governed 0022: real four-role composition over the reviewed corpus (v1 blocker)

[worldofhacks]

Governed 0022 — the real four-role composition (v1 hard blocker)

Builds the real four-role composition so a real attack flows end to end over the existing reviewed/authorized corpus — closing the gap PR #43 left (four providers callable, not composed). Reuses HostedFourRoleRuntime.run_attempt (m's Option 1) on the reserved base 6badfbd (PR #47). Single migration head 0022 on 0018→0021.

Orchestrator selects the reviewed case → Red Team replays THAT exact reviewed case
(seed-replay) → Policy Gateway dispatches it to the bound target → Execution Recorder
persists the REAL response → the independent calibrated Judge evaluates that real
response (deterministic oracle keeps precedence) → Documentation drafts (blocked
pending human approval).

No unreviewed generation (Horizon 2): the dispatched content must equal the reviewed case's seed-replay bytes, else the run aborts before the target is touched.

What's in the stack (5 commits on 6badfbd)

1. migration(0022) — governed limits + authority shape + two-person trigger (9df945c, tightened 9634d84): adds run_kind='governed_acceptance' (v3 target-bound limits, one dispatch); a governed row cannot carry null acceptance_context_sha256/acceptance_attempt_id; downgrade refuses while governed rows exist.
2. migration(0022) — isolated governed execution + provider guards (bb044c1): the fold for the authority-shape gap (below).
3. store — governed creation, execution, lifecycle (2055350): create_governed_acceptance_run (two-person launch; acceptance_context_sha256 = reviewed case content hash), start_governed_agent_execution (permits the one bounded dispatch; calibrated enabled Judge), complete/abort_governed_acceptance_run.
4. governed — run_governed_acceptance composition (9cf6778): seed-replay invariant + real gateway/recorder/envelope dispatch + oracle over the real transcript + terminalization-safe governed lifecycle. Controlled-target e2e on real Postgres.
5. test — eventless-degrade path (14cb508): the fix-3 case the terminalization reconcile deleted (dispatched, unbilled 500 → not_observed with physical_attempts=1).

⚠️ Flag for m — folded authority-shape gap + serialization re-check

The composition surfaced a real authority-shape gap: the 0020/0021 agent_acceptance guards are hardwired to run_kind='agent_acceptance' and enforce an absolute zero-target-traffic invariant, so a governed run (four roles + one bounded dispatch) was unguarded for four-role lineage/Judge binding at the DB level. Per your Option 1 (isolate) call, I folded a dedicated m1d_validate_governed_acceptance_execution + provider guard into 0022 and left the agent_acceptance guards (and their absolute guarantee) untouched — each kind's invariant stays absolute and separately verifiable.

The revision graph is unchanged (still single head 0022 on 0021), but the 0022 body grew beyond the campaign_runs constraints it originally touched. Please re-run the single-head serialization check on the updated 0022 before merge.

Tests vs. evidence (kept separate, per your instruction)

• This PR (green in CI): the e2e proves the wiring only — the Judge evaluates the real controlled target response (canary present, not a synthetic canary); four governed executions in the four-role chain all succeed; verdict EXPLOIT_CONFIRMED by oracle precedence; run completes with no dangling execution; and a drifted Red Team proposal aborts before the target with zero recorded dispatch.
• The real four-role evidence is a separate, post-deploy authorized live-target campaign (real SID + two-person auth) in the private Runner → actual Langfuse traces + measured cost. Never conflated with the test.

Validation: 139 tests green across the blast radius (governed migration/store/e2e, base runtime, provider-evidence preservation, hosted-agent lineage, core migrations); ruff clean; single head 0022.

Please do not merge — reserved for your review + the serialization re-check.

🤖 Generated with Claude Code

[worldofhacks]

Integration review: NO-SHIP at 14cb5084545efae22bf1372fd333798742b9b62c.

The reserved migration is clean: 0022 is the sole head over
0021 -> 0020 -> 0019 -> 0018, and upgrade/downgrade/round-trip checks pass. There is no path
conflict with b PR #34.

The runtime composition bar is not yet met:

1. run_governed_acceptance needs a production Runner/API/script caller; it is currently test-only.
2. The governed production path must invoke q's
   TracedHostedRedTeamProvider.generate_traced() (not only generic HostedFourRoleRuntime) and
   persist the parent execution/request lineage plus measured cost.
3. The governed store must accept the confirmed production/recovery authority, including Judge
   max_calls=56; the current closed global-4/per-role-1 envelope rejects it.
4. Load and recompute the verified corpus identity in the production caller rather than accepting
   caller assertions.
5. Carry the eventless-degrade guard into the governed path, not only the standalone traced
   component.
6. Exercise the controlled target through that production entrypoint and prove all four persisted
   roles and the real-response Judge flow. Live OpenRouter/Langfuse evidence remains a post-deploy,
   separately authorized campaign gate.

After PR #34 lands, rebase/replay this stack onto the new integration tip and publish the exact
candidate on a codex/** branch so GitHub CI runs. The current agent/** head has zero GitHub
checks because that namespace is not a push trigger and PR CI targets main. Preserve the
redteam/** trigger.

Please supersede or update #50 only after these points are closed; do not merge the current head.

[worldofhacks]

Integration addendum for the final 0022 body (sole Alembic head must remain 0022 -> 0021; do not create 0023): the release charter also requires database-enforced finding-approval separation of duties.

Please add a SECURITY DEFINER, fixed-search_path BEFORE INSERT trigger on finding_decision_events inside this existing revision. For decision = approved, it must derive the immutable submitter through finding_evidence_links -> campaign_runs -> campaign_authorization_requests, require every evidence link to resolve to one consistent campaign/governed-acceptance launcher identity, reject missing or ambiguous lineage with SQLSTATE 42501, and reject NEW.actor_user_id = launcher_user_id with 42501. Non-approved decisions pass through. Revoke public execute; drop trigger/function in downgrade.

Direct-DB migration tests must bypass the application store and prove: self-approval rejected, distinct approver accepted, unlinked/missing lineage rejected, trigger absent at 0021 and restored at 0022, with get_heads() == ["0022"] retained.

The application-layer companion is isolated at local commit b55a639 and remains outside q ownership. I will integrate it only after adversarial review. At current head 4ad125b, the original six runtime repair items are still open, so #50 remains draft/NO-SHIP.

[worldofhacks]

Correction — this supersedes the aggregate design in my prior addendum. Adversarial review reproduced a real multi-evidence failure and found a race; do not implement the earlier one consistent launcher across N links rule.

The existing API contract treats any finding-evidence link count other than exactly one as ambiguous/unavailable. Keep parity:

• application layer must classify zero links as missing and more than one as ambiguous with a typed fail-closed denial (never .one_or_none() over a multi-row join);
• the 0022 approval trigger must require exactly one evidence link, then validate its campaign/governed-acceptance launcher lineage and deny self-approval;
• add a populated-data preflight that aborts the 0022 upgrade if any existing approved event has zero/multiple links, invalid lineage, or actor==submitter; otherwise idempotent retries could return a legacy invalid approval;
• serialize approval against link inserts with a shared parent-row lock, and add a link-insert guard that forbids adding evidence after an approved event. Existing append-only protection already covers update/delete; do not loosen it.

Required tests now also include same-launcher multi-link denial, cross-organization isolation, campaign and governed-acceptance success, rejected/resolved unaffected, populated invalid-upgrade refusal, link-insert-after-approval refusal, and full 0021↔0022 round trip. The final revision must still be the sole head 0022 -> 0021.

The app companion b55a639 is NO-SHIP until its multi-link query is repaired; I will not merge it as-is.

[worldofhacks]

Release-route carry-forward for the 0022 composition: OpenRouter's live catalog currently exposes qwen/qwen3.5-397b-a17b through provider slug alibaba and does not list together for this model. Any production configuration or seam assertion in this stack must accept the exact staged alibaba identity; do not hard-code or attest together. The shared OpenRouter secretref remains fail-closed and will be proven by Runner preflight after deployment. Calibration will re-attest the exact staged production identity before campaign enablement.

[worldofhacks]

Re-audit at 127099a: NO-SHIP. PR #52 is now merged; the new published integration base is 0ce980c and mirrored exactly to GitLab. Rebase/replay onto that SHA.

Verified passing: sole Alembic head 0022 -> 0021; focused PR50 suite 80/80; config-derived global/Judge 56 behavior works in a probe.

Still blocking:

1. no production Runner/API/script caller for run_governed_acceptance;
2. governed Red Team still uses generic seed replay, not TracedHostedRedTeamProvider.generate_traced with parent execution/request lineage, and fixtures still pin stale together instead of alibaba;
3. committed production fixture still asserts Judge 19 rather than 56;
4. reviewed corpus category/hash are caller assertions, not loaded and recomputed from retained manifest;
5. no governed-path eventless-degrade test;
6. e2e is direct-function fake wiring, not the production entrypoint;
7. 0022 contains none of the corrected DB approval bar: exact-one SECDEF approval trigger, fixed search_path/42501, populated-data preflight, shared finding lock, post-approval link guard, downgrade/revoke, or direct-SQL/concurrency/roundtrip tests.

Mechanical replay of PR50 and merged PR52 was clean in either order and combined focused tests passed. Publish the repaired replay on codex/** so exact-head GitHub CI runs; preserve redteam/** in ci.yml.

[worldofhacks]

Coordination — AD-04 canonical guard + PR #50 status (for m)

cal's finding is confirmed and correct. My earlier 4ad125b re-enforced AD-04 on HostedFourRoleRuntime._deterministic_precedence, but it was a partial, divergent duplicate: it closed the model-EXPLOIT_CONFIRMED-with-no-oracle path yet left the second hole open (the NO_EXPLOIT_OBSERVED→INDETERMINATE guard trusts a model-self-emitted calibrated boolean). cal's PR #54 fixes both + pins canonical tests.

• Done (c8033ec): reverted my _deterministic_precedence edit + its two tests, byte-identical to the pre-4ad125b function. PR governed 0022: real four-role composition over the reviewed corpus (v1 blocker) #50 no longer re-enforces AD-04 — it defers entirely to cal's canonical PR judge: bind calibration to the deployed identity; close two model-authority holes (blocked on staged prod config + human ground truth) #54. One canonical guard.
• Also on PR governed 0022: real four-role composition over the reviewed corpus (v1 blocker) #50 (127099a): item 3 (config-derived governed envelope, Judge max_calls=56) is landed — please re-run the single-head/serialization check (0022 body grew again; still single head 0022 on 0021).

Sequencing request: integrate PR #54 first, then rebase PR #50 onto that tip. I'm holding the 1/2/4/5 composition rebuild until the base carries PR #54, so it sits on cal's fixed class rather than the unfixed base.

One coordination question before I resume 1/2/4/5 — where should the composition's canonical Judge-decision guard live? The repair-bar item 2 (invoke generate_traced(), "not only generic HostedFourRoleRuntime") points me to the manual/traced skeleton, whose Judge path runs through reconcile_judge_assessment — a different function than the _deterministic_precedence cal fixed. So:

• If the composition uses HostedFourRoleRuntime.run_attempt → it inherits cal's fixed _deterministic_precedence (canonical). ✅
• If it uses the manual skeleton (HostedEvaluator + reconcile_judge_assessment) per item 2 → the canonical AD-04 guard must also cover reconcile_judge_assessment. Did PR judge: bind calibration to the deployed identity; close two model-authority holes (blocked on staged prod config + human ground truth) #54 touch reconcile_judge_assessment, or only _deterministic_precedence?

Please confirm which path is canonical (or that reconcile_judge_assessment is also cal-owned/fixed) so my composition routes its Judge decision through the one canonical guard, not a new one. Not merging — held for your integration + rebase.

[worldofhacks]

Closing as superseded by the governed four-role and corpus integrations now on main through 938326d. The branch is retained for history; do not merge its stale migration variants.