test(devtools): guard proofs with production reachability

.beads/issues.jsonl

@@ -1,3 +1,4 @@
+{"_type":"issue","id":"polylogue-jdesf","title":"verification: enforce hermetic test-path boundaries","description":"Complete the hermeticity half of the production-reachability oracle. Tests that certify production behavior must not read ambient user or live archive paths unless they declare and enter an explicit production-safe fixture boundary.","design":"Add a structured fixture-boundary declaration and verifier in devtools, integrate it with the production reachability seam checks, and cover ambient ~/.codex, ~/.claude, configured archive-root, and explicit temporary fixture paths. Keep tests deterministic and fail closed on undeclared escapes.","acceptance_criteria":"1. A production-reachability seam can declare its fixture boundary and the verifier rejects undeclared reads of ambient user/session/archive paths. 2. Explicit workspace_env or temporary fixture paths remain allowed and are checked against the declared boundary. 3. Mutation coverage proves removing the guard or widening the boundary makes the test fail. 4. Focused tests and devtools verify --quick pass. 5. No live archive or production mutation is used.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-10T07:49:21Z","created_by":"Sinity","updated_at":"2026-08-10T07:49:21Z","labels":["area:devtools","area:testing","horizon:frontier","lane:reindex"],"dependencies":[{"issue_id":"polylogue-jdesf","depends_on_id":"polylogue-4v2d3","type":"discovered-from","created_at":"2026-08-10T07:49:21Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"polylogue-1mfxh","title":"raw-authority: persist paginated artifact census receipts","description":"Add a durable source-tier raw-authority artifact census and receipt route. It must use the canonical byte-duplicate authority planner, exclude parser-failed rows from the authoritative candidate universe, support resumable bounded pages, validate backup evidence before checkpointing, and persist apply receipts in source.db.","acceptance_criteria":"1. Census candidates are derived through the canonical duplicate-supersession planner and include only the declared accepted parser universe; parser-failed rows and alternate authority logic cannot enter the applied population. 2. Bounded apply supports an exclusive continuation cursor and durable receipt/checkpoint so successive pages cannot repeat or skip rows. 3. Backup manifest and source ownership are validated before checkpoint or mutation, and any invalid or changed evidence refuses without mutation. 4. Each apply page persists an immutable source-tier receipt bound to census, cursor, plan digest, before/after inventory, and command identity. 5. Real temporary-archive tests exercise two pages, stale/invalid backup refusal, parser-failure exclusion, receipt persistence, and red mutations; quick verification passes. 6. No live production apply is claimed by implementation closure.","status":"closed","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-10T00:51:50Z","created_by":"Sinity","updated_at":"2026-08-10T07:17:24Z","closed_at":"2026-08-10T07:17:24Z","close_reason":"Satisfied by merged PR #3911 (9f8a0a4e2). Paginated raw-authority census receipts use the canonical planner, parser-failure exclusion, resumable cursor/checkpoint, backup/ownership validation, immutable receipt binding, and red-mutation coverage. Verification: focused census suite and quick gate passed on exact head e2e80dfb; no live production apply claimed.","dependencies":[{"issue_id":"polylogue-1mfxh","depends_on_id":"polylogue-fbkr","type":"discovered-from","created_at":"2026-08-10T00:52:00Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"polylogue-mupq0","title":"reindex: bind message-owner backfill to durable candidate authority","description":"Make message-owner scope backfill a shared, daemon-safe prerequisite for candidate creation and promotion. The route must reject unscoped assertions, bind receipts to current durable state and candidate ownership, and recover safely after a durable commit before receipt publication.","acceptance_criteria":"1. Direct rebuild and daemon bulk-rebuild paths invoke the same message-owner gate before candidate creation, after archive ownership acquisition, and before promotion. 2. The receipt binds exact durable assertion fingerprints, candidate generation/ownership, and source/index authority; missing, drifted, duplicated, or mismatched state refuses without candidate mutation. 3. A prepared marker supports restart-safe completion after commit-before-receipt interruption and rejects altered post-commit state. 4. Real SQLite route tests and mutation twins cover bypass, durable drift, candidate-owner mismatch, and recovery. 5. Implementation closure does not claim a live candidate or promotion; those remain under the reindex phase receipts.","status":"closed","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-10T00:43:21Z","created_by":"Sinity","updated_at":"2026-08-10T07:17:24Z","closed_at":"2026-08-10T07:17:24Z","close_reason":"Satisfied by merged PR #3909 (f33e859f9). Direct and daemon rebuild routes share the owner gate; durable assertion/source/index/candidate-owner bindings and prepared-marker recovery are implemented. Verification: 54 focused route tests passed on exact rebased head 68d54b736; merge-gate passed; implementation closure does not claim live candidate or promotion.","dependency_count":0,"dependent_count":0,"comment_count":0}
 {"_type":"issue","id":"polylogue-d96ta","title":"testmon: run and publish a bounded fresh seed receipt","description":"Execute a fresh seed-testmon run after the concurrency cap, retain the complete selection denominator and resource receipt, and decide whether the result is a complete red baseline, release-eligible baseline, or typed incomplete/resource-timeout outcome.","acceptance_criteria":"1. The fresh seed runs on a clean selected code tree and records the complete expected node universe, selection digest, harness and dependency identity, and actual worker/resource evidence. 2. The run reaches a typed terminal outcome or records an explicit timeout/incomplete receipt; no partial selection can be promoted. 3. The resulting receipt is independently replayable and accepted only by the typed testmon promotion gate. 4. The exact command, resource envelope, result, and residual failure attribution are published for the release ledger.","status":"open","priority":0,"issue_type":"task","owner":"ezo.dev@gmail.com","created_at":"2026-08-10T00:40:19Z","created_by":"Sinity","updated_at":"2026-08-10T00:40:19Z","dependencies":[{"issue_id":"polylogue-d96ta","depends_on_id":"polylogue-817er","type":"discovered-from","created_at":"2026-08-10T00:40:29Z","created_by":"Sinity","metadata":"{}"}],"dependency_count":0,"dependent_count":0,"comment_count":0}