Run the append gate on receipt 0.6.0: commit-addressed verification

[MaxGhenis]

Receipt 0.6.0 binds the append verdict to a named commit and its tree. This migrates the isolated-checkout shim from #241, preserving its four Chronicle spec-binding wrappers and required full-OID parser while delegating object verification to the released package.

Pin and release preconditions

pyproject.toml pins receipt==0.6.0; uv.lock records the published wheel and sdist hashes. Wheel SHA-256: 84dd540bc77f14547bcf5b4654ff22184a404aa280d8b13cda8e179593575734.

The annotated v0.6.0 tag peels to a2228e40fc0bb2d8e525cae61b91ea495eec4112, the reviewed head named in receipt #59. Saved PyPI metadata and the completed publish-verification log confirm publication; the local wheel matches the published hash. All 14 installed receipt files match that wheel byte for byte. The exact v0.5.2..v0.6.0 append-gate diff confirms the commit parameter and seven-field verdict contract.

Contract and responsibility

--commit remains required, without a default, and reuses _object_id_argument to require a full OID. The four spec-binding wrappers remain. verify_append_gate now requires commit and delegates to verify_append_gate_verdict, returning its AppendGateVerdict. Success prints the unchanged summary, then candidate commit <candidate_commit> tree <candidate_tree> using the package's fields.

The package selects and rehashes commit/tree/blob objects, establishes ancestry against the selected base, and privately materializes protected bytes for its leaf verifier. The candidate's working tree and index do not supply the verdict's bytes. The shim's seven checkout, scan, hash and worktree-removal functions are deleted.

The shim retains the frozen process environment, private scratch/configuration lifetime, full-OID argument parser and Chronicle-owned spec and trust anchors. The outer freeze remains necessary because the public append entry refuses redirecting variables before the reader sanitizes its environment, and because the shim's own configuration commands precede that reader. The package drops every inherited GIT_*, creates its own safe.directory-only global configuration, and audits includes, hooks, filesystem monitors, program-valued connection settings, partial clones and fsck weakening settings itself. The shim keeps only its existing additional local/worktree policy against filter.*, core.sparseCheckout and core.sparseCheckoutCone, plus the audit of its own global/system scopes. Receipt does not refuse those additional settings because object reads use neither filters nor the sparse index. The module docstring states these boundaries and the same-user trust boundary.

The pin also removes receipt APIs eagerly imported by the companion release-chain shim. Four unused git-helper aliases and materialize_base_tree are removed. Its remaining history/base-chain wrappers use entered snapshots; --base-ref now compares HEAD objects and verifies that same candidate's private materialization. Ordinary directory verification, legacy help bytes and the authenticated oracle fixtures are preserved. Two CLI tests cover valid committed history under a dirty workspace and a committed rewrite hidden by a repaired workspace.

Workflows and default-branch copy

The pull_request_target path passes --root "$candidate" --commit "$MERGE_SHA" --base-ref "$BASE_SHA". The candidate path captures and validates git -C "$GITHUB_WORKSPACE" rev-parse HEAD before passing --commit "$workspace_sha"; this preserves #241's protection against an unnoticed failed command substitution. Push passes --commit "$GITHUB_SHA", and the candidate checkout retains fetch-depth: 0.

Both base-owned help-probe compatibility branches are retained. Every shell block enables pipefail. A byte-identical copy is committed on shim/receipt-0.6-workflow for main, following #242; its head is 2f9f5de5c534d15fc64d70a6f742deb7ccf784ba. Main already carries all three commit arguments from #242, so this copy updates the documentation and shell-block form.

Recommend enabling require branches to be up to date before merging on codex/thesis-ledger-facts. A stale GitHub test merge remains a consumer branch-protection concern; no branch protection was changed.

Tests and byte-equivalence proof

The pre-bump proof at receipt 0.5.2 passed all 18 cases. At the released 0.6.0 wheel:

Suite	Cases	Result
Shim isolation	34	34 passed
Append adversarial	33	28 passed, 5 existing strict xfails
Series catalog	155	155 passed
Byte-equivalence proof	18	18 passed
Release chain	64	64 passed
PolicyEngine ledger	9	9 passed
Total	313	308 passed, 5 xfailed

The isolation suite previously held 37 cases. Ten tests whose subject was a private checkout, its index/byte comparison, or its worktree registration are removed because the shim no longer creates that subject. Committed unsafe entries, attributes, configuration refusals, parser behavior, frozen environments and scratch cleanup remain covered. Seven new cases enforce the required commit and exercise acceptance/refusal for the PR-target, candidate and push paths against the installed wheel. They assert exact verdict OIDs with disagreeing HEAD/index/workspace, and refusal when repaired local state conceals bad committed data. Subprocess environment recording includes the package's long-lived cat-file child and asserts no worktree command runs.

uv run --frozen -q pytest -q tests/test_thesis_append_shim_isolation.py tests/test_thesis_append_adversarial.py tests/test_build_series_catalog.py
217 passed, 5 xfailed in 52.87s

The released-pin proof and workflow companions passed together: 91 passed in 31.31s. Summary/refusal bytes agree with the authenticated original scripts, and the new verdict line is asserted separately. The original fixture hashes are unchanged. Ruff checks and workflow shell syntax checks pass. Both direct append invocations on the committed implementation head pass, with and without a base.

Shell DNS prevents both branch pushes in this sandbox. These results are local; the PR's Append gate and Trusted base append gate checks remain pending and must pass before this draft is ready.

🤖 Generated with Claude Code

[MaxGhenis]

Maintainer read of 727cd47 (the lane's five commits plus one that keeps its log out of the tree), against the plan's section 3.10 and receipt 0.6.0 as installed.

What we ran. The requested suite at this head with the released wheel (uv run --frozen): 217 passed, 5 xfailed (the five strict expected failures the adversarial module already carried against the installed package); the companion modules (test_receipt_shim_transparency.py, test_release_chain.py, test_policyengine_ledger.py) 91 passed. On the PR, the Append gate and Trusted base append gate workflows, which run this shim, are green. The lockfile was written without network by the lane; I checked it online: uv lock --check reports it current, uv sync --frozen installs 0.6.0, and the recorded artifact URLs and hashes are PyPI's (wheel 84dd540b…, sdist c84f221d…, the digests verified after publication).

Each item of 3.10 against the diff.

1. --commit is required, a full OID through the existing _object_id_argument, passed to verify_append_gate_verdict; the second output line is the package's own candidate_commit and candidate_tree, so the log names the tree it judged. The four spec-binding wrappers remain.
2. The isolated checkout is gone with its seven functions, the hook directory, the scan settings and the index and byte assertions; the package reads objects. What the shim keeps, and why, is in the module docstring, and I checked the two mechanism claims it makes against 0.6.0's reader: the package's configuration deny list covers core.hooksPath, core.fsmonitor, includes, program-valued connection keys, partial-clone and fsck-weakening keys, and it does not cover filter.* or core.sparseCheckout, so the shim's retained refusals are exactly the gap and nothing else (test_repository_configuration_redirects_are_refused shows the split: the shim refuses filters in its own words, the package refuses the rest). The frozen environment stays because the public append entry refuses redirecting variables before the reader sanitizes them.
3. The workflow keeps the three explicit --commit arguments and fetch-depth: 0, corrects its comments to the object-reading contract, and runs the five test modules under pipefail; the copy on main (Document commit-addressed verification in the trusted append workflow #249) is byte-identical to this branch's file.
4. Installed-package tests: an autouse fixture proves every subprocess imports the released wheel, not a checkout; each workflow path (pull-request merge commit, candidate, push) is exercised twice, once with HEAD, index and workspace all disagreeing with the selected commit and the verdict still naming it, once with a refused committed candidate that a repaired workspace cannot rescue; the ten removed tests all had the private checkout, its index, its byte comparison or its registration as their subject, which the 0.6 shim no longer creates.
5. The release-chain shim lost five aliases (git_blob_bytes, git_file_entry, git_tree_entries, resolve_base_commit, materialize_base_tree) that 0.6.0 no longer exports, and its --base-ref path now selects HEAD and the base as snapshots, checks ancestry, compares release history between them, and verifies the candidate's private materialization; two CLI tests show a dirty workspace cannot change the committed verdict and a repaired workspace cannot hide a committed rewrite.
6. The byte-equivalence proof is recorded at the 0.5.2 pin before the bump and re-run at 0.6.0 (the lane's commits 8c729dd and d168041).

The PR body recommends "require branches to be up to date before merging" on codex/thesis-ledger-facts and changes no branch protection.

Independent round. GPT-6 Astra on 727cd47, verdict block verbatim in the next comment.

[MaxGhenis]

Independent round 1 on 727cd47 (GPT-6 Astra, 2026-09-05), verdict block verbatim. The medium (the base commit and tree missing from the verdict line on --base-ref runs) and the low (checkout wording in the proof helpers) are folded on this branch by the maintainer; the folded head gets the round again.

---SUBFLEET-VERDICT-BEGIN---
{"schema_version":1,"artifact_revision":{"kind":"pr","repository":"PolicyEngine/chronicle","number":248,"head_sha":"727cd474baeced5c856a11cb1fd32320f4544adc","base_sha":"bc619d697533e8f37b6520d3d9464b0afdcefffb"},"findings":[{"severity":"medium","location":"scripts/check_thesis_facts_append.py:508-509","description":"Successful --base-ref runs omit the required base_commit and base_tree. A released-wheel fixture probe returned both base fields but stdout contained only the candidate pair; existing acceptance tests enforce that incomplete output. Append the returned base pair to the second line when present and update the PR/candidate and byte-equivalence assertions.","residual_class":false},{"severity":"low","location":"tests/test_receipt_shim_transparency.py:173-196","description":"Proof helper docstrings still describe a checkout made by the shim. Source inspection confirms that machinery was removed; the passing proof now exercises receipt's commit objects and private materialization. Update the obsolete checkout wording.","residual_class":false}],"notes":["Pin and both artifact hashes match the requested PyPI values; all 14 installed receipt files match the released wheel.","Required full-OID --commit, four spec-binding wrappers, verdict pass-through and candidate identity logging verified.","Removed active configuration refusals are covered by receipt 0.6.0; retained filter/sparse policy is correct. Global/system audit overlap is harmless and nonholding.","All three workflow commit paths, case ordering, full fetch and byte-identical default-branch companion verified; both required GitHub checks succeeded on the exact PR head.","Frozen three-suite run: 217 passed, 5 xfailed in 56.04s. Independent byte-equivalence proof: all 18 cases passed.","PR recommends up-to-date branches; its diff contains no branch-protection mutation. Protection history could not be independently established through the restricted API.","Tracked files and HEAD unchanged; no commits, pushes or custody-file writes. No high-severity or new concurrent-writer residual finding."],"summary":"Changes requested because successful base-relative verdicts omit the required base identities; the released-wheel tests, proof and CI otherwise pass.","verdict":"changes_requested"}
---SUBFLEET-VERDICT-END---

[MaxGhenis]

Independent round 2 on 5a9d02f (GPT-6 Astra, 2026-09-05), verdict block verbatim: approve, one low (three proof comments still said "checks out"), folded on top as 93187f4. Merging with a merge commit on agreement and green CI; the byte-identical workflow copy on main (#249) merges after it.

---SUBFLEET-VERDICT-BEGIN---
{"schema_version":1,"artifact_revision":{"kind":"pr","repository":"PolicyEngine/chronicle","number":248,"head_sha":"5a9d02f5134909ed26413ddd7b38fdbc9283106d","base_sha":"bc619d697533e8f37b6520d3d9464b0afdcefffb"},"findings":[{"severity":"low","location":"tests/test_receipt_shim_transparency.py:396-398","description":"Supporting proof wording still says the shim checks out the named commit; lines 430-432 and 589-591 likewise describe removed checkout machinery. Source inspection and all 18 passing proof cases confirm committed-object verification. Update these remaining comments and docstrings to describe receipt's object reads and private materialization.","residual_class":false}],"notes":["R1 medium closed: the second line uses returned candidate/base commit and tree fields; every assertion pinning that line uses fixture OIDs.","The fold is one commit changing only the append script and three test files; other R1 closures remain intact.","Exact receipt 0.6.0 pin and both requested artifact hashes verified; all 14 installed receipt files match the released wheel.","Removed configuration refusals are covered by receipt; retained filter/sparse policy is correct. Global/system audit duplication is harmless, low and nonholding.","All three workflow commit paths, case ordering, full fetch and identical companion workflow verified; both required GitHub jobs succeeded on the specified head.","Required suites: 217 passed, 5 xfailed in 53.64s. Byte-equivalence proof: 18 of 18 passed individually.","PR records the proof and recommends up-to-date branches; its diff contains no branch-protection change.","No new concurrent-writer residual finding; tracked files and HEAD unchanged, with no commits, pushes or custody-file writes."],"summary":"Approve with one remaining low wording finding; the base-identity fix, released-wheel tests, byte-equivalence proof and required CI checks pass.","verdict":"approve"}
---SUBFLEET-VERDICT-END---