fix: withhold private child-usage authentication and pair extras

[seathatflowsinourveins]

Scope

Withhold private raw-output authentication from 12 published child-usage receipts and preserve the six frozen ledger bindings through the CC-ruled append-only redaction-supersession kind. The landed #995 writer is preserved unchanged; its published pair allowlist contains labels and the two agent IDs, with native keys local. Original sweep records, policy, votes and counters are unchanged.

The previous migration gate is resolved by option (b). Six records appended through the native ledger command bind each original published Git blob to its redacted successor. Both immutable history and current registered bytes are verified; no append-only check or publication guard is bypassed.

• PR merge base: main 489b263286edd87493689347a5411b263d60e306, including landed Apply verified event scopes to CI secret scans #949, fix(landscape): bind completed supersessions and redact scratch sessions #995 and Finalize 373 starred repositories with guarded retention and source coverage #1016.
• Main receipt snapshot: 421bf3f98b631d931838c22a927b4fec246f7df8.
• Lane: lane:foundation.
• Owned paths: receipt fields, publication/writer regressions, native ledger/checker/schema/readers, generated final-stack source binding, native registrations and decision documentation.
• fix(landscape): bind completed supersessions and redact scratch sessions #995 landed as 429f0421; Apply verified event scopes to CI secret scans #949 and Finalize 373 starred repositories with guarded retention and source coverage #1016 advisory appends are on the current base. The PR remains a draft until the co-op verifies the adapted head.

SOTA sources

• Original writer defect at 43f3008e, proven_supersessions, and native sweep_common.py json_text: use the existing validated pair fields and exact published proof serialization.
• Native ledger at 421bf3f9, Checker, append, record_sha256, write_ledger, check_append_only: this extends its existing record chain and native atomic writer. The unchanged-prefix checker and re-chained-rewrite regression are preserved exactly.
• Installed Git 2.53.0: native git cat-file checks the historical source object is a commit, and git show resolves the immutable commit:path blob, following the ledger's existing pinned-history mechanism. Lazy fetching and optional locks are disabled during verification; missing history fails closed.
• #161 published-byte guard at 421bf3f9: authentication of published safe bytes differs from authentication of a private original.
• CC option (b), redaction-supersession ruling relayed 2026-10-12T06:16:33Z. No new research harness, runtime, decoder or model client is introduced.

Evidence-class table

Claim	Evidence class	Command / receipt
Twelve receipt raw-output seals and the original pair-extra defect fail before correction; current writer fix is supplied by landed #995	synthetic/local_integration	Receipt-set and runtime-built example.org public-CLI regressions, exit 1 before and exit 0 after
Redacted receipt bindings fail on the old checker	local_integration	Six mismatches plus two dependent readability errors; new fixture has one failure and one error before extension
Six native records repair those bindings without rewriting history	local_integration	Native --append batch, --check --base, independent unchanged-sweep comparison
Tampering, missing/non-commit history and altered counters fail closed	synthetic	Redaction-supersession fixture controls, including refreshed registration and declared successor digest
Newest binding governs current bytes; every predecessor is verified	synthetic	Two successive native bindings with both historical commits retained
Saturation results and final-stack decisions remain unchanged	local_integration	Derived/completed-sweep equality; native final-stack refresh changes only ledger source digest

Historical local commands at the original review head

python3 -m unittest tests.test_child_usage_publication.ChildUsagePublicationTests
before first correction: exit 1, two failures; corrected: exit 0

python3 -m unittest tests.test_saturation_ledger.RedactionSupersessionTests.test_redacted_usage_has_append_only_historical_and_successor_bindings tests.test_saturation_ledger.RedactionSupersessionTests.test_native_append_repairs_redacted_binding_without_changing_old_records
before extension: exit 1, one failure and one error; corrected: exit 0

python3 scripts/saturation_ledger.py --append <public-redaction-binding-input.json>
exit 0; six redaction-supersession records appended atomically

python3 scripts/saturation_ledger.py --check --base 421bf3f98b631d931838c22a927b4fec246f7df8
python3 scripts/saturation_ledger.py --check --base ddd706be88f2dabe53beef9a10cef9bf3f3fdd2f
exit 0; chain and current/historical bindings verified

python3 -m unittest tests.test_saturation_ledger.RedactionSupersessionTests tests.test_saturation_ledger.IntegrityTests.test_a_rechained_rewrite_is_caught_against_the_base_commit
exit 0; eight focused tests, including native failed-batch no-write control

python3 -m unittest tests.test_saturation_ledger tests.test_child_usage_publication tests.test_landscape_postrun tests.test_published_digest_privacy tests.test_component_matrix tests.test_final_stack
Historical pre-rebase broader qualification: exit 0; 271 tests, 1 optional skip, 299.495 seconds
The failed-batch test was then added and passed in the final eight-test selection.
The current six-module inventory is 272 tests; a second full run is not claimed.

python3 scripts/component_matrix.py --check
exit 0; 32 rows

python3 scripts/final_stack.py --write
python3 scripts/final_stack.py --check
exit 0; 34 layers; only the ledger source digest changed

python3 scripts/validate.py
exit 0; 70 components, 11746 files, 4 profiles, 239 receipts

python3 scripts/evidence_manifest.py --check
git diff --check
exit 0

The first broad development run exposed schema, seed re-derivation and a no-model-client token-name mismatch. Those were corrected. The original failure is retained, and final broader-suite results are reported in FIX-PUSHED. Seed re-derivation explicitly accounts for a checked redaction binding while preserving every historical semantic field; it does not rewrite the seed. The original append-only checker and rechain regression source are unchanged.

Decision record

docs/decisions/2026-10-12-child-usage-publication-privacy.md; native kind and appender documentation in catalogs/saturation/README.md.

The newest binding authenticates current bytes. Every predecessor must resolve to the named full Git commit/path and match the stored digest. For this #161 kind, receipt JSON may differ only by the private raw-authentication marker. An atomic batch validates the whole proposed ledger before writing; an unrelated broken record, registration or lineage still refuses. Redaction records contain no date, run, vote or layer and cannot count as a fresh sweep.

Historical receipt blobs remain in immutable published Git history, the residual the CC explicitly ruled equivalent to #177. The new digest bindings authenticate those already-published Git preimages; they do not publish the private raw-output preimage or its original digest anew.

Host evidence

No host receipt, platform-status or live configuration change. Original private authentication remains in host state.

Follow-ups

• The owning rule-4 publication audit extends to JSON receipts as well as Markdown.
• Future raw-output/contract/journal authentication stays private until its publication representation binds a published safe preimage.
• Native scanner unavailable flakes remain in co-op row 44; diagnose timeout/resource cause while preserving fail-closed behavior.
• Read/archive transport must retain the pinned Git history needed by the binding checks; an absent object is a refusal, not a pass.

Checklist

• Failing-before receipt, pair-extra and ledger-binding regressions are retained.
• Original sweeps and all other receipt fields are unchanged.
• --check --base and the original rechain guard remain unchanged and pass.
• Native writers/registration regenerate all changed bindings.
• No credential, real identity fixture, provider call, broker action or scan bypass.
• Landed dependencies, current main base and adapted carry are explicit; draft status retained.

Adapted rebase after the append chain

Previously reviewed content head e130a75 was rebased onto main 7151664. Its pure registry-rebase equivalent is 7a4c7db on main 489b263. The original public input and history bindings remain unchanged. Three receipt/ledger/whitespace commits replayed, then ONE dated native advisory commit appended after #949 and #1016. The original read head a52e89e is superseded only by the exact leased push.

Beyond pure replay from a52e89e: preserve landed #995's entire usage_record.py, removing the obsolete five-field pair projection; adapt the retained CLI regression to its three public fields; qualify that change and cite landed #995 in the sweep record. Re-register evidence natively over main. The writer README, postrun tests and workflow SHA256SUMS are byte-identical to current main. Ledger implementation/tests/history and F3 whitespace carry are unchanged outside inherited patch context.

The ordered new advisory entry reuses native GitTree/derive_ci_protected at committed 07be055. It derives 346 reads against the unchanged #1016 baseline, with two extra saturation-ledger reads, exact script/shape/location differences and permission_change false. No historical delta or baseline is rewritten. Source: blueprints/runtime-workers/openhands/evidence/advisory-gate-deltas.md at 7151664; its cited native Git/CPython mechanisms are reused without changing the resolver gate.

Historical bounded checks at reviewed content head e130a75:

• python3 -m unittest tests.test_child_usage_publication: 2 tests, exit 0.
• python3 -m unittest tests.test_saturation_ledger: 106 tests, exit 0.
• python3 scripts/saturation_ledger.py --check --base origin/main: 12 records, chain/bindings verified, exit 0.
• python3 -m unittest tests.test_runtime_worker_openhands_push_gate: 127 tests, exit 0 at the committed advisory head. The owning advisory check fails before the new entry (1 test / 1 failure / exit 1). The initial full-module attempt with the entry still uncommitted has one failure in its committed-outer-clone fixture; after committing the entry the complete module passes.
• python3 scripts/validate.py: 70 components / 11813 files / 4 profiles / 239 receipts, exit 0.
• Fresh-main merge-tree, diff check, native publication scan and gitleaks: exit 0. No full-suite qualification is claimed.

Carried review Follow-ups

• Qualify the historical source/comment locator independently; preserve explicit historical pins.
• Complete intended scanner/runtime/capture qualification and diagnose row 44's fail-closed unavailable-under-load result.
• Keep inherited hostname/preimage hygiene separate and counts-only; published Git history remains the accepted Linux/WSL2 bootstrap keeps a newer native Claude Code: the pin is a floor (stacked on #159) #177 residual.
• Preserve full Git history in read packets and the explicit draft/base recovery receipts.

The permanent GSD binding regression belongs to #1031 under the later CC ruling, so no #1031 test or source-intake scope is added to this PR. W7 S1 batches remain parked.

Tests-only fixture publication correction

Head 93c1854 adds ONE tests-only correction commit on 7a4c7db; production writer, ledger, receipt bytes, history bindings and advisory accounting are unchanged.

Both the added and inherited Git identity literals in the changed ledger test are replaced with a fixed non-email fixture placeholder. The previous reserved-domain strings were synthetic and do not establish a real-address leak; this correction follows the repository publication rule. No address literal is repeated in this body or the new regression.

The new whole-ledger-test publication guard fails on exact 7a4c7db source (1 test / 1 failure / exit 1; two disallowed literals) and passes after the fix. It distinguishes the documented no-reply domain exception while requiring the current fixtures to publish no email-shaped literal. All three child-usage publication tests and all 106 ledger tests pass, including the historical commit/rechain and redaction controls. Native validator and evidence registration checks pass; only the two changed test registrations are refreshed.

Primary source: installed Git 2.53.0, git/git@67ad421, Documentation/config/user.adoc:1-12 documents that command-scoped user.name/user.email determine author/committer metadata. The unchanged native Git fixture path reproduces successful commits with the non-email placeholder. The repository unittest harness executes the red/green publication guard; no new scanner, decoder or runtime mechanism is introduced.

Astra fix2 Follow-ups (ACK at 93c1854)

• P3-1: correct the live closure-policy locator in docs/decisions/2026-10-01-definitive-sota-wsl-program.md to the current paragraph at scripts/saturation_ledger.py:34-37, or bind its historical revision. Preserve frozen snapshot URLs and dated removed locations; no enforcing citation failure was reproduced.
• P3-2: add a native repeated-binding regression and verify every non-original predecessor against the original receipt's permitted redacted representation. The reproduced original-to-intermediate-to-restored batch authenticates the intermediate bytes while allowing a changed intermediate child_usage.status; the safe final receipt is restored byte-for-byte and remains protected. Current predecessor checks authenticate digests/raw-field shape, while redaction-only semantic comparison covers the original and final bytes. No current privacy leak or changed final counter was reproduced; this is an adjacent-transition follow-up, with no code change in this round.
• P3-3: retain fail-closed scanner/history refusals and supply supported-host scanner/resource qualification plus genuine-worktree ledger/postrun runs through the owning packet process. The archive lacks real Git history and native scanner inputs; focused controls or author-side worktree passes do not convert those archive failures into passes or timing-flake claims. Preserve co-op row 44.
• P3-4: continue inherited hostname hygiene through its owning lane, preserving native evidence bindings. Fix2 counted its own runtime hostname 3 times on 3 inherited lines; the earlier limited read counted a different runtime hostname 20 times on 18 lines. Keep both dated counts separate, with all identity values withheld and no implication that earlier observations disappeared.
• P3-5: supply missing immutable native source blobs, reference trees and historical execution captures through the packet process; keep original private evidence private. Current mechanisms and reconstructible bytes remain distinct from unavailable historic sources, and absence alone is not a blocker or a refutation.

The PR stays draft/class 4. The CC tests-only check and Astra's correction delta await class-1/2 capacity. W7 S1 batches remain parked.

Astra fix2 at 93c1854 is ACK with zero blockers. The head stays frozen for the CC class-4 Claude check; no further commit or push is owed without a CC request.

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T21:15:27.973793Z	93c1854	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: e130a75cc4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[seathatflowsinourveins]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: 93c18540c7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".