fix: prove retained ttl marker drift

Author: misunders2d

README.md

@@ -570,11 +570,13 @@ v0.1.50 may upgrade directly to v0.1.51.
 The v0.1.50→v0.1.51 transition preserves the exact published v0.1.50
 Approval TTL policy (`request_ttl_seconds=300` with no separate
 communication-scope field). It separately recognizes the retained one-hour
-hotfix shape: before loading Approval, setup journals its exact configuration,
-restores the ordinary approval deadline to 600 seconds, keeps the
-communication-scope ceremony ceiling at 3600 seconds, and atomically replaces
-the file. A crash resumes from the journal; an already-shortened or otherwise
-different TTL shape fails closed, and pre-commit rollback restores the exact
+hotfix shape. If that operational hotfix was not written into the setup marker,
+setup reconstructs the exact published 300-second form and requires its
+canonical digest to equal the marker before creating a journal. It then
+journals the realized configuration, restores the ordinary approval deadline
+to 600 seconds, keeps the communication-scope ceremony ceiling at 3600
+seconds, and atomically replaces the file. A crash resumes from the journal;
+any additional drift fails closed, and pre-commit rollback restores the exact
 source bytes.
 
 

RELEASE_MANIFEST.json

@@ -538,11 +538,11 @@
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "ad0ff0bb3aeb8a7edd06be612a431418650185502e8218aadc1a8d1cf54cd882"
+      "sha256": "3d63d7ee7a2c8659e14a637bd8ba32e2e76f2a3fc3436202586096c835a6d3d9"
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
-      "sha256": "449c442be60a5b10824d16a1f43c069eac92d9f87cffa14962b12e2b3bffe3a9"
+      "sha256": "4ed20a48f3c97dc8ead5c00d02873a6ba5c58682c8b8a08ec836461840d38faf"
     },
     "deploy/Dockerfile": {
       "path": "deploy/Dockerfile",
@@ -562,7 +562,7 @@
     },
     "docs/GATE_EVIDENCE.md": {
       "path": "docs/GATE_EVIDENCE.md",
-      "sha256": "e6e9b637a9a083c94689c2741fbc2954203c9062c731d5aebb4aaa1208360ad9"
+      "sha256": "1be89389eda3c5005a48455a2de789bfa5a8d1047116c5f5bfb340fefe501afc"
     },
     "docs/RELEASE_MANIFEST.md": {
       "path": "docs/RELEASE_MANIFEST.md",
@@ -602,13 +602,13 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "3828924ecf0748023fa6412ed881629b8e2dca719440402ab3c1cf4d640ea843"
+      "sha256": "548fdc8a2c326efbe4a965027edb7fe93e3a100db3fb002422ae16d1db633c85"
     }
   },
   "release_source_tree": {
     "algorithm": "sha256(path NUL bytes NUL)",
     "path": "src",
-    "sha256": "453daeb672b69a757d9067e796234f298cb0417026378b74514ee3165cb070b7"
+    "sha256": "92f3c087df1f697dba25cc6e4258ca697c3e8167434544a5bb880c887b537da1"
   },
   "runtime": {
     "implementation": "CPython",

REQUIREMENTS_STATUS.md

@@ -442,12 +442,14 @@ published and historical release evidence:
   300-second generic Approval policy without a rewrite and separately journals
   and atomically normalizes only the retained one-hour generic Approval hotfix
   to the bounded 600-second ordinary and 3600-second communication-scope TTL
-  split; retries resume and pre-commit rollback restores the source bytes,
-  while already-shortened or otherwise different shapes fail closed. The
-  focused recovery lane reports **238 passed**; the broad releasable-source
-  lane reports **2226 passed and 22 expected platform/dedicated-PostgreSQL
+  split. An unrecorded hotfix is accepted only when deriving the published
+  300-second form reproduces the marker’s exact canonical config digest;
+  retries resume, pre-commit rollback restores the source bytes, and any
+  additional drift fails closed. The
+  focused recovery lane reports **240 passed**; the broad releasable-source
+  lane reports **2228 passed and 22 expected platform/dedicated-PostgreSQL
   skips**; and source plus two recursive packed generations each report
-  **2253 passed and 22 expected skips**. Two independent
+  **2255 passed and 22 expected skips**. Two independent
   builds are byte-identical, packaged local message/obligation processing
   reaches `recipient_committed`, and a fresh installed npm package passes exact
   endpoint routing with zero sibling reactions or residue. Dedicated

docs/ARCHITECTURE.md

@@ -914,12 +914,14 @@ resume the prepared phase, while a missing or mismatched copy fails closed.
 That same v0.1.50→v0.1.51 boundary preserves the exact published v0.1.50
 Approval policy with its 300-second generic request TTL and absent
 communication-scope field. It separately recognizes the retained hotfix that
-raised the generic request TTL to one hour. Setup records that Approval
-configuration in upgrade journal v3 before mutation, restores the ordinary
-request ceiling to 600 seconds, and preserves the distinct communication-scope
-ceiling at 3600 seconds. The write uses compare-and-swap; interruption resumes
-from the journal, pre-commit rollback restores the exact source bytes, and
-already-shortened or otherwise non-matching configuration fails closed.
+raised the generic request TTL to one hour. When the setup marker still records
+the published configuration, setup derives that exact 300-second form from the
+realized hotfix and requires its canonical digest to match the marker. Only
+then does it record the realized Approval configuration in upgrade journal v3,
+restore the ordinary request ceiling to 600 seconds, and preserve the distinct
+communication-scope ceiling at 3600 seconds. The write uses compare-and-swap;
+interruption resumes from the journal, pre-commit rollback restores the exact
+source bytes, and any additional configuration drift fails closed.
 
 Communication-scope completion and legacy-scope repair share one schema-v7
 single-scope materializer. Completion invokes it inside the transaction that

docs/GATE_EVIDENCE.md

@@ -84,7 +84,7 @@ Gate statuses used here:
 | Candidate npm `0.1.48` canonical post-C0 credential correction | Completed-C0 terminal credentials now resolve through the exact domain/principal-bound harness plus credential epoch; unknown or mismatched identity state remains fail-closed. Adds only the exact forward-only `0.1.47→0.1.48` five-unit marker edge and no database migration. | Focused lane: `547 passed, 5 skipped`; broad releasable-source lane: `2155 passed, 21 skipped`; recursive packed-package and installed-host upgrade evidence pending. | H-only correction evidence; no gate promotion. Affected IDs: `ID-006`, `ID-009`, `SEC-007`, `OPS-003`. |
 | Candidate npm `0.1.49` completed-C0 communication recovery | Permanent communication activation resolves the exact completed C0 pair; only the authenticated ordinary server harness may advance to its current active credential, while the C0 peer remains pinned to its enrolled credential absent separately verified succession. Terminal pre-commit retries converge without replacing committed authority. Signed message send, inbox, and acknowledgement requests bind the exact collaboration scope. Adds only the forward-only `0.1.48→0.1.49` five-unit marker edge and no database migration. | Focused lane: `645 passed, 5 skipped`; broad releasable-source lane: `2166 passed, 21 skipped`; recursive packed-package and installed-host upgrade evidence pending. | H-only correction evidence; no gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-004`, `ID-006`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-007`, `AUTH-009`, `COM-001`, `COM-002`, `COM-003`, `COM-006`, `COM-009`, `COM-011`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`. |
 | Candidate npm `0.1.50` setup-usability, direct-upgrade, and communication-scope approval path | One guided server command over the strict request/plan/apply protocol; one server-origin-only guided laptop command with authenticated discovery defaults; content-free named phases; ten-minute server and five-minute laptop bounds; resumable blocker output; exact direct allowlist from v0.1.45–v0.1.49 schema-v7 five-unit markers; installed separate-process local communication/obligation roundtrip added to packed verification; explicit one-hour Approval request ceiling limited to `authorization.communication_scope.approve`, with all other approvals retaining the five-minute ceiling and short-lived WebAuthn challenges | Focused release lane: `681 passed, 5 skipped`; broad releasable-source lane: `2180 passed, 21 skipped`; source and two recursive packed generations: `2207 passed, 21 skipped` each; two byte-identical release builds; release manifest verifier passed; installed tarball journey passed from an unrelated prefix; installed-host, fresh-machine, and same-commit CI evidence pending | H/L-shaped local candidate evidence only. No production, owner-policy, external, privileged-host, or gate promotion. Affected IDs: `ID-006`, `AUTH-004`, `AUTH-007`, `COM-001`, `COM-002`, `COM-003`, `COM-006`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `UX-001`, `UX-002`, `SEC-003`, `SEC-005`, `OPS-003`, `OPS-006`. |
-| Corrective v0.1.51 canonical-owner, schema-v7 projection, retained-TTL, and expired-member replacement recovery | Exact enrolled-Core plus pinned-Approval-OIDC owner selection; transactional Approval owner/passkey adoption; current receipt-signer replacement; strict resumable signer/config journal; journaled Core OIDC/approver cutover; exact published v0.1.50 300-second Approval policy preservation plus retained one-hour generic Approval hotfix normalization to separate 600-second ordinary and 3600-second communication-scope ceilings under compare-and-swap, resume, and rollback; single-scope schema-v7 projection shared by atomic activation and idempotent legacy repair; separately approved same-principal expired-member replacement requires the exact scope owner, preserves role, tombstones the former harness, activates the enrolled replacement, increments membership and scope revisions once, recomputes canonical digests, cuts authorization over to current schema-v7 membership, and permits exact committed replay after request expiry; ambiguity, cross-principal/domain, replay, tamper, drift, partial-row, conflicting-row, and already-shortened TTL rejection | Recovery-focused lane: `238 passed`; replacement-focused SQLite lane: `62 passed`; PostgreSQL contract collection: `82 passed, 8 dedicated-database skips`; broad releasable-source lane: `2226 passed, 22 skipped`; `npm run check` source plus two recursively packed generations: `2253 passed, 22 skipped` each; release manifest, installed-byte local communication, exact-endpoint routing, and packaged v0.1.45 journey passed | Current source/package H/L-shaped evidence only. Dedicated PostgreSQL replacement execution, same-commit CI, installed-host setup/upgrade, and live server/laptop reliability evidence remain pending. No requirement or gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-005`, `ID-006`, `ID-009`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-005`, `COM-001`, `COM-002`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`, `SEC-007`, `OPS-003`, `OPS-006`. |
+| Corrective v0.1.51 canonical-owner, schema-v7 projection, retained-TTL, and expired-member replacement recovery | Exact enrolled-Core plus pinned-Approval-OIDC owner selection; transactional Approval owner/passkey adoption; current receipt-signer replacement; strict resumable signer/config journal; journaled Core OIDC/approver cutover; exact published v0.1.50 300-second Approval policy preservation plus marker-relative proof and normalization of the retained one-hour generic Approval hotfix to separate 600-second ordinary and 3600-second communication-scope ceilings under compare-and-swap, resume, and rollback; single-scope schema-v7 projection shared by atomic activation and idempotent legacy repair; separately approved same-principal expired-member replacement requires the exact scope owner, preserves role, tombstones the former harness, activates the enrolled replacement, increments membership and scope revisions once, recomputes canonical digests, cuts authorization over to current schema-v7 membership, and permits exact committed replay after request expiry; ambiguity, cross-principal/domain, replay, tamper, drift, partial-row, conflicting-row, and already-shortened TTL rejection | Recovery-focused lane: `240 passed`; replacement-focused SQLite lane: `62 passed`; PostgreSQL contract collection: `82 passed, 8 dedicated-database skips`; broad releasable-source lane: `2228 passed, 22 skipped`; `npm run check` source plus two recursively packed generations: `2255 passed, 22 skipped` each; release manifest, installed-byte local communication, exact-endpoint routing, and packaged v0.1.45 journey passed | Current source/package H/L-shaped evidence only. Dedicated PostgreSQL replacement execution, same-commit CI, installed-host setup/upgrade, and live server/laptop reliability evidence remain pending. No requirement or gate promotion. Affected IDs: `ID-001`, `ID-002`, `ID-005`, `ID-006`, `ID-009`, `AUTH-001`, `AUTH-002`, `AUTH-003`, `AUTH-004`, `AUTH-005`, `COM-001`, `COM-002`, `COM-009`, `AVL-003`, `AVL-005`, `AVL-006`, `SEC-003`, `SEC-005`, `SEC-007`, `OPS-003`, `OPS-006`. |
 
 | OIDC validated-address transport repair | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/identity/test_oidc_enrollment.py tests/operations/test_fail_closed_config.py tests/production/test_deployment_config.py` | 53 passed, 0 failed on 2026-07-15 | H only: includes the real `_PinnedHTTPSConnection` socket path under a validation-to-connect DNS-answer change, exact TCP address/SNI/Host assertions, proxy/tunnel and redirect denial, response bounds, unsafe address-class rejection, invalid resolver type handling, private IPv4/IPv6 pins, configuration, and deployment wiring. No real IdP/TLS service or independent approval boundary is claimed. |
 | Independent WebAuthn-UV approval component | `UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/approval`; approval-consumer lane; non-gate full regression below | 12 focused passed; 144 approval/consumer passed; included in 1049-pass broad lane on 2026-07-15 | H only: strict owner-only config/key custody, exact SQLite catalog/tamper rejection, UV-required maintained-library call contract, exact display/digest, bounded duplicate-rejecting HTTP, one-receipt response-loss retry, committed denial/expiry audits, rejection, credential revocation, loopback serving, and non-authorizing provisioning. WebAuthn verification is seam-controlled in hermetic tests; no real authenticator, independent host/device/operator, TLS proxy, rotation/recovery drill, or owner decision is claimed. |

docs/SCHEMAS_INTERFACES.md

@@ -842,12 +842,14 @@ extends the standard forward-only journal with one
 `previous_configs.approval_config` payload under the existing root-only
 custody and size bounds. The exact published source with
 `request_ttl_seconds=300` and no
-`communication_scope_request_ttl_seconds` is preserved byte-for-byte. Only a
-journaled retained-hotfix source with `request_ttl_seconds=3600` and an absent
-or 3600-second communication-scope field is normalized to the target 600/3600
-split. Compare-and-swap replacement, exact resume, and exact rollback use that
-retained payload; already-shortened, unknown, or otherwise different TTL
-shapes fail closed.
+`communication_scope_request_ttl_seconds` is preserved byte-for-byte. A
+retained-hotfix source with `request_ttl_seconds=3600` and an absent or
+3600-second communication-scope field may differ from its marker only when
+replacing those fields with the published 300-second form reproduces the
+marker’s canonical Approval-config digest. The realized hotfix is then
+journaled and normalized to the target 600/3600 split. Compare-and-swap
+replacement, exact resume, and exact rollback use that retained payload;
+already-shortened, unknown, or any additionally drifted shape fails closed.
 
 The schema-v7 communication projection has one canonical single-scope mapping.
 Both normal activation and repair write the exact collaboration scope, two

docs/implementation-guide.md

@@ -396,14 +396,17 @@ authority.
 The exact published v0.1.50 Approval configuration has
 `request_ttl_seconds: 300` and no separate communication-scope field; setup
 preserves it without rewriting. A retained live hotfix may instead have
-`request_ttl_seconds: 3600` and no separate communication-scope field. Do not
-edit either file manually. For the hotfix only, the exact
-v0.1.50→v0.1.51 setup path journals the source Approval configuration before
-loading the service, changes the generic deadline to 600 seconds, and writes
+`request_ttl_seconds: 3600` and no separate communication-scope field. The
+setup marker may still contain the digest of the published 300-second form;
+setup accepts that difference only when reconstructing the published form from
+the realized file reproduces the marker digest exactly. Do not edit either file
+manually. For that hotfix only, the exact v0.1.50→v0.1.51 setup path journals
+the realized Approval configuration before loading the service, changes the
+generic deadline to 600 seconds, and writes
 `communication_scope_request_ttl_seconds: 3600`. Rerun the same approved
-command after interruption. An already-shortened or otherwise different
-TTL/configuration shape blocks as `approval_config`; a failure before marker
-commit restores the journaled source bytes.
+command after interruption. Any additional TTL/configuration drift blocks as
+`setup_upgrade_conflict`; a failure before marker commit restores the journaled
+source bytes.
 
 The same setup pass repairs an already committed communication scope that lacks
 its schema-v7 collaboration projection. It materializes only the exact