feat(witness): re-verify the evidence read set before promotion (ADR-0010)

[ruvnet]

1. Hypothesis

Given a candidate whose evaluation receipt was produced against an earlier tree, when the paths that evaluation read are digest-anchored at evaluation time and re-digested against the promotion target, then drift in that read set should be detected even when git reports no conflict — subject to: (1) a moved base commit alone never yields STALE; (2) age alone is not the mechanism; (3) the witness primitive performs no I/O; (4) no receipt carries file content.

2. The failure this is derived from

PR #11 merged cleanly and still broke main. It was evaluated 2026-08-15 asserting withDefaults(selfConfig).autoMerge === true plus a golden prompt snapshot. Honest evaluation, passed. Three weeks later the repo deliberately set autoMerge: false; on landing, two tests went red (repaired in #95).

dream.config.json was never in #11's diff — git had nothing to conflict on. It was in #11's read set.

git protects the WRITE set. Nothing here protected the READ set.

This is not "receipts get old." A three-week-old candidate whose dependencies never moved is still valid; a one-day-old candidate whose dependencies moved is not. Age is the wrong axis.

3. Candidate

EvidenceFreshnessPolicy / EvidenceFreshnessReceipt in @dream-machine/witness, plus dream-machine freshness stamp|verify.

The policy freezes: policy id, base commit, evaluation timestamp, the declared read set (path + SHA-256 at eval time), requireDeclaredDependencies, optional maxAgeDays. At promotion the same paths are re-digested and compared.

FRESH / STALE / INDETERMINATE (unverifiable is never fresh) / INVALID. Every receipt carries authority: 'none' per ADR-0007/0009 — evidence that an evaluation still applies, never permission to merge.

Deliberate non-goals, because getting them wrong makes the gate useless:

• a moved base commit is not staleness — main advances constantly; that gate fires always and gets switched off
• age is a secondary bound, not the mechanism
• the primitive does no I/O; the CLI supplies observed digests

4. Evaluation Receipt

Vitest, deterministic, $0, zero LLM calls. 616/616, typecheck clean.

• 19 unit tests incl. the compiler-parity: golden-snapshot test coverage for self-hosted dream.config.json #11 regression and an adversarial block (policy rewriting, path traversal, duplicates, backdated observations, runtime type bypass, resource bounds, no-content-in-receipt)
• 11 CLI tests incl. exit-code contract (0/1/2)
• 2 cost tests: sub-quadratic 512→4096 deps

Validated against real history, not fixtures: stamping dream.config.json from 8ce3857 (#11's actual evaluation base) and verifying against current main returns STALE, driftedPaths: ["dream.config.json"], exit 1.

5. Security Review

Adversarial review of this change found a real defect in this change: freshness verify originally digested every declared path before the library validated them, so an untrusted policy file naming ../../etc/hosts would be read — and its existence confirmed — before coming back INVALID. A read/existence oracle.

Fixed by validating and anchoring the policy before any filesystem access, with two regression tests (one asserts the only path read is the policy file itself). Also: digests only, never content (tested); bounded read set, path length, and age; no ReDoS-prone patterns; absolute paths, .. traversal, backslashes and null bytes rejected.

6. Reward Hack Check

No test weakened. One pre-existing assertion in my own earlier commit was strengthened (a rewritten policy now produces no receipt at all rather than an INVALID one emitted after touching the filesystem) — called out explicitly in the diff. Full suite reported both ways; the single local npm run check failure is the macOS-only /tmp→/private/tmp symlink case in mission.test.mjs, not exercised by this repo's Linux CI.

7. What this does and does not do

It supplies the missing freshness input a bounded auto-landing path would need before acting on a three-week-old ACCEPT verdict. It does not close the promotion loop by itself, and a read set declared too narrowly will still miss drift — this raises the floor, it does not prove independence.

8. ADR

ADR-0010 (Proposed), indexed.

9. Merge Policy

Human review required. Evaluation is not promotion.

🤖 Generated with RuFlo

https://claude.ai/code/session_01Ff2xRKvYrqXJhefvcapfE1