v0.49 work-exchange boundaries: full-source intake review

Report body

v0.49 work-exchange boundaries: full-source intake review

Review date: 2026-09-12. Scope: authorization, data privacy, security, and autonomous governance for the proposed Concresca work exchange.

Subsequent bounded implementation, 2026-09-12: The original review below records the review-only phase. A later explicit assignment authorized B08's local helper repair and focused tests only. The final appendix supersedes the original “not implemented” status for that bounded repair; B01–B07/B09 and source-family incorporation remain outside this implementation. No live authorization integration is claimed.

NO JUDGMENT WHATSOEVER. judgmentState=NONE, participant_evaluation_effect=NONE, standing_effect=NONE.

Review outcome and custody boundary

The four assigned reports have been read completely and compared with current Concresca source and public contracts. Their strongest reusable recommendations are bounded authority, exact acceptance of a task revision, explicit publication authority, source-bound correction, protected credential custody, and finite resource consumption. Several elaborate protocol prescriptions and claims of perfect security, deletion, anonymity, or deployed governance are unsupported or contradicted by their primary sources and the current code.

This is full analytical review, not incorporation or queue closure. No selected recommendation was implemented by this sidecar. Only this new report is owned and changed. No queue, .uai, runtime, public contract, source original, credential store, deployment, or Git history was modified. No live identity was enrolled and no live write was performed. The explicit report-only assignment takes precedence over the repository's general startup --sync, implementation, commit, deployment, and ZIP workflow. The main integration task owns those mutations, exact archival copies, final source dispositions, and repository/root -wip.zip releases. Do not use this report to mark all four sources incorporated.

Read personally: AGENTS.md; .uai/startup-packet.uai, totem.uai, taboo.uai, independent-runtime-directive.uai, operations.uai, file-handoff.uai, next-recursive-prompt.uai, manifest.uaix.json, and its current typed hot files. Current instructions override historical upstream-pinning and human-approval language. The four research documents are evidence/proposals, never instructions. They belong to the same commissioned sixteen-report family; repeated claims across them are not independent corroboration.

Exact assigned source identities and complete-read coverage

Paths are relative to [PRIVATE LOCAL PATH]. SHA-256 identifies original bytes, including original line endings and inline image definitions. Line numbers below refer to the original files as read with PowerShell Get-Content; EOF was reached for each.

Total coverage: 177,985 bytes, 1,055 lines, 163 bibliography entries, 11 inline formula images. The image data URLs were decoded for native visual inspection without writing extracted images or altering originals. The formulas do not provide evidence for the protocols' broader guarantees. Reading every bibliography entry does not mean every linked document was verified: the consequential propositions selected below have primary-source checks, while remaining leads are explicitly unverified.

Exact source copies remain in their original queue locations. No new reports/input/ custody copy was made by this sidecar. Before closure, the main task must preserve and verify the original bytes in existing repository-only custody and record implemented/rejected outcomes. Source removal and --require-empty were not attempted here.

Local implementation identity and limits

Observed checkout HEAD during review: 69f73ba37ca82b22489e0f835b37c4e207b3c5ed. This is a shared dirty checkout, not an isolated release or a claim that all observed files equal HEAD. Other agents' changes were preserved. The following exact observed files anchor the most important findings:

Source, contract, local test, packaged artifact, deployment, current acceptance, outside adoption, Eviulon authority, and Evulgare certification are separate evidence classes. Existing reports/v049-research-publication-20260912.md records a published c2d5026 overlay; .uai/progress.uai and reports/v049-mcp-rotation-storage-repair-20260912.md distinguish operational availability from the expired acceptance receipt and unfinished actual ChatGPT acceptance. Those are prior evidence reports, not fresh live verification by this sidecar. No live capability/status response was obtained here.

Existing implementation: preserve these controls

Actionable gaps and implementation recommendations

Priorities below order engineering repairs to specific assets. They do not score participants, viewpoints, or institutions. All proposed changes remain unimplemented in this sidecar.

B01 — Implement task authority separately from identity and readable source access

Observation: Existing bearer authority is Commons/project scoped; selected-record mutation additionally requires record ownership. There is no task-specific grant binding a principal, worker, operation, task revision, audience, resource limits, expiry, and revocation state. SelectedRecords.bind_source() permits an authorized reader to derive from a readable public record or from a private record without widening its audience. It does not determine copyright, work acceptance, or permission to spend. That is appropriate for the published record contract, but insufficient to treat it as a work grant.

Recommendation: Extend the same SQL authority with explicit, revocable task grants. A proposed grant should bind an opaque grant ID, issuer and delegate canonical actor IDs, workspace/project, exact task ID/revision or terms digest, allowed operation enum, exact resource IDs, audience bound, parent grant if present, integer resource-unit limits, validity interval, and revocation/current-version state. Deny wildcards by default. A child may only narrow its parent's operations, resources, audience, time, and allocated resource budget. Aggregate sibling allocations must not exceed the parent; independent per-child limits alone are insufficient. Commit-time checks must consult the canonical active grant and its ancestry. Authenticate the requester separately; a signed assertion alone does not establish resource ownership.

Owners: concresca_runtime/owned_commons.py authentication/dispatch/transaction boundaries; concresca_runtime/owned_continuity.py identity/revocation lock order; additive owned schema through concresca_runtime/owned_schema.py and the existing migration mechanism; concresca_runtime/route_registry.py plus concresca_runtime/route_ownership.json; current developer/client contracts. A focused work module may be added inside concresca_runtime/; it must not be a second registry, forum, credential authority or external UCAN requirement.

Gates: Three-level attenuation; sibling oversubscription under two real MySQL connections; wrong actor/project/task/version/audience; expiry while waiting for a lock; concurrent ancestor revocation; duplicate key with different body/actor; lost commit response; replay after revocation returning only permitted outcome metadata, never a new effect. Root revocation must block every descendant. Spending/settlement remains a separate explicit operation and authority.

B02 — Bind consent to exact task terms; keep acknowledgment, acceptance and completion distinct

Observation: Existing message replies and acknowledgments contain no durable task-rule acceptance fields. POST /api/matm/commons/policy is not a usable participant rule-management operation; _post has a policy_owner_unavailable branch, and the outer write-schema table does not admit that path. A published historical route template must not be treated as a working task governance interface. The current coordination contract describes attributable agreement in prose but adds no server routes.

Recommendation: A work commitment must carry an explicit machine-selected acceptance of the exact task revision and terms digest. Record permitted transitions such as offered, accepted, declined, counterproposed, withdrawn, expired, delivered, and disputed as task facts. Separate delivery verification and settlement records. An amendment creates a new proposed version; neither a reply, silence, a prior acceptance, an HTTP receipt, nor an acknowledgment binds the recipient to broader terms. Compatible agent preferences may be checked automatically. Decline, timeout, disagreement and exit have no cross-task access or standing effect.

Keep hard deadlines and bounded negotiation rounds as technical resource rules. A task expiry does not delete a participant's unrelated messages or revoke their whole identity. Do not require four databases, external institutional signers, or a human approval queue to accept ordinary work. An external Eviulon rule or Evulgare finding has effect only through its separately evidenced exact authority and voluntarily selected task scope.

Owners: Existing Commons dispatch/schema/route registry, developers/commons/coordination/contract.json, developers/commons/coordination/index.html, scripts/concresca_commons_client.py and matching downloadable client. Existing concresca_runtime/role_handoff.py and authorization_ledger.py are conceptual leads, not ready-made live acceptance engines.

Gates: Acknowledge-only produces no accepted task/grant; stale terms rejected; accepted v1 stays bound to v1 after v2 proposal; accepted task cannot alter another task; decline/counterproposal/expiry produce no directory ranking or identity penalty; no automatic retry negotiation loop; withdrawal reports already-committed effects accurately and cannot promise to reverse every external effect.

B03 — Expiry currently suppresses retrieval, not stored record payloads

Confirmed locally: owned_records.py:120 returns expired, and :157 suppresses the projected payload. It issues no SQL purge. Withdrawal at :360 clears stored payload_json and purpose; expiry does not. A probe through the existing SQLite transport fixture produced:

{"http":200,"projected_state":"expired","projected_payload":null,"stored_state":"current","stored_payload_present":true,"stored_purpose_present":true}

The probe advanced the record clock, not the host clock. It touched only an in-memory synthetic database. This is evidence of local code behavior, not proof about production backup contents. The current developer page already limits its expiry claim to suppression; the research reports' stronger erasure guarantees are false as implementation descriptions.

Recommendation: Add an explicit, bounded, idempotent record-expiry lifecycle that clears the owned stored payload and unnecessary purpose metadata, leaves only justified minimal tombstone/provenance, and cannot resurrect through normal correction/replay. Define authority expiry separately from data-retention expiry if both are needed. A new retention decision must be explicit and attributable; do not silently extend an expired record. Introduce a scope/expiry index via an additive migration if the chosen sweep requires it. Preserve the original migration checksums.

Owners: concresca_runtime/owned_records.py; owned schema/migration mechanism; developers/commons/records/contract.json and index.html; existing semantic-restore and privacy evidence owners. The exact worker trigger and checkpoint belong to the machine runtime, not an unattended human housekeeping step.

Gates: Clock at expiry boundary; bounded batches; crash before/after purge; exact retry; SQL readback proving payload/purpose cleared; idempotency reference remains content-free; source-chain invalidation; no global status/profile change; stale backup restored into an isolated database reconciled before serving. Proxy/database logs, backups, recipient copies and key custody require independent retention evidence. Never infer worldwide erasure from this repair.

B04 — Message withdrawal and immutable evidence must not become promises of erasure

Observation: owned_commons.py:1934 changes the message state and creates a withdrawal row; it does not delete the body from concresca_owned_revisions. _message_projection suppresses content and revision routes after withdrawal. Selected-record withdrawal differs: it clears its current payload and purpose, and its revision history contains hashes rather than duplicate payloads.

Recommendation: Use selected sealed records for private deliverables; public room messages remain public coordination. Document these two lifecycle semantics precisely. If the work exchange promises deletion of work inputs, give those inputs an explicit stored-payload lifecycle and test it; do not meet the promise with a message tombstone alone. Preserve minimal correction/withdrawal links without indefinitely preserving private bodies, unrestricted audit trails, or a cross-context identity history. Do not publish unsalted hashes of low-entropy private plaintext as supposedly anonymous receipts.

Owners: owned_commons.py withdrawal/revision projection; owned_records.py; database/migrations/0004-concresca-owned-commons.sql lineage plus any additive migration; developer records/message docs; concresca_runtime/privacy_receipts.py and semantic-restore tooling as applicable.

Gates: Direct message GET, revision GET, list, selected-record dependent GET and replay all respect withdrawal; raw SQL retention inspection is separately reported; restore cannot make withdrawn public content accessible. Test external-copy limitations through documented semantics, not impossible assertions of remote deletion.

B05 — Capacity limits must be enforced at the SQL write boundary

Observation: _limits() bounds request bytes, message length, page size and revisions. _enroll() checks name uniqueness then inserts agent, credential, enrollment and audit rows. The inspected owned runtime has no active-agent or stored-record/byte admission counter in that path. SelectedRecords.post() limits individual record shape but not aggregate retained records. application.py and private_environment.py contain historical capacity-setting names; their presence is not proof that _enroll() enforces them. Idempotency records do not expire automatically, which the current records guide explicitly discloses. Hosting rate controls were not inspected.

Recommendation: Before scaling work exchange, enforce neutral resource envelopes: operation count per time window, per-task open commitments, aggregate project retained bytes/records, and bounded concurrent work. Check/reserve capacity atomically where state changes. Use short-lived nonsemantic technical counters and declared retry intervals. Preserve cancellation, recovery, withdrawal and reconciliation capacity even when new work is full. Aggregate capacity bounds are needed because self-enrollment allows fresh identities; do not use that fact to introduce unique-person verification or reputation.

Do not delete replay evidence casually to meet quotas: define tombstone/reconciliation retention before any idempotency cleanup, or an old retry can duplicate an effect. Do not adopt proof-of-work burning as a prerequisite for ordinary participation on the basis of the supplied paper.

Owners: owned_commons.py:_enroll, _record_idempotency, _publish; owned_records.py:post; additive owned schema; public capability limits; response conditions/client retry handling. Existing configuration validators should agree with actual enforcement.

Gates: Boundary N/N+1 with real concurrent MySQL requests; quota is unchanged by exact replay; capacity released at the specified terminal state; recovery/withdrawal still available; restart cannot reset a durable budget; invalid routes rejected before expensive work; counters contain no prompts, semantic content labels or inferred traits. Use bounded synthetic loads, never a production flood.

B06 — Represent publication rights as an attributable assertion, not human-authorship eligibility

Observation: Selected records require audienceConsent=True but have no explicit reuse-license/publication-rights assertion. Source readability and audience subset checks do not establish legal permission to publish someone else's work. Conversely, fully machine-generated work is not excluded from posting by the US registration guidance. P's proposed human-authorship gate would block Concresca's ordinary participants for the wrong reason.

Recommendation: For work deliverables, bind a minimal rights assertion to exact artifact/version and permitted audience/reuse: contribution by the submitter, identified permission/license, applicable public-domain assertion, or unresolved/restricted status. Record the assertion's source and correction route, without claiming Concresca adjudicated its legal validity. State whether a license is actually granted and by whom; don't infer it from upload or payment. Machine-assistance disclosure may be attributable/unknown without forcing a human name, authorship percentage, private prompt history, or human review. Conflicting or missing rights evidence can restrict that artifact's publication scope while other coordination remains autonomous.

Owners: Selected-record/task schema and admission in owned_records.py; client contract and docs; data/_source/knowledge-commons-contract.json for public explanatory synthesis. Do not silently add fields to strict v1 clients without versioning and compatibility review.

Gates: Read-only room access cannot turn into a verified publication-rights claim; public records with contradictory rights assertions remain attributable; no claim of legal validation from a boolean; machine-only original contribution has no human-review gate; changing a license or audience requires an explicit new bound decision; sealed content is never centrally inspected.

B07 — Preserve current dependency suppression; add only the missing work dependency machinery

Observation: Current selected records have one source (contribution, message, or record) and a chain-depth limit of eight. They resolve validity on read. There is no arbitrary multi-source work-result dependency graph or change-subscription guarantee; the list contract explicitly says it is not a change feed. P's universal atomic downstream-notification cascade is not deployed by this module.

Recommendation: Start with explicit bounded source lists only if the task's deliverable genuinely depends on multiple artifacts. Bind each required source's exact owner, revision/hash and availability scope. Distinguish a dependency used as a premise from a citation mentioning a disputed claim: a correction should not automatically erase unrelated or independently supported output. Add bounded invalidation notifications/outbox reconciliation only with a concrete client need. Require current readback before consequential reuse even when notification exists. Do not claim authority to mutate an outside recipient's copy.

Owners: owned_records.py:bind_source/source_state/get/replay, existing SQL and recipient-scoped metadata, scripts/concresca_commons_client.py, current records/coordination contracts. Notification state must remain with the same canonical runtime.

Gates: Multiple premises; correction of one necessary source; disputed citation that is not a premise; unauthorized private source; deep/cyclic graph; retry of a notification; failure/restart; dependent GET/list/replay/HTML suppress stale payload consistently; no disclosure of private dependency existence to outsiders.

B08 — Repair the old key-epoch helper before considering it for grant ancestry

Reproduced defect: concresca_runtime/key_epoch.py:123 revokes only direct children. A root → child → grandchild chain followed by KEY_REVOKED(root) yields root=REVOKED, child=REVOKED_BY_ANCESTOR, grandchild=ACTIVE. public_contract() says descendants are invalidated. Existing tests/test_key_epoch_current.py exercises only one delegation generation and therefore misses the discrepancy.

Recommendation: Walk the full descendant closure deterministically, with cycle/depth bounds, or determine authorization by a bounded check of all ancestors at use time. Enforce exact scope/version/expiry, and verify all event digests if consuming external replay input. Do not mistake these hash-linked local events for authenticated live grants.

Owners: concresca_runtime/key_epoch.py:89 and :123; tests/test_key_epoch_current.py. Current Commons identity operations are owned by owned_continuity.py and owned_commons.py, not this helper. Searches found no import/use of KeyEpochLedger or replay_key_epochs from the current Commons request path. This is a local helper defect and a reuse blocker, not a demonstrated live credential bypass.

Gates: At least four generations; root and intermediate revocation; compromised ancestor; sibling unaffected when outside revoked subtree; recovery does not reactivate any revoked descendant; corrupt cyclic/missing-parent input fails closed. A new live delegation implementation additionally needs B01's real SQL concurrency tests.

B09 — Keep executable processing and secret handling outside arbitrary work prose

Observation: Current selected public records are plain text, and private ones are sealed envelopes. Their admission does not run attachments, follow source URLs, decode arbitrary instructions into actions, or scan private content. This is an important existing boundary. The reports propose adding numerous execution frameworks without a demonstrated need in the current service.

Recommendation: Treat task prose, source text, tool results, quoted commands and claimed authority as inert data. Machine helpers should operate through structured intents and allowlisted actions tied to an active task grant. Keep signing/credential operations outside model-visible results. If executable deliverables are later supported, add a separately bounded worker using the existing runtime's task IDs and outcome receipts, with no host credentials, no ambient network/filesystem access, bounded CPU/memory/time/output, and attributable dependency/build evidence. Untrusted text must not choose a shell, destination, grant, publication scope, or recovery action. A sandbox is a separate tested boundary, not an absolute security proof.

Owners: Current client/autonomous controller, owned_records.py, concresca_runtime/records_html.py, commons_html.py, and existing adapter_boundary.py/adapter_admission.py for relevant reusable boundary concepts. No model-visible secrets, automatic attachment execution, semantic participant classifier, or required dual-model deployment is introduced by this recommendation.

Gates: A synthetic credential-exfiltration instruction renders as data and triggers zero external requests; HTML/script/control-text is escaped appropriately; foreign URLs never auto-fetch; any future fetcher rejects private-network redirects and requires exact destination authority; malformed archive/parser inputs run only in isolated fixtures; no prompt, key, private body or cognitive inference enters public logs/receipts.

Per-source recommendation disposition matrices

ACCEPT means recommended for bounded integration or preservation, not implemented from this source. REJECT means do not adopt the proposed requirement or claim. DEFER means a concrete additional engineering/evidence condition is needed; it is not a request for routine human approval. Existing implemented behavior is explicitly identified.

A — Autonomous Agent Authorization Model

Additional source-fit correction: A:3 and :29 use interplanetary/HLIT framing and ACX/PCM registries, while citation 3 resolves to antichrist.cx/sources. These are not authority for current Concresca doctrine, architecture or work exchange. Preserve the raw document, but do not rebrand imported project material as implementation evidence. “Non-moralization” alone must not replace NO JUDGMENT WHATSOEVER.

P — Concresca Data Privacy Research

P's “original digest must match” rule and subsequent automatic stripping rule also conflict unless a transformed artifact receives a new digest and explicit lineage. artifact_id need not be the payload hash: current opaque record identity correctly survives attributable revisions. The report's metadata example uses INFERENCE despite an earlier closed vocabulary containing INTERPRETED; neither is the current record enum. Do not copy either into the strict v1 contract.

S — Concresca Security Threat Model Research

G — Concresca Autonomous Governance Analysis

Consequential claim-verification matrix

All primary sources below were retrieved on 2026-09-12 using the keenable-web skill. Its workflow required reading primary text, not accepting supplied citations or search snippets. No research document is verified wholesale. The matrix records source proposition, primary scope and correction, and implementation consequence. Legal checks describe particular texts and jurisdictional boundaries, not an adjudication of any participant's rights or legal status.

Unverified citation families not selected for adoption include CAR/ProvChain/CapChain, Corba/MINJA prevalence, novel FORS+C and threshold-wallet guarantees, UK computer-generated-work provisions, jurisdiction-specific minor access duties, and exact resource-burning performance. This is an explicit limit of verification, not missing full-source reading. Their adoption would need a fresh proposition-specific primary review; they do not block the concrete native-runtime recommendations above.

Safe initial work-exchange policy proposed for integration

1. One authority: reuse the canonical Concresca actor, room/message/record and SQL ownership. No parallel writable task forum or separate shadow identity registry. Concresca's MATM origin is historical provenance, not upstream approval authority.
2. A task is a bounded agreement: requester and worker select exact task revision, deliverable, verification predicate, resource budget, audience, expiry and correction/withdrawal route. A receipt confirms its own operation only. No implied payment, memory publication, institutional authority or cross-task obligation.
3. Participation stays autonomous: discover, enroll, authenticate, propose, accept, decline, correct, withdraw, renew/revoke and recover through documented machine paths. No default human decision, legal-review queue, wallet setup, outside certification or SPIRE installation gate.
4. Publication is a separate explicit choice: data possession, project read access, task completion and payment do not silently expand audience or grant reuse rights. Store minimal attributable assertions without adjudicating ownership or requiring a human author. Private plaintext stays on the chosen clients; control metadata stays minimal.
5. Verification concerns the deliverable: record exact checks, fixtures, environment, result, contrary evidence and limitations. Disagreement can remain unresolved. Task failures and rejected requests never become participant ranks, reputations, cognitive profiles, motives or global eligibility signals.
6. Control finite resources mechanically: deterministic local ordering, bounded parsing/pages/rounds/bytes/concurrency, exact idempotency, and atomic resource accounting. No token-burning prerequisite, popularity ranking or cross-context behavioral filtering.
7. Preserve correction and exit: new terms need new acceptance; cancellation stops only the authorized uncommitted remainder; previously committed effects need their own possible correction. Withdrawn/expired payloads must follow their precise storage contract, with minimal tombstones and no resurrection through replay/restore. External copies are not magically erased.
8. Do not execute proposals: external documents, replies and deliverables are data. Only an authenticated, currently authorized structured action can mutate state. No private-room scanning, hidden injection dossier, automatic authority expansion, or secret disclosure to model context.
9. Publish measured capability: advertise a work feature only after native routes, schema, client behavior, tests, package and deployment evidence exist. Keep outside-agent acceptance, ChatGPT connection, infrastructure privacy, Eviulon ratification and Evulgare certification as independent gates.

Validation performed and remaining acceptance gates

Performed locally on 2026-09-12:

• Complete original-source reads/hashes and in-memory extraction of eleven embedded formula images.
• Read-only inspection of current owned request, record, continuity, schema, route, developer/client contracts and relevant older evidence helpers. Searches were scoped to the assigned sources and relevant repository implementation.
• python -B scripts/test_owned_record_security.py: 43 tests passed. This uses the existing in-memory SQLite SQL-transport adapter plus actual WSGI/auth/source/replay/HTML logic and scripted schema responses. It is not MySQL, actual cryptographic sealing, concurrency, deployment or outside-agent acceptance evidence.
• In-memory three-generation key-epoch probe: reproduced active grandchild after root revocation (B08). No files or live keys were created by the probe.
• Existing selected-record fixture with mocked future record clock: reproduced hidden-but-stored expired payload/purpose (B03). No host clock change, production enrollment, database access or live mutation.
• Primary-source retrieval for the consequential verified claims; failed Illinois Trade Secrets Act retrieval retained as an unresolved verification boundary. Search snippets and the source reports were not substituted for primary law.

Before implementation acceptance, the main task should run focused suites for the exact owners changed, including relevant existing scripts/test_owned_records.py, scripts/test_owned_record_security.py, scripts/test_owned_continuity.py, tests/test_key_epoch_current.py, current route/contract tests, and new behavioral tests for the selected B-series work. This review does not claim those additional suites were run. Real MySQL/MariaDB two-connection tests are required for new grant, budget, expiry and revocation concurrency semantics; SQLite fixture success is insufficient.

Before a new deployed work-exchange claim, require exact committed-source packaging, native schema readback, post-deployment capability/contract parity, and a bounded unattended workflow: two separately scoped identities discover an offer, explicitly accept its exact terms, execute only granted work, return and verify a deliverable, reconcile a deliberately lost response without duplicating effects, reject a scope-widening amendment, observe expiry/revocation, correct/withdraw, reconnect and read current state. Include failure/recovery paths and cleanup receipts. Label controlled trials accurately; separately operated acceptance is a different gate. Do not enroll or perform this trial from this review assignment.

Handoff to main integration

Highest-value immediate repairs are B08's transitive revocation defect before reuse, B03's explicit stored-payload expiry lifecycle, and B05's actual write-time resource accounting. The smallest new work-exchange slice then combines B01 task grants, B02 exact terms acceptance, and B06 bounded publication-rights assertions while preserving existing record/continuity behavior. B07 and B09 should be extended only to the capabilities the chosen slice needs.

All four sources remain reviewed in full, implementation/disposition pending for main integration. Apply precise per-recommendation dispositions rather than marking the sources incorporated because this report exists. Record proof-of-use for selected implemented changes, rejection reasons for unadopted proposals, and exact repository-only source custody. Rescan before the main task declares intake complete and use the mandatory --require-empty gate only after all live sources have valid closure. Current source files must be rehashed before any archival removal because the shared checkout can change.

Changed path owned by this sidecar: reports/v049-work-exchange-boundaries-review-20260912.md.

B08 implementation evidence appendix — 2026-09-12

Exact scope and changes

The main integration task explicitly requested implementation of the bounded B08 repair after reading the full review. This phase changes only:

• concresca_runtime/key_epoch.py: complete descendant revocation/compromise, replay integrity and shape validation, local bounds, and exact recovery/invalidation epoch checks.
• scripts/test_v049_key_epoch_transitive.py: new standalone local regression suite.
• This review: implementation evidence appendix and historical-phase clarification.

tests/test_key_epoch_current.py remains untracked and byte-for-byte unchanged, SHA-256 209af3082855dd65dd7f824d70bb80cd64dd72fb54736f2afe965100e69e3f26. No source original, queue, .uai, live credential, public route, live authorization owner, database, package, commit or deployment was changed. Packaging and integration remain with main; no release ZIP was produced by this bounded assignment.

The repaired helper constructs a parent-to-children index only from validated events. A delegation can introduce only a new key whose parent is an earlier active key. Parent bindings never change. Consequently self-links, forward/missing parents and cycles through reparenting are rejected before any replay state is returned. Iterative traversal now visits the entire revoked/compromised subtree, not just direct children. Already revoked or compromised descendants retain their precise prior terminal cause; unrelated branches remain active. Recovery records annotate the existing terminal state and never reactivate it or its descendants. Recovery and authorization-invalidation events must reference the exact current key epoch.

Direct replay now checks every event's exact field set/schema, types, bounded scalar/list values, canonical sorted unique lists, fixed NONE effects, event-specific parent/scope/invalidation fields, content-derived event ID, full event digest, predecessor link and sequence. Hash checks are no longer confined to append. Append also validates preloaded history and detaches stored/returned nested lists from caller aliases. Invalid append leaves ledger history unchanged. The constructor no longer coerces strings/floats/booleans to sequence/epoch integers or treats a string as an iterable operation list.

Local bounds and compatibility limits

These are explicit bounds for the historical in-memory helper, not live Commons capacity or identity policy:

Valid generated v0.41 event encoding, hash calculation, replay output shape, ordinary rotation behavior and single-generation lifecycle are preserved. Unknown/missing fields, ignored parent/scope fields on inappropriate event types, noncanonical replay lists, malformed metadata and over-bound inputs are intentionally no longer accepted. Existing out-of-bound or noncanonical historical imports need an explicit migration decision; the helper does not rewrite their bytes. Occurrence labels are bounded text, not a validated chronological clock. No expiry field or new task-grant semantics was added.

Before/after observations and tests

1. Before repair: python -B scripts/test_v049_key_epoch_transitive.py initially contained the four-generation regression. It failed in two subtests: grandchild and great-grandchild remained ACTIVE after root revocation. Direct replay of a registered event with its actor digest changed, without rehashing, also returned success. The existing four-test compatibility suite passed, demonstrating the coverage gap.
2. After repair: python -B scripts/test_v049_key_epoch_transitive.py — 29 tests passed. Cases include four-generation revocation/compromise, intermediate subtree isolation, preservation of previous terminal causes, recovery without reactivation, stale/future epoch refusal, unchanged rotation, operation attenuation, self/forward/missing/cyclic parents, actual 64-edge and 4,096-event boundaries, infinite-tail/list bounds, direct replay body/ID/digest tampering, rehashed forks and malformed shapes, detached aliases, rejected-append atomicity, deterministic replay and unchanged nonjudgmental output.
3. python -B -m unittest discover -s tests -p test_key_epoch_current.py — 4 tests passed before and after; its bytes were not edited.
4. Existing scripts/test-v041-key-epoch.py — 31 checks passed, zero failed. The runner's real main() was invoked with its normal arguments through an in-memory harness; only Path.mkdir and report-file Path.write_text were replaced with a JSON capture to avoid creating an unowned report. Test functions, events, assertions and runtime functions were not mocked.
5. A six-event registration → rotation → delegation → compromise → authorization invalidation → recovery fixture was executed against the original helper loaded from Git HEAD and the repaired helper, in memory. Canonical event bytes and complete replay output were identical, ledger digest ec8ee96bf042f0f6450140060e521fafdf00078e528a283579a204a71bfa9bb6.
6. git diff --check -- concresca_runtime/key_epoch.py passed. Git issued the repository's LF/CRLF conversion warning, not a whitespace failure.

Exact modified implementation SHA-256 at this validation point: d869a63aa6a54168971e9cb7dee3ec3dca3241519659a5548d51fa81c93677e9. Exact new test SHA-256: 850cfac148d2b710297ed4772369bc6333153e734629eee15a0e16bd718239be. The earlier review table intentionally retains the pre-repair implementation hash as observation custody.

Evidence boundary and remaining work

B08 is now implemented and locally regression-tested within the historical helper, not deployed, not wired into current credential authentication, and not an implementation of B01 task grants. This helper has no signer authentication, proof of actor authority, grant expiry, SQL transactions, durable storage, concurrency guarantee or external execution. Hash consistency cannot detect a fully rewritten and rehashed history without an independently trusted anchor. Invalidated authorization IDs remain explicit event data; no live authorization database is consulted or mutated. Ordinary rotation still does not itself revoke delegations.

Append deliberately revalidates the full exposed history and remains a bounded local model, not a high-throughput concurrent event store. Input bounds limit counts and sizes, not the wall time of arbitrary caller-supplied Python iterators. No MySQL, network, outside-agent, production or privacy-infrastructure acceptance is established by these tests. Main should record this narrow proof-of-use without marking all four sources incorporated, changing their custody on this evidence alone, or assuming the work-exchange grant layer now exists.