feat(wake): #958 A11 preimage.sh — durable provenance for the operator-side preimage definition

The operator-owned bytes every observed_hash is computed FROM (the source
adapter, the watch-list) were unversioned: a byte change was attributable
only via an agent transcript, and reconcile surfaced it as N UNACCOUNTED
sources instead of one cause.

New tool preimage.sh (wake 0.6.15 -> 0.7.0):
- Derives the preimage set from the runtime env (resolved
  WAKE_DETECTOR_SOURCE_CMD file, WAKE_WATCH_LIST, WAKE_PREIMAGE_EXTRA);
  per file appends {ts,path,sha256,size,mtime,prev} to an append-only
  ledger and captures bytes content-addressed under
  $STATE_DIR/preimage/objects/<sha256> — prior bytes + change time from
  durable state alone (acceptance a).
- CREDENTIAL HARD GATE (acceptance b): byte capture is REFUSED — never
  redacted — for credential-store paths, secret-shaped content (digest's
  six scrub shapes as a content-deny), and files over
  WAKE_PREIMAGE_MAX_BYTES; the refused file still gets its
  hash/size/mtime row (captured:false) so change TIME survives.
- FIRST-CLASS CAUSE LINE (acceptance c): a change/deletion enqueues one
  class=actionable entry via the store allocator with path as its §2.1
  hard locator; detector poll-once and reconcile run the check as a
  PRE-step so the cause line lands at a LOWER observed_seq than the
  deltas/enumerations it explains.
- FAIL-LOUD (D2/#955 class): unresolvable adapter, corrupt ledger
  (refuses re-baseline), failed object/ledger write, failed enqueue are
  loud non-zero, never "no change"; in both integrations the pass exits
  non-zero but source observation still proceeds.

Installer unchanged (Gate A auto-enumerates the new file; the recording
site is the runtime tick where the env-derived set exists). Watch-list
schema untouched ([1,1]).

Tests: test-wake-preimage.sh P1-P12 (red-first verified: P3/P11/P12 fail
with the integration edits reverted); all 9 existing wake suites green.

Refs #958

Agent: PEPPER (sb-it-1-dt)

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01NsKce8iZuSuRnu3gVMCBKB
Written-by: pepper (sb-it-1-dt)

packages/mosaic/framework/tools/wake/manifest.txt

@@ -374,8 +374,55 @@
 #              Changed: store.sh, digest.sh, ack.sh
 #              (+ test-wake-store-ack.sh T13-T16,
 #              test-wake-digest-quarantine.sh Q12-Q16).
+#   0.7.0  #958 A11 preimage.sh — durable provenance for the OPERATOR-SIDE
+#              preimage definition (wake-pilot finding: source-adapter.sh was
+#              unversioned, so the operator-owned bytes every observed_hash is
+#              computed FROM had thinner provenance than any hash they feed;
+#              attribution required an agent transcript). NEW tool + two
+#              pre-step integrations, ADDITIVE: (1) preimage.sh derives the
+#              preimage set from the RUNTIME env (the resolved
+#              WAKE_DETECTOR_SOURCE_CMD file, WAKE_WATCH_LIST, optional
+#              WAKE_PREIMAGE_EXTRA paths) and, per file, records
+#              {ts,path,sha256,size,mtime,prev} to an append-only ledger +
+#              captures the bytes CONTENT-ADDRESSED under
+#              $STATE_DIR/preimage/objects/<sha256> — prior bytes + change
+#              time are answerable from durable state alone, no transcript
+#              (acceptance a). A git-repo-in-operator-dir design was REJECTED:
+#              its who/why claim is false under shared-author fleets, and
+#              .gitignore is pattern-based where acceptance (b) demands
+#              fail-closed. (2) CREDENTIAL HARD GATE (acceptance b): byte
+#              capture is REFUSED — never redacted — for (i) credential-store
+#              PATHS (mosaic-home credentials.json, tools/_lib/credentials.json,
+#              credentials/**, any basename credentials.json), (ii)
+#              secret-SHAPED content (digest.sh's six scrub shapes reused as a
+#              content-deny grep), (iii) files over WAKE_PREIMAGE_MAX_BYTES
+#              (default 1 MiB). A refused file still gets its hash/size/mtime
+#              row (captured:false + refused reason) so change TIME survives
+#              even when content must not. (3) FIRST-CLASS CAUSE LINE
+#              (acceptance c): on a change (or deletion — ABSENT is a state,
+#              not an error), one class=actionable entry is enqueued via the
+#              store allocator with locators {kind:preimage, path (§2.1 hard
+#              locator — never quarantined), observed_hash, prev_hash,
+#              preimage:true, reason:preimage-definition-changed}. Both
+#              detector.sh cmd_poll_once and reconcile.sh cmd_reconcile run
+#              the check as a PRE-step, so the cause line lands at a LOWER
+#              observed_seq than the N per-source deltas/enumerations it
+#              explains — "preimage definition changed" reads first, not N
+#              UNACCOUNTED lines. (4) FAIL-LOUD discipline (D2/#955 class):
+#              an unresolvable adapter, unreadable watch-list, corrupt ledger
+#              (REFUSES to compare or re-baseline over corrupt history), failed
+#              object/ledger write, or failed enqueue is a loud non-zero —
+#              never read as "no change"; in both integrations the pass exits
+#              non-zero but source observation still proceeds (no starvation).
+#              First-seen is a SILENT baseline (detector first-poll idiom).
+#              The installer is UNCHANGED — Gate A auto-enumerates the new
+#              file from the filesystem; the recording site is the runtime
+#              tick, which is where the env-derived preimage set exists.
+#              store.sh/digest.sh/beacon.sh UNCHANGED; watch-list schema
+#              UNTOUCHED ([1,1]). Changed: preimage.sh (new), detector.sh,
+#              reconcile.sh (+ test-wake-preimage.sh P1-P12).
 component=wake
-version=0.6.15
+version=0.7.0
 
 # Watch-list schema this component consumes, and the INCLUSIVE range of
 # schema_version values it supports. A wake-watch-list.json whose schema_version
@@ -446,6 +493,19 @@ schema_max=1
 #                    seed) instead of a bare source error, and LINKS the unit into
 #                    the user systemd search path + post-install-validates it
 #                    resolves (#913).                                       (W7, #913)
+#   preimage.sh A11 — operator-side PREIMAGE-DEFINITION provenance: derives the
+#                    preimage set from the runtime env (resolved adapter file,
+#                    watch-list, WAKE_PREIMAGE_EXTRA), appends
+#                    {ts,path,sha256,size,mtime,prev} rows to an append-only
+#                    ledger, captures bytes content-addressed under
+#                    preimage/objects/<sha256>, and enqueues a FIRST-CLASS
+#                    "preimage-definition-changed" actionable (path = §2.1 hard
+#                    locator) BEFORE the deltas it explains (detector +
+#                    reconcile pre-step). Credential HARD GATE: capture is
+#                    REFUSED (hash/mtime still recorded) for credential-store
+#                    paths, secret-shaped content, and oversized files —
+#                    refusal, never redaction. Fail-loud on any infra failure;
+#                    a corrupt ledger refuses re-baseline.        (#958)
 # Companion (framework subtree, not under tools/wake/): systemd/user/mosaic-wake.service
 #                    — the long-lived detector daemon unit (per-class SLO lives in
 #                    the daemon, NOT a systemd interval).                          (W7)