feat: model boundary receipts, the verify arm and chain admission - #35
Open
HarperZ9 wants to merge 2 commits into
Open
feat: model boundary receipts, the verify arm and chain admission#35HarperZ9 wants to merge 2 commits into
HarperZ9 wants to merge 2 commits into
Conversation
Design: docs/superpowers/specs/2026-07-29-model-boundary-receipts-design.md
Emission is harness-side (harness/model_shim.py's --receipt-dir flag, the
local-model / _wshim repo); this commit ships buildc's read side only.
- New docs/MODEL-RECEIPT.md: the buildlang-model-boundary-receipt/v0 schema
contract (field table, SHIM-WITNESSED vs DECLARED tags, the seal and
cross-language canonicalization contract). docs/SCIENTIFIC-RECEIPT.md
gains a pointer section; the scientific verifier's CAPABILITY_INADMISSIBLE
refusal of any Model-observing program is untouched.
- New compiler/src/model_receipt.rs: the fourth receipt verify arm (beside
gpu, scientific-runtime, and check), wired into both the plain and --json
`receipt verify` dispatch. Offline only (no re-run): seal recompute
(SEAL_MISMATCH), digest well-formedness (DIGEST_MALFORMED), and the three
named field-shape contracts (FIELD_CONTRACT_VIOLATION) -- no new failure
classes, the shared taxonomy is reused whole.
- compiler/src/main.rs: cmd_receipt_chain_build's member-schema gate widens
from a single-schema equality to a two-schema allowlist
(scientific-runtime + model-boundary-receipt). Chain verify needed zero
changes: pinned seals and subprocess re-verification already dispatch
through the new arm.
- compiler/tests/fixtures/model-receipt-golden.json: the byte-identical
golden fixture (echo-mode COMPLETED receipt) both repos pin, seal
6bb2a09c47f5eaa2e3208a5eadcd6d57d1faffa74a567e024e920571c3794035. The
no-floats schema is what makes serde_json::to_vec and Python's
json.dumps(..., separators=(",", ":"), ensure_ascii=False) agree
byte-for-byte.
- Tamper coverage (unit tests in model_receipt.rs, CLI tests in cli.rs
against the real buildc binary): a resealed field-shape violation, a seal
mismatch, and a propose/dispose chain (a model receipt beside a
Model-free disposer kernel's scientific receipt) that breaks with
CHAIN_LINK_UNVERIFIED when only the model member is tampered.
- The model receipt is not a corpus member and not a --self-test case (a
different artifact kind, not scientific evidence): corpus 29/29 and
self-test 10/10 stay unchanged, re-run and recorded. Full suite: 1,698
passed, 0 failed (+15 over the prior 1,683 baseline); cargo fmt clean.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…po byte pin The review's one Important: local-model pins the shared golden fixture eol=lf but buildlang had no .gitattributes at all, so a fresh Windows clone with autocrlf would smudge the fixture bytes. No current test breaks (verify recomputes seals from the parsed struct, proven empirically in review), but the cross-repo byte-identity provenance claim depends on the bytes, so both repos now pin it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The read side of model boundary receipts (buildlang-model-boundary-receipt/v0): docs/MODEL-RECEIPT.md contract, the fourth receipt-verify schema arm (compiler/src/model_receipt.rs, seal idiom and failure classes matching the scientific family), and the chain-build allowlist widened to exactly two schemas so a model receipt can sit beside a scientific receipt in one tamper-evident chain, with pinning and member re-verification untouched. The propose/dispose rule is untouched by construction: a model receipt is a provenance artifact (bytes-crossed, DECLARED identity, no invariant, no verdict vocabulary), and the scientific path still refuses Model programs outright. The emitter half lives harness-side (local-model feat/model-boundary-receipts): the shipped shim emits sealed receipts under --receipt-dir, and the cross-language pin is a byte-identical golden fixture both repos carry (LF-pinned in both via .gitattributes after review). Review PASS/PASS with live probes: a real shim-emitted receipt VERIFIED by buildc over a real socket, a mixed propose/dispose chain built and broken by tampering the model member (CHAIN_LINK_UNVERIFIED), corpus 29/29 and self-test 10/10 unchanged, suite 1698/0. Stacked on #34.
(generated with Claude Code, https://claude.com/claude-code)