Bind host receipts to landscape winner ids: refuse stack-id aliases, list unbound Mac receipts - #214

Problem

Receipts recorded on the Mac (macos-m5pro-20260924) under manifests/stack.json ids never counted toward their landscape winners, so every macos-arm64 matrix entry stayed untested.

• docs/contributing-evidence.md step 3 told recorders to pass a stack id.
• platform_status / component_matrix join receipts by the winner's component_id and bind only on the full winner pin.
• record skipped its winner-pin check for a stack id, because the alias itself has no winner pins.
• Five stack ids name the same repository as a winner under a different id: alpaca-py→data-alpaca-py, duckdb→data-duckdb, edgartools→data-edgartools, exchange-calendars→data-exchange-calendars, nautilus-trader→nautilustrader.

Change

• Write time (fail closed): host_receipts.py record refuses a stack alias of a winner (exit 2) and names the winner id and its full pin. --from-stack-commands still resolves the alias's documented commands.
• Validate: alias receipts are rejected unless listed in GRANDFATHERED_ALIAS_RECEIPTS.
  • Each entry is pinned by claim_sha256: canonical JSON of the receipt without its append-only reviews. So review (as Record independent needs_changes reviews on #201's Mac application receipts #209 did on the duckdb receipt) keeps the exemption, and any edit to the recorded claim loses it.
  • Stale, corrupt and mis-mapped entries are errors.
  • The explicit tools/sota-convergence/receipt-component-aliases.json table and the repository-inferred aliases are cross-checked in both directions.
• Read side: the matrix lists alias_receipts per winner × platform. They are never counted in pass/fail, platform_status, the flip rule or e2e_state. receipt_staleness.py reports grandfathered aliases as informational and flags any other alias as stack_alias.
• Docs: record under the winner component_id from the matrix. Multi-part pins bind in full.

This follows current identity practice:

• Declare and enforce canonical identity at write time, as OSV aliases and CycloneDX identity do.
• Never rewrite historical evidence.
• Pin exceptions by digest, as in-toto/SLSA subjects are pinned.

A purl key was judged scope creep for two internal catalogs of one repo.

Not changed / not claimed

• Evidence receipt files are byte-identical (git diff --stat origin/main -- evidence/hosts is empty).
• The three Mac alias receipts still do not bind: their ids are aliases, and their versions (0.44.0, 1.5.5, 2.0.0rc5) are not the full winner pins. The nautilus receipt is local_integration, so it could reach conditional at most.
• No platform_status changes. The verdict-review-gate reports 0 changed rows.

Verification (Linux/WSL2; nothing ran on macOS)

• Every step of validate.yml that can run locally passed:
  • validate.py
  • host_receipts.py validate (16 receipts)
  • validate_catalogs, validate_foundation, landscape.py
  • build_verdicts --check, component_matrix --check, new_host_grand_list --check
  • verdict_flip_candidates, gap_crosswalk build --check, build_ecosystem --check
  • evidence_manifest --check
  • verdict_review_gate --base origin/main (0 changed rows)
  • receipt_staleness, release_due, audit_reports --check, validate_convergence
• Full python -m unittest: Ran 4450, OK (skipped=430). The base ran the same skips; they are runtime-gated.
• Node contract test: 6/6.
• New tests cover the resolver, the exact real alias set, record refusal, validate rejection, claim-digest identity (appended review keeps the exemption end to end through review; an altered claim loses it; a lone surrogate gives a mismatch, not a crash), stale and corrupt entries, the non-counting matrix listing, and staleness info versus flag.
• Independent reviews: 3 lenses (correctness, evidence integrity, CI reproduction) plus 2 rechecks and a final claim-digest review. All findings were fixed or dispositioned.

Follow-up on the Mac (to make the receipts count)

Re-record under the winner ids from a checkout that contains this change. tool_versions then defaults to the full winner pin:

python3 scripts/host_receipts.py record --host-id macos-m5pro-20260924 --platform-id macos-arm64 \
  --component-id data-alpaca-py --stage use --evidence-class native_proven --second-physical-machine \
  --cmd "<the functional command the original receipt ran>"

Do the same for data-duckdb and nautilustrader (the latter is local_integration). Then add an independent review from a different identity; accepted needs a reviewed native_proven use-stage pass.

🤖 Generated with Claude Code