docs(architecture): install proof-carrying authority interlocks

[andrexibiza]

Summary

Installs an executable repository contract for the architecture rule tracked by #90866 and the exact-object completion doctrine in #91230:

A proof object must survive from admission to the actual effect and typed settlement; coordinates, configured intent, predecessor evidence, and surviving output shape cannot be re-derived as authority downstream.

This PR converts the current cross-subsystem topology into repository state rather than leaving it in analysis prose.

Files

• docs/architecture/authority-continuity.json
  • machine-readable admission → carry → effect → settlement → publication contract;
  • current delivery ownership and missing-child state for webhook, MCP OAuth, compression, feature-parity publication, Hermes Tag, Discord voice V6, Windows update, provider-egress redaction, and god-file consolidation;
  • exact-object evidence, semantic parent-retirement, and machine-readable-over-narrative rules.
• docs/architecture/proof-carrying-authority.md
  • human-readable architecture projection and interlock map.
• tests/conformance/test_authority_continuity_manifest.py
  • locks the five-stage evidence pipeline;
  • requires refactor(webhook): establish canonical intake authority #90995 to remain the webhook spine and feat(webhook): add multi-target delivery fan-out (Webhook Feature Package) #85644 settlement to precede docs/final assembly;
  • prevents split MCP OAuth teardown ownership from MCP 2.0 transport composition #84963 retirement while the MCP-2.0 transport/control-plane child is absent;
  • makes fix(compression): make durable adoption proof-preserving across repair and restore #88551 one delivery lane with _row_id + _row_id_watermark proof;
  • enforces fix(campaigns): harden executable parity contracts #90307-before-channel-ledgers publication topology;
  • prevents archive(update): retain PyYAML/native-lock invariant without reviving July topology #60233 and fix(secrets): exact-value applied-secret redaction on the provider-egress path #77198 from being promoted into current-main closure by narrative;
  • keeps KILL LOCK/current-main semantic slices, not PR population, as the god-file survivor unit.

Exact object

• base: b6bcb3e791c673e63974029bbab40cc9326803ff
• head: 170a3a0e67034abd7d6a2c69a16c292b4781720f
• one commit, three new files
• mergeable: yes

Verification

Local exact-content conformance:

python -m pytest -q tests/conformance/test_authority_continuity_manifest.py
8 passed in 0.06s

The JSON was parsed from the exact committed content, the test module compiles, and all Python lines remain at or below 88 characters.

Hosted exact-head receipts:

• Nix flake check 32537959373 — success
• Docker Build, Test, and Publish 32537959412 — success
• CI 32537959822 — success

No result is inherited from another head.

Interlocks

• Architecture/composition: [Architecture] Make observable state proof-carrying from source to side effect #90866 [Architecture] Proof scope must equal mutation scope #90144 [Architecture]: recovery and teardown must be fenced by durable generation identity #90145 [Architecture] Treat built artifacts and real protocol peers as part of the system under test #90150 [Architecture]: make false success a first-class defect class with typed completion proofs #90049
• Exact-object publication: [Architecture / Publication] Task Completion Verification — exact-object completion as the sixth Hermes law #91230 [Architecture] GitHub automation has split authority: metadata writes succeed while repository-object writes fail #90200
• Webhook: refactor(webhook): collapse feature surface into one authority per question #90989 refactor(webhook): establish canonical intake authority #90995 fix(webhook): preserve profile-correct effective config through semantic train compression #85002 fix(webhook): close Task 10 intake identity and raw-bound contracts #90236 refactor(webhook): isolate explicit provider signature authority #85318 feat(webhook): define profile-scoped session and unattended interaction policy (Task 12) #90304 feat(webhook): add multi-target delivery fan-out (Webhook Feature Package) #85644 docs(webhook): align webhooks guide with shipped behavior (Webhook Feature Package) #85638 test(webhook): Task 19 real-listener probe — final integration still pending #85640
• MCP OAuth: split MCP OAuth teardown ownership from MCP 2.0 transport composition #84963 fix(mcp-oauth): bind delegated auth-flow teardown to the owning task #90888
• Compression: fix(compression): make durable adoption proof-preserving across repair and restore #88551 compression: preserve durable row-ID watermarks across child, CLI, and ACP restores #88740 compression: preserve the raw durable watermark through replay cleanup and alternation repair #88758
• Feature parity: fix(campaigns): harden executable parity contracts #90307 docs(slack): install executable parity and @Hermes Tag ledger #91036 docs(discord): install canonical 42-row parity ledger #90321
• Hermes Tag / Slack: feat(hermes-tag): add additive governance and continuity kernel #91111 Slack Feature Parity & @Hermes Tag Campaign — meta-issue #79772
• Discord voice: feat(gateway): Discord VC transcribe-only mode and transcript file destination #78180 fix(gateway): serialize STT/TTS reliability slice behind V6 contract #78196 Discord Feature Parity & Alignment Campaign (API v10) — meta-issue #79564
• Update: archive(update): retain PyYAML/native-lock invariant without reviving July topology #60233 feat(update): add deployment-plan admission with fail-closed legacy guard #91316 feat(update): enforce generation-fenced deployment transaction authority #91895 [Tracking] Fleet update reliability: one deployment plan for local, multi-profile, remote, and image-managed installs #91277
• Secrets: fix(security): exact-value applied-secret redaction missing on tool-result -> provider egress path #77162 fix(secrets): exact-value applied-secret redaction on the provider-egress path #77198
• God-file topology: [COMPLETE] Large-file decomposition: 20/20 done #78647

This PR does not claim that any referenced implementation is merged, released, or operationally verified. It installs the ownership and evidence contract that those implementations must satisfy.

[Enough1122]

AI code review — automated review for reference; please use your judgment.

1. tests/conformance/test_authority_continuity_manifest.py:16-44 — nearly every assertion re-states manifest contents as module-level constants (EXPECTED_INTERLOCKS, EXPECTED_WEBHOOK_ORDER, exact owner numbers). Why it matters: as written the suite is a change-detector, not a conformance check — any legitimate governance update must edit two files in lockstep, while a wrong update fails identically to a correct one; the test verifies the JSON equals itself-with-extra-steps and never verifies anything about reality (that referenced owners are open, that stages exist, that captured_main still relates to main). Suggestion: keep structural invariants here (uniqueness, node shape, settlement-before-docs ordering expressed as relations), and move point-in-time facts into either a generated fixture or an opt-in GitHub-API check.

2. docs/architecture/authority-continuity.json:4 — captured_main pins commit b6bcb3e7… but nothing validates it (ancestor-of-main? stale?). Why it matters: this is the manifest's one cryptographic-ish anchor for "current main truth", and it will silently rot on day one after merge; future readers can't tell whether constraints were captured last week or six months ago. Suggestion: add a CI step asserting git merge-base --is-ancestor, plus a documented refresh rule when it goes stale.

3. docs/architecture/proof-carrying-authority.md vs authority-continuity.json — global law Terminal tool #1 says machine-readable state outranks narrative prose, yet the .md hand-duplicates every owner/child mapping from the JSON and no test cross-checks the two. Why it matters: the document will drift from the manifest (the exact failure mode law Terminal tool #1 warns about), and readers can't tell which side is authoritative when they disagree. Suggestion: generate the per-interlock markdown sections from the JSON at build time, or add a conformance test extracting issue/PR numbers from the .md and comparing them to the manifest.

4. tests/conformance/test_authority_continuity_manifest.py (referential integrity) — all kind/number nodes are validated only as positive ints; a typo'd reference (91893 instead of 91983) passes forever. Why it matters: the whole value of an interlock graph is that its edges point at real objects; silent dangling edges undermine the contract's core promise. Suggestion: add a slow/opt-in test (marked for nightly, not per-push) that resolves every node via the GitHub API and fails on nonexistent/closed-as-wrong objects.

5. authority-continuity.json (schema) — schema_version: 1 exists but no JSON Schema ships alongside, so "version 1" has no defined meaning; the conformance test's ad-hoc asserts are the only de-facto schema. Suggestion: commit a JSON Schema for pipeline/interlock records and validate the manifest against it first — then value-level tests stay focused on semantics.

nit: tests/conformance/test_authority_continuity_manifest.py:49-56 — _interlocks_by_id(_manifest()) re-reads and re-parses the JSON in every test; a module-scoped fixture would do once.

— reviewer-h (automated AI reviewer)

[andrexibiza]

@Enough1122 The review is correct about the underlying conflation. The current head mixes three different responsibilities—schema validation, architecture-law conformance, and a point-in-time topology snapshot—and then calls the aggregate a conformance suite. The snapshot assertions were intentional, but they are duplicated in the test module and are not sufficient as independent proof.

I’m treating this as one class-level correction rather than five isolated patches:

• ship a JSON Schema so schema_version: 1 has an actual contract, and validate the manifest against it first;
• keep the fast pytest layer limited to structural and relational invariants: unique identities, valid node shape, stage/role relations, settlement-before-publication ordering, retirement gates, and similar laws;
• move point-in-time owner mappings out of duplicated module constants into one explicit generated snapshot/projection;
• generate the interlock sections of proof-carrying-authority.md from the JSON, with CI requiring a clean regeneration, so the narrative cannot become a second authority;
• validate that captured_main exists and is an ancestor of the checked object, while adding explicit capture metadata and a refresh rule—ancestry alone proves lineage, not freshness;
• add an opt-in/nightly GitHub referential-integrity check that resolves every referenced issue/PR and validates existence, kind, and declared state/disposition.

One nuance on the network check: closed cannot be treated as automatically invalid. Historical fossils and completed delivery objects may intentionally be closed; the check needs per-node allowed-state/disposition semantics and should fail only when the live object contradicts the manifest’s declared role.

The module-scoped fixture nit is also correct and belongs in the same cleanup. I do not consider the current head complete until these layers are separated and the revised exact head has fresh local and hosted verification.

[andrexibiza]

Supplementing the disposition above with two exact-state clarifications from the live read:

• The governance snapshot must remain independent of the manifest. Generating expected owner mappings from the same JSON would make the check self-validating; structural relations may be derived, but policy locks need a separately reviewable authority.
• The anchor problem is already concrete: main at 261a4efb is 75 commits ahead of captured base b6bcb3e7. git merge-base --is-ancestor would still pass, so it is only a lineage floor—not a freshness test. This branch needs a rebase and refreshed capture binding before replacement exact-head receipts are valid.

That does not change the class-level correction already stated; it makes the policy-proof and freshness boundaries explicit.

[Enough1122]

Thanks @andrexibiza — both clarifications accepted:

1. Governance snapshot independence: expected owner mappings move to a separately reviewable authority input rather than being generated from the manifest under test; structural relations may stay derived, but nothing policy-locking self-validates against its own subject.
2. Freshness gate: agreed merge-base ancestry is only a lineage floor. Adding a recorded capture-time main SHA plus an ahead-by freshness assertion (warn/fail when main advances past it), and rebasing the captured base onto current main before the next push.

[teknium1]

Closing with #91316/#91895 — the manifest pins open-PR head SHAs and asserts them in a conformance test, which is a change-detector test on process artifacts (guaranteed stale the moment any referenced branch moves). Architecture intent for the update campaign lives in tracking issue #91277 and AGENTS.md instead.