Host-receipt recorder: output_sha256 digests the published excerpt only - #492

…ence, blueprints and manifests (#1010)

* Re-derive 10 published digests that hashed unmasked bytes, and guard evidence, blueprints and manifests

Correction #161: the 2026-10-11 masked-digest audit of main at 7b76a88 found 8 sha256 values under evidence/artifacts that hash bytes from before sanitization. Its residual list found 2 more under blueprints. Each sits beside a copy in which the home directory is replaced by ~ or the user name by <user>. Anyone could put a guessed value back, hash the result and confirm the guess offline.

Each value is now the sha256 of the published bytes. That is the basis scripts/host_receipts.py record has used for output_sha256 since #492 (scripts/host_receipts.py:1012-1029 at 7b76a88).

- sota-refresh-20260925 markitdown (2), mcporter (3) and rtk (1) results.json: files[].run_copy_sha256 is now the sha256 of the committed file, the same value as the entry's sha256. byte_identical_to_run_copy stays false. Each record gets a corrections entry; mcporter had no list, so one is added.
- The withdrawn nemotron vLLM use receipt -2: commands[1] and commands[4] output_sha256 are now the sha256 of output_excerpt (UTF-8), and its README records the change. This removes no oracle, because 4 registered evidence/hosts receipts keep the same digests (commands[1]'s in 4, commands[4]'s in 3).
- blueprints/retrieval-quality-v2/review-293-repro-20260926.json: inputs.files[0].as_run_sha256 is now the committed driver's sha256. A corrections entry in the record's own shape records the change.
- The withdrawn byterover-cli install receipt: commands[0].output_sha256 is now the excerpt digest. retained-outputs.json, the byterover-cli README and the trials README record the exception to "kept byte-for-byte".

The sha256 of a file before this change would confirm a guess the same way: rebuild the old file from a guess, hash it and compare. Every digest of an old file is therefore re-pinned or dropped:
- the three evidence/receipts qualification receipts re-pin results.json in provenance[], as #314 did;
- retained-outputs.json gives the new receipt bytes for both private_original and published;
- the review-293 correction records no as_recorded_sha256;
- manifests/evidence.json re-registers the 13 files through host_receipts.register_file.

tests/test_published_digest_privacy.py walks every JSON file under evidence/, blueprints/ and manifests/. It flags a 64-hex digest that hashes none of the published texts or files in its own or enclosing object, but does hash one of them once a home directory or name is put back. The masks are ~, <home>, <HOME>, <host-home>, $HOME, ${HOME}, <user>, <USER> and $USER, under /home/<name> and /Users/<name>. Names come from LANDING_PROHIBITED_NAMES. Without them, as in CI, that check skips.

LEGACY_SITES freezes the 106 remaining sites by path, key and 8-hex prefix, with a count assertion:
- 96 output_sha256 values in evidence/hosts receipts recorded before 2026-09-29, append-only since #492;
- 10 that the audit's probe could not reach, because it put back only ~ and <user> and read only files named in the digest's own object.

A new site fails. A listed site that is gone also fails until it is removed, so the list only shrinks. Two checks run in CI too: every listed site is still present, and the 10 fixed sites hash the published bytes.

Fail-before: on the 7b76a88 tree, the guard reports exactly the 10 fixed sites and the fixed-site check fails 10 subtests, with or without names. After this change, all 11 tests pass, or 10 pass and 1 skips without names.

Not changed: git history keeps the old digests. No rewrite is proposed, because the exposure is a home directory or account name, not a credential.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

* Re-pin readiness to the re-pinned receipts and enforce the digest guard in pre-push (#1010 round 1)

B1 (CC adjudication of #1010 round 1): catalogs/north-star/readiness.json still pinned the pre-change sha256 of the three qualification receipts this PR re-pins, in 15 places. Each receipt had five: the repo:<receipt>@<digest> key, that entry's sha256 and expected_sha256, and two nested receipt objects. Rebuilt from the new bytes and a guessed name, each old receipt matched its pin, which is the second-order oracle of correction #161. Each pin now names the receipt's current sha256:
- markitdown-018: d9a1a348 -> 74d066a1;
- mcporter-0141: 5379b1e3 -> 9b69956e;
- rtk-050: 9de293b6 -> b47326a1.
Byte counts are unchanged. tools/north-star/build_readiness.py --write was not used, because it would also fold in readiness drift that predates this PR.

tests/test_published_digest_privacy.py:
- ReadinessPinTests needs no names. Every readiness binding of a receipt changed since the merge base with origin/main must hash that receipt's current bytes. It fails at 7a03593 (15 stale pins) and passes after.
- The guard is now enforced. scripts/git-hooks/pre-push runs it on each pushed tip with PUBLISHED_DIGEST_GUARD_HOST_NAMES=1, so the names come from scripts/host_name_scan.py host_names(), the runtime source of #934's scan (docs/decisions/2026-10-09-host-name-scan.md); NATIVE_AGENT_HOST_NAMES_JSON replaces them in fixtures. The hook's runner refuses a skip, and an unavailable source errors. CI keeps the name-free tests.
- The legacy check is one-directional, so it works in a clone whose names differ. An unlisted site fails. A listed site the names do not reproduce is reported only as a count. test_the_frozen_list_only_shrinks still fails, without names, once a listed digest is gone from its file.
- The mask set adds the repository's existing markers <user-home>, <SCRATCH_HOME>, %USERPROFILE% (as C:\Users\<name>, C:/Users/<name> or /mnt/c/Users/<name>), <WSL_USER> and <hostname>. Every subset of up to four present masks is tried; beyond four, all of them or one at a time.
  - Measured with LANDING_PROHIBITED_NAMES (3 names) and with host_names() (5 names), the guard finds exactly the 106 listed sites both times. There is no new site, so the list and LEGACY_COUNT are unchanged.
- Caching texts and resolved paths halves the whole-tree walk, from 24 s to 11 s with 3 names.

tests/test_pre_push_gate.py overlays the guard module on the fixture tip, as it does the scanner sources. A clean push runs the guard once. A committed receipt whose output_sha256 hashes its excerpt with the fixture home put back is refused without echoing the name.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

---------

Co-authored-by: Claude Opus 5.5 <[email protected]>