toasterson/akh-medu
Watch
1
0
Fork
You've already forked akh-medu
 0
Code Issues 12 Pull requests 36 Projects Releases 3 Packages 8 Wiki Activity Actions

Add fail-closed legacy ACP history provenance backfill #669

Closed
toasterson wants to merge 1 commit from codex/mausbot-legacy-provenance-round9a into main
pull from: codex/mausbot-legacy-provenance-round9a
merge into: toasterson:main
Conversation 1 Commits 1 Files changed 14 +1496 -1
toasterson commented 2026-10-18 02:51:30 +00:00
Owner
Copy link

The 34 legacy MausBot transcript rows have neither acp_origin nor a native per-record session ID. Merged-main owner filtering hides them, blocking the history-continuity gate. This PR adds a conservative offline admin backfill tool and records why none of the current records is provably attributable: Athena0/15, Odin0/11, Apollo0/8. It does not make the activation window ready.

The tool requires a preexisting authoritative native record session ID, independently authenticated owner-registry agreement, a ready custodian session, exact ECMAScript prompt SHA256 and byte count, and an unambiguous settled prompt interval. Missing/conflicting proofs exclude. An initial temporal-only join identified five candidates; fresh-context independent review proved that native ACP can return end_turn without capturing a row, so that result is explicitly withdrawn and a missing-session counterexample regression now excludes it.

Apply adds only acp_origin and a versioned provenance marker. It locks exact physical rows, compares full original payloads in one serializable Postgres transaction, and fsyncs exclusive0600 before-images before any update. Existing origins are never overwritten; stale reapplication refuses unchanged. Reversal requires all complete after-images and restores original payloads atomically. The zero-attributable round9a bundle refuses apply. No daemon invocation or schema change is involved.

Local validation:31 synthetic tests pass; real CLI/SQL apply, repeated-apply refusal, reversal, identity/CAS checks and transaction rollback pass in a removed loopback-only disposable PostgreSQL18.6 container. The actual merged-source transcript filtering/listing functions, compiled with equivalent fixture types, show one visible row per bot after synthetic attribution and zero for the real read-only copy. This is fixture evidence, not deployed ACP or history acceptance. CI now runs all three suites.

Public per-record verdict/proof hashes, the withdrawn report, source/private-input hash manifest, validation and independent review are retained in docs/mausbot/evidence/legacy-history-20261018-round9a/; content-bearing evidence stays outside Git in private0600 files. No live transcript/DB/ledger writes, session creation, daemon probe, enrollment, grant, binding, activation or merge occurred. CI is pending. The CoS owns merge; a separately authorized apply round additionally needs authoritative native record-to-session evidence or a separately approved recovery plan. NEEDS-OPERATOR remains the history gate.

The 34 legacy MausBot transcript rows have neither `acp_origin` nor a native per-record session ID. Merged-main owner filtering hides them, blocking the history-continuity gate. This PR adds a conservative offline admin backfill tool and records why **none of the current records is provably attributable**: Athena0/15, Odin0/11, Apollo0/8. It does not make the activation window ready. The tool requires a preexisting authoritative native record session ID, independently authenticated owner-registry agreement, a ready custodian session, exact ECMAScript prompt SHA256 and byte count, and an unambiguous settled prompt interval. Missing/conflicting proofs exclude. An initial temporal-only join identified five candidates; fresh-context independent review proved that native ACP can return end_turn without capturing a row, so that result is explicitly withdrawn and a missing-session counterexample regression now excludes it. Apply adds only `acp_origin` and a versioned provenance marker. It locks exact physical rows, compares full original payloads in one serializable Postgres transaction, and fsyncs exclusive0600 before-images before any update. Existing origins are never overwritten; stale reapplication refuses unchanged. Reversal requires all complete after-images and restores original payloads atomically. The zero-attributable round9a bundle refuses apply. No daemon invocation or schema change is involved. Local validation:31 synthetic tests pass; real CLI/SQL apply, repeated-apply refusal, reversal, identity/CAS checks and transaction rollback pass in a removed loopback-only disposable PostgreSQL18.6 container. The actual merged-source transcript filtering/listing functions, compiled with equivalent fixture types, show one visible row per bot after synthetic attribution and zero for the real read-only copy. This is fixture evidence, not deployed ACP or history acceptance. CI now runs all three suites. Public per-record verdict/proof hashes, the withdrawn report, source/private-input hash manifest, validation and independent review are retained in `docs/mausbot/evidence/legacy-history-20261018-round9a/`; content-bearing evidence stays outside Git in private0600 files. No live transcript/DB/ledger writes, session creation, daemon probe, enrollment, grant, binding, activation or merge occurred. CI is pending. The CoS owns merge; a separately authorized apply round additionally needs authoritative native record-to-session evidence or a separately approved recovery plan. **NEEDS-OPERATOR** remains the history gate.
Add provenance-checked reversible legacy ACP history backfill
Some checks failed
CI / test-native-client-computer (pull_request) Successful in 12m12s
Details
CI / check-seshat (pull_request) Successful in 4m5s
Details
CI / test-native-receiver-isolation (pull_request) Successful in 19m17s
Details
CI / test-sokar-sharing (pull_request) Successful in 15m1s
Details
CI / test-sokar (pull_request) Successful in 15m41s
Details
CI / check-akh-medu (pull_request) Successful in 10m59s
Details
CI / test-session-platform (pull_request) Failing after 27m6s
Details
CI / docker-sokard (pull_request) Successful in 13m27s
Details
CI / docker-seshd (pull_request) Successful in 13m49s
Details
CI / publish-chart (pull_request) Successful in 8m29s
Details
CI / test-akh-medu (pull_request) Successful in 20m3s
Details
CI / platform-images-core (pull_request) Has been skipped
Details
CI / platform-images-daemons (pull_request) Has been skipped
Details
CI / platform-images-home (pull_request) Has been skipped
Details
CI / docker-akh-transcripts (pull_request) Failing after 41m32s
Details
CI / platform-images-fleet (pull_request) Has been skipped
Details
CI / platform-images-collect (pull_request) Has been skipped
Details
5e9d546f1b
toasterson commented 2026-10-18 09:33:48 +00:00
Author
Owner
Copy link

Closing unused (operator decision 2026-10-18). The dry run proved 0/34 legacy records attributable: none stores a native session ID, and hash/timing matches cannot prove ownership. Legacy pre-#644 transcripts stay stored but hidden, as #644 intends; MausBot clients start with fresh owner-tagged history. Branch retained for reference.

Closing unused (operator decision 2026-10-18). The dry run proved 0/34 legacy records attributable: none stores a native session ID, and hash/timing matches cannot prove ownership. Legacy pre-#644 transcripts stay stored but hidden, as #644 intends; MausBot clients start with fresh owner-tagged history. Branch retained for reference.
toasterson closed this pull request 2026-10-18 09:33:51 +00:00
Some checks failed
CI / test-native-client-computer (pull_request) Successful in 12m12s
Details
CI / check-seshat (pull_request) Successful in 4m5s
Details
CI / test-native-receiver-isolation (pull_request) Successful in 19m17s
Details
CI / test-sokar-sharing (pull_request) Successful in 15m1s
Details
CI / test-sokar (pull_request) Successful in 15m41s
Details
CI / check-akh-medu (pull_request) Successful in 10m59s
Details
CI / test-session-platform (pull_request) Failing after 27m6s
Details
CI / docker-sokard (pull_request) Successful in 13m27s
Details
CI / docker-seshd (pull_request) Successful in 13m49s
Details
CI / publish-chart (pull_request) Successful in 8m29s
Details
CI / test-akh-medu (pull_request) Successful in 20m3s
Details
CI / platform-images-core (pull_request) Has been skipped
Details
CI / platform-images-daemons (pull_request) Has been skipped
Details
CI / platform-images-home (pull_request) Has been skipped
Details
CI / docker-akh-transcripts (pull_request) Failing after 41m32s
Details
CI / platform-images-fleet (pull_request) Has been skipped
Details
CI / platform-images-collect (pull_request) Has been skipped
Details

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
follow-up
Documented operational follow-up

No labels
follow-up
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
toasterson/akh-medu!669
No description provided.