feat: add read-only case growth convergence verifier - #87
feat: add read-only case growth convergence verifier#87raylee-hawkins wants to merge 65 commits into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6ab0e6029f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| @@ -1521,7 +1539,7 @@ def build_sample_case_event(repo_root: Path) -> dict[str, Any]: | |||
| "ledger_version": CASE_LEDGER_VERSION, | |||
| "case_id": packet["case_id"], | |||
| "detection_id": packet["detection_id"], | |||
| "truth_class": "SYNTHETIC_TEST_CASE", | |||
| "truth_class": "CONTROLLED_TEST_CASE", | |||
There was a problem hiding this comment.
When the factory operates on the tracked evidence/autosoc-case-ledger-v0.sqlite, this new value violates the database's persisted case_events.truth_class CHECK constraint, which still permits SYNTHETIC_TEST_CASE rather than CONTROLLED_TEST_CASE; CREATE TABLE IF NOT EXISTS does not update that schema. Consequently, sample initialization and controlled manual-fire/correction appends fail with an SQLite integrity error, while the updated metrics no longer count the four existing rows using the old value. Migrate the existing table and rows, or support both values during a transition, before emitting the renamed class.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ff827f459a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| flags=re.IGNORECASE, | ||
| ) | ||
| for clause in clauses: | ||
| bounded_clause = clause_negation.search(clause) is not None |
There was a problem hiding this comment.
When a prose value contains any negation earlier in the same punctuation-delimited clause, bounded_clause suppresses every later promotional match, even across a conjunction. For example, not stale and customer deployed passes this verifier, and the convergence scanner has the same behavior, so an authority-boundary or freshness-policy string can assert a blocked public claim without either required CI gate rejecting it. Scope the negation to each matched phrase or split conjunctions into separate clauses.
Useful? React with 👍 / 👎.
| parsed = datetime.fromisoformat(value.replace("Z", "+00:00")) | ||
| except ValueError: | ||
| return None | ||
| return parsed if parsed.tzinfo is not None else parsed.replace(tzinfo=timezone.utc) |
There was a problem hiding this comment.
When the website status supplies a timestamp such as 2026-07-22T12:00:00 without an offset, this branch silently interprets it as UTC instead of classifying freshness as unresolved. A producer emitting local wall-clock time can therefore shift the calculated age by its timezone offset and make stale data appear fresh; require an explicit timezone as the standalone contract verifier already does.
Useful? React with 👍 / 👎.
1 participant
Repair objective
Close the adversarial convergence findings owned by this repository and make its trust-boundary verification fail closed under exact content identity and reviewed source selection.
Findings closed
PP-PLATFORM-001,PP-PLATFORM-002,PP-PLATFORM-003,INT-002,INT-003Authority surface
platform contract and read-only mechanical convergence truth only
Before / after attack behavior
Before: content-addressed currentness, rewrite projections, and zero-mutation enforcement admitted one or more malformed, ambiguous, stale, unbound, or CI-unenforced states identified by the adversarial packet.
After: closed schemas, canonical identity and path checks, recursive claim controls, content-addressed provenance, reverse inventory, replay/pair binding, and required CI reject the attacks while preserving only the bounded authority surface.
Files changed (19)
.github/workflows/governance-gate.yml.github/workflows/hoxline-main-checks.yml.github/workflows/hoxline-private-canary.yml.github/workflows/hoxline-schedule-gated-collection.yml.github/workflows/hoxline-source-checks.yml.github/workflows/hoxline-trusted-runtime-verify.yml.github/workflows/local-gpu-triage-gate.yml.github/workflows/runtime-case-collector-v0-linux.yml.github/workflows/runtime-case-collector-v0-windows.ymlcontracts/examples/hoxline-remote-lab-authority-v1.controlled.jsoncontracts/hoxline-case-growth-source-manifest-v1.jsoncontracts/public-status-source-contract-v1.jsondocs/factory/DETECTION_FACTORY_CONTROLLER_V0.mdscripts/ho_factory.pyscripts/verify-public-status-source-contract.pytests/test_hoxline_case_growth_convergence.pytests/test_hoxline_private_reviewer_cockpit.pytests/test_hoxline_runtime_ops.pytests/test_verify_public_status_source_contract.pyPositive tests
python -B scripts/ho_factory.py hoxline-case-growth-convergence-verify --repo-root .. --format jsonpython -B scripts/verify-public-status-source-contract.py --format jsonpython -B -m unittest discover -s testsHostile tests
Required CI and current results
required-files—SUCCESS— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008885/job/89397017633PR/source checks—SUCCESS— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008878/job/89397017611ho-det-011-case-packet—SUCCESS— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008885/job/89397017779runtime-route-proof-v1-private-candidate—SUCCESS— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008885/job/89397017710runtime-collector-eligibility-v0—SUCCESS— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008885/job/89397017668lifetime-case-ledger-v1—SKIPPED— https://github.com/HawkinsOperations/hawkinsoperations-platform/actions/runs/30066008885/job/89397018257Clean room
PASS— Canonical GitHub clones at the exact seven final heads were tracked-clean and passed the command-center source set, 77 detection tests, 134 validation tests, 81 proof tests, 215 Platform tests, atomic Case Growth generation and verification, aligned Hoxline batch replay, Website generation and verification, and the declared claim and mutation boundaries.Cross-repository dependency state
Related PRs:
Generated artifact state
No pre-merge semantic regeneration remains. The Hoxline JSON/Markdown pair is atomic and current by authority blob identity; Website generation verifies at its sealed content identity. After each separately authorized merge wave, record the actual main heads and rerun owning and seven-repository convergence checks. If authority blobs are unchanged, only freshness observations require refresh; final GitHub merge SHAs remain unknown before merge.
Known limitations
POST_MERGE_FOLLOW_UP— Website dependency advisories: npm audit reports three high and zero critical advisories: Next 14.2.35 via PostCSS 8.4.31 and Sharp 0.33.5; npm proposes semver-major Next 16.2.11 and Sharp 0.35.3, so no unrelated major upgrade was taken in this repair scope.ENVIRONMENT_ONLY— Playwright default browser cache: The default browser cache lacked the declared Chromium binary; an isolated install under the approved Data root produced 5/5 passing visual tests.ENVIRONMENT_ONLY— Python cache directories: Only attributed untracked scripts/tests pycache directories remain in detections, validation, and Platform; no tracked or overlapping dirt exists.NON_ISSUE_WITH_EVIDENCE— Platform ledger job skip: The mutation-capable ledger job is intentionally excluded from pull-request execution; required source and convergence checks ran and succeeded, and the skip cannot satisfy or mask them.NON_ISSUE_WITH_EVIDENCE— Atomic generated-pair parent observations: The final pair verifies with zero errors. Its command-center and Hoxline observed heads are explicitly classified as expected historical context created by committing the pair and then sealing its immutable head; their authoritative blobs are current.MERGE_BLOCKING— Eligible independent human review: All seven PRs have zero submitted reviews and zero unresolved threads. Visible eligible human review and explicit MERGE_APPROVED remain required; green CI and Codex review are not approval.Private-data and claim-boundary scans
PASS; zero credential, private-key, MUFG, customer-identifier, or raw private-evidence exposure; five lexical hits were verifier patterns, negative fixtures, or explicit do-not-publish guidancePASS; promotion vocabulary appears only in blocked-claim data, bounded proof ceilings, verifier deny-lists, and hostile testsPASS; zero tracked hits across 246 changed filesReplacement review packet
C:\Raylee\Work\HawkinsOperations\repair-sprint-v1\FINAL_REVIEW_AND_MERGE_REHEARSAL.mdBCD3041112E4B845F604794B240449C64ED6AA265420F727FEAFB5A6A201F32AGovernance boundary
Proof ceiling:
CONTROLLED_REPO_CONVERGENCE_AND_LOCAL_FIXTURE_REVIEW_ONLYGreen CI is not approval. No merge is authorized. Independent eligible human review and explicit
MERGE_APPROVEDremain required.