Repair ledger reconciliation and authenticated historical receipt replay

.github/workflows/community-tooling799.yml

@@ -54,8 +54,40 @@ jobs:
           python -B research/community-frontier799-audit/check_pr806_trace.py
       - name: Current ledger and archive integrity controls
         run: |
-          python -B scripts/replay_historical_check.py tooling-ledger
-          python -B -m unittest discover -s tests -p 'test_historical_check.py' -v
-          python -B -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
-          python -B -O -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
-      - run: git diff --exit-code
+          status=0
+          python -B scripts/replay_historical_check.py tooling-ledger || status=$?
+          if [ "$status" -ne 0 ]; then
+            python -B - <<'PY'
+          import json
+          from pathlib import Path
+          source = 'docs/research/pr-intake-decisions.json'
+          ledger = json.loads(Path('docs/research/pr-ledger.json').read_text())
+          decisions = json.loads(Path(source).read_text())['pull_requests']
+          item = next(row for row in ledger['pull_requests'] if row['number'] == 2985)
+          decision = next(row for row in decisions if row['number'] == 2985)
+          print(json.dumps({
+              'diagnostic': 'PR2985 closure field and source references',
+              'ledger_closure_present': 'closure' in item,
+              'ledger_closure': item.get('closure'),
+              'source': source,
+              'source_closure_present': 'closure' in decision,
+              'source_closure': decision.get('closure'),
+              'source_sha256': ledger['source_sha256'].get(source),
+              'current_head_observed_in': item.get('current_head_observed_in'),
+              'reconciliation_evidence': item.get('reconciliation_evidence', []),
+          }, sort_keys=True))
+          PY
+          fi
+          exit "$status"
+      - name: Historical replay regression tests
+        if: ${{ success() || failure() }}
+        run: python -B -m unittest discover -s tests -p 'test_historical_check.py' -v
+      - name: Reconciliation regression tests
+        if: ${{ success() || failure() }}
+        run: python -B -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
+      - name: Optimized reconciliation regression tests
+        if: ${{ success() || failure() }}
+        run: python -B -O -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
+      - name: Reject tracked-file mutations
+        if: ${{ success() || failure() }}
+        run: git diff --exit-code

docs/research/pr-ledger.json

@@ -147019,7 +147019,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 2986,
@@ -148266,7 +148267,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3013,
@@ -149111,7 +149113,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3030,
@@ -149204,7 +149207,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3032,
@@ -149597,7 +149601,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3040,
@@ -149640,7 +149645,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3041,
@@ -149883,7 +149889,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3046,
@@ -150078,7 +150085,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3050,
@@ -151228,7 +151236,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3075,
@@ -153534,7 +153543,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3121,
@@ -154696,7 +154706,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3146,
@@ -154789,7 +154800,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3148,
@@ -155082,7 +155094,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3157,
@@ -156275,7 +156288,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3182,
@@ -156426,7 +156440,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3185,
@@ -156719,7 +156734,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3192,
@@ -157062,7 +157078,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3199,
@@ -157155,7 +157172,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3201,
@@ -159706,7 +159724,8 @@
       "current_head_observed_in": "docs/research/pr-intake-decisions.json",
       "reconciliation_evidence": [
         "docs/research/pr-intake-decisions.json"
-      ]
+      ],
+      "closure": null
     },
     {
       "number": 3252,

docs/research/research-package-guide.md

@@ -339,3 +339,57 @@ Tekalign, with substantial OpenAI Codex assistance. Apache-2.0. The exact
 HEAD/index fallback premise follows Arham-Tahir64's PR3102 sparse-reference work;
 this applies it to replay declarations. The original planner, canonical Git
 spelling, symlink and inventory-error controls retain their predecessor credit.
+
+## Historical source/credit receipt adapters
+
+Two source/credit receipts now register an explicit historical-only wrapper:
+`research/pr1-retention-receipt` and
+`research/pr636-family-witness-manifest-receipt`. Their original package bytes
+are frozen at `20ecf2891d80b5acf18d980b2164fb44ea7faa90`, with original input
+bases `d8e0f83f00191df62174b641e9fff055c357f641` and
+`1f7a934975e5eacaf83511c9ac870263bf095e05`, respectively. Later additions to
+CONTRIBUTORS.md and the ledger must not be rolled back to satisfy those old
+live-input pins.
+
+Their current SOURCES.json retains each original commit/blob/SHA256 pin as
+historical provenance. Current VERIFY.json and README.md explicitly describe
+the historical scope. The adapter permits only the exact reviewed transformation
+of those three files; current verifier, evidence and other package bytes must
+still equal the frozen original. This is a two-package policy, not a fallback
+for arbitrary stale live pins.
+
+```sh
+python3 -B scripts/replay_historical_receipt.py --package research/pr1-retention-receipt
+python3 -B scripts/replay_historical_receipt.py --package research/pr636-family-witness-manifest-receipt
+python3 -W error -B -m unittest discover -s tests -p 'test_research_historical_receipts.py' -v
+```
+
+CI must fetch full Git history (`fetch-depth: 0`). Required historical commit,
+tree and blob objects must be locally available; missing objects fail closed,
+and this adapter never fetches them. The adapter authenticates exact
+commit/path/blob identities and SHA256 pins, then copies only the original
+package, source bytes and required Git objects into a private temporary tree.
+It shares no Git object store, config, refs, hooks, worktree or alternate with
+the live repository. Replacement objects and inherited Git configuration cannot
+substitute history; legacy grafts, symlinks and path aliases are rejected.
+The unchanged generic validator and unchanged original commands run there,
+including the PR1 positive/twelve failure controls and PR636 positive/four
+failure controls. Original per-command timeouts and Python cache isolation
+remain in force. The temporary tree is removed after success or failure.
+
+Success requires final unchanged-file checks for original materialized files
+and live package/input bytes, and emits `PASS_HISTORICAL_RECEIPT_ONLY` with both
+commit IDs and `live_inputs_validated=false`. `--check-only` authenticates only
+metadata and pins, emitting `PASS_HISTORICAL_METADATA_ONLY`; it runs no verifier.
+Missing history, changed pins, unapproved wrapper/code/evidence changes or
+failed controls exit nonzero. This is not a sandbox against arbitrary untrusted
+code, an atomic snapshot of a changing checkout, a current-state validation,
+a new scientific acceptance or a PR closure decision.
+
+The current registered wrappers also run the focused regression suite and
+declare its file and the adapter as inputs. Their edits therefore invalidate
+these two consumers without changing the shared planner or workflows. All
+other packages retain normal live-input validation. The original manifests
+remain immutable in Git; running their original live contract against later
+input bytes still fails closed as before. Existing contributor credit,
+scientific evidence and selected-frontier obligations are unchanged.

research/pr1-retention-receipt/README.md

@@ -154,3 +154,33 @@ this package follows.
 Prepared by **Aaron Wang**, with help from opencode (substantial AI assistance;
 no model named; no independent human review claimed). Apache-2.0. Predecessor
 licenses and notices remain in force.
+
+## Explicit historical-only registered replay
+
+The registered command now authenticates and replays the original package at
+`20ecf2891d80b5acf18d980b2164fb44ea7faa90` against its original pinned base.
+It does not validate today's ledger, contributor list, or other live input
+bytes. The original SOURCES.json, VERIFY.json, verifier and evidence are read
+unchanged from that commit into an isolated temporary tree. Current source
+rows keep their exact original commit/blob/SHA256 pins as historical provenance.
+
+Only these three wrapper files (README.md, SOURCES.json and VERIFY.json) may
+differ from the frozen package, and the adapter checks their exact approved
+transformation. All current verifier and evidence bytes must still equal the
+original tree. The original positive and negative controls run without edits;
+materialized and live package/input files must remain unchanged afterward.
+`PASS_HISTORICAL_RECEIPT_ONLY` is a historical source/credit result, not a
+current-state validation, new scientific acceptance, or closure decision.
+
+Run the historical adapter with Python 3.12:
+
+```sh
+python3 -B scripts/replay_historical_receipt.py --package research/pr1-retention-receipt
+```
+
+The generic runner's default live-input contract is unchanged. To inspect the
+original live contract, replay the original frozen package metadata against live
+inputs: it correctly rejects later byte drift. The registered wrapper declares
+the adapter and its focused tests as inputs, so changes select these two
+consumers without a global shared-workflow invalidation. See
+[the replay guide](../../docs/research/research-package-guide.md#historical-sourcecredit-receipt-adapters).

research/pr1-retention-receipt/SOURCES.json

@@ -4,31 +4,31 @@
   "files": [
     {
       "path": "CITATION.cff",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "574b2108bc40b5799f5a8c54fa3519d8aea51892",
       "sha256": "4b17b8cff777e2f619afc47d7421e49e9309bdff9f8fe2f185fc774ff18a25e1"
     },
     {
       "path": "CONTRIBUTORS.md",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "6431453337f4ff2fec9b560decce3267f443ea5a",
       "sha256": "e16a737af455f68cf329710bf9bc48ec1728101cbeaf1519dd7aef0fbafad172"
     },
     {
       "path": "Makefile",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "02055437d2b90c705e8b82d2ef2b58633101ca7d",
       "sha256": "cbcc8cb5e977970fce52ad0b2e4440eb6b6a9c9e87fa1bcfd6af11a16f9344b7"
     },
     {
       "path": "NOTICE",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "59d8e0cf3102e15bd11db430838365531e2d7f18",
       "sha256": "b49022cb4104d90b182e4c335f670faf45529025b15db77bf0291835083c28bd"
     },
     {
       "path": "README.md",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "74f49a5eca5910b915cb8446462c081c0372b141",
       "sha256": "00162212b6ae88b02330d824c8d1469ef41097c88b91e32b0876f83d29a94caa"
     },
@@ -40,7 +40,7 @@
     },
     {
       "path": "docs/reproducibility.md",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "ce620954a86c0b6688859a7421441fc97a3d9259",
       "sha256": "333f87bf13c4aa911af89d278923ea84bfd091966e23f5fb1332e83aa4565db9"
     },
@@ -52,19 +52,19 @@
     },
     {
       "path": "docs/research/pr-ledger.json",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "f5ce7e4c467d3e9bfe1d16a1524228b11c655769",
       "sha256": "f36486250793e396bebe63f51adafcee82fe28a4a0c7e9a40cf6b5d1713cb066"
     },
     {
       "path": "research/overnight-pr-review-20261009/dispositions.json",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "ed53da272d6dc016420f2a6a75321e9c18fb5bc1",
       "sha256": "9dd0264e667551852a7d6747df490e3e542465caf347d9f43998c6f0665faae9"
     },
     {
       "path": "research/overnight-pr-review-20261009/source-inventory.json",
-      "usage": "input",
+      "usage": "provenance",
       "git_blob": "ab2e653500b152ca672d8651d2c4476d5672d9fb",
       "sha256": "0dc9bc5fc0da37f4442014e17106823f24c4ecaf36b144643fc5684474ac2261"
     }