Validate dated grant counts and the newest advisory delta - #1030

Scope

A later tracked script or baseline refresh could make #970’s dated count and advisory assertions fail unrelated PRs. This correction separates historical inputs from current monitoring: dated grant counts use the record’s explicit Git pin, and the advisory check validates the newest dated delta against its referenced baseline and current native derivation. Every committed historical index remains an unchanged prefix; its delta and baseline bytes are independently preserved from Git objects.

• Base commit: 8b1ef0c37e2f523aa84d2c75960540f45e74e814.
• Lane: lane:foundation.
• Head: e7aea6902cf15c9ed23a57c2a75818f923561f03 (four commits; no rebase).
• Owned paths: the skill correction and advisory-gate test modules, the existing skill record, the dated-delta index and protocol documentation, and native evidence registrations. Apply verified event scopes to CI secret scans #949 and Finalize 373 starred repositories with guarded retention and source coverage #1016 source records are unchanged.

The decision's counts are preserved. Its durable inventory-validation pin is #970's landed squash 900835c60ce9890cd704df4e98ded0b8aa91977d, an ancestor of main with the same 97-path inventory as the original amended carry input. The original source history remains labeled historical. This avoids making the test depend on an unreachable PR-source commit after squash.

Dated advisory baseline/delta extension

blueprints/runtime-workers/openhands/evidence/unclassified-gate-read-deltas.json records dated delta filenames in chronological UTC-date order; append order breaks same-date ties. The checker selects the last entry. Each historical baseline must still match the hash recorded by its own delta. Only the newest delta’s script, shape, total, classification and protection accounting is compared with the current native derivation.

The correction to Astra’s P2 reads all prior index versions reachable from the tested tree’s resolved Git commit using git rev-list --full-history <commit> -- <index-path>. Every prior entries array must remain an unchanged prefix. Its historical delta and baseline bytes are also read independently through the existing native GitTree, so deleting an entry or editing its expected hash cannot remove preservation coverage. A committed removal fails too. Full Git history is required; the existing validation workflow uses fetch-depth: 0.

A PR that changes advisory reads appends its own delta with its native derived_count. If it refreshes a baseline, it writes a separately dated snapshot and points the new delta at it; neither the old snapshot nor the 2026-10-11 skill-use delta is overwritten. The public append/derivation protocol describes the schema and native APIs for #949’s follow-on delta.

The new fixture uses derive_ci_protected to add one advisory read, builds a fresh complete baseline and appends its new delta. Old logic ignores that entry and fails; new logic passes. The fix-round regression rejects removal with or without a baseline rewrite, for later and same-date observations, plus a committed omission and a joint historical-delta/baseline rewrite. Valid appends remain accepted. Both historical files in this PR are byte-for-byte unchanged.

The final correction seeds the refresh fixture's own committed Git history before its first checker call and binds its candidate files and native GitTree to that isolated repository. An added regression commits a valid same-date observation in a shared outer clone, verifies acceptance, runs the refresh fixture and its refusal controls, and separately rejects omission, reorder and entry editing in the outer checkout. The production preservation assertions are unchanged. Both Git blob-output locators now cite line 27, verified at the installed Git pin; their evidence registrations are refreshed.

The protocol also states the frozen-history consequence: a follow-on PR whose committed delta needs a fix after its first push may only append a superseding entry or rewrite its branch.

SOTA sources

• Installed Git 2.53.0, git/[email protected], commit 67ad42147a7acc2af6074753ebd03d904476118f, read from the official source mirror: git-ls-tree.adoc documents recursive trees, NUL termination and name-only output; git-show.adoc:27 documents plain blob contents; revisions.adoc:217-220 documents <rev>:<path>.

• At the same Git pin, git-rev-list.adoc:65-70 documents path-limited commit enumeration, and rev-list-options.adoc:520-525 documents following all merge parents with --full-history. The check reads durable commit objects without trusting mutable remote refs or a candidate-selected comparison pin.

• The outer regression uses supported local Git commands at the same pin: git-clone.adoc:80-85 (--shared), :160-161 (--no-checkout) and git-checkout.adoc:66-71 (--detach).

• Existing native selector at scripts/local_pages_policy_grants.py:46, inventory_paths. The correction reuses this selector with Git-read historical inputs. It does not create a second inventory policy.

• Existing native advisory derivation at push_gate.py:665, derive_ci_protected, with the native reader defined at patch_policy.py:55, GitTree; exact script and shape multiplicities remain enforced.

• Locally installed CPython 3.13.16, python/cpython@cbc944f4bc59639a444dd971c737788ba2283a91: JSON loads, ISO date parsing, and Path.resolve. Official pinned source was read; no new runtime dependency. CI interpreter citation is a separate follow-up below.

Evidence-class table

Local commands run

Both required regression methods were overlaid on main 8b1ef0c3 without changing its checked logic: the tracked-path case fails 97 !=98, and the baseline-refresh case fails because the original check ignores the later delta. Two failures, zero errors, rc1, in 15.626s.

Round 1 fail-before at 2ffc23b2: its fixture with the exact Git-read checker from 02763f27d8c9b2d83da51e64848dd78c3dcf88c1 failed six controls (later/same-date omission with and without baseline rewriting, joint historical-delta/baseline rewriting, and committed omission): one test, six failures, zero errors, rc1, in 21.514s; its corrected checker passed in 16.906s. Round 2 repeats the corrected isolated fixture against that same 02763f27 checker: six expected failures, zero errors, rc1, in 13.509s. Public historical baseline/delta bytes remain unchanged.

Round 2 fail-before: the new outer-checkout regression against the exact Git-read 2ffc23b2 refresh fixture gives one failure, zero errors, rc1 (17.360s). Direct acceptance succeeds first; the old refresh fixture then fails its synthetic-prefix comparison. The three focused checks pass at the committed final head, rc0 (26.388s). The original omission/rebound/committed-omission controls remain active.

Current owning-module validation ran separately under idle-class scopes: 127 push-gate tests, zero skips, rc0 (93.443s), then five skill tests, zero skips, rc0 (0.783s). Native integrity validation was rerun after all four final payload registrations.

# Separate owning-module runs, with retained installed pinned tools on PATH:
systemd-run --user --scope -p CPUWeight=idle python3 -m unittest -v tests.test_runtime_worker_openhands_push_gate
# 127 tests, zero skips, rc0 (93.443s)
systemd-run --user --scope -p CPUWeight=idle python3 -m unittest -v tests.test_skill_correction_claims
# 5 tests, zero skips, rc0 (0.783s)
python3 scripts/validate.py
# 70 components /11,740 hashed files /4 profiles /239 receipts; rc0
python3 scripts/evidence_manifest.py --check
# rc0
gitleaks git . --config .gitleaks.toml --gitleaks-ignore-path .gitleaksignore --log-opts='8b1ef0c37e2f523aa84d2c75960540f45e74e814..e7aea6902cf15c9ed23a57c2a75818f923561f03' --redact --no-banner
# PR range only: four commits, zero leaks, rc0
git diff --check
# rc0

Earlier validation includes an initial native-zizmor host-shim prerequisite failure, cleared using installed pinned tools without changing expectations. Current checks use the retained installed Python 3.13.16 tool directory. No full repository suite or live/provider run is claimed.

Decision record

Existing skill invoke-rate record, now naming its durable inventory-validation commit and the pinned Git mechanism. The dated counts and #1016's dated record are not rewritten.

Host evidence

No host receipt or platform-status change. Only public Git objects and metadata are read. No provider, model, service or account probe is run.

Checklist

• Source mechanism is cited at the installed Git version.
• Regression fails before and passes after; tampered historical claims remain rejected.
• Native evidence registration and validation pass.
• No workflow, permission, policy or credential changes.
• No paid hosting or billing surface introduced.
• Peer-owned worktrees are preserved; Add fenced Claude usage sampling and Grafana panels #954 has landed and its clean lane worktree was removed on the cleanup cue.

Follow-ups

Class: dated-record/live-state coupling. Freeze the inputs of historical assertions; keep intentionally live projections separate. The bounded historical sweep scanned 361 test files, retained 48 AST/read/count candidates and source-reviewed the comparisons below. Retain its captured locators as historical inputs and map current symbols separately when continuing classification. These remain review targets; the capture does not establish that every candidate is a defect.

The sweep also distinguishes intended current projections in tests/test_new_wsl_definitive_defaults.py:1020 and tests/test_handbook_summary.py:50, the advisory baseline/delta contract now corrected in this PR (tests/test_runtime_worker_openhands_push_gate.py, newest-entry check), and retained-input checks in tests/test_host_baseline_probe.py:606 and tests/test_claude_federation_diagnostics.py:47. Static filters do not prove absence through arbitrary dynamic paths/helpers. The complete candidate inventory and scope notes are retained as dated-grant-correction-20261012/SWEEP.json and SWEEP.md.

If the inventory selector itself changes, review the historical-selector semantics independently of this tree/catalog/policy snapshot correction. Follow-up baseline publishers must use the append-only dated-entry protocol; keep location-list-versus-derivation coverage as the previously recorded P3. Both review families are to read the final correction delta; the CC owns landing before the dependent follow-on PRs.

The nine Astra round-2 P3s below retain the earlier Claude follow-ups too. B2's two Git-show locators are fixed; these items do not reopen the terminal fix round:

1. P3 — Historical sweep scope and locator mapping. Preserve the original 361-file/48-candidate capture and record its source revision plus a current symbol/locator mapping when continuing classification. The captured advisory checker locator is :1241; at this head the named checker is tests/test_runtime_worker_openhands_push_gate.py:1392. Separate intentional latest projections from historical assertions and proven defects. Astra verified both attached captures and all 48 named functions; the earlier missing-capture gap is closed.
2. P3 — Historical selector and provenance boundaries. Current snapshot inputs still use today's native inventory_paths implementation (tests/test_skill_correction_claims.py:87). Independently review selector-version semantics and historical location-list/source-commit verification (tests/test_runtime_worker_openhands_push_gate.py:1493, :1509). This fixture correction does not claim to solve those boundaries.
3. P3 — Machine-name hygiene. Normalize the inherited labels in a separate evidence-preserving cleanup with native re-registration: 20 occurrences on 18 unchanged manifest lines, including manifests/evidence.json:4155, with zero in added lines or the body. The matched value is omitted.
4. P3 — Finalize 373 starred repositories with guarded retention and source coverage #1016's append publication. Preserve the old baseline and 10-11 skill-use delta and append Finalize 373 starred repositories with guarded retention and source coverage #1016's separately dated observation through the protocol. The earlier review-only merge replaced historical bytes; no newer Finalize 373 starred repositories with guarded retention and source coverage #1016 head was supplied to this read. This PR does not modify Finalize 373 starred repositories with guarded retention and source coverage #1016 or claim its current full CI passes.
5. P3 — Recovery and concurrent publication order. The protocol sentence correctly requires a superseding append or branch rewrite after a committed delta needs correction. Document when an append suffices, when rewriting is necessary, and how concurrent append branches are rebased into one order. A new observation does not repair an already destructive historical mutation; a later restoration does not erase an incompatible ancestor. Keep the production refusal assertions and retain rejected history as review evidence.
6. P3 — Source coverage and reader attribution. Extend the code/decision Git-ls-tree citations to Documentation/git-ls-tree.adoc:82 for --full-tree; :44-61 covers the other listed switches. Correct the protocol introduction's attribution: GitTree is in resolver/patch_policy.py:55, while derive_ci_protected is in resolver/push_gate.py:665. Re-register changed public bytes in that follow-up; the body source links already distinguish them.
7. P3 — CI interpreter citations. Add CI CPython 3.12.3's matching pinned JSON/date/path citations alongside the explicitly local CPython 3.13.16 source pin. The local runs remain labeled as local; the Claude read verified matching semantics for CI's version.
8. P3 — Canonical date spelling. If the index schema requires YYYY-MM-DD, compare parsed dates' .isoformat() with their original strings and cover accepted/refused spellings. date.fromisoformat also accepts compact forms (tests/test_runtime_worker_openhands_push_gate.py:1409); this remains optional hardening.
9. P3 — Synthetic basename collision. The outer regression assumes unclassified-gate-reads-outer-fixture-delta.json is unused (tests/test_runtime_worker_openhands_push_gate.py:1252, :1255). Astra reproduced a valid committed observation with that basename: the production checker accepts it, then the regression duplicates the path and fails uniqueness (2 != 3, one failure/zero errors, rc1). Choose a synthetic basename absent from both the existing index and files before copying/appending, and retain a regression containing the formerly colliding name. This adjacent P3 is a follow-up under the terminal ruling; ordinary append and B1/B2 checks pass.

Follow-ups from Codex at e7aea690 (CC ruling, 2026-10-12T10:50:37Z)

These are P2 hardening items. Round 2 of 2 is complete and both families pass at e7aea690, so under the terminal rule they do not reopen the PR. Each goes to a follow-on PR with a failing regression:

• Verify each appended delta's recorded source_commit by deriving the observation from a GitTree at that pin, and add an invalid-pin regression (thread PRRT_kwDOUg_LrM6rZwCd).
• Pin the inventory selector with its historical inputs: load the cited selector from the pin, or freeze its derived inventory, and add a regression that changes the live helper (thread PRRT_kwDOUg_LrM6rZwCl).
• Check added_locations and removed_locations against the native location difference, and add tamper regressions for each side (thread PRRT_kwDOUg_LrM6rZwCp).