Re-derive 10 published digests that hashed unmasked bytes; guard evidence, blueprints and manifests - #1010

Scope

• What this PR changes, in one or two sentences:
  • Ten published sha256 values hashed bytes from before sanitization, so anyone could put a guessed home directory or account name back in place of ~ or <user> and confirm the guess offline (correction 2026-09-24 community sweep: effort-guard SessionStart notice, working plugin-install commands, dated dispositions #161). Each is now the sha256 of the published bytes.
  • No tracked file still pins the base digest of a file this PR changes. The pre-push hook runs a guard test with the host's names on each pushed tip, and it fails on any unlisted site its detector reaches. CI runs the name-free checks.
• Base commit: 7b76a88c3e669dac328a8e05018ef0ccc029fd8f
• Lane: lane:foundation
• Owned paths touched:
  • evidence/artifacts/sota-refresh-20260925/{markitdown,mcporter,rtk}/results.json
  • evidence/artifacts/workstation-lane-20260925/nemotron-qualification/withdrawn/ (receipt and README)
  • evidence/receipts/{markitdown-018,mcporter-0141,rtk-050}-qualification-20260925.json (provenance re-pin only)
  • catalogs/north-star/readiness.json (re-pin of those three receipts only)
  • blueprints/retrieval-quality-v2/review-293-repro-20260926.json
  • blueprints/trials-20260926/README.md
  • blueprints/trials-20260926/byterover-cli/ (README, retained-outputs.json, withdrawn install receipt)
  • manifests/evidence.json
  • scripts/git-hooks/pre-push and tests/test_pre_push_gate.py (guard wiring)
  • tests/test_published_digest_privacy.py (new)

The ten sites

• Sites 7 and 8 remove no oracle. Four registered evidence/hosts receipts carry the same digests (commands[1]'s in 4, commands[4]'s in 3). They are fixed for consistency.
• Each record says what changed:
  • corrections entries in results.json, and in review-293's own corrections shape;
  • the nemotron withdrawn README;
  • for byterover, retained-outputs.json (verbatim: false, a sanitization rule), the byterover-cli README and the trials README, which record the exception to "kept byte-for-byte".
• Second-order digests. The sha256 of a file before this change would confirm a guess the same way: rebuild the old file from a guess, hash it and compare. So:
  • the three qualification receipts re-pin results.json in provenance[] (the Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence #314 precedent);
  • catalogs/north-star/readiness.json re-pins those three receipts in its 15 bindings, five per receipt:
    • markitdown-018 d9a1a348 → 74d066a1;
    • mcporter-0141 5379b1e3 → 9b69956e;
    • rtk-050 9de293b6 → b47326a1;
    • byte counts are unchanged, and build_readiness --write was not used, because it would fold in drift that predates this PR;
  • retained-outputs.json gives the new receipt bytes for both private_original and published;
  • the review-293 correction records no as_recorded_sha256;
  • manifests/evidence.json re-registers every changed file it lists through host_receipts.register_file;
  • a search of the tree finds no tracked file still pinning the 7b76a88 digest of any of the 17 changed files.
• Blueprints append-only check. No README or rule makes either blueprints file append-only:
  • blueprints/retrieval-quality-v2/README.md describes the record and carries a corrections list;
  • blueprints/trials-20260926/README.md:59,73 and byterover-cli/README.md:200 describe the withdrawn receipts as "kept byte-for-byte". That is the same kind of statement the nemotron withdrawn README made, and it now records the exception.

The guard

• Detection. tests/test_published_digest_privacy.py walks every JSON file under evidence/, blueprints/ and manifests/.
  • It flags a 64-hex digest that hashes none of the mask-carrying texts or path/file/log files in its own or enclosing object as published, but does hash one of them once masks are put back. Masks are put back as follows:
    • ~, <home>, <HOME>, <host-home>, <user-home>, <SCRATCH_HOME>, $HOME and ${HOME} as /home/<name> or /Users/<name>;
    • %USERPROFILE% as C:\Users\<name>, C:/Users/<name> or /mnt/c/Users/<name>;
    • <user>, <USER>, $USER, <WSL_USER> and <hostname> as <name>.
  • Every subset of up to four present masks is tried. Beyond four, the guard tries all of them, or one at a time.
• Output. Path, key and an 8-hex prefix only.
• Names: enforced in pre-push. scripts/git-hooks/pre-push runs the guard on each pushed tip with PUBLISHED_DIGEST_GUARD_HOST_NAMES=1.
  • The names are scripts/host_name_scan.py host_names(), the runtime source of Check private host names in files, commit diffs and identities #934's scan. Fixtures set NATIVE_AGENT_HOST_NAMES_JSON.
  • The hook's runner refuses a skip, and an unavailable source errors.
  • Run by hand, the test reads the comma-separated LANDING_PROHIBITED_NAMES instead, and skips without names, as in CI.
• Frozen list. LEGACY_SITES freezes 106 sites by path, key and digest prefix, with a count assertion (LEGACY_COUNT = 106):
  • 96 output_sha256 values in evidence/hosts receipts recorded before 2026-09-29, append-only since Host-receipt recorder: output_sha256 digests the published excerpt only #492;
  • 10 that the audit's probe could not reach (see Follow-ups).
  • The masks added in round 1 surface no new site. With either name source, the guard finds exactly the 106.
• How the list behaves. An unlisted site fails. A listed site the names do not reproduce is reported as a count only, because another clone's names differ. test_the_frozen_list_only_shrinks fails without names once a listed digest is gone from its file, so a fixed site leaves the list and the list only shrinks.
• Checks without names (they run in CI too):
  • every listed site is still present;
  • the ten fixed sites hash the published bytes;
  • every readiness binding of a receipt changed since the merge base with origin/main hashes that receipt's current bytes (ReadinessPinTests);
  • the synthetic detector cases.

SOTA sources

• Recorder convention. https://github.com/seathatflowsinourveins/native-agent-stack at 7b76a88c3e669dac328a8e05018ef0ccc029fd8f:
  • scripts/host_receipts.py:1012-1020 is the basis comment: output_sha256 binds the published bytes; receipts before 2026-09-29 hash the raw output;
  • scripts/host_receipts.py:1029 is hashlib.sha256(excerpt.encode("utf-8", "surrogateescape")).hexdigest().
  • Both are from c0ca46d1294ea2b286f629aa9550a7cae3be9e6b (Host-receipt recorder: output_sha256 digests the published excerpt only #492), whose message keeps older receipts' digests "(append-only)".
• Runtime names and hook. Same repository and pin:
  • scripts/host_name_scan.py:43 host_names(), with the NATIVE_AGENT_HOST_NAMES_JSON override at :21;
  • docs/decisions/2026-10-09-host-name-scan.md (Check private host names in files, commit diffs and identities #934);
  • scripts/git-hooks/pre-push's runner and its githooks(5) pre-push protocol (https://git-scm.com/docs/githooks#_pre_push).
• Registration path. scripts/host_receipts.py:710 register_file at the same commit. Then scripts/evidence_manifest.py --write and --check.
• Re-pin precedent. 5c1961e49b89dd56ef5626950a5448735caabe4c (Fix Codex post-merge findings: wider rtk blob exclusion, TOML-parsed bootstrap reminder, blind-packet leak, retained markitdown evidence #314) updated the qualification receipts' provenance[] sha256 when results.json changed.
• Audit method.
  • The co-op's host-local probe walked evidence/artifacts and manifests at 7b76a88 and found 8 sites. Its residual list over evidence/hosts and blueprints found 98. The probe put back ~ as the home directory and <user> as the account, read only files named in the digest's own object, and printed only file:line, field and a Boolean.
  • The round-1 reader's probes covered two chains:
    • readiness_chain.py rebuilt each pre-change receipt from head bytes and a guessed name. It matched the readiness pin at 7a03593 and does not match after this change.
    • probe_d.py checked every tracked file and JSON string, with Windows profile prefixes. It found 145 unique sites, which the Residual section covers.

Evidence-class table

Local commands run

Names were sourced from the host-local env file without printing them. host mode uses host_names(), as the pre-push hook does.

$ python3 -m unittest tests.test_published_digest_privacy   # env = LANDING_PROHIBITED_NAMES, host = host_names(), none
head 42519c9a (tree identical to the receipts' run): env rc=0 (15 OK); host rc=0 (15 OK); none rc=0 (OK, skipped=1)
7a035936 worktree + this module: env, host and none rc=1, each failing only ReadinessPinTests (15 stale pins)
7b76a88c extract + this module: env and host rc=1 (guard: the 10 fixed sites; fixed-site check: 10 subtests);
  none rc=1 (fixed-site check: 10 subtests)
$ python3 readiness_chain.py <tree>      # the reader's probe: head bytes + a guessed name vs the readiness pin
7a035936: reproduces the pin True x3; head: False x3
$ findings(ROOT, names)                  # the guard's walk, counts only
LANDING_PROHIBITED_NAMES (3 names): 106 found, all listed; host_names() (5 names): 106 found, all listed
$ python3 -m unittest tests.test_pre_push_gate               # 3 parallel shards, 16:14:41Z-16:23:39Z
Ran 10 + 10 + 9 tests: OK x3                                         rc=0
$ python3 scripts/validate.py
{"components": 70, "hashed_files": 11477, "profiles": 4, "receipts": 239, "status": "passed"}   rc=0
$ python3 scripts/evidence_manifest.py --check
{"files": 11477, "status": "passed"}                                 rc=0
$ python3 scripts/validate.py --scan-file <each of the 5 round-1 files>
5 x {"matching_locations": 0, "source": "host", "status": "passed"}  rc=0
$ python3 -m unittest <34 modules: test_local_pages*, test_north_star_readiness, test_evidence_manifest, test_validate, test_host_name_scan>
Ran 623 tests: OK                                                    rc=0
$ gitleaks git --redact --config .gitleaks.toml --log-opts=<7a035936..HEAD | 7b76a88c..HEAD> .   # gitleaks 8.30.1
no leaks found (both ranges)                                         rc=0

Round 0's receipts at 7a03593 are unchanged:

• the 82-module run (4811 tests): the two failures there pass when run alone and read no changed file;
• the 15 per-file scans returned 0 matches;
• PR CI was green at 7a03593.

Decision record

None. The scope decisions came from the command center (correction #161):

• leave evidence/hosts untouched;
• fix the two blueprints sites;
• guard the whole tree with a frozen list that only shrinks.

Round 1 follows the CC adjudication of #1010 at 7a03593:

• B1: the readiness re-pin, option (a);
• Codex :324: the pre-push wiring;
• Codex :329: the one-directional legacy check;
• Codex :46: the added masks.

Residual

• Left in place. 96 output_sha256 values in evidence/hosts receipts recorded before 2026-09-29 stay. Host-receipt recorder: output_sha256 digests the published excerpt only #492 left those receipts append-only. Git history keeps every old value.
• No rewrite proposed. The exposure is a home directory or account name, not a credential, so this is hygiene-level.
• More sites than the guard reaches. The reader's whole-tree probe (probe_d.py: every tracked file and JSON string, Windows profile prefixes, capitalized names) finds 145 unique sites at 7a03593:
  • the 106 listed;
  • 39 the guard's detector does not reach: 8 in F1 and 31 in F2.
  • The detector gaps behind them are F3. All three are under Follow-ups.
• Not a digest oracle. Byte counts beside some private originals (as_run_bytes, private_original.bytes) still reveal the masked name's length. This PR does not change them.

Follow-ups

A CC follow-up PR comes right after this one lands, ahead of other privacy work.

• F1. headroom-039. The same family as the ten fixed here. 8 unique run_copy_sha256 sites, 5 prefixes and 21 occurrences, in two files:
  • evidence/artifacts/sota-refresh-20260925/headroom-039/out/run-outputs.json;
  • evidence/artifacts/sota-refresh-20260925/headroom-039/verifier/run-outputs.json.
• F2. 31 more unique sites, routed to their owners:
  • evidence/artifacts/skills-trials-20261009/: 12 pairs, 12 each in native/native-results.json and publication-redaction.json;
  • omniroute-routing-20260928: 5, in four evidence artifacts and one blueprint;
  • docs/decisions/2026-10-08-memory-roles-live-host.json: 2.
• F3. Detector gaps:
  • content-addressed tables;
  • nested digests;
  • keys outside FILE_KEYS;
  • all-or-nothing mask restore, now partial: every subset of up to four present masks is tried, and beyond four, all of them or one at a time;
  • pins of pre-change files outside the readiness bindings ReadinessPinTests checks;
  • catalogs/, docs/, tools/ and files that are not JSON.
  • Round 1 closed the read's mask-form gap: %USERPROFILE% and <user-home> are now in the mask set.
• F4. Pre-push wiring: resolved in round 1. The guard isn't wired into pre-push, although its docstring says it is. It now is (scripts/git-hooks/pre-push).
• F5. The frozen list shrinks only by convention. Add a check that LEGACY_SITES is a subset of the merge base's list, so a new entry fails instead of relying on review.
• F6 (P3). blueprints/trials-20260926/README.md:59, the withdrawn_host_receipt class row, still says "kept byte-for-byte". Line 73 and byterover-cli/README.md record the exception; that row does not.
• F7 (P3). retained-outputs.json entry 48 conflicts with the file's sanitization_policy clause, which says each private original's "name, byte count and sha256 are recorded here". Entry 48's private_original.sha256 is now the published bytes' sha256, a deliberate choice explained in the entry's sanitization rule. The clause needs an exception or a reword.
• F11. Every pushed commit, not only each tip (Codex scripts/git-hooks/pre-push:157, reproduced by the CC's confirmation micro at 42519c9a). An oracle added and then removed within one push passes (rc 0), because the guard runs on each pushed tip. Scan every new commit in the pushed range instead, matching the same hook's name scan, which already covers each ref's range with --scan-history. The CC's follow-up PR above carries it, with a two-commit push test that fails first.
• F3, extended (Codex tests/test_published_digest_privacy.py:240). The guard puts one name into every mask, so text that holds two different identities (<user> and <hostname>) is missed. Synthetic two-value cases give 0 findings, against 1 for the single-value controls. A whole-tree probe with independent names over all 7 names finds 0 tracked sites. It goes into F3 with a regression.
• F12 (Codex evidence/artifacts/sota-refresh-20260925/markitdown/results.json:72). The field holds the published hash in round-0 content. The record's corrections[] entry discloses the change, and no code reads run_copy_sha256. Relabel the field when the record is next revised; nothing changes here.
• F13 (P3). ReadinessPinTests lacks maxDiff = None, so a failure prints "Diff is 1105 characters long" instead of the stale pins.
• F8, F9 (notes). Both are disclosed, as the first read at 7a03593 lists them.
• F10. No action needed, as the read records.

The guard found these 10 sites outside the audit. They existed at 7b76a88 and stay frozen in OUTSIDE_THE_AUDIT until their owners fix them. Each fix removes its entry and lowers LEGACY_COUNT.

Skills lane (gela, skills-lifecycle):

• evidence/artifacts/native-skill-lifecycle-20260930/receipt.json:1010 final_sha256 cc707baf (<home> in returned_final).
• evidence/artifacts/skills-trials-20261009/publication-redaction.json, original_sha256 (<host-home> in the named file), 6 sites:
  • :39 ea4e2998
  • :48 c8b28445
  • :57 c4a6249b
  • :86 55b5ad93
  • :96 9db79be8
  • :352 f7fa1723
• evidence/artifacts/skills-trials-20261009/native/native-results.json, artifact sha256 (<host-home>), 2 sites:
  • :317 55b5ad93
  • :539 9db79be8
• Constraints on the fix:
  • publication-redaction.json publishes private-original digests by design: its native_artifact_hashes says "native-results.json artifact entries refer private original bytes".
  • The fix must respect the freeze in that trial's PREREGISTRATION.md.
  • The lane decides whether a new labelled publication supersedes the record.

Trials follow-up:

• blueprints/trials-20260926/byterover-cli/retained-outputs.json:544 private_original.sha256 549e503b (oclif-autoupdate.log, ~, with the path in the enclosing object).

Host evidence

No file under evidence/hosts/ changes.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (none changed)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

🤖 Generated with Claude Code