feat: converge case growth and expand fixture review - #26
Draft
raylee-hawkins wants to merge 71 commits into
Draft
feat: converge case growth and expand fixture review#26raylee-hawkins wants to merge 71 commits into
raylee-hawkins wants to merge 71 commits into
Conversation
This was referenced Jul 23, 2026
Draft
Draft
feat: add read-only case growth convergence verifier
HawkinsOperations/hawkinsoperations-platform#87
Draft
added 24 commits
July 23, 2026 12:33
raylee-hawkins
marked this pull request as ready for review
July 24, 2026 05:53
raylee-hawkins
marked this pull request as draft
July 24, 2026 13:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Repair objective
Close the adversarial convergence findings owned by this repository and make its trust-boundary verification fail closed under exact content identity and reviewed source selection.
Findings closed
HXL-001,HXL-002,HXL-003,HXL-004,HXL-005,HXL-006,HXL-007,HXL-008,HXL-009,HXL-010,INT-001,INT-002,INT-003Authority surface
Case Growth aggregation and local fixture-review product truth only
Before / after attack behavior
Before: authority-owned universe, atomic Case Growth pair, review PASS semantics, and replay completeness admitted one or more malformed, ambiguous, stale, unbound, or CI-unenforced states identified by the adversarial packet.
After: closed schemas, canonical identity and path checks, recursive claim controls, content-addressed provenance, reverse inventory, replay/pair binding, and required CI reject the attacks while preserving only the bounded authority surface.
Files changed (95)
.github/workflows/ci.ymlREADME.mddocs/demo/HOXLINE_ONE_COMMAND_REVIEWER_DEMO_V0.mddocs/gauntlet/HOXLINE_GAUNTLET_METRICS_V0.mddocs/gauntlet/HOXLINE_GAUNTLET_V0.mddocs/review-engine/HOXLINE_REVIEW_ENGINE_V1.mddocs/reviewer/HOXLINE_REVIEWER_START_HERE.mdexamples/case-growth/current-case-growth-index.jsonexamples/case-growth/current-case-growth-index.mdexamples/case-growth/sample-case-growth-index.jsonexamples/demo/ho-det-010-safe-fixture.jsonexamples/demo/ho-det-010-safe-negative-fixture.jsonexamples/gauntlet/controlled-test-events.jsonexamples/gauntlet/expected-detection-results.jsonexamples/gauntlet/sample-artifact.jsonexamples/gauntlet/sample-evidence-graph.jsonexamples/gauntlet/sample-proofcard.jsonexamples/gauntlet/synthetic-events.jsonexamples/review/aws-det-001-artifact-manifest-v1.jsonexamples/review/fixtures/aws-det-001-safe-fixture.jsonexamples/review/fixtures/aws-det-001-safe-negative-fixture.jsonexamples/review/fixtures/ho-det-009-safe-fixture.jsonexamples/review/fixtures/ho-det-009-safe-negative-fixture.jsonexamples/review/fixtures/ho-det-011-safe-fixture.jsonexamples/review/fixtures/ho-det-011-safe-negative-fixture.jsonexamples/review/fixtures/ho-det-012-safe-fixture.jsonexamples/review/fixtures/ho-det-012-safe-negative-fixture.jsonexamples/review/fixtures/ho-det-013-safe-fixture.jsonexamples/review/fixtures/ho-det-013-safe-negative-fixture.jsonexamples/review/fixtures/id-det-001-safe-fixture.jsonexamples/review/fixtures/id-det-001-safe-negative-fixture.jsonexamples/review/fixtures/id-det-002-safe-fixture.jsonexamples/review/fixtures/id-det-002-safe-negative-fixture.jsonexamples/review/fixtures/id-det-003-safe-fixture.jsonexamples/review/fixtures/id-det-003-safe-negative-fixture.jsonexamples/review/fixtures/id-det-004-safe-fixture.jsonexamples/review/fixtures/id-det-004-safe-negative-fixture.jsonexamples/review/ho-det-009-artifact-manifest-v1.jsonexamples/review/ho-det-010-artifact-manifest-v1.jsonexamples/review/ho-det-011-artifact-manifest-v1.jsonexamples/review/ho-det-012-artifact-manifest-v1.jsonexamples/review/ho-det-013-artifact-manifest-v1.jsonexamples/review/ho-ndr-001-artifact-manifest-v1.jsonexamples/review/hostile-batch/duplicate-artifact-id-index.jsonexamples/review/hostile-batch/missing-manifest-index.jsonexamples/review/hostile-batch/private-evidence-batch-index.jsonexamples/review/hostile-batch/production-claim-batch-index.jsonexamples/review/hostile-batch/unexpected-blocked-pass-index.jsonexamples/review/hostile-batch/unexpected-pass-index.jsonexamples/review/hostile-batch/unsafe-batch-public-safe-claim-index.jsonexamples/review/hostile/missing-fixture-path.jsonexamples/review/hostile/missing-telemetry-contract.jsonexamples/review/hostile/private-evidence-field-attempt.jsonexamples/review/hostile/private-execution-id-field-attempt.jsonexamples/review/hostile/raw-alert-like-field-attempt.jsonexamples/review/hostile/requested-ai-approved-claim.jsonexamples/review/hostile/requested-analyst-approved-claim.jsonexamples/review/hostile/requested-autonomous-soc-claim.jsonexamples/review/hostile/requested-case-closure-claim.jsonexamples/review/hostile/requested-customer-claim.jsonexamples/review/hostile/requested-final-authorization-claim.jsonexamples/review/hostile/requested-production-claim.jsonexamples/review/hostile/requested-socaas-claim.jsonexamples/review/hostile/unsafe-public-safe-status.jsonexamples/review/id-det-001-artifact-manifest-v1.jsonexamples/review/id-det-002-artifact-manifest-v1.jsonexamples/review/id-det-003-artifact-manifest-v1.jsonexamples/review/id-det-004-artifact-manifest-v1.jsonexamples/review/multi-artifact-review-index-v1.jsonschemas/artifact-manifest-v1.schema.jsonschemas/case-growth-index-v0.schema.jsonschemas/multi-artifact-review-index-v1.schema.jsonschemas/review-machine-state-v1.schema.jsonsrc/claimfirewall/claim_authority/evaluator.pysrc/claimfirewall/scanner.pysrc/hoxline/case_growth/__init__.pysrc/hoxline/case_growth/collector.pysrc/hoxline/case_growth/discovery.pysrc/hoxline/case_growth/render.pysrc/hoxline/case_growth/report.pysrc/hoxline/cli.pysrc/hoxline/demo.pysrc/hoxline/metrics/__init__.pysrc/hoxline/metrics/evaluator.pysrc/hoxline/metrics/report.pysrc/hoxline/review_engine.pytests/fixtures/case_growth/README.mdtests/test_action_contract.pytests/test_blocked_claims.pytests/test_case_growth_index_v0.pytests/test_gauntlet_metrics_v0.pytests/test_gauntlet_v0.pytests/test_multi_artifact_review_manifest_expansion_v1.pytests/test_one_command_reviewer_demo_v0.pytests/test_review_engine_v1.pyPositive tests
python -B -m unittest discover -s testspython -B -m pytestpython -B -m hoxline.cli case-growth verify --repo-root .. --snapshot examples/case-growth/current-case-growth-index.jsonpython -B -m hoxline review batch run --index examples/review/multi-artifact-review-index-v1.jsonHostile tests
Required CI and current results
hoxline-trust-boundaries (3.11)—SUCCESS— https://github.com/HawkinsOperations/hoxline/actions/runs/30066007915/job/89397016184hoxline-trust-boundaries (3.11)—SUCCESS— https://github.com/HawkinsOperations/hoxline/actions/runs/30066005897/job/89397008890hoxline-trust-boundaries (3.12)—SUCCESS— https://github.com/HawkinsOperations/hoxline/actions/runs/30066007915/job/89397016187hoxline-trust-boundaries (3.12)—SUCCESS— https://github.com/HawkinsOperations/hoxline/actions/runs/30066005897/job/89397008961Clean room
PASS— Canonical GitHub clones at the exact seven final heads were tracked-clean and passed the command-center source set, 77 detection tests, 134 validation tests, 81 proof tests, 215 Platform tests, atomic Case Growth generation and verification, aligned Hoxline batch replay, Website generation and verification, and the declared claim and mutation boundaries.Cross-repository dependency state
Related PRs:
Generated artifact state
No pre-merge semantic regeneration remains. The Hoxline JSON/Markdown pair is atomic and current by authority blob identity; Website generation verifies at its sealed content identity. After each separately authorized merge wave, record the actual main heads and rerun owning and seven-repository convergence checks. If authority blobs are unchanged, only freshness observations require refresh; final GitHub merge SHAs remain unknown before merge.
Known limitations
POST_MERGE_FOLLOW_UP— Website dependency advisories: npm audit reports three high and zero critical advisories: Next 14.2.35 via PostCSS 8.4.31 and Sharp 0.33.5; npm proposes semver-major Next 16.2.11 and Sharp 0.35.3, so no unrelated major upgrade was taken in this repair scope.ENVIRONMENT_ONLY— Playwright default browser cache: The default browser cache lacked the declared Chromium binary; an isolated install under the approved Data root produced 5/5 passing visual tests.ENVIRONMENT_ONLY— Python cache directories: Only attributed untracked scripts/tests pycache directories remain in detections, validation, and Platform; no tracked or overlapping dirt exists.NON_ISSUE_WITH_EVIDENCE— Platform ledger job skip: The mutation-capable ledger job is intentionally excluded from pull-request execution; required source and convergence checks ran and succeeded, and the skip cannot satisfy or mask them.NON_ISSUE_WITH_EVIDENCE— Atomic generated-pair parent observations: The final pair verifies with zero errors. Its command-center and Hoxline observed heads are explicitly classified as expected historical context created by committing the pair and then sealing its immutable head; their authoritative blobs are current.MERGE_BLOCKING— Eligible independent human review: All seven PRs have zero submitted reviews and zero unresolved threads. Visible eligible human review and explicit MERGE_APPROVED remain required; green CI and Codex review are not approval.Private-data and claim-boundary scans
PASS; zero credential, private-key, MUFG, customer-identifier, or raw private-evidence exposure; five lexical hits were verifier patterns, negative fixtures, or explicit do-not-publish guidancePASS; promotion vocabulary appears only in blocked-claim data, bounded proof ceilings, verifier deny-lists, and hostile testsPASS; zero tracked hits across 246 changed filesReplacement review packet
C:\Raylee\Work\HawkinsOperations\repair-sprint-v1\FINAL_REVIEW_AND_MERGE_REHEARSAL.mdBCD3041112E4B845F604794B240449C64ED6AA265420F727FEAFB5A6A201F32AGovernance boundary
Proof ceiling:
CONTROLLED_REPO_CONVERGENCE_AND_LOCAL_FIXTURE_REVIEW_ONLYGreen CI is not approval. No merge is authorized. Independent eligible human review and explicit
MERGE_APPROVEDremain required.