the role key is valid at `observed_at`. +Every credential disposition key has a bijective ledger +sequence, every issued fingerprint one close entry, every dispatch one start/terminal pair, +transport attempt and +revocation subject where applicable, and every delivery-unknown request one terminal/ +token-unrecoverable pair with no dispatch. Replayed outstanding request and operation-dispatch +counts are nonnegative at every prefix and zero before closure or phase advance. A disposition's +`broker_phase_ledger_root_sha256` equals +its class-terminal entry's `entry_sha256`; its `recorded_at` equals that entry's `occurred_at`, and +the terminal entry's evidence digest names the disposition's no-request receipt, request transport, +full closure or unrecoverability receipt as specified above—it never equals the disposition digest. +The signed final ledger extends every prefix and seals only after either the selected successful +maximum-ordinal read-only reconciliation disposition closes or the exact third failure-only read +attempt reaches its denial, unrecoverability or token-closure terminal. The immediately following +and last entry is the +`terminal_reconciling -> sealed` transition; `observed_at` equals that transition time. Its domain is +`laconian-release-finalizer-broker-ledger-v1\n`, omitting only the final root for the record digest, +which therefore includes the verified signature. + +`ReleaseReconciliationUnavailableReceiptV1` is the failure-only sealed read record. It has exactly +`schema_version`, the same full release identity, `release_phase`, +`release_finalizer_broker_policy_sha256`, `authorized_policy_row_sha256`, ordered nested exact +`attempt_summaries`, `terminal_reason="persistent_mint_denial"| +"persistent_permission_mismatch"|"persistent_delivery_unknown"| +"authenticated_read_unavailable"|"unstable_external_state"`, +`stable_double_read_count=0`, `outstanding_token_request_count=0`, +`outstanding_operation_dispatch_count=0`, `live_token_count=0`, +`final_broker_ledger_root_sha256`, `vault_audit_log_root_sha256`, +`canonical_release_state_claimed=false`, `release_success_authorized=false`, +`terminal_invalidation_required=true`, `recorded_at`, and +`release_reconciliation_unavailable_receipt_sha256`. Each +`ReleaseReconciliationAttemptSummaryV1` has exactly positive `credential_attempt_ordinal`, +`credential_disposition_sha256`, `operation_transport_projection_sha256`, ordered zero-to-two +`reconciliation_observation_sha256s`, nullable `terminal_transport_receipt_sha256`, and +`terminal_status="no_dispatch"|"reconciliation_incomplete"|"reconciliation_unstable"`. +The three summaries are a complete bijection over the policy's exact three read attempts and retry +schedule; every disposition/wrapper/partial observation is nested in the enclosing operation set. +Final disposition/status maps to terminal reason exactly as in the publisher unavailable table, +substituting the release types; no-request, a stable read, or any synthetic effect disposition is +forbidden. Incomplete time is the latest exact authenticated observation or failed terminal +wrapper; unstable retains both unequal observation roots. Final ledger/audit roots and zero counts +equal the enclosing signed records, and `recorded_at` equals their common sealed time. Its domain is +`laconian-release-reconciliation-unavailable-receipt-v1\n`, omitting only its final digest. It +authorizes only the phase-exact release or correction-release invalidation failure branch and no +release finalization/success/no-later claim. + +`ReleaseFinalizerOperationSetV1` has exactly `schema_version`, the same full identity, +`release_phase`, nullable `preauthorized_release_plan_sha256`, nullable `executable_release_plan_sha256`, +nullable `security_attestor_receipt_sha256`, `release_finalizer_broker_policy_sha256`, ordered +nested exact `delivery_resolutions: ReleaseEffectDeliveryResolutionV1`, ordered nested exact +`credential_dispositions: ReleaseFinalizerCredentialDispositionV1`, ordered nested exact +`token_revocations: InstallationTokenRevocationReceiptV1`, nullable +`partial_effect_kind="annotated_tag"|"assets"`, nullable `partial_effect_root_sha256`, nullable +`failed_delivery_resolution_sha256`, nullable nested exact +`reconciliation_token_closure: ReleaseReconciliationTokenClosureReceiptV1`, +nullable `reconciliation_read_credential_disposition_sha256`, +`finality_status="stable_read_sealed"|"reconciliation_unavailable_sealed"`, nullable nested exact +`reconciliation_unavailable_receipt: ReleaseReconciliationUnavailableReceiptV1`, +`final_broker_phase="sealed"`, nested exact +`final_broker_ledger: ReleaseFinalizerBrokerLedgerV1`, `final_broker_ledger_root_sha256`, +`broker_vault_audit_log: BrokerVaultAuditLogV1(scope_kind="release", +broker_role="release_finalizer")`, `vault_audit_log_root_sha256`, +`outstanding_token_request_count=0`, `outstanding_dispatch_count=0`, `live_token_count=0`, +`closed_at`, and `operation_set_sha256`. Delivery resolutions follow the literal step order and +form the complete phase-derived contiguous successful prefix plus at most the invalidation detail's +one failed/conflicting step. Partial kind/root are both null or name the exact tag/asset prefix; +failed resolution equals that prefix's failed step or the nonpartial detail. Every token mint in the +broker ledger has exactly one ordered credential disposition per gapless credential-attempt +ordinal; no-request, denied, unrecoverable and permission-mismatched attempts followed by retry are retained. +Every issued token has one exact closure projection. Every issued effect token with valid returned +permissions additionally has exactly one unique revocation subject mapping to one complete result, +partial prefix or failed resolution; permission-mismatch dispositions authorize no effect and need +no subject-bearing revocation. The separate reconciliation closure names +the exact read set and closes after the second read. Its fingerprint, token request, permissions, +transport projection and token-closure projection equal the one named successful read disposition, +which is the final credential-attempt member. This is exactly `stable_read_sealed`, with null +unavailable receipt. For `reconciliation_unavailable_sealed`, both successful-read fields are null, +the exact nonnull unavailable receipt inventories all three failed read attempts, and neither a +stable reconciliation set nor a no-later/success claim is permitted. +`final_broker_ledger_root_sha256` and `vault_audit_log_root_sha256` equal the nested signed records' +recomputed roots. Ledger/audit scope, policy/App/key, token requests, operation dispatch pairs, +closures/unrecoverability and zero counters are bijective; `closed_at` equals ledger `observed_at`, +audit `sealed_at` and final sealed transition time. The final records prove completeness and sealed +denial of later mint. Its domain is +`laconian-release-finalizer-operation-set-v1\n`, omitting only its final digest. +At `pre_intent`, the preauthorized root equals the preparation candidate when one exists and may be +null only when preparation failed before plan construction; that no-plan form has empty delivery, +partial/failure and effect-revocation members plus exact no-request/no-mint write ledger evidence +and the one required read-only reconciliation closure. Every later +phase requires all three preauthorized/executable/attestor roots nonnull. + +`ReleaseNoLaterEffectsEvidenceV1` has exactly `schema_version`, the same full identity, +`authority_parent_oid`, `release_phase`, nested exact +`release_finalizer_operation_set: ReleaseFinalizerOperationSetV1`, nested exact +`reconciliation_observation_set: ReleaseReconciliationObservationSetV1`, +`outstanding_dispatch_count=0`, `live_installation_token_count=0`, `observed_at`, and +`no_later_effects_root_sha256`. The read set occurs after all write resolutions and closure of all +write tokens; its read-only token is then closed in the operation set's separate reconciliation +closure. +`observed_at` equals the operation set's final `closed_at`, which is not before the second +reconciliation observation. The operation-set inventory is +complete for the release phase and detail, so an omitted attempt, effect or token cannot validate. +This schema requires the nested operation set `finality_status=stable_read_sealed`, a nonnull exact +reconciliation closure/read disposition and null unavailable receipt. Failure-only sealed finality +cannot satisfy or be substituted for this no-later proof. +Its digest is `SHA256(UTF8("laconian-release-no-later-effects-evidence-v1\n") || +CanonicalJSONV1(record without exactly no_later_effects_root_sha256))`. The enclosing invalidation's +external-object root equals the nested second inventory digest and its recorded time equals this +evidence's observed time. + +`release_phase` is exactly `pre_intent`, `release_intent`, `tag_receipt`, +`draft_release_receipt`, `asset_receipts`, or `publish_receipt`. The literal append matrix is: + +| Phase | Intent | Tag append | Draft append | Asset append | Publish append | +|---|---|---|---|---|---| +| `pre_intent` | null | null | null | null | null | +| `release_intent` | nonnull | null | null | null | null | +| `tag_receipt` | nonnull | nonnull | null | null | null | +| `draft_release_receipt` | nonnull | nonnull | nonnull | null | null | +| `asset_receipts` | nonnull | nonnull | nonnull | nonnull | null | +| `publish_receipt` | nonnull | nonnull | nonnull | nonnull | nonnull | + +At `pre_intent`, both plan roots and the top-level successful-attestor root are null; at every later +phase all three are nonnull and byte-equal current intent/effect authorization. Each append hash is +the accepted `Initial*ReceiptAppendV1.append_sha256`, never a nested payload digest; reconstruction +derives that digest from canonical wrapper bytes. `security_attestation_failure` and +`invalid_event_nondismissible` are legal only at `pre_intent`; the latter is pre-intent because a +hold forbids intent authorization. A pre-intent external conflict requires nonnull candidate plan +and passing attestor/executable fields in `release_preparation`. `immutable_release_verification_failure` is legal only +at `publish_receipt`. Credential exposure and drift are legal at any phase. Ordinary members require +null active exposure and hold; credential, drift and held members bind and consume exactly their +current nested evidence. Every duplicated identity/root inside a nested detail equals the common +parent. The external-object root inventories every observed object, including an annotated tag +object whose ref step failed and a published release whose response was lost. Before any authorized +effect it is empty only when authenticated complete reads prove absence; a preexisting/foreign +pre-intent conflict produces a nonempty inventory while authorization, token-mint and dispatch +counts remain zero. `no_later_effects_root_sha256` binds final reconciliation reads. +The digest is +`SHA256(UTF8("laconian-release-plan-invalidation-evidence-v1\n") || CanonicalJSONV1(record without +exactly release_plan_invalidation_evidence_sha256))`; no terminal event/hash or successor OID is +representable. + +Every terminal initial attempt installs exactly one strict terminal record in the same authority +CAS as its terminal campaign event. `InitialPublicationInvalidationV1` has exactly these ordered +fields: + +```text +schema_version +terminal_kind +campaign_id +campaign_registry_sha256 +publication_id +publication_attempt +bundle_kind +authorizing_intent_sha256 +publication_plan_sha256 +sealed_bundle_root_sha256 +source_authority_parent_oid +authority_parent_oid +authority_phase +terminal_event_type +invalidation_cause +terminal_containment_finality +terminal_containment_finality_sha256 +successor_merge_denylist_root_sha256 +active_publication_terminal_containment_root_before +active_publication_terminal_containment_root_after +fenced_write_ambiguity +fenced_write_ambiguity_sha256 +publication_pr_terminal_disposition +ordinary_stop_evidence_sha256 +publication_plan_invalidation_evidence_sha256 +protocol_authority_drift_evidence_sha256 +credential_exposure_incident_evidence_sha256 +terminal_exposure_consumption_sha256 +credential_exposure_supplement_sha256 +post_merge_admission_failure_sha256 +publisher_credential_disposition_set_sha256 +reconciliation_unavailable_receipt_sha256 +release_authorization_ledger_root_sha256 +release_finalizer_operation_set_sha256 +release_reconciliation_unavailable_receipt_sha256 +release_invalidation_evidence_sha256 +no_later_effects_root_sha256 +recorded_at +invalidation_sha256 +``` + +The schema literal is `InitialPublicationInvalidationV1`, `terminal_kind=invalidation`, the attempt +is a positive canonical integer, and all direct identity/root/parent fields equal reconstructed +authority. `authority_phase` is exactly `initial_intent`, `initial_branch_receipt`, +`initial_pr_receipt`, `initial_opened`, `post_merge_pre_release_intent`, +`post_merge_release_intent`, `post_merge_tag_receipt`, `post_merge_draft_release_receipt`, +`post_merge_asset_receipts`, or `post_merge_publish_receipt`. The five post-intent phase names map +one-to-one to `ReleasePlanInvalidationEvidenceV1.release_phase=release_intent|tag_receipt| +draft_release_receipt|asset_receipts|publish_receipt`; pre-release-intent maps to `pre_intent`. +`terminal_event_type` is exactly `PERMANENT_STOP`, +`COMPLETE_PUBLICATION_PLAN_INVALIDATED`, `INVALID_PUBLICATION_PLAN_INVALIDATED`, +`RESULT_MERGE_INVALIDATED`, `INVALID_PREFIX_MERGE_INVALIDATED`, or +`RELEASE_PLAN_INVALIDATED`. `invalidation_cause` is exactly `ordinary_plan_or_lineage`, +`protocol_authority_drift`, `credential_exposure`, `post_merge_admission_failure`, +`publication_reconciliation_unavailable`, `publication_write_ambiguity_fenced`, or +`release_invalidation`. Every nullable field is +present. + +`PublicationPlanInvalidationEvidenceV1`, used by either typed initial plan-invalidation event, has +exactly `schema_version`, `campaign_id`, `campaign_registry_sha256`, `publication_id`, positive +`publication_attempt`, `bundle_kind`, `authorizing_intent_sha256`, `publication_plan_sha256`, +`sealed_bundle_root_sha256`, `parent_authority_oid`, `authority_phase`, `reason`, nullable +`branch_receipt_sha256`, nullable `pull_request_receipt_sha256`, nullable exact +`publication_pr_terminal_disposition`, `branch_create_delivery_resolution_sha256`, +`pr_create_delivery_resolution_sha256`, `pr_marker_discovery_sha256`, nullable +`terminal_guard_set_sha256`, `conflicting_publication_objects_root_sha256`, +`expected_base_oid`, `expected_head_oid`, `observed_current_base_oid`, nullable +`observed_branch_head_oid`, ordered `plan_mismatch_predicates`, nested exact `detail`, +nullable `publisher_credential_disposition_set_sha256`, nullable +`reconciliation_unavailable_receipt_sha256`, nullable +`release_authorization_ledger_root_sha256`, nullable `no_later_effects_root_sha256`, `recorded_at`, and +`publication_plan_invalidation_evidence_sha256`. Its schema literal is the class name; reason is +exactly `base_moved`, `head_moved`, `plan_mismatch`, `closed_unmerged`, +`terminal_invalid_lineage`, or `reconciliation_unavailable`. +`PublicationPlanInvalidationDetailV1` is a strict reason discriminator +whose remaining fields are exactly: + +| Reason | Exact remaining detail fields | +|---|---| +| `base_moved` | `expected_base_oid`, `observed_current_base_oid`, `base_observation_receipts_root_sha256` | +| `head_moved` | `expected_head_oid`, `observed_branch_head_oid`, `branch_observation_sha256` | +| `plan_mismatch` | `expected_publication_plan_sha256`, `observed_plan_inputs_root_sha256`, nonempty ordered `failed_predicates`, `verification_receipts_root_sha256` | +| `closed_unmerged` | nested exact `publication_pr_terminal_disposition` with `outcome=closed` | +| `terminal_invalid_lineage` | `expected_sealed_root_sha256`, `observed_lineage_root_sha256`, nonempty ordered `failed_predicates`, `verification_receipts_root_sha256` | +| `reconciliation_unavailable` | `publisher_credential_disposition_set_sha256`, `reconciliation_unavailable_receipt_sha256`, `release_authorization_ledger_root_sha256`, nested exact `publication_pr_terminal_disposition` with `outcome=no_pr|closed` | + +Expected fields equal the intent/plan. Base-moved requires a different nonnull current protected- +base OID; head-moved requires a different nonnull branch head. A null branch head is legal only +with `no_pr`, `branch_outcome=absent`, and authenticated absence in the branch resolution. These +current ref observations are distinct from the nested disposition's observed PR base/head, which +remain null for `no_pr` and are nonnull only for a PR outcome. Once intent exists, the terminal disposition is always nonnull and +is `no_pr|closed`; an observed merge uses the distinct failed-admission event. Its branch/PR +delivery, final marker discovery, guard set, conflict root and expected OIDs byte-equal the +duplicated top-level fields; its PR observed OIDs and identity mismatch predicates are independently +preserved inside the disposition. Top-level `plan_mismatch_predicates` is the nonempty canonical +schema-ordered subset appropriate to the reason. `plan_mismatch` uses +`publication_id_mismatch`, `attempt_mismatch`, `bundle_kind_mismatch`, +`ruleset_policy_mismatch`, `actor_mismatch`, `idempotency_key_mismatch`, or +`prior_terminal_head_reuse`; `terminal_invalid_lineage` uses `sealed_root_mismatch`, +`receipt_parent_mismatch`, `marker_mismatch`, `conflicting_object_uncontained`, or +`terminal_guard_incomplete`; base/head/closed reasons use only their same-named predicate; and +reconciliation unavailable uses only `reconciliation_unavailable`. +Receipt nullability follows reconstructed +phase. For `reconciliation_unavailable`, the three top-level failure roots and disposition +byte-equal its detail and the exact sealed unavailable set/receipt, including that receipt's empty +signed release-authorization ledger; `no_later_effects_root_sha256` is null and `recorded_at` equals +the receipt/set/publisher-ledger/vault-log/release-ledger sealed time. Every other reason requires +the three failure roots null, a nonnull exact no-later root, and `recorded_at` equal its observed +time. Its domain is +`laconian-publication-plan-invalidation-evidence-v1\n`, omitting only its final digest. + +The terminal record's event/cause/nullability matrix is exhaustive; every field not named in a row +is null: + +| Terminal event | Exact `invalidation_cause` | Required nonnull cause fields | +|---|---|---| +| `PERMANENT_STOP` | `ordinary_plan_or_lineage` | `ordinary_stop_evidence_sha256`; exact `no_pr|closed` disposition | +| `PERMANENT_STOP` | `protocol_authority_drift` | `protocol_authority_drift_evidence_sha256`; exact `no_pr|closed` disposition | +| `PERMANENT_STOP` | `credential_exposure` | `credential_exposure_incident_evidence_sha256`; exact `no_pr|closed` disposition; terminal-consumption and supplement fields null | +| `PERMANENT_STOP` | `publication_reconciliation_unavailable` | `ordinary_stop_evidence_sha256(reason=publication_reconciliation_unavailable)`; exact `publisher_credential_disposition_set_sha256`, `reconciliation_unavailable_receipt_sha256`, empty signed `release_authorization_ledger_root_sha256`, and exact `no_pr|closed` disposition; `no_later_effects_root_sha256=null` | +| `COMPLETE_PUBLICATION_PLAN_INVALIDATED` | `ordinary_plan_or_lineage` | `publication_plan_invalidation_evidence_sha256`; exact `no_pr|closed` disposition once intent exists | +| `INVALID_PUBLICATION_PLAN_INVALIDATED` | `ordinary_plan_or_lineage` | `publication_plan_invalidation_evidence_sha256`; exact `no_pr|closed` disposition once intent exists | +| `INVALID_PUBLICATION_PLAN_INVALIDATED` | `protocol_authority_drift` | plan-invalidation and exact drift-evidence roots; exact `no_pr|closed` disposition; exposure/supplement fields null | +| `INVALID_PUBLICATION_PLAN_INVALIDATED` | `credential_exposure` | plan-invalidation, incident, and supplement roots; exact `no_pr|closed` disposition; terminal-consumption null | +| `INVALID_PUBLICATION_PLAN_INVALIDATED` | `publication_reconciliation_unavailable` | plan-invalidation evidence with `reason=reconciliation_unavailable`; exact unavailable set/receipt and empty signed release-ledger roots copied from it; exact `no_pr|closed` disposition; `no_later_effects_root_sha256=null` | +| `PERMANENT_STOP` | `publication_write_ambiguity_fenced` | nested exact `PublicationFencedWriteAmbiguityV1(terminal_route=initial_complete_premerge)` and digest; ordinary disposition/no-later/unavailable/post-merge fields null | +| `INVALID_PUBLICATION_PLAN_INVALIDATED` | `publication_write_ambiguity_fenced` | nested exact `PublicationFencedWriteAmbiguityV1(terminal_route=initial_invalid_premerge)` and digest; ordinary disposition/no-later/unavailable/post-merge fields null | +| `RESULT_MERGE_INVALIDATED` or `INVALID_PREFIX_MERGE_INVALIDATED` | `post_merge_admission_failure` | `post_merge_admission_failure_sha256` with `failure_kind=ordinary`; its nullable-or-`already_merged` disposition is copied exactly and both emergency objects are null | +| either merge-invalidation event | `post_merge_admission_failure` | post-merge failure with `failure_kind=publication_write_ambiguity_merge_race`, exact write-ambiguity merge-won containment finality and empty signed release ledger; ordinary disposition/no-later fields null | +| `RESULT_MERGE_INVALIDATED` | `protocol_authority_drift` | post-merge failure with `failure_kind=protocol_authority_drift_race` and byte-identical drift root; exact `already_merged` disposition; terminal-consumption null | +| either merge-invalidation event | `credential_exposure` | post-merge failure with `failure_kind=credential_exposure_race`, incident, and byte-identical terminal-consumption roots; exact `already_merged` disposition | +| either merge-invalidation event | `publication_reconciliation_unavailable` | post-merge failure with `failure_kind=reconciliation_unavailable` and ordinary merge-won containment finality; exact unavailable set/receipt and empty signed release-ledger roots copied from it; exact `already_merged` disposition; `no_later_effects_root_sha256=null` | +| `RELEASE_PLAN_INVALIDATED` | `release_invalidation` | release evidence reason is one of the six ordinary reasons or `invalid_event_nondismissible`; all emergency fields null | +| `RELEASE_PLAN_INVALIDATED` | `release_invalidation` | release evidence reason is `release_reconciliation_unavailable`; exact failure-only release operation-set/receipt roots copied from it; `no_later_effects_root_sha256=null` and publisher-unavailable fields null | +| `RELEASE_PLAN_INVALIDATED` | `protocol_authority_drift` | release evidence reason is exactly `protocol_authority_drift` and its nested drift root byte-equals the direct drift root; disposition and terminal-consumption null | +| `RELEASE_PLAN_INVALIDATED` | `credential_exposure` | release evidence reason is exactly `credential_exposure`, and its nested terminal consumer byte-equals the direct incident/consumption roots; disposition null | + +For a merge row, every duplicated nested root byte-equals the strict +`PostMergeAdmissionFailureV1`; for a release row it equals the strict release-invalidation evidence. +For every row terminating an active publication-containment root, the nested exact +`PublicationTerminalContainmentFinalityV1` and digest, successor denylist root, before root equal to +its intent digest and after root null are nonnull. Its terminal parent byte-equals +`authority_parent_oid`; its source parent byte-equals the record's distinct +`source_authority_parent_oid`. Ordinary premerge rows also carry the no-later root whose nested +finality is byte-identical; ambiguity rows carry the exact fenced object; merge rows carry the exact +merge-won finality through `PostMergeAdmissionFailureV1`. The terminal CAS preserves the successor +denylist byte-for-byte and clears the active containment root. Release-only invalidation with no +active publication containment has all seven containment/fence fields null and its source parent +equals its immediate authority parent. Direct normal failed admission has the same null +containment/fence fields and immediate source parent, without a denylist transition. +Premerge STOP and invalid-prefix supplement routes consume the active exposure chain directly +through incident/supplement evidence and therefore cannot carry the post-merge-only +`TerminalCredentialExposureConsumptionV1`. A plan invalidation before any +authoritative intent has no initial directory and therefore no terminal record; once `intent.json` +exists, every applicable STOP/plan invalidation/failed admission/release invalidation appends this +record atomically. Premerge STOP/plan invalidation and containment-sourced ordinary failed-admission rows require exact +`PublicationNoLaterEffectsEvidenceV1`; its duplicated identity, phase, disposition and delivery +roots equal the terminal record, except that every +`publication_reconciliation_unavailable` row requires this root null and instead carries the exact +sealed unavailable set/receipt and their empty signed release-authorization-ledger root. A direct +`PostMergeAdmissionFailureV1(source_kind=normal_postmerge_admission)` has a null disposition, null +no-later root and copies that object's deterministic `recorded_at`; it is not a close-race +terminalization. The write-ambiguity merge-race also has a null no-later root and uses its +merge-won/failure sealed time. A +`RELEASE_PLAN_INVALIDATED` row instead requires the exact +`ReleaseNoLaterEffectsEvidenceV1` nested by its `ReleasePlanInvalidationEvidenceV1`, and the generic +terminal `no_later_effects_root_sha256` equals that release root, except that +`reason=release_reconciliation_unavailable` requires the no-later root null and copies the exact +failure-only release operation-set/receipt roots. It never claims zero release +authorization after an intent/effect exists. `recorded_at` byte-equals the selected class's final +authenticated closure/sealed `observed_at` and the terminal event timestamp; for unavailable it +equals the applicable publisher or release failure receipt, disposition/operation set, broker +ledger and vault-log sealed times, plus the signed empty release-authorization ledger for the +publisher branch. Its digest is +`SHA256(UTF8("laconian-initial-publication-invalidation-v1\n") || CanonicalJSONV1(record without +exactly invalidation_sha256))`. + +`InitialPublicationFinalizationV1` has exactly `schema_version`, +`terminal_kind="finalization"`, `campaign_id`, `campaign_registry_sha256`, `publication_id`, +`publication_attempt`, `bundle_kind`, `authorizing_intent_sha256`, `publication_plan_sha256`, +`sealed_bundle_root_sha256`, `authority_parent_oid`, `publication_merge_receipt_sha256`, nullable +`publication_success_finality: PublicationSuccessFinalityEvidenceV1`, +`publication_success_finality_root_sha256`, nullable +`release_intent_sha256`, nullable `tag_receipt_append_sha256`, nullable +`draft_release_receipt_append_sha256`, nullable `asset_receipts_append_sha256`, nullable +`publish_receipt_append_sha256`, nullable `final_release_verification_receipt_sha256`, nullable +`release_no_later_effects: ReleaseNoLaterEffectsEvidenceV1`, nullable +`release_no_later_effects_root_sha256`, +`terminal_event_type`, `recorded_at`, and `finalization_sha256`. The schema literal is +`InitialPublicationFinalizationV1`. Invalid-prefix success requires +`terminal_event_type=INVALID_PREFIX_MERGED`, an exact nonnull publication-success-finality object/ +root and all release fields null; complete success requires +`terminal_event_type=RESULT_RELEASED` and every release field nonnull and equal to the accepted +append wrapper/final-verification chain, including an exact release no-later object whose nested +operation set is sealed with zero live tokens. Each duplicated finality root recomputes from its +nested exact object. Each append field is specifically its accepted wrapper's +`append_sha256`; nested payload digests are reconstructed from those canonical bytes. The +finalization timestamp equals the terminal event timestamp and, for `RESULT_RELEASED`, the release +no-later final closure time; it cannot precede the publication-success sealed time. Its digest +domain is `laconian-initial-publication-finalization-v1\n`, omitting only +`finalization_sha256`. + +`RESULT_MERGED` alone does not terminalize the complete attempt: it appends the exact merge receipt +and leaves zero terminal members while release is pending. `INVALID_PREFIX_MERGED` appends its merge +receipt plus finalization; `RESULT_RELEASED` appends finalization; every typed terminal failure above +appends invalidation. Exactly one terminal member is thereafter immutable. Missing, both, premature, +cause/event mismatch, or a later receipt beneath an invalidated attempt fails reconstruction before +any credential or effect. + +The annotated tag's tagger name/email/timestamp are deterministic content needed for its OID, not +proof of the platform actor. Actor authorization comes only from the intent-bound App installation +identity, broker/API request and audit-log receipts, and protected-tag ruleset evidence. + +Draft recovery fully paginates authenticated `GET /releases` (the by-tag endpoint is not a draft +lookup), requires one unique tag/marker/author match, then fetches that exact release ID. Published +recovery may use the exact tag endpoint and still re-verifies by ID. Create/update endpoints have no +platform idempotency key or CAS, so one repository-wide serialized finalizer performs exact +pre-read/effect/post-read reconciliation. After an asset timeout, 422, or 502 it relists assets and +adopts only an exact name/content-type/size/provider-digest/uploader match, downloading and hashing +bytes when the API digest is absent. A divergent object or `starter` asset is terminal +`RELEASE_PLAN_INVALIDATED` evidence under the no-delete/no-overwrite policy; it is never blindly +retried. + +Every query, create, adoption, response loss, retry, conflict, and returned object ID/root is an +authority receipt. A same-name object with a different actor, target, marker, byte/root, plan, or +lineage is never overwritten, force-updated, reused, or hidden. Before merge, a complete conflict +uses the exact complete-publication invalidation or `PERMANENT_STOP`; an invalid-prefix conflict +uses its exact invalidation. An already-merged complete object that fails admission emits +`RESULT_MERGE_INVALIDATED` and enters `RELEASE_BLOCKED`; an already-merged invalid-prefix object +that fails admission emits `INVALID_PREFIX_MERGE_INVALIDATED` and enters terminal +`INVALID_PREFIX_MERGED_INVALID`. A release/tag/draft/asset/publish conflict emits +`RELEASE_PLAN_INVALIDATED` and enters `RELEASE_BLOCKED`. Immutable or externally visible objects +are recorded as exposure/orphan +evidence. Recovery cannot create a second branch, PR, tag, Release, asset name, or publish +transition. All external effects are therefore either covered by a prior durable intent and exact +receipt/adoption, or are terminal conflicting evidence; no untracked ordinary-publication orphan is +accepted. + +Credential exposure at `RESULT_MERGED` uses the same event with a strict pre-intent or post-intent +invalidation form. Both require `TerminalCredentialExposureConsumptionV1` and clear the active +pair plus matching optional hold in the invalidation CAS. The pre-intent form proves no release +object exists; the post-intent form binds the exact intent and every discovered/adopted tag, draft, +asset, or published object plus no-later-effects reconciliation. Ordinary invalidation forbids the +terminal projection and requires the active pair null. No post-intent evidence may be hidden by +selecting the pre-intent form. + +### 7.7 Public replay CLI is offline and non-evidentiary + +All seven public `laconian-benchmark` commands are offline replay conveniences and are +non-evidentiary: `hard-score`, `prepare-judge`, `seal-judge`, `sample-audit`, `seal-audit`, +`analyze`, and `verify`. They may reconstruct or inspect ordinary values from supplied local +artifacts, but their outputs cannot create campaign authority, advance `CampaignStateV1`, satisfy a +live prerequisite, mint a verified context, or enter publication evidence merely because the +bytes or hashes match. + +Live `hard-score`, `prepare-judge`, and `seal-judge` execute only as Runtime campaign-side stages +that receive the in-memory verified generation-context capability. Their exact internal entrypoints +are `laconian_eval.campaign.runtime.Runtime.hard_score`, `.prepare_judge`, and `.seal_judge`; the +only constructor is the non-public +`laconian_eval.campaign.runtime._reconstruct_verified_runtime`, which requires the in-memory +capability from section 7.1. Live `sample-audit`, `seal-audit`, `analyze`, and `verify` execute only +as `laconian_eval.campaign.publication.Publication.campaign.evaluation_stage` methods with those +exact names; the only constructor is the non-public +`laconian_eval.campaign.publication._reconstruct_verified_publication` from current authority. + +The public console entrypoint remains `laconian_eval.cli:main` and may call only modules under +`laconian_eval.replay`; it cannot import either campaign constructor or capability type. Import- and +call-graph tests enumerate these seven public command handlers and seven live methods and fail on +any shared writer entrypoint. No live workflow invokes the public replay CLI. No verified +capability, capability wrapper, or capability-bearing context is serialized to an artifact, +provider index, command line, workflow input, or environment value. + +## 8. Provider failures, retries, and spend + +The campaign has a fixed **USD 75 maximum authorized request exposure** under the committed price +snapshot. The pilot has a separate USD 5 cap. A preflight calculation above the cap stops before +environment approval. Current-price verification follows the reviewer attestation in section 7.1; +there is no brittle automatic scrape. This is a hard scheduling/authorization bound, not a claim +that an external provider invoice can be controlled perfectly or that every planned request is +guaranteed to fit. If cumulative charged-or-reserved exposure plus the next conservative batch +reservation no longer fits, the campaign stops incomplete and is reported accordingly. + +The committed `PriceSnapshotV1` and each reviewer `PriceAttestationV1` are tier-specific. +`price_snapshot.service_tier == price_attestation.requested_service_tier == "default"` is required +for every requested model ID and batch. Each frozen requested model ID has separate non-null +reviewed rates for ordinary +uncached input, cache reads, cache writes, visible output, and reasoning output. In particular, a +null cache-write rate is forbidden even though the request contract disables writes; any numeric +rate, including zero, must itself be explicitly sourced and reviewed rather than inferred. The +snapshot and attestation bind the versioned `<= 272_000` conservative input-exposure proof; no +long-context schedule is in the authorized price vocabulary. + +An append-only campaign spend ledger tracks both batch and request-attempt exposure. Before a +provider job can map the key, the secret-free preparation path persists a worst-case reservation +for every initial call and allowed retry in its frozen `BatchPlanV1`, including input bounds and +output-token caps. Each reservation is a typed vector with distinct +`ordinary_uncached_input_tokens`, `cache_read_tokens`, `cache_write_tokens`, +`visible_output_tokens`, and `reasoning_output_tokens` components and their frozen prices; read +evidence cannot satisfy or erase the write component. Its finalized receipt binds the campaign, +phase, ordered plan items, price snapshot, requested `default` service tier, literal +`prompt_cache_options: {"mode": "explicit", "ttl": "30m"}`, the recursive absence of every +`prompt_cache_breakpoint`, predecessor ledger, and exact provider-job identity tuple +`(workflow_run_id, run_attempt, job_id, batch_attempt_id)`. + +The conservative reservation envelope is versioned and mechanically reproducible. Let `P_u`, +`P_r`, and `P_w` be the frozen ordinary-input, cache-read, and cache-write USD-per-million rates, +and let `P_v` and `P_h` be visible- and reasoning-output rates. For generation, one attempt reserves: + +```text +R_attempt = (272_000 * max(P_u, P_r, P_w) + + 1_024 * max(P_v, P_h)) / 1_000_000 +``` + +The three input components remain separately recorded with the coupling invariant +`ordinary_uncached + cache_read + cache_write <= 272_000`; the maximum-rate envelope prevents +double-counting mutually exclusive input-token partitions while retaining worst-case write +exposure. The judge substitutes `768` for `1_024`. A confirmatory request permits one initial +attempt plus five retries, so its worked worst-case chain is exactly `6 * R_attempt`; a full +40-request shard would be `40 * 6 * R_attempt`. For example, with remaining authorization `B`, +preflight may schedule at most `floor(B / (6 * R_attempt))` generation requests and schedules none +if that value is zero. It does not substitute long-context rates or assume cache reads/writes are +zero to make the USD 75 cap fit. + +That identity must consume exactly one unused reservation before key access. A rerun or replacement +job has a new identity and therefore requires a new additive reservation; it cannot reuse the old +receipt. An unreconciled prior reservation remains fully charged against the cap. Missing, +duplicate, reused, superseded, or identity-mismatched receipts write STOP before credentials. This +makes runner loss conservative rather than an unrecorded opportunity to spend again. + +Every request attempt has its own reserved amount and terminal accounting state. A reservation may +be released only with durable evidence that the attempt never began. Once provider dispatch may +have occurred, it reconciles downward only from trusted provider usage or a frozen provider rule +that proves a definitely rejected request has zero billable usage. Missing usage, uncertain +delivery, a crash, or an unverifiable checkpoint retains the full worst-case amount. Earlier failed +attempts in a retry chain and the final successful attempt reconcile independently; success never +erases earlier exposure. The next batch starts only when its predecessor ledger is exact, its new +worst-case reservation fits, and no STOP marker exists. + +Every terminal attempt stores the exact response paths and separate applied-cache-control, +cache-read, and cache-write status enums from section 6.2, plus total input, ordinary-uncached input, +visible output, reasoning output, billed output, total usage, and a source digest for each. +Cache-control/read/write records are never derived from one another. `cache_write_tokens = 0` is +accepted only from the exact canonical path with `reported_zero`; absent or incomplete detail stays +`missing`, never becomes zero, and retains the full write component. If delivery is unknown or any +Responses API result was received, `missing`, `mismatch`, or `invalid` appends STOP and permits zero +later calls. + +Any trusted `reported_nonzero` cache-write usage is reconciled at the frozen non-null cache-write +rate and included in charged exposure before STOP is appended. The record and cost remain evidence; +STOP does not discard or relabel the write. `reported_nonzero` cache-read usage reconciles only the +separate read component and also stops because it violates the explicit/no-breakpoint contract. +The same per-attempt record stores exactly one service-tier accounting status from section 6.2. +`missing` or `mismatch` returned-tier evidence retains all unreconciled worst-case components, +appends STOP, and permits zero later calls. + +The automatic retry taxonomy is closed and versioned: + +- authentication and permission failures, including both 401 and 403, durably stop the campaign; +- only a structured provider 429 response classified `delivery_certainty=definitely_rejected`, + independently proven to have no response usage, and recorded as + `not_applicable_definitely_rejected` for service-tier accounting may be retried automatically; +- its valid bounded `Retry-After` controls the delay; when absent, the frozen domain-seeded + exponential full-jitter rule controls the delay; +- timeout, connection loss, 408, 409, 5xx, or any other response with uncertain delivery becomes + `AMBIGUOUS_INFLIGHT` and is never automatically retried; +- other definite provider rejections are terminal and are never automatically retried; and +- at most five 429 retries are allowed by the confirmatory manifest, while the pilot allows zero. + +The existing sub-second fixed backoff is not sufficient for this campaign and must be replaced +before the live pilot. The versioned retry-evidence schema records status class, delivery +certainty, provider `Retry-After`, bounded retry-after milliseconds, exponential bound, jitter +derivation, selected backoff, source, attempt reservation, and remaining deadline. The verifier +checks the frozen rule rather than the old exact `100 * 2**n` value. SDK retries remain disabled so +the append-only journal is the only retry authority. + +Authentication, permission, ambiguous delivery, reservation inconsistency, or suspected credential +exposure writes a permanent STOP marker into the campaign ledger. The current 403-as-ordinary- +rejection behavior must be changed. Every later secret-free predecessor job and every provider-call +boundary checks the marker, and tests prove that no subsequent call occurs. + +The runner stops voluntarily at least 15 minutes before the three-hour job timeout. It begins a +request or retry only if the remaining monotonic time covers the full request timeout, maximum +allowed backoff, durable journal work, and checkpoint margin. `always()` upload is fallback, not a +guarantee after forced runner termination. + +`GENERATION_COMPLETE` alone is not a success gate. Collection verifies all planned keys, terminal +reasons, retry chains, delivery certainty, returned-model consistency, response usage, and missing +records. `retry_exhausted` and provider-rejected records remain evidence and count against success +and coverage. + +## 9. Blind semantic judge + +After all 36 generation capsules are sealed, a secret-free deterministic stage creates one +`HardScoreRequestSetV1` attachment per capsule. It binds the generation-capsule seal, hard-scorer +source and protocol hashes, every planned response ID, deterministic hard-pass decision and reason, +and the exact ordered judge-request IDs for hard-pass responses. The attachment is sealed before +any judge request; changing a hard decision or request set creates a new attachment identity and +cannot be joined to the campaign. + +The live stage receives only the in-memory `VerifiedGenerationContextExpectationV1` reconstructed +under section 7.1. Every hard-score set and downstream judge projection repeats and verifies the +tagged hard-scorer source hash, hard-score, judge, statistical, and audit protocol hashes, +`campaign_registry_sha256`, `protocol_attestations_root`, both identity-registry digests, and the +common `workflow_root`. +Provider-evidence validation rejects any attachment or provider-index projection that omits, +changes, nests as alleged authority, or substitutes one of these bindings. + +Only deterministic hard-pass responses enter semantic judging. The judge is `gpt-5.6-sol` with: + +- literal wire `service_tier: "default"`, literal + `prompt_cache_options: {"mode": "explicit", "ttl": "30m"}`, and no + `prompt_cache_breakpoint` anywhere; +- `reasoning.effort: low`; +- low text verbosity and a strict structured-output schema; +- `max_output_tokens: 768`; +- no tools, persistence, or conversation carry-over; and +- a frozen prompt, schema, settings, and protocol SHA-256. + +The judge sees the original user request, semantic rubric, material-warning requirement, locale, +and candidate response as explicitly delimited untrusted data. It does not see arm, provider, +generation model, request order, output length, token counts, latency, or cost. Candidate text can +never select tools, files, workflow state, or output paths. Delimiting and adversarial tests reduce +prompt-injection risk but cannot prove that an LLM will never be influenced by candidate text; this +remains a disclosed residual limitation. + +The structured judgment records every rubric-item decision, the material-warning decision where +applicable, any material contradiction, overall semantic pass, and bounded evidence. The overall +decision must be derivable from the item decisions; inconsistent or malformed judgments fail +closed. + +Judge requests follow the same service-tier, applied-cache-control, cache-read/cache-write, +input-bound, delivery, retry, budget, journaling, and artifact rules as generation. A semantic-gated report requires 100% +judgment coverage for hard-pass responses. Judge failure does not silently fall back to a +hard-gated performance claim. + +Judging uses 36 hash-bound attachments keyed by generation model and scenario. Each attachment +references exactly one sealed generation-capsule hash and its sealed `HardScoreRequestSetV1` hash, +and contains judgments for at most its 40 ordered judge requests. A zero-request set still produces +a sealed zero-call judge attachment. Judge batches use the same bounded batch controller, +per-attempt spend ledger, STOP marker, soft deadline, resume contract, and exact-artifact lookup as +generation. Provider-evidence validation verifies that the ordered judge attachments cover each +and only each request in the 36 sealed hard-score request sets. + +Using Sol to judge Sol-generated answers is a disclosed limitation. The independent human sample +is the predeclared check against judge disagreement and self-preference; it does not make the judge +infallible. + +## 10. Statistical contract + +### 10.1 Primary estimand + +The confirmatory comparison is `if` versus `concise`, calculated separately for each generation +model. An eligible pair has matching case and repetition, terminal responses for both arms, and a +pass for both arms under the selected semantic gate. + +The primary delta is: + +```text +visible output tokens(concise) - visible output tokens(if) +``` + +A positive delta means the eligible visible `if` response is shorter. For each response, +`visible_output_tokens = output_tokens - reasoning_tokens`; billed output and hidden reasoning +tokens are reported separately. The point estimator is the median over eligible paired visible-token +deltas. Characters are secondary and are never presented as tokens. Input, visible output, +reasoning output, billed output, total, cache-read-input tokens, cache-write-input tokens, +estimated cost, and latency remain separate descriptive metrics. + +This is a post-treatment estimand conditional on both matched responses passing the semantic gate. +It does not estimate unconditional token, total-token, or cost savings across all planned requests. +Every public claim therefore says “among jointly successful matched responses.” + +Baseline and Caveman results provide context only. Any pairwise estimates involving them are +exploratory and do not replace the primary hypothesis. + +### 10.2 Dependence and intervals + +Every confirmatory interval is two-sided 95%. The cluster-percentile bootstrap sorts canonical +scenario UIDs bytewise, samples 12 scenario indices with replacement, and retains both locales, +all repetitions, and matched arms for each sampled block. Each replicate recomputes the complete +estimator. The implementation uses NumPy `Generator(PCG64)`, the domain-derived seed from section +6.3, 10,000 replicates, and type-7 empirical quantiles at 0.025 and 0.975. Fewer than 9,990 valid +replicates makes the corresponding decision inconclusive. Ties remain in the empirical sample; +golden vectors freeze ordering, quantiles, and invalid-replicate behavior. + +Paired brevity, raw arm pass proportions, and paired arm pass-rate differences all use this same +scenario-clustered interval. Unclustered Wilson intervals may appear only as explicitly labeled +naive diagnostics; they are not publication uncertainty or a decision input. The normative +methodology is updated accordingly before the input tag. + +Intervals, denominators, scenario coverage, eligible pair count, token-pair count, and missingness +are always adjacent to point estimates. `eligible_pairs` and `token_pairs` are separate fields. + +### 10.3 Quality and coverage gates + +For every model and each of its 120 planned case/repetition keys per arm, define: + +- `H = 1` only for a terminal provider success that passes the deterministic hard gate; +- `S = 1` only when `H = 1` and the frozen judge passes the semantic rubric; and +- `H = S = 0` for provider-rejected, retry-exhausted, blank, or hard-fail terminal records. + +Only hard-pass responses require a judge call. A missing key, unknown delivery, authentication +stop, inconsistent model, or unverifiable provenance invalidates inference instead of being +imputed as failure. Thus `hard_pass_rate = sum(H) / 120` and +`semantic_success_rate = sum(S) / 120`; semantic quality is never conditioned only on rows that +survived the hard gate. + +For both `H` and `S`, the paired rate-difference estimator is the mean of `if - concise` over the +120 matched planned keys. The lower 95% cluster-bootstrap bound for: + +```text +pass_rate(if) - pass_rate(concise) +``` + +must be greater than `-0.05`. This is the predeclared five-percentage-point quality +non-inferiority margin. For `S`, this observed-data check is provisional: final semantic +non-inferiority also requires the worst-case false-fail sensitivity bound in section 11.3. + +A model result also requires: + +- at least 96 of the 120 planned primary pairs to be eligible; +- eligible pairs from at least 10 of 12 scenarios; +- provider-reported billed-output and reasoning-token usage, and therefore visible-output tokens, + for every eligible pair; +- complete judge coverage for every hard-pass response; and +- no unresolved identity, delivery, model, or provenance error. + +These gates prevent a small successful subset from carrying the brevity claim. + +### 10.4 Outcome classification + +Classification follows this fixed precedence and records every applicable reason: + +1. Protocol, identity, security, missing-ledger, inconsistent-model, or ambiguous-delivery failure + is **operationally invalid**; no performance classification is made. +2. With statistically valid evidence, a hard-quality upper bound below `-0.05` is + **negative-quality**. Semantic `negative-quality` additionally requires the section 11.3 + worst-case false-fail sensitivity upper bound below `-0.05`. Merely failing to put the lower + bound above `-0.05` is not evidence of inferiority. +3. When integrity, coverage, quality, and model-specific human-audit gates pass, a primary + visible-token upper bound below zero is **negative-brevity** only if the section 11.3 + negative-direction false-fail sensitivity gate also passes. +4. When every integrity, coverage, quality, and model-specific human-audit gate passes and the + primary visible-token lower bound is above zero, the hypothesis is **supported** only if the + section 11.3 positive-direction false-fail sensitivity gate also passes. +5. Every other statistically valid case, including a boundary-crossing interval or audit-gate + failure, is **inconclusive**. + +If multiple negative conditions hold, all are reported. A semantic-based negative or supported +classification requires a valid audit; hard-gate quality inferiority may still be reported when +the semantic judge is inconclusive. + +The three model decisions are published separately. No multiplicity-adjusted family claim is +made. A descriptive statement such as “supported on X of 3 tested models” must still link to all +three independent results and their limitations. + +## 11. Human audit + +### 11.1 Sampling and blinding + +After all judge decisions are sealed, a deterministic sample targets 144 judged records. It uses +24 strata: `3 generation models x 2 locales x 4 arms`, with an initial quota of six per stratum. +Every judge-pass `safety-medical` record from the primary `if` and `concise` arms is first selected +as a certainty unit with inclusion probability one. Under the planned corpus this is at most five +records inside each primary model/locale/arm stratum, so the sixth slot remains available for a +random noncritical record. If certainty units ever exceed the 144-record target, the audit expands +rather than subsampling them. + +After certainty selection, base stratum `s = (generation model, locale, arm)` has local capacity +`q_s = max(0, min(6 - c_s, N_s))`, where `c_s` is its certainty count and `N_s` its noncertainty +population. Noncertainty records are split into cells +`h = (generation model, locale, arm, blinded judge decision)`. Within each cell, canonical record +IDs are sorted bytewise and permuted by NumPy `Generator(PCG64)` using the section 6.3 seed derived +with domain `laconian-human-audit-v1/cell/` plus the canonical cell ID. + +The integer allocation is exact. If `q_s` is at least the number of nonempty cells, first assign one +seat to every nonempty cell. Allocate the remaining seats by Hamilton largest remainder over each +cell's remaining capacity: take floors of the proportional quotas, then award residual seats by +descending fractional remainder with bytewise cell ID as the tie-break, skipping full cells. If +`q_s` is smaller than the number of nonempty cells, apply the same Hamilton rule without the +one-seat minimum. After all local allocations, set the total target to +`max(144, total_certainty_count)` and fill any shortfall one record per pass over bytewise-sorted +noncertainty cell IDs, skipping full cells, until the target or population exhaustion. A cell's +selected records are always the first `n_h` IDs in its frozen permutation. The sample manifest +records all capacities, floors, remainders, tie-breaks, global-fill passes, `N_h`, `n_h`, certainty +flags, seeds, permutations, and inclusion probabilities. + +The blind packet removes model, arm, order, tokens, length, latency, judge decision, and provider +metadata. It retains only the prompt, rubric, warning severity, locale, candidate response, and +opaque audit-record ID required for human evaluation. + +Two human reviewers label the same packet independently using the frozen rubric. They must not +inspect generation or judge artifacts before committing their labels. + +### 11.2 Commit-reveal + +The input-tag manifest binds the exact two-entry `AuditReviewerRegistryV1` from section 6.5, +including each numeric GitHub account ID, exact login, signing-verification mode, fingerprint +field, canonical bytes, and digest. Independence is preserved through ordinary user-authored pull +requests and this public commit-reveal protocol: + +1. each reviewer produces canonical label JSONL and a fresh random salt locally; +2. that reviewer opens a PR which only adds + `benchmarks/audits//commitments/.json`, containing the + domain-separated SHA-256 commitment bound to campaign, reviewer ID, salt, sample-manifest hash, + and exact label bytes; +3. branch-protection CI verifies that the PR actor matches the preregistered reviewer, the head + commit has the required verified signature status, the path is new, and the commitment schema + and campaign bindings are exact; +4. only after both commitment PRs merge, each reviewer opens a separate reveal PR adding immutable + canonical labels and salt under `benchmarks/audits//reveals//`; +5. CI recomputes the commitment byte-for-byte and rejects an actor mismatch, modified original + commitment, malformed or incomplete labels, duplicate record, or premature reveal; +6. after both reveal PRs merge, disagreements are copied by a separate adjudication PR to an + append-only record without editing either original label file; and +7. both preregistered reviewers independently approve or sign the canonical adjudication digest, + which binds both reveal hashes and every consensus label and rationale. + +The audit collector binds the exact commitment, reveal, and adjudication PR numbers; actors; head +and merge commit SHAs; signature-verification states; merge actors; file hashes; and both reviewer +sign-off records. CI verifies that the signers are the two distinct preregistered identities, checks +their configured signing fingerprints when required, and confirms that the adjudication input did +not include or reveal model-judge labels. A missing or stale sign-off leaves the disagreement +unresolved and the affected model inconclusive. A maintainer cannot substitute a reviewer or +adjudication file without producing a visibly different, invalid provenance chain. + +The two reviewers reconcile disagreements after reveal and record a bounded rationale plus both +sign-offs. They and any adjudicator remain blinded to the model-judge decision until the consensus +file is committed and sealed; judge labels are revealed only for agreement calculation. Any +unresolved disagreement makes the affected model's semantic performance conclusion inconclusive. + +### 11.3 Audit metrics and gate + +For weighting, a noncertainty sampling cell is +`h = (generation model, locale, arm, blinded judge decision)`. Each selected record in that cell +has design weight `w_h = N_h / n_h`, where both `N_h` and `n_h` exclude certainty units; certainty +units have weight one. This finer cell definition is required because judge-pass and judge-fail +records can have different inclusion probabilities. +Agreement is the Hajek +weighted proportion `sum(w * I[judge = consensus]) / sum(w)`. False-pass rate is +`sum(w * I[judge = pass and consensus = fail]) / sum(w * I[judge = pass])`; a zero denominator is +inconclusive. Human-human agreement and kappa use the corresponding design-weighted confusion +table. Weighted kappa is a descriptive point estimate with no Wilson interval; its complete +confusion table is reported. The publication reports all weights, cells, denominators, point +estimates, and the specified intervals for proportions. + +Audit uncertainty uses a preregistered design-weighted Wilson score interval. For each reported +proportion, `n_eff = sum(w)^2 / sum(w^2)` over its denominator and the two-sided interval uses +`z = 1.959963984540054`; it therefore retains nonzero uncertainty after zero observed errors or +perfect observed agreement. This is an approximate survey-weighted interval and is labeled as +such. Empty required strata, `n_eff < 1`, or a zero false-pass denominator make the affected gate +inconclusive. Binary percentile resampling is forbidden for audit-gate uncertainty. + +The confirmatory audit gate is calculated separately for each generation model and uses only its +`if` and `concise` strata. Baseline and Caveman audit results, plus campaign-wide aggregates, are +exploratory and cannot validate a model-specific primary claim. For each model, the preregistered +point-estimate gate requires: + +- judge-consensus agreement of at least 90%; +- judge false-pass rate of at most 5%; +- no unresolved reviewer disagreement; +- 100% audit coverage of judge-pass primary-arm `safety-medical` critical records; and +- no false pass for either preregistered `safety-medical` critical warning. + +The 95% intervals are always shown beside those decisions. An audit-gate failure does not erase the +run; it makes that model's semantic conclusion inconclusive rather than allowing other models or +context arms to dilute the failure. + +The report also gives the weighted false-fail rate +`P(consensus = pass | judge = fail)` separately for every generation model `m` and primary arm +`a in {if, concise}`. Let `M_{m,a}` be the number of all judge-fail records, `U_{m,a}` its reported +95% upper false-fail bound, and `D_{m,a}` the number of audited judge-fail/consensus-pass records. +Those `D_{m,a}` known records are reclassified in every sensitivity assignment, and at most +`K_{m,a} = min(M_{m,a}, max(D_{m,a}, ceil(U_{m,a} * M_{m,a})))` total records in that model/arm may +be reclassified. If `M_{m,a} = 0`, `K_{m,a} = 0`; if `M_{m,a} > 0` but its false-fail uncertainty is +not estimable, that model's semantic result is inconclusive. + +For every feasible arm-specific assignment respecting matched keys, the analysis recomputes `S`, +the semantic pass-rate-difference interval, eligibility, and the primary visible-token interval +with the frozen 10,000-replicate cluster bootstrap. Across assignments it selects the minimum +semantic-quality lower bound, maximum semantic-quality upper bound, minimum primary-token lower +bound, and maximum primary-token upper bound. Exhaustive enumeration or a verifier-checked exact +branch-and-bound certificate is required; a heuristic search is not sufficient. + +The exact search is deterministically bounded per model. Let +`A_m = product_a sum_{j=D_{m,a}}^{K_{m,a}} C(M_{m,a} - D_{m,a}, j - D_{m,a})`. Direct enumeration is +allowed only when `A_m <= 4096`. Larger spaces use bytewise record order and exact branch-and-bound +capped at 1,000,000 visited nodes and 4,096 complete-assignment bootstrap evaluations, with all +10,000 bootstrap scenario-index vectors precomputed once. A verifier checks the certificate for +every pruned subtree and all four extrema. The caps count deterministic logical operations, not wall +time. If the proof is incomplete at either cap, all semantic quality and brevity decisions for that +model are `inconclusive`; no partial extremum is used. The caps, counters, certificate, and +`search_exhausted` reason are published. + +Semantic non-inferiority passes only when the minimum semantic-quality lower bound is greater than +`-0.05`; semantic `negative-quality` is established only when the maximum semantic-quality upper +bound is below `-0.05`. Otherwise the semantic-quality decision is inconclusive. The +positive-direction brevity sensitivity gate passes only when the minimum token lower bound is +strictly above zero; the negative-direction gate passes only when the maximum token upper bound is +strictly below zero. If the applicable directional gate fails, the semantic brevity result is +inconclusive. Hard-gate `H` quality is unaffected by judge false-fail assignments and retains its +section 10.3 interval. + +## 12. GitHub Actions trust boundaries + +### 12.1 Environments and permissions + +The repository adds two protected environments: + +- `benchmark-live`, holding `OPENAI_API_KEY` and requiring approval before generation or judge + batch execution; and +- `benchmark-publish`, requiring separate approval for each publisher or release-finalizer write. + +At specification time the repository API reports default workflow permission `read` and +`can_approve_pull_request_reviews: false`. The read default remains. The repository +`GITHUB_TOKEN` is read-only everywhere, including state, provider, publication, correction, and +release workflows; it never creates or closes a PR, moves an authority ref, creates a tag or +release, uploads release assets, approves, or merges. + +Self-review and admin bypass are disabled where GitHub supports those controls. Deployment refs +are restricted to the protected input-tag pattern; the paired attestation-tag pattern is separately +protected against update and deletion and is never accepted as a workflow trigger. The exact +stable semantic ruleset policy root enters `ProtocolAttestationTagBindingV1`; variable observations +remain separate receipts. Approval actors and deployment +identities are retained in provenance. A platform administrator may technically bypass or later +change a ruleset, so a ref name or ruleset is not immutable authority: exact Git OIDs, +`GitObjectSHA256V1` values, the double-read receipts, and post-seal drift checks are mandatory. + +One universal gate applies immediately before **any** provider/App/OIDC credential mint, mapping, +or use and before any external effect other than the read-only verification calls themselves. The +responsible workflow, broker, or fixed tool freshly double-reads both exact refs, verifies both tag +and peeled-object identities/raw hashes, reconstructs the stable `TagRulesetPolicyV1` projection +from fresh `TagRulesetObservationReceiptV1` evidence, and matches the sealed companion binding and +`campaign_registry_sha256`. A temporary inability to complete any read produces no token, effect, +or state mutation. Proven drift before merge uses exactly the closed drift STOP matrix; after merge +it uses only the existing release-invalidation/correction path. No cached preflight result, +environment approval, durable intent, prior receipt, or idempotent retry bypasses this gate. +Independently, a nonnull `active_credential_exposure_pending_root` blocks every ordinary authority +mutation, credential issuance, provider call, artifact access/download, publication, release, +correction, documentation/social action, and external effect. The only admissions are the next +inventoried containment effect, its typed `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` CAS, the final +phase-exact STOP, supplement, merge/release invalidation, or correction intent/invalidation that +consumes the root, and protected-main reads/CAS needed for those acts. An unresolved invalid-event +hold likewise blocks every ordinary edge; +the only atomic consumers permitted with a nonnull hold are `INVALID_EVENT_DISMISSED`; premerge +`PERMANENT_STOP` with `invalid_event_nondismissible`, typed credential-exposure, or typed drift +evidence; `RESULT_MERGED -> RELEASE_PLAN_INVALIDATED`; and `RELEASED -> +CORRECTION_INTENT_AUTHORIZED` only with the exact nondismissible/exposure/invalidation/drift +discriminator and evidence. Hold admission is forbidden while any correction prefix is active. +It is also forbidden while any initial-publication prefix is active and at +`COMPLETE_PUBLICATION_PR_OPEN`. +Each consumer binds the predecessor hold root and its successor clears it. All require the +active exposure root null except the credential emergency flow's own progress/final consumer. +Every other publication, promotion, release, correction, invalid-prefix, or safe-finalization edge +requires both roots null. +On proven premerge drift the requested ordinary credential/effect remains forbidden. The closed +exceptions are: state-writer for the typed drift STOP CAS and, for an active initial complete- +publication prefix, publisher only for its exact absence/close/merge disposition and corresponding +STOP or failed-admission CAS; the protected-main safe-invalid continuation after an already sealed +STOP/BUDGET lineage; and credential-exposure pending/final CASes plus only their inventoried +containment credentials/effects/receipts, because exposure containment has emergency precedence. +Those exceptions are governed by their exact matrices below and grant no live recovery. + +All automated benchmark-workflow writes use exactly three installed, pairwise-distinct, +repository-scoped GitHub Apps with actor IDs frozen in the security protocol and receipts: + +- the **state-writer App** performs only expected-OID, non-force, fast-forward updates on + `benchmark-authority/*`, for requests admitted from the fixed hash-verified reusable + state-writer job; +- the **publisher App** creates the exact result branch and PR bound by the current + `PublicationPlanV1`, writes the App-bound eligibility/terminal-guard protocol-evidence context, + or closes/dequeues/fences only the exact affected PR after typed terminal containment; the App + context is not the branch-protection required check; and +- the **release-finalizer App** creates the exact protected annotated result tag, creates the exact + draft release and checksum-bound assets, verifies their returned roots, and performs exactly one + transition that publishes that draft. + +The companion-tag amendment adds no GitHub App, workflow, environment, credential, or secret. The +existing 15-member workflow inventory and three-App topology remain exact; protocol reviewers and +the registered operator respectively create the serial review commits and paired annotated tags +through protected human Git operations before preflight. + +The release-finalizer App installation also has `Administration: write`, solely because GitHub +withholds ruleset `bypass_actors` from callers lacking ruleset write access; this does not add a +fourth App, and the security-attestor endpoint policy remains GET-only. A separate fixed `security_attestor` job in +`.github/workflows/benchmark-publish.yml` at the exact allowed main/ref/plan runs only in the +protected `benchmark-publish` environment. After its own closed OIDC job identity verifies, an +external App-token broker mints a permissions-downscoped installation token containing only +`administration:write`, `metadata:read`, and `contents:read`; the App private key never enters +Actions, and the exact token request and returned permissions are receipt-bound. No +contents/Releases write token or publisher/state credential is present in that job. The fixed +client rejects every non-GET method even though the installation token is technically broader. +Conversely, release-writer tokens omit Administration permission. No other workflow, ref, job, or environment +may request the attestor token. The attestor reads exact repository rule-suite and +immutable-Release settings and never receives a provider key or model-output/artifact bytes. + +The Apps' GitHub permission grants are necessarily broader than those semantic operations, so the +design does not claim that unavailable GitHub capability scopes enforce the narrow roles. Narrowing +is enforced jointly by fixed hashed tools, endpoint-policy allow/deny tests, protected branch/tag +rulesets, immutable Releases configuration, expected-object receipts, exact actor restrictions, +environment approvals, and postcondition verification. An endpoint, method, ref, actor, asset, or +state transition outside the frozen policy fails closed and leaves a durable receipt or incident. + +The state-writer App private key is held only by an identity-bound external token broker; it is not +stored in repository, organization, environment, or Actions secrets. The broker accepts GitHub OIDC +only under a versioned `StateBrokerCallerPolicyV1`. The policy freezes the audience, exact +`OWNER/REPO`, numeric `repository_id`, exact owner login and numeric `repository_owner_id`, and the +repository's exact OIDC subject-customization/immutable-subject configuration state and digest; it +does not assume one GitHub default `sub` format across repository creation, opt-in, rename, or +transfer boundaries. The broker requires `typ=JWT`, `alg=RS256`, a `kid` that resolves through the +current GitHub OIDC JWKS, issuer `https://token.actions.githubusercontent.com`, the frozen `aud`, a +`sub` derived by the frozen repository configuration, `nbf <= iat <= now < exp`, an accepted age +of at most five minutes, and a durable never-before-seen `jti`, then constructs an exact identity +projection containing `repository`, `repository_id`, `repository_owner`, `repository_owner_id`, +`actor`, `actor_id`, `ref`, `ref_type`, `sha`, `event_name`, `workflow`, `workflow_ref`, +`workflow_sha`, `job_workflow_ref`, `job_workflow_sha`, `run_id`, `run_attempt`, +`check_run_id`, and `runner_environment`. The projection requires every listed field; `actor` and +`actor_id` are caller-discriminated. Every normal caller requires the same plan-authorized human +dispatcher in the frozen operator registry. Only `benchmark-dismiss-hold.yml` instead requires the +exact `eligible_dismisser_account_id/login` in the current strict dismissal plan and C0 dismissal +policy, distinct from the rejected source actor. Its plan also binds the exact dispatcher workflow +and ref. A rerun's REST `triggering_actor` must satisfy the same caller-specific rule; it cannot +fall back to the initial actor or the tag operator. The `environment` claim must be absent because the reusable state-writer job does not use a GitHub +environment. Standard JOSE/time claims remain raw token metadata. Any missing, duplicate, unknown +identity field in the signed broker request, or value inconsistent with the JWT, GitHub API run, +campaign plan, or frozen registry is denied; extra raw GitHub claims are retained but never confer +authority. + +For a called workflow, GitHub's `workflow`, `ref`, `workflow_ref`, and `workflow_sha` describe the +caller, while `job_workflow_ref` and `job_workflow_sha` describe the called reusable workflow. The +caller reference must therefore be exactly +`OWNER/REPO/.github/workflows/.yml@` and the called reference exactly +`OWNER/REPO/.github/workflows/benchmark-publication-state.yml@`; bare paths and a +synthetic `workflow_ref@C0` comparison are forbidden. `workflow` must equal the exact top-level +workflow name extracted from the verified caller member. The caller uses the same-repository +reusable-workflow form, so the called workflow resolves at the same triggering commit without a +self-referential C0 literal in C0's own YAML. The called workflow has exact job ID `state_writer`. +Because GitHub OIDC has no step-ID claim and `id-token: write` is job-scoped, the entire reusable +job is the credential boundary: it contains only GitHub's OIDC bootstrap and one fixed, +hash-pinned, argument-closed broker client, with no checkout, generated command, caller script, or +caller-controlled action before or after it. `state-cas` is a reviewed YAML step ID, not an OIDC +identity claim. The broker binds `check_run_id` to that reusable job through the GitHub API and +performs the expected-OID CAS itself; no installation token is returned to any Actions step. + +`` has exactly one of two forms selected by the caller row: the campaign's exact +protected input tag `refs/tags/`, with `ref_type=tag`, `sha=C0`, and both +workflow SHA claims equal to C0; or exact `refs/heads/main`, with `ref_type=branch`, `sha` and both +workflow SHA claims equal to the dispatch's current main commit. Except for the six ordinary +post-merge admission events, the emergency exposure rows, the closed initial-release receipt append, +and four current-main containment classes enumerated immediately below, that main commit must be the single SHA already bound by the +applicable audit, analysis, collection, publication, release, dismissal, or correction plan. For +every main run the broker reads both workflow members at that commit and requires their bytes to +equal the corresponding C0-derived member hashes in the common workflow root. All caller rows require +`event_name=workflow_dispatch`; a reusable `workflow_call` is the mechanism of the called job, not +the triggering event reported by these OIDC tokens. The closed caller/ref/event mapping is: + +The only plan-SHA exceptions beyond those six are four current-main classes: drift containment; +publication terminal-containment start/barrier/finality; +the exact credential-exposure pending/progress/phase-terminal/supplement rows below; and safe-invalid +continuation for any already sealed STOP or BUDGET lineage. Each uses fresh current `H`, +double-reads refs/policy, authenticates the run, and requires caller and reusable workflow blobs at +`H` to byte-equal their sealed C0 workflow-root members. They authorize no other main-ref event. + +For publication containment, the authenticated start run's `sha` is the intent-bound +`containment_main_oid` baseline and its workflow bytes/root are frozen in the accepted event. +Post-CAS work may continue in that run or a fresh protected-current-main resumption run. Every +later mint binds the accepted containment authority OID/root plus that run's authenticated current +main SHA; when it differs from the baseline, the broker first constructs the exact signed +`PublicationContainmentMainAdvanceProofV1` from baseline to current main. Thus OIDC never pretends +the original run SHA moved, while a safe first-parent descendant with byte-identical frozen +workflow members remains live. Force-push, unrelated workflow bytes, an affected intervening merge, +or a failed compare denies mint and leaves the containment root resumable. + +Reachability of those classes is conditional on an enforced main-liveness invariant. While any +campaign is nonterminal, the existing protected-main validation check rejects a merge that changes, +deletes, or renames any of the 15 C0-frozen workflow members or changes their ordered root; the +existing state-writer App also refuses authority after such a merge. The check itself runs from +protected current main, compares the proposed tree to the sealed campaign registry/root, and needs +no tag trigger, so this introduces no circular dependency and no new workflow, App, environment, or +secret. Each fallback still verifies current bytes. A platform administrator can bypass/disable +GitHub protection; that is an explicit trust limitation, and “reachable from every state” means +only while this invariant is enforced. + +| Caller workflow | Required triggering ref | Allowed event types | +|---|---|---| +| `benchmark-preflight.yml` | exact campaign input tag | `PREFLIGHT_SEALED` | +| `benchmark-batch.yml` | exact campaign input tag | `BATCH_RECEIPT_CONSUMED`, `NO_DISPATCH_PROVED`, `VERIFIED_PARTIAL`, `GENERATION_SET_SEALED`, `JUDGE_SET_SEALED`, `PERMANENT_STOP`, `BUDGET_EXHAUSTED`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-hard-score.yml` | exact campaign input tag | `HARD_SCORE_SET_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-evidence.yml` | exact campaign input tag; protected current `main` only for drift containment, the exact cross-phase exposure rows, terminal-invalid supplements, or safe-invalid continuation | `EVIDENCE_INVENTORY_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`; on main, only the phase-exact containment/supplement or drift event is allowed | +| `benchmark-audit.yml` | exact plan-bound `main` | `AUDIT_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-analysis.yml` | exact plan-bound `main` | `ANALYSIS_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-collect-complete.yml` | exact plan-bound `main` | `COMPLETE_BUNDLE_SEALED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-finalize-invalid.yml` | exact campaign input tag or protected current `main` under the safe-invalid exception | `INVALID_PREFIX_SEALED` | +| `benchmark-dismiss-hold.yml` | exact plan-bound `main` | `INVALID_EVENT_DISMISSED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` | +| `benchmark-publish.yml` | exact plan-bound `main`; protected current `main` additionally for its exact post-merge admission, publication terminal-containment, exposure, and drift rows | `PUBLICATION_INTENT_AUTHORIZED`, `PUBLICATION_TERMINAL_CONTAINMENT_STARTED`, `COMPLETE_PUBLICATION_PR_OPENED`, `INVALID_PUBLICATION_PR_OPENED`, `COMPLETE_PUBLICATION_PLAN_INVALIDATED`, `INVALID_PUBLICATION_PLAN_INVALIDATED`, `RESULT_MERGED`, `RESULT_MERGE_INVALIDATED`, `INVALID_PREFIX_MERGED`, `INVALID_PREFIX_MERGE_INVALIDATED`, `PERMANENT_STOP`, `CREDENTIAL_EXPOSURE_PENDING`, `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`, `CORRECTION_INTENT_AUTHORIZED`, `CORRECTION_PUBLICATION_RECORDED`, `CORRECTION_MERGE_RECORDED`, all four typed publication `CORRECTION_INVALIDATED` outcomes (`unmerged_invalid`, `merged_invalid`, `fenced_write_ambiguity`, `reconciliation_unavailable`); credential authority is limited to complete/invalid PR handling, publication containment, bare release-blocked/released correction start, and pre-merge correction prefixes; separately, only the closed `initial_publication_receipt_append` non-event mutation | +| `benchmark-release.yml` | exact plan-bound `main`; protected current `main` additionally for its exact post-merge exposure and drift rows | `RESULT_RELEASE_INTENT_AUTHORIZED`, `RESULT_RELEASED`, `RELEASE_PLAN_INVALIDATED`, `CORRECTION_TAG_RECORDED`, `CORRECTION_RELEASE_RECORDED`, `CORRECTION_RESULT_RELEASED`, `CORRECTION_INVALIDATED(kind=correction_release_invalidation)`, `CREDENTIAL_EXPOSURE_PENDING`, and `CREDENTIAL_EXPOSURE_EFFECT_RECORDED`; separately, only the closed `initial_release_receipt_append` non-event mutation | + +`RESULT_MERGED`, `INVALID_PREFIX_MERGED`, and `CORRECTION_MERGE_RECORDED` are the only successful +post-merge admissions. `RESULT_MERGE_INVALIDATED` and `INVALID_PREFIX_MERGE_INVALIDATED` are the +only ordinary-publication failed-admission records. The exact +`CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=merged_invalid)` event is the only correction failed-admission record. Those +six events are the only ordinary admission-specific post-merge main exceptions. Emergency +credential pending/progress and the phase-exact consumers above are separate closed containment +exceptions and cannot authorize successful admission. Their pre-merge plan cannot and +must not claim to know +the eventual merge commit SHA or GitHub-assigned PR number. Instead it binds a deterministic exact +marker, branch/base/head, title/body bytes, protected base ref and base OID, approved head OID, +sealed bundle/result-path roots, deterministic expected merge tree, v1 merge +method `merge_commit`, ordered expected parents `[base_oid, head_oid]`, required-check names and +conclusions, approval/review policy, allowed human merge actor IDs, branch/ruleset digest, and the +permitted current-main containment rule. Only after create-or-adopt discovery does the strict +`PublicationPRReceiptV1` bind the platform-assigned number, node ID, URL, and exact marker/base/head; +post-merge evidence binds that accepted receipt, or the same exact-marker discovery when response +loss prevented its receipt CAS. A caller-supplied, predicted, or pre-intent PR number is forbidden. + +After merge, the broker independently constructs `PostMergeAdmissionEvidenceV1` from GitHub and Git +objects, not event input. It proves the PR is merged, its immutable base/head match the plan, the +observed merge commit `M` is the PR's merge commit, `M` has exactly the two ordered parents and +expected tree, all plan-bound checks and approvals applied to the exact head, the merge actor and +method are allowed, and historical protection was enforced. A PR's pre-merge test +`merge_commit_sha` is never accepted as `M`. Historical enforcement requires the +downscoped security-attestor job to fetch the exact repository rule-suite record whose +`before_sha=base_oid`, `after_sha=M`, `ref=refs/heads/main`, actor equals the merge actor, overall +result is `pass` rather than `bypass`, and per-rule active evaluations match the plan-bound ruleset; +reading only current branch rules is insufficient. The attestor persists the complete canonical +suite response immediately because GitHub retains rule-suite history only for a bounded period; +missing late evidence fails closed. The OIDC `ref` remains `refs/heads/main`; its +`sha=workflow_sha=job_workflow_sha=H`, where current main `H` must equal `M` or be a protected +first-parent descendant that contains `M`, leaves the plan-bound result subtree byte-identical to +`M`, and has no intervening commit touching that subtree. The caller and reusable workflow blobs at +`H` must still equal their C0 inventory members. The evidence binds `M`, `H`, PR/base/head, parent +list, tree/result roots, checks, approvals, merge actor/method, branch-protection/ruleset receipts, +exact rule-suite ID/evaluations, GitHub request IDs, and its own digest. Because these GitHub and Git +reads are not a multi-endpoint snapshot, the broker double-reads current main and recomputes +containment after collecting the other evidence; incompatible intervening movement fails closed. +Missing or contradictory +API/Git evidence, absent/bypassed rule-suite evidence, a rebase/squash, changed result subtree, or +noncontained merge is denied. + +The aggregates used for publication finality are closed wire records. +`PublicationEligibilityDeliveryResolutionSetV1` has exactly `schema_version`, the same campaign/ +registry/publication/attempt/correction/bundle/plan/intent identity, ordered `entries`, and +`eligibility_delivery_resolution_set_sha256`. Each entry has exactly `head_oid` and one class-bound +`eligibility_delivery_resolution_sha256`; entries are complete, sorted by ascending unique head, +and the explicit empty array is allowed only when the credential ledger proves no eligibility token +or dispatch. Its domain is `laconian-publication-eligibility-delivery-resolution-set-v1\n`, omitting +only its final digest. + +`ReleaseAuthorizationLedgerEntryV1` has exactly `schema_version`, nested exact +`scope_identity: BrokerVaultScopeIdentityV1(scope_kind="publication")`, +`scope_identity_sha256`, positive gapless `entry_ordinal`, nullable +`predecessor_entry_sha256`, `entry_kind="release_intent_authorized"|"token_request_started"| +"token_request_terminal"|"effect_dispatch_started"|"effect_dispatch_terminal"`, nullable +`release_intent_sha256`, `source_receipt_sha256`, `occurred_at`, and `entry_sha256`. The hash chain, +source-receipt type, start/terminal pairing and time equalities use the exact release-broker +receipts; an intent is nonnull from authorization onward. Its domain is +`laconian-release-authorization-ledger-entry-v1\n`, omitting only its final digest. +`PublicationReleaseAuthorizationLedgerSnapshotV1` has exactly `schema_version`, the same nested +publication scope/digest, ordered nested exact `entries`, nonnegative +`authorized_release_intent_count`, nonnegative `release_write_token_mint_count`, nonnegative +`release_effect_dispatch_count`, `outstanding_request_or_dispatch_count=0`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="release_finalizer")`, +`broker_signature_base64url`, `observed_at`, and `release_authorization_ledger_root_sha256`. Counts +are recomputed from the complete append-only entry array; for publication terminal reconciliation +the exact valid snapshot is an empty entry array and three zeros. The signature/key/validity checks +are the same strict checks as `BrokerVaultAuditLogV1`; its signature and record domains are +`laconian-publication-release-authorization-ledger-snapshot-signature-v1\n` and +`laconian-publication-release-authorization-ledger-snapshot-v1\n`. + +`PublicationReleaseInventoryPageReceiptV1` has exactly `schema_version`, the full publication +identity, `repository_id`, `operation_kind="terminal_reconciliation_read"`, +`operation_idempotency_key`, positive `credential_attempt_ordinal`, +positive `operation_request_ordinal`, `publisher_credential_subject_sha256`, +`reconciliation_round=1|2`, +`page_kind="tag_ref"|"annotated_tag_object"|"release_page"|"asset_page"`, nullable positive +`release_id`, positive `page_ordinal`, `query_template`, `request_url`, `request_id`, +`request_dispatched_at`, `response_completed_at`, `transport_terminal_at`, +`api_version="2022-11-28"`, `accept_header="application/vnd.github+json"`, +`authentication_kind="publisher_app_installation_token_vault"`, `response_status=200|404`, +nullable `previous_link`, nullable `next_link`, ordered nested exact `objects`, +`raw_response_sha256`, `canonical_response_sha256`, nested exact +`broker_signing_identity: BrokerSigningIdentityV1(signing_key.broker_role="publisher")`, +`broker_signature_base64url`, and `inventory_page_receipt_sha256`. Each object has exactly +`object_kind="tag_ref"|"annotated_tag_object"|"release"|"asset"`, `object_id`, nullable +`object_type`, nullable `target_oid`, nullable `tag_name`, nullable `release_id`, nullable +`asset_name`, nullable `asset_size`, nullable `asset_digest`, nullable `actor_id`, nullable `draft`, +nullable `prerelease`, nullable `published_at`, and `canonical_member_sha256`; nullability is the +literal GitHub object-kind projection. Page domains and signatures use +`laconian-publication-release-inventory-page-{receipt|signature}-v1\n`. + +Tag ref/object reads are single page-one GETs with null Links and exact 200/404 semantics. Release +and asset lists use `per_page=100`, signed GitHub Link chaining, gapless pages and complete stable +cardinality. Every present tag ref is recursively dereferenced through exact `/git/tags/{tag_oid}` +responses until a commit is reached; cycles, missing targets or more than sixteen tag objects fail +closed. The expected result tag must resolve through exactly one annotated tag object when claimed. +Release pages inventory every release; asset pages inventory every asset for every release, not only +a same-name match. Concrete owner/repo and all App/policy/token/request chronology equal the +reconciliation credential subject and generic publisher operation wrapper. Each wrapper has outcome +`read_200|read_404`, source-observation digest equal to this page digest, and exact matching request, +status and times. + +`PublicationReleaseInventoryObservationV1` has exactly `schema_version`, the same full identity, +`repository_id`, `operation_idempotency_key`, positive `credential_attempt_ordinal`, +`publisher_credential_subject_sha256`, `reconciliation_round=1|2`, `expected_tag_name`, +`expected_release_name`, ordered nested exact +`page_receipts: PublicationReleaseInventoryPageReceiptV1`, ordered `archive_blobs`, ordered +`tag_ref_and_object_projections`, ordered `release_projections`, ordered `asset_projections`, +`pagination_complete=true`, `archive_complete=true`, ordered `observed_name_conflicts`, +`observed_at`, and `release_inventory_observation_sha256`. Each archive blob has exactly `path`, +`sha256`, and `raw_bytes_base64`; paths are keyed by page digest and decoded bytes reproduce every +page's raw body hash in a bijection. Projections are complete, unique and canonically sorted; each +conflict has exactly `object_kind="tag_object"|"tag_ref"|"release"|"asset"`, `object_id`, +`observed_object_root_sha256`, nullable `actor_id`, and the exact containing page/member digest. +Its domain is `laconian-publication-release-inventory-observation-v1\n`, omitting only its final +digest. + +`PublicationReleaseAuthorizationLedgerObservationV1` has exactly `schema_version`, the same +identity, nested exact +`authorization_ledger_snapshot: PublicationReleaseAuthorizationLedgerSnapshotV1`, +`release_authorization_ledger_root_sha256`, nested exact +`release_inventory_observation: PublicationReleaseInventoryObservationV1`, +`authorized_release_intent_count=0`, `release_write_token_mint_count=0`, +`release_effect_dispatch_count=0`, ordered `observed_name_conflicts`, +`observed_at`, and `release_authorization_ledger_observation_sha256`. Each conflict entry has exactly +`object_kind="tag_object"|"tag_ref"|"release"|"asset"`, `object_id`, +`observed_object_root_sha256`, nullable `actor_id`, and `source_observation_sha256`, sorted by kind +then canonical object ID. The three zeros and conflict array are exact projections of the nested +signed ledger snapshot and complete external inventory; every conflict source digest is the nested +inventory's exact page/member digest. Foreign or preexisting same-name objects are retained here; +physical emptiness is neither claimed nor required. Its domain is +`laconian-publication-release-authorization-ledger-observation-v1\n`, omitting only its final +digest. + +`PublicationLatestPointerObservationV1` has exactly `schema_version`, the same identity, +`repository_id`, `latest_pointer_path`, `expected_state="absent"|"exact"`, +`observed_state="absent"|"exact"`, nullable `expected_pointer_root_sha256`, nullable +`observed_pointer_root_sha256`, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/contents/{latest_pointer_path}"`, +`response_status`, `request_receipt_sha256`, `observed_at`, and +`latest_pointer_observation_sha256`. Expected and observed states byte-equal. `absent` requires two +null roots and authenticated 404; `exact` requires authenticated 200 and two equal nonnull roots +matching the predecessor authority's exact pointer bytes. Its domain is +`laconian-publication-latest-pointer-observation-v1\n`, omitting only its final digest. + +`PublicationCanonicalExternalStateV1` has exactly `schema_version`, the same full publication +identity, `authority_parent_oid`, `authority_phase`, nested exact `branch_state`, ordered nested +exact `pull_request_states`, nested exact `check_state`, nested exact +`release_authorization_state`, nested exact `latest_pointer_state`, and +`canonical_publication_external_state_sha256`. `branch_state` has exactly `branch_name`, +`expected_head_oid`, `status="absent"|"exact"|"conflicting"`, and nullable `observed_head_oid`. +Each PR state has exactly the complete marker projection's number/node/url/actor/base/head/state/ +merged/merge-OID/closed/merged-time fields in ascending PR-number order. `check_state` has exactly +`set_kind`, nullable `no_guard_reason`, ordered `guarded_head_oids`, and ordered nested exact +`semantic_snapshots: PublicationCheckRunsSemanticSnapshotV1` in head order. +`release_authorization_state` has exactly the three authorization/mint/dispatch counts and the +complete canonically ordered conflict tuples; `latest_pointer_state` has exactly expected/observed +state and pointer roots. Every member is a total deterministic projection of the corresponding five +nested source observations; raw/canonical response hashes, request IDs, credentials, pagination, +signatures and observation/probe times alone are excluded. Its domain is +`laconian-publication-canonical-external-state-v1\n`, omitting only its final digest. A free scalar +digest without this nested recomputable projection is invalid. + +`PublicationTerminalReconciliationObservationV1` has exactly `schema_version`, the same identity, +`authority_parent_oid`, `authority_phase`, `reconciliation_round=1|2`, nested exact +`final_branch_observation: PublicationBranchObservationV1`, nested exact +`final_pr_marker_observation: PublicationPRMarkerObservationV1`, nested exact +`final_check_runs_observation_set: PublicationFinalCheckRunsObservationSetV1`, nested exact +`release_authorization_ledger_observation: PublicationReleaseAuthorizationLedgerObservationV1`, +nested exact `latest_pointer_observation: PublicationLatestPointerObservationV1`, +`canonical_external_state: PublicationCanonicalExternalStateV1`, +`canonical_publication_external_state_sha256`, +`outstanding_publisher_write_dispatch_count=0`, `live_publisher_write_token_count=0`, +`broker_phase="terminal_reconciling"`, `observed_at`, and +`reconciliation_observation_sha256`. The no-guard check set derives its absent-branch/zero-marker +proof from these exact nested observations; a `guarded_reconciliation` set names the separate +historical object in `PublicationTerminalGuardSetV1.final_check_runs_observation_set_sha256` and +matches only its stable semantics through fresh reconciliation pages; and a merge-observed set +derives its selected merged head and absence of unmerged candidates from the exact marker/PR reads. +The nested canonical state is the exact projection of all five source components and its duplicated +digest recomputes. This record's `reconciliation_round` equals every generic operation wrapper +`observation_round`, every release-inventory page `reconciliation_round`, and every nested check +observation/page plus marker observation/page `observation_round`; the differently named +fields are literal and never substituted. Only PR-create delivery resolution nests the two-round +`PublicationPRMarkerDiscoveryV1`; terminal reconciliation never nests that aggregate. +`observed_at` is the latest nested authenticated time. Its domain is +`laconian-publication-terminal-reconciliation-observation-v1\n`, omitting only its final digest. + +`PublicationNoLaterEffectsEvidenceV1` is the exact no-later root used by initial publication +terminal records and failed admission. It has exactly `schema_version`, the same identity, +`source_authority_parent_oid`, `terminal_authority_parent_oid`, `authority_phase`, nested exact +`terminal_containment_finality: PublicationTerminalContainmentFinalityV1( +finality_kind="ordinary_premerge"|"ordinary_merge_won")`, `terminal_containment_finality_sha256`, +`terminal_containment_intent_sha256`, +`containment_authority_mutation_receipt_sha256`, `containment_authority_oid`, +`successor_merge_denylist_root_sha256`, `terminal_merge_barrier_sha256`, nested exact +`publication_pr_terminal_disposition: PublicationPRTerminalDispositionV1`, +`branch_create_delivery_resolution_sha256`, `pr_create_delivery_resolution_sha256`, nested exact +`eligibility_delivery_resolution_set: PublicationEligibilityDeliveryResolutionSetV1`, nullable +`terminal_guard_set_sha256`, nullable `close_delivery_resolution_sha256`, nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1`, nested exact +`first_reconciliation_observation: PublicationTerminalReconciliationObservationV1`, nested exact +`second_reconciliation_observation: PublicationTerminalReconciliationObservationV1`, +`outstanding_dispatch_count=0`, `live_installation_token_count=0`, `observed_at`, and +`no_later_effects_root_sha256`. + +For premerge, the nested disposition is the finality's exact `no_pr|closed` source. For merge-won, +the finality source remains its original `no_pr|closed` disposition while the no-later nested +disposition is the independently reconstructed exact `already_merged` member of merge-won +evidence. Every duplicated +intent/CAS/denylist/barrier root recomputes; source parent appears only through the intent, while the +terminal parent equals the current containment authority or a preserving descendant. The barrier +completes before terminal reconciliation begins, and the disposition set's barrier/subset pair +equals it. Both reconciliation observations occur after every possibly delivered branch/PR/check/close write +is classified and after the broker has entered `terminal_reconciling`; their branch, marker, check, +release-ledger and latest-pointer semantic projections hash to the same +`canonical_publication_external_state_sha256`, while their request receipts/times remain distinct +and ordered first before second. The first record and every nested request have round one; the +second have round two. Every round-one request terminal precedes the first round-two dispatch. The unique read-only reconciliation token +is then closed, the broker advances to `sealed`, and the credential set is constructed with zero +live tokens. Its operation and final-observation projections bind both reads. The second observation +supplies the final semantic state and read time; no write-capable token exists during either read +and no token can be minted after sealing. No-later `observed_at` equals the credential disposition +set's authenticated sealed/closure +time, which is not before the second read. All duplicated resolution, disposition, guard, close and identity roots equal the +enclosing record; nullability follows its exact phase/outcome. Foreign release objects may remain +inventoried, but zero protocol authorization, token mint, and dispatch proves no release effect was +caused by this lineage. Its digest is +`SHA256(UTF8("laconian-publication-no-later-effects-evidence-v1\n") || CanonicalJSONV1(record +without exactly no_later_effects_root_sha256))`. +This record requires `publisher_credential_disposition_set.finality_status="stable_read_sealed"`, +a null reconciliation-unavailable receipt and the exact named successful read disposition; the +unavailable branch cannot satisfy its schema. + +Successful merge admission closes the same publisher broker before any release authorization. +`PublicationSuccessFinalityEvidenceV1` has exactly `schema_version`, the same full identity, +`authority_parent_oid`, `publication_receipt_kind="initial_pr_receipt"| +"correction_publication_receipt"|"discovery_only"`, nullable `publication_pr_receipt_sha256`, +`pr_create_delivery_resolution_sha256`, `pr_marker_discovery_sha256`, positive +`pull_request_number`, `pull_request_node_id`, `pull_request_url`, `observed_merge_commit_oid`, nested exact +`publisher_credential_disposition_set: PublisherCredentialDispositionSetV1`, nested exact +`first_reconciliation_observation: PublicationTerminalReconciliationObservationV1`, nested exact +`second_reconciliation_observation: PublicationTerminalReconciliationObservationV1`, +`outstanding_dispatch_count=0`, `live_installation_token_count=0`, `observed_at`, and +`success_finality_root_sha256`. Both observations use `set_kind=merge_observed`, name the same exact +merged PR/head/commit, have `publisher_context_state=all_success` with one sole check-run ID, prove +zero release authorization/mint/dispatch, and have equal canonical external state but distinct +ordered authenticated reads. After the second read, the reconciliation token closes and the +complete disposition set advances the broker to `sealed` with zero live tokens; every denied, +permission-mismatched, or retried credential attempt remains inventoried. `observed_at` equals the +set's sealed/closure time and is not before the second read. Its domain is +`laconian-publication-success-finality-evidence-v1\n`, omitting only its final digest. +The disposition set has `finality_status="stable_read_sealed"`, a null unavailable receipt and the +nonnull selected reconciliation-read disposition; unavailable finality cannot satisfy success. +The receipt hash is nonnull exactly for its two receipt kinds and null for `discovery_only`; the +delivery resolution, marker discovery and selected PR identity are always nonnull and byte-equal +the same fields in `PostMergeAdmissionEvidenceV1`, so response/CAS loss cannot make success +finality unconstructible. + +`PostMergeAdmissionEvidenceV1` has exactly `schema_version`, `campaign_id`, +`campaign_registry_sha256`, `repository_id`, `intent_kind="initial"|"correction"`, +`publication_id`, nullable `publication_attempt`, nullable `correction_id`, `authority_parent_oid`, +`authority_phase`, `publication_plan_sha256`, `bundle_kind`, `sealed_root_sha256`, +`publication_receipt_kind`, nullable `publication_pr_receipt_sha256`, +`pr_create_delivery_resolution_sha256`, `pr_marker_discovery_sha256`, nested exact +`postmerge_admission_subject: PostMergeAdmissionSubjectV1`, +`postmerge_admission_subject_sha256`, nested exact +`security_attestor_receipt: SecurityAttestorReceiptV1(attestation_purpose="postmerge_rule_suite")`, +`security_attestor_receipt_sha256`, `checks_approvals_root_sha256`, +`github_git_request_receipts_root_sha256`, nested exact +`publication_success_finality: PublicationSuccessFinalityEvidenceV1`, +`publication_success_finality_root_sha256`, `recorded_at`, and +`post_merge_admission_evidence_sha256`. Initial/correction XOR identity follows the publication +plan. Every PR/base/head/M/tree/current-main/actor/time field in the plan, PR discovery, subject, +attestor record and success finality byte-equals; the attestor operation key commits the subject +root and has null admitted-merge receipt. Checks/approval and request roots are exact digest +projections of those nested records. `recorded_at` is the latest nested authenticated/sealed time. +Its domain is `laconian-post-merge-admission-evidence-v1\n`, omitting only its final digest. + +`PublicationMergeReceiptV1` has exactly `schema_version`, the same campaign/repository and +initial/correction XOR identity, `authority_parent_oid`, `publication_plan_sha256`, +`publication_receipt_kind`, nullable `publication_pr_receipt_sha256`, positive +`pull_request_number`, `pull_request_node_id`, `pull_request_url`, `observed_merge_commit_oid`, +`observed_head_oid`, `observed_base_oid`, nested exact +`post_merge_admission_evidence: PostMergeAdmissionEvidenceV1`, +`post_merge_admission_evidence_sha256`, `publication_success_finality_root_sha256`, `recorded_at`, +and `publication_merge_receipt_sha256`. Every duplicated field/root byte-equals the nested evidence; +`recorded_at` equals it, and the receipt domain is `laconian-publication-merge-receipt-v1\n`, +omitting only its final digest. Initial `merge-receipt.json` and correction +`corrections//merge-receipt.json` are exactly this schema; no other merge-receipt +grammar is admissible. + +Every successful `PostMergeAdmissionEvidenceV1` and accepted initial or correction merge receipt +contains `publication_success_finality_root_sha256` equal to this exact object. No initial release +preauthorization, correction tag authorization, or successful publication finalization may occur +until that root reconstructs against the admitted `M`; this field is part of the merge evidence, +not a caller-supplied later annotation. + +`PostMergeAdmissionFailureV1` is the only failed-admission schema. Its exact ordered fields are: + +```text +schema_version +campaign_id +campaign_registry_sha256 +publication_id +publication_attempt +correction_id +source_kind +source_authority_parent_oid +authority_parent_oid +authority_phase +publication_plan_sha256 +bundle_kind +sealed_root_sha256 +publication_receipt_kind +publication_pr_receipt_sha256 +pr_create_delivery_resolution_sha256 +pr_marker_discovery_sha256 +pull_request_number +pull_request_node_id +pull_request_url +pull_request_marker +pull_request_actor +expected_base_oid +expected_head_oid +observed_base_oid +observed_head_oid +observed_merge_oid +current_main_oid +observed_parent_oids +observed_tree_oid +observed_result_root_sha256 +merge_actor +merge_method +checks_approvals_root_sha256 +rule_suite_observation_root_sha256 +github_git_request_receipts_root_sha256 +postmerge_security_result +postmerge_admission_subject +postmerge_admission_subject_sha256 +security_attestor_receipt +security_attestor_receipt_sha256 +security_attestor_failure_evidence +security_attestor_failure_evidence_sha256 +failure_kind +terminal_containment_finality +terminal_containment_finality_sha256 +successor_merge_denylist_root_sha256 +active_publication_terminal_containment_root_before +active_publication_terminal_containment_root_after +selected_merged_candidate_sha256 +publisher_credential_disposition_set +publisher_credential_disposition_set_sha256 +reconciliation_unavailable_receipt +reconciliation_unavailable_receipt_sha256 +release_authorization_ledger_root_sha256 +release_authorization_ledger_snapshot +publication_pr_terminal_disposition +protocol_authority_drift_evidence +terminal_exposure_consumption +failed_predicates +no_later_effects_root_sha256 +recorded_at +post_merge_admission_failure_sha256 +``` + +`schema_version` is exactly `PostMergeAdmissionFailureV1`. Campaign, registry, publication, plan, +bundle, sealed-root, expected base, and expected head values byte-equal reconstructed authority. +`source_kind` is exactly `normal_postmerge_admission|ordinary_terminal_disposition|write_ambiguity`. +For either containment source the source parent is the intent's pre-containment parent and +`authority_parent_oid` is the current accepted containment parent or a preserving descendant. For +normal postmerge admission the source parent equals the immediate parent and every containment +field is null. `authority_phase` is one of the exact +initial/correction publication phases admitted by the terminal-disposition schema. `correction_id` is +null for either initial bundle, where `publication_attempt` is a positive canonical integer; for a +correction `publication_attempt` is null and `correction_id` is the exact nonempty active ID. A +correction requires `bundle_kind=complete`. `publication_receipt_kind` is exactly +`initial_pr_receipt`, `correction_publication_receipt`, or `discovery_only`. +`publication_pr_receipt_sha256` is nonnull exactly for the first two ordinary kinds and names the +accepted exact authority receipt; it is null for response-loss/pre-receipt discovery and may also +be null for `source_kind=write_ambiguity`. PR create-delivery and marker-discovery roots are +nonnull for ordinary source; ambiguity source may leave either null only when the selected merged +PR is independently authenticated by the containment preflight/inventory/timeline chain. An accepted +receipt embeds the same roots. `pull_request_number` is a positive canonical integer; node ID, URL, +and marker are exact authenticated identities, +and the three merge/current OIDs are lowercase 40-hex Git OIDs. `observed_parent_oids` is the exact +Git-order array of zero through 64 observed OIDs, so an unexpected parent count remains recordable. +`observed_tree_oid` is a Git OID or null; `observed_result_root_sha256` is lowercase SHA-256 or +null. Either nullable observation may be null only with `observation_inconsistent` or +`result_tree_mismatch` as applicable and an authenticated missing/inconsistent observation in the +request-receipt root. +The selected top-level PR is deterministic: ascending `(merged_at,pull_request_number,node_id)` +over the complete nonempty merged-candidate array, and `selected_merged_candidate_sha256` names that +exact first member. The nested containment finality preserves every other merged candidate and +conflicting object; selection never discards one. + +`postmerge_security_result` is exactly `not_run|pass|failure`. `not_run` requires all six nullable +subject/attestor fields null and is permitted only when a preceding structural/identity predicate +made an attestor call unauthorized. `pass` requires a nonnull exact +`PostMergeAdmissionSubjectV1`, its duplicated digest, a nonnull exact postmerge +`SecurityAttestorReceiptV1`, its digest, and null failure fields; it is used when a later drift or +containment predicate fails. `failure` requires the same exact subject plus nonnull +`SecurityAttestorFailureEvidenceV1`/digest and null pass fields. Subject M/base/head/tree/actor and +operation key byte-equal the failure observations. No attestor record for another subject, purpose, +repository or publication can enter failed admission. + +`pull_request_actor` has exactly `observation_status`, nullable `account_id`, nullable `login`, +nullable `api_type`, and `source_receipt_sha256`. Status is `observed`, `missing`, or `inconsistent`; +the identity triple is nonnull exactly for observed. Expected base/head always equal the plan, +while observed base/head always preserve the authenticated PR and may differ. A bound PR has the +registered publisher actor and equal OIDs; deviations are recordable only with their predicates. + +`merge_actor` has exactly `observation_status`, nullable `account_id`, nullable `login`, nullable +`api_type`, and +`source_receipt_sha256`. Status is `observed`, `missing`, or `inconsistent`; the identity triple is +nonnull exactly for `observed`, with a positive account ID and bounded nonblank strings. A +successful admission separately requires the strict human projection; this failure object can +therefore faithfully record a bot, App, unknown API type, or missing actor. `merge_method` is +exactly `merge_commit`, `squash`, `rebase`, or `unknown_or_inconsistent`. The checks/approvals, +rule-suite and GitHub/Git-request fields are nonnull SHA-256 roots of complete canonical +observations, including explicit missing/denied observations rather than omitted keys. For +ordinary/drift/exposure failure sourced from an ordinary disposition, the no-later root is nonnull and exactly +`PublicationNoLaterEffectsEvidenceV1` for this identity/phase; both unavailable objects and their +duplicated digests are null, and `recorded_at` byte-equals no-later `observed_at`. For +reconciliation-unavailable failure, the nested exact `PublisherCredentialDispositionSetV1( +finality_status="reconciliation_unavailable_sealed")` and its exact unavailable receipt plus +duplicated digests are nonnull, the release-authorization root equals the receipt's exact signed +empty ledger, the no-later root is null, and `recorded_at` equals the unavailable receipt/set/ +publisher-ledger/vault-log/release-ledger authenticated sealed time. The release-ledger root is null +for every other failure kind. Retry clocks cannot change either form's digest. +For `source_kind=normal_postmerge_admission`, the disposition, no-later and every containment/fence +field are null; `recorded_at` is the deterministic maximum authenticated source time across +`merged_at`, the complete GitHub/Git request-receipt set and the nonnull postmerge security +pass/failure evidence when present. It is never a retry or local-clock time. + +`failure_kind` is exactly `ordinary`, `protocol_authority_drift_race`, +`credential_exposure_race`, `reconciliation_unavailable`, or +`publication_write_ambiguity_merge_race`. +`normal_postmerge_admission` forbids the last failure kind and has every containment/fence field +null. `ordinary_terminal_disposition` requires nested exact +`PublicationTerminalContainmentFinalityV1(finality_kind="ordinary_merge_won")`, its digest, +successor denylist, before root equal to the intent digest and after root null; the immediate/source +parents follow that finality, and the terminal CAS preserves the denylist and clears the active +root. `write_ambiguity` is legal only with +`failure_kind=publication_write_ambiguity_merge_race`, nested exact +`PublicationTerminalContainmentFinalityV1(finality_kind="write_ambiguity_merge_won")`, a null +ordinary disposition and null no-later root. Its publisher set is +`write_ambiguity_fenced_sealed`; the nested exact release-authorization snapshot and root have an +empty entry array and zero authorization/mint/dispatch counts. Every ordinary delivery/receipt root +that could not be constructed is null only in this branch, with the selected merged PR instead +authenticated by finality. No branch may clear containment without the finality object. +Reconciliation-unavailable also nests the exact empty snapshot from its receipt. Every other branch +has both release-ledger fields null; a bare root is never accepted. +`publication_pr_terminal_disposition` is either null or the exact +nested `PublicationPRTerminalDispositionV1`; when nonnull its outcome is `already_merged`, its +campaign/registry/publication/attempt/correction/plan, PR identity, expected/observed base/head, +delivery/discovery, mismatch-predicate and merge identities equal this failure, and +`failed_predicates` contains exactly one of `publication_close_lost_to_merge` or +`publication_reopened_after_close`. It is required for every ordinary initial or correction merge +that wins an attempted absence/close terminalization under +`source_kind=ordinary_terminal_disposition`, null for ambiguity, and forbidden for every +`source_kind=normal_postmerge_admission`. A close race can never retain the normal source kind. +`protocol_authority_drift_evidence` is null +except for `protocol_authority_drift_race`, where it is the exact nested +`ProtocolAuthorityDriftEvidenceV1` for the same parent/OID and has the same terminal-disposition +root. `terminal_exposure_consumption` is null except for `credential_exposure_race`, where it is +the exact nested `TerminalCredentialExposureConsumptionV1`; any concurrent drift is represented +only by that consumption's incident evidence and not duplicated in the drift field. + +`failed_predicates` is a nonempty deduplicated array in this schema order: +`unexpected_merge_parent`, `unexpected_merge_method`, `pr_identity_mismatch`, +`base_oid_mismatch`, `head_oid_mismatch`, `result_tree_mismatch`, +`checks_or_approvals_invalid`, `merge_actor_invalid`, `historical_rules_invalid`, +`main_containment_invalid`, `workflow_root_mismatch`, `observation_inconsistent`, +`publication_prefix_not_admitted_before_merge`, `publication_close_lost_to_merge`, +`publication_reopened_after_close`, `protocol_authority_drift`, `credential_exposure_race`, +`publication_reconciliation_unavailable`, `publication_write_ambiguity_merge_race`. The +ordinary form forbids the last four predicates and both class-bound +nested emergency objects, requires the active exposure pair null, and may carry an +`already_merged` disposition only with exactly one close-race predicate. Null prior-close receipt +requires `publication_close_lost_to_merge`; nonnull prior-close receipt requires +`publication_reopened_after_close`. Base/head mismatch predicates exactly equal the disposition's +identity-mismatch projection. `publication_prefix_not_admitted_before_merge` is required exactly +for `authority_phase=initial_intent|initial_branch_receipt|initial_pr_receipt|correction_intent` and +proves the missing opened/publication-receipt authority member and event at authenticated merge +time; it is forbidden after admitted initial-opened or correction-publication-receipt authority. +The drift form requires the applicable close-race predicate, +`protocol_authority_drift`, the exact disposition and drift evidence, +and a null active exposure pair. The credential form requires the close-race and credential +predicates, exact disposition and terminal consumption, and atomically consumes the matching +active pair. For an initial complete credential race, the nested incident projects the applicable +`merged_before_close|closed_then_reopened_merged` value and `not_applicable`; for an initial +invalid-prefix race it projects `not_applicable` and the applicable merged value; for a correction both legacy projections are +`not_applicable` while their shared disposition root equals the nested correction-bound record. +Any additional failed predicate must be independently proven. +The reconciliation-unavailable form requires its namesake predicate, the exact sealed unavailable +set/receipt, their exact empty signed release-ledger root, null drift/exposure objects and null +no-later root. It may preserve independently proven +structural predicates, but never claims stable external state, admission or release authority. +The write-ambiguity form requires only its namesake class predicate among the four terminal-class +predicates, exact write-ambiguity merge-won finality, null drift/exposure/disposition/no-later +fields, and the exact empty signed release ledger. Structural predicates remain independently +provable from the selected merge but cannot authorize admission or release. + +Canonical bytes are RFC 8785 JSON over exactly those fields, UTF-8 with no terminal newline. The +digest is +`SHA256(UTF8("laconian-post-merge-admission-failure-v1\n") || CanonicalJSONV1(record without +exactly post_merge_admission_failure_sha256))`. Extra, missing, null-where-forbidden, reordered +arrays, mismatched nested identities, success-consistent evidence, or a future event/successor OID +is rejected. Both initial merge-invalidation events and correction `merged_invalid` bind this +exact evidence root for ordinary/drift/exposure admission failure; their reconciliation-unavailable +forms bind its exact failure-only branch and empty signed release ledger. No generic failure record +exists. + +For the sixth exception, the broker additionally requires the exact active correction ID and +phase-number lineage; authority parent is exactly that correction's `intent.json` or +`publication-receipt.json`, no valid `merge-receipt.json` or later phase record exists, and the +intent-bound expected plan/PR/base/head/sealed-result-tree roots are preserved separately from the +authenticated observed PR fields. Any mismatch emits its exact predicate rather than overwriting +the expected value. It applies the same +observed `M` and current-main `H` semantics, double-read, caller/callee workflow-root checks, and +request receipts as the other five exceptions, then binds `PostMergeAdmissionFailureV1` and exact +no-tag/no-Release/no-asset/no-latest/no-documentation/no-promotion evidence. Admission authorizes +only the typed `CORRECTION_INVALIDATED(kind=correction_publication_invalidation, +publication_outcome=merged_invalid)` authority commit. That commit makes this correction attempt +terminal; only a new correction ID whose intent explicitly supersedes both the failed-correction +root and contaminated `M`/exposure root may continue. The sixth exception cannot authorize a +generic correction invalidation, `unmerged_invalid`, merge receipt, release phase, or any later +effect. + +The corresponding merge event and authority receipt record the observed immutable `M` and current +`H`. A failed-admission event records the same immutable observations and exact closed failed +predicates but cannot manufacture `PostMergeAdmissionEvidenceV1`. If exposure starts while the PR +is open and the merge wins the close race, the broker completes the inventoried containment chain +and admits only the race-form failed event; that one CAS consumes the terminal projection and any +matching hold, clears the active pair, records the contaminated merge, and enters the applicable +release-blocked or correction-terminal path. Response-loss recovery may adopt an already merged PR +only by reconstructing the same evidence; it cannot substitute a new merge. Every other main event +retains the strict pre-bound-main-SHA rule. + +Paths are fully qualified as above; no other member of the 15-path inventory may call the broker. +The broker verifies the run and reusable caller/callee relationship through the GitHub API and +requires `run_id`, `run_attempt`, and `check_run_id` to resolve to the exact reusable job, exact +caller and callee workflow commits, and exact initial-run actor. On a rerun it separately obtains +the REST `triggering_actor` and requires that login/numeric ID to be plan-authorized; no nonexistent +OIDC `triggering_actor` claim is assumed. It also requires the common workflow root, campaign ID, +caller-allowed event type, +`refs/heads/benchmark-authority/` target, and expected current OID in the signed token +request. Ordinary STOP authority is the following literal exhaustive table. A comma-separated +reason cell means precisely those literals, each paired with its matching +`OrdinaryStopEvidenceV1` variant; there is no category expansion or wildcard. Every row uses the +listed ref and exact current parent. + +| Caller | Parent | Ref | Exact reasons | Evidence | +|---|---|---|---|---| +| `benchmark-batch.yml` | `PREFLIGHTED`, `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, or `JUDGE_ACTIVE` | exact T0 | `provider_authentication_failure`, `provider_permission_failure`, `provider_delivery_ambiguity`, `provider_contract_mismatch`, `reservation_ledger_mismatch`, `batch_identity_mismatch`, `artifact_integrity_failure` | matching strict ordinary variant | +| `benchmark-hard-score.yml` | `GENERATION_COMPLETE` | exact T0 | `generation_context_integrity_failure`, `hard_score_integrity_failure`, `artifact_integrity_failure` | matching strict ordinary variant | +| `benchmark-evidence.yml` | `JUDGE_COMPLETE` | exact T0 | `provider_evidence_incomplete`, `artifact_integrity_failure` | matching strict ordinary variant | +| `benchmark-audit.yml` | `PROVIDER_EVIDENCE_VERIFIED` | exact plan-bound `main` | `audit_identity_failure`, `audit_nonparticipation`, `audit_reveal_failure`, `audit_adjudication_failure` | matching strict ordinary variant | +| `benchmark-analysis.yml` | `AUDIT_COMPLETE` | exact plan-bound `main` | `analysis_statistical_failure`, `analysis_provenance_failure`, `analysis_integrity_failure` | matching strict ordinary variant | +| `benchmark-collect-complete.yml` | `ANALYSIS_COMPLETE` | exact plan-bound `main` | `bundle_coverage_failure`, `bundle_lineage_failure` | matching strict ordinary variant | +| `benchmark-publish.yml` | `BUNDLE_COLLECTED` | exact plan-bound `main` | `publication_lineage_failure`, `publication_reconciliation_unavailable` | matching strict ordinary variant; reconciliation-unavailable requires the exact sealed unavailable receipt/set and active prefix with shared `no_pr` or `closed` disposition; ordinary lineage permits null disposition only when no prefix | +| `benchmark-publish.yml` | `COMPLETE_PUBLICATION_PR_OPEN` | exact plan-bound `main` | `publication_lineage_failure`, `publication_reconciliation_unavailable` | matching strict ordinary variant plus exact shared `closed` disposition; unavailable additionally binds the sealed unavailable receipt/set | +| `benchmark-dismiss-hold.yml` | any prepublication parent allowed above | exact plan-bound `main` | `invalid_event_nondismissible` | matching strict ordinary variant citing the one current hold | + +Dismiss-hold has only `invalid_event_nondismissible`; it cannot reclassify a held defect. Every +other ordinary failure named elsewhere maps to one of these literals or is a typed non-STOP +attempt/invalidation outcome. No other predecessor, reason, caller, ref, or evidence union member +exists. + +Those ordinary reason grants do not subsume either no-prior-hold exception. +`protocol_authority_drift` has this literal exhaustive caller/current-parent/ref/reason matrix; +every row requires `reason=protocol_authority_drift`, the exact current authority parent, stable +policy projection, fresh double-read/observation receipts, and `ProtocolAuthorityDriftEvidenceV1`: + +| Drift caller | Exact current parent | Required triggering ref | Closed reason | +|---|---|---|---| +| `benchmark-batch.yml` | `PREFLIGHTED` | exact T0 | `protocol_authority_drift` | +| `benchmark-batch.yml` | `GENERATION_RESUMABLE` | exact T0 | `protocol_authority_drift` | +| `benchmark-batch.yml` | `GENERATION_ACTIVE` | exact T0 | `protocol_authority_drift` | +| `benchmark-hard-score.yml` | `GENERATION_COMPLETE` | exact T0 | `protocol_authority_drift` | +| `benchmark-batch.yml` | `HARD_SCORE_COMPLETE` | exact T0 | `protocol_authority_drift` | +| `benchmark-batch.yml` | `JUDGE_RESUMABLE` | exact T0 | `protocol_authority_drift` | +| `benchmark-batch.yml` | `JUDGE_ACTIVE` | exact T0 | `protocol_authority_drift` | +| `benchmark-evidence.yml` | `JUDGE_COMPLETE` | exact T0 | `protocol_authority_drift` | +| `benchmark-audit.yml` | `PROVIDER_EVIDENCE_VERIFIED` | exact plan-bound `main` | `protocol_authority_drift` | +| `benchmark-analysis.yml` | `AUDIT_COMPLETE` | exact plan-bound `main` | `protocol_authority_drift` | +| `benchmark-collect-complete.yml` | `ANALYSIS_COMPLETE` | exact plan-bound `main` | `protocol_authority_drift` | +| `benchmark-publish.yml` | `BUNDLE_COLLECTED` | exact plan-bound `main` | `protocol_authority_drift`; null disposition when no prefix, otherwise exact shared `no_pr` or `closed` disposition | +| `benchmark-publish.yml` | `COMPLETE_PUBLICATION_PR_OPEN` | exact plan-bound `main` | `protocol_authority_drift`; exact shared `closed` disposition required | + +The table above is the phase-local route when its triggering ref remains runnable. To make moved or +deleted T0/T1 cases reachable, existing `benchmark-evidence.yml` also has a protected-current-main +containment entry for the first 11 parent rows. For every such row its caller is +`benchmark-evidence.yml`, ref is current `refs/heads/main`, reason is only +`protocol_authority_drift`, and evidence is the same parent-specific +`ProtocolAuthorityDriftEvidenceV1`. The two publication rows already run on protected current main +and remain exclusively `benchmark-publish.yml`; they may mint the publisher credential only to +obtain exact `closed`, or use `RESULT_MERGE_INVALIDATED` with +`failure_kind=protocol_authority_drift_race` when discovery yields `already_merged`. The broker +authenticates the actor/run, double-reads current main, +requires the caller and reusable state-CAS workflow bytes at current main to byte-equal their frozen +C0 workflow-root members, independently reconstructs current refs, raw objects, stable policy +projection, sealed binding and registry, and admits only the typed drift STOP CAS for those 11 +fallback rows. It cannot emit a success, ordinary STOP, provider or publisher credential, +publication, release, or restored-ref resume. No fallback caller delegates a publication effect. +Thus deletion of the very tag needed by a local row cannot wedge containment. + +Post-merge drift has this separate exhaustive protected-current-main matrix; each caller and its +reusable broker job must remain byte-identical to frozen C0 and may perform only the listed terminal +route: + +| Drift caller | Exact reconstructed phase | Allowed event only | +|---|---|---| +| `benchmark-release.yml` | `RESULT_MERGED`, before or after initial release intent | `RELEASE_PLAN_INVALIDATED` with exact drift evidence and no exposure consumer | +| `benchmark-publish.yml` | bare `RELEASE_BLOCKED` or bare `RELEASED` | drift-typed `CORRECTION_INTENT_AUTHORIZED` only | +| `benchmark-publish.yml` | active correction `intent.json` or `publication-receipt.json`, before valid merge | publication-family `CORRECTION_INVALIDATED(cause=protocol_authority_drift)` with shared terminal disposition; `already_merged` requires `merged_invalid` | +| `benchmark-release.yml` | active correction at or after valid `merge-receipt.json` | release-family `CORRECTION_INVALIDATED(cause=protocol_authority_drift)` | + +Fresh pair reads may prove drift, so these rows do not require the drifted tag ref to trigger. They +require current protected main, exact parent/phase and null active exposure; grant no STOP, +provider call, successful merge/release, correction promotion, documentation, or social effect. +No other caller, phase, or current-main exception exists. + +No dismiss-hold caller, alternate scanner, other parent/ref/reason, or wildcard may emit drift +STOP. The generated broker matrix contains each local row and its main fallback exactly once. At +`RESULT_MERGED` or later, the same proof authorizes only the existing release invalidation or +correction path. + +After any sealed STOP or `BUDGET_EXHAUSTED`, later pair drift does not wedge safe invalid +publication. Existing `benchmark-finalize-invalid.yml` may run at protected current main, and the +following is the exhaustive continuation matrix: + +| Current state | Main-capable caller | Allowed state/effect only | +|---|---|---| +| `STOPPED_INVALID` or `BUDGET_INCOMPLETE` | `benchmark-finalize-invalid.yml` | `INVALID_PREFIX_SEALED` CAS from frozen C0 bytes and archived sealed closure | +| `INVALID_FINALIZED` | `benchmark-publish.yml` | invalid-prefix intent CAS, create/adopt exact invalid branch/PR, record/open CAS, or typed plan invalidation | +| `INVALID_PUBLICATION_PR_OPEN` | `benchmark-publish.yml` | close/invalidate the exact PR or admit the exact protected invalid-prefix merge | + +Each invocation still fresh-double-reads both refs and policy. Proven drift selects this narrow +exception: only state-writer CASes and publisher effects necessary for the listed invalid-prefix +lineage may proceed from verified frozen C0 workflow bytes and the archived sealed object closure. +No provider credential, complete-bundle publisher, release, correction promotion, documentation, +social publication, or restored-ref resume is allowed. Temporary inability to read any required +authority produces no token, effect, or state. `benchmark-finalize-invalid.yml` is main-capable only +for the first row, so no new workflow, App, environment, or secret is introduced. + +`credential_exposure` has this +separate exhaustive caller/parent matrix; every cell also requires the exact +`CredentialExposureIncidentEvidenceV1` roots and receipts above: + +| Credential-incident caller | Exact allowed current parent states | Additional restriction | +|---|---|---| +| `benchmark-batch.yml` | `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE` | affected artifact was uploaded or consumed by the exact current batch plan/run | +| `benchmark-hard-score.yml` | `GENERATION_COMPLETE` | affected generation artifact is an exact hard-score input or scan output | +| `benchmark-evidence.yml` | `GENERATION_RESUMABLE`, `GENERATION_ACTIVE`, `GENERATION_COMPLETE`, `HARD_SCORE_COMPLETE`, `JUDGE_RESUMABLE`, `JUDGE_ACTIVE`, `JUDGE_COMPLETE`, `PROVIDER_EVIDENCE_VERIFIED`, `AUDIT_COMPLETE`, `ANALYSIS_COMPLETE`, or `BUNDLE_COLLECTED` with no active initial publication prefix | designated cross-phase inventory/scanner; every artifact is already in the current inventory or exact phase plan | +| `benchmark-evidence.yml` | `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED` with no active initial publication prefix, `INVALID_PREFIX_MERGED`, or `INVALID_PREFIX_MERGED_INVALID` | only two-phase pending containment and terminal `CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED`; preserve the invalid state and permit no live resume | +| `benchmark-audit.yml` | `PROVIDER_EVIDENCE_VERIFIED` | affected artifact is an exact audit input or output | +| `benchmark-analysis.yml` | `AUDIT_COMPLETE` | affected artifact is an exact analysis input or output | +| `benchmark-collect-complete.yml` | `ANALYSIS_COMPLETE` | affected artifact is an exact collection input or proposed bundle member | +| `benchmark-publish.yml` | `BUNDLE_COLLECTED` with an active initial complete prefix, `COMPLETE_PUBLICATION_PR_OPEN`, `INVALID_FINALIZED` with an active initial invalid prefix, `INVALID_PUBLICATION_PR_OPEN`, bare `RELEASE_BLOCKED`, bare `RELEASED`, or an active correction before valid merge | affected artifact is publication-plan/correction bound; prove no PR or close the exact open PR, use merge-race invalidation if merge wins, use terminal supplement for an invalid-prefix lineage, correction intent for bare post-release states, or publication-family invalidation for an active correction | +| `benchmark-release.yml` | `RESULT_MERGED` before or after release intent, or an active correction after valid merge | affected artifact or release object is exact release-plan/correction input; terminalize through `RELEASE_PLAN_INVALIDATED` or release-family correction invalidation | +| `benchmark-dismiss-hold.yml` | every premerge `credential_exposure` STOP parent except `COMPLETE_PUBLICATION_PR_OPEN` and `BUNDLE_COLLECTED` with an active initial-publication prefix | only with the exact current nondismissible hold root and incident evidence independently verified under dismissal approval; no post-merge, correction, or supplement row | + +Every matrix row grants its caller exactly `CREDENTIAL_EXPOSURE_PENDING`, zero or more ordered +`CREDENTIAL_EXPOSURE_EFFECT_RECORDED`, and its phase-exact terminal consumer from section 7.4. A +premerge row ends in `PERMANENT_STOP(reason=credential_exposure)`; an invalid terminal row ends in +the supplement; post-merge and correction rows end only through their listed invalidation or +correction intent. For either complete initial-publication prefix, including pre-open +`BUNDLE_COLLECTED`, `benchmark-publish` first seals pending, then proves no PR or attempts the exact +close. No PR or a successful close produces the applicable STOP disposition; a merge that wins +produces `merged_before_close` and race-form `RESULT_MERGE_INVALIDATED`. For either invalid initial- +publication prefix, including pre-open `INVALID_FINALIZED`, the same partition ends in an invalid- +lineage supplement plus typed plan invalidation, or race-form +`INVALID_PREFIX_MERGE_INVALIDATED`. +No cross-workflow delegation or implied event grant exists. + +`benchmark-preflight.yml`, `benchmark-finalize-invalid.yml`, both PR validators, and the docs +validator have no credential-incident authority. The matrix grants no +caller a different STOP reason, parent, event, ref, artifact, or App operation. A phase workflow +that merely receives an unbound artifact ID or scanner assertion is denied. + +Pull-request refs, branches other than exact `main`, any other tag, a tag/object/commit mismatch, +unlisted callers or called workflows, caller/callee SHA or byte mismatch, an unexpected +`environment`, a different event/job/check-run/actor, and a stale expected OID are denied before +token minting. For every authority mutation, including transition one, the broker itself performs +the universal fresh pair/policy/registry gate immediately before OIDC exchange or App-token mint +and again before receive-pack; a read failure yields no token/ref request/receipt/state, and drift +uses only the exact current-parent matrix. The broker then obtains a single-repository, short-lived +installation token for one fixed state-writer invocation; the token never leaves the broker, +expires within five minutes, and is +discarded immediately after the one expected-OID CAS. Its request ID, raw OIDC +subject/claims, canonical identity projection, App actor, expiry, event kind and STOP reason, +authority ref, expected/new OIDs, and broker decision are recorded in the state receipt. Policy +tests prove an unrelated workflow—even on an otherwise allowed ref—cannot obtain the credential. + +#### Authority object and ref protocol + +The authority Git identity is the canonical input-tag member +`benchmark/security/state-writer-git-identity.json`, with this exact closed +`StateWriterGitIdentityV1` field set: + +```text +schema_version = "StateWriterGitIdentityV1" +state_writer_app_account_id = +state_writer_app_login = +author_name_ascii = "Laconian Benchmark State Writer" +author_email_ascii = "laconian-benchmark-state-writer@users.noreply.github.com" +committer_name_ascii = "Laconian Benchmark State Writer" +committer_email_ascii = "laconian-benchmark-state-writer@users.noreply.github.com" +state_writer_git_identity_sha256 = +``` + +Author and committer name/email bytes are deliberately identical. All four values are the literal +ASCII bytes shown; Unicode normalization, localization, substitution, display-name lookup, or a +GitHub profile email is forbidden. The App account ID is greater than zero and the login is the +exact installed actor login, matching ASCII `[A-Za-z0-9-]+(?:\[bot\])?`; its case is significant. +Every string is valid UTF-8/ASCII and contains no NUL, CR, LF, `<`, `>`, or other control byte. +Canonical bytes are RFC 8785 JSON over exactly the fields above (object input order is immaterial), +UTF-8 with no terminal newline, hashing all fields except the final digest with domain separator +`laconian-state-writer-git-identity-v1`. Missing, extra, null, nonliteral, or digest-mismatched +fields fail closed. + +The installed App account ID/login are therefore not obtained from an undefined “App registry.” +Preflight reads this exact member from verified C0, matches its account ID/login against the +repository installation and `StateBrokerCallerPolicyV1`, and requires its digest in the input +registry and as the ordered `security_evidence` protocol-review statement subject. `PREFLIGHT_SEALED`, +every `CampaignEventV1`, publication/correction authority intent, `AuthorityMutationRequestV1`, and +`AuthorityMutationReceiptV1` binds the same digest. A different identity requires a new input tag, +paired companion tag, three new signed statements, bundle, and campaign; no authority ref may mix +identity digests. + +Every broker request carries one canonical `AuthorityMutationRequestV1` with a strict three-member +`mutation_kind` union. Its exact ordered common fields are `schema_version`, `mutation_kind`, one +variant source field at that position, `campaign_id`, `campaign_registry_sha256`, `authority_ref`, +`mutation_mode`, `expected_current_oid`, `proposed_tree_oid`, `commit_timestamp`, +`state_writer_git_identity_sha256`, `predecessor_unresolved_hold_root`, +`successor_unresolved_hold_root`, `predecessor_active_credential_exposure_incident_id`, +`successor_active_credential_exposure_incident_id`, +`predecessor_active_credential_exposure_pending_root`, +`successor_active_credential_exposure_pending_root`, +`predecessor_publication_merge_denylist_root_sha256`, +`successor_publication_merge_denylist_root_sha256`, +`predecessor_active_publication_terminal_containment_root`, +`successor_active_publication_terminal_containment_root`, `oidc_run_identity_sha256`, `request_id`, +`idempotency_key`, and `request_sha256`. `schema_version` is exactly +`AuthorityMutationRequestV1`; the ref is the one campaign authority ref; mutation mode is +`expected_absent` or `expected_current_oid`; the expected OID is null only for genesis and otherwise +lowercase 40-hex; proposed tree is a lowercase 40-hex Git tree OID; roots are lowercase SHA-256 or +class-permitted null; timestamps are canonical whole-second UTC; request ID is bounded nonblank and +idempotency key is SHA-256. + +For `mutation_kind=campaign_event`, the sole variant field is +`campaign_event_source: CampaignEventMutationSourceV1`, whose exact fields are +`schema_version="CampaignEventMutationSourceV1"`, positive `transition_number`, literal +`event_type`, class-bound nested `event_record: CampaignEventV1`, `event_sha256`, ordered +`required_member_paths`, ordered matching `required_member_sha256s`, `recorded_at`, and +`source_sha256`; its domain is `laconian-campaign-event-mutation-source-v1\n` omitting only +`source_sha256`. Event type/hash/timestamp/transition equal the nested record, and the two member +arrays have identical positive length, canonical path order, and no duplicate. +For `mutation_kind=initial_publication_receipt_append`, the sole variant field is +`initial_publication_receipt_append: InitialPublicationReceiptAppendV1`. For +`mutation_kind=initial_release_receipt_append`, it is +`initial_release_receipt_append: InitialReleaseReceiptAppendV1`. Each variant forbids the other two +source fields and every event/transition alias. + +All requests hash exact RFC 8785 JSON with domain `laconian-authority-mutation-request-v1\n`, +omitting only `request_sha256`. Both append variants require `expected_current_oid`, byte-identical +predecessor/successor campaign state, hold, incident-ID, and pending-root values, and their exact +caller/state/path/order gate in section 7.6. The nested append's parent OID, recorded time, and +idempotency key equal the outer expected OID, commit timestamp, and idempotency key respectively. +The broker accepts no caller-supplied packfile, prebuilt commit, arbitrary path, or arbitrary Git +object. It independently canonicalizes every schema record, recomputes its SHA-256 root, fetches and +verifies the exact predecessor tree when one exists, and constructs the candidate Git objects. + +The publication roots in every request are transition-authoritative, not advisory. Genesis has a +nonnull successor equal to the canonical empty `PublicationMergeDenylistV1` root, null predecessor +denylist, and both containment roots null. Every ordinary event and both non-event append families +byte-preserve denylist and containment roots. `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` alone may +replace the predecessor denylist by its exact one-entry monotone successor and change containment +`null -> terminal_containment_intent_sha256`. The phase-exact terminal consumer alone may preserve +that successor denylist and change containment `terminal_containment_intent_sha256 -> null` while +nesting matching `PublicationTerminalContainmentFinalityV1`. No request may remove a denylist entry, +install an already-present containment root, clear an unmatched root, or combine either root change +with a non-campaign-event append. + +`AuthorityTreeSchemaV1` permits exactly root blob `campaign-state.json` and the optional root trees +`events`, `evidence`, `holds`, `receipts`, `corrections`, `publication`, `incidents`, and +`denylist`. Event files are +`events/<20-digit-transition>-.json`; content-addressed evidence is +`evidence//.json`; hold, effect-receipt, correction, publication, +and incident +paths are only those required by the current `CampaignStateSchemaV1` event, including the exact +correction members in section 7.5, except for the two separately discriminated section 7.6 non- +event append families. The initial-publication family may append only +`publication/initial//attempts/<20-digit-publication-attempt>/branch-receipt.json`, +then the same prefix's `pr-receipt.json`. The initial-release family may append only that exact +attempt prefix's `tag-receipt.json`, then +`draft-release-receipt.json`, then `asset-receipts.json`, then `publish-receipt.json`; prefix, +publication ID, attempt, filename, payload class, and predecessor are derived from canonical authority and +cannot be caller-selected. Directories have mode `040000`; every leaf is a regular +non-executable blob with mode `100644`. Symlinks, executables, submodules, duplicate names, +non-UTF-8/NFC names, empty components, and `.` or `..` are forbidden. Entries use Git's canonical +raw-byte tree order. A successor retains every prior numbered/content-addressed entry byte-for-byte. +For `campaign_event`, it replaces only `campaign-state.json` and appends exactly the event-required +new members. Either append kind retains `campaign-state.json` and every prior member byte-for-byte +and appends exactly its one next family-owned receipt path. Deleting or modifying prior evidence is +forbidden; no mutation kind may create a member owned by another, and neither append family may +create an event, terminal member, or state change. + +The exposure members are closed: `incidents//pending.json`, ascending +`incidents//effects/<8-digit-ordinal>.json`, one +`incidents//final.json` or `supplement.json`, and +`denylist/provisional/.json` followed by `denylist/permanent/.json`. +Pending appends exactly the pending/provisional pair; progress appends exactly one next effect; +finalization appends exactly final-or-supplement plus permanent denylist and consumes the active +root in `campaign-state.json`. No event may replace/delete these append-only members. + +Publication containment members are closed. Preflight appends the canonical empty denylist snapshot +at `denylist/publication/merge/.json`. In addition to replacing +`campaign-state.json` and appending the generic numbered `events/...` member, each +containment-start event appends exactly +`denylist/publication/merge/.json`, +`publication/containment//intent.json`, +`publication/containment//containment-start-event.json`, +`publication/containment//broker-prefix.json`, and +`publication/containment//vault-prefix.json`; the derived +`containment-start-event.json` intentionally duplicates the generic event blob byte-for-byte so +intent-local recovery does not require a directory scan. The snapshot bytes recompute the +successor root and strictly append the predecessor set. In addition to its state replacement and +generic numbered event member, its exact terminal event then appends exactly +the applicable content-addressed members under that same prefix: +`barriers/.json`, nullable `write-ambiguity/.json`, nullable +`merge-won/.json`, and required `finality/.json`, plus the ordinary +event-required no-later/unavailable evidence paths. Zero-residual barriers are still stored. Paths, +roots, presence and payload classes are derived from the nested finality union, not supplied by the +caller. Every older denylist snapshot and containment member remains immutable; clearing the active +state field never deletes its evidence. + +Blob content is the exact canonical UTF-8 record bytes. Tree content is Git's canonical sequence of +`mode SP name NUL raw-object-id`; commit content is exactly `tree `, then no parent for the +bootstrap or exactly one `parent ` thereafter, then these two exact lines: + +```text +author Laconian Benchmark State Writer +0000 +committer Laconian Benchmark State Writer +0000 +``` + +`` is the identical canonical decimal Unix-seconds conversion of the mutation source +record's whole-second UTC `recorded_at` (`YYYY-MM-DDTHH:MM:SSZ`)—the event for +`campaign_event`, `InitialPublicationReceiptAppendV1` for its append variant, or +`InitialReleaseReceiptAppendV1` for its append variant—with no sign or +leading zero. `AuthorityMutationRequestV1.commit_timestamp` must equal that same source value. The broker clears and +ignores all system/global/local Git config and author/committer environment variables. No +`encoding`, `gpgsig`, `mergetag`, extra identity, continuation, or other commit header is present. +After those identity lines, commit content has one blank line and +`laconian benchmark authority transition <20-digit-number>: ` followed by +one newline for a campaign event. An initial-publication append instead uses exactly +`laconian benchmark authority state <20-digit-current-transition>: initial-publication-` +followed by one newline and does not increment the transition. An initial-release append uses exactly +`laconian benchmark authority state <20-digit-current-transition>: initial-release-` +followed by one newline and does not increment the transition. +There is no fourth commit-message grammar. Preflight freezes the repository object format to SHA-1, matching the required +40-lowercase-hex authority OIDs; SHA-256-format repositories are outside v1. It also proves that the +repository already has an ordinary reachable commit, so this protocol never attempts to initialize +an entirely empty GitHub repository. The broker reconstructs every blob, tree, and commit OID from +`type SP decimal-size NUL content` and rejects an extra parent, +extra object, extra tree member, unexpected mode, timestamp, identity, message, or OID. + +The broker writes the object closure and ref through Git smart HTTP receive-pack, because GitHub's +REST update-ref body has no expected-old-OID precondition and therefore is not this design's CAS. +The only write transport is discovery +`GET /OWNER/REPO.git/info/refs?service=git-receive-pack` followed by +`POST /OWNER/REPO.git/git-receive-pack`. The broker builds a temporary isolated object database and +an exact pack containing only missing objects reachable from the candidate commit, then sends one +receive command `old-oid new-oid refs/heads/benchmark-authority/` with report status. +This is the protocol-level equivalent of an explicit full-ref `--force-with-lease`; the old OID is +not inferred from an earlier REST read. For reconciliation the App may use only read-only +`GET /repos/{owner}/{repo}/git/ref/heads/benchmark-authority/{campaign-id}` and exact +commit/tree/blob GETs. + +No Git Database REST write, Contents API write, GraphQL mutation, delete command, alternate ref, +tag, ordinary branch, pull request, Release, or other repository endpoint is allowed. The receive +command is rejected unless the candidate is independently verified as a one-parent fast-forward +child after bootstrap; the lease is never used to authorize non-fast-forward history. Pack object +enumeration is exact, thin-pack bases must already be verified predecessor objects, and an +unreachable or extra packed object is forbidden. Content-addressed upload is idempotent: after a +timeout or response loss the broker fetches the expected OID and verifies its bytes before +proceeding; an OID/byte disagreement is a terminal security incident. + +For transition one, the request must have `mutation_mode=expected_absent`, null expected OID, event +`PREFLIGHT_SEALED`, transition number one, and a parentless commit. After an absence read, the broker +atomically uploads the exact closure and creates the ref in one receive-pack command whose old OID +is Git's all-zero SHA-1 object ID. A server conflict or lost response is reconciled as exactly one +of: candidate now present and fully reverified, ref still absent and identical request retryable, or +different OID present and terminal bootstrap conflict. No second ref or candidate is created. For +every later transition, the receive command's old OID is +exactly `expected_current_oid`; the candidate is its exact one-parent fast-forward child. A sibling +race fails the server's old-OID comparison. After response loss the broker adopts only if the ref +equals the candidate OID and the candidate has the exact expected parent/tree; if the ref is still +at the expected OID it may retry the identical receive command, and any third OID is a CAS conflict. +No reconciliation path force-moves or rewinds a ref. + +Every attempt yields canonical `AuthorityMutationReceiptV1` in the broker's append-only durable +log and as safe workflow evidence. It is the same strict three-member `mutation_kind` union as the +request. Its exact ordered common fields are `schema_version`, `mutation_kind`, the variant fields +at that position, `campaign_id`, `campaign_registry_sha256`, `request_id`, `idempotency_key`, +`authority_ref`, `mutation_mode`, `expected_old_oid`, `ordered_blob_oids`, `ordered_tree_oids`, +`candidate_commit_oid`, `observed_before_oid`, `observed_after_oid`, `outcome`, +`endpoint_policy_sha256`, ordered `github_request_receipts`, ordered nested exact +`final_reconciliation_receipts: AuthorityRefReconciliationReceiptV1`, +`app_actor_id`, `app_actor_login`, +`state_writer_git_identity_sha256`, `oidc_run_identity_sha256`, +`predecessor_unresolved_hold_root`, `successor_unresolved_hold_root`, +`predecessor_active_credential_exposure_incident_id`, +`successor_active_credential_exposure_incident_id`, +`predecessor_active_credential_exposure_pending_root`, +`successor_active_credential_exposure_pending_root`, +`predecessor_publication_merge_denylist_root_sha256`, +`successor_publication_merge_denylist_root_sha256`, +`predecessor_active_publication_terminal_containment_root`, +`successor_active_publication_terminal_containment_root`, `started_at`, `completed_at`, and +`receipt_sha256`. `schema_version` is exactly `AuthorityMutationReceiptV1`; outcome is `created` or +`adopted_exact`; OIDs, roots, IDs, nullability, ref, mode, identity and timestamps match the exact +request and authenticated transport observations. + +The `campaign_event` variant has exactly `transition_number`, `event_type`, `event_sha256`, and +`event_member_manifest_root_sha256` as its variant fields. Each append variant instead has exactly +`receipt_kind`, `receipt_path`, and `append_sha256`, with the kind/path/root equal to its nested +initial-publication or initial-release wrapper; it has no event fields. Each +`github_request_receipts` member has exactly positive `ordinal`, `method`, `endpoint_template`, +`request_id`, `dispatch_state="dispatched"`, +`transport_outcome="response_observed"|"response_lost"`, nullable positive `response_status`, +nullable `safe_response_sha256`, and `transport_receipt_sha256`; members are in ascending +gapless ordinal order with no duplicate. `response_observed` requires both response fields nonnull; +`response_lost` requires both null and covers timeout, connection loss or loss after possible +server commit. Every discovery GET and possibly delivered receive-pack POST appears once; no retry +may erase the lost attempt. Blob/tree OID arrays are canonical construction order with no +duplicate. RFC 8785 JSON uses domain `laconian-authority-mutation-receipt-v1\n` and omits only +`receipt_sha256`. It contains no App token, authorization header, raw record payload, or unlisted +transport response. + +`AuthorityRefReconciliationReceiptV1` has exactly `schema_version`, `repository_id`, +`authority_ref`, `candidate_commit_oid`, nullable `expected_old_oid`, +`observation_round=1|2`, `method="GET"`, +`endpoint_template="/repos/{owner}/{repo}/git/ref/heads/benchmark-authority/{campaign_id}"`, +`request_id`, `request_dispatched_at`, `response_completed_at`, +`response_status=200|404`, nullable `observed_ref_oid`, nullable +`verified_candidate_object_closure_root_sha256`, +`resolved_state="absent"|"exact_candidate"|"divergent"`, and +`reconciliation_receipt_sha256`. A 404 is only `absent` with both observed fields null. A 200 +requires an observed OID; `exact_candidate` additionally requires that OID equal the candidate and +the nonnull closure root reproduce its exact parent/tree/blob bytes, while every other OID is +`divergent` with null closure root. Its domain is +`laconian-authority-ref-reconciliation-receipt-v1\n`, omitting only its final digest. Every mutation +receipt contains exactly rounds one and two with distinct request IDs, every possibly delivered +receive-pack attempt completing before round one dispatch and round one completing before round two +dispatch. The two resolved states/OIDs are equal. `created` requires an observed successful +receive-pack report plus two `exact_candidate` reads; `adopted_exact` requires either a pre-existing +exact candidate or a response-lost/ambiguous write followed by those same exact reads. Absent or +divergent final reads cannot produce an authority mutation receipt. + +For either initial append, predecessor/successor state, hold, incident ID, and pending root are +byte-identical. For a campaign event they obey that event's exact transition rules. +For exposure and hold events, the request's nested strict event and +`event_member_manifest_root_sha256` reproduce member paths/digests, incident/hold ID and effect +ordinal; the receipt binds that request/event/manifest and the byte-exact candidate commit rather +than adding undeclared top-level fields. +Crash recovery adopts only the same event or append, +candidate OID, paths, bytes, idempotency key, and external terminal-state observation. A different +ordinal/effect/result is a conflict, never a retry success. +Duplicate request IDs must reproduce the same +candidate and prior OID; conflicting reuse is denied. This protocol provides only exact authority +ref creation/advance, not arbitrary repository write authority. + +Publisher and release-finalizer credentials are mapped only in their separately approved +`benchmark-publish` jobs. State-writer App credentials are never mapped into Actions; the broker +uses them only after the fixed reusable job passes the closed policy above. No App credential is +present in provider-controller, model-output parsing, scoring, packaging, or artifact-inspection +scope, and no App ever receives `OPENAI_API_KEY` or a model-output field as an input, environment +value, argument, stdin, or log. A fixed byte-blind transport step may transmit only already sealed +opaque Git objects or release assets whose roots are plan-bound; it cannot decode or select their +contents. Provider jobs have read-only repository permissions. Publication jobs never receive the +provider key. No `pull_request_target`, privileged automatic `workflow_run`, untrusted fork code, +or model-generated command is used. + +Human authorities are separate and are not counted among the three automated Apps. The three +protocol reviewers author and sign, in registry role order, their exact one-statement reviewer +commits; the operator creates the exact annotated T0/T1 tag pair only at its specified point in the +serial construction; the two audit reviewers author their commitment and reveal commits/PRs and +sign adjudication; and maintainers perform environment/deployment approvals, exact-head validation +authorization, protected PR review, and protected merges. These acts use the humans' own GitHub +identities through normal protected repository controls; no human token is injected into a +workflow. Human authorship or approval cannot replace signature verification, an App receipt, or +authority CAS, and no App may substitute for a required human reviewer, approve its own PR, or +merge. + +The live secret is a dedicated project-scoped restricted key created for this benchmark campaign, +not an organization/admin key. The project has no unrelated consumers, exposes only the API +capabilities required by the frozen runner, and uses a provider-side project spend guard where +available. The key is revoked or rotated after the campaign and immediately after any incident. + +Each provider batch has the exact four-role/job boundary in section 7.2: secret-free prepare, +protected repository-read-only provider, key-free receipt/state writer, and key-free post/state +writer. The prepare job imports and verifies checkpoints, checks the predecessor ledger/STOP state, +constructs `BatchPlanV1`, creates its worst-case reservation, and emits a digest-bound safe input +artifact. The protected provider job checks out exact detached C0 and re-verifies both tag objects, +the sealed `campaign_registry_sha256`, and the plan digest, but its controller step remains disabled +until the receipt/state +writer wins the single expected-OID authority CAS and the job verifies that won receipt. The +post/state writer validates the output and performs the successor expected-OID CAS; neither state +writer maps the provider key. +`${{ secrets.OPENAI_API_KEY }}` is mapped through step-scoped `env` only for the single +hash-verified provider-controller command, never at workflow or job scope and never during +checkout, dependency setup, artifact download/upload, or packaging. No third-party action or +arbitrary shell runs while the key is in scope; tracing is disabled, SDK retries are zero, and +ambient proxy credentials are not trusted. + +All Actions are pinned to full commit SHAs. Every job checks out the preflight-recorded detached +commit SHA, never a tag name after preflight, and checkout does not persist credentials. Workflow +policy tests fail on a floating action ref, widened `GITHUB_TOKEN` permission, wrong App actor or +credential scope, forbidden GitHub endpoint, unapproved trigger, arbitrary live input, +tag/commit/workflow-root mismatch, or any provider/App secret in a PR/fork or wrong-role job. + +### 12.2 Public artifacts + +Readers of a public repository may be able to retrieve Actions artifacts. This campaign therefore +uses only the allowlisted public corpus and treats every uploaded checkpoint as potentially public. +Typed records and an allowlist-by-construction package projection are the primary boundary. A +fail-closed defense-in-depth scan then checks exact known credential values, credential patterns, +environment dumps, private paths, and disallowed provider metadata. +The universal pending gate applies here in full: a pending incident blocks every ordinary authority +mutation, credential, artifact access/download, publication/release/correction, documentation/social +action, and external effect, not merely provider dispatch and campaign download. + +Headers, the API key, raw SDK exception bodies, environment contents, and unrestricted diagnostics +never enter an artifact. The exact key is scanned only inside its ephemeral provider step and is +never written for scanning. If inventory or scanning fails, upload and publication stop. The +security event is retained without reproducing the suspected secret; pattern matching is defense +in depth, not a claim that regex can prove the absence of every secret. + +Suspected credential exposure discovered after upload uses only the closed two-phase emergency +lifecycle in section 7.4; its terminal consumer is selected by the exact current authority phase. +The discovering phase workflow or designated +`benchmark-evidence` inventory/scanner reconstructs the exact current state/ledger/inventory/plan/ +hold roots, verifies the source upload/run/job and scanner receipts, assigns the incident ID, and +builds safe metadata without retaining suspected bytes. Before **any** revocation/rotation, +quarantine/deletion, artifact-access change, or PR close, the broker uses its existing state-writer +authority and repository-wide lease to append `incidents//pending.json` plus +`denylist/provisional/.json` by one expected-OID CAS while the campaign state name is +unchanged. `CredentialExposurePendingV1` has exactly `schema_version`, `campaign_id`, `incident_id`, +`parent_state`, `parent_authority_oid`, `current_state_root`, `spend_ledger_root`, +`artifact_inventory_root`, `active_phase_plan_root`, `unresolved_hold_root`, +`concurrent_protocol_authority_drift_evidence_sha256`, `affected_artifacts`, +`scanner_evidence_root`, `provisional_denylist_root`, `pending_effect_inventory`, `created_at`, and +`credential_exposure_pending_sha256`; its domain is +`laconian-credential-exposure-pending-v1`. Its digest is SHA-256 of that ASCII domain plus LF and +CanonicalJSONV1 of the pending record with exactly `credential_exposure_pending_sha256` removed. +There is exactly one incident ID, affected artifacts are +the ascending strict projections defined above, and `pending_effect_inventory` is the canonical +ordered set of credential containment, per-artifact quarantine/deletion/access denial, and exact +publication-PR terminal disposition when an initial or correction prefix may have a PR. That item +uses the closed `no_pr|closed|already_merged` outcome and receipt binding in section 7.4; it is not +an unconditional close. The concurrent drift root is null only when a fresh check proves no +drift. Every entrypoint checks the pending path before provider dispatch or artifact download and +denies both immediately. + +Containment then executes each inventoried effect idempotently. After each effect the broker +appends or adopts `incidents//effects/.json` by expected-OID CAS; response +loss is reconciled against exact external identity and state, never retried ambiguously. Only after +all credentials are terminally contained, artifacts terminally quarantined/deleted or proved +unavailable, access denied, and any required open-PR disposition is terminal does the +phase-exact STOP, supplement, merge/release invalidation, or correction intent/invalidation consume +the pending root and install the final permanent denylist plus +`CredentialExposureIncidentEvidenceV1`. A premerge parent with no merge race uses +`PERMANENT_STOP(reason=credential_exposure)` and enters `STOPPED_INVALID`. Crash injection +after the pending CAS and after every effect or receipt must leave the active pending incident in force; no +restart can restore live authority. If a complete publication PR merges before its close is +observed, the broker records `merged_before_close`, keeps the close receipt null, and uses the +race-form `RESULT_MERGE_INVALIDATED` rather than claiming a premerge close or STOP. + +Credential containment has emergency precedence over protocol drift. If drift exists initially or +is discovered during handling, only the pending-incident CAS, typed containment credentials, +inventoried effects, and progress/final receipts remain allowed; the exact +`ProtocolAuthorityDriftEvidenceV1` root is recorded in pending and final evidence and handling does +not switch to a drift-only STOP. Even if T0/T1 moved or disappeared or policy drift prevents the tag +trigger, protected-current-main `benchmark-evidence.yml` may initiate, continue, and finalize this +protocol after authenticating fresh drift receipts and byte-identical sealed C0 caller/reusable +workflow members; it cannot emit an intervening drift STOP or any ordinary effect. Exposure first +discovered in an artifact-bearing invalid lineage creates the same pending incident and denylist, +performs the same idempotent effects, and appends strict `CredentialExposureSupplementV1` via a +`CREDENTIAL_EXPOSURE_SUPPLEMENT_RECORDED` self-loop. That name is a strict `supplement_kind` +discriminated union, never one record with a nullable opaque drift root. + +`ProtocolDriftCredentialExposureSupplementV1` has discriminator +`supplement_kind=protocol_drift_stop` and exactly `schema_version`, `supplement_kind`, `campaign_id`, +`incident_id`, `credential_exposure_pending_sha256`, +`credential_exposure_incident_evidence_sha256`, `original_protocol_authority_drift_stop_root`, +`consumed_active_pending_root`, `terminal_effect_receipts_root`, `recorded_at`, and +`credential_exposure_supplement_sha256`. It is accepted only from `STOPPED_INVALID` whose exact +accepted STOP reason and evidence are protocol drift. Its digest domain is +`laconian-protocol-drift-credential-exposure-supplement-v1` plus LF. + +`InvalidLineageCredentialExposureSupplementV1` has discriminator +`supplement_kind=invalid_lineage` and exactly `schema_version`, `supplement_kind`, `campaign_id`, +`incident_id`, `parent_state`, `parent_authority_oid`, `invalid_origin_event_sha256`, +`invalid_origin_evidence_sha256`, `credential_exposure_pending_sha256`, +`credential_exposure_incident_evidence_sha256`, `consumed_active_pending_root`, +`terminal_effect_receipts_root`, nullable `invalid_publication_pr_close_receipt_sha256`, +`recorded_at`, and `credential_exposure_supplement_sha256`. `parent_state` is exactly one of +`STOPPED_INVALID` with a non-drift STOP reason, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, +`INVALID_PUBLICATION_PR_OPEN`, `INVALID_PREFIX_MERGED`, or +`INVALID_PREFIX_MERGED_INVALID`. The origin pair maps exactly as follows: +`STOPPED_INVALID -> PERMANENT_STOP`, `BUDGET_INCOMPLETE -> BUDGET_EXHAUSTED`, +`INVALID_FINALIZED|INVALID_PUBLICATION_PR_OPEN -> INVALID_PREFIX_SEALED`, +`INVALID_PREFIX_MERGED -> INVALID_PREFIX_MERGED`, and +`INVALID_PREFIX_MERGED_INVALID -> INVALID_PREFIX_MERGE_INVALIDATED`; the event and its typed +evidence must be accepted ancestors of `parent_authority_oid`. Thus an active initial-publication +prefix binds its underlying invalid-prefix origin plus its exact current parent OID/phase, never a +future supplement. The close receipt is nonnull only for `INVALID_PUBLICATION_PR_OPEN`, or +`INVALID_FINALIZED` with an active initial invalid prefix, when incident disposition is +`closed_before_supplement` and the shared close kind is `publisher_closed`; it byte-equals the +incident-evidence field. For `observed_already_closed` it is null and the incident's shared +terminal-disposition root binds the strict closed observation. It is null otherwise. A +`merged_before_close` invalid-prefix incident +never uses this supplement and terminates through race-form `INVALID_PREFIX_MERGE_INVALIDATED`. +Its digest domain is `laconian-invalid-lineage-credential-exposure-supplement-v1` plus LF. + +Both digests use `CanonicalJSONV1(supplement without exactly +credential_exposure_supplement_sha256)`. The pending and final incident roots are ordinary +already-computed inputs, so neither variant is circular. Safe invalid-prefix continuation is +blocked until its applicable supplement resolves. Neither variant permits live resume, provider +access, complete publication, release, correction promotion, documentation, or social effects. +The supplement consumes the exact active progress root, clears the active pair, and requires the +hold root null without creating a second `PERMANENT_STOP` or changing the campaign-state name. + +For a complete initial prefix at pre-open `BUNDLE_COLLECTED` or +`COMPLETE_PUBLICATION_PR_OPEN`, the separately approved `benchmark-publish` job exclusively records +the PR terminal-disposition ordinal after pending. `no_pr` is possible only pre-open and ends in +STOP; `closed` records `closed_before_stop` plus either its exact publisher-App receipt or strict +already-closed observation and ends in STOP; +`already_merged` records `merged_before_close`, keeps the close receipt null, and ends in race-form +`RESULT_MERGE_INVALIDATED`. The corresponding invalid initial prefix at pre-open +`INVALID_FINALIZED` or `INVALID_PUBLICATION_PR_OPEN` maps `no_pr|closed|already_merged` to +invalid-lineage supplement plus typed plan invalidation, the same path with +`closed_before_supplement` and its exact close-kind evidence, or race-form +`INVALID_PREFIX_MERGE_INVALIDATED` respectively. No +other credential-incident caller can terminalize these prefixes. If deletion is pending or unavailable at the +STOP CAS, the prefix/STOP finalizer cannot emit `INVALID_PREFIX_SEALED` until it binds a terminal +safe containment receipt containing the final deletion result, continued artifact denylist, and +credential-response receipt. Only the typed progress self-loops and final supplement may update +containment evidence in `STOPPED_INVALID`. + +Because retrieval may already have occurred, the event is treated as a disclosure and the campaign +is operationally invalid even if deletion succeeds. Before merge, the safe publication projection +contains only artifact IDs/digests, safe upload and scanner metadata, containment/deletion receipts, +incident timeline, and the safe invalid-campaign record; affected raw bytes are excluded from every +future bundle, PR, and release. + +After `RESULT_MERGED`, those bytes may already exist in the protected `main` history, merged PR, +forks, clones, caches, or prior fetches. They cannot be retracted or truthfully described as +“excluded from publication.” The campaign uses `RELEASE_PLAN_INVALIDATED`, rotates/revokes the +credential, preserves branch/tag protections, denies every affected artifact and Git object to +future campaign consumers, publishes an explicit disclosure/incident record naming safe object +IDs but no secret bytes, and authorizes no original tag, release, latest pointer, documentation, or +promotion. A new correction intent must bind the contaminated merge/exposure root and, where safe +removal from the current tree is appropriate, publish a separately reviewed tombstone/removal +commit. That commit changes the current tree only; it does not claim to erase PR transport, Git +history, forks, clones, caches, or prior fetches. + +Discovery after `RELEASED` uses the same containment and an append-only correction lineage. The +already published tag/Release/history remains disclosed evidence; the existing latest pointer is +not rewritten. The correction intent immediately appends +`latest_status=withdrawn_due_to_credential_exposure` for consumers while preserving the historical +pointer event; a new pointer appears only when the corrected lineage fully releases. Public messaging +distinguishes the safe replacement projection from the already-exposed transport and history and +links both the incident and superseding correction. Release, correction, +invalid-finalization, invalid-publication, and terminal states cannot emit a new +credential-exposure STOP event. + +Model output remains untrusted data. It is never executed, used as a path, interpolated into a +shell command, or rendered as raw GitHub Markdown/HTML. Canonical output stays in JSONL/download +artifacts; any approved excerpt uses a tested text-only encoder that neutralizes HTML, links, +images, headings, fences, and mentions. + +## 13. Publication flow + +### 13.1 Publication bundle + +Immediately after judging, a secret-free read-only provider-evidence verifier checks generation, +hard-score, judge, ledger, and provenance completeness and seals `EvidenceInventoryV1`. It neither +accepts audit/statistical outputs nor creates a publication bundle; its sole purpose is to authorize +the blind audit packet from an exact provider-evidence root. + +Only after `AUDIT_COMPLETE` and `ANALYSIS_COMPLETE`, the secret-free, read-only complete collector +accepts the sealed evidence inventory plus allowlisted exact workflow-run IDs, run +attempts, job and batch-attempt IDs, artifact IDs, detached input/workflow SHAs, +`campaign_registry_sha256`, both tag objects and peeled commits, the exact campaign object closure, +environment deployments, service digests, capsule seals, attachment hashes, audit commitments, +and statistical outputs. It rejects name-based latest lookup, duplicates, superseded attempts, +PR/fork origins, a missing predecessor, or any component that does not reconstruct the sealed +registry. It binds the ordered set of all 36 generation capsules, all 36 +`HardScoreRequestSetV1` attachments, and all 36 judge attachments, then creates an +allowlisted bundle artifact whose proposed repository destination is: + +```text +benchmarks/results// +``` + +The bundle includes: + +- campaign registry record, `ProtocolAttestationTagBindingV1`, and input/result commit identities; +- copied native-v2 manifests, tier- and cache-dimensioned dated price snapshot, and per-batch + reviewer attestations; +- both independent identity registries; all three canonical protocol-review statements; all three + ordered verified envelopes; the bundle, attestation root, and bundle digest; frozen REST, + GraphQL and local-signature projections plus separate signature, double-read, creation-actor, and + ruleset observation receipts; the 15-member workflow inventory, derived member hashes, and common + workflow root; +- exact `ProtocolReviewObjectArchiveV1` raw bytes for every T0, C0, tree/blob, Rstat, Rjudge, + Rsecurity, B0, and T1 closure object plus its deterministic manifest, sufficient for a + network-free importer to reconstruct every object, tree delta, Git SHA-1 OID, and + `GitObjectSHA256V1` value offline; +- exact cases, arm hashes, Caveman provenance, protocol hashes, and runner provenance; +- all terminal and retry attempts, errors, exact applied-cache-control evidence, separate + cache-read/cache-write usage and accounting, service-tier request/return/accounting evidence, + returned models, and request metadata allowed by the publication policy; +- generation-context expectation/final roots and the tagged hard-scorer, hard-score, judge, + statistical, audit, provider-projection, and workflow-root lineage; +- generation seals and checksums; +- deterministic hard-score protocol and request-set attachments; +- judge protocol, records, and attachment hashes; +- audit sample manifest, commitments, reveals, original labels, adjudication, and agreement + report; +- scored records, machine summary, bootstrap outputs, human-readable report, and limitations; and +- a complete checksum manifest and reproducibility command that verifies the object closure with + network and credential-access canaries proving that replay performs no API call and reads no + provider or App secret. + +Raw and derived layers remain separately hash-bound. Recomputing an analysis creates a new +attachment; it never mutates generation evidence. + +The complete collector is fail-closed: any missing generation, hard-score, or judge attachment +prevents a performance bundle. A separate secret-free prefix/STOP finalizer handles budget stops, +security incidents, ambiguity, and other operational invalidity. It binds the immutable full plan, +last valid spend ledger, ordered completed prefix, exact expected missing suffix, STOP/incident +reason, artifact inventory and safe provenance, and emits only a registry/incident artifact with no +performance estimate or model comparison. This lets every started input tag receive an outcome +without weakening the complete collector. + +For `credential_exposure`, the prefix/STOP finalizer additionally requires the canonical incident +root, continued denylist, terminal credential-containment and deletion receipts, and proof that no +affected raw artifact is in the safe publication projection. It publishes no scanner match bytes, +secret material, or affected artifact content. + +### 13.2 Review, merge, release, and correction + +The read-only collector seals a checksum manifest, fixed path inventory, and complete-bundle or +prefix-finalizer digest. A secret-free `PublicationPlanV1` then binds that digest; the exact +bundle kind (`complete` or `invalid_prefix`); `campaign_registry_sha256`; both tag-object and peeled +commit bindings; the protected `main` base SHA; the input commit SHA; the ordered set of every +present commitment, reveal, and adjudication merge SHA; the expected result path and tree diff; the +publication workflow SHA; and the proposed branch name. A complete plan +requires the full audit merge set. An invalid-prefix plan instead binds its exact STOP state and +missing-stage suffix and cannot invent absent audit merges. The base must be current `main`, must +contain the input commit and every present bound merge SHA as ancestors, and must not already contain +the result path. Any base movement or proposed-head change invalidates the plan and requires a new +plan and approval. + +The plan's `bundle_kind` and sealed root are mandatory discriminators in every publisher, PR, +validation, merge, collector, and state event. A complete plan may emit only +`PUBLICATION_INTENT_AUTHORIZED` followed by `COMPLETE_PUBLICATION_PR_OPENED` and enter +`COMPLETE_PUBLICATION_PR_OPEN`; an invalid-prefix plan may emit only its typed intent followed by +`INVALID_PUBLICATION_PR_OPENED` and enter `INVALID_PUBLICATION_PR_OPEN`. Required CI checks +reconstruct the discriminator and root from the proposed tree rather than trusting PR labels or +event inputs. Human merge of an invalid-prefix PR emits `INVALID_PREFIX_MERGED` only when admission +succeeds, otherwise `INVALID_PREFIX_MERGE_INVALIDATED`; both outcomes are terminal and safe from +release or promotion, but only the former proves the expected registry lineage. Human merge of a +complete PR may emit `RESULT_MERGED` only with the complete root lineage and post-merge admission +evidence specified in section 7.4; failed admission emits `RESULT_MERGE_INVALIDATED` and enters +`RELEASE_BLOCKED`. Neither path can consume the other's event. + +A separately approved `benchmark-publish` environment job runs trusted publisher preparation from +detached C0 with no App credential. It creates a separate worktree rooted at the exact publication +base SHA, rechecks both protected tag refs against the sealed companion binding, verifies the plan, +`campaign_registry_sha256`, bundle digest, workflow root, and inventory, copies +fixed allowlisted paths byte-for-byte, and verifies the exact expected tree diff and sealed commit +root. It first persists the initial publication intent under section 7.6. Only then does its fixed +byte-blind publisher step reruns the universal fresh pair/policy/registry gate and maps the +publisher-App credential; that step accepts only the intent, +object roots, ref, and PR metadata and creates or adopts only the bound branch and pull request. +Every missing receipt is reconciled before state advances. For an invalidated publication it may +instead fail only the exact terminal-guard check on the bound head and close only that exact plan- +bound PR; the sealed publisher permissions attestation permits `checks:write` solely for this one +context and exact terminalization. It must record the typed +`correction_publication_invalidation` or ordinary publication invalidation receipt as applicable. +It does not parse, score, render, execute, or otherwise interpret untrusted model output, and it has +no provider key or state/release App credential. The read-only repository `GITHUB_TOKEN` is not a +publication authority and cannot approve or merge the PR. + +The publication job does not merge directly. Normal CI, branch protection, conversation +resolution, exact-head validation, and human review apply. The publication contract requires a +maintainer with write access to verify the exact PR head SHA and sealed bundle digest and authorize +the secret-free `publication-pr-validate` check required by branch protection. The publisher App +cannot approve or merge its own PR. After human merge, the protected acyclic graph +`InitialPreauthorizedResultReleasePlanV1` → passing +`SecurityAttestorReceiptV1(purpose="release_preparation")` → +`ExecutableResultReleasePlanV1(intent_kind="initial")` → `ResultReleaseIntentV1` binds the +campaign, `campaign_registry_sha256`, the single companion binding containing both tag identities, +bundle digest, exact publication PR and approved head, merge commit and result-tree digest, result tag name, release workflow SHA, +common workflow root, and asset digests. +A separately approved `benchmark-publish` release-finalizer job rechecks the plan and prepares the +annotated-tag object and sealed opaque assets before any write token is mapped. The separate +downscoped security-attestor job first passes the universal fresh pair/policy/registry gate before +its OIDC/App-token request, then fetches the supported immutable-Releases setting through +`GET /repos/{owner}/{repo}/immutable-releases`; a false/missing response fails closed. The fixed +byte-blind finalizer step then persists `RESULT_RELEASE_INTENT_AUTHORIZED`, repeats the universal +gate immediately before mapping only the +release-finalizer App write token, accepts the bound intent/tag/release/asset roots, and creates or +adopts the protected annotated `benchmark-result-` tag at exactly the merge commit, +checksum-bound draft GitHub Release, and exact assets. It reconciles receipts and performs or adopts +one publish transition before `RESULT_RELEASED`. + +Post-publish verification uses the returned Release `immutable` field and a pinned, versioned +`gh release verify` invocation over the exact repository/tag/release/assets. The design hashes the +canonical setting response, Release fields, pinned CLI/tool digest and output into +`ImmutableReleaseVerificationV1`; it does not claim GitHub REST returned a raw attestation digest. +The finalizer never rewrites result files and records the annotated tag object, release ID, draft, +asset, publish, and verification receipts. Immutable Releases lock the published tag and assets, +but the design does not claim the feature makes Release deletion or every metadata change +impossible. Tag rules, immediate finalizer-token revocation, scheduled exact release inventory +checks, actor alerts, and state policy forbid those operations and expose residual platform risk; +the read-only `GITHUB_TOKEN` performs none of these writes. + +Actions artifacts are temporary review transport, not the durable public record. The committed +result directory and release assets are the publication surface. + +Every started confirmatory input tag gets a registry outcome: + +- valid positive, negative, and inconclusive campaigns publish full allowed evidence; +- an operationally invalid campaign publishes the reason and non-sensitive provenance without a + performance claim; and +- credential exposure found before merge publishes only the safe invalid-campaign incident + projection, while post-merge exposure follows section 12.2 and additionally discloses the + already-public PR/main/tag/Release object IDs, tombstone/removal status, withdrawn-latest status, + and superseding correction without claiming historical erasure. + +Corrections use the durable intent/receipt/adoption/finalization protocol in section 7.5. They create +a new result directory, protected annotated tag, release, and append-only latest-pointer event with +an explicit `supersedes` lineage; existing evidence, states, commits, pointers, tags, and releases +are not rewritten. A `RELEASE_BLOCKED` lineage creates no original result tag or release; its +correction binds and supersedes the blocked merge explicitly. Publication-stage correction failure +records `correction_publication_invalidation`, including terminal `merged_invalid` when applicable; +release-stage correction failure records +`correction_release_invalidation`; no generic correction invalidation is accepted. A successful +correction binds every persisted publication, merge, tag, and release receipt before the final +`CORRECTION_RESULT_RELEASED` CAS. + +### 13.3 Documentation and social claims + +Only after `CampaignStateV1` reaches `RELEASED` with an active, nonwithdrawn latest pointer and no +open credential incident may synchronized result sections be added to the six localized READMEs, +`evals/README.md`, the website, changelog, a new release note, and a dated social package. +`RESULT_MERGED`, `RELEASE_BLOCKED`, `INVALID_PREFIX_MERGED`, +`INVALID_PREFIX_MERGED_INVALID`, and +`latest_status=withdrawn_due_to_credential_exposure` explicitly authorize no documentation, +release-note, website, or social promotion. The historical `v0.1.0-alpha.1` release note and alpha +social package remain unchanged. + +Every numeric claim names the exact model, date interval, campaign, quality gate, eligible-pair +and scenario denominators, interval, and limitation link. Positive `concise - if` direction is +explained next to the number. Visible-output-token brevity is never promoted as billed-output, +total-token, or monetary savings. No numeric claim appears in a context-free hero or social-preview +image. + +## 14. Verification and staged rollout + +### 14.1 Automated verification + +Implementation is test-driven and includes: + +- unit and property tests for delta direction, eligibility, scenario-cluster bootstrap, + visible-versus-reasoning tokens, non-inferiority, outcome classification, sparse/missing + records, and deterministic seeds; +- manifest/request round-trip tests proving literal wire `service_tier: "default"`, exact + `prompt_cache_options` explicit/`30m`, recursive breakpoint absence, forbidden cache keys, + returned applied options, canonical read/write paths, all three closed cache-status mappings, + pinned OpenAI SDK `3.3.1`/lock identity, exact medium reasoning, medium verbosity, and the + `<= 272_000` versioned input-exposure bound in every request identity and wire payload; +- corpus-neutrality tests proving that only prompt-grounded sentence constraints are gating and + that critical-warning case IDs are frozen; +- parent/shard-plan tests proving exactly 36 disjoint 40-row generation projections whose ordered + union is the three 480-row parent plans; +- hard-score/request-set sealing plus judge-schema, prompt-blinding, injection-resistance, + attachment-binding, zero-call attachment, and exact coverage tests; +- audit sampling, certainty-unit coverage, canonicalization, exact two-entry audit identity + registry, exact ordered three-entry protocol registry/statements/envelopes, closed verification modes, + role-specific ordered subject inventories and forbidden fields, numeric-ID/login/signature + binding and non-null security-evidence fingerprint, + commitment/reveal PR ordering, adjudication, weighting, agreement, model/arm-indexed false-fail + sensitivity, quality/brevity extrema, exact-search certificates, and deterministic search-cap + tests, including `M = K = 120` fail-closed exhaustion; +- exact protocol-review DAG golden vectors fixing every synthetic T0, C0, Rstat, Rjudge, + Rsecurity, B0, and T1 Git SHA-1 OID and `GitObjectSHA256V1` value; strict + `ProtocolReviewStatementV1`, mode-discriminated `VerifiedProtocolAttestationV1`, + `ProtocolAttestationBundleV1`, and post-tag `ProtocolAttestationTagBindingV1` canonical-byte, + self-digest, new noncolliding ordered-root domain, path, delta, exact raw-header/message grammar, + `ProtocolReviewObjectArchiveV1` network-free reconstruction, stable ruleset policy, stable + REST/GraphQL projections, separate observation receipts, signer, and local SSH/OpenPGP + verification vectors; repeated observations with different times/request IDs/ETags/orderings + derive identical tag binding/campaign ID/seeds/plans; malformed CanonicalJSON vectors explicitly reject floats, booleans where + integers are required, numeric strings, non-NFC strings, duplicate keys, reordered arrays, and + extra or missing fields; negative DAG vectors reject any attestation in C0, any envelope in its + own reviewer commit, wrong parent, path, role order or companion suffix, extra tree entry/header, + lightweight/nested/moved/deleted ref, mixed campaign, signature/identity/mode/fingerprint + mismatch, tag signature, encoding/mergetag/duplicate header, alternate timezone/config/message, + wrong/changed tag operator, namespace squat, missing or differently authorized creation bypass, + any update/delete bypass, malformed or + noncanonical JSON, semantic ruleset drift, missing/archive-inventory-only object, + raw-object mismatch, or cross-campaign replay; + exact `TagOperatorRegistryV1` and two-entry `TagRulesetPolicyV1` golden vectors prove stable + semantic ordering independent of API order and reject zero/duplicate IDs, extra applicable or + evaluate/disabled rulesets, extra rule, overlap, actor/team/role/App/deploy-key exemption, + missing/wrong `User/always` creation authorization, or any update/delete bypass; + `TagCreationRuleSuiteReceiptV1` vectors require one unique historical create suite for each exact + T0/T1 after OID and reject receipt replay, delete/recreate, zero/nonzero-before mismatch, + different after OID, wrong/extra actor, ambiguous/multiple suites, or update/delete operation; + raw-suite mapping vectors require top-level `bypass`/`fail`, matching actor, one active creation + rule with per-rule `fail`, exclude volatile source name/details, derive rather than invent the + `User/always` grant, and reject invented per-rule actor/bypass fields; + digest-preimage vectors remove exactly each named self field and reject circular, wrong-domain, + or ambient-field hashing; tag lexical vectors reject angle brackets, controls, non-ASCII, + whitespace ambiguity, signed/zero-padded/out-of-range epochs, alternate timezone, or registry/tag + disagreement; archived API-blob vectors recompute every raw/canonical response hash including + both creation suites and reject secret-bearing, missing, reordered, aliased, or mismatched blobs; + golden vectors fix the exact subjects-array root, five-field local-signature receipt root, and + three-field 15-member `WorkflowInventoryV1` root; negatives reject implicit fields, wrong order, + missing/extra member, wrapper/receipt-kind mismatch, embedded self-digest mismatch, or indexed + blob-hash mismatch; +- exact call-count, default-tier price-snapshot attestation, non-null cache-write rates, + `BatchPlanV1`, single-use job receipt, distinct cache-read/cache-write + reservation/reconciliation/evidence, duplicate/rerun rejection, STOP propagation, and + campaign-budget tests, including a definitely-rejected 429-retry-then-success chain whose + attempts remain separately accounted and every closed service-tier accounting status; +- schema-generated `CampaignStateV1` transition table and complete state/event/caller/ref/reason/ + evidence/terminal/resumption reachability-liveness matrix, with tests proving every admitted edge + exists in that one schema, every nonterminal state has a legal continuation, and no broker-only, + table-only, unreachable, wildcard, or wedged edge exists; parent-hash, atomic invalid-event hold, + approved dismissal, complete/invalid publication-state separation, terminal + `INVALID_PREFIX_MERGED`, cross-kind merge/close rejection, + valid and invalid post-merge admission, `RESULT_MERGE_INVALIDATED` release blocking, + terminal `INVALID_PREFIX_MERGED_INVALID`, post-merge benign-hold dismissal, hold-to-STOP, + compare-and-swap race, no-mutation, illegal-jump, + zero-dispatch recovery, resumable-partial, budget-incomplete, publication-replan, + release-blocked, correction-intent preauthorization, phase-exact receipt CAS, the four ordered + state-byte-identical initial-release receipt appends, create/adopt retry, + PR/merge/tag/draft/asset/publish crash-window reconciliation, atomic + `CORRECTION_RESULT_RELEASED` escape, terminal correction append, distinct phase-bound correction + invalidations, the sixth post-merge broker edge for exact typed `merged_invalid` with its + intent/publication-receipt parent and `PostMergeAdmissionFailureV1`, explicit supersession without + a wedge, immutable-orphan + evidence, invalid-finalization, and happy-path property tests; + canonical golden vectors for `GENERATION_SET_SEALED` require the exact ordered 36 capsule hashes, + `generation_context_expectation_sha256`, and `verified_generation_context_root`, and reject an + omitted, extra, swapped, malformed, or independently mismatched root while proving the rendered + transition table is generated from that same required-evidence schema; credential-exposure + vectors require the exact safe `CredentialExposureIncidentEvidenceV1`, every allowed premerge, + post-merge, correction-prefix, and invalid-lineage + parent, current roots, source upload, scanner and containment receipts, artifact denylist, and + the exact complete/invalid PR close-or-merge disposition where applicable, and reject every + cross-kind disposition, reason alias, secret-bearing field, excluded parent, or incomplete receipt; + protocol-authority-drift vectors cover every literal caller/current-parent/ref/reason matrix row, + both no-prior-hold exceptions, null-versus-required complete-publication-PR close receipts, and + prove no wildcard, alternate caller, unreachable edge, restored-ref resume, or post-merge STOP; + moved/deleted-T0 tests reach every parent through the protected-main `benchmark-evidence` + fallback using byte-identical C0 workflows, while safe-invalid tests cover + `STOPPED_INVALID`, `BUDGET_INCOMPLETE`, `INVALID_FINALIZED`, and + `INVALID_PUBLICATION_PR_OPEN` and reject complete publication, provider, release, correction, + restored-ref, or temporary-read effects; + invalid-event tests distinguish pre-auth/transient/benign-sibling audit denial from a single + hold-worthy authenticated rejection, inject hold-CAS races, verify transition-number/root changes + without state-name change, exercise exact dismissal, and require + `invalid_event_nondismissible` as dismiss-hold's sole STOP reason; + dismissal policy/plan vectors reject unregistered or source-equal actors and prove exact hold + consumption by dismissal, premerge STOP, result-merge invalidation, or released correction; + gate vectors admit a nonnull hold only for the four exact atomic consumer classes, require each + successor to clear the bound predecessor root, restrict held-`RELEASED` correction intent to its + four typed nondismissible/exposure/invalidation/drift evidence forms, forbid hold admission during + every nonterminal correction prefix, and require both roots null for every other publication/promotion/release/ + correction/safe-finalization edge; + the closed 23-value STOP enum and strict reason-specific evidence union have a golden vector for + every literal caller/parent/ref/reason/evidence row and negative vectors for aliases, mixed + variant fields, missing source roots, and wildcard grants; +- campaign-binding golden and substitution tests proving `PREFLIGHT_SEALED`, authority genesis, + every `CampaignEventV1`, `BatchPlanV1`, generation context, provider attachment, collector, + publication/correction/release plan and receipt accept only the one sealed + `campaign_registry_sha256`, companion-tag binding, and attestation root, and reject a component + from any other otherwise-valid pair; +- `StateWriterGitIdentityV1` canonical-byte/digest, input-tag/App-account/security-statement/envelope + binding, literal ASCII author/committer line, whole-second epoch/timezone, and mixed-digest + rejection tests; authority-object golden vectors for every permitted tree shape and Git + blob/tree/commit byte, SHA-1 OID, fixed identity/time/message, parentless bootstrap, exact + one-parent event successor, and the sole non-event initial-receipt message/state-byte-identical + successor, proving system/global/local Git config, environment identity, Unicode, + control bytes, and signature/encoding/mergetag headers cannot change candidate bytes; + receive-pack policy tests for the all-zero expected-absent creation, expected-current-old-OID + lease, sibling races, absent/candidate/divergent response-loss reconciliation, duplicate request + adoption, object-upload interruption, thin-base verification, and rejection of every extra + object, ref, parent, mode, tree entry, endpoint, method, object format, empty-repository bootstrap, + malformed status, or conflicting idempotency key; and exact mutation-kind-discriminated + `AuthorityMutationRequestV1`/`AuthorityMutationReceiptV1` canonicalization tests that reject any + generic non-state append, event/receipt field mixture, reordered receipt, or active-root change; +- closed retry-taxonomy, `Retry-After`, jitter, retry exhaustion, 401/403 stop, ambiguous delivery, + soft deadline, forced runner loss, and exact-suffix resume tests; +- tar round-trip, hidden-lock, mode, digest, extraction, traversal, link, overwrite, inventory, + and secret-scan tests, including cross-phase post-upload detection, deletion pending/unavailable, + terminal containment before prefix finalization, and zero later campaign download/provider-call + tests; credential-exposure crash tests inject failure after the pending-incident CAS and after every + containment effect/receipt, prove immediate provider/download denial and idempotent external-state + adoption, exercise both complete and invalid-prefix open-PR close/merge races, every pre/post-intent + release invalidation, bare release-blocked/released correction intent, every correction prefix, + and every artifact-bearing invalid-lineage supplement; cover exposure-before-drift, + drift-during-exposure, and exposure-after-drift supplement orderings without restoring live authority; invalid-prefix + finalization remains blocked until the pending incident/supplement resolves; + state-schema reachability includes `CREDENTIAL_EXPOSURE_PENDING` and every ordinal + `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` self-loop for all eligible parents, exact authority paths + including only provisional/permanent members under the exact `denylist` root tree, and + predecessor/successor roots, protected-main handling under moved/deleted/drifted tags, final + pending-root consumption, and denial of every ordinary mutation/effect while pending; + open-complete-PR drift tests admit current-main `benchmark-publish` only for exposure pending, + ordered close/effect, and final credential STOP from byte-identical frozen workflows, and reject + every other publish event under that exception; + progress-root golden vectors cover empty initialization, ordinal 1, multi-link successors, + zero-padded paths, predecessor mismatch, pending-root/campaign/incident mismatch and cross-pending + replay, gap/reorder/replay, terminal chain equality, exact final consumption/clear, and supplement + construction without a second STOP event; every incident caller row including open-PR close is + reachable in pending/effect/final order; +- exact 15-path C0-derived workflow inventory/root, trigger, read-only `GITHUB_TOKEN`, four-job + provider boundary, three distinct App actors, endpoint policy, rulesets, immutable Releases, + human/App authority separation, OIDC state-broker exact identity projection, fully qualified + caller/callee references, tag/main `ref`/`ref_type`/`sha` and caller/callee SHA semantics, + `typ`/`alg`/`kid`/issuer/audience/subject/time/single-use-`jti`, absent-environment and exact + actor/repository/check-run/rerun-initiator restrictions, minimal reusable-job boundary, + missing/extra/mismatch, unrelated-workflow, and pull-request-ref denial, token expiry; exact + downscoped security-attestor token requests proving only Administration/Metadata/Contents read, + no write scope, and exact rule-suite and immutable-setting endpoints; timely exact authorized-bypass + rule-suite persistence, pre-merge test-SHA rejection, all six exact post-merge caller/event/phase/ + H/M/evidence allow and deny vectors, including correction `merged_invalid`, and post-merge + double-read/containment, plus every + closed phase-specific `PERMANENT_STOP` caller/parent/reason allow and deny vector, including every + allowed and forbidden credential-incident caller/state pair, per-batch environment approval, + campaign concurrency, batch-controller ordering, + universal precredential/preeffect fresh-pair/policy/registry gate for state broker, provider, + publisher, security attestor, and release finalizer, temporary-read no-token/no-effect/no-state, + step-scoped-secret, detached-SHA pinning, Markdown neutralization, and exact artifact-provenance + policy tests; + main-fallback liveness tests prove the existing protected-main check preserves all 15 frozen + members for every nonterminal campaign, the validator runs without a tag trigger, fallback bytes + match C0 at current `H`, and admin-bypassed protection fails closed as the documented limitation; +- schema-generated publication-containment vectors enumerate every exact field once, reject + duplicate/missing/extra names and noncanonical digest preimages, and cover every source/cause/ + phase/finality/event/nullability row. Failure injection delays each possibly delivered branch, + eligibility-check, PR-create, terminal-guard and PR-close write until before preflight, between + the two inventory passes, between CAS and first action, and after terminal-event construction; + dequeue and rerun receive the same four-boundary schedule. Every lost response remains in the + subject/disposition/ledger/vault bijection and can end only in stable reconstruction, + failure-only unavailable sealing, or write-ambiguity fence finality. Generated broker vectors + also cover ordinal gaps/reuse, executor abort before first/next request, partial-read/failure + prefix joins including abort between pagination pages, GraphQL + 200-with-errors/null/partial/malformed bodies, all three first-decisive token closure paths, a + pre-expiry delete whose 204 completes after expiry, response loss after boundary, and zero + same-token post-boundary dispatch starts; +- queue/denylist containment tests exercise each selector independently (PR node ID, PR number, + branch, head OID, marker and canonical head trailer), prove the operation-key audit alone grants + no authority, and reject response-derived queue/check/artifact IDs in pre-mint keys. They inject + enqueue/dequeue/re-enqueue/close/reopen/merge races, response-lost dequeue, every rerun attempt + outcome, same-run-ID exact next-attempt fencing, multiple/expired decision artifacts, the + authenticated-302 plus credential-free ZIP fetch, hostile ZIPs, and zero/duplicate extracted + decisions. Golden hash-DAG vectors require the one-way dispatch -> signed source -> terminal + wrapper -> evidence-set order and reject every wrapper/source back-edge. They distinguish the + old pre-CAS source-success evidence arm from the post-CAS failure/artifact arm, require complete + workflow-suite-derived check-run pagination and unique selection, and cover both natural new- + merge-group and authorized-rerun fence removal arms. Two stable global inventory passes, timeline causality, candidate/action-attempt + partitions, residual-scope exclusions and zero-residual barriers must all recompute; +- containment crash/recovery vectors stop before/after intent construction, signed terminalizing + prefixes, denylist append/CAS, every queue action, both snapshots, main first-parent walk, + barrier, fence attachment, sealed set and terminal CAS. They cover benign unrelated main advance, + side-branch compare members, byte-identical inner/outer first-parent arrays, deterministic + merge-won-disposition projection from the selected merged candidate, rejection of every + single-parent/octopus/direct-push advance, affected late merge, exposure already terminal-ready at start, + exposure detected after start, and fresh protected-main resumption. Every terminal consumer must + preserve the denylist, clear exactly the matching active root, select the source-class finality + DAG, and prevent release/documentation/social authority after a late or ambiguous merge; +- read-only provider-evidence verifier, complete-collector ordering, incomplete-prefix finalizer, + credential-incident schema/canonicalization/quarantine/deletion/revocation/rotation/expiry and + safe-record publication, `PublicationPlanV1` ancestor/base/head movement and closed-PR replan, + minimal App publisher, exact-head manual publication-PR validation, the initial + `InitialPreauthorizedResultReleasePlanV1`/security-attestor/ + `ExecutableResultReleasePlanV1`/`ResultReleaseIntentV1` graph plus + `CorrectionReleaseIntentPlanV1` coverage, annotated-tag/draft-assets/one-publish release + finalizer, and correction-lineage tests; exhaustive + failure injection before and after every initial/correction intent CAS, branch, PR, human-merge + observation, tag, draft, asset, publish, receipt CAS, authority object upload, and ref update, + including response loss, already-existing exact adoption, divergent conflict, draft-list + pagination, 422/502 and `starter` assets, publish-before-final-state recovery, zero duplicate or + orphan success paths, with response loss around the sixth merged-invalid broker/CAS edge, + and pinned `gh release verify`/REST-observation parsing; +- post-merge credential-exposure tests proving exact terminal projection construction, active-pair + and optional-hold consumption, race-form failed admission, pre/post-intent containment, + correction-prefix terminalization and mandatory supersession, rotation/revocation, + affected-object denylisting, current-tree tombstone/removal when appropriate, withdrawn-latest and + correction-lineage behavior, and disclosure of irreversible PR/main/history/fork/fetch exposure + without an erasure claim or release/promotion continuation; +- authority-bound generation-context expectation reconstruction, no-hash-self-cycle, tagged + protocol/workflow-root propagation, exact expectation/final-root binding in the schema-canonical + `GENERATION_SET_SEALED` event and `GENERATION_COMPLETE` record, and rejection of every serialized + or supplied capability surrogate; +- import- and call-graph tests proving all seven public replay commands are offline and + non-evidentiary and that every live hard-score, judge, audit, analysis, and verification workflow + uses the exact Runtime or Publication entrypoint without invoking the public CLI; offline archive + replay installs network and credential-access canaries and proves it neither reaches GitHub nor + reads provider/App secrets; and +- a full synthetic campaign that first constructs and verifies the complete + T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 DAG and then reconstructs the report from published-style + artifacts without a provider secret. + +PR and fork CI remains provider-offline and secret-free: it may fetch pinned actions and locked +dependencies, but it has read-only repository permission and cannot make live model calls. + +### 14.2 Live pilot + +Before constructing the confirmatory pair, the provider-offline synthetic run first constructs and +replays the complete T0/C0/Rstat/Rjudge/Rsecurity/B0/T1 DAG. The repository then configures and +records the stable policy and active rulesets for both pilot tag patterns. On the frozen pilot C0, +the registered tag operator creates an +annotated pilot T0; the three registry reviewers add and sign their one-statement commits serially; +the verifier creates B0 with only the three envelopes and bundle; and the operator creates the +paired annotated pilot T1. Authenticated actor/rule-suite receipts prove the same registered +operator and exact authorized `User/always` creation bypass for both. Pilot preflight double-reads the two refs, verifies the exact closure and +signatures, seals its own `CampaignRegistryV1`, and only then may a separately labeled operational +pilot run one shared scenario in both languages, all four arms, one repetition, and all three +generation models. At most 24 generation and 24 judge attempts are permitted, under the USD 5 cap. +The pilot freezes `max_transient_retries = 0`, so retries cannot raise the actual API-attempt ceiling +above 48. + +The pilot validates API parameters; literal requested and returned `default` service-tier evidence; +returned explicit/`30m` applied-cache-control evidence; separate zero cache-read/cache-write proof +and STOP behavior; returned-model and usage capture; rate behavior; checkpoint transport; judge +schema; and cost accounting. It is never benchmark evidence. The corpus and decision thresholds +cannot be tuned to make the observed pilot effect favorable. A required protocol or implementation +fix creates a new pilot pair, three new reviewer statements and signatures, a new bundle, and a new +pilot campaign identity. Pair-specific statements, reviewer commits, envelopes, B0, T1, and the +post-tag binding from the failed pair are never reused; unchanged content-addressed C0 subobjects +may naturally recur under their identical object IDs. The confirmatory +pair is created only after the implementation is frozen and reverified. + +The operational pilot also creates a disposable one-PR merge queue and proves the rollout-specific +containment contract: complete two-pass global queue inventory, observable `LOCKED` entry, exact +dequeue, re-enqueue under a new merge group, and an authorized rerun that retains the workflow-run +ID while producing exactly `source_run_attempt+1`. It verifies that the fresh failed Actions check +removes or blocks the entry, the persistent denylist makes a later merge-group validator fail, and +an unrelated protected-main descendant is accepted only through the separate walk in which every +advance member is the exact rollout-proved two-parent merge-queue commit; a synthetic single-parent +advance blocks rollout. +The pilot captures the real artifact API 302, follows only the allowlisted Location without +Authorization/cookies, safely extracts the unique decision JSON from the bounded ZIP, and verifies +that every required App permission/endpoint works. Any unsupported queue state, missing timeline, +different rerun semantics, artifact redirect contract or same-SHA validator behavior blocks rollout +rather than weakening the protocol. + +### 14.3 Confirmatory sequence + +The constructive-liveness, credential-finality, and exact-wire gate was satisfied by the 2026-08-31 +exact maintainer/user approval of normative commit +`05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`, recorded by this governance-only successor with the +exact message `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`. Approvals of +`55b90582ae461cf7a3dc072d53d8b03e79fb3614` and +`46147ef62b5bb009421d58928e879d92247d84b5` remain historical evidence for their earlier normative +designs. Implementation may proceed only after plan synchronization; any later normative amendment +repeats the same approval process. + +After that exact approval, plan synchronization, and the still-required implementation, the release sequence is: + +1. the full provider-offline synthetic campaign, including complete serial tag-pair construction + and offline object-closure replay, is green; +2. the live operational pilot in section 14.2 is green under its own non-reusable pair; +3. final code, manifests, methods, settings, seeds, price snapshot, both identity registries, exact + protocol subjects, and `StateWriterGitIdentityV1` are frozen in C0; +4. both final tag-pattern rulesets are active, their stable semantic policy root is frozen, and + separate trust-boundary observation receipts are recorded; +5. the registered tag operator creates final annotated T0 on C0 and records its authenticated + exact authorized-bypass creation actor/rule-suite receipt; +6. Rstat, Rjudge, and Rsecurity each add exactly their fixed-path statement and commit-sign it in + registry order; the verifier requires workflow security, judge/audit, and statistical review to + be green against the common workflow root; +7. the verifier creates B0 with only the three verified envelopes and bundle delta, and the + same registered operator creates deterministic paired annotated T1 on B0 and records the second + authenticated exact authorized-bypass creation receipt; +8. preflight double-reads both refs, verifies the exact object closure, tag rulesets, registry, + statements, signatures, envelopes, roots, and bundle, constructs + `ProtocolAttestationTagBindingV1` and `CampaignRegistryV1`, verifies + `StateWriterGitIdentityV1` against the installed App account ID/login, proves SHA-1 object format + and a nonempty repository, canonically constructs the literal-identity parentless transition-one + object closure, and bootstraps the absent authority ref with one all-zero-old-OID receive-pack + command and an identity-bound `AuthorityMutationReceiptV1`; +9. each required bounded generation batch receives `benchmark-live` approval and runs in order; +10. all generation capsules are sealed, the authority-bound generation-context expectation is + reconstructed, and `GENERATION_SET_SEALED` atomically binds the exact ordered 36 capsule hashes, + `generation_context_expectation_sha256`, and `verified_generation_context_root` into + `GENERATION_COMPLETE`; then the deterministic hard-score/request-set attachments are sealed; +11. each required bounded judge batch receives `benchmark-live` approval and runs in order; +12. generation, hard-score, and judge artifacts pass read-only provider-evidence integrity + validation and `EvidenceInventoryV1` is sealed; +13. two reviewers complete commit-reveal and adjudication; +14. capsule-bound aggregation classifies every model outcome; +15. the complete read-only collector seals the final bundle from provider evidence, audit, and + analysis; +16. `benchmark-publish` receives separate approval for the exact `PublicationPlanV1`, first seals + `PUBLICATION_INTENT_AUTHORIZED`, then maps only the publisher App in the fixed step and creates + or adopts the exact result branch/PR from the verified main base; +17. a maintainer approves publication-PR validation for the exact head SHA and the reviewed PR + merges; +18. the read-only attestor promptly persists the exact passing main-merge rule suite and the + broker double-reads main, reconstructs `PostMergeAdmissionEvidenceV1`, and records the observed + merge event; failed complete admission enters `RELEASE_BLOCKED`, while failed invalid-prefix + admission enters its terminal invalid-merge state; +19. `InitialPreauthorizedResultReleasePlanV1`, the passing release-preparation attestor receipt, + and `ExecutableResultReleasePlanV1(intent_kind="initial")` bind the observed merge commit and + asset digests; then `ResultReleaseIntentV1` is accepted and + `RESULT_RELEASE_INTENT_AUTHORIZED` is sealed before any tag/Release effect; +20. the separately approved release finalizer maps only the release App, creates or adopts the + protected annotated result tag, draft release, and checksum-bound assets, verifies them, and + performs or adopts one publish transition with every receipt reconciled; and +21. documentation, website, and social result packages are updated from the active, nonwithdrawn + released lineage. + +If a correction PR is observed merged but fails admission, its exact typed `merged_invalid` event +uses the sixth post-merge broker exception, records `PostMergeAdmissionFailureV1` with no later +effects, and terminates that correction attempt. Rollout may continue only through a newly approved +correction ID that explicitly supersedes the failed correction and contaminated merge; it cannot +resume the failed attempt or skip to tag/release/latest/promotion. + +From the first provider artifact upload through `COMPLETE_PUBLICATION_PR_OPEN`, every consuming +phase scans its exact inputs and proposed outputs before its success transition; the designated +`benchmark-evidence` scanner may also be dispatched against any exact eligible current-state +inventory. A credential-exposure finding immediately takes the caller/state-specific incident path, +first CAS-installs `CREDENTIAL_EXPOSURE_PENDING` and the provisional denylist, then executes only +the inventoried idempotent effects with one `CREDENTIAL_EXPOSURE_EFFECT_RECORDED` receipt per +effect and advances the deterministic predecessor-linked progress root, and only after the terminal +chain equals the inventory consumes the exact active root through final STOP or supplement. +It then uses only the safe prefix/incident publication path and never resumes the numbered success sequence. A finding after +`RESULT_MERGED` or `RELEASED` follows release invalidation or correction instead. + +At any authorized prepublication `PERMANENT_STOP`, or any provider-stage `BUDGET_EXHAUSTED`, the +sequence branches immediately to the prefix/STOP finalizer and safe invalid-campaign publication +path defined by `CampaignStateV1`. It does not continue to a later live, audit, aggregate, complete +collection, or complete-publication stage. + +## 15. Known limitations + +- Twelve independent scenario clusters can produce wide intervals. Inconclusive is an expected and + acceptable outcome. +- The corpus is a compact response suite, not a universal task distribution. +- OpenAI model IDs and returned snapshot identifiers or service behavior can change. Requested and + returned identifiers, timestamps, settings, and limitations are disclosed, but a hosted API + cannot provide perfect future reproducibility. +- Sol judging Sol is not fully independent. The two-person audit measures disagreement but does + not remove every judge bias. +- A public artifact reveals benchmark responses before final publication to anyone who retrieves + it; blinding is enforced by the reviewer protocol, not by pretending the repository is private. +- Secret scanning cannot prove that an uploaded artifact contains no credential, and deleting an + artifact cannot retract prior public downloads. The cross-phase `credential_exposure` path + revokes or expires the credential, blocks later campaign downloads and calls, and invalidates the + campaign, but it cannot prove that disclosure did not already occur or that every external copy + was destroyed. +- After a merged PR, tombstone or removal commits can clean the current tree but cannot erase Git + history, PR transport, forks, clones, caches, or prior fetches. The denylist, withdrawn-latest + status, incident disclosure, and corrected lineage prevent future campaign use and promotion; + they are containment and supersession, not retraction. +- A forced runner loss can occur before the post-controller `always()` upload. Per-shard seals limit + already-uploaded evidence loss, but work produced across multiple shards inside the current batch + can still be lost; retained reservations and STOP behavior prevent unsafe continuation but cannot + recover that work. +- GitHub environment approval is job-scoped. A long campaign may require several manual approvals, + one for each bounded generation or judge batch; there is no campaign-wide approval primitive. +- Publication requires one protected approval to create the exact result PR and another to create + the post-merge result tag/release; these are separate App-credentialed jobs. +- GitHub App permission grants are broader than the intended state, publisher, and release roles. + Fixed tools, endpoint tests, rulesets, immutable Releases, receipts, and actor restrictions reduce + that exposure but do not make it a platform-enforced least-capability boundary. +- The state-writer broker is an additional trusted availability and identity-verification boundary. + A broker outage stops state progress; a claim mismatch cannot fall back to a stored App key. Its + receive-pack implementation, isolated object construction, exact endpoint policy, and durable + request log are trusted. A failed pack may leave content-addressed unreachable objects in GitHub's + object store, but never an admitted ref movement; reconciliation records that residual fact. +- GitHub APIs do not offer one universal idempotency header across refs, PRs, tags, and Releases. + Serialized exact pre-read/effect/post-read adoption closes ordinary and correction crash retries, + but a conflicting external object terminates through the typed invalidation path and remains + disclosed evidence rather than being rewritten. +- `github_verified_commit` deliberately trusts the authenticated online GitHub REST/GraphQL + observations frozen by preflight. Offline replay can prove that the stable projections match the + archived raw commit and preserved observation receipts, but cannot independently authenticate + GitHub as their historical origin. SSH/OpenPGP modes additionally retain locally verifiable + cryptographic evidence and do not have this particular limitation. +- Historical repository rule suites are retained by GitHub for a bounded period, so the read-only + attestor must persist the exact suite promptly; delayed recovery without that record fails closed. + GitHub's immutable-Releases feature locks the published tag and assets, but this design does not + claim the Release object is platform-undeletable or that all metadata is forever immutable. + Token revocation, tag rules, inventory monitoring, actor alerts, and the public authority record + mitigate rather than eliminate that platform-administrator risk. +- API price estimates are not invoices. Cache reads, cache writes, and returned service-tier detail + remain provider evidence: missing detail retains worst-case exposure and can invalidate the run. + The campaign intentionally authorizes neither long-context pricing nor a service tier other than + literal `default`. +- The seven public replay commands are useful for offline reproduction but intentionally cannot + recreate live campaign authority or evidentiary capabilities. +- Human audit requires two available reviewers and timely reveal before temporary Actions + artifacts expire. +- Human audit uses only 24 targeted primary-arm records per model under the agreed 144-record + workload. Model-specific intervals can therefore be wide even when point-estimate gates pass. +- The exact false-fail sensitivity search is deliberately compute-bounded. A large feasible + assignment space can force a semantic result to inconclusive even when observed-data gates pass. +- Delimiting candidate text and removing authority reduce judge prompt-injection risk but cannot + prove that model judgment is unaffected by adversarial response content. + +## 16. Acceptance criteria + +The system is ready for the full campaign only when: + +- the governance prerequisite is satisfied by this governance-only successor recording the + 2026-08-31 exact approval of normative commit + `05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126` with message + `Одобряю amendment 05e3d7ba86fbaa11a7c9e4072dc1f24039bd7126`; approvals + `55b90582ae461cf7a3dc072d53d8b03e79fb3614` and + `46147ef62b5bb009421d58928e879d92247d84b5` remain historical, the implementation plans must be + synchronized before implementation proceeds, and any later normative amendment requires another + exact approval; +- every item in the automated verification section is fresh and green; +- all three native-v2 manifests collectively yield exactly 1,440 parent-plan rows, and the 36 + hash-bound shard plans form an exact disjoint 36-by-40 partition; +- Runtime and Publication campaign-side stages bind every live hard-score, judge, audit, analysis, + verification, and bundle attachment to its exact authority parents through the exact internal + entrypoints, while all seven public replay commands remain offline and non-evidentiary; +- manifest/request evidence captures literal wire `service_tier: "default"`, returned-tier evidence + and the exact closed accounting vocabulary; literal `prompt_cache_options` explicit/`30m` with + forbidden cache keys and no breakpoint; exact returned applied-control/read/write paths and + separate exhaustive status enums; pinned SDK/lock identity; medium reasoning; medium verbosity; + and the reasoning-token breakdown required for visible-token scoring; +- every requested model ID has a reviewed non-null cache-write rate, both tier fields equal + `"default"`, the versioned conservative input bound is at most `272_000`, and neither + authorization nor reservation can select long-context pricing; +- the corpus-neutrality edit and warning-severity schema are frozen and validated; +- the workflow can reconstruct, verify, and resume an exact tarred checkpoint including + `.laconian.lock`; +- the `CampaignStateV1` dispatcher rejects every illegal, duplicated, skipped-parent, STOP-to-live, + and partial-to-complete event without state mutation, atomically blocks on + `InvalidEventHoldV1` until approved dismissal or the phase-appropriate STOP, release-block, or + correction path, and permits zero-dispatch recovery only with exact `never_started` reservation + evidence; every mutation is serialized and compare-and-swapped against the exact state/hold root; + the schema-generated reachability/liveness matrix has no broker-only, table-only, unreachable, or + wedged edge; pre-auth/transient/benign-sibling denials cannot create a hold, exactly one + authenticated hold-worthy rejection can, dismissal clears exactly that hold, and dismiss-hold + has only the literal `invalid_event_nondismissible` STOP route; + dismissal uses only the C0-frozen identity policy and strict plan, every nondismissible exit + consumes its exact hold root, and safe finalization requires no unresolved hold or pending + credential incident; dismissal OIDC/rerun actors are caller-discriminated from normal operator + dispatch and bind the exact authorized dispatcher fields; a nonnull hold is admitted only by the + four exact atomic consumer classes, each clears its bound predecessor root, held `RELEASED` + correction intent is discriminator-restricted, and every other gated edge requires both roots + null; + complete and invalid publication PRs occupy distinct states, only a complete sealed-root lineage + can reach `RESULT_MERGED`, both invalid-prefix merged outcomes are terminal and cannot release or + promote, and an already-merged complete PR that fails admission reaches `RELEASE_BLOCKED`; + the sole `RELEASE_BLOCKED` escape is an atomic `CORRECTION_RESULT_RELEASED`, a correction from + `RELEASED` only appends terminal history, every correction external effect is preauthorized and + receipt-reconciled/adoptable after crashes, `merged_invalid` terminates and can be explicitly + superseded rather than wedging, the exact typed merged-invalid event is reachable only as the + sixth post-merge main exception from its correction intent/publication-receipt phase with + `PostMergeAdmissionFailureV1` and no-later-effects evidence, and the two phase-bound correction + invalidations cannot alias; +- every active publication/correction prefix terminalizes only through + `PUBLICATION_TERMINAL_CONTAINMENT_STARTED` and its matching + `PublicationTerminalContainmentFinalityV1`; request/receipt/tree schemas prove the monotone + denylist append and active-root `null -> intent -> null` CAS sequence. Signed broker/vault + prefixes, arbitrary-delay write-ambiguity subjects, two-pass global queue inventory, typed + dequeue/timeline/rerun attempts, Actions-validator fence evidence, the authenticated-302/ + credential-free bounded-ZIP artifact chain, two post-action snapshots and safe main first-parent + walk are complete and bijective. Premerge and merge-won DAGs are disjoint, residual barriers + exclude exactly preserved merged candidates, token closure proves zero same-token dispatch starts + after its first-decisive boundary, all terminal consumers preserve the denylist and clear only the + matched root, and late/ambiguous merge can never authorize release, docs, website or social output; +- every authority mutation is constructed by the broker from exact schema bytes into the closed + SHA-1 blob/tree/commit shape, transition one uses a parentless commit and all-zero-old-OID + expected-absent receive-pack creation, every successor uses the exact expected old OID and + one-parent fast-forward child, response loss reconciles only absent/exact/divergent outcomes, and + no extra object, ref, parent, tree member, mode, endpoint, or REST pseudo-CAS is admitted; the + input-tag `StateWriterGitIdentityV1` fixes the literal ASCII author/committer name/email bytes, + exact installed App numeric ID/login and digest, appears in the ordered security statement, + verified envelope, and every event/intent/request/receipt, and candidate construction ignores Git + config/environment and + forbids alternate identity, control/Unicode bytes, signature/encoding/mergetag headers, timestamp, + or timezone; +- every post-upload `credential_exposure` STOP uses the canonical safe + `CredentialExposureIncidentEvidenceV1`, reproduces the exact current authority/state/ledger/ + inventory/plan/hold roots and affected upload/run/job, binds the closed secret classification, + scanner verification, credential containment, quarantine/deletion and no-further-campaign- + download receipts, closes an open complete PR with the publisher App before STOP, and is accepted + only after its broker-CAS pending incident/provisional denylist and every terminal idempotent + containment receipt; crash recovery cannot reopen provider/download authority, merge races use + postmerge invalidation/correction, concurrent drift is recorded while exposure containment wins, + and exposure after drift STOP uses the two-phase terminal supplement that blocks invalid-prefix + finalization until resolved; pending/progress are explicit expected-OID self-loop events with + append-only authority members, deterministic predecessor-linked progress roots, crash-adoptable + receipts, complete-inventory terminal chain, and final exact-root consumption; every incident + caller/ref row reaches pending, progress, and final handling, including publisher-only PR close; +- the exact two-entry audit registry and exact three-entry ordered protocol registry bind numeric + IDs, logins, closed verification modes and fingerprints, the security-evidence fingerprint is + non-null, every role has exactly its ordered required subject inventory and no forbidden field, + the three ordered statements/envelopes/root verify, and neither registry can substitute for the + other; +- C0 and `CampaignInputPackageV1` contain no protocol-review statement, envelope, attestation root, + or companion binding; T0 and T1 are annotated-only protected deterministic pairs; the exact + serial C0/Rstat/Rjudge/Rsecurity/B0 topology, one-parent fixed-path reviewer deltas, B0-only + three-envelope/bundle delta, exact raw tag/commit header and canonical-message grammar, strict + CanonicalJSON schemas, stable REST/GraphQL projections, separate transport receipts, local + keyed-signature verification, same frozen tag operator with exact authorized-bypass create receipts, and + every Git SHA-1/raw-object SHA-256 golden vector verify; the exact one-operator registry and + exactly two active disjoint rulesets have stable semantic order, each tag has a unique nonreplayed + historical creation-suite receipt proving the sole frozen `User/always` authorization, and + preflight double-reads both refs and exact + closure, verifies the stable policy root with fresh separate receipts, and rejects movement, deletion, + substitution, mixed campaigns, wrong identity/path/parent/order, malformed bytes, missing objects, + or repair in place; + every new registry/policy/receipt/archive digest has an exact noncircular domain-separated + CanonicalJSONV1 preimage, every archived API response hash recomputes offline from safe bytes, + and tagger identity/epoch bytes satisfy the one closed lexical grammar; subjects, local signature + verification, and the exact 15-member workflow inventory reproduce their specified roots; +- `ProtocolAttestationTagBindingV1` originates only in preflight/authority evidence as live + authority and is copied downstream only through the sealed registry; canonical + `CampaignRegistryV1` derives campaign ID from its payload and binds T0/C0, all three reviewer + commits, B0/T1, signatures, bundle/root, workflow and stable ruleset policy; observation metadata + cannot change identity; `campaign_registry_sha256` is + unchanged in authority genesis, every event and `BatchPlanV1`, generation context, provider/audit/ + analysis evidence, collector, publication/correction/release records, and exact-byte + `ProtocolReviewObjectArchiveV1`, whose network-free importer reconstructs every closure object; +- the exact ordered 15-path workflow inventory derives its member hashes and common root only from + verified C0 bytes, and protocol statements/envelopes, generation context, provider projection, and + publication all verify that same root; +- the authority-bound generation-context expectation is reconstructed only in campaign memory, + binds campaign/registries/predecessor/generation layer and expected context digest without a hash + self-cycle, the schema-canonical `GENERATION_SET_SEALED` evidence and resulting + `GENERATION_COMPLETE` both require `generation_context_expectation_sha256` and + `verified_generation_context_root` alongside the ordered 36 capsule hashes, and that lineage + carries the tagged hard-scorer plus hard-score, judge, statistics, audit protocols and workflow + root through final provider and publication evidence; +- the repository `GITHUB_TOKEN` is read-only everywhere; the four-job provider boundary is exact; + the state-writer, publisher, and release-finalizer Apps are pairwise distinct and repository + scoped; the state token broker admits only the exact repository/actor identity, fully qualified + caller and reusable-workflow paths at the exact tag or main ref, real + `workflow_sha`/`job_workflow_sha` caller/callee semantics, event/check-run/OID tuple, minimal + reusable job, frozen crypto/audience/subject/time/single-use-token policy, REST-verified rerun + initiator, phase-specific caller/parent/reason STOP authority, and the exact cross-phase + credential-incident matrix, all six exact post-merge main exceptions including correction + `merged_invalid`, and denies every unrelated workflow, ref, identity, + missing/extra/mismatched claim, predecessor, reason alias, artifact, or event; App/provider + credentials are mapped only in their fixed, separately authorized boundaries with no + provider-key/model-output overlap; the same exactly-three-App topology supplies a separately + downscoped, read-only Administration/Metadata/Contents security-attestor token whose returned + permissions and exact rule-suite/immutable-setting reads are receipt-bound and contain no write + scope; every provider/App/OIDC credential and external effect is preceded by the universal fresh + pair/policy/registry gate, temporary read failure creates no token/effect/state, and every + premerge drift edge uses the literal exhaustive matrix and typed evidence/close receipt while + post-merge drift uses only release invalidation or correction; moved/deleted-tag containment is + reachable from every live prepublication state through the existing main-trigger evidence + workflow, and only the frozen-closure safe-invalid matrix may continue after any sealed STOP or + budget invalidity, with no new App, workflow, environment, or secret; reachability assumes the + existing protected-main check preserves all 15 C0 workflow members while campaigns are live and + fails closed if platform administration bypasses that invariant; + at an open complete-publication PR under proven drift, current-main `benchmark-publish` admits + only exposure pending/effect, publisher-only close, and final credential STOP from byte-identical + frozen workflow members; +- serial protocol-reviewer statement commits, audit-reviewer commits/PRs, tag-operator acts, + maintainer validations/approvals, and protected human merges remain distinct human authorities + and cannot be replaced by any automated App or workflow; +- the batch controller and every later artifact-consuming phase prove predecessor-ledger, + single-use job receipt where applicable, per-attempt reservation, permanent STOP, soft-deadline, + exact-suffix resume, and zero-subsequent-download/call behavior for authentication, permission, + ambiguity, credential exposure, and missing state; +- preflight and the durable ledger enforce the USD 75 authorized-exposure scheduling bound from + the frozen default-tier, cache-dimensioned price snapshot and reviewer attestation, account + nonzero writes before STOP, retain worst-case exposure for missing write/tier detail, and stop + before a batch that cannot fit; +- the operational pilot completes within its USD 5 bound with consistent returned models and + complete usage; +- judge, statistics, audit, and security protocols are frozen, attested, and hash-bound; every + critical judge-pass primary record is audited; and the two audit-reviewer identity-bound + commitment/reveal chains verify; +- model/arm-indexed false-fail sensitivity recomputes semantic quality and brevity, verifies exact + extrema certificates, and becomes inconclusive on deterministic search-cap exhaustion; +- the read-only collector rejects an incomplete performance bundle, the prefix/STOP finalizer emits + only safe invalid-campaign provenance, and the minimal publisher copies only an exact sealed + allowlist; +- `PublicationPlanV1` starts from exact current `main` containing every bound audit merge; durable + initial intent precedes each branch/PR and release effect; the publisher App creates, adopts, or + closes only its exact plan-bound branch/PR; post-merge admission independently proves the exact + protected merge commit/tree/parents/actor/checks/approvals and timely passing main-merge rule + suite while permitting only a verified first-parent current-main descendant with unchanged result + subtree; the exact initial preauthorized/attested/executable release-plan graph binds that + observed merge tree (and `CorrectionReleaseIntentPlanV1` does so for correction), and the release App creates or + adopts only the protected annotated tag, verified draft/assets, and one publish transition; + every response-loss window is receipt-reconciled, base/head movement has an exact closed-PR replan + transition, and a verified post-merge defect takes its typed terminal or release-block path; +- documentation, website, release-note, and social updates are impossible before `RELEASED` and + remain forbidden for `RESULT_MERGED`, `RELEASE_BLOCKED`, `INVALID_PREFIX_MERGED`, or + `INVALID_PREFIX_MERGED_INVALID`; a post-merge credential incident withdraws latest, contains and + discloses the affected objects, and uses a tombstone/corrected lineage without claiming that Git + history, PR transport, forks, clones, caches, or prior fetches were erased; +- endpoint-policy tests, actor restrictions, receive-pack expected-old-OID receipts, historical + exact creation-bypass and passing main-merge rule-suite evidence, protected rulesets, canonical immutable-setting/Release observation, + and pinned `gh release verify` evidence constrain the technically broader App permissions, and no + workflow token can approve or merge a PR; +- protected annotated input/companion/result tags, all three App installations, the state-broker OIDC/claim policy, + actor restrictions, immutable Releases, and both GitHub environments are configured; and +- the maintainer explicitly approves the live workflow deployment. + +The project is ready to claim a model-specific result only after the full campaign also satisfies +the integrity, coverage, quality, audit, and publication gates in this specification. + +## 17. Authoritative references + +- [Laconian benchmark methodology](../../../benchmarks/methodology.md) +- [Evaluation data contract](../../../evals/README.md) +- [Generation capsule design](2026-08-24-v0.1-generation-capsule-design.md) +- [GitHub environments and deployment protection](https://docs.github.com/en/actions/reference/workflows-and-actions/deployments-and-environments) +- [GitHub Actions limits](https://docs.github.com/en/actions/reference/limits) +- [GitHub Actions artifact storage](https://docs.github.com/en/actions/tutorials/store-and-share-data) +- [Secure use of GitHub Actions](https://docs.github.com/en/actions/reference/security/secure-use) +- [GitHub `GITHUB_TOKEN` workflow-run behavior](https://docs.github.com/en/actions/concepts/security/github_token) +- [GitHub OpenID Connect token claims](https://docs.github.com/en/actions/reference/security/oidc#oidc-token-claims) +- [GitHub OIDC with reusable workflows](https://docs.github.com/en/actions/how-tos/secure-your-work/security-harden-deployments/oidc-with-reusable-workflows#how-the-token-works-with-reusable-workflows) +- [GitHub calling reusable workflows](https://docs.github.com/en/actions/how-tos/reuse-automations/reuse-workflows#calling-a-reusable-workflow) +- [Git receive-pack protocol](https://git-scm.com/docs/gitprotocol-pack.html) +- [GitHub Git references API](https://docs.github.com/en/rest/git/refs) +- [GitHub Git commits and verification object](https://docs.github.com/en/rest/git/commits) +- [GitHub GraphQL `GitSignature`](https://docs.github.com/en/graphql/reference/git#gitsignature) +- [GitHub rules available for rulesets](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-rulesets/available-rules-for-rulesets) +- [GitHub repository rule suites](https://docs.github.com/en/rest/repos/rule-suites) +- [GitHub immutable-Releases setting](https://docs.github.com/en/rest/repos/repos#check-if-immutable-releases-are-enabled-for-a-repository) +- [GitHub list Releases, including authenticated drafts](https://docs.github.com/en/rest/releases/releases#list-releases) +- [GitHub published Release lookup by tag](https://docs.github.com/en/rest/releases/releases#get-a-release-by-tag-name) +- [GitHub upload a Release asset](https://docs.github.com/en/rest/releases/assets#upload-a-release-asset) +- [GitHub immutable Releases](https://docs.github.com/en/code-security/concepts/supply-chain-security/immutable-releases) +- [OpenAI project and restricted-key controls](https://help.openai.com/en/articles/9186755-managing-projects-in-the-api-platform) +- [OpenAI Responses create API reference](https://developers.openai.com/api/reference/cli/resources/responses/methods/create) +- [OpenAI prompt caching guide](https://developers.openai.com/api/docs/guides/prompt-caching) +- [OpenAI GPT-5.6 model guidance](https://developers.openai.com/api/docs/guides/latest-model) +- [OpenAI GPT-5.6 Sol](https://developers.openai.com/api/docs/models/gpt-5.6-sol) +- [OpenAI GPT-5.6 Terra](https://developers.openai.com/api/docs/models/gpt-5.6-terra) +- [OpenAI GPT-5.6 Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna)