fix: recover proof-bound dual drift

Author: misunders2d

README.md

@@ -591,10 +591,14 @@ remained outside the marker, setup accepts the combined state only after the
 completed recovery evidence reconstructs the marker-era Approval and Core
 documents. It reverses only the evidence-bound owner and signer fields in
 memory, then requires both reconstructed canonical digests to equal the
-marker. The realized current documents are journaled, the TTL policy is
-normalized, and owner/Core convergence is rechecked idempotently. Missing
-Core-OIDC agreement, incomplete evidence, or unrelated drift fails before
-setup creates its upgrade journal or changes managed state.
+marker. Historical marker matching treats only the fixed mandatory
+approval-purpose set as order-insensitive; it may reconstruct that set's
+serialized order to reproduce the retained digest, but any added, removed,
+duplicated, or changed purpose fails closed. The realized current documents
+are journaled, the TTL policy is normalized, and owner/Core convergence is
+rechecked idempotently. Missing Core-OIDC agreement, incomplete evidence, or
+unrelated drift fails before setup creates its upgrade journal or changes
+managed state.
 
 
 Git tag `v0.1.23` reached the staging workflow, but CI stopped before npm

RELEASE_MANIFEST.json

@@ -538,8 +538,8 @@
   "release_inputs": {
     "README.md": {
       "path": "README.md",
-      "sha256": "04c40c68406ab67f430cb1d3eaf5adb702137d015ff4acfc0dd8fe68110c50b3",
-      "size": 46300
+      "sha256": "fb8b10a622b64f024462047ba82708cc090270b27f13e9f94e045c8208ad99b8",
+      "size": 46552
     },
     "REQUIREMENTS_STATUS.md": {
       "path": "REQUIREMENTS_STATUS.md",
@@ -618,14 +618,14 @@
     },
     "scripts/verify_release.py": {
       "path": "scripts/verify_release.py",
-      "sha256": "ae5cc17c04aa8d2e3895d6ae5e2408b947a06a25ce33d755e01048d694f143a9",
+      "sha256": "119c226d6f87f100e2e41e4c974339417859b6f6c1d5212896ec799898541e3b",
       "size": 56697
     }
   },
   "release_source_tree": {
     "algorithm": "sha256(path NUL bytes NUL)",
     "path": "src",
-    "sha256": "9baef70ed843decde60e73ce6eb22718a29754c6087177672f5c5c6d1633e212"
+    "sha256": "e00067bb4365b9089d45af45a726ff3d4f080baca6b39f3e2e4a017226857a10"
   },
   "runtime": {
     "implementation": "CPython",

docs/ARCHITECTURE.md

@@ -925,12 +925,15 @@ Approval/Core policy, one active canonical owner binding, target credential
 state, and one immutable adoption audit jointly reproduce the exact marker-era
 source and current realized digests. Reconstructing the marker-era source
 reverses only the exact evidence-bound Approval and Core owner/signer policy
-fields. The reconstruction write is the first mutation and changes no
-authority. Its strict evidence is revalidated after process loss. A resumed
-upgrade journal rechecks the exact two-signer custody and matching current
-Core/Core-OIDC policy immediately before the Approval TTL compare-and-swap;
-missing, additional, ambiguous, or drifted evidence leaves Approval unchanged
-and fails closed.
+fields. Because the historical policy writer serialized a `frozenset`, marker
+matching may search only permutations of the exact mandatory approval-purpose
+set to recover its former byte order. Added, removed, duplicated, or changed
+purposes cannot enter that path. The reconstruction write is the first
+mutation and changes no authority. Its strict evidence is revalidated after
+process loss. A resumed upgrade journal rechecks the exact two-signer custody
+and matching current Core/Core-OIDC policy immediately before the Approval TTL
+compare-and-swap; missing, additional, ambiguous, or drifted evidence leaves
+Approval unchanged and fails closed.
 
 That same v0.1.50→v0.1.51 boundary preserves the exact published v0.1.50
 Approval policy with its 300-second generic request TTL and absent

docs/SCHEMAS_INTERFACES.md

@@ -879,7 +879,11 @@ Approval and Core schemas, and the exact source/target identity and signer
 fields needed to reconstruct both marker-era documents. The inverse TTL
 comparison may remove only the known communication-scope field and restore the
 published 300-second generic value. The reconstructed Approval and Core
-digests must equal the marker before upgrade journal v3 is created. Every
+digests must equal the marker before upgrade journal v3 is created. Historical
+`allowed_purposes` ordering is not authority-bearing: marker matching may
+permute only the exact fixed mandatory set to reproduce either retained
+digest. Set membership, cardinality, all other fields, and the digest remain
+exact; any added, removed, duplicated, or changed purpose fails closed. Every
 initial or resumed attempt repeats the terminal journal,
 exact-single-active-owner, adoption-audit, target-credential, and
 signer-custody checks. An upgrade-journal resume also requires the current Core

docs/implementation-guide.md

@@ -429,7 +429,11 @@ Approval unchanged.
 Setup reconstructs the exact marker-era Approval and Core documents by
 reversing only the recovery-evidence-bound owner and signer fields, applies the
 bounded inverse TTL comparison, and requires both reconstructed digests to
-equal the marker. It parses the retained 3600-second source policy without
+equal the marker. The old writer emitted the fixed mandatory
+`allowed_purposes` set in process-dependent order. Setup may therefore try only
+permutations of that exact set when reproducing the retained Approval/Core
+digests. It never accepts different membership, duplicates, or unrelated
+policy drift. Setup parses the retained 3600-second source policy without
 writing and admits only that exact legacy TTL shape. Only then does it journal
 the realized current documents, normalize the TTL policy, and recheck the
 owner command and Core policy as idempotent

docs/superpowers/specs/2026-08-09-agentnet-canonical-owner-recovery-design.md

@@ -77,11 +77,15 @@ Before creating the setup upgrade journal, setup may reverse only the
 documented recovery transformations in memory: the TTL fields are restored to
 the published v0.1.50 shape, while the Approval and Core owner/signer policy
 fields are restored from the exact recovery evidence. The reconstructed
-Approval and Core digests must equal the retained marker. The current Core OIDC
-sidecar must equal Core, and the realized target signer, domain, target
-principal, and fixed setup request must agree with the recovery evidence. This
-reconstruction writes only a strict terminal evidence journal when the
-original journal is absent; it does not change authority.
+Approval and Core digests must equal the retained marker. The historical writer
+serialized the fixed mandatory approval-purpose `frozenset` in
+process-dependent order. Digest reconstruction may therefore try only
+permutations of that exact set; membership, cardinality, every other field, and
+both retained digests remain exact. The current Core OIDC sidecar must equal
+Core, and the realized target signer, domain, target principal, and fixed setup
+request must agree with the recovery evidence. This reconstruction writes only
+a strict terminal evidence journal when the original journal is absent; it
+does not change authority.
 
 An incomplete or malformed recovery journal, a wrong domain or target,
 unverifiable signer state, extra configuration drift, Core/Core-OIDC

evidence/local/2026-08-09-v0.1.51/artifacts/agentnet-0.1.51-py3-none-any.whl

@@ -2,30 +2,30 @@
   "artifacts": [
     {
       "path": "evidence/local/2026-08-09-v0.1.51/artifacts/agentnet-0.1.51.tar.gz",
-      "sha256": "46064f63be8e8b0d2b0cfe2b5d118c0d6749e40045575ebd3284eabdd15c24fd"
+      "sha256": "c557316e5bfe8ae1d3332390754ed74e73da9d1e06508dded5c37825cefa4897"
     },
     {
       "path": "evidence/local/2026-08-09-v0.1.51/artifacts/agentnet-0.1.51-py3-none-any.whl",
-      "sha256": "ebee10aecef0bcb947d6facfad83adb8f0deee9934a98cd7f02fa0aa002d9d47"
+      "sha256": "615dd15d58da962d21727a1852eec320ba2a95e5bf6fc2e80a09f376b61878fb"
     }
   ],
   "change_boundary": "Candidate 0.1.51 recognizes only the exact retained live state where completed canonical-owner recovery changed the Approval and Core owner/signer policy while the one-hour Approval TTL hotfix remained outside the retained v0.1.50 marker. Marker-relative recovery reverses only evidence-bound source/target principal and signer fields in current typed Approval/Core documents, requires both reconstructed canonical digests to equal the marker, and requires the current Core OIDC sidecar to equal Core. Journal-less recovery additionally requires one active canonical owner binding, one matching adoption audit, exact target credential state, and exactly two fixed-custody signer keys; every resumed write revalidates marker/current digests, Core/Core-OIDC agreement, database evidence, and signer custody before mutation.",
   "commands": [
     {
       "command": "PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/approval/test_approval_cli.py tests/approval/test_webauthn_service.py tests/operations/test_canonical_owner_recovery.py tests/operations/test_server_setup_recovery.py tests/authorization/test_communication_scope_service.py tests/production/test_release_v7_schema.py tests/integration/test_collaboration_scope_messaging.py tests/production/test_postgres_runtime.py::test_keeper_failure_blocks_protected_work_until_recovery_state_is_published tests/production/test_postgres_runtime.py::test_expired_keeper_lease_recovers_on_next_operation_with_higher_fence tests/production/test_postgres_runtime.py::test_expired_keeper_recovery_starts_new_background_keeper",
-      "result": "PASS: 281 passed"
+      "result": "PASS: 287 passed"
     },
     {
       "command": "PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run pytest -q tests/authorization/test_scope_harness_replacement.py tests/authorization/test_communication_scope_service.py tests/integration/test_collaboration_scope_messaging.py tests/cli/test_server_agent_activation.py",
       "result": "PASS: 62 passed"
     },
     {
       "command": "PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run --extra test pytest -q --ignore=tests/adapters/test_installed_live_inference.py --ignore=tests/adapters/test_subprocess_lifecycle.py --ignore=tests/components/test_bakeoff_evidence.py --ignore=tests/conformance/test_release_manifest.py",
-      "result": "PASS: 2269 passed and 22 expected platform/dedicated-PostgreSQL skips"
+      "result": "PASS: 2275 passed and 22 expected platform/dedicated-PostgreSQL skips"
     },
     {
       "command": "SOURCE_DATE_EPOCH=1580601600 PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache UV_LINK_MODE=copy uv build --offline --no-build-isolation twice",
-      "result": "PASS: two independent builds are byte-identical; sdist sha256 46064f63be8e8b0d2b0cfe2b5d118c0d6749e40045575ebd3284eabdd15c24fd; wheel sha256 ebee10aecef0bcb947d6facfad83adb8f0deee9934a98cd7f02fa0aa002d9d47"
+      "result": "PASS: two independent builds are byte-identical; sdist sha256 c557316e5bfe8ae1d3332390754ed74e73da9d1e06508dded5c37825cefa4897; wheel sha256 615dd15d58da962d21727a1852eec320ba2a95e5bf6fc2e80a09f376b61878fb"
     },
     {
       "command": "PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run python -B -I scripts/ci/packaged_local_communication_e2e.py run --package-root <installed package> --launcher <installed agentnet.mjs> --workspace <empty unrelated workspace>",
@@ -61,14 +61,14 @@
     },
     {
       "command": "PYTHONDONTWRITEBYTECODE=1 UV_CACHE_DIR=/tmp/uv-cache uv run agentnet verify",
-      "result": "PASS: 2296 passed and 22 expected platform/dedicated-PostgreSQL skips"
+      "result": "PASS: 2302 passed and 22 expected platform/dedicated-PostgreSQL skips"
     },
     {
       "command": "npm run check",
-      "result": "PASS: source plus generations 1 and 2 each reported 2296 passed and 22 expected platform/dedicated-PostgreSQL skips; exact-endpoint routing gate and packaged v0.1.45 user journey passed; excludes installed-live-inference, subprocess-lifecycle, and bake-off-evidence; two installed-harness pin failures remain non-green and were not rerun or waived"
+      "result": "PASS: source plus generations 1 and 2 each reported 2302 passed and 22 expected platform/dedicated-PostgreSQL skips; exact-endpoint routing gate and packaged v0.1.45 user journey passed; excludes installed-live-inference, subprocess-lifecycle, and bake-off-evidence; two installed-harness pin failures remain non-green and were not rerun or waived"
     }
   ],
-  "evaluated_at": "2026-08-12T13:39:04Z",
+  "evaluated_at": "2026-08-12T16:41:11Z",
   "execution_context": {
     "callback_incident": "Exact-commit GitHub workflow and server PostgreSQL results are included; no callback result is claimed",
     "local_retry_incident": "No retry is counted as evidence for this corrective tree. The final exact focused lane, broad lane, release verifier, release-manifest contract, recursive npm check, and source agentnet verify completed green with the recorded counts.",
@@ -84,7 +84,7 @@
     "source_revision": "4e8ebd72d6b5e39550e438816abb1e2d30a5326a"
   },
   "release_certified": false,
-  "release_source_tree_sha256": "9baef70ed843decde60e73ce6eb22718a29754c6087177672f5c5c6d1633e212",
+  "release_source_tree_sha256": "e00067bb4365b9089d45af45a726ff3d4f080baca6b39f3e2e4a017226857a10",
   "run_id": "2026-08-09-v0.1.51-local-package-candidate",
   "scope": "v0_1_51_dual_policy_drift_journalless_owner_recovery_candidate",
   "source_revision": "Working-tree corrective candidate bound by release_source_tree_sha256; exact-commit CI, disposable PostgreSQL evidence, and live convergence must be refreshed after commit",

evidence/local/2026-08-09-v0.1.51/artifacts/agentnet-0.1.51.tar.gz

@@ -1022,7 +1022,7 @@ def _verify_evidence_ledgers(manifest: dict[str, Any], root: Path, failures: lis
         npm_result = command_results.get("npm run check", "")
         if (
             not npm_result.startswith("PASS:")
-            or "2296 passed and 22 expected" not in npm_result
+            or "2302 passed and 22 expected" not in npm_result
             or "source plus generations 1 and 2" not in npm_result
             or "exact-endpoint routing gate" not in npm_result
             or "packaged v0.1.45 user journey" not in npm_result
@@ -1069,7 +1069,7 @@ def _verify_evidence_ledgers(manifest: dict[str, Any], root: Path, failures: lis
                 "uv run pytest -q "
             )
             and all(path in command.split() for path in required_focused_paths)
-            and result == "PASS: 281 passed"
+            and result == "PASS: 287 passed"
             for command, result in command_results.items()
         ):
             failures.append("0.1.51 focused release-blocker evidence is incomplete")