Review source mutation quality through deterministic owner replay

.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
   hoxline-trust-boundaries:
     runs-on: ubuntu-latest
     env:
-      HAWKINS_COMMAND_CENTER_IMMUTABLE_OBSERVED_SHA: 5c6127f5acc1031bae2528df3ce1f197da882100
+      HAWKINS_COMMAND_CENTER_IMMUTABLE_OBSERVED_SHA: 18a2e00505f4df4e895bf8d9ecc97052d4d03a61
       HAWKINS_HOXLINE_EVENT_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
     strategy:
       fail-fast: false
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: HawkinsOperations/.github
-          ref: 5c6127f5acc1031bae2528df3ce1f197da882100
+          ref: 18a2e00505f4df4e895bf8d9ecc97052d4d03a61
           path: org/.github
           fetch-depth: 0
           persist-credentials: false

README.md

@@ -37,6 +37,28 @@ See `docs/demo/HOXLINE_ONE_COMMAND_REVIEWER_DEMO_V0.md` for the design contract
 
 ## Reusable Review Engine
 
+### Source-executed detection quality
+
+```powershell
+python -B -m hoxline detection-quality --repo-root .. --detections-ref <exact-detection-commit> --validation-ref <exact-validation-commit> --platform-ref <exact-platform-commit>
+```
+
+This review executes six canonical detection predicates through platform's
+validation-owned handoff. It renders observed confusion matrices and real rule
+mutation outcomes from the existing controlled corpus. Add `--format json` for
+the owner report, or `--verify <saved-quality.json>` to reexecute and compare a
+saved report. Exact clean source, validation, and platform heads are required.
+Altered metrics, nested authority additions, source hashes, and AI approval or
+closure fields cannot pass replay merely by changing a report checksum.
+
+Validation owns behavior and metrics; platform delegates; Hoxline renders.
+Mutants remain in memory, survivors remain visible, and parser errors never count
+as kills. AI authors candidate engineering labor and tests.
+AI does not approve disposition, case closure, public-safe status, or proof promotion. This offline
+predicate path does not establish backend parity, endpoint execution, runtime
+signal, or production detection quality. The owning validation workflow runs the
+same path on GitHub-hosted Linux and Windows.
+
 Use the reusable manifest-driven engine when you want the same deterministic ProofOps loop behind a machine-checkable artifact manifest:
 
 ```powershell

examples/case-growth/current-case-growth-index.json

@@ -1,6 +1,6 @@
 {
   "schema_version": "case-growth-index-v1",
-  "generated_at": "2026-07-24T15:39:07Z",
+  "generated_at": "2026-09-06T14:17:30Z",
   "repo_root": "HawkinsOperations",
   "proof_ceiling": "CASE_GROWTH_INDEX_CONTROLLED_REPO_AGGREGATION_ONLY",
   "historical_snapshot": false,
@@ -16,10 +16,10 @@
     {
       "repository": ".github",
       "authority_role": "org command-center routing",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
+      "resolved_ref": "agent/source-executed-mutation-factory",
       "source_commit_sha": "6e6763a81d6af09c2e4588462b56117ce82c2f88",
       "source_observed_head_sha": "6e6763a81d6af09c2e4588462b56117ce82c2f88",
-      "current_observed_head_sha": "5c6127f5acc1031bae2528df3ce1f197da882100",
+      "current_observed_head_sha": "18a2e00505f4df4e895bf8d9ecc97052d4d03a61",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
@@ -48,10 +48,10 @@
     {
       "repository": "hawkinsoperations-detections",
       "authority_role": "detection source truth",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
+      "resolved_ref": "agent/source-executed-mutation-factory",
       "source_commit_sha": "f8bc0a0925113ca815bf5692081b5216162cc918",
       "source_observed_head_sha": "f8bc0a0925113ca815bf5692081b5216162cc918",
-      "current_observed_head_sha": "9e01f43fb350de3370f8c01a323dcdcdf2e33147",
+      "current_observed_head_sha": "56cad4f726c0d3988c9464693ce7c127c8f63cad",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
@@ -80,10 +80,10 @@
     {
       "repository": "hawkinsoperations-validation",
       "authority_role": "controlled validation truth",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
+      "resolved_ref": "agent/source-executed-mutation-factory",
       "source_commit_sha": "ebf52f7c6c9b78de767272cc56fccdc584f5c4e0",
       "source_observed_head_sha": "ebf52f7c6c9b78de767272cc56fccdc584f5c4e0",
-      "current_observed_head_sha": "677b704150b0f5f333c27913dd481b4be6a78ab7",
+      "current_observed_head_sha": "c8f3f08995d78fa103115610e5c6a2b85ee61701",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
@@ -112,21 +112,21 @@
     {
       "repository": "hawkinsoperations-platform",
       "authority_role": "platform contract truth",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
-      "source_commit_sha": "a667c4de8b478fe165c3ec612e642bbd5d879492",
-      "source_observed_head_sha": "a667c4de8b478fe165c3ec612e642bbd5d879492",
-      "current_observed_head_sha": "4716d7e65525425be4f70127cdc7f7d3de3a7b9e",
+      "resolved_ref": "agent/source-executed-mutation-factory",
+      "source_commit_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4",
+      "source_observed_head_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4",
+      "current_observed_head_sha": "13fd8d88b179572bc53759f371d9b968ba3c94d4",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
       "revision_scope": "content_addressed_authority",
       "source_path": "contracts/public-status-source-contract-v1.json",
       "authoritative_path": "contracts/public-status-source-contract-v1.json",
-      "authoritative_git_blob_sha": "5bc7b79b77150413893f3d8147ae211b98d50e5b",
-      "source_git_blob_sha": "5bc7b79b77150413893f3d8147ae211b98d50e5b",
-      "source_file_sha256": "3a1cdc74a86230fe6567ddaed396ed45662e9b4efef7e398ae522a3e018317e4",
-      "authoritative_content_fingerprint": "f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01",
-      "source_semantic_fingerprint_sha256": "f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01",
+      "authoritative_git_blob_sha": "70507d53fcc5ce7c89be401d38fd3e43776bc55d",
+      "source_git_blob_sha": "70507d53fcc5ce7c89be401d38fd3e43776bc55d",
+      "source_file_sha256": "34b2801c10de7c269220010797a0a1a7c8eae8e26213243940a9b0e2ca3d8cea",
+      "authoritative_content_fingerprint": "a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841",
+      "source_semantic_fingerprint_sha256": "a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841",
       "canonical_origin": "github.com/hawkinsoperations/hawkinsoperations-platform",
       "observed_origin": "github.com/hawkinsoperations/hawkinsoperations-platform",
       "repository_dirty_observed": false,
@@ -176,10 +176,10 @@
     {
       "repository": "hawkinsoperations-website",
       "authority_role": "rendering-only public status contract",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
+      "resolved_ref": "agent/source-executed-mutation-factory",
       "source_commit_sha": "5856f8e69527b5e61c3953b88a2ad4c088268655",
       "source_observed_head_sha": "5856f8e69527b5e61c3953b88a2ad4c088268655",
-      "current_observed_head_sha": "0e7cb554ee3fd5519142006246201e7b15f0c9b5",
+      "current_observed_head_sha": "a18a196d4336e088f94c0cec0305c8ae8ebbe0cf",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
@@ -208,10 +208,10 @@
     {
       "repository": "hoxline",
       "authority_role": "case-growth and fixture-review product truth",
-      "resolved_ref": "feature/hoxline-case-growth-convergence-v1",
+      "resolved_ref": "agent/source-executed-mutation-factory",
       "source_commit_sha": "1cb97efc45ffe753389105645c25ed7fe57cf9e5",
       "source_observed_head_sha": "1cb97efc45ffe753389105645c25ed7fe57cf9e5",
-      "current_observed_head_sha": "52867ee7e332dba3cab4d2c3e308d636ed5bb610",
+      "current_observed_head_sha": "6bdf263144f2f5465ec232c996666c3c00d16945",
       "source_observation_kind": "reviewed_immutable_commit",
       "source_parent_sha": null,
       "self_referential": false,
@@ -238,7 +238,7 @@
       "next_legal_action": "none; preserve source ownership"
     }
   ],
-  "source_manifest_digest": "f295e5268283eeed408bd42c80c38a70b438a166d7882a75d3fd2b9bd79f957e",
+  "source_manifest_digest": "e19616241e7b762e1fa8462a5b3d8cbf086e603154ea50c21f371df3e46a7167",
   "contradictions": [],
   "drift": [],
   "next_legal_action": "none; current source-controlled inputs converge",
@@ -247,7 +247,7 @@
       "repo": ".github",
       "path": ".github",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "org metadata and reviewer routing only; not proof authority",
       "files_scanned": 37
@@ -256,7 +256,7 @@
       "repo": "hawkinsoperations-detections",
       "path": "hawkinsoperations-detections",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "source package and source status authority only",
       "files_scanned": 93
@@ -265,16 +265,16 @@
       "repo": "hawkinsoperations-validation",
       "path": "hawkinsoperations-validation",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "controlled validation authority only",
-      "files_scanned": 202
+      "files_scanned": 204
     },
     {
       "repo": "hawkinsoperations-platform",
       "path": "hawkinsoperations-platform",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "platform runtime-candidate, collector, receipt, and ledger contract authority only",
       "files_scanned": 121
@@ -292,7 +292,7 @@
       "repo": "hawkinsoperations-website",
       "path": "hawkinsoperations-website",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "route/rendering surface only; not proof authority",
       "files_scanned": 274
@@ -301,10 +301,10 @@
       "repo": "hoxline",
       "path": "hoxline",
       "exists": true,
-      "branch": "feature/hoxline-case-growth-convergence-v1",
+      "branch": "agent/source-executed-mutation-factory",
       "dirty": false,
       "authority_boundary": "product metrics and Hoxline Gauntlet artifact authority only",
-      "files_scanned": 181
+      "files_scanned": 182
     }
   ],
   "repo_slot_accuracy": {
@@ -499,7 +499,7 @@
       "case_state": "BLOCKED_WAITING_NEXT_GATE",
       "metrics_available": false,
       "metrics_refs": [],
-      "last_updated": "2026-07-24T08:54:44-05:00",
+      "last_updated": "2026-09-06T08:56:27-05:00",
       "next_gate": "proof-record-specific human review before any public-safe, runtime, or signal promotion",
       "evidence_confidence": "HIGH",
       "notes": [
@@ -933,7 +933,7 @@
       "case_state": "BLOCKED_WAITING_NEXT_GATE",
       "metrics_available": false,
       "metrics_refs": [],
-      "last_updated": "2026-07-24T08:54:44-05:00",
+      "last_updated": "2026-09-06T08:46:02-05:00",
       "next_gate": "separate runtime receipt and proof review before any runtime, signal, public-safe, production, or approval wording",
       "evidence_confidence": "HIGH",
       "notes": [
@@ -1013,7 +1013,7 @@
       "case_state": "BLOCKED_WAITING_NEXT_GATE",
       "metrics_available": false,
       "metrics_refs": [],
-      "last_updated": "2026-07-24T08:54:44-05:00",
+      "last_updated": "2026-09-06T08:46:02-05:00",
       "next_gate": "reviewer validates source and controlled-test validation before any separately approved private runtime gate",
       "evidence_confidence": "HIGH",
       "notes": [
@@ -1179,7 +1179,7 @@
       "case_state": "BLOCKED_WAITING_NEXT_GATE",
       "metrics_available": false,
       "metrics_refs": [],
-      "last_updated": "2026-07-24T08:54:44-05:00",
+      "last_updated": "2026-09-06T08:46:02-05:00",
       "next_gate": "blocked until separate runtime or signal evidence review supports any runtime, routed-telemetry, public-safe, production, autonomous SOC, or disposition-authority promotion",
       "evidence_confidence": "HIGH",
       "notes": [
@@ -1271,7 +1271,7 @@
       "case_state": "BLOCKED_WAITING_NEXT_GATE",
       "metrics_available": false,
       "metrics_refs": [],
-      "last_updated": "2026-07-24T08:54:44-05:00",
+      "last_updated": "2026-09-06T08:46:02-05:00",
       "next_gate": "reviewer validates source and controlled-test validation before any separately approved private runtime gate",
       "evidence_confidence": "HIGH",
       "notes": [
@@ -2024,5 +2024,5 @@
     "website_rendering_treated_as_proof": false,
     "green_ci_treated_as_approval": false
   },
-  "reproducibility_sha256": "a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b72578e059f8a1"
+  "reproducibility_sha256": "324aeb3bf7e5f9c091408db65a053a0a22567c32ffec30f828cede509672428b"
 }

examples/case-growth/current-case-growth-index.md

@@ -1,12 +1,12 @@
 # Hoxline Case Growth Index v1
 
-Generated: `2026-07-24T15:39:07Z`
+Generated: `2026-09-06T14:17:30Z`
 Proof ceiling: `CASE_GROWTH_INDEX_CONTROLLED_REPO_AGGREGATION_ONLY`
 Repo-slot accuracy: `seven expected repo slots evaluated; seven present local repos scanned`
 Historical snapshot: `false`
 Current authority: `true`
-Source manifest digest: `f295e5268283eeed408bd42c80c38a70b438a166d7882a75d3fd2b9bd79f957e`
-Reproducibility SHA-256: `a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b72578e059f8a1`
+Source manifest digest: `e19616241e7b762e1fa8462a5b3d8cbf086e603154ea50c21f371df3e46a7167`
+Reproducibility SHA-256: `324aeb3bf7e5f9c091408db65a053a0a22567c32ffec30f828cede509672428b`
 
 ## Summary
 
@@ -38,7 +38,7 @@ Reproducibility SHA-256: `a8b5ec50636e7b62f9a0c11e0316d62b8009b3d18e4a52faf9b725
 | `.github` | `org command-center routing` | `governance/COMMAND_CENTER_INVARIANTS.json` | `6e6763a81d6af09c2e4588462b56117ce82c2f88` | `623e3f9e813b0599618a7df41dee1c9a40fb7a18` | `45cfa989c3f742b546f7f8a497632b43c928029bcaa09e80e04c7c894dba660c` | `CURRENT` |
 | `hawkinsoperations-detections` | `detection source truth` | `detections/DETECTION_PROMOTION_MATRIX.yml` | `f8bc0a0925113ca815bf5692081b5216162cc918` | `3123d4f2a9dabdaa31d7e1d20698a17e7854491c` | `d5214ccc882ac68eb56b3018b3c37799b7c5851e37c7b76e34cda570f0e061f1` | `CURRENT` |
 | `hawkinsoperations-validation` | `controlled validation truth` | `validation/VALIDATION_REGISTRY.yml` | `ebf52f7c6c9b78de767272cc56fccdc584f5c4e0` | `6fac3ac3d048c3ef687faaf5ebef1b04e846aad1` | `de88ff4a621256cae51ec597a2cbb73f172d16c9d6e5109bcc42ff9a3b461cc3` | `CURRENT` |
-| `hawkinsoperations-platform` | `platform contract truth` | `contracts/public-status-source-contract-v1.json` | `a667c4de8b478fe165c3ec612e642bbd5d879492` | `5bc7b79b77150413893f3d8147ae211b98d50e5b` | `f0f16d909e06b4cf67f347c675b999de3f7f10ff7032fbd350dc5a1f54266a01` | `CURRENT` |
+| `hawkinsoperations-platform` | `platform contract truth` | `contracts/public-status-source-contract-v1.json` | `13fd8d88b179572bc53759f371d9b968ba3c94d4` | `70507d53fcc5ce7c89be401d38fd3e43776bc55d` | `a4e8183b128cefaed1252168136a64b919dddee50f256d3aa6a681bac77ca841` | `CURRENT` |
 | `hawkinsoperations-proof` | `proof and claim-boundary truth` | `proof/indexes/DETECTION_PROOF_STATUS_INDEX.yml` | `042a918ad4a8473cd5abcfd575072fc094639682` | `623b93e6e5ac141684978ff4dcdc6ed1dec55678` | `68e5de4749bfe34a6677331f6116fab82987c88e999ae14eaf706e9b33536170` | `CURRENT` |
 | `hawkinsoperations-website` | `rendering-only public status contract` | `schemas/public-status-v0.schema.json` | `5856f8e69527b5e61c3953b88a2ad4c088268655` | `1f10e8c0948635eda720905c1f1e7476ef63bf3c` | `5d04c8fbce269352e341798f28afdc29720fd2ea97b80d63884cfdb32e893a11` | `CURRENT` |
 | `hoxline` | `case-growth and fixture-review product truth` | `src/hoxline/case_growth/collector.py` | `1cb97efc45ffe753389105645c25ed7fe57cf9e5` | `90c809e9ccd3764d14903f647980c81341bb3c42` | `98277ac2a8bb2b85b7a7cd93863cd9dc3f8aaa9d89cf31038afa6310bc98992c` | `CURRENT` |

src/hoxline/cli.py

@@ -34,6 +34,18 @@ def main(argv: list[str] | None = None) -> int:
     parser = _build_parser()
     args = parser.parse_args(argv)
 
+    if args.command == "detection-quality":
+        from .detection_quality import QualityReviewError, compare_replay, read_report, render_review, run_review
+        try:
+            report = run_review(Path(args.repo_root), args.detections_ref, args.validation_ref, args.platform_ref)
+            if args.verify:
+                compare_replay(read_report(Path(args.verify).read_text(encoding="utf-8")), report)
+            print(json.dumps(report, indent=2, sort_keys=True) if args.format == "json" else render_review(report), end="\n")
+            return 0
+        except (QualityReviewError, OSError) as exc:
+            print(json.dumps({"status": "BLOCKED", "error": str(exc), "human_review_required": True, "ai_disposition_authority": False}))
+            return 2
+
     if args.command == "gauntlet" and args.gauntlet_command == "run":
         return _run_gauntlet(args)
     if args.command == "gauntlet" and args.gauntlet_command == "metrics":
@@ -77,6 +89,14 @@ def _build_parser() -> argparse.ArgumentParser:
     parser = argparse.ArgumentParser(prog="hoxline")
     subparsers = parser.add_subparsers(dest="command")
 
+    quality_parser = subparsers.add_parser("detection-quality", help="replay validation-owned source mutation quality through platform")
+    quality_parser.add_argument("--repo-root", required=True)
+    quality_parser.add_argument("--detections-ref", required=True)
+    quality_parser.add_argument("--validation-ref", required=True)
+    quality_parser.add_argument("--platform-ref", required=True)
+    quality_parser.add_argument("--format", choices=("json", "markdown"), default="markdown")
+    quality_parser.add_argument("--verify", help="compare a saved owner report with freshly executed source/corpus")
+
     gauntlet_parser = subparsers.add_parser("gauntlet", help="run Hoxline Gauntlet workflows")
     gauntlet_subparsers = gauntlet_parser.add_subparsers(dest="gauntlet_command")