fix(change): a definition approval may not withdraw the delta binding an earlier approval recorded

[0xLeif]

Closes #719. The last known way to defeat a gate shipped in this release.

The bypass

#711 bound delta bodies to the approval that signed them. change approve --portable-5-0-1 undid that: append_portable_definition_approval_v501 appended two definition-gate records carrying approved_delta_digests: None, and effective_definition_approval selects with rposition — the last one. So a portable approve after a normal one downgraded the effective approval to "no claim".

Correcting the issue's mechanism

The literal sequence I filed already refuses on unfixed main, but for a different reason. The portable projection is workflow-v1 only, and a v1 definition digest hashes every delta payload through definition_artifact_snapshot, so ensure_definition_approval_valid catches the swap one line before the binding is consulted:

portable definition approval pair is malformed or stale

On v1 the downgrade costs recorded evidence and a correct diagnostic, not a materialization — and that diagnostic is actively harmful, since it points the reader at re-running --portable-5-0-1, which re-approves the swapped wording and again records no claim about it.

The consequence that generalizes is v2's, where the scope digest hashes intent and boundary only and this binding is all there is. The second discriminator therefore builds the downgraded shape directly rather than replaying the filed sequence.

The fix — monotonicity on both sides

Write side: the portable pair carries the binding forward instead of recording None. That matches what the module already does — append_approval records it for every definition gate, and the normalizing approval inside accept_change already carries it forward. The None was an omission predating #711, not a position. Refusing the portable approve instead would have removed a capability with no workaround, since approve → approve --portable-5-0-1 is the normal route to a 5.0.1-verifiable approval.

Read side: absence still returns Ok(()) — but absence is now a property of a ledger, not of one event. It is trusted only when no definition-gate approval in that ledger records a digest; a withdrawn claim is refused and names the remedy. Closing and finalization gates are excluded, since they record None by design.

The distinction #711 was built on is preserved: absence means this ledger predates the binding, never this approval declines to say what it signed.

Other digests unaffected, pinned rather than assumed: approved_delta_digests is an input to none of definition_digest, definition_projection_bytes_v501, or definition_approval_pair_id. The discriminator asserts the pair's digests still equal portable_definition_digest_pair_v501 and that ensure_definition_approval_valid still resolves. ApprovalLedger tolerates unknown fields by design, so a 5.0.1 reader still parses it.

Tests, each run with the fix disabled in place

Test	Against unfixed main
a_portable_definition_approval_carries_the_delta_binding_it_inherits	FAIL — left: None, right: Some({"auth": "66d9882e…"})
a_later_definition_approval_may_not_withdraw_a_recorded_delta_binding	FAIL with no message at all — returns Ok(canonical_applied: true) and the spec contains BACKDOOR
a_portable_definition_approval_records_delta_wording_with_no_prior_approval	FAIL — legitimate portable use recorded no wording
a_ledger_that_never_recorded_delta_wording_still_materializes_a_swapped_body	PASS — control

Honest label on the control, and it is the important one: it builds the ledger monotonicity is easiest to break — a pre-#711 change approved several times, no digest anywhere — swaps the body, and requires materialization to succeed. That is what fails if someone "fixes" this by making absence fail closed, which would fail all 193 archived changes on evidence nobody could have written (#672 / #684 / #689's first design).

Blast radius measured, not argued: all 197 approvals.json files under .specsync/ scanned for the newly refused shape — none matches.

clippy -D warnings bare clean · fmt clean · 2395 unit + 407 integration · change check exit 0 · change audit --strict exit 0 · pre-push gate 62 specs, 100%.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DgYAvsQM6P9fKxDotnDuzP

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.