fix(#832): bind receipt promotion to trusted observation

docs/compaction-refresh/probes/p5_receipt_replay.py

@@ -15,6 +15,7 @@ consumed challenge cannot be replayed or reopen/renew its lease.
 from __future__ import annotations
 
 import argparse
+import base64
 import importlib.util
 import json
 import os
@@ -88,8 +89,12 @@ def run_once(index: int) -> str:
     os.chmod(root, 0o700)
     socket_path = root / "broker.sock"
     state_path = root / "state.json"
+    observer_path = root / "test-observer.json"
     process = subprocess.Popen(
-        [sys.executable, "-I", "-S", "-B", str(DAEMON), "--socket", str(socket_path), "--state", str(state_path)],
+        [
+            sys.executable, "-I", "-S", "-B", str(DAEMON), "--socket", str(socket_path),
+            "--state", str(state_path), "--test-observer-file", str(observer_path),
+        ],
         stdin=subprocess.DEVNULL,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
@@ -121,12 +126,22 @@ def run_once(index: int) -> str:
             "h_payload": construction.h_payload,
             "schema_version": 1,
         }
+        construction_request = {
+            "manifest_version": 1,
+            "generator_version": "p5-replay-probe",
+            "fragments": [{
+                "source_id": "authority/probe",
+                "content_base64": base64.b64encode(b"P5 shipped transition driver\n").decode("ascii"),
+                "expected_sha256": "63537df1a6cb0d80195a96757ab11d629e5b5e1f23be167218b84cb195b1c1d6",
+            }],
+        }
         pending = request(socket_path, {
             "action": "begin_verification",
             "session_id": session_id,
             "runtime_generation": 1,
             "runtime": "pi",
             "binding": binding,
+            "construction": construction_request,
         })
         if pending.get("ok") is not True or pending.get("state") != "PENDING_VERIFICATION":
             raise AssertionError(f"shipped pending-delivery transition failed: {pending!r}")
@@ -143,12 +158,17 @@ def run_once(index: int) -> str:
             "receipt_challenge": challenge,
         }), "INVALID_LEASE_TRANSITION")
 
+        observer_path.write_text(json.dumps({
+            "session_id": session_id,
+            "runtime_generation": 1,
+            "latest_assistant_message": receipt,
+        }), encoding="utf-8")
+        os.chmod(observer_path, 0o600)
         observed = request(socket_path, {
             "action": "observe_receipt",
             "session_id": session_id,
             "runtime_generation": 1,
             "receipt_challenge": challenge,
-            "latest_assistant_message": receipt,
         })
         if observed.get("ok") is not True or observed.get("state") != "PENDING_PROMOTION":
             raise AssertionError(f"shipped evidence transition failed: {observed!r}")
@@ -173,7 +193,6 @@ def run_once(index: int) -> str:
             "session_id": session_id,
             "runtime_generation": 1,
             "receipt_challenge": challenge,
-            "latest_assistant_message": receipt,
         }), "RECEIPT_REPLAY")
         expect_refused(request(socket_path, {
             "action": "promote_lease",

docs/scratchpads/832-receipt-challenge-protocol.md

@@ -10,4 +10,4 @@
   3. Implement the broker-minted receipt challenge and exact receipt observation/consume/promote path.
   4. Run unit, framework-shell, compile, lint, and type checks; push after the required queue guard; report to `mosaic-100`.
 - **Risks:** The standalone harness must drive the real daemon without a divergent fixture. If that is impossible, stop and flag Mos.
-- **Evidence:** RED recorded in `/home/hermes/agent-work/reviews/832-wi5-red-receipt-challenge.log`: receipt module absent before implementation. GREEN: receipt T26/T29 unittest (2 tests), normative-fragments unittest (5 tests), state-store regression (10 tests), `py_compile`, Mosaic package lint, and Mosaic package typecheck. Coverage tooling is unavailable (`python3 -m coverage`: module not installed); no probe was fired. Push pending.
+- **Evidence:** Initial RED recorded in `/home/hermes/agent-work/reviews/832-wi5-red-receipt-challenge.log`; initial green checks passed. Remediation RED recorded in `/home/hermes/agent-work/reviews/832-wi5-remediation-red.log` before observer/payload implementation: forged `h_source`/`h_payload` was accepted and the observer module was absent. Remediation GREEN: observer/payload/T26/T29 unittest (4 tests), normative-fragments unittest (5), state-store regression (10), full mutator-gate acceptance (20, including the real begin → observer → consume → promote path), `py_compile`, Mosaic package lint/typecheck, and targeted Prettier check. The P5 harness was updated for the test-observer seam but was not fired. Coverage tooling remains unavailable (`python3 -m coverage`: module not installed). Push pending.