Verify native memory and RAG use and monitor their lifecycle - #47

…g (Codex review at a2434e2; Codex cross-family review)

- The allowlisted export exports no whole tree: tests/, tools/ and scripts/ carry selection-bearing data, so a
  file there is exported only when a packet references it.
- codex_lane.tree_sha256 refuses a symlink leaving the tree; every lane and adjudication entry point exits 2.
- assemble derives each order's Claude position from the input contents (re-scrubbing the hash-bound lane
  returns) and refuses a judgment whose index map disagrees; the index moves out of the work dir to a state
  directory keyed by the work dir; a flagged Codex blind audit voids its judgment.
- The vendored layer-verdict-lane.js is agent-lab #47's merge (e070125, sha256 fd77b749: per-layer packet_path);
  claude_lane.py requires each layer's packet_path to be the work dir's packet with its packet_sha256.
- claude_lane_args.py checks --repo as given and resolved.

Tests: 6 new tests fail on the previous code; full suite 3651 OK (354 skipped: runtime-gated suites only).

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

… corrections (final-round reviews)

- L1: record_verdicts resolves --lane-repo-root as adjudicate records it, so a symlinked or relative export
  relativizes the same way on both sides of the lane_returns_sha256 binding.
- L2: a deliberately non-blind codex_lane run (--allow-git-history) hashes an escaping link's text instead of
  refusing; blind runs still refuse.
- tree_sha256 also refuses a symlink loop and a non-regular entry (FIFO, socket, device) instead of skipping it
  (Codex cross-family review, F4).
- README: the allowlisted export re-measured at 697 files (0 missing references) without whole trees; the index
  location and assemble's claude_position described as they now are; the vendored lane named as #47's merge;
  the tests/-path overturn trade-off disclosed (L3). New codex registry entry.

Tests: codex_lane loop, FIFO and non-blind-link cases; codex_lane suite OK.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

…y digest of host state

The final commit of #1012 under the CC's ruling on Astra's three P1s at
3d7b1e7 (her VERDICT.md, sha256 e945d18d).

- P1 1: the atext walk takes all 81 RFC 5322 atext characters. The slash
  was left out and leading backticks were always skipped, so a lone slash,
  "x/" and a lone backtick before an at sign stayed readable on the pages
  and as token-tools-now.json keys and values, also as %2F, / and %60.
  CPython Lib/email/_parseaddr.py getatom (:475-493 at cbc944f4) accepts
  all 81. Three contexts are set aside, each positively identified: inside
  a URL (a scheme, "://", up to a space, angle bracket or quote; RFC 3986
  section 3.1) the slash ends the local part, so a path is no address and
  an address after a path segment masks from its own first character; an
  at sign right after a slash, with a name after it that a slash or an
  opening parenthesis follows, starts a path segment or a call, and the
  slash must be the character right before the at sign, which no mailbox
  has, so an address that is itself a path segment (gcloud's
  legacy_credentials/ plus an account address plus /adc.json, or x/ plus
  an address plus /y) masks whole, directory prefix included; and a
  backtick string that a string of equal length closes after the at sign
  opens a Markdown code span (CommonMark 0.31.2 spec.txt:5865-5872 and
  :6072-6073 at 9103e341), so `@AGENTS.md` stays and a backtick that
  nothing closes is part of the local part. A scheme-less host path with
  nothing after it now masks, like any slash-ended local part.
- P1 2 (#161): the new page's footer served the SHA-256 of the native
  builder's render of the state root, whose raw bytes held a private
  address (the gate owner), and sources.html served the raw digests of
  the gate receipt, the gap board, the roadmap inputs and 70 readiness
  receipts. A digest of private bytes confirms a guessed value offline.
  The composer now marks an input private by provenance, when its path is
  under the state root, and the role projection's registry files the same
  way, so 83 inputs are private where 9 were and the nonserved receipt
  keeps their digests. The Command center and Sources pages show
  "private, not published (host state)" for each of them and for the
  native manifest in the footer; repository inputs keep their SHA-256.
  Not in this commit: the Home, Readiness, Gap board, Roadmap and Fleet
  footers still print the manifest digest, and two architecture pages
  print cc-now.json's, adoption-now.json's and one readiness receipt's.
- P1 3: three comments wrote out a complete address at a delegated domain:
  two in sanitization.py, one of them a host path that the full atext
  grammar also reads as an address, and a punctuation-only address on the
  target domain in a test. They are prose now, and a test scans the
  local-pages and skill-usage sources and their tests for any address that
  is not a no-reply form or on a name RFC 2606 and RFC 6761 reserve.

Thirteen tests: eleven fail at an export of 3d7b1e7 (68 failures,
counting subtests) with the export unchanged, and two pin the URL,
Markdown and path controls and the cost. Astra's review_probes.py gives
FAILED (failures=10) on that export and OK here, review_static.py FAILED
(failures=1) and OK. Twelve mutations of the change each fail them. The
36 local-pages, skill-usage and north-star modules pass (812 tests, 8
skipped). A live build takes 37.2 s, against 40.3 s at 3d7b1e7 built
just before it from the same state root (load 17 to 25), and its 43
pages carry no mask or residue placeholder. On 1,288,538 unique strings
from the tracked tree and the live inputs, 4 outputs differ from
3d7b1e7's (two package URLs mask from their ecosystem segment, an
apostrophe-quoted import stays readable again, and the removed comment
now masks), none in text a page renders. The three adversarial
50,000-character forms take 0.025, 0.022 and 0.021 s, against 0.025,
0.021 and 0.021 s at 3d7b1e7, back to back at load 16 to 20.

Co-Authored-By: Claude Sonnet 5.5 <[email protected]>