WI-4: Verbatim-hashed normative fragments — B_payload / H_payload (no self-reference, byte-identical Claude↔Pi) #831

New Issue

jason.woltje · 2026-07-17T23:55:07Z

jason.woltje commented

2026-07-17 23:55:07 +00:00

OPUS-SECREV MANDATORY (hash-construction surface).

Deliverable 4 (BUILD-BRIEF §3.4, SPEC-v5 D3 Objects). B_payload = exact normative fragments (verbatim per §5 hashing) + deterministic metadata (manifest_version, generator_version, ordered resolved source identities). H_payload = SHA256(domain_sep ‖ length_framed(B_payload)) — hashes the payload ONLY; the receipt/challenge is NOT part of B_payload → NO self-reference. Source-invalidation fail-closed.

ACs: T24 deterministic B_payload/H_payload/envelope vectors have no self-reference and reproduce BYTE-FOR-BYTE across the Claude and Pi builders. Gated on WI-0 probe 5.

Authority (build AGAINST these, do not re-derive): BUILD-BRIEF 89fdbc27, SPEC-v5 a6d07ade, RATIFICATION bac58319, sol red-team 3da326a4. Coder MUST re-verify sha256 before build. Target: framework-native packages/mosaic/ in mosaicstack/stack (NOT jarvis-brain, NOT ~/.config/mosaic/ directly). M1 = Claude + Pi only.

Review discipline: red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); closes #<this>; full 40-char head; never edit tests to pass / never force-merge red / never --no-verify. Mos merges after review + green suite + (for security surfaces) Opus-SECREV.

**OPUS-SECREV MANDATORY (hash-construction surface).** Deliverable 4 (BUILD-BRIEF §3.4, SPEC-v5 D3 Objects). `B_payload` = exact normative fragments (verbatim per §5 hashing) + deterministic metadata (`manifest_version`, `generator_version`, ordered resolved source identities). `H_payload = SHA256(domain_sep ‖ length_framed(B_payload))` — hashes the payload ONLY; the receipt/challenge is NOT part of `B_payload` → NO self-reference. Source-invalidation fail-closed. **ACs:** **T24** deterministic `B_payload`/`H_payload`/envelope vectors have no self-reference and reproduce BYTE-FOR-BYTE across the Claude and Pi builders. Gated on WI-0 probe 5. **Authority (build AGAINST these, do not re-derive):** BUILD-BRIEF `89fdbc27`, SPEC-v5 `a6d07ade`, RATIFICATION `bac58319`, sol red-team `3da326a4`. Coder MUST re-verify sha256 before build. Target: framework-native `packages/mosaic/` in `mosaicstack/stack` (NOT jarvis-brain, NOT `~/.config/mosaic/` directly). M1 = Claude + Pi only. **Review discipline:** red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); `closes #<this>`; full 40-char head; never edit tests to pass / never force-merge red / never `--no-verify`. **Mos merges** after review + green suite + (for security surfaces) Opus-SECREV.

jason.woltje added this to the Compaction-Refresh Mechanism (M1: Claude+Pi) milestone 2026-07-17 23:55:07 +00:00

jason.woltje referenced this issue from a commit

2026-07-19 20:15:30 +00:00

test(#831): add failing tests for verbatim-hashed fragments (B_payload/H_payload, no-self-ref, source-invalidation)

jason.woltje referenced this issue from a commit

2026-07-19 20:15:30 +00:00

feat(#831): implement verbatim-hashed normative fragments construction

jason.woltje referenced a pull request that will close this issue

2026-07-19 20:22:37 +00:00

WI-4 (#831): verbatim-hashed normative fragments (B_payload/H_payload) #844

jason.woltje closed this issue

2026-07-19 20:34:21 +00:00