Transcript commitment: Toolpath-Head trailers in signed commits, verified by the pathbase door at upload

[bdelanghe]

The v2 extension designed in #180's comments, promoted to its own issue now that the vendor's published CLI docs upgraded the mechanism. Goal: make the claim thread's toolpath link checked testimony — proof that this transcript produced these commits, tamper-evident from commit time.

The problem it closes

Commits carry Claude-Session: … trailers — self-assertion a third party cannot verify. Transcript↔commit cross-references prove only consistency: SHAs are public, so a transcript could be fabricated around them after the fact.

The design (upgraded: live tracking, not post-hoc import)

The original sketch imported the transcript at the end and stamped its head retroactively-ish. The vendor CLI's path p track group removes that weakness — it builds the Path incrementally as work happens (track init / track step / track annotate / track export), so the hash-chain head exists at commit time:

1. A session hook (or prx integration) runs p track alongside the work; at each git commit, the current chain head is stamped into the signed commit as a trailer: Toolpath-Head: <hash> — beside the existing Claude-Session: trailer.
2. Git writes are already verified against a signed owner (org convention; the main ruleset enforces verified signatures) — so each head lands inside an object that cannot be forged retroactively. Prerequisite already learned the hard way: no -c commit.gpgsign=false, ever (Pathbase door: schema- and DO-bound write-only gateway on the Worker (no session credential, no egress grant) #180's record).
3. At upload, the pathbase door's DO verifies the shared document's chain passes through every head the PR's commits committed to before accepting it and posting testimony. A document that doesn't chain through the stamped heads is refused — fabrication now requires forging a signed commit.

The claim thread's link becomes testimony three ways: claim ↔ branch (claimant convention, #113), commits ↔ transcript (head commitment, DO-verified), transcript ↔ session (the recorded tool calls that made those commits).

Boundary, restated so it never gets promoted

This proves this transcript produced these commits. It does not prove the runtime was a genuine Claude session — no platform attestation exists (#119's family; infra#328's SPIFFE plane is the eventual answer for org-floor rooms, and cloud sessions stay unattested until the platform exposes signed per-session metadata). The session URL stays human-checkable by the account owner.

Build home and pieces

• The head-stamping contract belongs in ocap-provenance ("git-writes today; egress and external reads next"), with keeperd as verifier kin — not ad hoc in a hook, though a hook is the likely v0 carrier.
• The door-side check is a small DO addition (parse trailers from the claim's PR commits via the App token it already holds; walk the uploaded chain).
• Chain-walk needs the toolpath document's step-hash linkage — path p validate / the format spec define it; verify the door can walk it cheaply at 30MB scale before committing to inline verification vs. ledger-flagged async.

Relations

#180 (closed — the door, and the design thread this promotes) · #113 (claim↔branch↔PR gate) · infra#363 (authenticated read URLs — the reviewer surface) · .github-private#513 (cost accounting — same document, different lens) · ocap-provenance / keeperd (contract home).