From 6bdf263144f2f5465ec232c996666c3c00d16945 Mon Sep 17 00:00:00 2001 From: Codex Date: Sun, 6 Sep 2026 09:13:14 -0500 Subject: [PATCH 1/2] Add source-executed quality review and owner replay checks --- README.md | 22 +++++++ src/hoxline/cli.py | 20 ++++++ src/hoxline/detection_quality.py | 109 +++++++++++++++++++++++++++++++ tests/test_detection_quality.py | 84 ++++++++++++++++++++++++ 4 files changed, 235 insertions(+) create mode 100644 src/hoxline/detection_quality.py create mode 100644 tests/test_detection_quality.py diff --git a/README.md b/README.md index 2552612..08dad06 100644 --- a/README.md +++ b/README.md @@ -37,6 +37,28 @@ See `docs/demo/HOXLINE_ONE_COMMAND_REVIEWER_DEMO_V0.md` for the design contract ## Reusable Review Engine +### Source-executed detection quality + +```powershell +python -B -m hoxline detection-quality --repo-root .. --detections-ref --validation-ref --platform-ref +``` + +This review executes six canonical detection predicates through platform's +validation-owned handoff. It renders observed confusion matrices and real rule +mutation outcomes from the existing controlled corpus. Add `--format json` for +the owner report, or `--verify ` to reexecute and compare a +saved report. Exact clean source, validation, and platform heads are required. +Altered metrics, nested authority additions, source hashes, and AI approval or +closure fields cannot pass replay merely by changing a report checksum. + +Validation owns behavior and metrics; platform delegates; Hoxline renders. +Mutants remain in memory, survivors remain visible, and parser errors never count +as kills. AI authors candidate engineering labor and tests. +AI does not approve disposition, case closure, public-safe status, or proof promotion. This offline +predicate path does not establish backend parity, endpoint execution, runtime +signal, or production detection quality. The owning validation workflow runs the +same path on GitHub-hosted Linux and Windows. + Use the reusable manifest-driven engine when you want the same deterministic ProofOps loop behind a machine-checkable artifact manifest: ```powershell diff --git a/src/hoxline/cli.py b/src/hoxline/cli.py index 159661a..037abb2 100644 --- a/src/hoxline/cli.py +++ b/src/hoxline/cli.py @@ -34,6 +34,18 @@ def main(argv: list[str] | None = None) -> int: parser = _build_parser() args = parser.parse_args(argv) + if args.command == "detection-quality": + from .detection_quality import QualityReviewError, compare_replay, read_report, render_review, run_review + try: + report = run_review(Path(args.repo_root), args.detections_ref, args.validation_ref, args.platform_ref) + if args.verify: + compare_replay(read_report(Path(args.verify).read_text(encoding="utf-8")), report) + print(json.dumps(report, indent=2, sort_keys=True) if args.format == "json" else render_review(report), end="\n") + return 0 + except (QualityReviewError, OSError) as exc: + print(json.dumps({"status": "BLOCKED", "error": str(exc), "human_review_required": True, "ai_disposition_authority": False})) + return 2 + if args.command == "gauntlet" and args.gauntlet_command == "run": return _run_gauntlet(args) if args.command == "gauntlet" and args.gauntlet_command == "metrics": @@ -77,6 +89,14 @@ def _build_parser() -> argparse.ArgumentParser: parser = argparse.ArgumentParser(prog="hoxline") subparsers = parser.add_subparsers(dest="command") + quality_parser = subparsers.add_parser("detection-quality", help="replay validation-owned source mutation quality through platform") + quality_parser.add_argument("--repo-root", required=True) + quality_parser.add_argument("--detections-ref", required=True) + quality_parser.add_argument("--validation-ref", required=True) + quality_parser.add_argument("--platform-ref", required=True) + quality_parser.add_argument("--format", choices=("json", "markdown"), default="markdown") + quality_parser.add_argument("--verify", help="compare a saved owner report with freshly executed source/corpus") + gauntlet_parser = subparsers.add_parser("gauntlet", help="run Hoxline Gauntlet workflows") gauntlet_subparsers = gauntlet_parser.add_subparsers(dest="gauntlet_command") diff --git a/src/hoxline/detection_quality.py b/src/hoxline/detection_quality.py new file mode 100644 index 0000000..c13fee9 --- /dev/null +++ b/src/hoxline/detection_quality.py @@ -0,0 +1,109 @@ +"""Review validation-owned source execution through the platform handoff.""" +from __future__ import annotations + +import json +import os +from pathlib import Path +import re +import subprocess +import sys +import unicodedata +from typing import Any + + +class QualityReviewError(ValueError): + pass + + +def canonical(value: Any) -> str: + return json.dumps(value, sort_keys=True, separators=(",", ":"), ensure_ascii=True, allow_nan=False) + + +def read_report(text: str) -> dict: + def unique(pairs): + result, seen = {}, set() + for key, value in pairs: + normalized = unicodedata.normalize("NFKC", key).casefold() + if normalized in seen: + raise QualityReviewError("ambiguous duplicate report keys") + seen.add(normalized); result[key] = value + return result + def invalid(value): + raise QualityReviewError("non-finite report number") + try: + report = json.loads(text, object_pairs_hook=unique, parse_constant=invalid) + except (ValueError, RecursionError) as exc: + raise QualityReviewError("malformed or ambiguous quality report") from exc + if not isinstance(report, dict): + raise QualityReviewError("quality report must be an object") + return report + + +def compare_replay(supplied: dict, observed: dict) -> None: + # Compare the whole reexecuted owner result, not supplied checksums/metrics. + if canonical(supplied) != canonical(observed): + raise QualityReviewError("report differs from fresh validation-owned replay") + + +def _environment() -> dict: + result = {key: value for key, value in os.environ.items() if not key.casefold().startswith("git_")} + result.update(GIT_NO_REPLACE_OBJECTS="1", GIT_TERMINAL_PROMPT="0") + return result + + +def _platform_identity(root: Path, revision: str) -> None: + if not re.fullmatch(r"[0-9a-f]{40}", revision): + raise QualityReviewError("platform requires an exact commit SHA") + def git(*args): + result = subprocess.run(["git", "-C", str(root), *args], capture_output=True, text=True, env=_environment()) + if result.returncode: + raise QualityReviewError("platform source identity unavailable") + return result.stdout.strip() + if Path(git("rev-parse", "--show-toplevel")).resolve() != root.resolve(): + raise QualityReviewError("platform root is not its Git top level") + if git("config", "--local", "--get-all", "remote.origin.url") not in ( + "https://github.com/HawkinsOperations/hawkinsoperations-platform.git", + "https://github.com/HawkinsOperations/hawkinsoperations-platform", + "git@github.com:HawkinsOperations/hawkinsoperations-platform.git", + ): + raise QualityReviewError("platform repository identity mismatch") + if git("rev-parse", "HEAD") != revision or git("status", "--porcelain", "--untracked-files=no"): + raise QualityReviewError("platform must be clean at the requested head") + + +def run_review(org_root: Path, detections_ref: str, validation_ref: str, platform_ref: str) -> dict: + org_root = org_root.resolve() + platform = org_root / "hawkinsoperations-platform" + _platform_identity(platform, platform_ref) + result = subprocess.run([ + sys.executable, "-E", "-B", str(platform / "scripts/ho_factory.py"), + "detection-quality-run", "--repo-root", str(org_root), + "--detections-ref", detections_ref, "--validation-ref", validation_ref, + ], cwd=platform, capture_output=True, text=True, env=_environment()) + if result.returncode: + raise QualityReviewError("platform rejected the validation-owned quality run") + report = read_report(result.stdout) + _platform_identity(platform, platform_ref) + if report.get("schema") != "hawkinsoperations-detection-quality-v1" or report.get("owner_repository") != "HawkinsOperations/hawkinsoperations-validation" or report.get("status") != "PASS": + raise QualityReviewError("unexpected validation owner, schema, or execution status") + return report + + +def render_review(report: dict) -> str: + metrics, mutations = report["quality"], report["mutation_metrics"] + lines = ["# Detection source quality review", "", + f"Executed: {report['detections_evaluated']} source rules; {metrics['events_evaluated']} controlled events.", + f"Observed: TP={metrics['true_positive']} TN={metrics['true_negative']} FP={metrics['false_positive']} FN={metrics['false_negative']}; precision={metrics['precision']} recall={metrics['recall']} F1={metrics['f1']}.", + f"Mutations: {mutations['generated']} generated; {mutations['killed']} killed; {mutations['survived']} survived; {mutations['errors']} errors; score={mutations['mutation_score']}.", "", + "| Detection | Events | FP / FN | Killed / generated | Survived |", + "|---|---:|---:|---:|---:|"] + for package in report["packages"]: + q, m = package["quality"], package["mutation_metrics"] + lines.append(f"| {package['detection_id']} | {q['events_evaluated']} | {q['false_positive']} / {q['false_negative']} | {m['killed']} / {m['generated']} | {m['survived']} |") + lines.extend(["", "Validation owns the results; platform delegates execution; Hoxline renders this review.", + "AI engineering labor authored candidate changes and tests. AI cannot set expected outcomes, approve disposition, close cases, or promote proof.", + "Survivors need corpus review; they are not silently counted as kills. Parser errors are not kills.", + f"Ceiling: {report['boundary']['proof_ceiling']}; NOT_PUBLIC_SAFE; human review required.", + "Does not prove SIEM backend parity, endpoint execution, runtime signal, production quality, or public-safe proof.", + f"Replay SHA-256: `{report['replay_sha256']}`."]) + return "\n".join(lines) + "\n" diff --git a/tests/test_detection_quality.py b/tests/test_detection_quality.py new file mode 100644 index 0000000..a91e90e --- /dev/null +++ b/tests/test_detection_quality.py @@ -0,0 +1,84 @@ +"""Reject report/AI authority tampering against fresh owner replay.""" +from __future__ import annotations + +import copy +import hashlib +import json +from pathlib import Path +import unittest +from unittest.mock import patch + +from hoxline.detection_quality import QualityReviewError, canonical, compare_replay, read_report, run_review, _platform_identity + + +class QualityReviewTests(unittest.TestCase): + def observed(self): + return {"schema": "hawkinsoperations-detection-quality-v1", "owner_repository": "HawkinsOperations/hawkinsoperations-validation", + "status": "PASS", "quality": {"true_positive": 1, "false_negative": 1}, + "mutation_metrics": {"generated": 2, "killed": 1, "survived": 1, "errors": 0}, + "boundary": {"runtime_active": False, "signal_observed": False, "public_safe_status": "NOT_PUBLIC_SAFE", "human_review_required": True, + "ai_disposition_authority": False, "case_closure_authority": False, "proof_promotion_authority": False}, + "sources": [{"repository": "HawkinsOperations/hawkinsoperations-validation", "head": "a" * 40}], + "inputs": [{"rule_sha256": "b" * 64, "corpus_sha256": "c" * 64}], "replay_sha256": "d" * 64} + + def test_exact_replay_and_json_order_are_deterministic(self): + observed = self.observed() + compare_replay(read_report(json.dumps(observed)), observed) + compare_replay(dict(reversed(list(observed.items()))), observed) + + def test_authority_metrics_identity_and_nested_laundering_rejected(self): + attacks = [ + ("runtime_active", True), ("signal_observed", True), ("public_safe_status", "PUBLIC_SAFE"), + ("human_review_required", False), ("ai_disposition_authority", True), + ("case_closure_authority", True), ("proof_promotion_authority", True), + ("ai_disposition_authority", 0), + ] + observed = self.observed() + for field, value in attacks: + candidate = copy.deepcopy(observed); candidate["boundary"][field] = value + with self.subTest(field=field, value=value), self.assertRaises(QualityReviewError): compare_replay(candidate, observed) + mutations = [ + lambda c: c.update(owner_repository="HawkinsOperations/hoxline"), + lambda c: c.update(status="APPROVED"), + lambda c: c["sources"][0].update(head="e" * 40), + lambda c: c["inputs"][0].update(rule_sha256="e" * 64), + lambda c: c["inputs"][0].update(corpus_sha256="e" * 64), + lambda c: c["quality"].update(false_negative=0), + lambda c: c["mutation_metrics"].update(killed=2, survived=0), + lambda c: c.update(ai_notes={"nested": [{"approval": True}]}), + lambda c: c.update(private_evidence={"path": "../private"}), + lambda c: c.update(closed_cases=1), + lambda c: c.update(human_approval=True), + lambda c: c.update(proof_ceiling="PUBLIC_PROOF_SAFE"), + ] + for mutation in mutations: + candidate = copy.deepcopy(observed); mutation(candidate) + candidate["replay_sha256"] = hashlib.sha256(canonical(candidate).encode()).hexdigest() + with self.subTest(candidate=candidate), self.assertRaises(QualityReviewError): compare_replay(candidate, observed) + + def test_duplicate_unicode_and_nonfinite_json_fail_closed(self): + for text in ('{"a": 1, "a": 2}', '{"Ａ": 1, "a": 2}', '{"n": NaN}', '{"n": Infinity}', '[]', '{broken'): + with self.subTest(text=text), self.assertRaises(QualityReviewError): read_report(text) + + def test_mutable_ref_never_executes_platform(self): + for ref in ("main", "HEAD", "../main", "a" * 39, "a" * 41, "a" * 40 + ":path"): + with self.subTest(ref=ref), patch("hoxline.detection_quality.subprocess.run") as run: + with self.assertRaises(QualityReviewError): _platform_identity(Path("platform"), ref) + run.assert_not_called() + + def test_failed_platform_execution_cannot_produce_success(self): + with patch("hoxline.detection_quality._platform_identity"), patch("hoxline.detection_quality.subprocess.run") as run: + run.return_value.returncode = 1 + run.return_value.stdout = json.dumps(self.observed()) + with self.assertRaises(QualityReviewError): run_review(Path("org"), "a" * 40, "b" * 40, "c" * 40) + + def test_wrong_owner_rejected_even_when_subprocess_returns_zero(self): + with patch("hoxline.detection_quality._platform_identity"), patch("hoxline.detection_quality.subprocess.run") as run: + run.return_value.returncode = 0 + report = self.observed(); report["owner_repository"] = "HawkinsOperations/hawkinsoperations-website" + run.return_value.stdout = json.dumps(report) + with self.assertRaises(QualityReviewError): run_review(Path("org"), "a" * 40, "b" * 40, "c" * 40) + + +if __name__ == "__main__": + unittest.main() From be2cd4f08aa5fe04fff89435de47e20abef9f96e Mon Sep 17 00:00:00 2001 From: Codex Date: Sun, 6 Sep 2026 09:19:22 -0500 Subject: [PATCH 2/2] Refresh case-growth authority observations and immutable CI source set --- .github/workflows/ci.yml | 4 +- .../current-case-growth-index.json | 70 +++++++++---------- .../case-growth/current-case-growth-index.md | 8 +-- tests/test_action_contract.py | 2 +- 4 files changed, 42 insertions(+), 42 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5b9421f..2f1abc2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -11,7 +11,7 @@ jobs: hoxline-trust-boundaries: runs-on: ubuntu-latest env: - HAWKINS_COMMAND_CENTER_IMMUTABLE_OBSERVED_SHA: 5c6127f5acc1031bae2528df3ce1f197da882100 + HAWKINS_COMMAND_CENTER_IMMUTABLE_OBSERVED_SHA: 18a2e00505f4df4e895bf8d9ecc97052d4d03a61 HAWKINS_HOXLINE_EVENT_SHA: ${{ github.event.pull_request.head.sha || github.sha }} strategy: fail-fast: false @@ -31,7 +31,7 @@ jobs: uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: HawkinsOperations/.github - ref: 5c6127f5acc1031bae2528df3ce1f197da882100 + ref: 18a2e00505f4df4e895bf8d9ecc97052d4d03a61 path: org/.github fetch-depth: 0 persist-credentials: false diff --git a/examples/case-growth/current-case-growth-index.json b/examples/case-growth/current-case-growth-index.json index c17be19..2966e11 100644 --- a/examples/case-growth/current-case-growth-index.json +++ b/examples/case-growth/current-case-growth-index.json @@ -1,6 +1,6 @@ { "schema_version": "case-growth-index-v1", - "generated_at": "2026-07-24T15:39:07Z", + "generated_at": "2026-09-06T14:17:30Z", "repo_root": "HawkinsOperations", "proof_ceiling": "CASE_GROWTH_INDEX_CONTROLLED_REPO_AGGREGATION_ONLY", "historical_snapshot": false, @@ -16,10 +16,10 @@ { "repository": ".github", "authority_role": "org command-center routing", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", + "resolved_ref": "agent/source-executed-mutation-factory", "source_commit_sha": "6e6763a81d6af09c2e4588462b56117ce82c2f88", "source_observed_head_sha": "6e6763a81d6af09c2e4588462b56117ce82c2f88", - "current_observed_head_sha": "5c6127f5acc1031bae2528df3ce1f197da882100", + "current_observed_head_sha": "18a2e00505f4df4e895bf8d9ecc97052d4d03a61", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, @@ -48,10 +48,10 @@ { "repository": "hawkinsoperations-detections", "authority_role": "detection source truth", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", + "resolved_ref": "agent/source-executed-mutation-factory", "source_commit_sha": "f8bc0a0925113ca815bf5692081b5216162cc918", "source_observed_head_sha": "f8bc0a0925113ca815bf5692081b5216162cc918", - "current_observed_head_sha": "9e01f43fb350de3370f8c01a323dcdcdf2e33147", + "current_observed_head_sha": "56cad4f726c0d3988c9464693ce7c127c8f63cad", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, @@ -80,10 +80,10 @@ { "repository": "hawkinsoperations-validation", "authority_role": "controlled validation truth", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", + "resolved_ref": "agent/source-executed-mutation-factory", "source_commit_sha": "ebf52f7c6c9b78de767272cc56fccdc584f5c4e0", "source_observed_head_sha": "ebf52f7c6c9b78de767272cc56fccdc584f5c4e0", - "current_observed_head_sha": "677b704150b0f5f333c27913dd481b4be6a78ab7", + "current_observed_head_sha": "c8f3f08995d78fa103115610e5c6a2b85ee61701", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, @@ -112,21 +112,21 @@ { "repository": "hawkinsoperations-platform", "authority_role": "platform contract truth", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", - "source_commit_sha": "a667c4de8b478fe165c3ec612e642bbd5d879492", - "source_observed_head_sha": "a667c4de8b478fe165c3ec612e642bbd5d879492", - "current_observed_head_sha": "4716d7e65525425be4f70127cdc7f7d3de3a7b9e", + "resolved_ref": "agent/source-executed-mutation-factory", + "source_commit_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4", + "source_observed_head_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4", + "current_observed_head_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, "revision_scope": "content_addressed_authority", "source_path": "contracts/public-status-source-contract-v1.json", "authoritative_path": "contracts/public-status-source-contract-v1.json", - "authoritative_git_blob_sha": "5bc7b79b77150413893f3d8147ae211b98d50e5b", - "source_git_blob_sha": "5bc7b79b77150413893f3d8147ae211b98d50e5b", - "source_file_sha256": "3a1cdc74a86230fe6567ddaed396ed45662e9b4efef7e398ae522a3e018317e4", - "authoritative_content_fingerprint": "f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01", - "source_semantic_fingerprint_sha256": "f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01", + "authoritative_git_blob_sha": "70507d53fcc5ce7c89be401d38fd3e43776bc55d", + "source_git_blob_sha": "70507d53fcc5ce7c89be401d38fd3e43776bc55d", + "source_file_sha256": "34b2801c10de7c269220010797a0a1a7c8eae8e26213243940a9b0e2ca3d8cea", + "authoritative_content_fingerprint": "a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841", + "source_semantic_fingerprint_sha256": "a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841", "canonical_origin": "github.com/hawkinsoperations/hawkinsoperations-platform", "observed_origin": "github.com/hawkinsoperations/hawkinsoperations-platform", "repository_dirty_observed": false, @@ -176,10 +176,10 @@ { "repository": "hawkinsoperations-website", "authority_role": "rendering-only public status contract", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", + "resolved_ref": "agent/source-executed-mutation-factory", "source_commit_sha": "5856f8e69527b5e61c3953b88a2ad4c088268655", "source_observed_head_sha": "5856f8e69527b5e61c3953b88a2ad4c088268655", - "current_observed_head_sha": "0e7cb554ee3fd5519142006246201e7b15f0c9b5", + "current_observed_head_sha": "a18a196d4336e088f94c0cec0305c8ae8ebbe0cf", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, @@ -208,10 +208,10 @@ { "repository": "hoxline", "authority_role": "case-growth and fixture-review product truth", - "resolved_ref": "feature/hoxline-case-growth-convergence-v1", + "resolved_ref": "agent/source-executed-mutation-factory", "source_commit_sha": "1cb97efc45ffe753389105645c25ed7fe57cf9e5", "source_observed_head_sha": "1cb97efc45ffe753389105645c25ed7fe57cf9e5", - "current_observed_head_sha": "52867ee7e332dba3cab4d2c3e308d636ed5bb610", + "current_observed_head_sha": "6bdf263144f2f5465ec232c996666c3c00d16945", "source_observation_kind": "reviewed_immutable_commit", "source_parent_sha": null, "self_referential": false, @@ -238,7 +238,7 @@ "next_legal_action": "none; preserve source ownership" } ], - "source_manifest_digest": "f295e5268283eeed408bd42c80c38a70b438a166d7882a75d3fd2b9bd79f957e", + "source_manifest_digest": "e19616241e7b762e1fa8462a5b3d8cbf086e603154ea50c21f371df3e46a7167", "contradictions": [], "drift": [], "next_legal_action": "none; current source-controlled inputs converge", @@ -247,7 +247,7 @@ "repo": ".github", "path": ".github", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "org metadata and reviewer routing only; not proof authority", "files_scanned": 37 @@ -256,7 +256,7 @@ "repo": "hawkinsoperations-detections", "path": "hawkinsoperations-detections", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "source package and source status authority only", "files_scanned": 93 @@ -265,16 +265,16 @@ "repo": "hawkinsoperations-validation", "path": "hawkinsoperations-validation", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "controlled validation authority only", - "files_scanned": 202 + "files_scanned": 204 }, { "repo": "hawkinsoperations-platform", "path": "hawkinsoperations-platform", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "platform runtime-candidate, collector, receipt, and ledger contract authority only", "files_scanned": 121 @@ -292,7 +292,7 @@ "repo": "hawkinsoperations-website", "path": "hawkinsoperations-website", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "route/rendering surface only; not proof authority", "files_scanned": 274 @@ -301,10 +301,10 @@ "repo": "hoxline", "path": "hoxline", "exists": true, - "branch": "feature/hoxline-case-growth-convergence-v1", + "branch": "agent/source-executed-mutation-factory", "dirty": false, "authority_boundary": "product metrics and Hoxline Gauntlet artifact authority only", - "files_scanned": 181 + "files_scanned": 182 } ], "repo_slot_accuracy": { @@ -499,7 +499,7 @@ "case_state": "BLOCKED_WAITING_NEXT_GATE", "metrics_available": false, "metrics_refs": [], - "last_updated": "2026-07-24T08:54:44-05:00", + "last_updated": "2026-09-06T08:56:27-05:00", "next_gate": "proof-record-specific human review before any public-safe, runtime, or signal promotion", "evidence_confidence": "HIGH", "notes": [ @@ -933,7 +933,7 @@ "case_state": "BLOCKED_WAITING_NEXT_GATE", "metrics_available": false, "metrics_refs": [], - "last_updated": "2026-07-24T08:54:44-05:00", + "last_updated": "2026-09-06T08:46:02-05:00", "next_gate": "separate runtime receipt and proof review before any runtime, signal, public-safe, production, or approval wording", "evidence_confidence": "HIGH", "notes": [ @@ -1013,7 +1013,7 @@ "case_state": "BLOCKED_WAITING_NEXT_GATE", "metrics_available": false, "metrics_refs": [], - "last_updated": "2026-07-24T08:54:44-05:00", + "last_updated": "2026-09-06T08:46:02-05:00", "next_gate": "reviewer validates source and controlled-test validation before any separately approved private runtime gate", "evidence_confidence": "HIGH", "notes": [ @@ -1179,7 +1179,7 @@ "case_state": "BLOCKED_WAITING_NEXT_GATE", "metrics_available": false, "metrics_refs": [], - "last_updated": "2026-07-24T08:54:44-05:00", + "last_updated": "2026-09-06T08:46:02-05:00", "next_gate": "blocked until separate runtime or signal evidence review supports any runtime, routed-telemetry, public-safe, production, autonomous SOC, or disposition-authority promotion", "evidence_confidence": "HIGH", "notes": [ @@ -1271,7 +1271,7 @@ "case_state": "BLOCKED_WAITING_NEXT_GATE", "metrics_available": false, "metrics_refs": [], - "last_updated": "2026-07-24T08:54:44-05:00", + "last_updated": "2026-09-06T08:46:02-05:00", "next_gate": "reviewer validates source and controlled-test validation before any separately approved private runtime gate", "evidence_confidence": "HIGH", "notes": [ @@ -2024,5 +2024,5 @@ "website_rendering_treated_as_proof": false, "green_ci_treated_as_approval": false }, - "reproducibility_sha256": "a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b72578e059f8a1" + "reproducibility_sha256": "324aeb3bf7e5f9c091408db65a053a0a22567c32ffec30f828cede509672428b" } diff --git a/examples/case-growth/current-case-growth-index.md b/examples/case-growth/current-case-growth-index.md index a778316..4a0d9f6 100644 --- a/examples/case-growth/current-case-growth-index.md +++ b/examples/case-growth/current-case-growth-index.md @@ -1,12 +1,12 @@ # Hoxline Case Growth Index v1 -Generated: `2026-07-24T15:39:07Z` +Generated: `2026-09-06T14:17:30Z` Proof ceiling: `CASE_GROWTH_INDEX_CONTROLLED_REPO_AGGREGATION_ONLY` Repo-slot accuracy: `seven expected repo slots evaluated; seven present local repos scanned` Historical snapshot: `false` Current authority: `true` -Source manifest digest: `f295e5268283eeed408bd42c80c38a70b438a166d7882a75d3fd2b9bd79f957e` -Reproducibility SHA-256: `a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b72578e059f8a1` +Source manifest digest: `e19616241e7b762e1fa8462a5b3d8cbf086e603154ea50c21f371df3e46a7167` +Reproducibility SHA-256: `324aeb3bf7e5f9c091408db65a053a0a22567c32ffec30f828cede509672428b` ## Summary @@ -38,7 +38,7 @@ Reproducibility SHA-256: `a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b725 | `.github` | `org command-center routing` | `governance/COMMAND_CENTER_INVARIANTS.json` | `6e6763a81d6af09c2e4588462b56117ce82c2f88` | `623e3f9e813b0599618a7df41dee1c9a40fb7a18` | `45cfa989c3f742b546f7f8a497632b43c928029bcaa09e80e04c7c894dba660c` | `CURRENT` | | `hawkinsoperations-detections` | `detection source truth` | `detections/DETECTION_PROMOTION_MATRIX.yml` | `f8bc0a0925113ca815bf5692081b5216162cc918` | `3123d4f2a9dabdaa31d7e1d20698a17e7854491c` | `d5214ccc882ac68eb56b3018b3c37799b7c5851e37c7b76e34cda570f0e061f1` | `CURRENT` | | `hawkinsoperations-validation` | `controlled validation truth` | `validation/VALIDATION_REGISTRY.yml` | `ebf52f7c6c9b78de767272cc56fccdc584f5c4e0` | `6fac3ac3d048c3ef687faaf5ebef1b04e846aad1` | `de88ff4a621256cae51ec597a2cbb73f172d16c9d6e5109bcc42ff9a3b461cc3` | `CURRENT` | -| `hawkinsoperations-platform` | `platform contract truth` | `contracts/public-status-source-contract-v1.json` | `a667c4de8b478fe165c3ec612e642bbd5d879492` | `5bc7b79b77150413893f3d8147ae211b98d50e5b` | `f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01` | `CURRENT` | +| `hawkinsoperations-platform` | `platform contract truth` | `contracts/public-status-source-contract-v1.json` | `13fd8d88b179572bc53759f371d9b968ba3c94d4` | `70507d53fcc5ce7c89be401d38fd3e43776bc55d` | `a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841` | `CURRENT` | | `hawkinsoperations-proof` | `proof and claim-boundary truth` | `proof/indexes/DETECTION_PROOF_STATUS_INDEX.yml` | `042a918ad4a8473cd5abcfd575072fc094639682` | `623b93e6e5ac141684978ff4dcdc6ed1dec55678` | `68e5de4749bfe34a6677331f6116fab82987c88e999ae14eaf706e9b33536170` | `CURRENT` | | `hawkinsoperations-website` | `rendering-only public status contract` | `schemas/public-status-v0.schema.json` | `5856f8e69527b5e61c3953b88a2ad4c088268655` | `1f10e8c0948635eda720905c1f1e7476ef63bf3c` | `5d04c8fbce269352e341798f28afdc29720fd2ea97b80d63884cfdb32e893a11` | `CURRENT` | | `hoxline` | `case-growth and fixture-review product truth` | `src/hoxline/case_growth/collector.py` | `1cb97efc45ffe753389105645c25ed7fe57cf9e5` | `90c809e9ccd3764d14903f647980c81341bb3c42` | `98277ac2a8bb2b85b7a7cd93863cd9dc3f8aaa9d89cf31038afa6310bc98992c` | `CURRENT` | diff --git a/tests/test_action_contract.py b/tests/test_action_contract.py index 150f5ab..f68d64a 100644 --- a/tests/test_action_contract.py +++ b/tests/test_action_contract.py @@ -43,7 +43,7 @@ def test_ci_uses_immutable_sibling_revisions_and_all_required_trust_checks() -> workflow = (ROOT / ".github" / "workflows" / "ci.yml").read_text(encoding="utf-8") refs = re.findall(r"^\s+ref:\s+([0-9a-f]{40})\s*$", workflow, flags=re.MULTILINE) reviewed_manifest = "governance/CONVERGENCE_SOURCE_MANIFEST.json" - command_center_ref = "5c6127f5acc1031bae2528df3ce1f197da882100" + command_center_ref = "18a2e00505f4df4e895bf8d9ecc97052d4d03a61" assert refs == [command_center_ref] assert ( "HAWKINS_COMMAND_CENTER_IMMUTABLE_OBSERVED_SHA: "