feat(step7): the merge order becomes a predicate on the target tree

[PhysShell]

Stacked on #356. The last structural piece before #263-B: the merge order stops being an agreement and becomes a predicate on the target tree.

The problem this closes

The frozen T0 (#354, 30d2f32) names an accepted harness identity — 104c384d01bf — that arrives with the memory-semantics repair in #355. On the T0 branch alone, perf_baseline.py is still the pre-repair version and hashes to 562a7f7232da. Nothing is wrong with the contract: it describes the state of the merged history. What is wrong is that the order holding it together lives in a conversation, and an order held by agreement is one stray Merge click from becoming an archaeological artifact — a document saying FROZEN in a tree where its referent does not exist.

What the first revision got wrong

Two defects, both found by the owner against the live PR rather than by these controls, and both of the same shape: the gate read descriptions of enforcement instead of enforcement.

• step7_machinery_present asked whether the two tool files existed and whether certain identifiers appeared in them. A file containing def check_campaign_link(): pass satisfies that — and the fixture meant to exclude that world was precisely that file. The control demonstrated the false positive it existed to prevent.
• steps_4_5_6_rebound searched each artifact's text for the digest. The right digest anywhere in the file — a comment, a history entry, a field nobody binds — was read as a binding.

Neither was a slip in a corner. A gate that checks for the name of a mechanism licenses exactly the tree it was built to refuse.

What the gate checks now

Against the commit a merge would produce, never against PR numbers. A number proves someone pressed a button; it says nothing about what the merged tree contains.

t0_frozen_and_authorized   T0 declares FROZEN *and* collection_authorized: true
t0_names_a_digest          it names an accepted harness identity
instrument_matches_t0      that digest, recomputed from THIS tree's instrument
                           sources by the frozen formula, matches
steps_4_5_6_rebound        each artifact binds that digest at the exact path it
                           actually binds at — see below
step7_machinery_enforces   the target tree's own tools are executed and must
                           refuse four attacks — see below
t0_zero_prerequisite       the step-7 note still revokes the automatic collection
                           authority, so hosts plus a binding cannot again start a clock

Exit 0 only when all hold; exit 1 on any refusal. A refusal means the frozen contract would become reachable from a tree that cannot satisfy it, and the merge is refused however mergeable the forge believes it to be.

The binding is read at one path per artifact, and only there

artifact	the one field that binds
p022-263a-policy-freeze.json	measurement_harness_digest
p022-263a-design-constants.json	bound_measurement_harness_digest
p022-263a-training-preregistration.json	bindings.measurement_harness_digest

Anywhere else is not a binding. The refusal names the path and both digests: p022-263a-policy-freeze.json: measurement_harness_digest is 562a7f7232da, not 104c384d01bf.

The machinery is run, not recognised

step7_machinery_enforces extracts hostqual.py and execbinding.py from the target commit, runs them in a subprocess against a synthetic campaign, and drives them through the whole authority table and the whole campaign path — negative and positive, because a refusal is only evidence if acceptance was possible.

state	hostqual.bind_t0	execbinding.t0_at
FROZEN + false	must refuse	must refuse
NOT_FROZEN + true	must refuse	must refuse
NOT_FROZEN + false	must refuse	must refuse
FROZEN + true	must accept	must accept

Then, on the campaign:

1. a correct link must be accepted; one naming a different execution binding must be refused; and the same correct link must be refused once the freeze is edited underneath it;
2. an unchanged campaign must survive session_eligibility → session_admissibility;
3. the same preflight with a swapped campaign must be inadmissible, and by a reason that names the campaign link — not merely by some reason.

Step 2 is what stops the witness reading "nothing is admissible" as "the swap was caught". A tool that fails any of this fails the gate, and the refusal says what happened — hostqual accepted NOT_FROZEN+false, or the swapped campaign was refused, but by no reason naming the campaign link.

The digest is not hard-coded. It is read out of the frozen T0 and recomputed from the target tree, and a control proves no 64-hex literal exists in the gate's own source — a gate trusting its own constant would be checking itself.

Controls

Fixtures now ship the real tools; each attack control mutates exactly one enforcement point and requires the gate to notice. A mutation that changes no bytes raises, rather than passing quietly as a second positive control nobody reads as one.

noop_campaign_link_function        -> REFUSED   check_campaign_link stubbed permissive
dead_authority_check               -> REFUSED   hostqual.bind_t0 always authorised
dead_authority_check (execbinding) -> REFUSED   execbinding.t0_at never raises
dead_postflight_continuity         -> REFUSED   only the preflight/current campaign-link
                                                comparison removed, check_campaign_link intact
always_inadmissible                -> REFUSED   a postflight that refuses every campaign
digest_only_in_decoy_field         -> REFUSED   stale binding, right digest in a decoy field
exact_binding_fields_correct       -> allowed

The last two mutations are the sensitivity proof for the campaign witness: one shows the negative half is specific to continuity, the other shows the positive half is load-bearing.

merge gate controls: 15 passed, 0 failed, including control-inventory-complete (the documented list and the executed set are the same set).

Exercised against real merges, not only fixtures

probe	exit	result
full chain #355 → #356 → #353 → #354 (270e3c1)	0	allowed: the merged tree's own tools walked the whole authority table on both readers and the whole campaign path, accepting what must be accepted and refusing what must be refused
#354 alone (8c87118)	1	refused, three predicates: instrument hashes to 562a7f7232da, all three bindings stale, machinery absent
#355 + #354, no machinery (2e1a6c7)	1	refused, one predicate

T0-0 needs no predicate of its own: #353 is an ancestor of the freeze commit, so it cannot be skipped.

Known limits

The witness proves behavioural compatibility at the named enforcement points, not byte identity: hostqual.py and execbinding.py are deliberately not pinned by SHA, so a comment or a diagnostic can be fixed without turning the gate into a museum alarm. It is also not a complete threat model — it proves these attacks are refused, not that no other attack exists.

The gate is a script, not yet a required check. Branch protection on this repository has no ruleset, so nothing currently prevents a merge that this gate refuses. Wiring mergegate.py as a required status check is an owner act and is not part of this PR.

Scope

scripts/step7/mergegate.py and its controls only. No instrument change, no digest movement, and #354 is untouched — 30d2f32 is terminal and is not to be amended, rebased or force-pushed.

Regression on this host: step-7 qualification 26/26, envcapture 11/11, perf instrument 16/16, calibration policy 10/10, calibration freeze 7/7, calibration constants 4/4, training preregistration 9/9. Four unrelated suites (byte_variants, repro_fixtures, cli_ownir_fixtures, checkpoint_status) fail identically on the frozen T0 branch — they need a built Rust engine and dotnet, which this host does not have.

🤖 Generated with Claude Code

https://claude.ai/code/session_018xhcg5opoFbSTdYHpkSXCh

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 569978fd-d662-4ef3-8d36-877da8239662

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}