Close the second-party review's nine findings and eight variants of them

[Jamarian Payne (SpookyGroup)]

Summary

Repairs all nine findings from a second-party adversarial review (NOE-F-029 to 037) and eight variants of them found by a deliberate follow-up hunt (NOE-F-038 to 045), each with regression tests. Suite: 127 -> 241 passing. Benchmark headline unchanged (0/13 attacks, 0/8 false positives); the new agent-path corpus is 0/8 by default versus 6/8 in its control arm.

Part 1 - the nine reported findings

#	Finding	Fix
R1	Confused deputy: publish-capable agent's learn_fact() went live	Evidence by default with server-recorded origin; publish=True is the explicit opt-out
R2	assemble_context ignored query/task_type/max_tokens	Token-budgeted, lexically ranked; guardrails always kept
R3	Corrections registered no grief; step success treated as truth	register_correction; operational evidence weighted 0.25, trust ceiling 0.75
R4	write() overwrote producer-declared trust	Lower-only trust_ceiling
R5	Skill "shadow validation" was a repeatable checklist	Held-out trigger replay: precision/recall/lift vs baseline
R6	Restatement and policy matching defeated by zero-width/punctuation	Fold invisible characters; canonical similarity check
R7	Faith unreachable	Earned via confirmation, capped at 0.6
R8	Mutable context nodes; overstated enforcement claim	Deep copies; docstring corrected
R9	Console context endpoint raised for every provider format	Request-local adapter

Part 2 - variants, hunted before a second reviewer could find them

The first repair fixed the reported instances. The hunt asked, for each fix, what a hostile reader would try next, using four audits: which fields providers emit vs what review covers, which code paths write nodes, where decisions rest on self-reported values, and whether the benchmark could even see each attack.

Ledger	Variant	Fix
F-038	Promotion rewrote only value, but providers also emit skill objective/method/constraints and episode reflection	Every non-reviewed field reset on promotion; originals kept in audit metadata
F-039	Autopsy wrote raw task text and tool error output into ACTIVE episodes; the Claude adapter emitted them	Episode value templated from system data only; raw narrative kept for audit, never rendered
F-040	A skill could be written already PROMOTED; promote_skill trusted self-reported evidence	Direct PROMOTED writes refused; promotion recomputes its own evidence
F-041	Candidate/quarantined facts earned or lost trust from sessions	Only published facts take part
F-042	Token estimate ignored escaping (up to 6x emitted size)	Estimate bounds escaped output
F-043	Policy matching evadable by combining marks, selectors, fillers, look-alikes, spacing	NFKD fold + small confusables table + compact matching
F-044	set_profile / set_project_state published directly (always-loaded classes)	Evidence by default, like learn_fact
F-045	Benchmark scored only node.value	Scores the text providers actually render

A structural guard (test_provider_emission_matches_the_reviewed_allowlist) fails whenever a provider starts emitting a field nobody reviewed, so this class cannot silently reopen.

Worth reviewing

• F-039 had been logged as a limitation rather than fixed in the first repair (NOE-L-016). It is now fixed and the limitation marked resolved, not deleted.
• The benchmark's publish=True control arm reproduces pre-repair behaviour and lands 6/8, including the profile, project-state and episode-narrative routes. A containment result is only evidence if that control loses.
• Each hardened module was reverted alone to confirm its tests fail without it (policy_boundary 12, store 15, autopsy 5, forge 4, retrieval 4, providers 2).
• Three existing tests were updated because they encoded the flawed behaviour (an empty store yielding a "shadow run", and an agent's set_profile publishing).
• README.md now has a table of exactly what can reach the model and what gates each field.

Honest limits

• The review is classed first-party in the ledger: reviewer identity and repo access are not independently established. The variant hunt is also first-party. Neither is certification.
• Not reproduced before repair: the reviewer's 20,001-character figure; the console failure against a live server. The 0.999 trust figure was derived, not observed.
• Still open as limitations (NOE-L-014 to 021): look-alike folding is a small table; fact trust remains authority-derived; skill validation measures trigger applicability, not outcome improvement; the emission allowlist is enforced by a test rather than types; no model in the loop.

Test plan

• python -m pytest -> 228 passed
• python benchmarks/harness.py -> 0/13, 0/8; agent path 0/8 (control 6/8)
• examples/quickstart.py runs end to end
• tests/test_failure_ledger.py contract tests pass (45 entries, 21 limitations)

Evidence: evidence/second-party-review-2026-09-19.md (review, verbatim, with pre-repair verification) and evidence/variant-hunt-2026-09-21.md (method, emission table, negative controls).

🤖 Generated with Claude Code

Update: faith is a static damper with a tamper tripwire (NOE-F-046)

Design review by the repository owner showed that the repair for the review's "faith is decorative" finding was wrong. Faith is not something a node earns; it is a system-set damper on grief intake that holds the system a controlled distance from a cascade. Making it earnable let relief be bought with signals an agent can influence.

• TrustGate.faith_for() is the only source of faith (operator base_faith; guardrails 0.92). The stored value is never used for relief.
• The earn/lose logic is deleted. Nothing a session does moves faith, so any stored value that differs, higher or lower, is tampering.
• GriefCascade._faith_tripwire force-purges a tampered node through the normal cascade path (no faith resistance, no seppuku criteria), notifies its dependents, and logs to tamper_log. Sacred nodes are logged and left in place.
• GriefCascade.cusp() is a read-only readout of distance from a cascade; the benign benchmark reports it. Today it reads 0.900, so the operating point is untuned (NOE-L-023).
• NOE-F-035 keeps its entry and gains a history event pointing at NOE-F-046; the ledger only appends.

Tests: 241 passing. Negative controls: grief_cascade reverted -> 9 fail, trust_gate reverted -> 15 fail.

Update: first cloud ultrareview (NOE-F-047 to 049)

The ultrareview of this PR returned two findings, both labeled pre-existing in master and both verified against source before any change:

1. Replacing a published node dropped its identity and dependency edges, and a replacement that policy quarantined overwrote the published value. Edge inheritance was coupled to contradiction handling; it now lives in write() for every replacement, and a replacement that would be quarantined is refused so the published memory survives. (NOE-F-047)
2. promote_skill reported success when write() stored a candidate. write() returns True for "stored" as well as "published". promote_skill now refuses up front for an identity without publish_memory and verifies the skill is retrievable afterwards; process_patterns and end_session no longer ignore refused writes. (NOE-F-048)

Hunting those classes found a third route, confirmed by probe before repair: republishing an identical value reset grief to 0 (laundering the circuit breaker), and republishing a purged key revived it as ACTIVE. Both are fixed (NOE-F-049).

Tests: 257 passing. Each changed module reverted alone fails its tests (store 13, forge 3, gateway 1). The report is preserved as received in evidence/ultrareview-1-2026-09-21.md; it is classed first-party because the reviewer's independence is not established.

Update: write() can no longer be misread as "published" (NOE-F-050, resolves NOE-L-024)

MemoryStore.write() returned (True, reason) both for a node that went ACTIVE and for one held as a candidate or quarantined. That ambiguity caused the promote_skill defect (NOE-F-048); fixing the callers left the trap in the API.

• WriteResult carries an explicit outcome (PUBLISHED, CANDIDATE, QUARANTINED, REFUSED) with .stored and .published.
• It has no truth value and cannot be unpacked, so if store.write(...) and ok, why = store.write(...) raise instead of guessing. A caller must say which they mean.
• A static guard scans the package for the mistake, so an untested branch cannot hide it. The guard is itself tested against each offending and each accepted form.
• This is a breaking change for anyone calling the write family directly: write, write_fact, write_episode, write_profile, write_project_state, and the gateway's learn_fact, set_profile, set_project_state. promote_candidate, release_quarantined and write_guardrail are unchanged (True there means the effect happened).

63 existing call sites converted. Tests: 276 passing. Reverting each changed module fails its tests.