fix: E01 contract review — claims vs observations, conditional channel, at-rest trust

[TheAmericanMaker]

Corrective follow-up to #414 for E01 (#399), per the maintainer's review. Do not merge until the maintainer has reviewed the handoff on #399. Merging #414 did not close E01; E02/E03 remain blocked and E09 stays on hold.

What this changes

1. Status. "Frozen" → "candidate contract; E01 acceptance pending" in the contract, README, implementation plan, and code comments. The decision record now lists five questions (D1–D5) the maintainer must answer before #399 closes.

2. Claims vs observations. Three layers are kept apart on every proof: the claim (collector, result, exit_code, check — caller text on the tool path), the attestation (provenance.attested_by ∈ adapter | host-tool-result | caller, adapter-set, unknown-field on every input), and the derived authority (proofAuthority → observed only with an observed collector and an observing attestation). Relabelling a caller-reported record host-observed never elevates it — the test pins this for every collector value. proofDischarges refuses claimed proofs under the default verified policy. The qualifying host-tool-result path is specified without CodeCartographer executing anything: a host-side ingestion entry the model's tools cannot reach, configured where agent tools cannot write; the host payload supplies command/cwd/exit code/output digest/tool_call_id; pairing rules are enforced (host-tool-result ⇒ host-observed + tool_call_id; adapter never attests host-observed; snapshots never host-tool-result). Claimed records are retained and disclosed. cooperative is a separate, operator-set, request-unselectable policy, labelled on every result and not authorized for the pilot (D5).

3. MCP elicitation stays conditional. VERIFIED_ACCEPTANCE_INTEGRATIONS (empty) is the only source of support; acceptanceChannelSupported refuses any host/client pair not in it, whatever the client advertises or the adapter asserts. The integration check's four required observations (presentation, acceptance, rejection/cancellation, stale/mismatched response) are documented. Unverified paths stop at needs-human-acceptance. The claim is session-attested, not human identity. Nothing here approves the channel (D1/D2).

4. Channel trust ≠ at-rest trust. Approvals carry assurance and storage.boundary at mint; receipts carry client. classifyAcceptance is verified only with a bound receipt, the (host, client, channel) triple in the current registry, the verified policy, and a reader-side CurrentStorage { host-enforced, enforced_since } whose epoch precedes decided_at. A real UI decision in an agent-writable namespace is cooperative; a forged record spelled host-enforced/verified_integration: true stays cooperative under boundary none or a later epoch (so enabling a boundary later cannot launder it); a record may not label itself verified over storage.boundary: none. The same-user-filesystem caveat is kept and is not used to satisfy the stronger requirement. No credential/token/signature system; Pi guards untouched.

Verification (on 92b034a, Linux, Node v22.22.3)

Step	Result
node --test tests/engineering-contract.test.mjs	21 pass, 0 fail
mutation: proofAuthority trusts the collector label	2 tests fail; reverted
npm run build	exit 0
npm test	969 pass, 0 fail
git diff --check; hygiene scan	clean

Fixtures: +2 valid (caller-reported proof, cooperative approval), +14 negative (132 total); tests +3.

Independent review

Round A (on b787ca1, opus, findings-only): met demands 1 and 3; 2 and 4 partial — eleven findings with concrete triggers (host-tool-result reachable by the model, boundary-toggle laundering, self-reported verified_integration, unenforced pairing rules, doc/code table drift, wording). All folded into 92b034a except two that are the maintainer's to answer and are now D3/D4/D5 sub-questions. Round B (on 92b034a, sonnet): all nine tightenings verified closed by probe; no findings; nothing classifies verified against the contract's own empty registry.

Open for the maintainer (contract § Decision record)

D1 MCP elicitation on a named verified host/client pair? D2 Pi host-native? D3 storage-boundary mechanism, where its declaration and enforced_since live, boundary-before-first-write? D4 observed-evidence path: must E05's entry be demonstrably unreachable by the model and its hook config outside agent-writable roots? D5 is cooperative permitted at all, and do honest agent-claimed records discharge equally there?

Refs #399, #398

🤖 Generated with Claude Code