fix(landscape): bind completed supersessions and redact scratch sessions - #995

Scope

Completed changed-key reruns require explicit bound proof, valid native start/result ordering, complete request-effort measurements and one authorized active terminal per superseded label. The direct native effort CLI refuses actual unknown provider-request efforts, excluding client-built synthetic session-limit rows. Native scratchpad redaction matches exact directory components and prefixes; percent-decoded private identifiers refuse before publication. A moved README locator is corrected under its enforced catalog test.

• Base commit: 900835c60ce9890cd704df4e98ded0b8aa91977d (reviewed source snapshot; current carry base 421bf3f) (standing registry-only rebase; non-registry patches preserved).
• Lane: lane:foundation.
• Owned paths: landscape-sweep wrapper/converter/result acceptance and docs; maintained native usage adapter/test/README; regression modules; the single catalog source locator; evidence manifest; dated decision record.

Terminal publication correction (v-next)

Current head b3d8ab63 carries two commits on a6335653. The first is the correction d7ec90104012425dfa4276278fe5b85349b65d5a, released by the CC at 2026-10-12 09:21:13Z after both reads. The second is the docs-only commit b3d8ab63, which aligns README:507-509, README:678-680 and the usage_record.py docstring (:31-32) with the allowlist; it makes no code change. The new reproduced native-key P1 closes through an output allowlist for the entire receipt and CLI summary. Public pairs contain only labels and the two agent IDs; native key, contract and journal validation stays local. Known request/search/token counters and completion/effort statuses remain. Unknown nested fields, final returns, opaque reasons, input seals, command metadata, timestamps and the private output path are withheld. Only the embedded proof digest and public processor/adapter code digests authenticate exported preimages; tool_commit is omitted.

The digest-audit regression checks every hex or v2 token of seven or more hex characters in receipt/stdout/stderr against independently identified public preimages. At exact a6335653 it reports 25 unapproved tokens, including all 24 native keys; diagnostics retain counts only. Six public-CLI regressions against the exact a633565 usage_record.py and sweep_common.py blobs fail: 6 tests, 23 failures, exit 1. Corrected postrun module: 21 tests, exit 0; native usage-record consumers: 18 tests, exit 0. These cover key omission, unknown nested fields, relabeled authentication, unconditional max on explicit supersession, malformed journal identities, and malformed measured IDs on explicit and ordinary paths, including preserving an existing receipt on refusal. No production function is mocked.

The four reproduced Codex items and the CC's B1/B2 are included: explicit non-max effort refuses even without the optional contract flag; malformed identities refuse with exit 2 and a fixed message before lookup/write; Betterleaks 1.9.0 is a named prerequisite; README and decision record describe only the actual public proof/code authentication. The #177 census is corrected to 22 distinct values in 17 files, counts only. Original inputs remain private. The versioned Claude Code 2.1.296 binary and its embedded No mechanism were verified at the cited executable pin and offsets. The maintained adapter's COUNTERS/summarizeChild and native json_text serializer supply the source contracts for the allowlist.

Local validation passes: 70 components / 11,743 files / 4 profiles / 239 receipts. Native changed-file identity scans have zero hits; changed-file and exact correction-range gitleaks pass; git diff --check passes. README line count and enforced line 1095 remain unchanged. All preceding counts/carries describe their named historical heads. These are synthetic-fixture and local integration results; new-head CI and confirmation reads remain required. #1032 waits for #995 landing, then rebases, with its P2 baseline delta also waiting for #1030. No landing or production acceptance is inferred here.

SOTA sources

• Native receipt writer at 43f3008e: supported json_text serialization; validated pair identities are in usage_record.py at that revision, lines 143–146. The correction extends the existing writer and validation path directly.

• anthropics/claude-code v2.1.296: installed executable SHA-256 24972e3bc859fab2b46ed4c1e51f7d6130f06d3bd550811a114640de3370d0de, native v2 journal/cache identities and structural scratchpad paths. Full original executable and source captures are retained privately for the controlled read.

• Maintained child-usage.mjs at8c32a84b246da66e43a6188c973741b09329e223: deduplicated provider-request counters, native supersession, summarizeRun and effortMismatches. Original SHA-256 3e5189342734135e88a2295c1c2152275d9e26c0c7731ed5cbc8905bbccd98a4; prior correction adapter SHA-256 e8659b58ab0813a840695f2ac9d9e413705585497ba4c470dc692e675dc5e9e5. This extends the maintained adapter directly, preserving existing counters.

• CPython v3.13.16 urllib.parse and official unquote documentation: supported percent decoder for the separate privacy validation view. Exact tag/API/blob/page captures retained.

• Selected checkout scripts/validate.py PRIVATE_CONTENT grammar; bound13-pair native proof/contract/journal; tests.test_upstream_surface_watch.DispositionCitationTests enforces the README policy locator, now1095 in both source and reason.

• Betterleaks 1.9.0, 81aff7a638638aae3a659845d089043e1d8fe9ac: cmd/stdin.go:47–49 and sources/stdin.go:18–25; Generate the canonical final-stack manifest (W4 PR 2) #1007's native publication path in scripts/host_name_scan.py at c2dee17, with native decode-depth and email/name rules.

Evidence-class table

Local commands run

python3 -B -m unittest tests.test_landscape_postrun tests.test_landscape_sweep_harness tests.test_evidence_manifest tests.test_upstream_surface_watch
rc0;428 tests,9 optional skips at reviewed a871ea91 AND isolated merged421bf3f9 snapshots

python3 -B -m unittest tests.test_upstream_surface_watch.DispositionCitationTests
rc0;6/6 (before locator fix:rc1,one failure)

node examples/claude-native/workflows/test-child-usage.mjs
rc0;224 checks,zero failed/skipped

python3 scripts/validate.py
rc0 at head:70 components/11740 hashed files/4 profiles/239 receipts
rc0 at merged snapshot:70 components/11743 hashed files/4 profiles/239 receipts

python3 scripts/evidence_manifest.py --check
git diff --check
rc0

PR-range-only gitleaks and native pre-push receipts are retained and reported in FIX-PUSHED. The unchanged base suite's original nonzero result remains explicitly retained alongside its controlled fixture-only comparison.

Decision record

docs/decisions/2026-10-11-landscape-postrun-accounting.md.

Native raw-output authentication remains in the private evidence store; no private-original digest is published here.

Private captures and their manifest authentication remain in the private evidence store; published review packets bind only their published sanitized bytes.

Host evidence

No host receipt or platform-status change.

Checklist

• All5 P2s have failing-first checks;adjacent native gate,chronology/chain/path/call-site transitions checked.
• Per-id provisos checked mechanically;no paid rerun,counter rewrite,clean-effort waiver or catalog/ledger append.
• Credentials/account identities/Codex config untouched;capture privacy rule applied.
• ONE forward correction on exact17eb102d lease;fix(convergence): isolate blind context and audit resumed attempts #993 remains separate;authorized family micros follow FIX-PUSHED.

Follow-ups

• Complete the catalog-owner README steps 11–12 through the existing publication gates after qualified verdicts; retain the controlled rerun and recording gates.

Review disposition follows the CC PR-wave ruling: in-scope reproduced P1/P2 defects or false claims at the head are blockers; other findings stay in this list. P1 safety/privacy/money/order findings always block. Subsequent fixes wait for Claude, GPT and Codex on the same head, or an explicit CC release; open items after the second fix round go to CC adjudication. Candidate changes return to the research queue, and #1009 has queue priority.

Historical registry-only rebase before the queued second micro

The standing CC rule replayed the five authored commits onto 0f00a1aa9fb6e217b3ca7f029be583f9d80851f3. Current head b3d2b6702f265b1b7012d66facedc3df7597940b, parent ed912108108b78c1d170e0a0f2e8f1191ba08948 (the rebased 17eb102d). Only manifests/evidence.json conflicted; it was restored from target main and regenerated through scripts.host_receipts.register_file using cumulative owned paths, retaining every main row and all non-files fields. No manual registry merge or implementation change.

Native git range-diff excluding the registry reports 5/5 =, with identical stable non-registry patch IDs. Full range-diff retains its four registry-only ! rows and one = row; those differences are confined to regenerated evidence entries. No non-registry conflict or non-equal source patch occurred. The queued delta is now ed912108..b3d2b670, with historical source/usage receipts retaining their original identities.

python3 -B -m unittest tests.test_landscape_postrun tests.test_landscape_sweep_harness tests.test_evidence_manifest tests.test_upstream_surface_watch
exit 0; 424 tests, 9 optional skips
node examples/claude-native/workflows/test-child-usage.mjs
exit 0; 224/224 checks
python3 scripts/validate.py
exit 0; 70 components, 11672 hashed files, 4 profiles, 239 receipts
python3 scripts/evidence_manifest.py --check
git diff --check
exit 0

Current main was re-fetched and remained the target; merge-tree is clean. This is local test/integrity and conflict qualification, not a model rerun or a live adoption claim. One exact-old-head leased push publishes the replay only. Native registration, range-diff, patch IDs, test/validator/push and final-head receipts are retained in lanes/convergence-practice-work/pr995-registry-rebase-20261011/. The co-op re-points the queued micro while preserving its place; all existing Follow-ups and landing/recording gates remain.

Historical CC-adjudicated correction after b3d2b67

Head 15d3d6343b9e843163592bd3d2dff1f8b913f3c3 carries ONE fix commit for B1, B2 and C4, with a registry-only rebase onto 86fa384421b1ca50134bd56d89cc72e0f7547816. B1 regenerates the example workflow checksum file in its existing relative-path form; the exact CI byte-identity command fails before and passes after. B2 uses the pinned adapter's real-message predicate: client-built <synthetic> rate-limit rows with zero usage and no effort are excluded from request/effort accounting, while their usage/issue provenance remains. The two existing fixtures now use that actual row shape and fail before/pass after. The CC's addendum corrects the earlier eight “unknown provider efforts” premise; the historical eight-failure/seven-reopen output remains a retained observation of the superseded gate, not a current gate outcome. No historical journal, receipt or aggregate usage is rewritten.

C4 reuses #1007's native publication scanner at c2dee17 and installed Betterleaks 1.9.0, upstream 81aff7a638638aae3a659845d089043e1d8fe9ac (cmd/stdin.go:47–49, sources/stdin.go:18–25). The vendor's stdin decoder checks complete JSON records before artifact writes or summary output; no decoder is added. All three synthetic runtime-built plants publish at the held head and are refused after correction. Unavailable scanning and oversized records refuse distinctly. Native scanner context is bound to the physical source checkout, independently of selected data-root redaction fixtures.

Validation: Node child-usage 224/224; postrun 11 tests; final rebased privacy/effort/context/control selection 5 tests, all pass. A broad native integration run contained 296 tests (3 skips) and one source-cwd fixture failure; that context defect was corrected and the failed regression plus four focused tests pass. The full broad run is not labeled green. Final validate.py passes (70 components,11691 files,4 profiles,239 receipts); native evidence/diff/byte-identity checks and the six-commit leak scan pass. All six non-registry range-diff rows are =. Current-head required GitHub checks must finish green before acceptance, and Astra's delta must inspect gh pr checks explicitly. One delta micro per family remains required; no landing is claimed.

Follow-ups

• Astra fix7 P3-1: remove the digest-audit test's obsolete, unverified Git-HEAD allowance and unused tool_commit helper when convenient. Retain the independent published proof, processor and adapter preimage checks. Production already omits tool_commit; never reintroduce commit authentication without a published preimage. This also removes the audit's archive Git dependency.

• Astra fix7 P3-2: normalize inherited top-level malformed raw JSON refusal before .get(), covering list/null input and preserving an existing receipt. The current inherited path fails closed with rc 1/AttributeError and no receipt; the owning follow-up should return the fixed rc-2 input diagnostic.

• Astra fix7 P3-3: pin the remaining unqualified live CLI-order comment in tools/skill-usage/skill_usage.py to the intended immutable revision or named functions. Preserve the adjacent explicitly b2dd1eb7-qualified historical reference; the earlier second-locator complaint was overbroad. The enforced catalog README locator remains correct.

• Astra fix7 P3-4: add narrowly scoped fail-before checks for present-tense publication documentation and the required scanner. Bind any residual-count assertion to its dated counts-only census; never publish residual values or prefixes as a fixture. Behavioral regressions already cover the code corrections.

• Astra fix7 P3-5: complete intended genuine-worktree/runtime qualification and supply missing native/source capture bundles. Preserve unmodified archive Git errors, scanner-source refusals and row-44 investigation, fallback-only parser checks, missing merged prometheus_client dependency, and socket/path/sandbox gaps as unqualified results; selected-class/fallback passes do not replace them.

• Astra fix7 P3-6: continue Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177's private historical-preimage investigation and owning identity/digest hygiene. The corrected census is 22 distinct values / 24 occurrences / 17 files. Keep inherited hostname findings and the accepted history residual separate; neither continued existence nor the census proves every preimage identifying. No values or prefixes are published here.

• CC addendum 02 / Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177 history residual: main holds 22 raw-output digest values in 17 committed files, counts only. Determine which raw outputs were identity-bearing before deciding whether to scrub current copies; some values belong to other tools. No historical purge is claimed.

• Astra fix5 P3-1 (correction-source citations): cite the dated CC digest-prefix ruling and pin the repository's actual serialization/hash source for json_text; preserve the demonstrated regression without publishing a forbidden digest or prefix as its fixture.

• Astra fix5 P3-2 (runtime qualification; co-op row 44): retain the ordinary archive scanner-unavailable failures, the supplemental 300-second transport deadline without a process result, and the retained pre-cue rc-124 timeout as incomplete results. Complete full scanner/harness qualification in the intended worktree/runtime and continue the timeout/resource-cause investigation while preserving fail-closed publication.

• Astra fix5 P3-3 (incentive-monitor timing): retain the first named timing failure. The named test passed once in each reviewed tree; the restricted-shell whole-module timeout is not a second reproduction of that assertion. Apply the ruled deterministic-test correction if that specific timing failure recurs.

• Astra fix5 P3-4 (CLI locators): replace the remaining unqualified child-usage CLI comment locator at tools/skill-usage/skill_usage.py:2564 with named functions or the intended immutable revision; the line-1395 citation is explicitly pinned historical evidence; preserve historical revision-bound citations as history. The enforced catalog stagger-policy locator is already corrected.

• Astra fix5 P3-5 (inherited hostname identifiers): normalize the inherited artifact names and their registrations together in the owning hygiene change, preserving evidence bindings. The review counted 53 inherited hostname hit lines in complete changed files and zero in the patch; host-username hits were zero.

• Astra fix5 P3-6 (receipt publication boundary): keep contract/journal seals as private provenance unless the publication representation binds only published safe bytes. Extend the existing public-receipt/Markdown digest coverage; a literal identity scan alone does not establish that a digest preimage is safe. No new public leak was reproduced by this read.

• Accepted history residual (2026-09-24 community sweep: effort-guard SessionStart notice, working plugin-install commands, dated dispositions #161, Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177; CC ruling 2026-10-12 06:38:11Z, shadow review Fix native worker timeout cleanup on macOS #1 F1): the PR's earlier commits retain the full private-journal digest; the squash lands only the clean tree. The CC accepts the residual without a purge because the whole private journal is not a guessable preimage; a GitHub-side purge would require the owner and GitHub support and is out of proportion.

• Complete the full landscape-sweep harness runtime qualification with load measurements; retain the 600-second archive timeouts as unqualified.

• Replace the stale child-usage CLI locators in skill-usage comments with named functions or explicit revisions.

• Normalize inherited hostname artifact identifiers and their registrations together in the owning hygiene change.

• Keep private contract/journal authentication distinct from public proof/receipt provenance; sweep Markdown digests and add the Code Review Rules check for unpublished preimages.

Digest publication correction

Head 43f3008e1c6bfe5b8a44ddf10d6c400f823e1cdb completes the CC-ruled digest and prefix sweep. Earlier correction head a871ea91b0f452f6cd9857aa1b6805a1d32bef2a carried the initial digest correction and a registry-only rebase onto 900835c60ce9890cd704df4e98ded0b8aa91977d, but still retained a journal-digest fragment. At 43f3008e, the record omits all 14 flagged private-original values and their 7-hex-or-longer prefixes and the native cache key; body raw-output and private manifest authentication are also omitted. Original evidence remains private. Public-file digests and the vendor executable identifier remain unchanged.

The receipt retains the validated redacted proof projection and hashes its exact UTF-8 JSON serialization, including the writer's final newline. Unused private capture metadata and original input seals are excluded from that proof preimage. Contract/journal binding is still checked before acceptance; counters and native history are preserved. The new public-CLI regression constructs a synthetic identity at runtime, fails against c6c36ca (exit 1), and passes after correction (exit 0).

Final carry checks: 50 receipt/privacy/evidence tests pass with one optional skip; validate.py passes (70 components,11740 files,4 profiles,239 receipts); native evidence/diff checks and the eight-commit gitleaks range pass. All eight non-registry range-diff rows are =. Native publication scan of this prepared body finds zero identity/email locations. Current-head CI and family delta reads remain required; no landing is claimed.

Private digest fragment correction

Previously reviewed fragment-correction head 43f3008e1c6bfe5b8a44ddf10d6c400f823e1cdb carries ONE fragment correction and registry-only carry onto 421bf3f98b631d931838c22a927b4fec246f7df8. The test/count lines above describe the CC-reviewed a871ea9 snapshots; current native validation covers 11743 files. The public journal citation refers only to authentication retained privately. The prefix regression fails at a871ea9 and passes after removal; all nine non-registry carry rows are unchanged. A counts-only sweep finds no 7-hex-or-longer prefix of any of the 14 flagged values in complete PR files, body or commit messages.

Additional Follow-ups

• The incentive-monitor two-sweep timing flake was first observed in run38201711914 attempt1. Base/main/head blobs match and isolated qualification plus the complete rerun pass. A second occurrence triggers the rule4 deterministic-test correction.
• Native scanner unavailable refusals under host load go to co-op research row44 for timeout/resource-cause qualification; preserve fail-closed behavior and retain incomplete harness runs.

Follow-ups after landing

Landed at 429f042 on 2026-10-12T13:19:44Z from head b3d8ab6. The GPT read of that head returned ACK with six P3 follow-ups; none blocks. They carry forward:

1. P3: The three documentation fixes still have no author-added fail-before documentation guard.
2. P3: Carry the reproduced adjacent malformed-input and locator-normalization cases.
3. P3: Keep the obsolete Git allowance, remaining live locator and minor interface cleanup in follow-up scope.
4. P3: Complete runtime and cited-capture qualification without rewriting incomplete results as passes.
5. P3: Historical identity/digest hygiene remains the accepted separate follow-up.
6. P3: Make the body's historical head label explicit.

The Claude micro at b3d8ab6 asked for one body correction, applied before landing; it has no other open item.

Astra fix8 Follow-ups after landing

• P3-1: add narrow fail-before guards for the three corrected publication descriptions, citing public_run/public_processing at the immutable correction revision. Retain upstream adapter/serializer citations and CLI controls.
• P3-2: normalize inherited malformed top-level raw JSON, mismatch-row identities and trailing-slash run locators before validation. Preserve existing-receipt refusal controls and their current failure results; synthetic or out-of-contract shapes do not establish a real native identity leak.
• P3-3: remove the obsolete Git allowance/tool_commit helper and unused metadata parameters; pin the remaining live CLI-order locator while preserving historical citations. Carry schema/first_capped_at, native-agent-ID digest-audit handling, supported scanner installation and dirty-checkout code-digest qualification as follow-ups.
• P3-4: complete genuine-worktree/runtime and cited-capture qualification, preserving archive/parser/scanner/dependency/socket gaps and the incomplete module rc 124 / wrapper rc 1 result as unqualified.
• P3-5: continue accepted Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177 historical preimage and identity hygiene, with the dated counts-only census (22 distinct values / 24 occurrences / 17 files). Preserve registrations; publish no values or prefixes and make no blanket inference about identifying preimages. Inherited WSL hostname findings remain P3 under the measured co-op ruling.
• P3-6: keep the behavioral correction and documentation micro heads explicitly historical when refreshing the body. The landing body already names b3d8ab6 as the reviewed two-commit head and d7ec901 as the earlier behavioral correction; retain those qualifications.