WI-5: Broker-minted one-time receipt-challenge protocol (COMPUTE=broker / COPY=model) #832

New Issue

jason.woltje · 2026-07-17T23:55:08Z

jason.woltje commented

2026-07-17 23:55:08 +00:00

OPUS-SECREV MANDATORY (receipt-protocol surface — core identity/authorization logic).

Deliverable 5 (BUILD-BRIEF §3.5, SPEC-v5 D3-v5). Broker mints a single-use receipt_challenge per cycle bound to (session_id, runtime_generation, compaction_epoch, request_epoch, H_source, H_payload, schema_version). COMPUTE = broker (observes exact latest-assistant message, computes binding incl H(latest-assistant-message)); COPY = model (verbatim copy of challenge + H_payload — an LLM cannot hash its own output). Observed in the EXACT latest assistant message (Claude: latest assistant entry + pending challenge, NO transcript grep; Pi: message_end, NOT after_provider_response). Single-use, consumed before the tool batch.

Broker transition order (mandatory): revoke → build B_payload/H_payload → PENDING_DELIVERY(mint unique challenge) → deliver → observe exact receipt → evidence commit → consume challenge → promote VERIFIED (last).
R2 (atomicity): evidence-commit→consume→promote is ONE atomic transaction; crash leaves neither VERIFIED-with-live-challenge nor consumed-with-ambiguous-promote; recovery mints a NEW challenge.
R3 (parsing): exact single current-cycle receipt parse; no unbounded grep; reject quoted/tool-output receipts, wrong gen/epoch, unknown/stale challenge, multiple receipts.
R1 (honesty): receipt detects ABSENT or PREFIX-TRUNCATED terminal token; a MIDDLE-DROP preserving the tail is a T-C contract violation, NOT receipt-detectable (server-side covers). R6: receipt = T-A delivery/liveness ONLY.

ACs: T25 replay rejected · T26 transcript-stale-match cannot promote · T27 partial delivery (prefix-trunc/tail-only/middle-drop/malformed) none promote · T28 single-use (no renew/reopen) · T29 model copies not computes. Depends on WI-1..WI-4.

Authority (build AGAINST these, do not re-derive): BUILD-BRIEF 89fdbc27, SPEC-v5 a6d07ade, RATIFICATION bac58319, sol red-team 3da326a4. Coder MUST re-verify sha256 before build. Target: framework-native packages/mosaic/ in mosaicstack/stack (NOT jarvis-brain, NOT ~/.config/mosaic/ directly). M1 = Claude + Pi only.

Review discipline: red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); closes #<this>; full 40-char head; never edit tests to pass / never force-merge red / never --no-verify. Mos merges after review + green suite + (for security surfaces) Opus-SECREV.

**OPUS-SECREV MANDATORY (receipt-protocol surface — core identity/authorization logic).** Deliverable 5 (BUILD-BRIEF §3.5, SPEC-v5 D3-v5). Broker mints a single-use `receipt_challenge` per cycle bound to `(session_id, runtime_generation, compaction_epoch, request_epoch, H_source, H_payload, schema_version)`. **COMPUTE = broker** (observes exact latest-assistant message, computes binding incl `H(latest-assistant-message)`); **COPY = model** (verbatim copy of challenge + `H_payload` — an LLM cannot hash its own output). Observed in the EXACT latest assistant message (Claude: latest assistant entry + pending challenge, NO transcript grep; Pi: `message_end`, NOT `after_provider_response`). Single-use, consumed before the tool batch. **Broker transition order (mandatory):** `revoke → build B_payload/H_payload → PENDING_DELIVERY(mint unique challenge) → deliver → observe exact receipt → evidence commit → consume challenge → promote VERIFIED (last)`. **R2 (atomicity):** evidence-commit→consume→promote is ONE atomic transaction; crash leaves neither VERIFIED-with-live-challenge nor consumed-with-ambiguous-promote; recovery mints a NEW challenge. **R3 (parsing):** exact single current-cycle receipt parse; no unbounded grep; reject quoted/tool-output receipts, wrong gen/epoch, unknown/stale challenge, multiple receipts. **R1 (honesty):** receipt detects ABSENT or PREFIX-TRUNCATED terminal token; a MIDDLE-DROP preserving the tail is a T-C contract violation, NOT receipt-detectable (server-side covers). R6: receipt = T-A delivery/liveness ONLY. **ACs:** **T25** replay rejected · **T26** transcript-stale-match cannot promote · **T27** partial delivery (prefix-trunc/tail-only/middle-drop/malformed) none promote · **T28** single-use (no renew/reopen) · **T29** model copies not computes. Depends on WI-1..WI-4. **Authority (build AGAINST these, do not re-derive):** BUILD-BRIEF `89fdbc27`, SPEC-v5 `a6d07ade`, RATIFICATION `bac58319`, sol red-team `3da326a4`. Coder MUST re-verify sha256 before build. Target: framework-native `packages/mosaic/` in `mosaicstack/stack` (NOT jarvis-brain, NOT `~/.config/mosaic/` directly). M1 = Claude + Pi only. **Review discipline:** red-first TDD; author≠reviewer; no self-merge; exact-head RoR (reviewed-SHA=merged-SHA); `closes #<this>`; full 40-char head; never edit tests to pass / never force-merge red / never `--no-verify`. **Mos merges** after review + green suite + (for security surfaces) Opus-SECREV.

jason.woltje added this to the Compaction-Refresh Mechanism (M1: Claude+Pi) milestone 2026-07-17 23:55:08 +00:00

jason.woltje referenced this issue from a commit

2026-07-19 21:16:06 +00:00

mos: WI-5 #832 sign-off — GO, Q1 confirmed, Q2 hybrid probe-form + provenance-form amendment

jason.woltje referenced this issue from a commit

2026-07-19 21:30:30 +00:00

test(#832): define receipt challenge replay contracts

jason.woltje referenced this issue from a commit

2026-07-19 21:30:30 +00:00

feat(#832): enforce broker-minted receipt challenges

jason.woltje referenced this issue from a commit

2026-07-19 22:02:19 +00:00