\\n>

⌛ How to resolve this issue?

\\n> \\n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\\n> \\n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.\\n> \\n>

\\n> \\n> \\n>

\\n>

🚦 How do rate limits work?

\\n> \\n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.\\n> \\n> For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.\\n> \\n> Please see our [Fair Usage Limits Policy](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy) for further information.\\n> \\n>

\\n> \\n>

\\n>

ℹ️ Review info

\\n> \\n>

\\n>

⚙️ Run configuration

\\n> \\n> **Configuration used**: Path: .coderabbit.yaml\\n> \\n> **Review profile**: ASSERTIVE\\n> \\n> **Plan**: Pro\\n> \\n> **Run ID**: `78e6bd64-f639-4702-b413-ce4fbb3253b8`\\n> \\n>

\\n> \\n>

\\n>

📥 Commits

\\n> \\n> Reviewing files that changed from the base of the PR and between 9da73d6c9596c3f74add555aba8af978b5af3591 and ba972f6f64c72351d89eb1c7b7c3c480e538feb1.\\n> \\n>

\\n> \\n>

\\n>

📒 Files selected for processing (1)

\\n> \\n> * `crates/warp-core/tests/witness_public_api_tests.rs`\\n> \\n>

\\n> \\n>

\\n\\n\\n\\n\\n\\n

\\n

📝 Walkthrough

\\n\\n## Walkthrough\\n\\nImplements Goalposts 4 and 5 of the braids/strands hardening roadmap. Adds three new `warp-core` modules: `witness` (typed receipts, deterministic simulator backend), `sealed_membership` (disclosure budget, presentation vocabulary), and `plurality_law` (named law registry, machine-readable cards, authorization/obstruction). All types are re-exported from the crate root. `BraidShellReplay` and `BraidShellAudit` are extended with `law_ref`, `law_reading`, `witness_receipt`, and `disclosure_budget` fields wired through the replay/audit constructors. Policy validation rejects all-zero policy ids.\\n\\n## Changes\\n\\n**GP4 + GP5: Witness Receipts, Sealed Membership, and Named Plurality Laws**\\n\\n| Layer / File(s) | Summary |\\n|---|---|\\n| **Witness receipt types and deterministic simulator backend**
`crates/warp-core/src/witness.rs` | Defines `WitnessKind` with canonical tag, `WitnessAttestation` (IntegrityOnly/IndependentAttestation), `WitnessCompatibilityRule` (StableV1/E1Scaffold/migration), `WitnessReceipt` with self-witness validation (E1Scaffold + IntegrityOnly only) and deterministic digest, `WitnessRequest` with explicit and self_witness constructors, `WitnessRejectionCode`, `WitnessError` with typed variants, `WitnessBackend` trait, and `WitnessBackendSimulator` with fixture-driven `verify()`. |\\n| **Sealed membership presentation vocabulary**
`crates/warp-core/src/sealed_membership.rs` | Adds `DisclosureBudget` enum, `PresentationPurpose` with const fn accessors, `SealedMembershipPresentationError` with typed mismatch variants, and `SealedMembershipPresentation` bundling coordinate/authority/commitment/receipt/budget with fallible constructor validating witness subject/evidence digests. |\\n| **Named plurality law registry, cards, readings, and obstruction evidence**
`crates/warp-core/src/plurality_law.rs` | Introduces `PluralityLawName`, `PluralityLawFamily` (AdapterProvided with authority digest), `PluralityLawRef` validating non-all-zero name and non-zero version, machine-readable card components, `PluralityLawCard` with sorted+deduped vectors and canonical digest, `PluralityLawRegistry` with authorize() enforcing authority-domain digest matching, typed `PluralityLawObstruction`, and `PluralityLawReading` deriving evidence posture from witness receipt with disclosure-budget-tagged digest. |\\n| **Module declarations and public re-exports**
`crates/warp-core/src/lib.rs` | Declares `mod plurality_law`, `mod sealed_membership`, `mod witness` and adds `pub use` blocks exposing all new types at crate root. |\\n| **BraidShell policy validation**
`crates/warp-core/src/braid_shell.rs` | Adds `BraidShellError::EmptyPolicyId`; introduces `check_policy_id` and `check_collapse_policy_identity` helpers; wires validation into both `assemble_with_proof` and `validate`; rejects all-zero policy ids and ensures collapse policy matches shell policy id. |\\n| **BraidShellReplay/Audit struct extensions**
`crates/warp-core/src/braid_shell.rs` | Adds `law_ref: PluralityLawRef` to `BraidShellReplay`, `disclosure_budget: DisclosureBudget` to `BraidShellMemberAuditFact`, and `law_reading: PluralityLawReading` plus `witness_receipt: WitnessReceipt` to `BraidShellAudit`. |\\n| **BraidShell constructor logic**
`crates/warp-core/src/braid_shell.rs` | Updates `replay_braid_shell` to derive `law_ref` from policy; extends `audit_braid_shell` to construct `witness_receipt` via `self_witness`, derive `law_ref`, compute shell/member disclosure budgets (AuthorityScoped if any sealed member), and build `PluralityLawReading` with witness receipt. |\\n| **BraidShell tests**
`crates/warp-core/src/braid_shell.rs` | Updates replay/audit assertions to validate `law_ref`, `law_reading` (evidence posture, disclosure budget), `witness_receipt`; extends member facts with `disclosure_budget`; adds sealed-member test and empty-policy rejection test; verifies `Collapse` family in collapse scenarios; validates collapse-policy-identity mismatch rejection. |\\n| **Witness receipt public API tests**
`crates/warp-core/tests/witness_public_api_tests.rs` | Tests unsupported backend/compatibility/attestation errors, deterministic receipt generation and digest stability, rejection handling, E1Scaffold-only enforcement for self-witness, receipt digest binding to compatibility, and `SealedMembershipPresentation` field retention and witness subject validation. |\\n| **Plurality law public API tests**
`crates/warp-core/tests/plurality_law_public_api_tests.rs` | Tests registry registration and duplicate rejection, ref validation (EmptyName/ZeroVersion), reading digest binding to version, integrity-only evidence posture, witness subject mismatch rejection, adapter-provided law authorization with authority-domain matching, and unsupported law obstruction. |\\n| **Design documentation and roadmap**
`docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`, `goalpost-05-named-plurality-laws.md`, `braids-and-strands-roadmap.md`, `CHANGELOG.md` | Updates Goalpost 4 and 5 status to implemented with full Implementation Design sections covering receipt identity, witness backend boundary, sealed membership validation, law registry, reading digests, and BraidShellAudit/Replay linkage. Marks Goalpost 4 checklist complete; updates witness compatibility enum name; adds changelog entries. |\\n\\n## Sequence Diagram(s)\\n\\n```mermaid\\nsequenceDiagram\\n participant Caller\\n participant WitnessBackendSimulator\\n participant WitnessReceipt\\n participant PluralityLawReading\\n participant BraidShellAudit\\n\\n Caller->>WitnessBackendSimulator: verify(WitnessRequest::self_witness(subject, evidence))\\n WitnessBackendSimulator->>WitnessReceipt: self_witness(subject_digest, evidence_digest)\\n WitnessReceipt-->>WitnessBackendSimulator: receipt(IntegrityOnly, E1Scaffold)\\n WitnessBackendSimulator-->>Caller: Ok(WitnessReceipt)\\n\\n Caller->>PluralityLawReading: new(law_ref, shell_digest, witness_receipt, disclosure_budget)\\n Note over PluralityLawReading: infers EvidencePosture from WitnessKind::SelfWitness + IntegrityOnly\\n PluralityLawReading-->>Caller: reading with disclosure-budget-tagged digest\\n\\n Caller->>BraidShellAudit: audit_braid_shell(shell, witness_digest)\\n Note over BraidShellAudit: computes member DisclosureBudget (Public vs AuthorityScoped)
constructs WitnessReceipt::self_witness
builds PluralityLawReading\\n BraidShellAudit-->>Caller: BraidShellAudit { law_reading, witness_receipt, member_facts[disclosure_budget] }\\n```\\n\\n## Estimated code review effort\\n\\n🎯 4 (Complex) | ⏱️ ~60 minutes\\n\\n## Possibly related PRs\\n\\n- [flyingrobots/echo#551](https://github.com/flyingrobots/echo/pull/551): Directly extends the same `BraidShellAudit`/`audit_braid_shell` surface in `braid_shell.rs` that this PR builds on for GP4/GP5 law reading and witness receipt fields.\\n- [flyingrobots/echo#539](https://github.com/flyingrobots/echo/pull/539): Modifies `braid_shell.rs` around retained shell policy/policy-id handling that this PR extends with plurality-law and witness-receipt derivation.\\n- [flyingrobots/echo#545](https://github.com/flyingrobots/echo/pull/545): Modifies `BraidShellReplay`/`BraidShellAudit` data structures in `braid_shell.rs` that this PR extends with `law_ref`, `law_reading`, and `witness_receipt` fields.\\n\\n## Poem\\n\\n> 🧵 A braid gets audited, a law gets named,\\n> The receipt is hashed, the witness is framed.\\n> All-zero names? Rejected outright.\\n> `E1Scaffold` only—self-witness rite.\\n> The registry speaks in deterministic bytes,\\n> And no `StableV1` slips through the pipe. ⚙️\\n\\n

\\n\\n\\n\\n\\n

\\n

🚥 Pre-merge checks | ✅ 5

\\n\\n

\\n

✅ Passed checks (5 passed)

\\n\\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\\n\\n

\\n\\n\\n\\n\\n

\\n

✨ Finishing Touches

\\n\\n

\\n

🧪 Generate unit tests (beta)

\\n\\n- [ ] Create PR with unit tests\\n- [ ] Commit unit tests in branch `hardening/witness-receipts-sealed-capabilities`\\n\\n

\\n\\n

\\n\\n\\n\\n\\n---\\n\\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/echo&utm_content=552)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\\n\\n

\\n

❤️ Share

\\n\\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\\n\\n

\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\\n\\n\\n\\n\\n\\n\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Assert shell-level disclosure budget for sealed-member audits.**\\n\\nThis test checks `member_facts[0].disclosure_budget` but not `audit.law_reading.disclosure_budget()`. A regression in `shell_disclosure_budget(...)` would slip through.\\n\\n

\\n

Proposed test assertion

\\n\\n```diff\\n assert_eq!(\\n audit.member_facts[0].disclosure_budget,\\n DisclosureBudget::AuthorityScoped\\n );\\n+ assert_eq!(\\n+ audit.law_reading.disclosure_budget(),\\n+ DisclosureBudget::AuthorityScoped\\n+ );\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@crates/warp-core/src/braid_shell.rs` around lines 1716 - 1740, The test\\nreplay_audit_labels_sealed_member_disclosure_budget currently only asserts the\\nmember-level disclosure budget via audit.member_facts[0].disclosure_budget but\\nmissing validation of the shell-level disclosure budget. Add an assertion to\\ncheck audit.law_reading.disclosure_budget() to ensure the shell-level disclosure\\nbudget is validated and prevent regressions in shell_disclosure_budget function.\\nThe assertion should verify that the shell-level disclosure budget matches the\\nexpected DisclosureBudget value (likely DisclosureBudget::AuthorityScoped).\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commits 3390bb5 to aa04326\",\"path\":\"crates/warp-core/src/braid_shell.rs\",\"side\":\"RIGHT\",\"line\":1802}{\"type\":\"pull_request_comment\",\"body\":\"_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**`settlement_policy` bypasses `PluralityLawRef` validation invariants.**\\n\\nLine 148 directly constructs `PluralityLawRef` and skips the non-zero-name guard in Line 133. Passing an all-zero `policy_id` produces a ref that `new(...)` would reject, so constructor invariants are inconsistent.\\n\\n

\\n

Proposed fix

\\n\\n```diff\\n- pub const fn settlement_policy(policy_id: Hash) -> Self {\\n- Self {\\n- family: PluralityLawFamily::Settlement,\\n- name: PluralityLawName::from_bytes(policy_id),\\n- version: 1,\\n- }\\n+ pub fn settlement_policy(policy_id: Hash) -> Self {\\n+ Self::new(\\n+ PluralityLawFamily::Settlement,\\n+ PluralityLawName::from_bytes(policy_id),\\n+ 1,\\n+ )\\n+ .expect(\\\"settlement policy id must be non-zero\\\")\\n }\\n```\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@crates/warp-core/src/plurality_law.rs` around lines 148 - 154, The\\nsettlement_policy function directly constructs a PluralityLawRef struct instead\\nof using the proper constructor validation method, which bypasses the\\nnon-zero-name guard that exists in the new() constructor at line 133. This\\ncreates an inconsistency where settlement_policy can create invalid instances\\n(such as with an all-zero policy_id) that would be rejected by new(). Refactor\\nsettlement_policy to use the proper constructor validation logic instead of\\ndirectly constructing the struct, ensuring all invariants are consistently\\nenforced regardless of which function creates the PluralityLawRef.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commits 3390bb5 to aa04326\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🛠️ Refactor suggestion_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**Avoid per-digest temporary allocations in `hash_tag_vec`.**\\n\\nLine 661 allocates a `Vec` for every call, and `PluralityLawCard::digest` calls this helper three times (Lines 379, 386, 390). In `warp-core` deterministic paths, this is avoidable hot-path churn.\\n\\nAs per coding guidelines, `crates/warp-core/**`: “Performance matters — flag unnecessary allocations in hot paths.”\\n\\n\\n\\n\\n

\\n

Proposed fix

\\n\\n```diff\\n-fn hash_tag_vec(hasher: &mut Hasher, tags: impl Iterator) {\\n- let tags: Vec = tags.collect();\\n- hash_len(hasher, tags.len());\\n- hasher.update(&tags);\\n+fn hash_tag_vec(hasher: &mut Hasher, tags: impl ExactSizeIterator) {\\n+ hash_len(hasher, tags.len());\\n+ for tag in tags {\\n+ hasher.update(&[tag]);\\n+ }\\n }\\n```\\n

\\n\\n\\nAlso applies to: 660-664\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@crates/warp-core/src/plurality_law.rs` around lines 375 - 399, The digest\\nmethod of PluralityLawCard calls hash_tag_vec three times with self.requires,\\nself.emits, and self.conceals, and each call allocates a temporary Vec in\\nthe hash_tag_vec helper function. To eliminate these hot-path allocations,\\nrefactor the hash_tag_vec helper to accept a Hasher reference and update it\\ndirectly without creating intermediate Vec allocations, then modify all three\\ncalls in the digest method to pass the hasher and iterator directly to the\\nrefactored helper instead of having the helper create and return a Vec.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\\n\\n✅ Addressed in commits 3390bb5 to aa04326\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":420}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 3**\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn `@crates/warp-core/src/braid_shell.rs`:\\n- Around line 1716-1740: The test\\nreplay_audit_labels_sealed_member_disclosure_budget currently only asserts the\\nmember-level disclosure budget via audit.member_facts[0].disclosure_budget but\\nmissing validation of the shell-level disclosure budget. Add an assertion to\\ncheck audit.law_reading.disclosure_budget() to ensure the shell-level disclosure\\nbudget is validated and prevent regressions in shell_disclosure_budget function.\\nThe assertion should verify that the shell-level disclosure budget matches the\\nexpected DisclosureBudget value (likely DisclosureBudget::AuthorityScoped).\\n\\nIn `@crates/warp-core/src/plurality_law.rs`:\\n- Around line 375-399: The digest method of PluralityLawCard calls hash_tag_vec\\nthree times with self.requires, self.emits, and self.conceals, and each call\\nallocates a temporary Vec in the hash_tag_vec helper function. To eliminate\\nthese hot-path allocations, refactor the hash_tag_vec helper to accept a Hasher\\nreference and update it directly without creating intermediate Vec allocations,\\nthen modify all three calls in the digest method to pass the hasher and iterator\\ndirectly to the refactored helper instead of having the helper create and return\\na Vec.\\n- Around line 148-154: The settlement_policy function directly constructs a\\nPluralityLawRef struct instead of using the proper constructor validation\\nmethod, which bypasses the non-zero-name guard that exists in the new()\\nconstructor at line 133. This creates an inconsistency where settlement_policy\\ncan create invalid instances (such as with an all-zero policy_id) that would be\\nrejected by new(). Refactor settlement_policy to use the proper constructor\\nvalidation logic instead of directly constructing the struct, ensuring all\\ninvariants are consistently enforced regardless of which function creates the\\nPluralityLawRef.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix (Beta)

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Path: .coderabbit.yaml\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `a38d0ed6-cb79-4852-93ca-8e49a860a31c`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between be0041669c61eee62096b283413780ac742c15f8 and 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (11)

\\n\\n* `CHANGELOG.md`\\n* `crates/warp-core/src/braid_shell.rs`\\n* `crates/warp-core/src/lib.rs`\\n* `crates/warp-core/src/plurality_law.rs`\\n* `crates/warp-core/src/sealed_membership.rs`\\n* `crates/warp-core/src/witness.rs`\\n* `crates/warp-core/tests/plurality_law_public_api_tests.rs`\\n* `crates/warp-core/tests/witness_public_api_tests.rs`\\n* `docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`\\n* `docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\\n* `docs/design/braids-and-strands-roadmap.md`\\n\\n

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Report collapse policies as collapse laws**\\n\\nWhen replaying a shell produced by `collapse_braid_shell(..., Some(CollapsePolicy { policy_id, .. }))`, the shell stores that same id in `outcome.collapse_policy`, but this line always wraps `shell.policy_id` as a `PluralityLawFamily::Settlement` law (and audit repeats the same mapping). Consumers of the new `law_ref`/`law_reading` will see a collapse-derived shell as a settlement-law reading instead of the named collapse law, so law authorization or audit can be performed against the wrong family.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/braid_shell.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject empty policy ids in settlement law refs**\\n\\n`PluralityLawRef::new` rejects all-zero law names, but this convenience constructor bypasses that validation and copies any `policy_id` directly into the law name. Since `BraidShell::assemble` accepts a raw `Hash` policy id, a caller can still retain/replay a shell whose `law_ref` has the forbidden all-zero name, making the new “named law” invariant inconsistent between direct law construction and braid replay/audit.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Do not promote integrity-only receipts to external posture**\\n\\nFor any custom backend or caller that returns a non-self `WitnessReceipt` with `WitnessAttestation::IntegrityOnly`, this fallback classifies the resulting `PluralityLawReading` as `ExternalWitness`, whose documentation says it is independent external evidence. That overstates the evidence posture merely because the receipt kind is not `SelfWitness`; either reject inconsistent receipts or derive this posture from the attestation strength.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent callers from minting self-witness overclaims**\\n\\nAlthough the simulator rejects `SelfWitness` requests for `StableV1`, this public receipt type/infallible constructor still lets any caller create `WitnessReceipt::new(WitnessKind::SelfWitness, ..., WitnessCompatibilityRule::StableV1, WitnessAttestation::IndependentAttestation)` or mutate equivalent public fields. In contexts that accept caller-supplied receipts, that bypasses the E1-scaffold boundary and reports local self-witness evidence as stable or independent.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/witness.rs\",\"side\":\"RIGHT\",\"line\":106}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind sealed presentations to their witness receipt**\\n\\nThis constructor accepts an arbitrary `witness_receipt` and then presents it as supporting the coordinate, purpose, authority, member commitment, and budget, but there is no digest check tying the receipt subject/evidence to those fields. A caller can therefore reuse a receipt from one purpose or braid coordinate in another `SealedMembershipPresentation`, undermining the purpose-bound capability claim made by this new public type.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/sealed_membership.rs\",\"side\":\"RIGHT\",\"line\":108}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `0ca9eb2c1c`\\n \\n\\n

ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"| Severity | Source | File | Lines | Issue | Planned handling |\\n|---|---|---|---:|---|---|\\n| P2 | Self-audit, extension of existing Codex sealed-presentation thread | `crates/warp-core/src/sealed_membership.rs` | 54-66 | `SealedMembershipPresentation` fields are public, so constructor validation alone would still allow callers to mutate a validated presentation into an unbound receipt/field pairing. @codex please sanity-check this closure condition. | Make the presentation fields private, expose read-only accessors, and validate witness subject/evidence digests in the constructor. |\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Make sealed presentations immutable after construction**\\n\\nWhen a caller validates a `SealedMembershipPresentation` once and then stores or forwards it, this public receipt field (together with the adjacent public claim fields) lets external crates replace either side of the binding after validation, e.g. keep a receipt issued for one member commitment but swap in a different braid, purpose, or authority domain. That breaks the sealed-membership proof invariant and means constructor-side validation would not actually close the unbound receipt/field-pairing hole unless these fields are private with read-only accessors.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/sealed_membership.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject unnamed settlement policy law refs**\\n\\nWhen a braid shell is assembled with the default/all-zero `policy_id` (the shell constructor and validator do not reject it), this helper bypasses `PluralityLawRef::new` and creates a settlement law whose name is `[0; 32]`. That violates the new named-law invariant and lets audit/replay, registry, and authorization surfaces carry an unnamed law despite `EmptyName` validation, so this path should be fallible or zero policy ids should be rejected before replay creates the law ref.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind law readings to the witnessed support digest**\\n\\nWhen a caller passes a `WitnessReceipt` whose `subject_digest` names different material than `support_digest`, this constructor still emits a witnessed `PluralityLawReading` with a normal evidence posture and digest. Downstream consumers can then treat support A as witnessed by a receipt issued for support B; since the braid audit path constructs matching digests, reject mismatched receipt subjects (or make the alternate subject derivation explicit) before accepting the reading.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":634}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent stable self-witness receipts from being minted**\\n\\nWhen external code uses this public constructor (or a custom backend returns its result), it can create `WitnessKind::SelfWitness` receipts with `StableV1` compatibility or `IndependentAttestation`, even though the simulator path now rejects stable self-witness requests. Those forged combinations are later consumed as ordinary receipts, so the self-witness scaffold can still overclaim stable or independent evidence unless this constructor rejects incompatible kind/compatibility/attestation pairs or is no longer the public minting path.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/witness.rs\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `0ca9eb2c1c`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Activity Summary\\n\\n| # | Severity | Source | Area | Commit | Outcome |\\n|---:|:---:|---|---|---|---|\\n| 1 | P2 | PR | `witness.rs` self-witness overclaims | `3390bb5e` | Rejected stable/independent self-witness receipts; fields made read-only. |\\n| 2 | P2 | PR | `plurality_law.rs` evidence posture | `57e47dcc` | Law readings derive posture from attestation strength. |\\n| 3 | P2 | PR + Self | `sealed_membership.rs` presentation binding | `7c995864` | Presentations are immutable and validate receipt subject/evidence digests. |\\n| 4 | P2 | PR | `plurality_law.rs` / `braid_shell.rs` empty policy refs | `89ec42dc` | Settlement policy refs and braid shell policy ids reject all-zero law names. |\\n| 5 | P2 | PR | `braid_shell.rs` collapse law family | `d67b25cd` | Collapse-derived shells report collapse policy ids as collapse laws. |\\n| 6 | P5 | PR | `braid_shell.rs` disclosure-budget test coverage | `116e491a` | Sealed-member audit test now asserts shell-level disclosure budget. |\\n| 7 | P3 | PR | `plurality_law.rs` Law Card digest allocation | `aa04326c` | `hash_tag_vec` streams exact-size iterators without temporary `Vec` allocation. |\\n| 8 | P2 | PR | `plurality_law.rs` law reading support binding | `bd18b984` | `PluralityLawReading::new` is fallible and rejects receipt/support digest mismatches. |\\n\\nResolved review threads: all 12 thread IDs currently returned by GraphQL are `isResolved: true`.\\n\\nLocal validation after the final commit:\\n\\n- `cargo test -p warp-core --lib`\\n- `cargo test -p warp-core --test witness_public_api_tests`\\n- `cargo test -p warp-core --test plurality_law_public_api_tests`\\n- `cargo fmt --all -- --check`\\n- `cargo clippy -p warp-core --lib -- -D warnings`\\n- `cargo clippy -p warp-core --test witness_public_api_tests -- -D warnings`\\n- `cargo clippy -p warp-core --test plurality_law_public_api_tests -- -D warnings`\\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\\n- `git diff --check origin/main...HEAD`\\n- `scripts/check_spdx.sh`\\n- `scripts/check-no-app-nouns-in-core.sh`\\n\\nPre-push hooks also reran the configured exact Rust slices and markdown formatting successfully.\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_\\n\\n**Validation gap: `collapse_policy` in derived outcomes is not checked at assembly time.**\\n\\n`check_policy_id` validates only the main `policy_id` parameter. A shell with `policy_id = [0x5E; 32]` but `collapse_policy: Some([0; 32])` in its `Derived` outcome passes assembly and validation, then fails during replay/audit when `shell_law_ref` calls `PluralityLawRef::collapse_policy`.\\n\\nShells should fail fast at assembly, not during replay. Consider extending `check_outcome_law` to validate `collapse_policy` when present:\\n\\n

\\n

Proposed fix

\\n\\n```diff\\n fn check_outcome_law(outcome: &BraidShellOutcome) -> Result<(), BraidShellError> {\\n match outcome {\\n BraidShellOutcome::Derived {\\n+ collapse_policy: Some(policy),\\n collapse_witness: Some(witness),\\n ..\\n- }\\n- | BraidShellOutcome::Obstruction { witness, .. } => {\\n+ } => {\\n+ check_policy_id(*policy)?;\\n WitnessDigest::new(*witness).map_err(|_| BraidShellError::EmptyWitness)?;\\n }\\n+ BraidShellOutcome::Obstruction { witness, .. } => {\\n+ WitnessDigest::new(*witness).map_err(|_| BraidShellError::EmptyWitness)?;\\n+ }\\n _ => {}\\n }\\n Ok(())\\n }\\n```\\n

\\n\\n\\n\\n\\n\\n\\nAlso applies to: 1160-1169\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@crates/warp-core/src/braid_shell.rs` around lines 758 - 763, The\\ncheck_policy_id function only validates the main policy_id parameter but ignores\\nthe collapse_policy field in Derived outcomes, allowing shells with invalid\\n(all-zeros) collapse_policy values to pass assembly-time validation and fail\\nonly during replay. Extend the check_outcome_law function to validate the\\ncollapse_policy field when it is present in a Derived outcome, ensuring it is\\nnot all zeros similar to how check_policy_id validates the main policy_id, so\\nthat invalid shells fail fast at assembly time rather than during replay/audit\\noperations.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commits bd18b98 to 9da73d6\",\"path\":\"crates/warp-core/src/braid_shell.rs\",\"side\":\"RIGHT\",\"line\":778}{\"type\":\"pull_request_comment\",\"body\":\"_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\\n\\n**Add explicit coverage for `WitnessEvidenceMismatch` in sealed-membership validation.**\\n\\nLine 161 currently exercises only the subject-mismatch path. Add a dedicated negative test for mismatched evidence digest to lock down the second constructor error branch.\\n\\n\\n\\n\\n\\n\\n

\\n

Suggested test addition

\\n\\n```diff\\n #[test]\\n fn public_sealed_membership_presentation_rejects_unbound_receipts() {\\n@@\\n }\\n+\\n+#[test]\\n+fn public_sealed_membership_presentation_rejects_unbound_evidence() {\\n+ let purpose = PresentationPurpose::new([0x44; 32]);\\n+ let coordinate = BraidCoordinate([0xBC; 32]);\\n+ let authority = authority_ref();\\n+ let member_commitment = [0xA5; 32];\\n+ let disclosure_budget = DisclosureBudget::CapabilityScoped;\\n+\\n+ let subject = SealedMembershipPresentation::witness_subject_digest(\\n+ coordinate,\\n+ purpose,\\n+ authority,\\n+ member_commitment,\\n+ disclosure_budget,\\n+ );\\n+ let expected = SealedMembershipPresentation::witness_evidence_digest(\\n+ coordinate,\\n+ purpose,\\n+ authority,\\n+ member_commitment,\\n+ disclosure_budget,\\n+ );\\n+ let receipt = WitnessReceipt::self_witness(subject, [0xEE; 32]);\\n+\\n+ assert_eq!(\\n+ SealedMembershipPresentation::new(\\n+ coordinate,\\n+ purpose,\\n+ authority,\\n+ member_commitment,\\n+ receipt,\\n+ disclosure_budget,\\n+ ),\\n+ Err(SealedMembershipPresentationError::WitnessEvidenceMismatch {\\n+ expected,\\n+ actual: [0xEE; 32],\\n+ })\\n+ );\\n+}\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n#[test]\\nfn public_sealed_membership_presentation_rejects_unbound_receipts() {\\n let purpose = PresentationPurpose::new([0x44; 32]);\\n let coordinate = BraidCoordinate([0xBC; 32]);\\n let authority = authority_ref();\\n let member_commitment = [0xA5; 32];\\n let disclosure_budget = DisclosureBudget::CapabilityScoped;\\n let expected = SealedMembershipPresentation::witness_subject_digest(\\n coordinate,\\n purpose,\\n authority,\\n member_commitment,\\n disclosure_budget,\\n );\\n let receipt = WitnessReceipt::self_witness([0xDE; 32], evidence_digest());\\n\\n assert_eq!(\\n SealedMembershipPresentation::new(\\n coordinate,\\n purpose,\\n authority,\\n member_commitment,\\n receipt,\\n disclosure_budget,\\n ),\\n Err(SealedMembershipPresentationError::WitnessSubjectMismatch {\\n expected,\\n actual: [0xDE; 32],\\n })\\n );\\n}\\n\\n#[test]\\nfn public_sealed_membership_presentation_rejects_unbound_evidence() {\\n let purpose = PresentationPurpose::new([0x44; 32]);\\n let coordinate = BraidCoordinate([0xBC; 32]);\\n let authority = authority_ref();\\n let member_commitment = [0xA5; 32];\\n let disclosure_budget = DisclosureBudget::CapabilityScoped;\\n\\n let subject = SealedMembershipPresentation::witness_subject_digest(\\n coordinate,\\n purpose,\\n authority,\\n member_commitment,\\n disclosure_budget,\\n );\\n let expected = SealedMembershipPresentation::witness_evidence_digest(\\n coordinate,\\n purpose,\\n authority,\\n member_commitment,\\n disclosure_budget,\\n );\\n let receipt = WitnessReceipt::self_witness(subject, [0xEE; 32]);\\n\\n assert_eq!(\\n SealedMembershipPresentation::new(\\n coordinate,\\n purpose,\\n authority,\\n member_commitment,\\n receipt,\\n disclosure_budget,\\n ),\\n Err(SealedMembershipPresentationError::WitnessEvidenceMismatch {\\n expected,\\n actual: [0xEE; 32],\\n })\\n );\\n}\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@crates/warp-core/tests/witness_public_api_tests.rs` around lines 160 - 190,\\nThe current test public_sealed_membership_presentation_rejects_unbound_receipts\\nonly exercises the WitnessSubjectMismatch error path of\\nSealedMembershipPresentation::new. Add a new dedicated test function that\\ncreates a WitnessReceipt with a correct subject digest but an incorrect evidence\\ndigest (pass a different value than evidence_digest() to the self_witness call),\\nthen verify that SealedMembershipPresentation::new returns the\\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\\ncomplete error-path coverage.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commit ba972f6\",\"path\":\"crates/warp-core/tests/witness_public_api_tests.rs\",\"side\":\"RIGHT\",\"line\":190}{\"type\":\"pull_request_comment\",\"body\":\"_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**Factual error: presentation fields are not read-only in the current implementation.**\\n\\nThe design doc claims \\\"the fields are read-only after construction,\\\" but `SealedMembershipPresentation` (in `sealed_membership.rs:109-127`) exposes all fields as `pub`, allowing direct field mutation after construction. This circumvents the constructor's validation and directly contradicts the PR objectives, which explicitly flag this as a P2 severity security issue requiring remediation via private fields + read-only accessors.\\n\\nEither update this to accurately describe the current state (public fields with validation closure gap) or reference the planned remediation explicitly; do not claim read-only semantics when they don't exist.\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn\\n`@docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`\\naround lines 92 - 94, The design document claims that fields in\\nSealedMembershipPresentation are read-only after construction, but this is\\nfactually incorrect since the current implementation exposes all fields as pub\\nin sealed_membership.rs, allowing direct mutation after construction. Either\\nupdate the document to accurately describe the current implementation state\\n(public mutable fields with a validation closure gap) or explicitly reference\\nthe planned remediation work that will address this security issue through\\nprivate fields and read-only accessors. Do not assert read-only semantics that\\ndo not currently exist in the code.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\",\"path\":\"docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md\",\"side\":\"RIGHT\",\"line\":94}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 3**\\n\\n> [!CAUTION]\\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\\n> \\n> \\n> \\n>

\\n>

⚠️ Outside diff range comments (1)

\\n> \\n>
\\n>
CHANGELOG.md (1)
\\n> \\n> `42-52`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\\n> \\n> **Incomplete: GP4 CHANGELOG entry omits the known sealed-membership field-visibility gap.**\\n> \\n> The entry describes the validation that sealed presentations perform at construction time, which is accurate. However, it does not mention that the P2 severity issue remains unresolved: `SealedMembershipPresentation` fields are public and can be mutated after construction, circumventing the validation. The design doc (lines 92–94 of goalpost-04) incorrectly claims fields are read-only post-construction.\\n> \\n> Consider adding a note like \\\"Remediation of field-visibility constraints is planned as a follow-up\\\" to signal that the implementation is incomplete on the security boundary, or leave this to the design doc to state more clearly.\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In `@CHANGELOG.md` around lines 42 - 52, The CHANGELOG entry for the warp-core\\n> fourth goalpost describes the sealed membership presentation validation but\\n> omits mention of the known P2 severity security gap where\\n> SealedMembershipPresentation fields are public and can be mutated after\\n> construction, circumventing the validation. Add a note to the CHANGELOG entry\\n> acknowledging this known issue and indicating that remediation of\\n> field-visibility constraints is planned as follow-up work to signal that the\\n> security boundary implementation is incomplete.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n>
\\n> \\n>

\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn `@crates/warp-core/src/braid_shell.rs`:\\n- Around line 758-763: The check_policy_id function only validates the main\\npolicy_id parameter but ignores the collapse_policy field in Derived outcomes,\\nallowing shells with invalid (all-zeros) collapse_policy values to pass\\nassembly-time validation and fail only during replay. Extend the\\ncheck_outcome_law function to validate the collapse_policy field when it is\\npresent in a Derived outcome, ensuring it is not all zeros similar to how\\ncheck_policy_id validates the main policy_id, so that invalid shells fail fast\\nat assembly time rather than during replay/audit operations.\\n\\nIn `@crates/warp-core/tests/witness_public_api_tests.rs`:\\n- Around line 160-190: The current test\\npublic_sealed_membership_presentation_rejects_unbound_receipts only exercises\\nthe WitnessSubjectMismatch error path of SealedMembershipPresentation::new. Add\\na new dedicated test function that creates a WitnessReceipt with a correct\\nsubject digest but an incorrect evidence digest (pass a different value than\\nevidence_digest() to the self_witness call), then verify that\\nSealedMembershipPresentation::new returns the\\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\\ncomplete error-path coverage.\\n\\nIn\\n`@docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`:\\n- Around line 92-94: The design document claims that fields in\\nSealedMembershipPresentation are read-only after construction, but this is\\nfactually incorrect since the current implementation exposes all fields as pub\\nin sealed_membership.rs, allowing direct mutation after construction. Either\\nupdate the document to accurately describe the current implementation state\\n(public mutable fields with a validation closure gap) or explicitly reference\\nthe planned remediation work that will address this security issue through\\nprivate fields and read-only accessors. Do not assert read-only semantics that\\ndo not currently exist in the code.\\n\\n---\\n\\nOutside diff comments:\\nIn `@CHANGELOG.md`:\\n- Around line 42-52: The CHANGELOG entry for the warp-core fourth goalpost\\ndescribes the sealed membership presentation validation but omits mention of the\\nknown P2 severity security gap where SealedMembershipPresentation fields are\\npublic and can be mutated after construction, circumventing the validation. Add\\na note to the CHANGELOG entry acknowledging this known issue and indicating that\\nremediation of field-visibility constraints is planned as follow-up work to\\nsignal that the security boundary implementation is incomplete.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix (Beta)

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Path: .coderabbit.yaml\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `f75943ab-8448-4d5e-93a1-cc29fe36f0ac`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25 and aa04326cb919af45e76782a0b8d9954b42cbe385.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (10)

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Self-Code Review Findings\\n\\n@codex please confirm these findings against `bd18b984`.\\n\\n| Severity | File | Lines | Infraction | Evidence | Recommended agent prompt |\\n|---|---|---:|---|---|---|\\n| P1 High | `crates/warp-core/src/braid_shell.rs` | 521-605, 800-819, 1163-1171 | Collapse-derived shells can carry two different policy identities. | `BraidShell::assemble_with_proof` accepts top-level `policy_id` and `BraidShellOutcome::Derived { collapse_policy: Some(...) }` independently. `check_outcome_member_coherence` only checks that collapse fields are all present or absent, not that `collapse_policy == policy_id`. The new `shell_law_ref` then reports the nested `collapse_policy` as the law ref while `BraidShellReplay`/`BraidShellAudit` still expose the top-level `policy_id`, so a validated shell can claim policy A at the shell level and policy B as the named law. The current test at lines 2048-2059 already constructs such a mismatch: top-level `[0x5E; 32]` with nested `[0x77; 32]`, and `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent` passes. | Add a deterministic regression test that assembles a collapse-derived shell with mismatched top-level `policy_id` and nested `collapse_policy` and expects a typed error. Introduce a `BraidShellError` variant for incoherent collapse policy identity, reject the mismatch in both assembly and validation, and update existing tests to use matching identities unless intentionally exercising the error path. |\\n| P5 Nit | `crates/warp-core/src/plurality_law.rs` | 123-139 | Rustdoc `# Errors` contract is incomplete. | `PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` at lines 133-135 and `ZeroVersion` at lines 136-138, but its `# Errors` docs only mention `ZeroVersion` at line 127. This is a public constructor in a newly exported API; incomplete error docs are drift. | Update the `PluralityLawRef::new` Rustdoc `# Errors` section to list both `EmptyName` for all-zero law names and `ZeroVersion` for version 0. |\\n\\nChecks run during review:\\n\\n- `git status --porcelain` clean before review\\n- `git fetch origin`\\n- `git diff --check origin/main...HEAD`\\n- `cargo fmt --all -- --check`\\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md docs/design/braids-and-strands-roadmap.md`\\n- `scripts/check_spdx.sh`\\n- `scripts/check-no-app-nouns-in-core.sh`\\n- `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent`\\n- `cargo clippy -p warp-core --lib -- -D warnings`\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject mismatched collapse policy ids**\\n\\nWhen a caller builds a collapse-derived shell with top-level `policy_id` A and nested `collapse_policy` B, validation only requires the collapse lineage fields to be all present, and this branch reports B as the `law_ref` while replay/audit still expose A as `policy_id`. That lets a retained shell validate and replay with two different policy identities; please reject collapse-derived shells whose nested collapse policy differs from `shell.policy_id`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/braid_shell.rs\",\"side\":\"RIGHT\",\"line\":1200}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `bd18b984cb`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Document the empty-name error**\\n\\n`PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` for an all-zero law name before it checks the version, but the public `# Errors` contract only mentions `ZeroVersion`. Callers reading generated API docs will miss a typed failure case for this new exported constructor, so please include `EmptyName` in the error docs as well.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"crates/warp-core/src/plurality_law.rs\",\"side\":\"RIGHT\",\"line\":130}{\"type\":\"pull_request_comment\",\"body\":\"\\n\\n> [!CAUTION]\\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\\n> \\n> \\n> \\n>

\\n>

⚠️ Outside diff range comments (1)

\\n> \\n>
\\n>
crates/warp-core/src/plurality_law.rs (1)
\\n> \\n> `521-530`: _🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\\n> \\n> **`PluralityLawAuthorization` public fields allow bypassing registry validation.**\\n> \\n> External code can construct this directly without calling `registry.authorize()`, creating forged authorization evidence. Same pattern as the P2 issue flagged for `SealedMembershipPresentation` in this PR.\\n> \\n> If the remediation plan (private fields + read-only accessors) applies here too, consider bundling it.\\n> \\n> \\n> \\n>
\\n>
Proposed encapsulation
\\n> \\n> ```diff\\n> /// Successful law authorization evidence.\\n> #[derive(Clone, Copy, Debug, PartialEq, Eq)]\\n> pub struct PluralityLawAuthorization {\\n> - /// Authorized law reference.\\n> - pub law_ref: PluralityLawRef,\\n> - /// Digest of the registered Law Card.\\n> - pub card_digest: Hash,\\n> - /// Authority that authorized execution, if any.\\n> - pub authorized_by: Option,\\n> + law_ref: PluralityLawRef,\\n> + card_digest: Hash,\\n> + authorized_by: Option,\\n> +}\\n> +\\n> +impl PluralityLawAuthorization {\\n> + pub const fn law_ref(&self) -> PluralityLawRef { self.law_ref }\\n> + pub const fn card_digest(&self) -> Hash { self.card_digest }\\n> + pub const fn authorized_by(&self) -> Option { self.authorized_by }\\n> }\\n> ```\\n>
\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In `@crates/warp-core/src/plurality_law.rs` around lines 521 - 530, The public\\n> fields on the PluralityLawAuthorization struct (law_ref, card_digest, and\\n> authorized_by) allow external code to construct valid-looking authorization\\n> evidence without going through the registry authorization process. Make these\\n> three fields private instead of public, and add public getter methods for each\\n> field that return the same types they currently expose. This ensures the struct\\n> can only be properly instantiated through the intended registry.authorize() code\\n> path, preventing forged authorization evidence from being created by external\\n> callers.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n>
\\n> \\n>

\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nOutside diff comments:\\nIn `@crates/warp-core/src/plurality_law.rs`:\\n- Around line 521-530: The public fields on the PluralityLawAuthorization struct\\n(law_ref, card_digest, and authorized_by) allow external code to construct\\nvalid-looking authorization evidence without going through the registry\\nauthorization process. Make these three fields private instead of public, and\\nadd public getter methods for each field that return the same types they\\ncurrently expose. This ensures the struct can only be properly instantiated\\nthrough the intended registry.authorize() code path, preventing forged\\nauthorization evidence from being created by external callers.\\n```\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Path: .coderabbit.yaml\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `2250b624-a5bc-4a38-86ef-6219d88df28e`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between aa04326cb919af45e76782a0b8d9954b42cbe385 and 9da73d6c9596c3f74add555aba8af978b5af3591.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (5)

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_428":773,"_409":410,"_430":416},{"_431":774,"_433":-5,"_42":-5,"_434":-5,"_96":323,"_92":436},[775],{"_46":769,"_92":776},"input_text",{"_428":778,"_409":410,"_430":416},{"_431":779,"_433":-5,"_42":-5,"_434":-5,"_96":323,"_92":436},[780,781],{"_46":783,"_92":776},{"_46":782,"_92":776},"\n /workspace/echo\n bash\n 2026-06-17\n Etc/UTC\n","# AGENTS.md instructions for /workspace/echo\n\n\n\n\n\n# AGENTS\n\nThis guide is for AI agents and human operators recovering context in the Echo repository.\n\n## Architecture North Star\n\nEcho is not a graph database, app framework, sync daemon, or mutable state\nserver. Echo is a deterministic WARP runtime over witnessed causal history.\n\nThe durable territory is admitted causal history: transitions, frontiers, lane\nidentities, payload hashes, receipts, witnesses, checkpoints, suffixes, and\nretained boundary artifacts. Graphs, files, editor buffers, UI state, and debug\nviews are materialized readings emitted by observers or optics over that\nhistory. They may be cached, retained, transported, compared, or revealed, but\nthey are not the substrate ontology.\n\nPublic Echo surfaces should follow the WARP optic shape:\n\n```text\nexplicit causal basis/site\n+ bounded aperture\n+ law\n+ support, capability, budget, and evidence posture\n-> witnessed hologram\n```\n\nExternal callers propose explicit-base intents or observe through bounded\noptics. Echo admits, stages, pluralizes, conflicts, or obstructs those claims\nunder named law and emits receipts, reading envelopes, witnesses, or retained\nshells. Transport is witnessed suffix admission, not state sync. Application\nnouns belong in authored contracts and generated adapters, not in Echo core.\n\nKeep these sentences in view when changing architecture, docs, or APIs:\n\n```text\nThere is witnessed causal history.\nWARP optics chart it.\nHolograms witness those charts.\nMaterialized graphs are optional readings.\nContinuum is the protocol for lawful causal-history exchange.\n```\n\n## Git Rules\n\n- **NEVER** amend commits.\n- **NEVER** rebase or force-push.\n- **NEVER** push to `main` without explicit permission.\n- Always use standard commits and regular pushes.\n\n## Documentation & Planning Map\n\nDo not audit the repository by recursively walking the filesystem. Follow the authoritative manifests:\n\n### 1. The Entrance\n\n- **`README.md`**: Public front door, core value prop, and quick tour.\n- **`GUIDE.md`**: Orientation and productive-fast path.\n- **`docs/index.md`**: VitePress documentation map.\n\n### 2. The Bedrock\n\n- **`ARCHITECTURE.md`**: Authoritative structural reference (Hexagonal, Core, Memory).\n- **`VISION.md`**: Core tenets and the causal mission.\n- **`METHOD.md`**: Repo work doctrine (Backlog lanes, Cycle loop).\n\n### 3. The Direction\n\n- **`docs/BEARING.md`**: Current execution gravity and active tensions.\n- **`docs/design/ROADMAP.md`**: Broad strategic horizon and targets.\n- **`backlog/`**: The active source of truth for pending work.\n\n### 4. The Proof\n\n- **`CHANGELOG.md`**: Historical truth of merged behavior.\n- **`cargo xtask dind`**: Determinism convergence verification.\n\n## Context Recovery Protocol\n\nWhen starting a new session or recovering from context loss:\n\n1. **Read `docs/BEARING.md`** to find the current execution gravity.\n2. **Read `METHOD.md`** to understand the work doctrine.\n3. **Check `backlog/asap/`** for imminent work.\n4. **Check `git log -n 5` and `git status`** to verify the current branch state.\n\n## Executable Claim Protocol\n\nEngineering work must converge around executable evidence, not broad repository\ninterpretation. Before editing code, reduce the task to one executable claim:\n\n1. **Bound the Claim**: State the behavior, invariant, or artifact that must\n change.\n2. **Name the Witness**: Identify the smallest test, check, script, compile\n contract, golden vector, schema validation, or artifact inspection that can\n prove the claim.\n3. **Run the Witness When Feasible**: Prefer a failing witness before the fix.\n If the witness cannot execute because the repository is already broken,\n repair only the minimal compile/runtime blocker required to run it.\n4. **Do Not Expand from an Unblocker**: Do not turn a compile blocker into\n nearby architecture cleanup, docs cleanup, lint cleanup, migration sweep, or\n opportunistic refactor.\n5. **Green the Claim**: Implement the smallest fix, rerun the witness, and run\n only directly relevant surrounding checks unless broader validation is\n explicitly requested.\n6. **Stop on Green**: When the witness passes and the requested scope is\n satisfied, stop. Do not inspect more PR comments, audit more files, or clean\n unrelated residue without a new executable claim.\n\nIf unrelated failures remain, isolate them in the final report instead of\nabsorbing them into the task. Report files changed, symbols or behavior changed,\nwitness commands, pass/fail results, and intentional non-actions such as no\ncommit, no push, or no PR comment.\n\n## End of Turn Checklist\n\nAfter altering files:\n\n1. **Verify Truth**: Ensure documentation is updated if behavior or structure changed.\n2. **Log Debt**: Add follow-on backlog items to `bad-code/` or `cool-ideas/`.\n3. **Commit**: Use focused, conventional commit messages. Propose a draft before executing.\n4. **Validate**: Run `cargo check` and relevant tests.\n\n---\n\n**The goal is inevitability. Every feature is defined by its tests.**\n\n",{"_428":785,"_409":410,"_430":416},{"_431":786,"_433":-5,"_42":-5,"_434":-5,"_96":787,"_92":436},[788,789],"developer",{"_46":791,"_92":776},{"_46":790,"_92":776},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_409":410,"_87":794},{"_103":-5,"_42":416,"_417":795,"_419":420,"_421":796},[],"inProgress",{"_421":798,"_409":410},{"_799":800,"_92":801},"activeFlags",[],"active","thread/started",{"_804":805},"thread",{"_806":-5,"_807":-5,"_808":809,"_810":420,"_472":473,"_811":15,"_812":-5,"_813":-5,"_42":410,"_814":815,"_181":-5,"_161":816,"_817":209,"_477":818,"_421":819,"_77":820,"_821":420},"agentNickname","agentRole","cliVersion","0.128.0","createdAt","ephemeral","forkedFromId","gitInfo","modelProvider","openai","/opt/codex/sessions/2026/06/17/rollout-2026-06-17T11-50-21-019ed56b-0624-7513-b2b8-37fe9021513f.jsonl","preview","vscode",{"_92":425},[],"updatedAt",[],"messages",[825],{"_42":826,"_827":828,"_829":830,"_831":830,"_431":832,"_421":833,"_433":-5,"_834":32,"_835":836,"_837":838,"_839":-5},"41e26365-65a8-4e34-8343-020303a036fc","author",{"_96":323,"_181":-5,"_835":848},"create_time",1781697020.474475,"update_time",{"_844":46,"_845":846},"finished_successfully","weight","metadata",{"_840":841},"recipient","all","channel","l1239dk1",{"_842":843},"inline_comments",[],"content_type","parts",[847],"## Activity Summary\n\n@codex review-thread remediation complete against `ba972f6f`.\n\n| # | Severity | Source | File | Thread / lines | Commit | Outcome |\n|---:|:---:|---|---|---|---|---|\n| 1 | P1 | PR / Codex | `crates/warp-core/src/braid_shell.rs` | `discussion_r3427674226`, L1196-L1200 | `9da73d6c` | Rejected collapse-derived shells whose nested `collapse_policy` differs from the shell `policy_id`; regression covers the incoherent pair. |\n| 2 | P3 | PR / Codex | `crates/warp-core/src/plurality_law.rs` | `discussion_r3427674228`, L130 | `9da73d6c` | Documented both `EmptyName` and `ZeroVersion` in `PluralityLawRef::new` public error contract. |\n| 3 | P4 | PR / CodeRabbit | `crates/warp-core/tests/witness_public_api_tests.rs` | `discussion_r3427283025`, L160-L190 | `ba972f6f` | Added explicit sealed-presentation `WitnessEvidenceMismatch` regression coverage. |\n| 4 | P2 | PR / CodeRabbit | `docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md` / `crates/warp-core/src/sealed_membership.rs` | `discussion_r3427283071`, L92-L94 | `7c995864` | Confirmed the documentation now matches implementation: presentation fields are private after construction and exposed only via read-only accessors. |\n\nReview-thread state: all four remaining threads resolved via GraphQL; a fresh thread inventory returns `0` unresolved threads.\n\nVerification:\n\n| Command | Result |\n|---|---|\n| `git status --porcelain` | clean before audit and clean after push |\n| `git fetch origin` | refs refreshed |\n| `git diff origin/main...HEAD` | audited; no additional self-discovered issues after the queued findings |\n| `cargo test -p warp-core --test witness_public_api_tests public_sealed_membership_presentation_rejects_wrong_evidence_digest -- --exact --list` | RED presence witness failed before the test existed; passes after `ba972f6f` |\n| `cargo test -p warp-core --test witness_public_api_tests public_sealed_membership_presentation_rejects_wrong_evidence_digest -- --exact` | passed |\n| `cargo test -p warp-core --test witness_public_api_tests` | passed, 9 tests |\n| `cargo test -p warp-core --lib` | passed, 565 tests |\n| `cargo fmt --all -- --check` | passed |\n| `cargo clippy -p warp-core --lib --test witness_public_api_tests -- -D warnings` | passed |\n| `cargo check -p warp-core --quiet` | passed |\n| `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md docs/design/braids-and-strands-roadmap.md` | passed |\n| `scripts/check_spdx.sh` | passed |\n| `scripts/check-no-app-nouns-in-core.sh` | passed |\n| pre-commit hook | passed |\n| pre-push hook | passed |\nComplete witness receipts and plurality law hardening\n\n## Summary\n\nCompletes the remaining braids/strands hardening roadmap slices for Goalposts 4 and 5.\n\n- Adds typed witness receipt boundaries, compatibility rules, simulator fixtures, and sealed membership presentation vocabulary.\n- Extends braid shell audit/replay facts with disclosure budgets, typed self-witness receipts, named plurality law refs, and witnessed law readings.\n- Adds named plurality law machinery: law refs, law families, Law Cards, deterministic registry, reading identity, authorization evidence, and unsupported/unauthorized obstruction evidence.\n- Checks off GP4-S1 through GP5-S5 in the roadmap and updates the Goalpost 4/5 design packets plus changelog.\n\n## Self-Review Fixes Included\n\n- Self-witness simulator now rejects non-E1 compatibility requests with `WitnessError::UnsupportedCompatibility` instead of minting stable public identity for scaffolding evidence.\n- `PluralityLawRef::new(...)` rejects all-zero law names and zero versions before registration.\n\n## Validation\n\n- `cargo test -p warp-core --lib`\n- `cargo test -p warp-core --test witness_public_api_tests`\n- `cargo test -p warp-core --test plurality_law_public_api_tests`\n- `cargo fmt --all -- --check`\n- `cargo clippy -p warp-core --lib -- -D warnings`\n- `cargo clippy -p warp-core --test witness_public_api_tests -- -D warnings`\n- `cargo clippy -p warp-core --test plurality_law_public_api_tests -- -D warnings`\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-roadmap.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\n- `scripts/check_spdx.sh`\n- `scripts/check-no-app-nouns-in-core.sh`\n- `git diff --check origin/main...HEAD`\n- Drift scan for stale GP4/GP5 planned markers, unchecked slices, and self-witness overclaim wording\n\n\n\n## Summary by CodeRabbit\n\n* **New Features**\n * Added typed witness receipts with deterministic simulator support and stricter compatibility/attestation rules.\n * Added purpose-bound sealed membership presentations that carry disclosure budgets.\n * Introduced a named plurality law registry with typed cards/authorizations and typed law reading/obstruction evidence.\n * Extended braid shell replay/audit to include law references/readings, witness receipts, and per-member disclosure-budget labeling.\n* **Bug Fixes**\n * Reject empty policy identifiers and detect incoherent collapse policy identity during validation.\n* **Documentation**\n * Marked Goals 4–5 as implemented; expanded design details and updated roadmap wording.\n* **Tests**\n * Added public API, determinism, and rejection/identity-mismatch coverage for witness and plurality-law flows.\n\n\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/echo/pull/552?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@flyingrobots`, we couldn't start this review because you've reached your PR review rate limit.\n> \n> More reviews will be available in 32 minutes and 25 seconds. [Learn how PR review limits work](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy).\n> \n> Your organization has run out of usage credits. Purchase more credits in the [billing tab](https://app.coderabbit.ai/settings/billing?tab=usage&orgId=4252c417-78a1-49cd-a607-68d1e6bdacc4) to continue.\n> \n>

\n>

⌛ How to resolve this issue?

\n> \n> After more reviews become available, a review can be triggered using the `@coderabbitai review` command as a PR comment. Alternatively, push new commits to this PR.\n> \n> To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.\n> \n>

\n> \n> \n>

\n>

🚦 How do rate limits work?

\n> \n> CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.\n> \n> For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.\n> \n> Please see our [Fair Usage Limits Policy](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy) for further information.\n> \n>

\n> \n>

\n>

ℹ️ Review info

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Path: .coderabbit.yaml\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `78e6bd64-f639-4702-b413-ce4fbb3253b8`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between 9da73d6c9596c3f74add555aba8af978b5af3591 and ba972f6f64c72351d89eb1c7b7c3c480e538feb1.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (1)

\n> \n> * `crates/warp-core/tests/witness_public_api_tests.rs`\n> \n>

\n> \n>

\n\n\n\n\n\n

📝 Walkthrough

\n\n## Walkthrough\n\nImplements Goalposts 4 and 5 of the braids/strands hardening roadmap. Adds three new `warp-core` modules: `witness` (typed receipts, deterministic simulator backend), `sealed_membership` (disclosure budget, presentation vocabulary), and `plurality_law` (named law registry, machine-readable cards, authorization/obstruction). All types are re-exported from the crate root. `BraidShellReplay` and `BraidShellAudit` are extended with `law_ref`, `law_reading`, `witness_receipt`, and `disclosure_budget` fields wired through the replay/audit constructors. Policy validation rejects all-zero policy ids.\n\n## Changes\n\n**GP4 + GP5: Witness Receipts, Sealed Membership, and Named Plurality Laws**\n\n| Layer / File(s) | Summary |\n|---|---|\n| **Witness receipt types and deterministic simulator backend**
`crates/warp-core/src/witness.rs` | Defines `WitnessKind` with canonical tag, `WitnessAttestation` (IntegrityOnly/IndependentAttestation), `WitnessCompatibilityRule` (StableV1/E1Scaffold/migration), `WitnessReceipt` with self-witness validation (E1Scaffold + IntegrityOnly only) and deterministic digest, `WitnessRequest` with explicit and self_witness constructors, `WitnessRejectionCode`, `WitnessError` with typed variants, `WitnessBackend` trait, and `WitnessBackendSimulator` with fixture-driven `verify()`. |\n| **Sealed membership presentation vocabulary**
`crates/warp-core/src/sealed_membership.rs` | Adds `DisclosureBudget` enum, `PresentationPurpose` with const fn accessors, `SealedMembershipPresentationError` with typed mismatch variants, and `SealedMembershipPresentation` bundling coordinate/authority/commitment/receipt/budget with fallible constructor validating witness subject/evidence digests. |\n| **Named plurality law registry, cards, readings, and obstruction evidence**
`crates/warp-core/src/plurality_law.rs` | Introduces `PluralityLawName`, `PluralityLawFamily` (AdapterProvided with authority digest), `PluralityLawRef` validating non-all-zero name and non-zero version, machine-readable card components, `PluralityLawCard` with sorted+deduped vectors and canonical digest, `PluralityLawRegistry` with authorize() enforcing authority-domain digest matching, typed `PluralityLawObstruction`, and `PluralityLawReading` deriving evidence posture from witness receipt with disclosure-budget-tagged digest. |\n| **Module declarations and public re-exports**
`crates/warp-core/src/lib.rs` | Declares `mod plurality_law`, `mod sealed_membership`, `mod witness` and adds `pub use` blocks exposing all new types at crate root. |\n| **BraidShell policy validation**
`crates/warp-core/src/braid_shell.rs` | Adds `BraidShellError::EmptyPolicyId`; introduces `check_policy_id` and `check_collapse_policy_identity` helpers; wires validation into both `assemble_with_proof` and `validate`; rejects all-zero policy ids and ensures collapse policy matches shell policy id. |\n| **BraidShellReplay/Audit struct extensions**
`crates/warp-core/src/braid_shell.rs` | Adds `law_ref: PluralityLawRef` to `BraidShellReplay`, `disclosure_budget: DisclosureBudget` to `BraidShellMemberAuditFact`, and `law_reading: PluralityLawReading` plus `witness_receipt: WitnessReceipt` to `BraidShellAudit`. |\n| **BraidShell constructor logic**
`crates/warp-core/src/braid_shell.rs` | Updates `replay_braid_shell` to derive `law_ref` from policy; extends `audit_braid_shell` to construct `witness_receipt` via `self_witness`, derive `law_ref`, compute shell/member disclosure budgets (AuthorityScoped if any sealed member), and build `PluralityLawReading` with witness receipt. |\n| **BraidShell tests**
`crates/warp-core/src/braid_shell.rs` | Updates replay/audit assertions to validate `law_ref`, `law_reading` (evidence posture, disclosure budget), `witness_receipt`; extends member facts with `disclosure_budget`; adds sealed-member test and empty-policy rejection test; verifies `Collapse` family in collapse scenarios; validates collapse-policy-identity mismatch rejection. |\n| **Witness receipt public API tests**
`crates/warp-core/tests/witness_public_api_tests.rs` | Tests unsupported backend/compatibility/attestation errors, deterministic receipt generation and digest stability, rejection handling, E1Scaffold-only enforcement for self-witness, receipt digest binding to compatibility, and `SealedMembershipPresentation` field retention and witness subject validation. |\n| **Plurality law public API tests**
`crates/warp-core/tests/plurality_law_public_api_tests.rs` | Tests registry registration and duplicate rejection, ref validation (EmptyName/ZeroVersion), reading digest binding to version, integrity-only evidence posture, witness subject mismatch rejection, adapter-provided law authorization with authority-domain matching, and unsupported law obstruction. |\n| **Design documentation and roadmap**
`docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`, `goalpost-05-named-plurality-laws.md`, `braids-and-strands-roadmap.md`, `CHANGELOG.md` | Updates Goalpost 4 and 5 status to implemented with full Implementation Design sections covering receipt identity, witness backend boundary, sealed membership validation, law registry, reading digests, and BraidShellAudit/Replay linkage. Marks Goalpost 4 checklist complete; updates witness compatibility enum name; adds changelog entries. |\n\n## Sequence Diagram(s)\n\n```mermaid\nsequenceDiagram\n participant Caller\n participant WitnessBackendSimulator\n participant WitnessReceipt\n participant PluralityLawReading\n participant BraidShellAudit\n\n Caller->>WitnessBackendSimulator: verify(WitnessRequest::self_witness(subject, evidence))\n WitnessBackendSimulator->>WitnessReceipt: self_witness(subject_digest, evidence_digest)\n WitnessReceipt-->>WitnessBackendSimulator: receipt(IntegrityOnly, E1Scaffold)\n WitnessBackendSimulator-->>Caller: Ok(WitnessReceipt)\n\n Caller->>PluralityLawReading: new(law_ref, shell_digest, witness_receipt, disclosure_budget)\n Note over PluralityLawReading: infers EvidencePosture from WitnessKind::SelfWitness + IntegrityOnly\n PluralityLawReading-->>Caller: reading with disclosure-budget-tagged digest\n\n Caller->>BraidShellAudit: audit_braid_shell(shell, witness_digest)\n Note over BraidShellAudit: computes member DisclosureBudget (Public vs AuthorityScoped)
constructs WitnessReceipt::self_witness
builds PluralityLawReading\n BraidShellAudit-->>Caller: BraidShellAudit { law_reading, witness_receipt, member_facts[disclosure_budget] }\n```\n\n## Estimated code review effort\n\n🎯 4 (Complex) | ⏱️ ~60 minutes\n\n## Possibly related PRs\n\n- [flyingrobots/echo#551](https://github.com/flyingrobots/echo/pull/551): Directly extends the same `BraidShellAudit`/`audit_braid_shell` surface in `braid_shell.rs` that this PR builds on for GP4/GP5 law reading and witness receipt fields.\n- [flyingrobots/echo#539](https://github.com/flyingrobots/echo/pull/539): Modifies `braid_shell.rs` around retained shell policy/policy-id handling that this PR extends with plurality-law and witness-receipt derivation.\n- [flyingrobots/echo#545](https://github.com/flyingrobots/echo/pull/545): Modifies `BraidShellReplay`/`BraidShellAudit` data structures in `braid_shell.rs` that this PR extends with `law_ref`, `law_reading`, and `witness_receipt` fields.\n\n## Poem\n\n> 🧵 A braid gets audited, a law gets named,\n> The receipt is hashed, the witness is framed.\n> All-zero names? Rejected outright.\n> `E1Scaffold` only—self-witness rite.\n> The registry speaks in deterministic bytes,\n> And no `StableV1` slips through the pipe. ⚙️\n\n

\n\n\n\n\n

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `hardening/witness-receipts-sealed-capabilities`\n\n

\n\n

\n\n\n\n\n---\n\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/echo&utm_content=552)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\n\n

❤️ Share

\n\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\n\n

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\n\n\n\n\n\n\n\n\n_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Assert shell-level disclosure budget for sealed-member audits.**\n\nThis test checks `member_facts[0].disclosure_budget` but not `audit.law_reading.disclosure_budget()`. A regression in `shell_disclosure_budget(...)` would slip through.\n\n

Proposed test assertion

\n\n```diff\n assert_eq!(\n audit.member_facts[0].disclosure_budget,\n DisclosureBudget::AuthorityScoped\n );\n+ assert_eq!(\n+ audit.law_reading.disclosure_budget(),\n+ DisclosureBudget::AuthorityScoped\n+ );\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/braid_shell.rs` around lines 1716 - 1740, The test\nreplay_audit_labels_sealed_member_disclosure_budget currently only asserts the\nmember-level disclosure budget via audit.member_facts[0].disclosure_budget but\nmissing validation of the shell-level disclosure budget. Add an assertion to\ncheck audit.law_reading.disclosure_budget() to ensure the shell-level disclosure\nbudget is validated and prevent regressions in shell_disclosure_budget function.\nThe assertion should verify that the shell-level disclosure budget matches the\nexpected DisclosureBudget value (likely DisclosureBudget::AuthorityScoped).\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326\n_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n\n**`settlement_policy` bypasses `PluralityLawRef` validation invariants.**\n\nLine 148 directly constructs `PluralityLawRef` and skips the non-zero-name guard in Line 133. Passing an all-zero `policy_id` produces a ref that `new(...)` would reject, so constructor invariants are inconsistent.\n\n

Proposed fix

\n\n```diff\n- pub const fn settlement_policy(policy_id: Hash) -> Self {\n- Self {\n- family: PluralityLawFamily::Settlement,\n- name: PluralityLawName::from_bytes(policy_id),\n- version: 1,\n- }\n+ pub fn settlement_policy(policy_id: Hash) -> Self {\n+ Self::new(\n+ PluralityLawFamily::Settlement,\n+ PluralityLawName::from_bytes(policy_id),\n+ 1,\n+ )\n+ .expect(\"settlement policy id must be non-zero\")\n }\n```\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/plurality_law.rs` around lines 148 - 154, The\nsettlement_policy function directly constructs a PluralityLawRef struct instead\nof using the proper constructor validation method, which bypasses the\nnon-zero-name guard that exists in the new() constructor at line 133. This\ncreates an inconsistency where settlement_policy can create invalid instances\n(such as with an all-zero policy_id) that would be rejected by new(). Refactor\nsettlement_policy to use the proper constructor validation logic instead of\ndirectly constructing the struct, ensuring all invariants are consistently\nenforced regardless of which function creates the PluralityLawRef.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326\n_🛠️ Refactor suggestion_ | _🟠 Major_ | _⚡ Quick win_\n\n**Avoid per-digest temporary allocations in `hash_tag_vec`.**\n\nLine 661 allocates a `Vec` for every call, and `PluralityLawCard::digest` calls this helper three times (Lines 379, 386, 390). In `warp-core` deterministic paths, this is avoidable hot-path churn.\n\nAs per coding guidelines, `crates/warp-core/**`: “Performance matters — flag unnecessary allocations in hot paths.”\n\n\n\n\n

Proposed fix

\n\n```diff\n-fn hash_tag_vec(hasher: &mut Hasher, tags: impl Iterator) {\n- let tags: Vec = tags.collect();\n- hash_len(hasher, tags.len());\n- hasher.update(&tags);\n+fn hash_tag_vec(hasher: &mut Hasher, tags: impl ExactSizeIterator) {\n+ hash_len(hasher, tags.len());\n+ for tag in tags {\n+ hasher.update(&[tag]);\n+ }\n }\n```\n

\n\n\nAlso applies to: 660-664\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/plurality_law.rs` around lines 375 - 399, The digest\nmethod of PluralityLawCard calls hash_tag_vec three times with self.requires,\nself.emits, and self.conceals, and each call allocates a temporary Vec in\nthe hash_tag_vec helper function. To eliminate these hot-path allocations,\nrefactor the hash_tag_vec helper to accept a Hasher reference and update it\ndirectly without creating intermediate Vec allocations, then modify all three\ncalls in the digest method to pass the hasher and iterator directly to the\nrefactored helper instead of having the helper create and return a Vec.\n```\n\n

\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326\n**Actionable comments posted: 3**\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn `@crates/warp-core/src/braid_shell.rs`:\n- Around line 1716-1740: The test\nreplay_audit_labels_sealed_member_disclosure_budget currently only asserts the\nmember-level disclosure budget via audit.member_facts[0].disclosure_budget but\nmissing validation of the shell-level disclosure budget. Add an assertion to\ncheck audit.law_reading.disclosure_budget() to ensure the shell-level disclosure\nbudget is validated and prevent regressions in shell_disclosure_budget function.\nThe assertion should verify that the shell-level disclosure budget matches the\nexpected DisclosureBudget value (likely DisclosureBudget::AuthorityScoped).\n\nIn `@crates/warp-core/src/plurality_law.rs`:\n- Around line 375-399: The digest method of PluralityLawCard calls hash_tag_vec\nthree times with self.requires, self.emits, and self.conceals, and each call\nallocates a temporary Vec in the hash_tag_vec helper function. To eliminate\nthese hot-path allocations, refactor the hash_tag_vec helper to accept a Hasher\nreference and update it directly without creating intermediate Vec allocations,\nthen modify all three calls in the digest method to pass the hasher and iterator\ndirectly to the refactored helper instead of having the helper create and return\na Vec.\n- Around line 148-154: The settlement_policy function directly constructs a\nPluralityLawRef struct instead of using the proper constructor validation\nmethod, which bypasses the non-zero-name guard that exists in the new()\nconstructor at line 133. This creates an inconsistency where settlement_policy\ncan create invalid instances (such as with an all-zero policy_id) that would be\nrejected by new(). Refactor settlement_policy to use the proper constructor\nvalidation logic instead of directly constructing the struct, ensuring all\ninvariants are consistently enforced regardless of which function creates the\nPluralityLawRef.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `a38d0ed6-cb79-4852-93ca-8e49a860a31c`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between be0041669c61eee62096b283413780ac742c15f8 and 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25.\n\n

\n\n

📒 Files selected for processing (11)

\n\n* `CHANGELOG.md`\n* `crates/warp-core/src/braid_shell.rs`\n* `crates/warp-core/src/lib.rs`\n* `crates/warp-core/src/plurality_law.rs`\n* `crates/warp-core/src/sealed_membership.rs`\n* `crates/warp-core/src/witness.rs`\n* `crates/warp-core/tests/plurality_law_public_api_tests.rs`\n* `crates/warp-core/tests/witness_public_api_tests.rs`\n* `docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`\n* `docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\n* `docs/design/braids-and-strands-roadmap.md`\n\n

\n\n

\n\n\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Report collapse policies as collapse laws**\n\nWhen replaying a shell produced by `collapse_braid_shell(..., Some(CollapsePolicy { policy_id, .. }))`, the shell stores that same id in `outcome.collapse_policy`, but this line always wraps `shell.policy_id` as a `PluralityLawFamily::Settlement` law (and audit repeats the same mapping). Consumers of the new `law_ref`/`law_reading` will see a collapse-derived shell as a settlement-law reading instead of the named collapse law, so law authorization or audit can be performed against the wrong family.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject empty policy ids in settlement law refs**\n\n`PluralityLawRef::new` rejects all-zero law names, but this convenience constructor bypasses that validation and copies any `policy_id` directly into the law name. Since `BraidShell::assemble` accepts a raw `Hash` policy id, a caller can still retain/replay a shell whose `law_ref` has the forbidden all-zero name, making the new “named law” invariant inconsistent between direct law construction and braid replay/audit.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Do not promote integrity-only receipts to external posture**\n\nFor any custom backend or caller that returns a non-self `WitnessReceipt` with `WitnessAttestation::IntegrityOnly`, this fallback classifies the resulting `PluralityLawReading` as `ExternalWitness`, whose documentation says it is independent external evidence. That overstates the evidence posture merely because the receipt kind is not `SelfWitness`; either reject inconsistent receipts or derive this posture from the attestation strength.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent callers from minting self-witness overclaims**\n\nAlthough the simulator rejects `SelfWitness` requests for `StableV1`, this public receipt type/infallible constructor still lets any caller create `WitnessReceipt::new(WitnessKind::SelfWitness, ..., WitnessCompatibilityRule::StableV1, WitnessAttestation::IndependentAttestation)` or mutate equivalent public fields. In contexts that accept caller-supplied receipts, that bypasses the E1-scaffold boundary and reports local self-witness evidence as stable or independent.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind sealed presentations to their witness receipt**\n\nThis constructor accepts an arbitrary `witness_receipt` and then presents it as supporting the coordinate, purpose, authority, member commitment, and budget, but there is no digest check tying the receipt subject/evidence to those fields. A caller can therefore reuse a receipt from one purpose or braid coordinate in another `SealedMembershipPresentation`, undermining the purpose-bound capability claim made by this new public type.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `0ca9eb2c1c`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n| Severity | Source | File | Lines | Issue | Planned handling |\n|---|---|---|---:|---|---|\n| P2 | Self-audit, extension of existing Codex sealed-presentation thread | `crates/warp-core/src/sealed_membership.rs` | 54-66 | `SealedMembershipPresentation` fields are public, so constructor validation alone would still allow callers to mutate a validated presentation into an unbound receipt/field pairing. @codex please sanity-check this closure condition. | Make the presentation fields private, expose read-only accessors, and validate witness subject/evidence digests in the constructor. |\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Make sealed presentations immutable after construction**\n\nWhen a caller validates a `SealedMembershipPresentation` once and then stores or forwards it, this public receipt field (together with the adjacent public claim fields) lets external crates replace either side of the binding after validation, e.g. keep a receipt issued for one member commitment but swap in a different braid, purpose, or authority domain. That breaks the sealed-membership proof invariant and means constructor-side validation would not actually close the unbound receipt/field-pairing hole unless these fields are private with read-only accessors.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject unnamed settlement policy law refs**\n\nWhen a braid shell is assembled with the default/all-zero `policy_id` (the shell constructor and validator do not reject it), this helper bypasses `PluralityLawRef::new` and creates a settlement law whose name is `[0; 32]`. That violates the new named-law invariant and lets audit/replay, registry, and authorization surfaces carry an unnamed law despite `EmptyName` validation, so this path should be fallible or zero policy ids should be rejected before replay creates the law ref.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind law readings to the witnessed support digest**\n\nWhen a caller passes a `WitnessReceipt` whose `subject_digest` names different material than `support_digest`, this constructor still emits a witnessed `PluralityLawReading` with a normal evidence posture and digest. Downstream consumers can then treat support A as witnessed by a receipt issued for support B; since the braid audit path constructs matching digests, reject mismatched receipt subjects (or make the alternate subject derivation explicit) before accepting the reading.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent stable self-witness receipts from being minted**\n\nWhen external code uses this public constructor (or a custom backend returns its result), it can create `WitnessKind::SelfWitness` receipts with `StableV1` compatibility or `IndependentAttestation`, even though the simulator path now rejects stable self-witness requests. Those forged combinations are later consumed as ordinary receipts, so the self-witness scaffold can still overclaim stable or independent evidence unless this constructor rejects incompatible kind/compatibility/attestation pairs or is no longer the public minting path.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `0ca9eb2c1c`\n \n\n

ℹ️ About Codex in GitHub

\n## Activity Summary\n\n| # | Severity | Source | Area | Commit | Outcome |\n|---:|:---:|---|---|---|---|\n| 1 | P2 | PR | `witness.rs` self-witness overclaims | `3390bb5e` | Rejected stable/independent self-witness receipts; fields made read-only. |\n| 2 | P2 | PR | `plurality_law.rs` evidence posture | `57e47dcc` | Law readings derive posture from attestation strength. |\n| 3 | P2 | PR + Self | `sealed_membership.rs` presentation binding | `7c995864` | Presentations are immutable and validate receipt subject/evidence digests. |\n| 4 | P2 | PR | `plurality_law.rs` / `braid_shell.rs` empty policy refs | `89ec42dc` | Settlement policy refs and braid shell policy ids reject all-zero law names. |\n| 5 | P2 | PR | `braid_shell.rs` collapse law family | `d67b25cd` | Collapse-derived shells report collapse policy ids as collapse laws. |\n| 6 | P5 | PR | `braid_shell.rs` disclosure-budget test coverage | `116e491a` | Sealed-member audit test now asserts shell-level disclosure budget. |\n| 7 | P3 | PR | `plurality_law.rs` Law Card digest allocation | `aa04326c` | `hash_tag_vec` streams exact-size iterators without temporary `Vec` allocation. |\n| 8 | P2 | PR | `plurality_law.rs` law reading support binding | `bd18b984` | `PluralityLawReading::new` is fallible and rejects receipt/support digest mismatches. |\n\nResolved review threads: all 12 thread IDs currently returned by GraphQL are `isResolved: true`.\n\nLocal validation after the final commit:\n\n- `cargo test -p warp-core --lib`\n- `cargo test -p warp-core --test witness_public_api_tests`\n- `cargo test -p warp-core --test plurality_law_public_api_tests`\n- `cargo fmt --all -- --check`\n- `cargo clippy -p warp-core --lib -- -D warnings`\n- `cargo clippy -p warp-core --test witness_public_api_tests -- -D warnings`\n- `cargo clippy -p warp-core --test plurality_law_public_api_tests -- -D warnings`\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\n- `git diff --check origin/main...HEAD`\n- `scripts/check_spdx.sh`\n- `scripts/check-no-app-nouns-in-core.sh`\n\nPre-push hooks also reran the configured exact Rust slices and markdown formatting successfully.\n\n_⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Validation gap: `collapse_policy` in derived outcomes is not checked at assembly time.**\n\n`check_policy_id` validates only the main `policy_id` parameter. A shell with `policy_id = [0x5E; 32]` but `collapse_policy: Some([0; 32])` in its `Derived` outcome passes assembly and validation, then fails during replay/audit when `shell_law_ref` calls `PluralityLawRef::collapse_policy`.\n\nShells should fail fast at assembly, not during replay. Consider extending `check_outcome_law` to validate `collapse_policy` when present:\n\n

Proposed fix

\n\n```diff\n fn check_outcome_law(outcome: &BraidShellOutcome) -> Result<(), BraidShellError> {\n match outcome {\n BraidShellOutcome::Derived {\n+ collapse_policy: Some(policy),\n collapse_witness: Some(witness),\n ..\n- }\n- | BraidShellOutcome::Obstruction { witness, .. } => {\n+ } => {\n+ check_policy_id(*policy)?;\n WitnessDigest::new(*witness).map_err(|_| BraidShellError::EmptyWitness)?;\n }\n+ BraidShellOutcome::Obstruction { witness, .. } => {\n+ WitnessDigest::new(*witness).map_err(|_| BraidShellError::EmptyWitness)?;\n+ }\n _ => {}\n }\n Ok(())\n }\n```\n

\n\n\n\n\n\n\nAlso applies to: 1160-1169\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/braid_shell.rs` around lines 758 - 763, The\ncheck_policy_id function only validates the main policy_id parameter but ignores\nthe collapse_policy field in Derived outcomes, allowing shells with invalid\n(all-zeros) collapse_policy values to pass assembly-time validation and fail\nonly during replay. Extend the check_outcome_law function to validate the\ncollapse_policy field when it is present in a Derived outcome, ensuring it is\nnot all zeros similar to how check_policy_id validates the main policy_id, so\nthat invalid shells fail fast at assembly time rather than during replay/audit\noperations.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits bd18b98 to 9da73d6\n_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Add explicit coverage for `WitnessEvidenceMismatch` in sealed-membership validation.**\n\nLine 161 currently exercises only the subject-mismatch path. Add a dedicated negative test for mismatched evidence digest to lock down the second constructor error branch.\n\n\n\n\n\n\n

Suggested test addition

\n\n```diff\n #[test]\n fn public_sealed_membership_presentation_rejects_unbound_receipts() {\n@@\n }\n+\n+#[test]\n+fn public_sealed_membership_presentation_rejects_unbound_evidence() {\n+ let purpose = PresentationPurpose::new([0x44; 32]);\n+ let coordinate = BraidCoordinate([0xBC; 32]);\n+ let authority = authority_ref();\n+ let member_commitment = [0xA5; 32];\n+ let disclosure_budget = DisclosureBudget::CapabilityScoped;\n+\n+ let subject = SealedMembershipPresentation::witness_subject_digest(\n+ coordinate,\n+ purpose,\n+ authority,\n+ member_commitment,\n+ disclosure_budget,\n+ );\n+ let expected = SealedMembershipPresentation::witness_evidence_digest(\n+ coordinate,\n+ purpose,\n+ authority,\n+ member_commitment,\n+ disclosure_budget,\n+ );\n+ let receipt = WitnessReceipt::self_witness(subject, [0xEE; 32]);\n+\n+ assert_eq!(\n+ SealedMembershipPresentation::new(\n+ coordinate,\n+ purpose,\n+ authority,\n+ member_commitment,\n+ receipt,\n+ disclosure_budget,\n+ ),\n+ Err(SealedMembershipPresentationError::WitnessEvidenceMismatch {\n+ expected,\n+ actual: [0xEE; 32],\n+ })\n+ );\n+}\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n#[test]\nfn public_sealed_membership_presentation_rejects_unbound_receipts() {\n let purpose = PresentationPurpose::new([0x44; 32]);\n let coordinate = BraidCoordinate([0xBC; 32]);\n let authority = authority_ref();\n let member_commitment = [0xA5; 32];\n let disclosure_budget = DisclosureBudget::CapabilityScoped;\n let expected = SealedMembershipPresentation::witness_subject_digest(\n coordinate,\n purpose,\n authority,\n member_commitment,\n disclosure_budget,\n );\n let receipt = WitnessReceipt::self_witness([0xDE; 32], evidence_digest());\n\n assert_eq!(\n SealedMembershipPresentation::new(\n coordinate,\n purpose,\n authority,\n member_commitment,\n receipt,\n disclosure_budget,\n ),\n Err(SealedMembershipPresentationError::WitnessSubjectMismatch {\n expected,\n actual: [0xDE; 32],\n })\n );\n}\n\n#[test]\nfn public_sealed_membership_presentation_rejects_unbound_evidence() {\n let purpose = PresentationPurpose::new([0x44; 32]);\n let coordinate = BraidCoordinate([0xBC; 32]);\n let authority = authority_ref();\n let member_commitment = [0xA5; 32];\n let disclosure_budget = DisclosureBudget::CapabilityScoped;\n\n let subject = SealedMembershipPresentation::witness_subject_digest(\n coordinate,\n purpose,\n authority,\n member_commitment,\n disclosure_budget,\n );\n let expected = SealedMembershipPresentation::witness_evidence_digest(\n coordinate,\n purpose,\n authority,\n member_commitment,\n disclosure_budget,\n );\n let receipt = WitnessReceipt::self_witness(subject, [0xEE; 32]);\n\n assert_eq!(\n SealedMembershipPresentation::new(\n coordinate,\n purpose,\n authority,\n member_commitment,\n receipt,\n disclosure_budget,\n ),\n Err(SealedMembershipPresentationError::WitnessEvidenceMismatch {\n expected,\n actual: [0xEE; 32],\n })\n );\n}\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/tests/witness_public_api_tests.rs` around lines 160 - 190,\nThe current test public_sealed_membership_presentation_rejects_unbound_receipts\nonly exercises the WitnessSubjectMismatch error path of\nSealedMembershipPresentation::new. Add a new dedicated test function that\ncreates a WitnessReceipt with a correct subject digest but an incorrect evidence\ndigest (pass a different value than evidence_digest() to the self_witness call),\nthen verify that SealedMembershipPresentation::new returns the\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\ncomplete error-path coverage.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commit ba972f6\n_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n\n**Factual error: presentation fields are not read-only in the current implementation.**\n\nThe design doc claims \"the fields are read-only after construction,\" but `SealedMembershipPresentation` (in `sealed_membership.rs:109-127`) exposes all fields as `pub`, allowing direct field mutation after construction. This circumvents the constructor's validation and directly contradicts the PR objectives, which explicitly flag this as a P2 severity security issue requiring remediation via private fields + read-only accessors.\n\nEither update this to accurately describe the current state (public fields with validation closure gap) or reference the planned remediation explicitly; do not claim read-only semantics when they don't exist.\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn\n`@docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`\naround lines 92 - 94, The design document claims that fields in\nSealedMembershipPresentation are read-only after construction, but this is\nfactually incorrect since the current implementation exposes all fields as pub\nin sealed_membership.rs, allowing direct mutation after construction. Either\nupdate the document to accurately describe the current implementation state\n(public mutable fields with a validation closure gap) or explicitly reference\nthe planned remediation work that will address this security issue through\nprivate fields and read-only accessors. Do not assert read-only semantics that\ndo not currently exist in the code.\n```\n\n

\n\n\n\n\n\n\n**Actionable comments posted: 3**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
CHANGELOG.md (1)
\n> \n> `42-52`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Incomplete: GP4 CHANGELOG entry omits the known sealed-membership field-visibility gap.**\n> \n> The entry describes the validation that sealed presentations perform at construction time, which is accurate. However, it does not mention that the P2 severity issue remains unresolved: `SealedMembershipPresentation` fields are public and can be mutated after construction, circumventing the validation. The design doc (lines 92–94 of goalpost-04) incorrectly claims fields are read-only post-construction.\n> \n> Consider adding a note like \"Remediation of field-visibility constraints is planned as a follow-up\" to signal that the implementation is incomplete on the security boundary, or leave this to the design doc to state more clearly.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@CHANGELOG.md` around lines 42 - 52, The CHANGELOG entry for the warp-core\n> fourth goalpost describes the sealed membership presentation validation but\n> omits mention of the known P2 severity security gap where\n> SealedMembershipPresentation fields are public and can be mutated after\n> construction, circumventing the validation. Add a note to the CHANGELOG entry\n> acknowledging this known issue and indicating that remediation of\n> field-visibility constraints is planned as follow-up work to signal that the\n> security boundary implementation is incomplete.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn `@crates/warp-core/src/braid_shell.rs`:\n- Around line 758-763: The check_policy_id function only validates the main\npolicy_id parameter but ignores the collapse_policy field in Derived outcomes,\nallowing shells with invalid (all-zeros) collapse_policy values to pass\nassembly-time validation and fail only during replay. Extend the\ncheck_outcome_law function to validate the collapse_policy field when it is\npresent in a Derived outcome, ensuring it is not all zeros similar to how\ncheck_policy_id validates the main policy_id, so that invalid shells fail fast\nat assembly time rather than during replay/audit operations.\n\nIn `@crates/warp-core/tests/witness_public_api_tests.rs`:\n- Around line 160-190: The current test\npublic_sealed_membership_presentation_rejects_unbound_receipts only exercises\nthe WitnessSubjectMismatch error path of SealedMembershipPresentation::new. Add\na new dedicated test function that creates a WitnessReceipt with a correct\nsubject digest but an incorrect evidence digest (pass a different value than\nevidence_digest() to the self_witness call), then verify that\nSealedMembershipPresentation::new returns the\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\ncomplete error-path coverage.\n\nIn\n`@docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`:\n- Around line 92-94: The design document claims that fields in\nSealedMembershipPresentation are read-only after construction, but this is\nfactually incorrect since the current implementation exposes all fields as pub\nin sealed_membership.rs, allowing direct mutation after construction. Either\nupdate the document to accurately describe the current implementation state\n(public mutable fields with a validation closure gap) or explicitly reference\nthe planned remediation work that will address this security issue through\nprivate fields and read-only accessors. Do not assert read-only semantics that\ndo not currently exist in the code.\n\n---\n\nOutside diff comments:\nIn `@CHANGELOG.md`:\n- Around line 42-52: The CHANGELOG entry for the warp-core fourth goalpost\ndescribes the sealed membership presentation validation but omits mention of the\nknown P2 severity security gap where SealedMembershipPresentation fields are\npublic and can be mutated after construction, circumventing the validation. Add\na note to the CHANGELOG entry acknowledging this known issue and indicating that\nremediation of field-visibility constraints is planned as follow-up work to\nsignal that the security boundary implementation is incomplete.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `f75943ab-8448-4d5e-93a1-cc29fe36f0ac`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25 and aa04326cb919af45e76782a0b8d9954b42cbe385.\n\n

\n\n

📒 Files selected for processing (10)

\n\n

\n\n\n## Self-Code Review Findings\n\n@codex please confirm these findings against `bd18b984`.\n\n| Severity | File | Lines | Infraction | Evidence | Recommended agent prompt |\n|---|---|---:|---|---|---|\n| P1 High | `crates/warp-core/src/braid_shell.rs` | 521-605, 800-819, 1163-1171 | Collapse-derived shells can carry two different policy identities. | `BraidShell::assemble_with_proof` accepts top-level `policy_id` and `BraidShellOutcome::Derived { collapse_policy: Some(...) }` independently. `check_outcome_member_coherence` only checks that collapse fields are all present or absent, not that `collapse_policy == policy_id`. The new `shell_law_ref` then reports the nested `collapse_policy` as the law ref while `BraidShellReplay`/`BraidShellAudit` still expose the top-level `policy_id`, so a validated shell can claim policy A at the shell level and policy B as the named law. The current test at lines 2048-2059 already constructs such a mismatch: top-level `[0x5E; 32]` with nested `[0x77; 32]`, and `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent` passes. | Add a deterministic regression test that assembles a collapse-derived shell with mismatched top-level `policy_id` and nested `collapse_policy` and expects a typed error. Introduce a `BraidShellError` variant for incoherent collapse policy identity, reject the mismatch in both assembly and validation, and update existing tests to use matching identities unless intentionally exercising the error path. |\n| P5 Nit | `crates/warp-core/src/plurality_law.rs` | 123-139 | Rustdoc `# Errors` contract is incomplete. | `PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` at lines 133-135 and `ZeroVersion` at lines 136-138, but its `# Errors` docs only mention `ZeroVersion` at line 127. This is a public constructor in a newly exported API; incomplete error docs are drift. | Update the `PluralityLawRef::new` Rustdoc `# Errors` section to list both `EmptyName` for all-zero law names and `ZeroVersion` for version 0. |\n\nChecks run during review:\n\n- `git status --porcelain` clean before review\n- `git fetch origin`\n- `git diff --check origin/main...HEAD`\n- `cargo fmt --all -- --check`\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md docs/design/braids-and-strands-roadmap.md`\n- `scripts/check_spdx.sh`\n- `scripts/check-no-app-nouns-in-core.sh`\n- `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent`\n- `cargo clippy -p warp-core --lib -- -D warnings`\n\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject mismatched collapse policy ids**\n\nWhen a caller builds a collapse-derived shell with top-level `policy_id` A and nested `collapse_policy` B, validation only requires the collapse lineage fields to be all present, and this branch reports B as the `law_ref` while replay/audit still expose A as `policy_id`. That lets a retained shell validate and replay with two different policy identities; please reject collapse-derived shells whose nested collapse policy differs from `shell.policy_id`.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `bd18b984cb`\n \n\n

ℹ️ About Codex in GitHub

\n**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Document the empty-name error**\n\n`PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` for an all-zero law name before it checks the version, but the public `# Errors` contract only mentions `ZeroVersion`. Callers reading generated API docs will miss a typed failure case for this new exported constructor, so please include `EmptyName` in the error docs as well.\n\nUseful? React with 👍 / 👎.\n\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
crates/warp-core/src/plurality_law.rs (1)
\n> \n> `521-530`: _🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n> \n> **`PluralityLawAuthorization` public fields allow bypassing registry validation.**\n> \n> External code can construct this directly without calling `registry.authorize()`, creating forged authorization evidence. Same pattern as the P2 issue flagged for `SealedMembershipPresentation` in this PR.\n> \n> If the remediation plan (private fields + read-only accessors) applies here too, consider bundling it.\n> \n> \n> \n>
\n>
Proposed encapsulation
\n> \n> ```diff\n> /// Successful law authorization evidence.\n> #[derive(Clone, Copy, Debug, PartialEq, Eq)]\n> pub struct PluralityLawAuthorization {\n> - /// Authorized law reference.\n> - pub law_ref: PluralityLawRef,\n> - /// Digest of the registered Law Card.\n> - pub card_digest: Hash,\n> - /// Authority that authorized execution, if any.\n> - pub authorized_by: Option,\n> + law_ref: PluralityLawRef,\n> + card_digest: Hash,\n> + authorized_by: Option,\n> +}\n> +\n> +impl PluralityLawAuthorization {\n> + pub const fn law_ref(&self) -> PluralityLawRef { self.law_ref }\n> + pub const fn card_digest(&self) -> Hash { self.card_digest }\n> + pub const fn authorized_by(&self) -> Option { self.authorized_by }\n> }\n> ```\n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@crates/warp-core/src/plurality_law.rs` around lines 521 - 530, The public\n> fields on the PluralityLawAuthorization struct (law_ref, card_digest, and\n> authorized_by) allow external code to construct valid-looking authorization\n> evidence without going through the registry authorization process. Make these\n> three fields private instead of public, and add public getter methods for each\n> field that return the same types they currently expose. This ensures the struct\n> can only be properly instantiated through the intended registry.authorize() code\n> path, preventing forged authorization evidence from being created by external\n> callers.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nOutside diff comments:\nIn `@crates/warp-core/src/plurality_law.rs`:\n- Around line 521-530: The public fields on the PluralityLawAuthorization struct\n(law_ref, card_digest, and authorized_by) allow external code to construct\nvalid-looking authorization evidence without going through the registry\nauthorization process. Make these three fields private instead of public, and\nadd public getter methods for each field that return the same types they\ncurrently expose. This ensures the struct can only be properly instantiated\nthrough the intended registry.authorize() code path, preventing forged\nauthorization evidence from being created by external callers.\n```\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `2250b624-a5bc-4a38-86ef-6219d88df28e`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between aa04326cb919af45e76782a0b8d9954b42cbe385 and 9da73d6c9596c3f74add555aba8af978b5af3591.\n\n

\n\n

📒 Files selected for processing (5)

\n\n

\n\n",{},"created",1781697088.817851,"Completing the task","event_type","info",{"_92":436,"_96":93,"_431":2921},{"_92":856,"_857":858},"partial_repo_snapshot","files",[859,860,861],{"_161":1443,"_863":-5,"_864":1444,"_866":-5},{"_161":995,"_863":-5,"_864":996,"_866":-5},{"_161":862,"_863":-5,"_864":865,"_866":-5},"crates/warp-core/tests/witness_public_api_tests.rs","contents","line_range_contents",[867],"missing_reason",{"_868":869,"_870":871,"_431":872,"_873":59},"line_range_start",1,"line_range_end",273,[874,875,209,876,209,877,878,879,880,881,882,883,209,884,885,886,209,887,888,886,209,889,890,891,892,893,886,209,894,895,896,897,898,899,900,901,902,209,903,904,905,906,907,902,886,209,894,908,909,897,910,899,900,901,902,209,911,912,209,913,914,903,915,916,902,917,918,919,886,209,894,920,921,897,922,899,900,901,902,209,903,904,923,924,925,907,902,886,209,894,926,927,897,928,899,900,901,902,209,903,904,929,930,931,907,902,886,209,894,932,903,933,934,935,936,937,938,939,929,930,931,907,902,903,933,934,935,936,940,941,939,942,930,943,907,902,886,209,894,944,945,910,899,900,946,947,948,949,910,899,900,901,947,948,209,950,919,886,209,894,951,952,953,954,955,956,957,958,959,960,961,962,902,963,209,903,964,965,966,967,968,969,970,939,971,972,973,907,902,886,209,894,974,952,953,954,955,956,975,958,959,960,961,962,902,976,958,959,960,961,962,902,977,978,979,209,903,964,965,966,967,968,969,970,939,980,972,981,907,902,886,209,894,982,983,952,953,954,955,956,975,958,959,960,961,962,902,984,958,959,960,961,962,902,985,986,958,959,960,961,987,962,948,209,988,989,990,991,992,993,994,919,886],"contains_end_of_file","// SPDX-License-Identifier: Apache-2.0","// © James Ross Ω FLYING•ROBOTS ","//! External-consumer witness receipt public API checks.","use warp_core::{"," AuthorityDomainId, AuthorityDomainRef, BraidCoordinate, DisclosureBudget, OriginId,"," PresentationPurpose, SealedMembershipPresentation, SealedMembershipPresentationError,"," WitnessAttestation, WitnessBackend, WitnessBackendSimulator, WitnessCompatibilityRule,"," WitnessError, WitnessKind, WitnessReceipt, WitnessRejectionCode, WitnessRequest,"," WitnessSimulatorFixture,","};","fn subject_digest() -> [u8; 32] {"," [0xA1; 32]","}","fn evidence_digest() -> [u8; 32] {"," [0xE1; 32]","fn authority_ref() -> AuthorityDomainRef {"," AuthorityDomainRef::new("," OriginId::from_bytes([0x10; 32]),"," AuthorityDomainId::from_bytes([0x20; 32]),"," )","#[test]","fn public_witness_backend_reports_unsupported_kind_as_typed_error() {"," let backend = WitnessBackendSimulator::new(WitnessSimulatorFixture::UnsupportedWitnessFixture);"," let request = WitnessRequest::new("," WitnessKind::ZkVerifierReceipt,"," subject_digest(),"," evidence_digest(),"," WitnessCompatibilityRule::StableV1,"," );"," assert_eq!("," backend.verify(&request),"," Err(WitnessError::UnsupportedBackend {"," kind: WitnessKind::ZkVerifierReceipt,"," })","fn public_witness_simulator_returns_deterministic_fixture_receipts() -> Result<(), WitnessError> {"," let backend = WitnessBackendSimulator::new(WitnessSimulatorFixture::SignedWitnessFixture);"," WitnessKind::SignedWitness,"," let first = backend.verify(&request)?;"," let second = backend.verify(&request)?;"," assert_eq!(first, second);"," assert_eq!(first.kind(), WitnessKind::SignedWitness);"," first.attestation(),"," WitnessAttestation::IndependentAttestation"," assert_eq!(first.compatibility(), WitnessCompatibilityRule::StableV1);"," assert_eq!(first.digest(), second.digest());"," Ok(())","fn public_rejected_witness_fixture_is_typed() {"," let backend = WitnessBackendSimulator::new(WitnessSimulatorFixture::RejectedWitnessFixture);"," WitnessKind::ThresholdWitness,"," Err(WitnessError::BackendRejected {"," kind: WitnessKind::ThresholdWitness,"," reason: WitnessRejectionCode::Rejected,","fn public_self_witness_fixture_rejects_stable_identity_requests() {"," let backend = WitnessBackendSimulator::new(WitnessSimulatorFixture::SelfWitness);"," WitnessKind::SelfWitness,"," Err(WitnessError::UnsupportedCompatibility {"," kind: WitnessKind::SelfWitness,"," compatibility: WitnessCompatibilityRule::StableV1,","fn public_witness_receipt_rejects_self_witness_overclaims() {"," WitnessReceipt::new("," WitnessKind::SelfWitness,"," subject_digest(),"," evidence_digest(),"," WitnessCompatibilityRule::StableV1,"," WitnessAttestation::IntegrityOnly,"," ),"," WitnessCompatibilityRule::E1Scaffold,"," WitnessAttestation::IndependentAttestation,"," Err(WitnessError::UnsupportedAttestation {"," attestation: WitnessAttestation::IndependentAttestation,","fn public_witness_receipt_identity_binds_compatibility_rule() -> Result<(), WitnessError> {"," let scaffold = WitnessReceipt::new("," WitnessCompatibilityRule::E1Scaffold,"," WitnessAttestation::IndependentAttestation,"," )?;"," let stable = WitnessReceipt::new("," assert_ne!(scaffold.digest(), stable.digest());","fn public_sealed_membership_presentation_rejects_unbound_receipts() {"," let purpose = PresentationPurpose::new([0x44; 32]);"," let coordinate = BraidCoordinate([0xBC; 32]);"," let authority = authority_ref();"," let member_commitment = [0xA5; 32];"," let disclosure_budget = DisclosureBudget::CapabilityScoped;"," let expected = SealedMembershipPresentation::witness_subject_digest("," coordinate,"," purpose,"," authority,"," member_commitment,"," disclosure_budget,"," let receipt = WitnessReceipt::self_witness([0xDE; 32], evidence_digest());"," SealedMembershipPresentation::new("," coordinate,"," purpose,"," authority,"," member_commitment,"," receipt,"," disclosure_budget,"," Err(SealedMembershipPresentationError::WitnessSubjectMismatch {"," expected,"," actual: [0xDE; 32],","fn public_sealed_membership_presentation_rejects_wrong_evidence_digest() {"," let subject = SealedMembershipPresentation::witness_subject_digest("," let expected = SealedMembershipPresentation::witness_evidence_digest("," let wrong_evidence = [0xEF; 32];"," assert_ne!(expected, wrong_evidence);"," let receipt = WitnessReceipt::self_witness(subject, wrong_evidence);"," Err(SealedMembershipPresentationError::WitnessEvidenceMismatch {"," actual: wrong_evidence,","fn public_sealed_membership_presentation_uses_generic_purpose_and_budget(",") -> Result<(), SealedMembershipPresentationError> {"," let evidence = SealedMembershipPresentation::witness_evidence_digest("," let receipt = WitnessReceipt::self_witness(subject, evidence);"," let presentation = SealedMembershipPresentation::new("," receipt,"," assert_eq!(presentation.braid_coordinate(), coordinate);"," assert_eq!(presentation.purpose(), purpose);"," assert_eq!(presentation.purpose().purpose_id(), [0x44; 32]);"," assert_eq!(presentation.authority_domain(), authority);"," assert_eq!(presentation.member_commitment(), member_commitment);"," assert_eq!(presentation.disclosure_budget(), disclosure_budget);"," assert_eq!(presentation.witness_receipt(), receipt);","crates/warp-core/src/plurality_law.rs",[997],{"_868":869,"_870":998,"_431":999,"_873":59},736,[874,875,1000,209,1001,209,1002,1003,209,1004,1005,1006,1007,209,1008,1009,1010,1011,1012,209,1013,1014,1015,209,1016,1017,1018,1019,1020,1021,209,1022,1018,1023,1024,1025,1026,1027,1028,1021,209,1029,1018,1030,1031,1021,886,209,1032,1014,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,886,209,1049,1050,1018,1051,1052,1053,1054,1021,209,1055,1056,1057,1058,1059,1060,1061,1059,1062,1063,1059,1064,1065,1059,1066,1067,1059,1068,1069,1070,1059,1054,1021,886,209,1071,1072,1073,1074,1075,1076,1077,1078,1079,886,209,1080,1014,1081,1082,1083,1084,886,209,1085,1086,1087,1088,1087,1089,1090,1087,1091,1092,1093,1094,1095,1096,1097,1098,1054,1099,1100,1054,1101,1102,1103,1104,907,1021,209,1105,1087,1088,1087,1106,1107,1108,1109,1110,1111,1112,1113,1021,209,1114,1087,1088,1087,1106,1107,1115,1109,1116,1111,1112,1113,1021,209,1117,1018,1118,1119,1021,209,1120,1018,1121,1122,1021,209,1123,1018,1124,1125,1021,209,1126,1018,1127,1024,1128,1129,1130,1021,209,1055,1131,1132,1133,1021,886,209,1134,1014,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,886,209,1150,1151,1056,1152,1153,1154,1155,1156,1157,1158,1054,1021,886,209,1159,1014,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,886,209,1171,1151,1056,1172,1173,1174,1175,1176,1054,1021,886,209,1177,1014,1178,1179,1180,1181,1182,1183,1184,886,209,1185,1151,1056,1186,1187,1188,1054,1021,886,209,1189,1014,1190,1191,1192,1193,1194,886,209,1195,1151,1056,1196,1197,1054,1021,886,209,1198,1072,1199,1200,1201,1202,886,209,1203,1204,1205,1206,1207,1208,1209,1210,886,209,1211,1212,1087,1213,1214,1087,1088,1087,1215,1216,1092,1217,1218,1219,1220,1221,1222,1223,1224,1225,1054,1101,1226,1227,1228,1229,1230,907,1021,209,1231,1018,1232,1233,1021,209,1123,1018,1234,1235,1021,209,1236,1018,1237,1238,1021,209,1239,1018,1240,1241,1021,209,1242,1018,1243,1244,1021,209,1245,1018,1246,1247,1021,209,1248,1018,1249,1024,1250,1251,1252,1253,1254,1255,1256,1257,1258,1252,1253,1259,1258,1252,1253,1260,1255,1256,1261,1258,1262,1130,1021,886,209,1263,1264,1265,1266,1267,1268,1269,1217,1048,886,209,1270,1271,1272,1273,886,209,1274,1275,1018,1276,1277,1278,1054,1021,209,1279,1087,1088,1087,1280,1281,1282,1283,1284,1285,1054,1286,1287,1021,209,1288,1018,1289,1290,1021,209,1291,1018,1292,1293,1021,209,1294,1018,1295,1296,1021,209,1297,1087,1088,1087,1298,1299,1300,1301,1302,1217,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1059,1054,1322,1226,1323,1324,907,1021,886,209,1325,1326,1327,1328,1329,1330,1331,1332,1333,886,209,1334,1014,1335,1336,1337,1338,1339,886,209,1340,1151,1056,1341,1342,1054,1021,886,209,1343,1326,1344,1345,1346,1347,1329,1348,1349,886,209,1350,1351,1018,1092,1352,1217,1303,1353,1354,1277,1355,1226,1324,1054,1021,209,1356,1018,1127,1024,1357,1358,1251,1359,1130,1021,886,209,1360,1326,1361,1206,1362,1363,1210,1364,886,209,1365,1072,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1048,886,209,1376,1377,1087,1088,1087,1378,1379,1092,1217,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1054,1390,1101,1226,1391,1392,1230,970,907,1021,209,1393,1018,1394,1233,1021,209,1395,1018,1396,1397,1021,209,1398,1018,1399,1400,1021,209,1401,1018,1402,1247,1021,209,1403,1018,1404,1405,1021,209,1406,1018,1127,1024,1407,1251,1408,1409,1262,1410,1130,1021,886,209,1411,1412,1413,1414,1021,886,209,1415,1416,1417,1418,886,209,1419,1420,886,209,1421,1422,1423,1424,1021,886,209,1425,1426,1427,1428,1429,886,209,1430,1431,1432,1433,1434,1435,1021,886,209,1436,1437,1438,1439,1440,1441,1442,1021,886],"//! Named plurality law registry, cards, readings, and obstruction evidence.","use std::collections::BTreeMap;","use blake3::Hasher;","use thiserror::Error;","use crate::ident::Hash;","use crate::revelation::AuthorityDomainRef;","use crate::sealed_membership::DisclosureBudget;","use crate::witness::{WitnessAttestation, WitnessReceipt};","const LAW_NAME_DOMAIN: &[u8] = b\"echo.plurality-law.name.v1\\0\";","const LAW_REF_DOMAIN: &[u8] = b\"echo.plurality-law.ref.v1\\0\";","const LAW_CARD_DOMAIN: &[u8] = b\"echo.plurality-law.card.v1\\0\";","const LAW_READING_DOMAIN: &[u8] = b\"echo.plurality-law.reading.v1\\0\";","const LAW_OBSTRUCTION_DOMAIN: &[u8] = b\"echo.plurality-law.obstruction.v1\\0\";","/// Hash-backed plurality law name.","#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)]","pub struct PluralityLawName(Hash);","impl PluralityLawName {"," /// Constructs a law name from canonical bytes."," #[must_use]"," pub const fn from_bytes(bytes: Hash) -> Self {"," Self(bytes)"," }"," /// Derives a law name from a stable label."," pub fn from_label(label: &str) -> Self {"," let mut hasher = Hasher::new();"," hasher.update(LAW_NAME_DOMAIN);"," hash_len(&mut hasher, label.len());"," hasher.update(label.as_bytes());"," Self(hasher.finalize().into())"," /// Returns the canonical law-name bytes."," pub const fn as_bytes(&self) -> &Hash {"," &self.0","/// Plurality law family.","pub enum PluralityLawFamily {"," /// Settlement law family."," Settlement,"," /// Collapse law family."," Collapse,"," /// Conflict-preserving law family."," ConflictPreserving,"," /// Quorum law family."," Quorum,"," /// Authority law family."," Authority,"," /// Adapter-provided law family scoped to an authority-domain digest."," AdapterProvided {"," /// Digest of the authority domain that owns the adapter-provided law family."," authority_digest: Hash,"," },","impl PluralityLawFamily {"," /// Constructs an adapter-provided law family from an authority domain."," pub fn adapter_provided(authority: AuthorityDomainRef) -> Self {"," Self::AdapterProvided {"," authority_digest: authority_digest(authority),"," }"," fn hash_into(self, hasher: &mut Hasher) {"," match self {"," Self::Settlement => {"," hasher.update(&[0x01]);"," }"," Self::Collapse => {"," hasher.update(&[0x02]);"," Self::ConflictPreserving => {"," hasher.update(&[0x03]);"," Self::Quorum => {"," hasher.update(&[0x04]);"," Self::Authority => {"," hasher.update(&[0x05]);"," Self::AdapterProvided { authority_digest } => {"," hasher.update(&[0x06]);"," hasher.update(&authority_digest);","/// Error raised when constructing an invalid plurality law reference.","#[derive(Error, Clone, Copy, Debug, PartialEq, Eq)]","pub enum PluralityLawRefError {"," /// Law names must not be the all-zero digest."," #[error(\"plurality law name must be non-empty\")]"," EmptyName,"," /// Law versions start at 1."," #[error(\"plurality law version must be non-zero\")]"," ZeroVersion,","/// Name, family, and version for a plurality law.","pub struct PluralityLawRef {"," family: PluralityLawFamily,"," name: PluralityLawName,"," version: u32,","impl PluralityLawRef {"," /// Constructs a named, versioned plurality law reference."," ///"," /// # Errors"," /// Returns [`PluralityLawRefError::EmptyName`] when `name` is the all-zero"," /// digest."," /// Returns [`PluralityLawRefError::ZeroVersion`] when `version` is zero."," pub fn new("," family: PluralityLawFamily,"," name: PluralityLawName,"," version: u32,"," ) -> Result {"," if name.as_bytes().iter().all(|byte| *byte == 0) {"," return Err(PluralityLawRefError::EmptyName);"," if version == 0 {"," return Err(PluralityLawRefError::ZeroVersion);"," Ok(Self {"," family,"," name,"," version,"," /// Constructs the v1 settlement-law reference for an existing policy id."," /// Returns [`PluralityLawRefError::EmptyName`] when `policy_id` is the"," /// all-zero digest."," pub fn settlement_policy(policy_id: Hash) -> Result {"," Self::new("," PluralityLawFamily::Settlement,"," PluralityLawName::from_bytes(policy_id),"," 1,"," )"," /// Constructs the v1 collapse-law reference for an existing policy id."," pub fn collapse_policy(policy_id: Hash) -> Result {"," PluralityLawFamily::Collapse,"," /// Returns the law family."," pub const fn family(self) -> PluralityLawFamily {"," self.family"," /// Returns the law name."," pub const fn name(self) -> PluralityLawName {"," self.name"," /// Returns the law version."," pub const fn version(self) -> u32 {"," self.version"," /// Returns the canonical law reference digest."," pub fn digest(self) -> Hash {"," hasher.update(LAW_REF_DOMAIN);"," self.hash_into(&mut hasher);"," hasher.finalize().into()"," self.family.hash_into(hasher);"," hasher.update(self.name.as_bytes());"," hasher.update(&self.version.to_le_bytes());","/// Machine-readable requirement named by a plurality Law Card.","pub enum PluralityLawRequirement {"," /// The law requires member support pins."," SupportPins,"," /// The law requires the retained settlement frontier digest."," FrontierDigest,"," /// The law requires the posture floor."," PostureFloor,"," /// The law requires proof-envelope binding."," ProofBinding,"," /// The law requires witness receipt evidence."," WitnessReceipt,"," /// The law requires a capability presentation."," CapabilityPresentation,"," /// The law requires an explicit disclosure budget."," DisclosureBudget,","impl PluralityLawRequirement {"," const fn tag(self) -> u8 {"," Self::SupportPins => 0x01,"," Self::FrontierDigest => 0x02,"," Self::PostureFloor => 0x03,"," Self::ProofBinding => 0x04,"," Self::WitnessReceipt => 0x05,"," Self::CapabilityPresentation => 0x06,"," Self::DisclosureBudget => 0x07,","/// Machine-readable emission named by a plurality Law Card.","pub enum PluralityLawEmission {"," /// The law emits a plural artifact."," PluralArtifact,"," /// The law emits a derived shell."," DerivedShell,"," /// The law emits conflict residue."," ConflictResidue,"," /// The law emits obstruction evidence."," ObstructionEvidence,"," /// The law emits an audit reading."," AuditReading,","impl PluralityLawEmission {"," Self::PluralArtifact => 0x01,"," Self::DerivedShell => 0x02,"," Self::ConflictResidue => 0x03,"," Self::ObstructionEvidence => 0x04,"," Self::AuditReading => 0x05,","/// Machine-readable concealed material named by a plurality Law Card.","pub enum PluralityLawConcealment {"," /// The law conceals sealed member source chains."," SealedMemberSourceChain,"," /// The law conceals member blinding material."," MemberBlindingMaterial,"," /// The law conceals private member history."," PrivateMemberHistory,","impl PluralityLawConcealment {"," Self::SealedMemberSourceChain => 0x01,"," Self::MemberBlindingMaterial => 0x02,"," Self::PrivateMemberHistory => 0x03,","/// Evidence posture attached to plurality law execution.","pub enum PluralityLawEvidencePosture {"," /// Integrity-only evidence, including E1 self-witness scaffolding."," SelfWitnessIntegrityOnly,"," /// Independent external witness evidence."," ExternalWitness,","impl PluralityLawEvidencePosture {"," Self::SelfWitnessIntegrityOnly => 0x01,"," Self::ExternalWitness => 0x02,","/// Error raised when constructing an invalid Law Card.","pub enum PluralityLawCardError {"," /// A Law Card must name at least one emitted artifact or reading."," #[error(\"plurality Law Card must name at least one emission\")]"," MissingEmission,","/// Machine-readable Law Card.","#[derive(Clone, Debug, PartialEq, Eq)]","pub struct PluralityLawCard {"," law_ref: PluralityLawRef,"," requires: Vec,"," emits: Vec,"," conceals: Vec,"," evidence_posture: PluralityLawEvidencePosture,","impl PluralityLawCard {"," /// Constructs a machine-readable Law Card."," /// Requirements, emissions, and concealments are sorted and deduplicated so"," /// card identity does not depend on caller vector ordering."," /// Returns [`PluralityLawCardError::MissingEmission`] when the card names"," /// no emitted artifact, obstruction, or reading."," law_ref: PluralityLawRef,"," requires: Vec,"," emits: Vec,"," conceals: Vec,"," evidence_posture: PluralityLawEvidencePosture,"," ) -> Result {"," let emits = normalized(emits);"," if emits.is_empty() {"," return Err(PluralityLawCardError::MissingEmission);"," law_ref,"," requires: normalized(requires),"," emits,"," conceals: normalized(conceals),"," evidence_posture,"," /// Returns the law reference named by this card."," pub const fn law_ref(&self) -> PluralityLawRef {"," self.law_ref"," pub const fn version(&self) -> u32 {"," self.law_ref.version()"," /// Returns required evidence/support facts."," pub fn requires(&self) -> &[PluralityLawRequirement] {"," &self.requires"," /// Returns emitted artifact/reading classes."," pub fn emits(&self) -> &[PluralityLawEmission] {"," &self.emits"," /// Returns concealed material classes."," pub fn conceals(&self) -> &[PluralityLawConcealment] {"," &self.conceals"," /// Returns the evidence posture for this Law Card."," pub const fn evidence_posture(&self) -> PluralityLawEvidencePosture {"," self.evidence_posture"," /// Returns the canonical Law Card digest."," pub fn digest(&self) -> Hash {"," hasher.update(LAW_CARD_DOMAIN);"," self.law_ref.hash_into(&mut hasher);"," hash_tag_vec("," &mut hasher,"," self.requires"," .iter()"," .copied()"," .map(PluralityLawRequirement::tag),"," );"," self.emits.iter().copied().map(PluralityLawEmission::tag),"," self.conceals"," .map(PluralityLawConcealment::tag),"," hasher.update(&[self.evidence_posture.tag()]);","/// Registry errors raised while registering Law Cards.","#[derive(Error, Clone, Debug, PartialEq, Eq)]","pub enum PluralityLawRegistryError {"," /// A Law Card for this reference is already registered."," #[error(\"plurality law is already registered: {law_ref:?}\")]"," DuplicateLaw {"," /// Duplicate law reference.","/// Deterministic plurality law registry.","#[derive(Clone, Debug, Default, PartialEq, Eq)]","pub struct PluralityLawRegistry {"," cards: BTreeMap,","impl PluralityLawRegistry {"," /// Creates an empty plurality law registry."," pub const fn new() -> Self {"," Self {"," cards: BTreeMap::new(),"," /// Registers a Law Card."," /// Returns [`PluralityLawRegistryError::DuplicateLaw`] when a card with"," /// the same law reference is already registered."," pub fn register(&mut self, card: PluralityLawCard) -> Result<(), PluralityLawRegistryError> {"," let law_ref = card.law_ref();"," if self.cards.contains_key(&law_ref) {"," return Err(PluralityLawRegistryError::DuplicateLaw { law_ref });"," self.cards.insert(law_ref, card);"," Ok(())"," /// Returns a registered Law Card."," pub fn card(&self, law_ref: &PluralityLawRef) -> Option<&PluralityLawCard> {"," self.cards.get(law_ref)"," /// Returns the number of registered Law Cards."," pub fn len(&self) -> usize {"," self.cards.len()"," /// Returns true when the registry contains no Law Cards."," pub fn is_empty(&self) -> bool {"," self.cards.is_empty()"," /// Authorizes execution of a registered law."," /// Returns [`PluralityLawObstruction`] when the law is unsupported by this"," /// registry or when an adapter-provided law is not authorized by its"," /// owning authority domain."," pub fn authorize("," &self,"," authorized_by: Option,"," ) -> Result {"," let card = self.card(&law_ref).ok_or_else(|| {"," PluralityLawObstruction::new("," PluralityLawObstructionKind::UnsupportedLaw,"," law_ref,"," authorized_by,"," )"," })?;"," if let PluralityLawFamily::AdapterProvided {"," authority_digest: required_authority,"," } = law_ref.family()"," {"," if authorized_by.map(authority_digest) != Some(required_authority) {"," return Err(PluralityLawObstruction::new("," PluralityLawObstructionKind::UnauthorizedLaw,"," law_ref,"," authorized_by,"," ));"," Ok(PluralityLawAuthorization {"," card_digest: card.digest(),"," authorized_by,","/// Successful law authorization evidence.","#[derive(Clone, Copy, Debug, PartialEq, Eq)]","pub struct PluralityLawAuthorization {"," /// Authorized law reference."," pub law_ref: PluralityLawRef,"," /// Digest of the registered Law Card."," pub card_digest: Hash,"," /// Authority that authorized execution, if any."," pub authorized_by: Option,","/// Typed plurality law obstruction kind.","pub enum PluralityLawObstructionKind {"," /// The requested law is not registered."," UnsupportedLaw,"," /// The requested law exists but lacks required authority."," UnauthorizedLaw,","impl PluralityLawObstructionKind {"," Self::UnsupportedLaw => 0x01,"," Self::UnauthorizedLaw => 0x02,","/// Typed obstruction evidence for plurality law execution.","pub struct PluralityLawObstruction {"," /// Obstruction kind."," pub kind: PluralityLawObstructionKind,"," /// Law reference that could not execute."," /// Authority-domain digest that attempted to authorize execution, if any."," pub authorized_by: Option,","impl PluralityLawObstruction {"," /// Constructs typed law obstruction evidence."," kind: PluralityLawObstructionKind,"," ) -> Self {"," let authorized_by = authorized_by.map(authority_digest);"," kind,"," /// Returns the canonical obstruction digest."," hasher.update(LAW_OBSTRUCTION_DOMAIN);"," hasher.update(&[self.kind.tag()]);"," hash_optional_digest(&mut hasher, self.authorized_by);","/// Witnessed plurality law reading identity.","pub struct PluralityLawReading {"," support_digest: Hash,"," witness_receipt: WitnessReceipt,"," disclosure_budget: DisclosureBudget,","/// Error raised when constructing an invalid plurality law reading.","pub enum PluralityLawReadingError {"," /// The witness receipt names different support than the reading."," #[error("," \"plurality law reading witness subject mismatch: expected {expected:?}, actual {actual:?}\""," )]"," WitnessSubjectMismatch {"," /// Support digest claimed by the reading."," expected: Hash,"," /// Subject digest named by the witness receipt."," actual: Hash,","impl PluralityLawReading {"," /// Constructs a witnessed plurality law reading."," /// Returns [`PluralityLawReadingError::WitnessSubjectMismatch`] when the"," /// witness receipt subject does not match the retained support digest."," support_digest: Hash,"," witness_receipt: WitnessReceipt,"," disclosure_budget: DisclosureBudget,"," ) -> Result {"," let actual = witness_receipt.subject_digest();"," if actual != support_digest {"," return Err(PluralityLawReadingError::WitnessSubjectMismatch {"," expected: support_digest,"," actual,"," });"," let evidence_posture = evidence_posture_for(witness_receipt);"," support_digest,"," witness_receipt,"," /// Returns the law reference used for this reading."," pub const fn law_ref(self) -> PluralityLawRef {"," /// Returns the retained support digest interpreted by the law."," pub const fn support_digest(self) -> Hash {"," self.support_digest"," /// Returns the witness receipt supporting this reading."," pub const fn witness_receipt(self) -> WitnessReceipt {"," self.witness_receipt"," /// Returns the evidence posture for this reading."," pub const fn evidence_posture(self) -> PluralityLawEvidencePosture {"," /// Returns the disclosure budget for this reading."," pub const fn disclosure_budget(self) -> DisclosureBudget {"," self.disclosure_budget"," /// Returns the canonical law reading digest."," hasher.update(LAW_READING_DOMAIN);"," hasher.update(&self.support_digest);"," hasher.update(&self.witness_receipt.digest());"," hasher.update(&[disclosure_budget_tag(self.disclosure_budget)]);","fn evidence_posture_for(receipt: WitnessReceipt) -> PluralityLawEvidencePosture {"," match receipt.attestation() {"," WitnessAttestation::IntegrityOnly => PluralityLawEvidencePosture::SelfWitnessIntegrityOnly,"," WitnessAttestation::IndependentAttestation => PluralityLawEvidencePosture::ExternalWitness,","fn normalized(mut values: Vec) -> Vec {"," values.sort();"," values.dedup();"," values","fn hash_len(hasher: &mut Hasher, len: usize) {"," hasher.update(&(len as u64).to_le_bytes());","fn hash_tag_vec(hasher: &mut Hasher, tags: impl ExactSizeIterator) {"," hash_len(hasher, tags.len());"," for tag in tags {"," hasher.update(&[tag]);","fn authority_digest(authority: AuthorityDomainRef) -> Hash {"," let mut hasher = Hasher::new();"," hasher.update(authority.origin_id.as_bytes());"," hasher.update(authority.domain_id.as_bytes());"," hasher.finalize().into()","fn hash_optional_digest(hasher: &mut Hasher, digest: Option) {"," if let Some(digest) = digest {"," hasher.update(&[0x01]);"," hasher.update(&digest);"," } else {"," hasher.update(&[0x00]);","const fn disclosure_budget_tag(budget: DisclosureBudget) -> u8 {"," match budget {"," DisclosureBudget::Public => 0x01,"," DisclosureBudget::AuthorityScoped => 0x02,"," DisclosureBudget::CapabilityScoped => 0x03,"," DisclosureBudget::HolderOnly => 0x04,"," DisclosureBudget::ZeroKnowledge => 0x05,","crates/warp-core/src/braid_shell.rs",[1445],{"_868":869,"_870":1446,"_431":1447,"_873":59},2549,[874,875,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1449,1458,1459,1460,1461,1462,209,1002,209,1463,1004,1464,1465,1466,1467,883,1006,1468,1469,1470,209,1471,1472,1473,1474,1475,209,1476,1477,1478,1479,1480,209,1481,1326,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,886,209,1492,1151,1056,1493,1494,1495,1496,1054,1021,886,209,1497,1014,1498,1499,1500,1501,1502,1503,1504,1505,1506,1048,886,209,1507,1508,1509,1018,1510,1511,1512,1513,1514,1024,1515,1516,1517,1518,1130,1021,209,1519,1520,1018,1521,1302,1522,1523,1524,1525,1526,1056,1527,1528,1529,1530,1531,1532,1533,1059,1054,1021,209,1534,1535,1021,209,1536,1018,1537,1056,1538,1539,1054,1021,209,1540,1541,1542,1056,1543,1544,1059,1528,1529,1545,1531,1546,1547,1548,1059,1054,1021,886,209,1549,1204,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,886,209,1569,1570,1018,1571,1024,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1130,1021,886,209,1582,1477,1583,1584,1204,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1048,1596,1597,1598,1599,1048,1600,1601,1602,1603,1048,1604,1605,1606,1607,1608,1609,1610,1611,1048,886,209,1612,1613,1018,1614,1056,1615,1616,1617,1618,1054,1021,209,1619,1056,1620,1621,1622,1623,1624,1531,1625,1626,1627,1628,1629,1630,1631,1632,1059,1633,1634,1635,1636,1637,1629,1059,1638,1639,1640,1641,1059,1642,1643,1644,1645,1531,1646,1647,1648,1649,1059,1054,1021,886,209,1650,1651,1652,1653,886,209,1654,1655,1656,1657,1658,1054,1659,1660,1054,1021,886,209,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1048,1675,1676,1677,1678,1679,1680,1681,1048,1682,1683,1684,1685,1679,1686,1681,1048,1687,1688,1689,1690,1691,1048,1692,1693,1694,1695,1696,1697,1698,1699,1048,1700,1701,1702,1703,1699,1048,1704,1705,1706,1707,1708,1709,1710,1048,1711,1712,1713,1714,1715,1716,1717,1718,1719,1720,1721,1722,1723,1048,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1048,1738,1739,1740,1741,1742,1743,1744,1745,1048,1746,1747,1748,1749,1750,1048,1751,1752,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1048,886,209,1763,1477,1764,1765,1766,1767,209,1768,1769,1024,1770,1771,1772,1773,1774,1054,1775,1028,1021,886,209,1776,1204,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1087,1793,1794,1795,1796,1797,1798,1799,1568,1800,1801,1802,1803,886,209,1804,1805,1806,1087,1088,1087,1807,1808,1809,1810,1811,1812,1813,1814,1815,1816,1817,1818,1819,1820,1821,1822,1823,1721,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1113,1021,209,1835,1836,1837,1838,1839,1087,1088,1087,1840,1841,1842,1821,1822,1843,1721,1844,1825,1845,1826,1846,1847,1054,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,1858,1859,1860,1861,1862,1863,1059,1054,1864,1865,1866,1315,1867,1054,1868,209,1869,1870,1871,1872,1873,1874,1875,1876,1877,1828,1878,1879,1831,1880,1833,1258,209,1881,1882,1883,1059,1054,1884,209,1885,1877,1828,1878,1879,1831,1880,1886,1833,1887,1258,1101,1888,965,1828,1829,1830,1831,1832,1886,1833,1889,1890,907,1021,209,1891,1087,1088,1087,1892,1893,1894,1895,1896,1897,1898,1899,1900,1901,1902,1903,1389,1054,1904,1847,1054,1905,1906,1907,1908,1909,1910,1872,1873,1874,1911,1912,1054,1913,1914,1915,1916,1059,1856,1857,1858,1859,1860,1861,1862,1863,1059,1054,1917,1918,1919,1920,1921,1867,1054,1922,1923,1315,1924,1054,209,1925,1926,1927,1928,1879,1929,1930,1919,1258,1931,1932,1933,1934,1389,1054,1935,1936,1883,1059,1054,1937,209,1885,1926,1927,1928,1879,1929,1930,1938,1919,1887,1258,1939,1940,1941,1942,1389,1054,1287,1021,209,1613,1018,1943,1944,1021,209,1945,1018,1946,1947,1948,1949,907,1021,209,1950,1951,1018,1952,1302,1522,1523,1524,1525,1526,1953,1954,1955,1956,1545,1957,1310,907,1021,886,209,1958,1959,1960,1961,1962,1963,1964,1054,1965,1966,1054,1967,1021,919,886,209,1968,1969,1970,1021,919,886,209,1971,1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982,1983,1389,1054,1021,919,886,209,1984,1985,1986,1987,1988,1872,1989,1315,1990,1054,1021,1991,1992,1993,1994,1995,1389,1054,1021,919,886,209,1996,1973,1997,1974,1998,1999,2000,2001,1999,2002,2003,1962,2004,2005,2006,1964,2007,2008,2009,2010,2011,2012,2013,2014,1860,2015,1059,2016,2017,2018,1054,2019,2020,2021,2022,2023,1287,1434,2024,2025,907,1021,886,209,2026,2027,2028,1084,2029,2030,2031,1972,1973,2032,2033,2034,2035,2036,2037,2038,2039,1021,2040,2041,2042,886,209,2026,2043,1084,2029,2030,2031,1972,1973,2032,2044,1426,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,902,1429,886,209,2026,2055,1084,2029,2030,2031,1972,1973,2056,2032,2057,2044,1426,2058,2046,2047,2048,2049,2050,2051,2052,2053,2054,902,2059,2060,2061,2062,2063,1054,1659,2064,1054,1021,1429,886,209,2065,1477,2066,2067,2068,2069,2070,2071,886,209,2072,2073,2074,1021,886,209,2075,1204,2076,2077,2078,2079,2080,2081,1789,2082,1329,2083,1798,2084,1568,886,209,2085,1326,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2096,2097,1048,886,209,2098,1326,2099,2100,2101,2102,2103,1699,1048,886,209,2104,1326,2105,2106,1552,2107,1564,2108,1568,1553,1554,1555,1556,2109,1558,2110,1560,2111,1562,2112,1566,2113,2114,886,209,2115,1204,2116,2117,2118,1780,1781,2077,2078,2081,1789,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,2134,886,209,2135,1477,2136,2137,2138,2139,2140,1477,2141,1477,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,1910,1872,2153,2154,2155,2156,2157,2158,2159,886,209,2160,1477,2161,2162,2163,2164,1477,2141,1477,2142,2143,2165,2145,2146,2166,2148,2167,2168,1999,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,1059,2180,2181,2149,2182,2156,2183,2184,2185,948,209,2186,2187,2188,2151,2155,2189,2190,2191,2192,1910,1872,2193,2154,2194,1910,1872,2195,1995,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2154,2206,2207,2208,2209,2184,2159,886,209,2210,2211,2212,2213,1021,886,209,2214,2215,2168,1999,2216,1979,2217,1434,2218,1021,886,209,2219,2220,1962,2221,1964,2222,2223,1021,2224,886,209,2225,2145,2226,2227,2228,2229,2230,2231,2232,2233,2234,2235,2180,1021,2236,1962,2237,1964,1054,2238,2239,1964,2240,2241,2022,2242,2243,2244,2245,2246,2247,2248,2249,2250,2251,2252,1389,1054,1021,2253,886,209,2254,2255,209,2256,2257,209,2258,1326,2259,2260,1789,2261,2262,886,209,2263,1204,2264,2265,2266,2267,2268,886,209,2269,1477,2270,2271,2272,2273,2274,1477,2275,2276,1477,2141,1477,2277,2278,2279,2146,2280,2281,2282,2283,2284,2285,2286,2287,1311,2288,2289,2290,2291,2180,1021,209,2292,2293,2294,2295,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2306,1021,209,2307,2308,2309,2310,2311,2312,2313,2314,2315,2316,2317,2318,2319,2320,2209,2321,948,2322,886,209,2323,1477,2324,2325,1326,2326,2327,2328,2329,2330,886,209,2331,2332,2333,2334,2335,2336,886,209,2337,2338,2339,1021,209,2340,2341,1021,886,209,2342,209,2343,2338,2344,1021,209,2345,2346,2347,2348,2349,2350,2351,2352,2340,1024,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,2370,1629,2371,2372,1629,1059,2373,2374,2375,2376,1059,2377,2378,2379,2380,2381,2368,2382,2383,2384,2385,2386,2387,2388,2389,1629,2371,2372,1629,1059,2390,2391,2392,2393,2394,2395,1059,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2407,1629,2410,2411,1059,1054,2412,2413,1130,1021,886,209,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,886,209,2425,2426,2427,2428,2429,2430,2431,2432,1021,886,209,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,886,209,1804,2448,1018,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2205,2454,2465,2466,2467,1021,886,209,2468,2469,2470,2471,2472,2473,2474,209,2475,2476,1021,209,2477,2478,2479,2480,2481,1054,1021,209,2482,2483,2484,2485,2486,2487,2488,2489,2490,2491,2492,1054,1021,209,2493,2494,2495,2496,1113,1021,209,2497,2498,1506,2499,2500,2501,2483,2502,2503,1545,2303,2485,2486,2487,2488,2504,2490,2491,2492,1054,1021,209,2505,2506,2507,2508,1830,2509,2510,2511,2303,2512,1113,2513,1021,209,2514,209,2515,2516,2517,2518,2519,2520,2521,1310,1054,1021,209,2522,2523,2524,1054,1021,209,2525,2526,2527,2528,2529,2530,209,2531,2532,1021,209,2525,2533,2534,209,2535,2536,2537,2538,2539,2540,1910,1872,2153,1874,2541,209,2542,2543,2544,2545,2546,2547,2548,1258,2549,1021,209,2525,2550,2551,2552,2553,2554,209,2555,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,2559,2560,2561,2562,2563,2564,2507,2508,1830,2509,2510,2511,2303,2512,2565,1113,2558,2539,2566,2567,2568,2541,209,2569,209,2570,2571,2546,2572,2548,1258,2573,2546,2574,2575,1258,2546,2576,2577,1258,2578,2579,2580,2546,2581,2582,2583,2584,2585,2586,2587,2588,2589,2590,2591,2592,2593,1258,2546,2594,2176,2595,2596,2597,1059,1258,2546,2598,2599,2600,1059,1258,2601,2602,2603,2546,2604,2605,1258,2546,2606,2607,1258,1021,209,2525,2608,2553,209,2609,2610,2611,2612,2613,2614,2539,2541,209,2569,209,2615,2616,2617,2618,2619,2546,2620,2621,1258,2546,2576,2621,1258,1021,209,2525,2622,2623,2539,209,2624,2625,2626,2627,2628,2629,209,2630,2631,2616,2632,2633,2634,2635,2619,209,2636,2637,2616,2638,2639,2619,209,2640,2641,2642,2563,2643,1021,209,2525,2644,2645,2646,2647,1021,209,2525,2648,2649,2507,2508,2650,2651,2298,2652,2653,2654,2655,2303,2512,1258,2656,1021,209,2525,2657,2649,2507,2508,2658,2509,2659,2660,2661,2662,2303,2512,1258,2656,1021,209,2525,2663,2649,2507,2508,2664,2665,2510,2511,2303,2512,1258,209,2666,1021,209,2525,2667,2649,2507,2508,2664,2509,2510,2668,2303,2512,1258,2546,2669,2670,2671,2205,1258,1021,209,2525,2672,2673,2674,2649,2507,2508,2675,2509,2510,2511,2303,2512,1258,2546,2669,2676,2677,2205,1258,1021,209,2525,2678,2679,2649,2507,2508,2680,2681,2682,2683,2684,2685,2686,2681,2682,2687,2684,2688,2686,2689,2509,2510,2511,2303,2512,1258,209,2690,1021,209,2525,2691,2649,2507,2508,2680,2692,2681,2693,2683,2684,2688,2686,2689,2509,2510,2511,2303,2512,1258,209,2694,1021,209,2525,2695,2696,2697,2698,209,2699,2700,2701,2702,2563,2703,2704,2705,2701,2706,2563,2707,209,2708,2709,2699,2710,2701,2711,2563,2712,2713,2714,1021,209,2525,2715,2623,2716,2717,2718,2719,2720,2721,2718,2719,1021,209,2525,2722,2649,2507,2508,2664,2509,2510,2511,2303,2723,1258,2616,2669,2724,2619,1021,209,2525,2725,2649,2507,2508,2650,2509,2510,2511,2303,2512,1258,2546,2669,2726,2727,2205,1258,1021,209,2525,2728,2696,2697,2293,2507,2508,2650,2651,2298,2652,2653,2729,2730,2303,2512,1113,2558,2731,209,2732,2733,2734,209,2735,2546,2736,2737,2738,2205,1258,1021,209,2525,2739,2696,2697,209,2546,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,2751,2752,2753,2754,2755,2205,1258,1021,209,2525,2756,2645,2757,2546,2758,2759,2760,1903,2205,1258,1021,209,2525,2761,2762,2763,2507,2508,2557,2509,2510,2764,2303,2512,1113,2558,2765,2507,2508,1830,2509,2510,2766,2303,2512,1113,2558,2531,209,2767,2768,2769,2563,2546,2770,2771,1258,1021,209,2772,2773,2774,2775,209,2525,2776,2777,209,2696,2697,2778,2779,209,2780,2781,2782,2563,2783,2784,2701,2785,2563,209,2546,2786,2298,2652,2653,2787,2730,1059,1258,2788,209,2789,2790,2791,2734,2792,2793,2546,2794,2795,1258,1021,209,2525,2796,2696,2697,2779,209,2699,2700,2701,2702,2563,209,2797,2798,2706,2563,2799,2800,1021,209,2525,2801,2623,2802,2803,1021,209,2525,2804,2623,209,2805,2716,2717,2806,2807,2808,2809,2810,2719,2720,2811,2718,2719,2720,2812,2718,2719,1021,209,2525,2813,2814,2815,2816,2817,2818,2609,2819,2820,2612,2821,2614,209,2822,2823,2824,2825,2826,2827,2619,2828,2824,2825,2829,2827,2619,2720,2830,2718,2719,2716,2831,1955,1956,1530,1957,2832,2718,2719,2833,2834,2835,1955,1956,1530,1957,1059,1258,2836,2837,1021,209,2525,2838,2839,209,2762,209,2840,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,2841,2842,2843,209,2844,2845,2560,2561,2846,2563,209,2847,2507,2508,2557,2509,2510,2511,2303,2512,2848,1113,2558,2849,2850,2851,2852,2853,1258,209,2854,2855,2856,2857,1054,2616,2858,2859,2619,209,2860,2861,2560,2561,2862,2563,2863,2507,2508,2557,2509,2510,2511,2303,2512,2864,1258,2616,2865,2866,2867,2868,2869,2750,2870,2619,209,2871,2872,2560,2873,2846,2563,2874,2507,2508,1830,2509,2510,2511,2303,2512,2875,1258,2616,2876,2866,2877,2205,2619,1021,209,2525,2878,2839,209,2762,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,209,2879,2880,2741,2742,2881,2744,2882,2883,2750,2751,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,1054,1021,209,2525,2896,2897,2898,2899,2900,209,2901,2902,2903,2904,2563,209,2905,2906,2824,2907,2826,2827,2619,209,2908,2909,2824,2907,2826,2827,2619,209,2910,2911,2912,2913,2907,2826,2827,2619,209,2914,2915,2912,2824,2916,2826,2827,2619,209,2917,2912,2824,2907,2918,2827,2619,209,2919,2912,2824,2907,2826,2920,2619,1021,886],"//! θ_braid — retained braid-scale settlement boundary shells.","//!","//! A braid shell is not a note that plurality happened. It is the retained","//! holographic boundary that makes a braid-scope settlement outcome","//! replayable **without reopening member strand histories** (AIΩN Paper VII","//! Prop 3.5; design packet 0026). The shell binds basis + members + member","//! verdicts + policy + outcome + witness with domain-separated digests, and","//! [`replay_braid_shell`] reproduces the outcome from shell records alone —","//! its signature offers no path to strand histories, so rematerialization is","//! a type error, not a temptation.","//! Hierarchy (E1a doctrine): `PluralAlternative` is per-entry residue;","//! θ_braid is the plural settlement boundary; the `BraidShell` is the","//! replayable outcome. Shells are append-only: a later collapse emits a new","//! `Derived` shell referencing its plural parent through `collapsed_from`;","//! it never rewrites the plural shell.","use crate::admission::AdmissionOutcomeKind;","use crate::plurality_law::{PluralityLawReading, PluralityLawReadingError, PluralityLawRef};","use crate::provenance_store::ProvenanceRef;","use crate::revelation::{"," shell_posture_obstruction, AuthorityDomainRef, CausalPosture, PostureObstruction, WitnessDigest,","use crate::strand::StrandId;","use crate::witness::WitnessReceipt;","use crate::worldline::WorldlineId;","const SHELL_DOMAIN: &[u8] = b\"echo.shell.braid.v1\\0\";","const MEMBER_DOMAIN: &[u8] = b\"echo.braid.member.v1\\0\";","const WITNESS_DOMAIN: &[u8] = b\"echo.braid.witness.v1\\0\";","const COORDINATE_DOMAIN: &[u8] = b\"echo.braid.coordinate.v1\\0\";","const SEALED_MEMBER_DOMAIN: &[u8] = b\"echo.braid.member.sealed.v1\\0\";","/// Current braid shell body version.","///","/// Version 2 binds the optional proof-envelope digest marker into shell","/// identity. Version 1 proofless shells used the pre-proof digest body.","pub const BRAID_SHELL_VERSION: u32 = 2;","/// Compact settlement verdict for one braid member.","pub enum MemberVerdict {"," /// Every claim from this member was imported."," Derived,"," /// At least one claim from this member remained lawfully plural."," Plural,"," /// At least one claim from this member became conflict residue and none"," /// remained plural."," Conflict,"," /// The member's claims were obstructed before judgment completed."," Obstructed,","impl MemberVerdict {"," Self::Derived => 1,"," Self::Plural => 2,"," Self::Conflict => 3,"," Self::Obstructed => 4,","/// Reference to a braid member, supporting both revealed and sealed references.","pub enum BraidMemberRef {"," /// Publicly revealed strand identity."," Revealed(StrandId),"," /// Sealed member reference."," Sealed {"," /// Domain-separated commitment digest of the member's identity."," blinded_commitment: Hash,"," /// Causal authority domain controlling the private history."," authority: AuthorityDomainRef,","impl BraidMemberRef {"," /// Computes the commitment for a sealed reference using caller-supplied"," /// non-public blinding material."," pub fn seal("," strand_id: StrandId,"," child_worldline_id: WorldlineId,"," blinding_secret: Hash,"," ) -> Hash {"," hasher.update(SEALED_MEMBER_DOMAIN);"," hasher.update(&blinding_secret);"," hasher.update(child_worldline_id.as_bytes());"," hasher.update(strand_id.as_bytes());"," /// Returns whether this sealed member reference matches the given strand"," /// ID, child worldline ID, authority, and blinding material."," pub fn matches_strand("," strand_id: &StrandId,"," child_worldline_id: &WorldlineId,"," authority: &AuthorityDomainRef,"," blinding_secret: &Hash,"," ) -> bool {"," Self::Revealed(_) => false,"," Self::Sealed {"," blinded_commitment,"," authority: member_authority,"," } => {"," let expected = Self::seal(*strand_id, *child_worldline_id, *blinding_secret);"," member_authority == authority && *blinded_commitment == expected"," const fn is_sealed(self) -> bool {"," matches!(self, Self::Sealed { .. })"," /// Stable wire tag for canonical serialization."," pub fn canonical_tag(self) -> u8 {"," Self::Revealed(_) => 0x01,"," Self::Sealed { .. } => 0x02,"," /// Hash this member reference into the given hasher."," pub fn hash_into(self, hasher: &mut Hasher) {"," hasher.update(&[self.canonical_tag()]);"," Self::Revealed(strand_id) => {"," hasher.update(strand_id.as_bytes());"," authority,"," hasher.update(&blinded_commitment);"," hasher.update(authority.origin_id.as_bytes());"," hasher.update(authority.domain_id.as_bytes());","/// One member entry in a braid shell: compact replay facts, never history.","pub struct BraidShellMember {"," /// Reference to the member strand, which may be revealed or sealed."," pub member_ref: BraidMemberRef,"," /// Digest over the member's support-pin set."," pub support_pin_digest: Hash,"," /// Digest over the member's fork basis facts."," pub basis_digest: Hash,"," /// Digest over the realized parent frontier the member was judged against."," pub frontier_digest: Hash,"," /// Digest over the contended footprint slots."," pub footprint_digest: Hash,"," /// Digest over the member's ordered claim identities."," pub claim_digest: Hash,"," /// Compact settlement verdict for the member."," pub verdict: MemberVerdict,"," /// Digest over the member's ordered per-claim decisions."," pub verdict_digest: Hash,"," /// Revelation posture carried by the member's claims."," pub posture: CausalPosture,","impl BraidShellMember {"," /// Canonical content digest for this member."," pub fn member_digest(&self) -> Hash {"," hasher.update(MEMBER_DOMAIN);"," self.member_ref.hash_into(&mut hasher);"," hasher.update(&self.support_pin_digest);"," hasher.update(&self.basis_digest);"," hasher.update(&self.frontier_digest);"," hasher.update(&self.footprint_digest);"," hasher.update(&self.claim_digest);"," hasher.update(&[self.verdict.tag()]);"," hasher.update(&self.verdict_digest);"," hasher.update(&[self.posture.canonical_tag()]);","/// Braid-shell outcome over the shared lawful algebra.","/// Collapse is a witnessed transition, never a fifth arm: a collapse emits a","/// new `Derived` shell whose `collapsed_from` references the plural parent.","pub enum BraidShellOutcome {"," /// A single lawful result was derived."," Derived {"," /// Target-worldline refs realized by the derivation."," result_refs: Vec,"," /// Collapse policy when this derivation collapsed retained plurality."," collapse_policy: Option,"," /// Witness for the explicit collapse act, when applicable."," collapse_witness: Option,"," /// Plural parent shell this derivation collapsed, when applicable."," collapsed_from: Option,"," /// Multiple lawful alternatives remain retained."," Plural {"," /// Stable plural artifact ids of the retained alternatives."," alternative_ids: Vec,"," /// The settlement produced explicit conflict residue."," Conflict {"," /// Deterministic per-claim conflict reason codes in claim order."," reason_codes: Vec,"," /// The settlement act was obstructed before judgment completed."," Obstruction {"," /// Deterministic obstruction reason code."," reason_code: u8,"," /// Witness digest for the obstruction."," witness: Hash,"," /// Shell whose transition this obstruction refused, when applicable."," obstructed_from: Option,","impl BraidShellOutcome {"," /// Maps the shell outcome onto Echo's shared lawful outcome family."," pub fn kind(&self) -> AdmissionOutcomeKind {"," Self::Derived { .. } => AdmissionOutcomeKind::Derived,"," Self::Plural { .. } => AdmissionOutcomeKind::Plural,"," Self::Conflict { .. } => AdmissionOutcomeKind::Conflict,"," Self::Obstruction { .. } => AdmissionOutcomeKind::Obstruction,"," fn hash_into(&self, hasher: &mut Hasher) {"," Self::Derived {"," result_refs,"," collapse_policy,"," collapse_witness,"," collapsed_from,"," hasher.update(&[1]);"," hasher.update(&(result_refs.len() as u64).to_le_bytes());"," for reference in result_refs {"," hash_provenance_ref(hasher, reference);"," }"," hash_optional_digest(hasher, collapse_policy.as_ref());"," hash_optional_digest(hasher, collapse_witness.as_ref());"," hash_optional_digest(hasher, collapsed_from.as_ref());"," Self::Plural { alternative_ids } => {"," hasher.update(&[2]);"," hasher.update(&(alternative_ids.len() as u64).to_le_bytes());"," for alternative in alternative_ids {"," hasher.update(alternative);"," Self::Conflict { reason_codes } => {"," hasher.update(&[3]);"," hasher.update(&(reason_codes.len() as u64).to_le_bytes());"," hasher.update(reason_codes);"," Self::Obstruction {"," reason_code,"," witness,"," obstructed_from,"," hasher.update(&[4]);"," hasher.update(&[*reason_code]);"," hasher.update(witness);"," hash_optional_digest(hasher, obstructed_from.as_ref());","fn hash_provenance_ref(hasher: &mut Hasher, reference: &ProvenanceRef) {"," hasher.update(reference.worldline_id.as_bytes());"," hasher.update(&reference.worldline_tick.as_u64().to_le_bytes());"," hasher.update(&reference.commit_hash);","fn hash_optional_digest(hasher: &mut Hasher, digest: Option<&Hash>) {"," match digest {"," Some(value) => {"," hasher.update(&[1]);"," hasher.update(value);"," None => {"," hasher.update(&[0]);","/// Obstructions raised while assembling, validating, or replaying a shell.","#[derive(Clone, Debug, PartialEq, Eq, thiserror::Error)]","pub enum BraidShellError {"," /// A shell must summarize at least one member."," #[error(\"braid shell must summarize at least one member\")]"," EmptyMembers,"," /// The shell posture exceeds its least-revealed member."," #[error(\"braid shell posture exceeds least-revealed member: {0:?}\")]"," PostureExceedsMembers(PostureObstruction),"," /// Outcome arm and member verdicts disagree."," #[error(\"braid shell outcome {outcome:?} disagrees with member verdicts\")]"," OutcomeMemberMismatch {"," /// Outcome arm the shell claims."," outcome: AdmissionOutcomeKind,"," /// The stored digest does not match the recomputed canonical body."," #[error(\"braid shell digest mismatch: stored {stored:?}, recomputed {recomputed:?}\")]"," DigestMismatch {"," /// Digest stored on the shell."," stored: Hash,"," /// Digest recomputed from the body."," recomputed: Hash,"," /// The stored witness digest does not match the recomputed body witness."," #[error(\"braid shell witness mismatch: stored {stored:?}, recomputed {recomputed:?}\")]"," WitnessMismatch {"," /// Witness digest stored on the shell."," /// Witness digest recomputed from the body."," /// The proof shape validation failed."," #[error(\"proof shape validation failed: {reason}\")]"," ProofShapeValidationFailed {"," /// Reason for shape validation failure."," reason: crate::proof::ProofError,"," /// Member entries are not in canonical order."," #[error(\"braid shell members are not in canonical order\")]"," NonCanonicalMemberOrder,"," /// No shell record exists for the requested digest."," #[error(\"no braid shell retained for digest {digest:?}\")]"," ShellNotFound {"," /// Digest that resolved to nothing."," digest: Hash,"," /// A shell with this digest is already retained with different content."," #[error(\"a divergent braid shell already claims digest {digest:?}\")]"," DuplicateDigestDivergentContent {"," /// Digest both shells claim."," /// The shell claims a body version this build does not speak."," #[error(\"unsupported braid shell version {stored} (supported: {supported})\")]"," UnsupportedVersion {"," /// Version stored on the shell."," stored: u32,"," /// Version this build supports."," supported: u32,"," /// Plural alternatives are not in canonical set order."," #[error(\"braid shell plural alternatives are not in canonical order\")]"," NonCanonicalAlternativeOrder,"," /// Collapse lineage fields must be all present or all absent."," #[error(\"derived shell carries incoherent collapse fields\")]"," IncoherentCollapseFields,"," /// Collapse-derived shells must carry one policy identity."," #[error(\"derived shell collapse policy {collapse_policy:?} does not match shell policy {policy_id:?}\")]"," IncoherentCollapsePolicy {"," /// Shell-level policy identity."," policy_id: Hash,"," /// Collapse policy identity carried by the outcome."," collapse_policy: Hash,"," /// A witness digest must never be a 32-byte shrug."," #[error(\"empty or null witness digest refused\")]"," EmptyWitness,"," /// A policy id must name a non-empty law."," #[error(\"empty policy id refused\")]"," EmptyPolicyId,"," /// A law reading failed validation."," #[error(\"plurality law reading refused: {0}\")]"," LawReading(#[from] PluralityLawReadingError),"," /// A lineage parent shell is missing or not plural."," #[error(\"lineage parent {parent:?} is missing or not plural\")]"," InvalidLineageParent {"," /// Parent shell digest named by a collapse or obstruction lineage."," parent: Hash,"," /// The stored braid coordinate does not match the recomputed body."," #[error(\"braid coordinate mismatch\")]"," CoordinateMismatch,"," /// Plural alternatives are a set; duplicates are refused."," #[error(\"duplicate plural alternative id {alternative_id:?}\")]"," DuplicateAlternativeId {"," /// Alternative id that appeared more than once."," alternative_id: Hash,"," /// One strand may appear at most once among shell members."," #[error(\"duplicate member strand {member_ref:?}\")]"," DuplicateMemberStrand {"," /// Member reference that appeared more than once."," member_ref: BraidMemberRef,"," /// Revealed and sealed member references may not be mixed in one shell."," #[error(\"braid shell mixes revealed and sealed member references\")]"," MixedMemberReferencePosture,"," /// A retained plural artifact id may never migrate to a different shell."," #[error(\"plural artifact {plural_id:?} already bound to shell {existing_shell:?}\")]"," PluralArtifactAlreadyBound {"," /// Plural artifact id being bound."," plural_id: Hash,"," /// Shell digest the id is already bound to."," existing_shell: Hash,"," /// Shell digest the rebind attempted."," attempted_shell: Hash,","/// Canonical coordinate of a braid: where the shell lives in braid space.","/// `hash(basis_ref, canonical_member_digest_list, policy_id)` — the first","/// real consumer of braid-scale addressing.","#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord)]","pub struct BraidCoordinate(pub Hash);","impl BraidCoordinate {"," fn derive(basis: &ProvenanceRef, member_digests: &[Hash], policy_id: Hash) -> Self {"," hasher.update(COORDINATE_DOMAIN);"," hash_provenance_ref(&mut hasher, basis);"," hasher.update(&(member_digests.len() as u64).to_le_bytes());"," for member_digest in member_digests {"," hasher.update(member_digest);"," hasher.update(&policy_id);","/// Retained braid-scale settlement boundary (θ_braid).","pub struct BraidShell {"," /// Shell body version."," pub version: u32,"," /// Canonical braid coordinate this shell lives at."," pub coordinate: BraidCoordinate,"," /// Target worldline the settlement judged into."," pub worldline_id: WorldlineId,"," /// Comparison basis the members were judged against."," pub basis: ProvenanceRef,"," /// Canonically ordered member entries."," pub members: Vec,"," /// Settlement policy identity the act ran under."," pub policy_id: Hash,"," /// Outcome arm over the shared lawful algebra."," pub outcome: BraidShellOutcome,"," /// Witness digest binding the settlement act."," /// E1 scaffolding: this is a domain-separated self-witness — a hash of"," /// the same shell body — folded into `digest`. It guarantees integrity,"," /// not independent attestation (anyone who can compute the shell can"," /// compute it). A real external witness replaces it when settlement"," /// gains witness-bearing authority."," pub witness_digest: Hash,"," /// Revelation posture of the shell itself."," /// Optional proof-shaped evidence envelope bound into shell identity."," pub proof: Option,"," /// Canonical content digest of the full shell body."," pub digest: Hash,","impl BraidShell {"," /// Assembles a shell: canonicalizes member order, checks the posture"," /// floor and outcome/member coherence, and seals witness + digest."," /// Returns [`BraidShellError`] for an empty member set"," /// ([`BraidShellError::EmptyMembers`]), a duplicate member strand or"," /// plural alternative ([`BraidShellError::DuplicateMemberStrand`],"," /// [`BraidShellError::DuplicateAlternativeId`]), an empty policy id"," /// ([`BraidShellError::EmptyPolicyId`]), an empty witness on a"," /// collapse/obstruction outcome ([`BraidShellError::EmptyWitness`]),"," /// incoherent collapse fields"," /// ([`BraidShellError::IncoherentCollapseFields`]), incoherent collapse"," /// policy identity ([`BraidShellError::IncoherentCollapsePolicy`]), a"," /// posture exceeding the least-revealed member"," /// ([`BraidShellError::PostureExceedsMembers`]), or an outcome arm that"," /// disagrees with member verdicts"," /// ([`BraidShellError::OutcomeMemberMismatch`])."," pub fn assemble("," worldline_id: WorldlineId,"," basis: ProvenanceRef,"," members: Vec,"," outcome: BraidShellOutcome,"," posture: CausalPosture,"," ) -> Result {"," Self::assemble_with_proof("," worldline_id,"," basis,"," members,"," policy_id,"," outcome,"," posture,"," None,"," /// Assembles a shell with a proof-shaped envelope: validates member order,"," /// checks posture floor and coherence, validates the proof envelope shape"," /// (if present) against the derived witness, and seals the shell digest."," /// Proof cryptographic validity is not verified; only envelope shape and"," /// public-input binding are validated."," /// Returns [`BraidShellError`] if any structure constraints are violated or if"," /// the proof envelope validation fails."," pub fn assemble_with_proof("," mut members: Vec,"," mut outcome: BraidShellOutcome,"," proof: Option,"," if members.is_empty() {"," return Err(BraidShellError::EmptyMembers);"," check_policy_id(policy_id)?;"," check_collapse_policy_identity(policy_id, &outcome)?;"," members.sort_by_cached_key(BraidShellMember::member_digest);"," check_unique_member_strands(&members)?;"," if let BraidShellOutcome::Plural { alternative_ids } = &mut outcome {"," // Retained alternatives are a set; canonical order, not transcript"," // order (the member verdict digest binds the ordered transcript)."," alternative_ids.sort_unstable();"," if let Some(duplicate) = alternative_ids"," .windows(2)"," .find(|pair| pair[0] == pair[1])"," .map(|pair| pair[0])"," {"," return Err(BraidShellError::DuplicateAlternativeId {"," alternative_id: duplicate,"," });"," check_outcome_law(&outcome)?;"," if let Some(obstruction) ="," shell_posture_obstruction(posture, members.iter().map(|member| member.posture))"," return Err(BraidShellError::PostureExceedsMembers(obstruction));"," check_outcome_member_coherence(&outcome, &members)?;"," // Compute each member digest once; coordinate, witness, and shell"," // digests all consume it."," let member_digests: Vec = members"," .iter()"," .map(BraidShellMember::member_digest)"," .collect();"," let coordinate = BraidCoordinate::derive(&basis, &member_digests, policy_id);"," let witness_digest = compute_witness_digest("," BRAID_SHELL_VERSION,"," &basis,"," &member_digests,"," &outcome,"," if let Some(ref p) = proof {"," if let Err(err) = p.validate_shape(witness_digest) {"," return Err(BraidShellError::ProofShapeValidationFailed { reason: err });"," let proof_digest = proof.as_ref().map(crate::proof::ProofEnvelope::digest);"," let digest = compute_shell_digest("," witness_digest,"," proof_digest,"," version: BRAID_SHELL_VERSION,"," digest,"," proof,"," /// Validates the shell as a self-contained retained record."," /// Returns [`BraidShellError`] for an unsupported version, empty or"," /// non-canonically-ordered members, a duplicate member strand,"," /// non-canonical or duplicate plural alternatives, an empty policy id, an"," /// empty collapse/obstruction witness, incoherent collapse policy identity,"," /// a posture floor violation, an outcome/member disagreement, a coordinate"," /// mismatch, or a stored witness/shell digest that does not match the"," /// recomputed body."," pub fn validate(&self) -> Result<(), BraidShellError> {"," if self.version != BRAID_SHELL_VERSION {"," return Err(BraidShellError::UnsupportedVersion {"," stored: self.version,"," supported: BRAID_SHELL_VERSION,"," if self.members.is_empty() {"," check_policy_id(self.policy_id)?;"," check_collapse_policy_identity(self.policy_id, &self.outcome)?;"," // Compute each member digest once; the order check, coordinate,"," // witness, and shell digests all consume it."," let member_digests: Vec = self"," .members"," if member_digests.windows(2).any(|pair| pair[0] > pair[1]) {"," return Err(BraidShellError::NonCanonicalMemberOrder);"," check_unique_member_strands(&self.members)?;"," if let BraidShellOutcome::Plural { alternative_ids } = &self.outcome {"," if alternative_ids.windows(2).any(|pair| pair[0] > pair[1]) {"," return Err(BraidShellError::NonCanonicalAlternativeOrder);"," check_outcome_law(&self.outcome)?;"," if let Some(obstruction) = shell_posture_obstruction("," self.posture,"," self.members.iter().map(|member| member.posture),"," ) {"," check_outcome_member_coherence(&self.outcome, &self.members)?;"," if BraidCoordinate::derive(&self.basis, &member_digests, self.policy_id) != self.coordinate"," return Err(BraidShellError::CoordinateMismatch);"," let witness = compute_witness_digest("," self.version,"," self.worldline_id,"," &self.basis,"," self.policy_id,"," &self.outcome,"," if witness != self.witness_digest {"," return Err(BraidShellError::WitnessMismatch {"," stored: self.witness_digest,"," recomputed: witness,"," if let Some(ref p) = self.proof {"," if let Err(err) = p.validate_shape(self.witness_digest) {"," let proof_digest = self.proof.as_ref().map(crate::proof::ProofEnvelope::digest);"," self.witness_digest,"," if digest != self.digest {"," return Err(BraidShellError::DigestMismatch {"," stored: self.digest,"," recomputed: digest,"," pub fn outcome_kind(&self) -> AdmissionOutcomeKind {"," self.outcome.kind()"," /// Returns whether the shell summarizes the given revealed member strand."," pub fn has_revealed_member_strand(&self, strand_id: &StrandId) -> bool {"," self.members.iter().any(|member| match member.member_ref {"," BraidMemberRef::Revealed(id) => id == *strand_id,"," BraidMemberRef::Sealed { .. } => false,"," /// Returns whether the shell summarizes the given member strand, using"," /// non-public blinding material for sealed references."," pub fn has_member_strand_secure("," self.members.iter().any(|member| {"," member.member_ref.matches_strand("," strand_id,"," child_worldline_id,"," blinding_secret,","/// Witness-bearing outcome fields must clear the [`WitnessDigest`] bar:","/// the newtype bouncer guards every door, not just the constructor.","fn check_outcome_law(outcome: &BraidShellOutcome) -> Result<(), BraidShellError> {"," match outcome {"," BraidShellOutcome::Derived {"," collapse_witness: Some(witness),"," .."," | BraidShellOutcome::Obstruction { witness, .. } => {"," WitnessDigest::new(*witness).map_err(|_| BraidShellError::EmptyWitness)?;"," _ => {}","fn check_policy_id(policy_id: Hash) -> Result<(), BraidShellError> {"," if policy_id.iter().all(|byte| *byte == 0) {"," return Err(BraidShellError::EmptyPolicyId);","fn check_collapse_policy_identity("," policy_id: Hash,"," outcome: &BraidShellOutcome,",") -> Result<(), BraidShellError> {"," if let BraidShellOutcome::Derived {"," collapse_policy: Some(collapse_policy),"," .."," } = outcome"," {"," if *collapse_policy != policy_id {"," return Err(BraidShellError::IncoherentCollapsePolicy {"," policy_id,"," collapse_policy: *collapse_policy,","/// One strand may appear at most once among shell members.","fn check_unique_member_strands(members: &[BraidShellMember]) -> Result<(), BraidShellError> {"," if let Some(first) = members.first() {"," let first_is_sealed = first.member_ref.is_sealed();"," if members"," .any(|member| member.member_ref.is_sealed() != first_is_sealed)"," return Err(BraidShellError::MixedMemberReferencePosture);"," let mut seen = std::collections::BTreeSet::new();"," for member in members {"," if !seen.insert(member.member_ref) {"," return Err(BraidShellError::DuplicateMemberStrand {"," member_ref: member.member_ref,","fn check_outcome_member_coherence("," members: &[BraidShellMember],"," let any_plural = members"," .iter()"," .any(|member| member.verdict == MemberVerdict::Plural);"," let any_conflict = members"," .any(|member| member.verdict == MemberVerdict::Conflict);"," let coherent = match outcome {"," collapse_policy,"," collapse_witness,"," collapsed_from,"," } => {"," let lineage_fields = ["," collapse_policy.is_some(),"," collapse_witness.is_some(),"," collapsed_from.is_some(),"," ];"," if lineage_fields.iter().any(|present| *present)"," && lineage_fields.iter().any(|present| !*present)"," return Err(BraidShellError::IncoherentCollapseFields);"," // A collapse-derived shell summarizes the plural members it"," // collapsed; a settlement-derived shell must carry none."," collapsed_from.is_some() || (!any_plural && !any_conflict)"," BraidShellOutcome::Plural { .. } => any_plural,"," BraidShellOutcome::Conflict { .. } => any_conflict && !any_plural,"," BraidShellOutcome::Obstruction { .. } => true,"," };"," if coherent {"," Err(BraidShellError::OutcomeMemberMismatch {"," outcome: outcome.kind(),","#[allow(clippy::too_many_arguments)]","fn hash_shell_body("," hasher: &mut Hasher,"," worldline_id: WorldlineId,"," basis: &ProvenanceRef,"," member_digests: &[Hash],"," posture: CausalPosture,",") {"," hasher.update(&version.to_le_bytes());"," hasher.update(worldline_id.as_bytes());"," hash_provenance_ref(hasher, basis);"," hasher.update(&(member_digests.len() as u64).to_le_bytes());"," for member_digest in member_digests {"," hasher.update(member_digest);"," hasher.update(&policy_id);"," outcome.hash_into(hasher);"," hasher.update(&[posture.canonical_tag()]);","fn compute_witness_digest(",") -> Hash {"," hasher.update(WITNESS_DOMAIN);"," hash_shell_body("," &mut hasher,"," version,"," worldline_id,"," basis,"," member_digests,"," policy_id,"," outcome,"," posture,","fn compute_shell_digest("," witness_digest: Hash,"," proof_digest: Option,"," hasher.update(SHELL_DOMAIN);"," hasher.update(&witness_digest);"," match proof_digest {"," Some(digest) => {"," hasher.update(&[0x01]);"," hasher.update(&digest);"," hasher.update(&[0x00]);","/// Read access to retained shell records — and nothing else.","/// Replay's only window into the world. There is deliberately no method that","/// returns provenance entries, strand registries, or worldline state: a","/// shell that cannot replay through this trait is not a shell.","pub trait BraidShellRecords {"," /// Returns the retained shell with the given digest, if any."," fn shell(&self, digest: &Hash) -> Option<&BraidShell>;","impl BraidShellRecords for std::collections::BTreeMap {"," fn shell(&self, digest: &Hash) -> Option<&BraidShell> {"," self.get(digest)","/// Outcome reproduced from a retained shell alone.","pub struct BraidShellReplay {"," /// Outcome arm reproduced from the shell."," pub outcome_kind: AdmissionOutcomeKind,"," /// Member verdicts in canonical member order."," pub member_verdicts: Vec<(BraidMemberRef, MemberVerdict)>,"," /// Policy identity the act ran under."," /// Named law that interpreted retained plurality or collapse."," /// Witness digest binding the act."," /// Revelation posture of the shell.","/// Stable proof-binding fact for braid shell audit output.","pub enum BraidProofBinding {"," /// The audited shell carries no proof envelope."," Absent,"," /// The audited shell carries a proof envelope that validated against the"," /// shell witness digest."," Matched {"," /// Proof envelope kind."," kind: crate::proof::ProofKind,"," /// Canonical proof-envelope digest."," envelope_digest: Hash,"," /// Public inputs hash carried by the proof envelope."," public_inputs_hash: Hash,","/// Witness posture surfaced by braid shell audit output.","pub enum BraidWitnessPosture {"," /// Current E1 self-witness: integrity-only local evidence, not independent"," /// attestation."," SelfWitnessIntegrityOnly {"," /// Witness digest bound into the shell.","/// One replay/audit fact for a braid shell member.","pub struct BraidShellMemberAuditFact {"," /// Reference to the member strand, revealed or sealed."," /// Settlement verdict reproduced for this member."," /// Member-level causal posture."," /// Digest over the realized parent frontier judged for this member."," /// Digest over contended footprint slots."," /// Digest over ordered claim identities."," /// Digest over ordered per-claim decisions."," /// Disclosure budget needed to interpret the member reference."," pub disclosure_budget: DisclosureBudget,","/// Replay/audit facts reproduced from a retained braid shell.","pub struct BraidShellAudit {"," /// Canonical shell digest audited."," pub shell_digest: Hash,"," /// Witnessed law reading for this shell audit."," pub law_reading: PluralityLawReading,"," /// Least-revealed member posture across the audited shell."," pub posture_floor: CausalPosture,"," /// Revelation posture claimed by the shell itself."," pub shell_posture: CausalPosture,"," /// Member refs in canonical settlement frontier order."," pub settlement_frontier: Vec,"," /// Per-member replay/audit facts in canonical member order."," pub member_facts: Vec,"," /// Proof binding status for the shell."," pub proof_binding: BraidProofBinding,"," /// Witness posture for the shell."," pub witness_posture: BraidWitnessPosture,"," /// Typed witness receipt for the shell audit."," pub witness_receipt: WitnessReceipt,","/// Replays a braid-scope settlement outcome from retained shell records.","/// Verifies digest integrity (member digests, witness digest, shell digest)","/// and collapse lineage (a `Derived` shell collapsing plurality must","/// reference a retained `Plural` parent), then reproduces the outcome arm","/// and member verdicts. Member strand histories are unreachable by","/// construction.","/// # Errors","/// Returns [`BraidShellError`] when the shell is missing, fails","/// self-validation, or names a collapse parent that is absent or not plural.","pub fn replay_braid_shell("," digest: &Hash,"," records: &dyn BraidShellRecords,",") -> Result {"," let shell = validated_shell_for_replay(digest, records)?;"," let law_ref = shell_law_ref(shell)?;"," Ok(BraidShellReplay {"," outcome_kind: shell.outcome_kind(),"," member_verdicts: shell"," .map(|member| (member.member_ref, member.verdict))"," .collect(),"," policy_id: shell.policy_id,"," law_ref,"," witness_digest: shell.witness_digest,"," posture: shell.posture,"," })","/// Returns stable replay/audit facts from a retained braid shell.","/// The audit view validates the same retained shell and collapse-lineage","/// constraints as [`replay_braid_shell`]. It exposes support, frontier, proof,","/// posture, member-verdict, and witness facts without reopening member strand","/// histories.","pub fn audit_braid_shell(",") -> Result {"," let posture_floor = shell"," .members"," .map(|member| member.posture)"," .min()"," .unwrap_or(shell.posture);"," let proof_binding = shell"," .proof"," .as_ref()"," .map_or(BraidProofBinding::Absent, |proof| {"," BraidProofBinding::Matched {"," kind: proof.kind,"," envelope_digest: proof.digest(),"," public_inputs_hash: proof.public_inputs_hash,"," });"," let witness_receipt = WitnessReceipt::self_witness(shell.digest, shell.witness_digest);"," let law_reading = PluralityLawReading::new("," shell.digest,"," witness_receipt,"," shell_disclosure_budget(shell),"," Ok(BraidShellAudit {"," shell_digest: shell.digest,"," coordinate: shell.coordinate,"," law_reading,"," posture_floor,"," shell_posture: shell.posture,"," settlement_frontier: shell"," .map(|member| member.member_ref)"," member_facts: shell"," .map(|member| BraidShellMemberAuditFact {"," verdict: member.verdict,"," posture: member.posture,"," support_pin_digest: member.support_pin_digest,"," basis_digest: member.basis_digest,"," frontier_digest: member.frontier_digest,"," footprint_digest: member.footprint_digest,"," claim_digest: member.claim_digest,"," verdict_digest: member.verdict_digest,"," disclosure_budget: member_disclosure_budget(member.member_ref),"," })"," proof_binding,"," witness_posture: BraidWitnessPosture::SelfWitnessIntegrityOnly {"," digest: shell.witness_digest,"," },","const fn member_disclosure_budget(member_ref: BraidMemberRef) -> DisclosureBudget {"," match member_ref {"," BraidMemberRef::Revealed(_) => DisclosureBudget::Public,"," BraidMemberRef::Sealed { .. } => DisclosureBudget::AuthorityScoped,","fn shell_disclosure_budget(shell: &BraidShell) -> DisclosureBudget {"," if shell"," .any(|member| matches!(member.member_ref, BraidMemberRef::Sealed { .. }))"," DisclosureBudget::AuthorityScoped"," DisclosureBudget::Public","fn shell_law_ref(shell: &BraidShell) -> Result {"," match &shell.outcome {"," collapse_policy: Some(policy_id),"," } => PluralityLawRef::collapse_policy(*policy_id),"," _ => PluralityLawRef::settlement_policy(shell.policy_id),"," .map_err(|_| BraidShellError::EmptyPolicyId)","fn validated_shell_for_replay<'a>("," records: &'a dyn BraidShellRecords,",") -> Result<&'a BraidShell, BraidShellError> {"," let shell = records"," .shell(digest)"," .ok_or(BraidShellError::ShellNotFound { digest: *digest })?;"," shell.validate()?;"," if shell.digest != *digest {"," return Err(BraidShellError::DigestMismatch {"," stored: *digest,"," recomputed: shell.digest,"," let lineage_parent = match &shell.outcome {"," collapsed_from: Some(parent_digest),"," | BraidShellOutcome::Obstruction {"," obstructed_from: Some(parent_digest),"," } => Some(*parent_digest),"," _ => None,"," if let Some(parent_digest) = lineage_parent {"," let parent ="," records"," .shell(&parent_digest)"," .ok_or(BraidShellError::InvalidLineageParent {"," parent: parent_digest,"," })?;"," parent.validate()?;"," if !matches!(parent.outcome, BraidShellOutcome::Plural { .. }) {"," return Err(BraidShellError::InvalidLineageParent {"," parent: parent_digest,"," Ok(shell)","/// Deterministic reason code: collapse attempted without a named policy.","pub const COLLAPSE_WITHOUT_POLICY_REASON: u8 = 1;","const COLLAPSE_OBSTRUCTION_WITNESS_DOMAIN: &[u8] = b\"echo.braid.collapse.obstruction.v1\\0\";","const ABSENT_COLLAPSE_POLICY_DOMAIN: &[u8] = b\"echo.braid.collapse-policy.absent.v1\\0\";","/// Named, witnessed law permitting one collapse of retained plurality.","pub struct CollapsePolicy {"," /// Stable collapse policy identity."," /// Witness for the explicit collapse act."," pub witness: WitnessDigest,","/// Outcome of one collapse attempt. Both arms are retained law.","pub enum CollapseResult {"," /// The plurality lawfully collapsed into a new derived shell."," Derived(BraidShell),"," /// The collapse was refused; the obstruction is itself a retained shell."," Obstructed(BraidShell),","/// Collapses a retained plural shell into a new shell-family record.","/// The plural parent is never mutated: a named, witnessed collapse policy","/// produces a new `Derived` shell whose `collapsed_from` references the","/// parent; a missing policy produces a retained `Obstruction` shell. Either","/// way the original plural shell remains byte-identical truth forever.","/// Append-only or bust.","/// When `policy` is `None`, `selected_result_refs` is ignored: an obstructed","/// collapse retains no derived result, only the refusal.","/// Returns [`BraidShellError`] when the plural shell is missing, fails","/// validation, or is not plural.","pub fn collapse_braid_shell("," plural_shell_digest: Hash,"," selected_result_refs: Vec,"," policy: Option,",") -> Result {"," let plural = records"," .shell(&plural_shell_digest)"," .ok_or(BraidShellError::ShellNotFound {"," digest: plural_shell_digest,"," plural.validate()?;"," if !matches!(plural.outcome, BraidShellOutcome::Plural { .. }) {"," return Err(BraidShellError::InvalidLineageParent {"," parent: plural_shell_digest,"," if let Some(policy) = policy {"," let derived = BraidShell::assemble("," plural.worldline_id,"," plural.basis,"," plural.members.clone(),"," policy.policy_id,"," BraidShellOutcome::Derived {"," result_refs: selected_result_refs,"," collapse_policy: Some(policy.policy_id),"," collapse_witness: Some(*policy.witness.as_hash()),"," collapsed_from: Some(plural_shell_digest),"," },"," plural.posture,"," )?;"," return Ok(CollapseResult::Derived(derived));"," let mut witness_hasher = Hasher::new();"," witness_hasher.update(COLLAPSE_OBSTRUCTION_WITNESS_DOMAIN);"," witness_hasher.update(&plural_shell_digest);"," let mut policy_hasher = Hasher::new();"," policy_hasher.update(ABSENT_COLLAPSE_POLICY_DOMAIN);"," let obstructed = BraidShell::assemble("," plural.worldline_id,"," plural.basis,"," plural.members.clone(),"," policy_hasher.finalize().into(),"," BraidShellOutcome::Obstruction {"," reason_code: COLLAPSE_WITHOUT_POLICY_REASON,"," witness: witness_hasher.finalize().into(),"," obstructed_from: Some(plural_shell_digest),"," plural.posture,"," Ok(CollapseResult::Obstructed(obstructed))","/// Kind discriminator for the retained boundary shell family.","/// θ_tick and θ_braid are siblings in one retained boundary family","/// (AIΩN Paper VII Prop 3.5); θ_import joins later.","pub enum RetainedBoundaryKind {"," /// A contiguous tick-segment boundary record."," Tick,"," /// A braid-scale settlement boundary shell."," Braid,","/// Shared contract for retained boundary shells of every scale.","pub trait RetainedBoundaryRecord {"," /// Returns which family member this record is."," fn boundary_kind(&self) -> RetainedBoundaryKind;"," /// Returns the canonical content digest for the record."," fn boundary_digest(&self) -> Hash;","impl RetainedBoundaryRecord for BraidShell {"," fn boundary_kind(&self) -> RetainedBoundaryKind {"," RetainedBoundaryKind::Braid"," fn boundary_digest(&self) -> Hash {"," self.digest","const TICK_SHELL_DOMAIN: &[u8] = b\"echo.shell.tick.v1\\0\";","impl RetainedBoundaryRecord for crate::provenance_store::BoundaryTransitionRecord {"," RetainedBoundaryKind::Tick"," /// Full canonical content digest over the retained BTR body: boundary"," /// facts, payload coordinates, and for every entry its coordinate,"," /// event kind, head key, parents, hash triplet, retained patch body"," /// commitment (header fields explicitly — `patch_digest` does not bind"," /// the header — plus the canonical `patch_digest` which binds ops and"," /// slots), materialization outputs, and atom-write provenance, plus the"," /// auth tag. No retained field named like content is excluded — this is"," /// a record digest, not a vibes checksum."," hasher.update(TICK_SHELL_DOMAIN);"," hasher.update(self.worldline_id.as_bytes());"," hasher.update(self.u0_ref.as_bytes());"," hasher.update(&self.input_boundary_hash);"," hasher.update(&self.output_boundary_hash);"," hasher.update(&self.logical_counter.to_le_bytes());"," hasher.update(self.payload.worldline_id.as_bytes());"," hasher.update(&self.payload.start_worldline_tick.as_u64().to_le_bytes());"," hasher.update(&(self.payload.entries.len() as u64).to_le_bytes());"," for entry in &self.payload.entries {"," hasher.update(entry.worldline_id.as_bytes());"," hasher.update(&entry.worldline_tick.as_u64().to_le_bytes());"," hasher.update(&entry.commit_global_tick.as_u64().to_le_bytes());"," match &entry.head_key {"," Some(head_key) => {"," hasher.update(&[1]);"," hasher.update(head_key.worldline_id.as_bytes());"," hasher.update(head_key.head_id.as_bytes());"," None => {"," hasher.update(&[0]);"," crate::coordinator::hash_provenance_event_kind(&mut hasher, &entry.event_kind);"," hasher.update(&(entry.parents.len() as u64).to_le_bytes());"," for parent in &entry.parents {"," hash_provenance_ref(&mut hasher, parent);"," hasher.update(&entry.expected.state_root);"," hasher.update(&entry.expected.patch_digest);"," hasher.update(&entry.expected.commit_hash);"," match &entry.patch {"," Some(patch) => {"," hasher.update(&patch.header.commit_global_tick.as_u64().to_le_bytes());"," hasher.update(&patch.header.policy_id.to_le_bytes());"," hasher.update(&patch.header.rule_pack_id);"," hasher.update(&patch.header.plan_digest);"," hasher.update(&patch.header.decision_digest);"," hasher.update(&patch.header.rewrites_digest);"," hasher.update(patch.warp_id.as_bytes());"," hasher.update(&patch.patch_digest);"," hasher.update(&(entry.outputs.len() as u64).to_le_bytes());"," for (channel, data) in &entry.outputs {"," hasher.update(&(channel.0.len() as u64).to_le_bytes());"," hasher.update(channel.0.as_ref());"," hasher.update(&(data.len() as u64).to_le_bytes());"," hasher.update(data);"," hasher.update(&(entry.atom_writes.len() as u64).to_le_bytes());"," for atom_write in &entry.atom_writes {"," hasher.update(atom_write.atom.warp_id.as_bytes());"," hasher.update(atom_write.atom.local_id.as_bytes());"," hasher.update(&atom_write.rule_id);"," hasher.update(&atom_write.tick.to_le_bytes());"," match &atom_write.old_value {"," Some(old_value) => {"," hasher.update(&[1]);"," hasher.update(&(old_value.len() as u64).to_le_bytes());"," hasher.update(old_value);"," }"," None => {"," hasher.update(&[0]);"," hasher.update(&(atom_write.new_value.len() as u64).to_le_bytes());"," hasher.update(&atom_write.new_value);"," hasher.update(&(self.auth_tag.len() as u64).to_le_bytes());"," hasher.update(&self.auth_tag);","/// Secure member lookup material for sealed braid member references.","#[derive(Clone, Copy, PartialEq, Eq)]","pub struct BraidShellMemberQuery {"," /// Strand identity being matched."," pub strand_id: StrandId,"," /// Child worldline identity bound into sealed member commitments."," pub child_worldline_id: WorldlineId,"," /// Causal authority domain bound into the sealed member reference."," pub authority: AuthorityDomainRef,"," /// Non-public blinding material used to derive sealed member commitments."," pub blinding_secret: Hash,","impl core::fmt::Debug for BraidShellMemberQuery {"," fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {"," f.debug_struct(\"BraidShellMemberQuery\")"," .field(\"strand_id\", &self.strand_id)"," .field(\"child_worldline_id\", &self.child_worldline_id)"," .field(\"authority\", &self.authority)"," .field(\"blinding_secret\", &\"\")"," .finish()","/// Scan-backed query over retained braid shells.","#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]","pub struct BraidShellQuery {"," /// Match the shell at this braid coordinate."," pub coordinate: Option,"," /// Match shells judged against this comparison basis."," pub basis: Option,"," /// Match shells summarizing this revealed member strand."," pub revealed_member_strand: Option,"," /// Match shells summarizing this member using sealed-reference material."," pub secure_member: Option,"," /// Match shells with this outcome arm."," pub outcome: Option,"," /// Match shells with this revelation posture."," pub posture: Option,"," /// Returns whether the shell matches every present query field."," pub fn matches(&self, query: &BraidShellQuery) -> bool {"," query"," .coordinate"," .is_none_or(|coordinate| self.coordinate == coordinate)"," && query.basis.is_none_or(|basis| self.basis == basis)"," && query"," .revealed_member_strand"," .as_ref()"," .is_none_or(|strand| self.has_revealed_member_strand(strand))"," && query.secure_member.is_none_or(|member| {"," self.has_member_strand_secure("," &member.strand_id,"," &member.child_worldline_id,"," &member.authority,"," &member.blinding_secret,"," )"," .outcome"," .is_none_or(|outcome| self.outcome_kind() == outcome)"," && query.posture.is_none_or(|posture| self.posture == posture)","#[cfg(test)]","#[allow(clippy::unwrap_used)]","mod tests {"," use super::*;"," use crate::clock::WorldlineTick;"," use crate::strand::make_strand_id;"," use std::collections::BTreeMap;"," fn wl(n: u8) -> WorldlineId {"," WorldlineId::from_bytes([n; 32])"," fn basis_ref() -> ProvenanceRef {"," ProvenanceRef {"," worldline_id: wl(1),"," worldline_tick: WorldlineTick::from_raw(0),"," commit_hash: [0x11; 32],"," fn member(label: &str, verdict: MemberVerdict) -> BraidShellMember {"," BraidShellMember {"," member_ref: BraidMemberRef::Revealed(make_strand_id(label)),"," support_pin_digest: [0x21; 32],"," basis_digest: [0x22; 32],"," frontier_digest: [0x23; 32],"," footprint_digest: [0x24; 32],"," claim_digest: [0x25; 32],"," verdict,"," verdict_digest: [0x26; 32],"," posture: CausalPosture::AuthorOnly,"," fn authority(origin: u8, domain: u8) -> AuthorityDomainRef {"," AuthorityDomainRef::new("," crate::revelation::OriginId::from_bytes([origin; 32]),"," crate::revelation::AuthorityDomainId::from_bytes([domain; 32]),"," fn sealed_member("," commitment: Hash,"," verdict: MemberVerdict,"," claim_byte: u8,"," ) -> BraidShellMember {"," member_ref: BraidMemberRef::Sealed {"," blinded_commitment: commitment,"," claim_digest: [claim_byte; 32],"," fn plural_shell(members: Vec) -> BraidShell {"," BraidShell::assemble("," wl(1),"," basis_ref(),"," [0x5E; 32],"," BraidShellOutcome::Plural {"," alternative_ids: vec![[0x31; 32]],"," CausalPosture::AuthorOnly,"," .unwrap()"," struct Records(BTreeMap);"," impl Records {"," fn with(shells: impl IntoIterator) -> Self {"," Self("," shells"," .into_iter()"," .map(|shell| (shell.digest, shell))"," .collect(),"," impl BraidShellRecords for Records {"," fn shell(&self, digest: &Hash) -> Option<&BraidShell> {"," self.0.get(digest)"," #[test]"," fn member_order_permutation_cannot_move_the_shell_digest() {"," let a = member(\"member-a\", MemberVerdict::Plural);"," let b = member(\"member-b\", MemberVerdict::Derived);"," let forward = plural_shell(vec![a.clone(), b.clone()]);"," let reversed = plural_shell(vec![b, a]);"," assert_eq!(forward.digest, reversed.digest);"," assert_eq!(forward, reversed);"," fn replay_reproduces_outcome_and_member_verdicts_from_records_alone() {"," use crate::plurality_law::PluralityLawRef;"," let shell = plural_shell(vec!["," member(\"member-a\", MemberVerdict::Plural),"," member(\"member-b\", MemberVerdict::Derived),"," ]);"," let digest = shell.digest;"," let expected_verdicts: Vec<(BraidMemberRef, MemberVerdict)> = shell"," let records = Records::with([shell]);"," let replay = replay_braid_shell(&digest, &records).unwrap();"," assert_eq!(replay.outcome_kind, AdmissionOutcomeKind::Plural);"," assert_eq!(replay.member_verdicts, expected_verdicts);"," assert_eq!(replay.policy_id, [0x5E; 32]);"," assert_eq!("," Ok(replay.law_ref),"," PluralityLawRef::settlement_policy([0x5E; 32])"," assert_eq!(replay.posture, CausalPosture::AuthorOnly);"," fn replay_audit_reports_member_proof_support_frontier_and_witness_facts() {"," use crate::plurality_law::{PluralityLawEvidencePosture, PluralityLawRef};"," use crate::proof::{ProofEnvelope, ProofKind};"," use crate::sealed_membership::DisclosureBudget;"," use crate::witness::{WitnessAttestation, WitnessCompatibilityRule, WitnessKind};"," let members = vec![member(\"audit-member\", MemberVerdict::Plural)];"," let temp_shell = BraidShell::assemble("," members.clone(),"," .unwrap();"," let proof = ProofEnvelope {"," kind: ProofKind::ReplayTrace,"," proof_bytes: vec![1, 2, 3],"," public_inputs_hash: temp_shell.witness_digest,"," };"," let shell = BraidShell::assemble_with_proof("," Some(proof),"," let expected_member = shell.members[0].clone();"," let expected_proof_digest = shell.proof.as_ref().unwrap().digest();"," let expected_witness = shell.witness_digest;"," let audit = audit_braid_shell(&digest, &records).unwrap();"," assert_eq!(audit.shell_digest, digest);"," assert_eq!(audit.outcome_kind, AdmissionOutcomeKind::Plural);"," Ok(audit.law_reading.law_ref()),"," assert_eq!(audit.law_reading.support_digest(), digest);"," audit.law_reading.evidence_posture(),"," PluralityLawEvidencePosture::SelfWitnessIntegrityOnly"," audit.law_reading.disclosure_budget(),"," DisclosureBudget::Public"," assert_eq!(audit.posture_floor, CausalPosture::AuthorOnly);"," assert_eq!(audit.shell_posture, CausalPosture::AuthorOnly);"," assert_eq!(audit.settlement_frontier, vec![expected_member.member_ref]);"," audit.member_facts,"," vec![BraidShellMemberAuditFact {"," member_ref: expected_member.member_ref,"," verdict: expected_member.verdict,"," posture: expected_member.posture,"," support_pin_digest: expected_member.support_pin_digest,"," basis_digest: expected_member.basis_digest,"," frontier_digest: expected_member.frontier_digest,"," footprint_digest: expected_member.footprint_digest,"," claim_digest: expected_member.claim_digest,"," verdict_digest: expected_member.verdict_digest,"," disclosure_budget: DisclosureBudget::Public,"," }]"," audit.proof_binding,"," kind: ProofKind::ReplayTrace,"," envelope_digest: expected_proof_digest,"," public_inputs_hash: expected_witness,"," audit.witness_posture,"," BraidWitnessPosture::SelfWitnessIntegrityOnly {"," digest: expected_witness,"," assert_eq!(audit.witness_receipt.kind(), WitnessKind::SelfWitness);"," assert_eq!(audit.witness_receipt.subject_digest(), digest);"," assert_eq!(audit.witness_receipt.evidence_digest(), expected_witness);"," audit.witness_receipt.compatibility(),"," WitnessCompatibilityRule::E1Scaffold"," audit.witness_receipt.attestation(),"," WitnessAttestation::IntegrityOnly"," fn replay_audit_labels_sealed_member_disclosure_budget() {"," let shell = plural_shell(vec![sealed_member("," [0xAA; 32],"," authority(0x01, 0x02),"," MemberVerdict::Plural,"," 0x25,"," )]);"," assert_eq!(audit.member_facts.len(), 1);"," assert!(matches!("," audit.member_facts[0].member_ref,"," BraidMemberRef::Sealed { .. }"," ));"," audit.member_facts[0].disclosure_budget,"," DisclosureBudget::AuthorityScoped"," fn tampering_with_policy_posture_or_verdict_fails_replay() {"," let shell = plural_shell(vec![member(\"member-a\", MemberVerdict::Plural)]);"," let mut policy_tampered = shell.clone();"," policy_tampered.policy_id = [0xAA; 32];"," let records = Records::with([policy_tampered]);"," // The tampered shell no longer lives at its claimed digest, and its"," // stored digest no longer matches its body either way."," assert!(replay_braid_shell(&digest, &records).is_err());"," let mut verdict_tampered = shell.clone();"," verdict_tampered.members[0].verdict_digest = [0xBB; 32];"," verdict_tampered.validate(),"," Err(BraidShellError::WitnessMismatch { .. }"," | BraidShellError::DigestMismatch { .. }"," | BraidShellError::CoordinateMismatch)"," let mut posture_tampered = shell.clone();"," posture_tampered.posture = CausalPosture::Scratch;"," posture_tampered.validate(),"," Err(BraidShellError::WitnessMismatch { .. } | BraidShellError::DigestMismatch { .. })"," let mut outcome_tampered = shell;"," outcome_tampered.outcome = BraidShellOutcome::Conflict {"," reason_codes: vec![4],"," assert!(outcome_tampered.validate().is_err());"," fn tampering_with_coordinate_fails_validation() {"," let mut shell = plural_shell(vec![member(\"member-a\", MemberVerdict::Plural)]);"," shell.coordinate = BraidCoordinate([0xCC; 32]);"," assert_eq!(shell.validate(), Err(BraidShellError::CoordinateMismatch));"," fn derived_shell_rejects_empty_collapse_witness() {"," let result = BraidShell::assemble("," vec![member(\"member-a\", MemberVerdict::Derived)],"," [0x77; 32],"," result_refs: vec![basis_ref()],"," collapse_policy: Some([0x77; 32]),"," collapse_witness: Some([0; 32]),"," collapsed_from: Some([0x88; 32]),"," assert_eq!(result, Err(BraidShellError::EmptyWitness));"," fn obstruction_shell_rejects_empty_witness() {"," vec![member(\"member-a\", MemberVerdict::Obstructed)],"," BraidShellOutcome::Obstruction {"," reason_code: 1,"," witness: crate::blake3_empty(),"," obstructed_from: None,"," fn shell_rejects_empty_policy_id() {"," vec![member(\"member-a\", MemberVerdict::Plural)],"," [0; 32],"," assert_eq!(result, Err(BraidShellError::EmptyPolicyId));"," fn duplicate_alternative_ids_are_refused() {"," alternative_ids: vec![[0x31; 32], [0x31; 32]],"," result,"," Err(BraidShellError::DuplicateAlternativeId {"," alternative_id: [0x31; 32],"," fn duplicate_member_strands_are_refused() {"," let mut duplicate = member(\"member-a\", MemberVerdict::Plural);"," duplicate.claim_digest = [0x99; 32];"," vec![member(\"member-a\", MemberVerdict::Plural), duplicate],"," Err(BraidShellError::DuplicateMemberStrand {"," member_ref: BraidMemberRef::Revealed(make_strand_id(\"member-a\")),"," fn sealed_members_with_same_commitment_under_different_authorities_are_distinct() {"," let commitment = [0x44; 32];"," vec!["," sealed_member("," commitment,"," authority(0x10, 0x20),"," MemberVerdict::Plural,"," 0x25,"," ),"," authority(0x11, 0x20),"," 0x26,"," ],"," assert!(result.is_ok());"," fn mixed_revealed_and_sealed_members_are_refused() {"," member(\"member-a\", MemberVerdict::Plural),"," [0x44; 32],"," assert_eq!(result, Err(BraidShellError::MixedMemberReferencePosture));"," fn obstructed_collapse_names_its_plural_parent() {"," let plural = plural_shell(vec![member(\"member-a\", MemberVerdict::Plural)]);"," let plural_digest = plural.digest;"," let records = Records::with([plural.clone()]);"," let CollapseResult::Obstructed(obstructed) ="," collapse_braid_shell(&records, plural_digest, Vec::new(), None).unwrap()"," else {"," unreachable!(\"collapse without policy must obstruct\");"," let BraidShellOutcome::Obstruction {"," obstructed_from, .."," } = obstructed.outcome"," unreachable!(\"obstructed collapse carries an obstruction outcome\");"," assert_eq!(obstructed_from, Some(plural_digest));"," // Replay verifies the named parent is retained and plural."," let mut store = Records::with([plural]);"," collapse_braid_shell(&store, plural_digest, Vec::new(), None).unwrap()"," unreachable!();"," store.0.insert(obstructed.digest, obstructed.clone());"," let replay = replay_braid_shell(&obstructed.digest, &store).unwrap();"," assert_eq!(replay.outcome_kind, AdmissionOutcomeKind::Obstruction);"," fn shells_are_queryable_by_coordinate() {"," assert!(shell.matches(&BraidShellQuery {"," coordinate: Some(shell.coordinate),"," ..BraidShellQuery::default()"," }));"," assert!(!shell.matches(&BraidShellQuery {"," coordinate: Some(BraidCoordinate([0xDD; 32])),"," fn shell_posture_cannot_exceed_least_revealed_member() {"," CausalPosture::Shared,"," Err(BraidShellError::PostureExceedsMembers(_))"," fn outcome_arm_must_agree_with_member_verdicts() {"," Err(BraidShellError::OutcomeMemberMismatch {"," outcome: AdmissionOutcomeKind::Plural,"," fn collapse_lineage_requires_a_retained_plural_parent() {"," collapse_witness: Some([0x78; 32]),"," collapsed_from: Some(plural_digest),"," let derived_digest = derived.digest;"," let complete = Records::with([plural, derived.clone()]);"," let replay = replay_braid_shell(&derived_digest, &complete).unwrap();"," assert_eq!(replay.outcome_kind, AdmissionOutcomeKind::Derived);"," let missing_parent = Records::with([derived]);"," replay_braid_shell(&derived_digest, &missing_parent),"," Err(BraidShellError::InvalidLineageParent {"," parent: plural_digest,"," fn collapse_policy_must_match_shell_policy_id() {"," BraidShell::assemble("," wl(1),"," basis_ref(),"," vec![member(\"member-a\", MemberVerdict::Derived)],"," [0x5E; 32],"," BraidShellOutcome::Derived {"," result_refs: vec![basis_ref()],"," collapse_policy: Some([0x77; 32]),"," collapse_witness: Some([0x78; 32]),"," collapsed_from: Some(plural_digest),"," },"," CausalPosture::AuthorOnly,"," ),"," Err(BraidShellError::IncoherentCollapsePolicy {"," policy_id: [0x5E; 32],"," collapse_policy: [0x77; 32],"," fn tampering_with_version_fails_validation() {"," shell.version = 999;"," shell.validate(),"," Err(BraidShellError::UnsupportedVersion {"," stored: 999,"," fn plural_alternatives_are_a_canonical_set() {"," let members = vec![member(\"member-a\", MemberVerdict::Plural)];"," let forward = BraidShell::assemble("," alternative_ids: vec![[0x32; 32], [0x31; 32]],"," let reversed = BraidShell::assemble("," alternative_ids: vec![[0x31; 32], [0x32; 32]],"," let mut tampered = forward;"," tampered.outcome = BraidShellOutcome::Plural {"," alternative_ids: vec![[0x32; 32], [0x31; 32]],"," tampered.validate(),"," Err(BraidShellError::NonCanonicalAlternativeOrder)"," // WitnessDigest shrug-rejection is owned and tested in `revelation`;"," // `check_outcome_law` maps it to `BraidShellError::EmptyWitness`, covered"," // by `derived_shell_rejects_empty_collapse_witness` /"," // `obstruction_shell_rejects_empty_witness` below."," fn collapse_with_named_policy_derives_without_mutating_the_plural_parent() {"," use crate::plurality_law::PluralityLawFamily;"," let snapshot = plural.clone();"," let records = Records::with([plural]);"," let policy = CollapsePolicy {"," policy_id: [0x77; 32],"," witness: WitnessDigest::new([0x99; 32]).unwrap(),"," let CollapseResult::Derived(derived) ="," collapse_braid_shell(&records, plural_digest, vec![basis_ref()], Some(policy)).unwrap()"," unreachable!(\"named collapse policy must derive\");"," derived.outcome,"," collapse_witness: Some([0x99; 32]),"," assert_eq!(records.shell(&plural_digest), Some(&snapshot));"," let mut store = Records::with([snapshot]);"," store.0.insert(derived.digest, derived.clone());"," let replay = replay_braid_shell(&derived.digest, &store).unwrap();"," assert_eq!(replay.law_ref.family(), PluralityLawFamily::Collapse);"," let audit = audit_braid_shell(&derived.digest, &store).unwrap();"," audit.law_reading.law_ref().family(),"," PluralityLawFamily::Collapse"," fn collapse_without_policy_is_a_retained_obstruction() {"," assert_eq!(obstructed.outcome_kind(), AdmissionOutcomeKind::Obstruction);"," let BraidShellOutcome::Obstruction { reason_code, .. } = obstructed.outcome else {"," assert_eq!(reason_code, COLLAPSE_WITHOUT_POLICY_REASON);"," obstructed.validate().unwrap();"," fn tick_and_braid_records_are_one_boundary_family() {"," assert_eq!(shell.boundary_kind(), RetainedBoundaryKind::Braid);"," assert_eq!(shell.boundary_digest(), shell.digest);"," fn query_matches_by_basis_member_outcome_and_posture() {"," assert!(shell.matches(&BraidShellQuery::default()));"," basis: Some(basis_ref()),"," revealed_member_strand: Some(make_strand_id(\"member-a\")),"," secure_member: None,"," outcome: Some(AdmissionOutcomeKind::Plural),"," posture: Some(CausalPosture::AuthorOnly),"," outcome: Some(AdmissionOutcomeKind::Conflict),"," revealed_member_strand: Some(make_strand_id(\"nobody\")),"," fn sealed_member_query_requires_secure_material() {"," let strand_id = make_strand_id(\"sealed-member\");"," let child_worldline_id = wl(9);"," let member_authority = authority(0xA1, 0xB1);"," let blinding_secret = [0xA5; 32];"," let member_ref = BraidMemberRef::seal(strand_id, child_worldline_id, blinding_secret);"," member_ref,"," member_authority,"," 0x27,"," assert!(!shell.has_revealed_member_strand(&strand_id));"," assert!(shell.has_member_strand_secure("," &strand_id,"," &child_worldline_id,"," &member_authority,"," &blinding_secret"," assert!(!shell.has_member_strand_secure("," &authority(0xA1, 0xB2),"," revealed_member_strand: Some(strand_id),"," secure_member: Some(BraidShellMemberQuery {"," }),"," let debug = format!("," \"{:?}\","," BraidShellMemberQuery {"," assert!(debug.contains(\"blinding_secret: \\\"\\\"\"));"," assert!(!debug.contains(\"blinding_secret: [\"));"," fn assemble_with_proof_validates_envelope() {"," use crate::proof::{ProofEnvelope, ProofError, ProofKind};"," // Build it without proof first to retrieve the expected witness digest."," assert_eq!(temp_shell.version, BRAID_SHELL_VERSION);"," assert_eq!(BRAID_SHELL_VERSION, 2);"," let expected_witness = temp_shell.witness_digest;"," // Valid replay-trace evidence: matches the witness_digest and has non-empty bytes."," let valid_proof = ProofEnvelope {"," public_inputs_hash: expected_witness,"," let shell_with_valid_proof = BraidShell::assemble_with_proof("," Some(valid_proof),"," assert_eq!(shell_with_valid_proof.version, BRAID_SHELL_VERSION);"," shell_with_valid_proof.validate().unwrap();"," assert_ne!("," temp_shell.digest, shell_with_valid_proof.digest,"," \"proof-bearing shells must have a distinct content identity\""," let mut proof_tampered = shell_with_valid_proof;"," assert!(proof_tampered.proof.is_some());"," if let Some(proof) = proof_tampered.proof.as_mut() {"," proof.proof_bytes.push(4);"," proof_tampered.validate(),"," Err(BraidShellError::DigestMismatch { .. })"," // Invalid proof: mismatched public inputs hash"," let invalid_proof_mismatch = ProofEnvelope {"," public_inputs_hash: [0x99; 32],"," let result_mismatch = BraidShell::assemble_with_proof("," Some(invalid_proof_mismatch),"," result_mismatch,"," Err(BraidShellError::ProofShapeValidationFailed {"," reason: ProofError::PublicInputsMismatch {"," expected,"," actual,"," }) if expected == expected_witness && actual == [0x99; 32]"," // Invalid proof: empty proof bytes"," let invalid_proof_empty = ProofEnvelope {"," proof_bytes: Vec::new(),"," let result_empty = BraidShell::assemble_with_proof("," Some(invalid_proof_empty),"," result_empty,"," reason: ProofError::EmptyPayload,"," fn cryptographic_proof_kinds_require_verifier_backend() {"," for kind in [ProofKind::ZkSnark, ProofKind::VectorOpening] {"," let result = BraidShell::assemble_with_proof("," members.clone(),"," BraidShellOutcome::Plural {"," alternative_ids: vec![[0x31; 32]],"," Some(ProofEnvelope {"," kind,"," proof_bytes: vec![1, 2, 3],"," public_inputs_hash: temp_shell.witness_digest,"," }),"," );"," assert!(matches!("," result,"," Err(BraidShellError::ProofShapeValidationFailed {"," reason: ProofError::UnsupportedKind { kind: rejected },"," }) if rejected == kind"," ));"," fn test_secure_sealed_member_matching() {"," let strand_id = make_strand_id(\"secure-member\");"," let child_worldline = WorldlineId::from_bytes([0x88; 32]);"," let member_authority = authority(0x10, 0x20);"," let blinding_secret = [0x44; 32];"," let blinded_commitment = BraidMemberRef::seal(strand_id, child_worldline, blinding_secret);"," let sealed_ref = BraidMemberRef::Sealed {"," blinded_commitment,"," authority: member_authority,"," // Verification matches correctly."," assert!(sealed_ref.matches_strand("," &child_worldline,"," // Revealed references are not accepted by the sealed secure path."," assert!(!BraidMemberRef::Revealed(strand_id).matches_strand("," // Mismatched strand_id fails."," let wrong_strand_id = make_strand_id(\"wrong-member\");"," assert!(!sealed_ref.matches_strand("," &wrong_strand_id,"," // Mismatched child_worldline fails."," let wrong_child_worldline = WorldlineId::from_bytes([0x99; 32]);"," &wrong_child_worldline,"," // Mismatched authority fails."," &authority(0x10, 0x21),"," // Mismatched blinding secret fails."," &[0x45; 32]",[2922,2923,2924,2925,2926,2927,2928,2929,2930],{"_844":46,"_46":2944},{"_844":2932,"_161":1443,"_868":2942,"_870":2943},{"_844":46,"_46":2941},{"_844":2932,"_161":1443,"_868":2939,"_870":2940},{"_844":46,"_46":2938},{"_844":2932,"_161":995,"_868":2936,"_870":2937},{"_844":46,"_46":2935},{"_844":2932,"_161":862,"_868":2933,"_870":2934},{"_844":46,"_46":2931},"\n* No repository code changes were needed. I restored an unrelated local `pnpm-lock.yaml` working-tree drift and left the branch clean, so I did **not** create a commit or call `make_pr`.\n\n**Testing / Checks**\n\n* ✅ `pwd && find .. -name AGENTS.md -print && git status --porcelain && git log -n 5 --oneline`\n* ✅ `sed -n '1,220p' docs/BEARING.md`\n* ✅ `sed -n '1,220p' METHOD.md`\n* ⚠️ `find backlog/asap -maxdepth 2 -type f -print | sort | head -50` — warning: `backlog/asap` does not exist in this repo state.\n* ✅ `git diff -- pnpm-lock.yaml | sed -n '1,220p'`\n* ✅ `git checkout -- pnpm-lock.yaml && git status --porcelain && git log -n 1 --oneline`\n* ✅ `nl -ba crates/warp-core/tests/witness_public_api_tests.rs | sed -n '150,220p'`\n* ✅ `nl -ba crates/warp-core/src/braid_shell.rs | sed -n '780,835p;1185,1215p'`\n* ✅ `nl -ba crates/warp-core/src/plurality_law.rs | sed -n '120,155p'`\n* ✅ `git status --porcelain`\n* ✅ `nl -ba crates/warp-core/tests/witness_public_api_tests.rs | sed -n '217,240p'`","repo_file_citation",192,230,"\n* Confirmed the sealed-membership public API tests include explicit `WitnessEvidenceMismatch` coverage. ",123,130,"\n* Confirmed `PluralityLawRef::new` Rustdoc now documents both `EmptyName` and `ZeroVersion` errors. ",1194,1203,"\n* Confirmed replay/audit law references still derive collapse shells from the nested collapse policy only after validation coherence is enforced. ",780,797,"### Summary\n\n* Verified the trigger’s reported remediation is already present on `ba972f6`: collapse-derived shells reject mismatched top-level and nested collapse policy identities via `check_collapse_policy_identity`. ",{"_92":323,"_42":84,"_96":323,"_2947":2948,"_2949":2950,"_2951":2952,"_132":-5,"_119":2953},[83],"input_items",[2971,2972,2973,2974,2975,2976,2977,2978,2979,2980,2981,2982,2983,2984,2985,2986,2987,2988,2989,2990,2991,2992,2993,2994,2995,2996,2997,2998,2999],"external_post_config",{"_2954":2955,"_262":196,"_2956":303,"_273":-5,"_2957":256,"_2958":-5,"_2959":2960,"_2961":2962,"_2963":-5,"_2964":-5,"_2965":2966,"_2967":15,"_2968":59,"_2969":54,"_2970":15},"user_model_slug","slug",1781697010.039626,"installation_id",89912914,"pr_number","repo_id","review_trigger","comment_id",4729600068,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",371183350,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":436,"_96":323,"_431":3045},{"_310":311,"_312":313,"_3042":317,"_3043":129,"_319":-5,"_92":3044},{"_92":3000,"_312":3041,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3039,"_161":1443,"_3002":3005,"_3003":3040},{"_92":3000,"_312":3038,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3036,"_161":995,"_3002":3005,"_3003":3037},{"_92":3000,"_312":3035,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3034,"_161":1443,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3033,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3032,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3030,"_161":3021,"_3002":3005,"_3003":3031},{"_92":3000,"_312":3028,"_161":3026,"_3002":3005,"_3003":3029},{"_92":3000,"_312":3019,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3027,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3025,"_161":3026,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3024,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3022,"_161":995,"_3002":3005,"_3003":3023},{"_92":3000,"_312":3020,"_161":3021,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3019,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3018,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3016,"_161":1443,"_3002":3005,"_3003":3017},{"_92":3000,"_312":3014,"_161":862,"_3002":3005,"_3003":3015},{"_92":3000,"_312":3011,"_161":3012,"_3002":3005,"_3003":3013},{"_92":3000,"_312":3010,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3009,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3007,"_161":1443,"_3002":3005,"_3003":3008},{"_92":3000,"_312":3006,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3004,"_161":995,"_3002":3005,"_3003":2937},{"_92":3000,"_312":3001,"_161":-5,"_3002":-5,"_3003":-5},"pull_request_comment","\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
crates/warp-core/src/plurality_law.rs (1)
\n> \n> `521-530`: _🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n> \n> **`PluralityLawAuthorization` public fields allow bypassing registry validation.**\n> \n> External code can construct this directly without calling `registry.authorize()`, creating forged authorization evidence. Same pattern as the P2 issue flagged for `SealedMembershipPresentation` in this PR.\n> \n> If the remediation plan (private fields + read-only accessors) applies here too, consider bundling it.\n> \n> \n> \n>
\n>
Proposed encapsulation
\n> \n> ```diff\n> /// Successful law authorization evidence.\n> #[derive(Clone, Copy, Debug, PartialEq, Eq)]\n> pub struct PluralityLawAuthorization {\n> - /// Authorized law reference.\n> - pub law_ref: PluralityLawRef,\n> - /// Digest of the registered Law Card.\n> - pub card_digest: Hash,\n> - /// Authority that authorized execution, if any.\n> - pub authorized_by: Option,\n> + law_ref: PluralityLawRef,\n> + card_digest: Hash,\n> + authorized_by: Option,\n> +}\n> +\n> +impl PluralityLawAuthorization {\n> + pub const fn law_ref(&self) -> PluralityLawRef { self.law_ref }\n> + pub const fn card_digest(&self) -> Hash { self.card_digest }\n> + pub const fn authorized_by(&self) -> Option { self.authorized_by }\n> }\n> ```\n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@crates/warp-core/src/plurality_law.rs` around lines 521 - 530, The public\n> fields on the PluralityLawAuthorization struct (law_ref, card_digest, and\n> authorized_by) allow external code to construct valid-looking authorization\n> evidence without going through the registry authorization process. Make these\n> three fields private instead of public, and add public getter methods for each\n> field that return the same types they currently expose. This ensures the struct\n> can only be properly instantiated through the intended registry.authorize() code\n> path, preventing forged authorization evidence from being created by external\n> callers.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `2250b624-a5bc-4a38-86ef-6219d88df28e`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between aa04326cb919af45e76782a0b8d9954b42cbe385 and 9da73d6c9596c3f74add555aba8af978b5af3591.\n\n

\n\n

📒 Files selected for processing (5)

\n\n

\n\n","side","line","**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Document the empty-name error**\n\n`PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` for an all-zero law name before it checks the version, but the public `# Errors` contract only mentions `ZeroVersion`. Callers reading generated API docs will miss a typed failure case for this new exported constructor, so please include `EmptyName` in the error docs as well.\n\nUseful? React with 👍 / 👎.","RIGHT","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `bd18b984cb`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Reject mismatched collapse policy ids**\n\nWhen a caller builds a collapse-derived shell with top-level `policy_id` A and nested `collapse_policy` B, validation only requires the collapse lineage fields to be all present, and this branch reports B as the `law_ref` while replay/audit still expose A as `policy_id`. That lets a retained shell validate and replay with two different policy identities; please reject collapse-derived shells whose nested collapse policy differs from `shell.policy_id`.\n\nUseful? React with 👍 / 👎.",1200,"## Self-Code Review Findings\n\n@codex please confirm these findings against `bd18b984`.\n\n| Severity | File | Lines | Infraction | Evidence | Recommended agent prompt |\n|---|---|---:|---|---|---|\n| P1 High | `crates/warp-core/src/braid_shell.rs` | 521-605, 800-819, 1163-1171 | Collapse-derived shells can carry two different policy identities. | `BraidShell::assemble_with_proof` accepts top-level `policy_id` and `BraidShellOutcome::Derived { collapse_policy: Some(...) }` independently. `check_outcome_member_coherence` only checks that collapse fields are all present or absent, not that `collapse_policy == policy_id`. The new `shell_law_ref` then reports the nested `collapse_policy` as the law ref while `BraidShellReplay`/`BraidShellAudit` still expose the top-level `policy_id`, so a validated shell can claim policy A at the shell level and policy B as the named law. The current test at lines 2048-2059 already constructs such a mismatch: top-level `[0x5E; 32]` with nested `[0x77; 32]`, and `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent` passes. | Add a deterministic regression test that assembles a collapse-derived shell with mismatched top-level `policy_id` and nested `collapse_policy` and expects a typed error. Introduce a `BraidShellError` variant for incoherent collapse policy identity, reject the mismatch in both assembly and validation, and update existing tests to use matching identities unless intentionally exercising the error path. |\n| P5 Nit | `crates/warp-core/src/plurality_law.rs` | 123-139 | Rustdoc `# Errors` contract is incomplete. | `PluralityLawRef::new` returns `PluralityLawRefError::EmptyName` at lines 133-135 and `ZeroVersion` at lines 136-138, but its `# Errors` docs only mention `ZeroVersion` at line 127. This is a public constructor in a newly exported API; incomplete error docs are drift. | Update the `PluralityLawRef::new` Rustdoc `# Errors` section to list both `EmptyName` for all-zero law names and `ZeroVersion` for version 0. |\n\nChecks run during review:\n\n- `git status --porcelain` clean before review\n- `git fetch origin`\n- `git diff --check origin/main...HEAD`\n- `cargo fmt --all -- --check`\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md docs/design/braids-and-strands-roadmap.md`\n- `scripts/check_spdx.sh`\n- `scripts/check-no-app-nouns-in-core.sh`\n- `cargo test -p warp-core --lib braid_shell::tests::collapse_lineage_requires_a_retained_plural_parent`\n- `cargo clippy -p warp-core --lib -- -D warnings`\n","**Actionable comments posted: 3**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
CHANGELOG.md (1)
\n> \n> `42-52`: _⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Incomplete: GP4 CHANGELOG entry omits the known sealed-membership field-visibility gap.**\n> \n> The entry describes the validation that sealed presentations perform at construction time, which is accurate. However, it does not mention that the P2 severity issue remains unresolved: `SealedMembershipPresentation` fields are public and can be mutated after construction, circumventing the validation. The design doc (lines 92–94 of goalpost-04) incorrectly claims fields are read-only post-construction.\n> \n> Consider adding a note like \"Remediation of field-visibility constraints is planned as a follow-up\" to signal that the implementation is incomplete on the security boundary, or leave this to the design doc to state more clearly.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@CHANGELOG.md` around lines 42 - 52, The CHANGELOG entry for the warp-core\n> fourth goalpost describes the sealed membership presentation validation but\n> omits mention of the known P2 severity security gap where\n> SealedMembershipPresentation fields are public and can be mutated after\n> construction, circumventing the validation. Add a note to the CHANGELOG entry\n> acknowledging this known issue and indicating that remediation of\n> field-visibility constraints is planned as follow-up work to signal that the\n> security boundary implementation is incomplete.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn `@crates/warp-core/src/braid_shell.rs`:\n- Around line 758-763: The check_policy_id function only validates the main\npolicy_id parameter but ignores the collapse_policy field in Derived outcomes,\nallowing shells with invalid (all-zeros) collapse_policy values to pass\nassembly-time validation and fail only during replay. Extend the\ncheck_outcome_law function to validate the collapse_policy field when it is\npresent in a Derived outcome, ensuring it is not all zeros similar to how\ncheck_policy_id validates the main policy_id, so that invalid shells fail fast\nat assembly time rather than during replay/audit operations.\n\nIn `@crates/warp-core/tests/witness_public_api_tests.rs`:\n- Around line 160-190: The current test\npublic_sealed_membership_presentation_rejects_unbound_receipts only exercises\nthe WitnessSubjectMismatch error path of SealedMembershipPresentation::new. Add\na new dedicated test function that creates a WitnessReceipt with a correct\nsubject digest but an incorrect evidence digest (pass a different value than\nevidence_digest() to the self_witness call), then verify that\nSealedMembershipPresentation::new returns the\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\ncomplete error-path coverage.\n\nIn\n`@docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md`:\n- Around line 92-94: The design document claims that fields in\nSealedMembershipPresentation are read-only after construction, but this is\nfactually incorrect since the current implementation exposes all fields as pub\nin sealed_membership.rs, allowing direct mutation after construction. Either\nupdate the document to accurately describe the current implementation state\n(public mutable fields with a validation closure gap) or explicitly reference\nthe planned remediation work that will address this security issue through\nprivate fields and read-only accessors. Do not assert read-only semantics that\ndo not currently exist in the code.\n\n---\n\nOutside diff comments:\nIn `@CHANGELOG.md`:\n- Around line 42-52: The CHANGELOG entry for the warp-core fourth goalpost\ndescribes the sealed membership presentation validation but omits mention of the\nknown P2 severity security gap where SealedMembershipPresentation fields are\npublic and can be mutated after construction, circumventing the validation. Add\na note to the CHANGELOG entry acknowledging this known issue and indicating that\nremediation of field-visibility constraints is planned as follow-up work to\nsignal that the security boundary implementation is incomplete.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `f75943ab-8448-4d5e-93a1-cc29fe36f0ac`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25 and aa04326cb919af45e76782a0b8d9954b42cbe385.\n\n

\n\n

📒 Files selected for processing (10)

\n\n

\n\n","_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n\n**Factual error: presentation fields are not read-only in the current implementation.**\n\nThe design doc claims \"the fields are read-only after construction,\" but `SealedMembershipPresentation` (in `sealed_membership.rs:109-127`) exposes all fields as `pub`, allowing direct field mutation after construction. This circumvents the constructor's validation and directly contradicts the PR objectives, which explicitly flag this as a P2 severity security issue requiring remediation via private fields + read-only accessors.\n\nEither update this to accurately describe the current state (public fields with validation closure gap) or reference the planned remediation explicitly; do not claim read-only semantics when they don't exist.\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n","docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md",94,"_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Add explicit coverage for `WitnessEvidenceMismatch` in sealed-membership validation.**\n\nLine 161 currently exercises only the subject-mismatch path. Add a dedicated negative test for mismatched evidence digest to lock down the second constructor error branch.\n\n\n\n\n\n\n

Suggested test addition

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/tests/witness_public_api_tests.rs` around lines 160 - 190,\nThe current test public_sealed_membership_presentation_rejects_unbound_receipts\nonly exercises the WitnessSubjectMismatch error path of\nSealedMembershipPresentation::new. Add a new dedicated test function that\ncreates a WitnessReceipt with a correct subject digest but an incorrect evidence\ndigest (pass a different value than evidence_digest() to the self_witness call),\nthen verify that SealedMembershipPresentation::new returns the\nSealedMembershipPresentationError::WitnessEvidenceMismatch variant to ensure\ncomplete error-path coverage.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commit ba972f6",190,"_⚠️ Potential issue_ | _🟡 Minor_ | _⚡ Quick win_\n\n**Validation gap: `collapse_policy` in derived outcomes is not checked at assembly time.**\n\n`check_policy_id` validates only the main `policy_id` parameter. A shell with `policy_id = [0x5E; 32]` but `collapse_policy: Some([0; 32])` in its `Derived` outcome passes assembly and validation, then fails during replay/audit when `shell_law_ref` calls `PluralityLawRef::collapse_policy`.\n\nShells should fail fast at assembly, not during replay. Consider extending `check_outcome_law` to validate `collapse_policy` when present:\n\n

Proposed fix

\n\n\n\n\n\n\nAlso applies to: 1160-1169\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/braid_shell.rs` around lines 758 - 763, The\ncheck_policy_id function only validates the main policy_id parameter but ignores\nthe collapse_policy field in Derived outcomes, allowing shells with invalid\n(all-zeros) collapse_policy values to pass assembly-time validation and fail\nonly during replay. Extend the check_outcome_law function to validate the\ncollapse_policy field when it is present in a Derived outcome, ensuring it is\nnot all zeros similar to how check_policy_id validates the main policy_id, so\nthat invalid shells fail fast at assembly time rather than during replay/audit\noperations.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits bd18b98 to 9da73d6",778,"## Activity Summary\n\n| # | Severity | Source | Area | Commit | Outcome |\n|---:|:---:|---|---|---|---|\n| 1 | P2 | PR | `witness.rs` self-witness overclaims | `3390bb5e` | Rejected stable/independent self-witness receipts; fields made read-only. |\n| 2 | P2 | PR | `plurality_law.rs` evidence posture | `57e47dcc` | Law readings derive posture from attestation strength. |\n| 3 | P2 | PR + Self | `sealed_membership.rs` presentation binding | `7c995864` | Presentations are immutable and validate receipt subject/evidence digests. |\n| 4 | P2 | PR | `plurality_law.rs` / `braid_shell.rs` empty policy refs | `89ec42dc` | Settlement policy refs and braid shell policy ids reject all-zero law names. |\n| 5 | P2 | PR | `braid_shell.rs` collapse law family | `d67b25cd` | Collapse-derived shells report collapse policy ids as collapse laws. |\n| 6 | P5 | PR | `braid_shell.rs` disclosure-budget test coverage | `116e491a` | Sealed-member audit test now asserts shell-level disclosure budget. |\n| 7 | P3 | PR | `plurality_law.rs` Law Card digest allocation | `aa04326c` | `hash_tag_vec` streams exact-size iterators without temporary `Vec` allocation. |\n| 8 | P2 | PR | `plurality_law.rs` law reading support binding | `bd18b984` | `PluralityLawReading::new` is fallible and rejects receipt/support digest mismatches. |\n\nResolved review threads: all 12 thread IDs currently returned by GraphQL are `isResolved: true`.\n\nLocal validation after the final commit:\n\n- `cargo test -p warp-core --lib`\n- `cargo test -p warp-core --test witness_public_api_tests`\n- `cargo test -p warp-core --test plurality_law_public_api_tests`\n- `cargo fmt --all -- --check`\n- `cargo clippy -p warp-core --lib -- -D warnings`\n- `cargo clippy -p warp-core --test witness_public_api_tests -- -D warnings`\n- `cargo clippy -p warp-core --test plurality_law_public_api_tests -- -D warnings`\n- `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md`\n- `git diff --check origin/main...HEAD`\n- `scripts/check_spdx.sh`\n- `scripts/check-no-app-nouns-in-core.sh`\n\nPre-push hooks also reran the configured exact Rust slices and markdown formatting successfully.\n","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `0ca9eb2c1c`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent stable self-witness receipts from being minted**\n\nWhen external code uses this public constructor (or a custom backend returns its result), it can create `WitnessKind::SelfWitness` receipts with `StableV1` compatibility or `IndependentAttestation`, even though the simulator path now rejects stable self-witness requests. Those forged combinations are later consumed as ordinary receipts, so the self-witness scaffold can still overclaim stable or independent evidence unless this constructor rejects incompatible kind/compatibility/attestation pairs or is no longer the public minting path.\n\nUseful? React with 👍 / 👎.","crates/warp-core/src/witness.rs","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind law readings to the witnessed support digest**\n\nWhen a caller passes a `WitnessReceipt` whose `subject_digest` names different material than `support_digest`, this constructor still emits a witnessed `PluralityLawReading` with a normal evidence posture and digest. Downstream consumers can then treat support A as witnessed by a receipt issued for support B; since the braid audit path constructs matching digests, reject mismatched receipt subjects (or make the alternate subject derivation explicit) before accepting the reading.\n\nUseful? React with 👍 / 👎.",634,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject unnamed settlement policy law refs**\n\nWhen a braid shell is assembled with the default/all-zero `policy_id` (the shell constructor and validator do not reject it), this helper bypasses `PluralityLawRef::new` and creates a settlement law whose name is `[0; 32]`. That violates the new named-law invariant and lets audit/replay, registry, and authorization surfaces carry an unnamed law despite `EmptyName` validation, so this path should be fallible or zero policy ids should be rejected before replay creates the law ref.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Make sealed presentations immutable after construction**\n\nWhen a caller validates a `SealedMembershipPresentation` once and then stores or forwards it, this public receipt field (together with the adjacent public claim fields) lets external crates replace either side of the binding after validation, e.g. keep a receipt issued for one member commitment but swap in a different braid, purpose, or authority domain. That breaks the sealed-membership proof invariant and means constructor-side validation would not actually close the unbound receipt/field-pairing hole unless these fields are private with read-only accessors.\n\nUseful? React with 👍 / 👎.","crates/warp-core/src/sealed_membership.rs","| Severity | Source | File | Lines | Issue | Planned handling |\n|---|---|---|---:|---|---|\n| P2 | Self-audit, extension of existing Codex sealed-presentation thread | `crates/warp-core/src/sealed_membership.rs` | 54-66 | `SealedMembershipPresentation` fields are public, so constructor validation alone would still allow callers to mutate a validated presentation into an unbound receipt/field pairing. @codex please sanity-check this closure condition. | Make the presentation fields private, expose read-only accessors, and validate witness subject/evidence digests in the constructor. |","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Bind sealed presentations to their witness receipt**\n\nThis constructor accepts an arbitrary `witness_receipt` and then presents it as supporting the coordinate, purpose, authority, member commitment, and budget, but there is no digest check tying the receipt subject/evidence to those fields. A caller can therefore reuse a receipt from one purpose or braid coordinate in another `SealedMembershipPresentation`, undermining the purpose-bound capability claim made by this new public type.\n\nUseful? React with 👍 / 👎.",108,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Prevent callers from minting self-witness overclaims**\n\nAlthough the simulator rejects `SelfWitness` requests for `StableV1`, this public receipt type/infallible constructor still lets any caller create `WitnessReceipt::new(WitnessKind::SelfWitness, ..., WitnessCompatibilityRule::StableV1, WitnessAttestation::IndependentAttestation)` or mutate equivalent public fields. In contexts that accept caller-supplied receipts, that bypasses the E1-scaffold boundary and reports local self-witness evidence as stable or independent.\n\nUseful? React with 👍 / 👎.",106,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Do not promote integrity-only receipts to external posture**\n\nFor any custom backend or caller that returns a non-self `WitnessReceipt` with `WitnessAttestation::IntegrityOnly`, this fallback classifies the resulting `PluralityLawReading` as `ExternalWitness`, whose documentation says it is independent external evidence. That overstates the evidence posture merely because the receipt kind is not `SelfWitness`; either reject inconsistent receipts or derive this posture from the attestation strength.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Reject empty policy ids in settlement law refs**\n\n`PluralityLawRef::new` rejects all-zero law names, but this convenience constructor bypasses that validation and copies any `policy_id` directly into the law name. Since `BraidShell::assemble` accepts a raw `Hash` policy id, a caller can still retain/replay a shell whose `law_ref` has the forbidden all-zero name, making the new “named law” invariant inconsistent between direct law construction and braid replay/audit.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Report collapse policies as collapse laws**\n\nWhen replaying a shell produced by `collapse_braid_shell(..., Some(CollapsePolicy { policy_id, .. }))`, the shell stores that same id in `outcome.collapse_policy`, but this line always wraps `shell.policy_id` as a `PluralityLawFamily::Settlement` law (and audit repeats the same mapping). Consumers of the new `law_ref`/`law_reading` will see a collapse-derived shell as a settlement-law reading instead of the named collapse law, so law authorization or audit can be performed against the wrong family.\n\nUseful? React with 👍 / 👎.","**Actionable comments posted: 3**\n\n

🤖 Prompt for all review comments with AI agents

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Path: .coderabbit.yaml\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `a38d0ed6-cb79-4852-93ca-8e49a860a31c`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between be0041669c61eee62096b283413780ac742c15f8 and 0ca9eb2c1cd2f7d7f042a9108db37e952028cf25.\n\n

\n\n

📒 Files selected for processing (11)

\n\n

\n\n","_🛠️ Refactor suggestion_ | _🟠 Major_ | _⚡ Quick win_\n\n**Avoid per-digest temporary allocations in `hash_tag_vec`.**\n\nLine 661 allocates a `Vec` for every call, and `PluralityLawCard::digest` calls this helper three times (Lines 379, 386, 390). In `warp-core` deterministic paths, this is avoidable hot-path churn.\n\nAs per coding guidelines, `crates/warp-core/**`: “Performance matters — flag unnecessary allocations in hot paths.”\n\n\n\n\n

Proposed fix

\n\n\nAlso applies to: 660-664\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/plurality_law.rs` around lines 375 - 399, The digest\nmethod of PluralityLawCard calls hash_tag_vec three times with self.requires,\nself.emits, and self.conceals, and each call allocates a temporary Vec in\nthe hash_tag_vec helper function. To eliminate these hot-path allocations,\nrefactor the hash_tag_vec helper to accept a Hasher reference and update it\ndirectly without creating intermediate Vec allocations, then modify all three\ncalls in the digest method to pass the hasher and iterator directly to the\nrefactored helper instead of having the helper create and return a Vec.\n```\n\n

\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326",420,"_⚠️ Potential issue_ | _🟠 Major_ | _⚡ Quick win_\n\n**`settlement_policy` bypasses `PluralityLawRef` validation invariants.**\n\nLine 148 directly constructs `PluralityLawRef` and skips the non-zero-name guard in Line 133. Passing an all-zero `policy_id` produces a ref that `new(...)` would reject, so constructor invariants are inconsistent.\n\n

Proposed fix

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@crates/warp-core/src/plurality_law.rs` around lines 148 - 154, The\nsettlement_policy function directly constructs a PluralityLawRef struct instead\nof using the proper constructor validation method, which bypasses the\nnon-zero-name guard that exists in the new() constructor at line 133. This\ncreates an inconsistency where settlement_policy can create invalid instances\n(such as with an all-zero policy_id) that would be rejected by new(). Refactor\nsettlement_policy to use the proper constructor validation logic instead of\ndirectly constructing the struct, ensuring all invariants are consistently\nenforced regardless of which function creates the PluralityLawRef.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326","_🧹 Nitpick_ | _🔵 Trivial_ | _⚡ Quick win_\n\n**Assert shell-level disclosure budget for sealed-member audits.**\n\nThis test checks `member_facts[0].disclosure_budget` but not `audit.law_reading.disclosure_budget()`. A regression in `shell_disclosure_budget(...)` would slip through.\n\n

Proposed test assertion

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n✅ Addressed in commits 3390bb5 to aa04326",1802,"\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/echo/pull/552?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!WARNING]\n> ## Review limit reached\n> \n> `@flyingrobots`, we couldn't start this review because you've reached your PR review rate limit.\n> \n> More reviews will be available in 32 minutes and 25 seconds. [Learn how PR review limits work](https://docs.coderabbit.ai/management/plans#fair-usage-limits-policy).\n> \n> Your organization has run out of usage credits. Purchase more credits in the [billing tab](https://app.coderabbit.ai/settings/billing?tab=usage&orgId=4252c417-78a1-49cd-a607-68d1e6bdacc4) to continue.\n> \n>

\n>

⌛ How to resolve this issue?

\n> \n> \n>

\n>

🚦 How do rate limits work?

\n> \n>

\n>

ℹ️ Review info

\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Path: .coderabbit.yaml\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `78e6bd64-f639-4702-b413-ce4fbb3253b8`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between 9da73d6c9596c3f74add555aba8af978b5af3591 and ba972f6f64c72351d89eb1c7b7c3c480e538feb1.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (1)

\n> \n> * `crates/warp-core/tests/witness_public_api_tests.rs`\n> \n>

\n> \n>

\n\n\n\n\n\n

📝 Walkthrough

\n\n\n\n\n

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n

✨ Finishing Touches

\n\n

🧪 Generate unit tests (beta)

\n\n- [ ] Create PR with unit tests\n- [ ] Commit unit tests in branch `hardening/witness-receipts-sealed-capabilities`\n\n

\n\n

❤️ Share

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands and usage tips.}\n\n\n\n\n\n\n\n","base_ref","head_ref","pull_request_info",[3046],{"_844":46,"_46":3047},"## Activity Summary\n\n@codex review-thread remediation complete against `ba972f6f`.\n\n| # | Severity | Source | File | Thread / lines | Commit | Outcome |\n|---:|:---:|---|---|---|---|---|\n| 1 | P1 | PR / Codex | `crates/warp-core/src/braid_shell.rs` | `discussion_r3427674226`, L1196-L1200 | `9da73d6c` | Rejected collapse-derived shells whose nested `collapse_policy` differs from the shell `policy_id`; regression covers the incoherent pair. |\n| 2 | P3 | PR / Codex | `crates/warp-core/src/plurality_law.rs` | `discussion_r3427674228`, L130 | `9da73d6c` | Documented both `EmptyName` and `ZeroVersion` in `PluralityLawRef::new` public error contract. |\n| 3 | P4 | PR / CodeRabbit | `crates/warp-core/tests/witness_public_api_tests.rs` | `discussion_r3427283025`, L160-L190 | `ba972f6f` | Added explicit sealed-presentation `WitnessEvidenceMismatch` regression coverage. |\n| 4 | P2 | PR / CodeRabbit | `docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md` / `crates/warp-core/src/sealed_membership.rs` | `discussion_r3427283071`, L92-L94 | `7c995864` | Confirmed the documentation now matches implementation: presentation fields are private after construction and exposed only via read-only accessors. |\n\nReview-thread state: all four remaining threads resolved via GraphQL; a fresh thread inventory returns `0` unresolved threads.\n\nVerification:\n\n| Command | Result |\n|---|---|\n| `git status --porcelain` | clean before audit and clean after push |\n| `git fetch origin` | refs refreshed |\n| `git diff origin/main...HEAD` | audited; no additional self-discovered issues after the queued findings |\n| `cargo test -p warp-core --test witness_public_api_tests public_sealed_membership_presentation_rejects_wrong_evidence_digest -- --exact --list` | RED presence witness failed before the test existed; passes after `ba972f6f` |\n| `cargo test -p warp-core --test witness_public_api_tests public_sealed_membership_presentation_rejects_wrong_evidence_digest -- --exact` | passed |\n| `cargo test -p warp-core --test witness_public_api_tests` | passed, 9 tests |\n| `cargo test -p warp-core --lib` | passed, 565 tests |\n| `cargo fmt --all -- --check` | passed |\n| `cargo clippy -p warp-core --lib --test witness_public_api_tests -- -D warnings` | passed |\n| `cargo check -p warp-core --quiet` | passed |\n| `pnpm exec markdownlint-cli2 CHANGELOG.md docs/design/braids-and-strands-hardening/goalpost-04-witness-receipts-and-sealed-capabilities.md docs/design/braids-and-strands-hardening/goalpost-05-named-plurality-laws.md docs/design/braids-and-strands-roadmap.md` | passed |\n| `scripts/check_spdx.sh` | passed |\n| `scripts/check-no-app-nouns-in-core.sh` | passed |\n| pre-commit hook | passed |\n| pre-push hook | passed |\n",[3374,3375],[],{"_849":850,"_46":851,"_852":853},{"_823":3365},{"_334":3364},{"_334":3083},{"_302":303,"_294":304,"_305":306,"_307":15,"_308":59,"_309":15,"_310":311,"_312":313,"_314":266,"_315":127,"_316":317,"_318":129,"_319":320,"_321":-5,"_322":-5,"_323":3082,"_325":326,"_327":328,"_329":330,"_331":332},{"_42":123,"_193":194,"_195":196,"_197":15,"_198":199,"_200":201,"_202":3071,"_204":-5,"_205":-5,"_206":3072,"_208":209,"_210":209,"_211":3073,"_213":3074,"_215":3075,"_217":-5,"_218":219,"_220":221,"_222":223,"_224":3076,"_55":-5,"_119":226,"_227":3077,"_229":3078,"_231":232,"_233":15,"_234":15},{"_133":3064},[3058,3059,3060,3061,3062,3063],{"_148":171,"_150":165,"_152":166,"_154":163,"_156":172,"_158":159,"_160":32,"_161":-5},{"_148":170,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":168,"_150":165,"_152":166,"_154":163,"_156":169,"_158":159,"_160":32,"_161":-5},{"_148":164,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":162,"_150":151,"_152":153,"_154":163,"_156":157,"_158":159,"_160":32,"_161":-5},{"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":32,"_161":-5},[3065,3066,3067],{"_177":3070,"_179":190},{"_177":3069,"_179":186},{"_177":3068,"_179":180},{"_181":182,"_92":183,"_119":184},{"_181":187,"_92":183,"_119":188},{"_181":191,"_92":183,"_119":192},{"_296":297,"_298":-5,"_299":-5,"_300":-5,"_301":-5},[256],{"_256":3079},{"_238":239,"_240":241,"_242":243,"_244":245,"_246":247,"_248":249,"_250":251,"_252":253,"_254":255},{},[],{"_237":59},{"_235":59,"_236":209},{"_42":258,"_181":259,"_260":3080,"_262":196,"_263":264,"_265":266,"_267":268,"_269":270,"_271":272,"_273":64,"_274":-5,"_275":-5,"_276":-5,"_277":-5,"_278":-5,"_279":-5,"_280":-5,"_160":281,"_282":-5,"_55":3081},{"_288":289,"_42":290,"_92":291,"_292":293,"_294":295},{"_284":15,"_285":15,"_286":15,"_287":15},{"_288":289,"_181":289,"_333":-5,"_292":293,"_42":290},[3084,3085,3086,3087,3088,3089,3090,3091,3092,3093,3094,3095,3096,3097,3098,3099,3100,3101,3102,3103,3104,3105,3106,3107,3108,3109,3110,3111,3112,3113,3114,3115,3116,3117,3118,3119,3120,3121,3122,3123,3124,3125,3126,3127,3128,3129,3130,3131,3132,3133,3134,3135,3136,3137,3138,3139,3140,3141,3142,3143,3144,3145,3146,3147,3148,3149,3150,3151,3152,3153],{"_154":802,"_407":3360},{"_154":422,"_407":3357},{"_154":792,"_407":3354},{"_154":426,"_407":3349},{"_154":426,"_407":3344},{"_154":426,"_407":3340},{"_154":440,"_407":3335},{"_154":440,"_407":3331},{"_154":426,"_407":3327},{"_154":426,"_407":3325},{"_154":440,"_407":3321},{"_154":426,"_407":3319},{"_154":440,"_407":3315},{"_154":426,"_407":3312},{"_154":426,"_407":3310},{"_154":426,"_407":3308},{"_154":426,"_407":3306},{"_154":440,"_407":3302},{"_154":440,"_407":3298},{"_154":426,"_407":3296},{"_154":426,"_407":3294},{"_154":440,"_407":3290},{"_154":426,"_407":3288},{"_154":440,"_407":3284},{"_154":426,"_407":3280},{"_154":426,"_407":3278},{"_154":440,"_407":3274},{"_154":426,"_407":3272},{"_154":440,"_407":3268},{"_154":426,"_407":3265},{"_154":426,"_407":3263},{"_154":440,"_407":3259},{"_154":426,"_407":3257},{"_154":440,"_407":3253},{"_154":426,"_407":3249},{"_154":426,"_407":3247},{"_154":426,"_407":3245},{"_154":426,"_407":3243},{"_154":426,"_407":3241},{"_154":440,"_407":3237},{"_154":426,"_407":3235},{"_154":426,"_407":3233},{"_154":426,"_407":3231},{"_154":426,"_407":3229},{"_154":440,"_407":3225},{"_154":440,"_407":3221},{"_154":440,"_407":3217},{"_154":440,"_407":3213},{"_154":426,"_407":3210},{"_154":426,"_407":3208},{"_154":426,"_407":3206},{"_154":426,"_407":3204},{"_154":426,"_407":3202},{"_154":426,"_407":3200},{"_154":426,"_407":3198},{"_154":440,"_407":3194},{"_154":426,"_407":3191},{"_154":426,"_407":3189},{"_154":426,"_407":3187},{"_154":440,"_407":3183},{"_154":426,"_407":3180},{"_154":426,"_407":3178},{"_154":440,"_407":3174},{"_154":426,"_407":3172},{"_154":440,"_407":3168},{"_154":426,"_407":3165},{"_154":440,"_407":3163},{"_154":426,"_407":3159},{"_154":422,"_407":3157},{"_154":406,"_407":3154},{"_409":410,"_87":3155},{"_412":413,"_414":415,"_103":-5,"_42":416,"_417":3156,"_419":420,"_421":113},[],{"_421":3158,"_409":410},{"_92":425},{"_428":3160,"_409":410,"_430":416},{"_431":3161,"_433":-5,"_42":-5,"_434":435,"_96":93,"_92":436},[3162],{"_46":438,"_92":439},{"_428":3164,"_409":410,"_430":416},{"_42":443,"_434":435,"_46":438,"_92":444},{"_428":3166,"_409":410,"_430":416},{"_431":-5,"_447":448,"_42":-5,"_449":3167,"_92":451},[],{"_428":3169,"_409":410,"_430":416},{"_431":3170,"_42":455,"_449":3171,"_92":451},[],[],{"_428":3173,"_409":410,"_430":416},{"_459":460,"_461":462,"_92":463},{"_428":3175,"_409":410,"_430":416},{"_466":467,"_468":469,"_470":3176,"_472":473,"_414":32,"_474":32,"_42":460,"_475":476,"_477":478,"_421":113,"_92":479},[3177],{"_468":481,"_181":482,"_161":483,"_92":484},{"_428":3179,"_409":410,"_430":416},{"_487":488,"_459":460,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3181,"_409":410,"_430":416},{"_431":-5,"_447":494,"_42":-5,"_449":3182,"_92":451},[],{"_428":3184,"_409":410,"_430":416},{"_431":3185,"_42":499,"_449":3186,"_92":451},[],[],{"_428":3188,"_409":410,"_430":416},{"_459":503,"_461":504,"_92":463},{"_428":3190,"_409":410,"_430":416},{"_487":507,"_459":503,"_42":-5,"_181":508,"_490":-5,"_92":491},{"_428":3192,"_409":410,"_430":416},{"_431":-5,"_447":511,"_42":-5,"_449":3193,"_92":451},[],{"_428":3195,"_409":410,"_430":416},{"_431":3196,"_42":516,"_449":3197,"_92":451},[],[],{"_428":3199,"_409":410,"_430":416},{"_459":520,"_461":521,"_92":463},{"_428":3201,"_409":410,"_430":416},{"_459":524,"_461":525,"_92":463},{"_428":3203,"_409":410,"_430":416},{"_459":528,"_461":529,"_92":463},{"_428":3205,"_409":410,"_430":416},{"_487":532,"_459":520,"_42":-5,"_181":508,"_490":-5,"_92":491},{"_428":3207,"_409":410,"_430":416},{"_487":535,"_459":524,"_42":-5,"_181":508,"_490":-5,"_92":491},{"_428":3209,"_409":410,"_430":416},{"_487":538,"_459":528,"_42":-5,"_181":508,"_490":-5,"_92":491},{"_428":3211,"_409":410,"_430":416},{"_431":-5,"_447":541,"_42":-5,"_449":3212,"_92":451},[],{"_428":3214,"_409":410,"_430":416},{"_431":3215,"_42":546,"_449":3216,"_92":451},[],[],{"_428":3218,"_409":410,"_430":416},{"_466":550,"_468":551,"_470":3219,"_472":473,"_414":553,"_474":32,"_42":554,"_475":555,"_477":478,"_421":113,"_92":479},[3220],{"_468":557,"_181":558,"_161":559,"_92":484},{"_428":3222,"_409":410,"_430":416},{"_466":562,"_468":563,"_470":3223,"_472":473,"_414":565,"_474":32,"_42":566,"_475":567,"_477":478,"_421":113,"_92":479},[3224],{"_468":569,"_181":570,"_161":571,"_92":484},{"_428":3226,"_409":410,"_430":416},{"_466":574,"_468":575,"_470":3227,"_472":473,"_414":577,"_474":32,"_42":578,"_475":579,"_477":478,"_421":113,"_92":479},[3228],{"_468":581,"_181":482,"_161":483,"_92":484},{"_428":3230,"_409":410,"_430":416},{"_459":584,"_461":585,"_92":463},{"_428":3232,"_409":410,"_430":416},{"_459":566,"_461":588,"_92":463},{"_428":3234,"_409":410,"_430":416},{"_459":554,"_461":591,"_92":463},{"_428":3236,"_409":410,"_430":416},{"_459":578,"_461":594,"_92":463},{"_428":3238,"_409":410,"_430":416},{"_466":-5,"_468":597,"_470":3239,"_472":473,"_414":32,"_474":32,"_42":584,"_475":599,"_477":478,"_421":113,"_92":479},[3240],{"_468":601,"_92":602},{"_428":3242,"_409":410,"_430":416},{"_487":605,"_459":584,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3244,"_409":410,"_430":416},{"_487":608,"_459":566,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3246,"_409":410,"_430":416},{"_487":611,"_459":554,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3248,"_409":410,"_430":416},{"_487":614,"_459":578,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3250,"_409":410,"_430":416},{"_431":-5,"_447":617,"_42":-5,"_449":3251,"_92":451},[3252],{"_46":620,"_92":621},{"_428":3254,"_409":410,"_430":416},{"_431":3255,"_42":625,"_449":3256,"_92":451},[],[620],{"_428":3258,"_409":410,"_430":416},{"_459":629,"_461":630,"_92":463},{"_428":3260,"_409":410,"_430":416},{"_466":633,"_468":634,"_470":3261,"_472":473,"_414":32,"_474":32,"_42":629,"_475":636,"_477":478,"_421":113,"_92":479},[3262],{"_468":638,"_92":602},{"_428":3264,"_409":410,"_430":416},{"_487":641,"_459":629,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3266,"_409":410,"_430":416},{"_431":-5,"_447":644,"_42":-5,"_449":3267,"_92":451},[],{"_428":3269,"_409":410,"_430":416},{"_431":3270,"_42":649,"_449":3271,"_92":451},[],[],{"_428":3273,"_409":410,"_430":416},{"_459":653,"_461":654,"_92":463},{"_428":3275,"_409":410,"_430":416},{"_466":657,"_468":658,"_470":3276,"_472":473,"_414":32,"_474":32,"_42":653,"_475":660,"_477":478,"_421":113,"_92":479},[3277],{"_468":662,"_92":602},{"_428":3279,"_409":410,"_430":416},{"_487":665,"_459":653,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3281,"_409":410,"_430":416},{"_431":-5,"_447":668,"_42":-5,"_449":3282,"_92":451},[3283],{"_46":671,"_92":621},{"_428":3285,"_409":410,"_430":416},{"_431":3286,"_42":675,"_449":3287,"_92":451},[],[671],{"_428":3289,"_409":410,"_430":416},{"_459":679,"_461":680,"_92":463},{"_428":3291,"_409":410,"_430":416},{"_466":683,"_468":684,"_470":3292,"_472":473,"_414":32,"_474":32,"_42":679,"_475":686,"_477":478,"_421":113,"_92":479},[3293],{"_468":688,"_161":689,"_92":690},{"_428":3295,"_409":410,"_430":416},{"_459":693,"_461":694,"_92":463},{"_428":3297,"_409":410,"_430":416},{"_459":697,"_461":698,"_92":463},{"_428":3299,"_409":410,"_430":416},{"_466":701,"_468":702,"_470":3300,"_472":473,"_414":32,"_474":32,"_42":697,"_475":704,"_477":478,"_421":113,"_92":479},[3301],{"_468":706,"_181":707,"_161":708,"_92":484},{"_428":3303,"_409":410,"_430":416},{"_466":711,"_468":712,"_470":3304,"_472":473,"_414":32,"_474":32,"_42":693,"_475":714,"_477":478,"_421":113,"_92":479},[3305],{"_468":716,"_181":717,"_161":718,"_92":484},{"_428":3307,"_409":410,"_430":416},{"_487":721,"_459":679,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3309,"_409":410,"_430":416},{"_487":724,"_459":693,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3311,"_409":410,"_430":416},{"_487":727,"_459":697,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3313,"_409":410,"_430":416},{"_431":-5,"_447":730,"_42":-5,"_449":3314,"_92":451},[],{"_428":3316,"_409":410,"_430":416},{"_431":3317,"_42":735,"_449":3318,"_92":451},[],[],{"_428":3320,"_409":410,"_430":416},{"_459":739,"_461":740,"_92":463},{"_428":3322,"_409":410,"_430":416},{"_466":743,"_468":744,"_470":3323,"_472":473,"_414":32,"_474":32,"_42":739,"_475":746,"_477":478,"_421":113,"_92":479},[3324],{"_468":748,"_92":602},{"_428":3326,"_409":410,"_430":416},{"_487":751,"_459":739,"_42":-5,"_181":489,"_490":-5,"_92":491},{"_428":3328,"_409":410,"_430":416},{"_431":-5,"_447":754,"_42":-5,"_449":3329,"_92":451},[3330],{"_46":757,"_92":621},{"_428":3332,"_409":410,"_430":416},{"_431":3333,"_42":761,"_449":3334,"_92":451},[],[757],{"_428":3336,"_409":410,"_430":416},{"_431":3337,"_42":766,"_92":767},[3338],{"_46":769,"_770":3339,"_92":46},[],{"_428":3341,"_409":410,"_430":416},{"_431":3342,"_433":-5,"_42":-5,"_434":-5,"_96":323,"_92":436},[3343],{"_46":769,"_92":776},{"_428":3345,"_409":410,"_430":416},{"_431":3346,"_433":-5,"_42":-5,"_434":-5,"_96":323,"_92":436},[3347,3348],{"_46":783,"_92":776},{"_46":782,"_92":776},{"_428":3350,"_409":410,"_430":416},{"_431":3351,"_433":-5,"_42":-5,"_434":-5,"_96":787,"_92":436},[3352,3353],{"_46":791,"_92":776},{"_46":790,"_92":776},{"_409":410,"_87":3355},{"_103":-5,"_42":416,"_417":3356,"_419":420,"_421":796},[],{"_421":3358,"_409":410},{"_799":3359,"_92":801},[],{"_804":3361},{"_806":-5,"_807":-5,"_808":809,"_810":420,"_472":473,"_811":15,"_812":-5,"_813":-5,"_42":410,"_814":815,"_181":-5,"_161":816,"_817":209,"_477":818,"_421":3362,"_77":3363,"_821":420},{"_92":425},[],[],[3366],{"_42":826,"_827":3367,"_829":830,"_831":830,"_431":3368,"_421":833,"_433":-5,"_834":32,"_835":3369,"_837":838,"_839":-5},{"_96":323,"_181":-5,"_835":3373},{"_844":46,"_845":3372},{"_840":3370},{"_842":3371},[],[847],{},{"_92":436,"_96":93,"_431":3389},{"_92":856,"_857":3376},[3377,3378,3379],{"_161":1443,"_863":-5,"_864":3386,"_866":-5},{"_161":995,"_863":-5,"_864":3383,"_866":-5},{"_161":862,"_863":-5,"_864":3380,"_866":-5},[3381],{"_868":869,"_870":871,"_431":3382,"_873":59},[874,875,209,876,209,877,878,879,880,881,882,883,209,884,885,886,209,887,888,886,209,889,890,891,892,893,886,209,894,895,896,897,898,899,900,901,902,209,903,904,905,906,907,902,886,209,894,908,909,897,910,899,900,901,902,209,911,912,209,913,914,903,915,916,902,917,918,919,886,209,894,920,921,897,922,899,900,901,902,209,903,904,923,924,925,907,902,886,209,894,926,927,897,928,899,900,901,902,209,903,904,929,930,931,907,902,886,209,894,932,903,933,934,935,936,937,938,939,929,930,931,907,902,903,933,934,935,936,940,941,939,942,930,943,907,902,886,209,894,944,945,910,899,900,946,947,948,949,910,899,900,901,947,948,209,950,919,886,209,894,951,952,953,954,955,956,957,958,959,960,961,962,902,963,209,903,964,965,966,967,968,969,970,939,971,972,973,907,902,886,209,894,974,952,953,954,955,956,975,958,959,960,961,962,902,976,958,959,960,961,962,902,977,978,979,209,903,964,965,966,967,968,969,970,939,980,972,981,907,902,886,209,894,982,983,952,953,954,955,956,975,958,959,960,961,962,902,984,958,959,960,961,962,902,985,986,958,959,960,961,987,962,948,209,988,989,990,991,992,993,994,919,886],[3384],{"_868":869,"_870":998,"_431":3385,"_873":59},[874,875,1000,209,1001,209,1002,1003,209,1004,1005,1006,1007,209,1008,1009,1010,1011,1012,209,1013,1014,1015,209,1016,1017,1018,1019,1020,1021,209,1022,1018,1023,1024,1025,1026,1027,1028,1021,209,1029,1018,1030,1031,1021,886,209,1032,1014,1033,1034,1035,1036,1037,1038,1039,1040,1041,1042,1043,1044,1045,1046,1047,1048,886,209,1049,1050,1018,1051,1052,1053,1054,1021,209,1055,1056,1057,1058,1059,1060,1061,1059,1062,1063,1059,1064,1065,1059,1066,1067,1059,1068,1069,1070,1059,1054,1021,886,209,1071,1072,1073,1074,1075,1076,1077,1078,1079,886,209,1080,1014,1081,1082,1083,1084,886,209,1085,1086,1087,1088,1087,1089,1090,1087,1091,1092,1093,1094,1095,1096,1097,1098,1054,1099,1100,1054,1101,1102,1103,1104,907,1021,209,1105,1087,1088,1087,1106,1107,1108,1109,1110,1111,1112,1113,1021,209,1114,1087,1088,1087,1106,1107,1115,1109,1116,1111,1112,1113,1021,209,1117,1018,1118,1119,1021,209,1120,1018,1121,1122,1021,209,1123,1018,1124,1125,1021,209,1126,1018,1127,1024,1128,1129,1130,1021,209,1055,1131,1132,1133,1021,886,209,1134,1014,1135,1136,1137,1138,1139,1140,1141,1142,1143,1144,1145,1146,1147,1148,1149,886,209,1150,1151,1056,1152,1153,1154,1155,1156,1157,1158,1054,1021,886,209,1159,1014,1160,1161,1162,1163,1164,1165,1166,1167,1168,1169,1170,886,209,1171,1151,1056,1172,1173,1174,1175,1176,1054,1021,886,209,1177,1014,1178,1179,1180,1181,1182,1183,1184,886,209,1185,1151,1056,1186,1187,1188,1054,1021,886,209,1189,1014,1190,1191,1192,1193,1194,886,209,1195,1151,1056,1196,1197,1054,1021,886,209,1198,1072,1199,1200,1201,1202,886,209,1203,1204,1205,1206,1207,1208,1209,1210,886,209,1211,1212,1087,1213,1214,1087,1088,1087,1215,1216,1092,1217,1218,1219,1220,1221,1222,1223,1224,1225,1054,1101,1226,1227,1228,1229,1230,907,1021,209,1231,1018,1232,1233,1021,209,1123,1018,1234,1235,1021,209,1236,1018,1237,1238,1021,209,1239,1018,1240,1241,1021,209,1242,1018,1243,1244,1021,209,1245,1018,1246,1247,1021,209,1248,1018,1249,1024,1250,1251,1252,1253,1254,1255,1256,1257,1258,1252,1253,1259,1258,1252,1253,1260,1255,1256,1261,1258,1262,1130,1021,886,209,1263,1264,1265,1266,1267,1268,1269,1217,1048,886,209,1270,1271,1272,1273,886,209,1274,1275,1018,1276,1277,1278,1054,1021,209,1279,1087,1088,1087,1280,1281,1282,1283,1284,1285,1054,1286,1287,1021,209,1288,1018,1289,1290,1021,209,1291,1018,1292,1293,1021,209,1294,1018,1295,1296,1021,209,1297,1087,1088,1087,1298,1299,1300,1301,1302,1217,1303,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1318,1319,1320,1321,1059,1054,1322,1226,1323,1324,907,1021,886,209,1325,1326,1327,1328,1329,1330,1331,1332,1333,886,209,1334,1014,1335,1336,1337,1338,1339,886,209,1340,1151,1056,1341,1342,1054,1021,886,209,1343,1326,1344,1345,1346,1347,1329,1348,1349,886,209,1350,1351,1018,1092,1352,1217,1303,1353,1354,1277,1355,1226,1324,1054,1021,209,1356,1018,1127,1024,1357,1358,1251,1359,1130,1021,886,209,1360,1326,1361,1206,1362,1363,1210,1364,886,209,1365,1072,1366,1367,1368,1369,1370,1371,1372,1373,1374,1375,1048,886,209,1376,1377,1087,1088,1087,1378,1379,1092,1217,1380,1381,1382,1383,1384,1385,1386,1387,1388,1389,1054,1390,1101,1226,1391,1392,1230,970,907,1021,209,1393,1018,1394,1233,1021,209,1395,1018,1396,1397,1021,209,1398,1018,1399,1400,1021,209,1401,1018,1402,1247,1021,209,1403,1018,1404,1405,1021,209,1406,1018,1127,1024,1407,1251,1408,1409,1262,1410,1130,1021,886,209,1411,1412,1413,1414,1021,886,209,1415,1416,1417,1418,886,209,1419,1420,886,209,1421,1422,1423,1424,1021,886,209,1425,1426,1427,1428,1429,886,209,1430,1431,1432,1433,1434,1435,1021,886,209,1436,1437,1438,1439,1440,1441,1442,1021,886],[3387],{"_868":869,"_870":1446,"_431":3388,"_873":59},[874,875,1448,1449,1450,1451,1452,1453,1454,1455,1456,1457,1449,1458,1459,1460,1461,1462,209,1002,209,1463,1004,1464,1465,1466,1467,883,1006,1468,1469,1470,209,1471,1472,1473,1474,1475,209,1476,1477,1478,1479,1480,209,1481,1326,1482,1483,1484,1485,1486,1487,1488,1489,1490,1491,886,209,1492,1151,1056,1493,1494,1495,1496,1054,1021,886,209,1497,1014,1498,1499,1500,1501,1502,1503,1504,1505,1506,1048,886,209,1507,1508,1509,1018,1510,1511,1512,1513,1514,1024,1515,1516,1517,1518,1130,1021,209,1519,1520,1018,1521,1302,1522,1523,1524,1525,1526,1056,1527,1528,1529,1530,1531,1532,1533,1059,1054,1021,209,1534,1535,1021,209,1536,1018,1537,1056,1538,1539,1054,1021,209,1540,1541,1542,1056,1543,1544,1059,1528,1529,1545,1531,1546,1547,1548,1059,1054,1021,886,209,1549,1204,1550,1551,1552,1553,1554,1555,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1567,1568,886,209,1569,1570,1018,1571,1024,1572,1573,1574,1575,1576,1577,1578,1579,1580,1581,1130,1021,886,209,1582,1477,1583,1584,1204,1585,1586,1587,1588,1589,1590,1591,1592,1593,1594,1595,1048,1596,1597,1598,1599,1048,1600,1601,1602,1603,1048,1604,1605,1606,1607,1608,1609,1610,1611,1048,886,209,1612,1613,1018,1614,1056,1615,1616,1617,1618,1054,1021,209,1619,1056,1620,1621,1622,1623,1624,1531,1625,1626,1627,1628,1629,1630,1631,1632,1059,1633,1634,1635,1636,1637,1629,1059,1638,1639,1640,1641,1059,1642,1643,1644,1645,1531,1646,1647,1648,1649,1059,1054,1021,886,209,1650,1651,1652,1653,886,209,1654,1655,1656,1657,1658,1054,1659,1660,1054,1021,886,209,1661,1662,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1674,1048,1675,1676,1677,1678,1679,1680,1681,1048,1682,1683,1684,1685,1679,1686,1681,1048,1687,1688,1689,1690,1691,1048,1692,1693,1694,1695,1696,1697,1698,1699,1048,1700,1701,1702,1703,1699,1048,1704,1705,1706,1707,1708,1709,1710,1048,1711,1712,1713,1714,1715,1716,1717,1718,1719,1720,1721,1722,1723,1048,1724,1725,1726,1727,1728,1729,1730,1731,1732,1733,1734,1735,1736,1737,1048,1738,1739,1740,1741,1742,1743,1744,1745,1048,1746,1747,1748,1749,1750,1048,1751,1752,1753,1754,1755,1756,1757,1758,1759,1760,1761,1762,1048,886,209,1763,1477,1764,1765,1766,1767,209,1768,1769,1024,1770,1771,1772,1773,1774,1054,1775,1028,1021,886,209,1776,1204,1777,1778,1779,1780,1781,1782,1783,1784,1785,1786,1787,1788,1789,1790,1791,1792,1087,1793,1794,1795,1796,1797,1798,1799,1568,1800,1801,1802,1803,886,209,1804,1805,1806,1087,1088,1087,1807,1808,1809,1810,1811,1812,1813,1814,1815,1816,1817,1818,1819,1820,1821,1822,1823,1721,1824,1825,1826,1827,1828,1829,1830,1831,1832,1833,1834,1113,1021,209,1835,1836,1837,1838,1839,1087,1088,1087,1840,1841,1842,1821,1822,1843,1721,1844,1825,1845,1826,1846,1847,1054,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,1858,1859,1860,1861,1862,1863,1059,1054,1864,1865,1866,1315,1867,1054,1868,209,1869,1870,1871,1872,1873,1874,1875,1876,1877,1828,1878,1879,1831,1880,1833,1258,209,1881,1882,1883,1059,1054,1884,209,1885,1877,1828,1878,1879,1831,1880,1886,1833,1887,1258,1101,1888,965,1828,1829,1830,1831,1832,1886,1833,1889,1890,907,1021,209,1891,1087,1088,1087,1892,1893,1894,1895,1896,1897,1898,1899,1900,1901,1902,1903,1389,1054,1904,1847,1054,1905,1906,1907,1908,1909,1910,1872,1873,1874,1911,1912,1054,1913,1914,1915,1916,1059,1856,1857,1858,1859,1860,1861,1862,1863,1059,1054,1917,1918,1919,1920,1921,1867,1054,1922,1923,1315,1924,1054,209,1925,1926,1927,1928,1879,1929,1930,1919,1258,1931,1932,1933,1934,1389,1054,1935,1936,1883,1059,1054,1937,209,1885,1926,1927,1928,1879,1929,1930,1938,1919,1887,1258,1939,1940,1941,1942,1389,1054,1287,1021,209,1613,1018,1943,1944,1021,209,1945,1018,1946,1947,1948,1949,907,1021,209,1950,1951,1018,1952,1302,1522,1523,1524,1525,1526,1953,1954,1955,1956,1545,1957,1310,907,1021,886,209,1958,1959,1960,1961,1962,1963,1964,1054,1965,1966,1054,1967,1021,919,886,209,1968,1969,1970,1021,919,886,209,1971,1972,1973,1974,1975,1976,1977,1978,1979,1980,1981,1982,1983,1389,1054,1021,919,886,209,1984,1985,1986,1987,1988,1872,1989,1315,1990,1054,1021,1991,1992,1993,1994,1995,1389,1054,1021,919,886,209,1996,1973,1997,1974,1998,1999,2000,2001,1999,2002,2003,1962,2004,2005,2006,1964,2007,2008,2009,2010,2011,2012,2013,2014,1860,2015,1059,2016,2017,2018,1054,2019,2020,2021,2022,2023,1287,1434,2024,2025,907,1021,886,209,2026,2027,2028,1084,2029,2030,2031,1972,1973,2032,2033,2034,2035,2036,2037,2038,2039,1021,2040,2041,2042,886,209,2026,2043,1084,2029,2030,2031,1972,1973,2032,2044,1426,2045,2046,2047,2048,2049,2050,2051,2052,2053,2054,902,1429,886,209,2026,2055,1084,2029,2030,2031,1972,1973,2056,2032,2057,2044,1426,2058,2046,2047,2048,2049,2050,2051,2052,2053,2054,902,2059,2060,2061,2062,2063,1054,1659,2064,1054,1021,1429,886,209,2065,1477,2066,2067,2068,2069,2070,2071,886,209,2072,2073,2074,1021,886,209,2075,1204,2076,2077,2078,2079,2080,2081,1789,2082,1329,2083,1798,2084,1568,886,209,2085,1326,2086,2087,2088,2089,2090,2091,2092,2093,2094,2095,2096,2097,1048,886,209,2098,1326,2099,2100,2101,2102,2103,1699,1048,886,209,2104,1326,2105,2106,1552,2107,1564,2108,1568,1553,1554,1555,1556,2109,1558,2110,1560,2111,1562,2112,1566,2113,2114,886,209,2115,1204,2116,2117,2118,1780,1781,2077,2078,2081,1789,2119,2120,2121,2122,2123,2124,2125,2126,2127,2128,2129,2130,2131,2132,2133,2134,886,209,2135,1477,2136,2137,2138,2139,2140,1477,2141,1477,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,1910,1872,2153,2154,2155,2156,2157,2158,2159,886,209,2160,1477,2161,2162,2163,2164,1477,2141,1477,2142,2143,2165,2145,2146,2166,2148,2167,2168,1999,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,1059,2180,2181,2149,2182,2156,2183,2184,2185,948,209,2186,2187,2188,2151,2155,2189,2190,2191,2192,1910,1872,2193,2154,2194,1910,1872,2195,1995,2196,2197,2198,2199,2200,2201,2202,2203,2204,2205,2154,2206,2207,2208,2209,2184,2159,886,209,2210,2211,2212,2213,1021,886,209,2214,2215,2168,1999,2216,1979,2217,1434,2218,1021,886,209,2219,2220,1962,2221,1964,2222,2223,1021,2224,886,209,2225,2145,2226,2227,2228,2229,2230,2231,2232,2233,2234,2235,2180,1021,2236,1962,2237,1964,1054,2238,2239,1964,2240,2241,2022,2242,2243,2244,2245,2246,2247,2248,2249,2250,2251,2252,1389,1054,1021,2253,886,209,2254,2255,209,2256,2257,209,2258,1326,2259,2260,1789,2261,2262,886,209,2263,1204,2264,2265,2266,2267,2268,886,209,2269,1477,2270,2271,2272,2273,2274,1477,2275,2276,1477,2141,1477,2277,2278,2279,2146,2280,2281,2282,2283,2284,2285,2286,2287,1311,2288,2289,2290,2291,2180,1021,209,2292,2293,2294,2295,2296,2297,2298,2299,2300,2301,2302,2303,2304,2305,2306,1021,209,2307,2308,2309,2310,2311,2312,2313,2314,2315,2316,2317,2318,2319,2320,2209,2321,948,2322,886,209,2323,1477,2324,2325,1326,2326,2327,2328,2329,2330,886,209,2331,2332,2333,2334,2335,2336,886,209,2337,2338,2339,1021,209,2340,2341,1021,886,209,2342,209,2343,2338,2344,1021,209,2345,2346,2347,2348,2349,2350,2351,2352,2340,1024,2353,2354,2355,2356,2357,2358,2359,2360,2361,2362,2363,2364,2365,2366,2367,2368,2369,2370,1629,2371,2372,1629,1059,2373,2374,2375,2376,1059,2377,2378,2379,2380,2381,2368,2382,2383,2384,2385,2386,2387,2388,2389,1629,2371,2372,1629,1059,2390,2391,2392,2393,2394,2395,1059,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2407,1629,2410,2411,1059,1054,2412,2413,1130,1021,886,209,2414,2415,2416,2417,2418,2419,2420,2421,2422,2423,2424,886,209,2425,2426,2427,2428,2429,2430,2431,2432,1021,886,209,2433,2434,2435,2436,2437,2438,2439,2440,2441,2442,2443,2444,2445,2446,2447,886,209,1804,2448,1018,2449,2450,2451,2452,2453,2454,2455,2456,2457,2458,2459,2460,2461,2462,2463,2464,2205,2454,2465,2466,2467,1021,886,209,2468,2469,2470,2471,2472,2473,2474,209,2475,2476,1021,209,2477,2478,2479,2480,2481,1054,1021,209,2482,2483,2484,2485,2486,2487,2488,2489,2490,2491,2492,1054,1021,209,2493,2494,2495,2496,1113,1021,209,2497,2498,1506,2499,2500,2501,2483,2502,2503,1545,2303,2485,2486,2487,2488,2504,2490,2491,2492,1054,1021,209,2505,2506,2507,2508,1830,2509,2510,2511,2303,2512,1113,2513,1021,209,2514,209,2515,2516,2517,2518,2519,2520,2521,1310,1054,1021,209,2522,2523,2524,1054,1021,209,2525,2526,2527,2528,2529,2530,209,2531,2532,1021,209,2525,2533,2534,209,2535,2536,2537,2538,2539,2540,1910,1872,2153,1874,2541,209,2542,2543,2544,2545,2546,2547,2548,1258,2549,1021,209,2525,2550,2551,2552,2553,2554,209,2555,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,2559,2560,2561,2562,2563,2564,2507,2508,1830,2509,2510,2511,2303,2512,2565,1113,2558,2539,2566,2567,2568,2541,209,2569,209,2570,2571,2546,2572,2548,1258,2573,2546,2574,2575,1258,2546,2576,2577,1258,2578,2579,2580,2546,2581,2582,2583,2584,2585,2586,2587,2588,2589,2590,2591,2592,2593,1258,2546,2594,2176,2595,2596,2597,1059,1258,2546,2598,2599,2600,1059,1258,2601,2602,2603,2546,2604,2605,1258,2546,2606,2607,1258,1021,209,2525,2608,2553,209,2609,2610,2611,2612,2613,2614,2539,2541,209,2569,209,2615,2616,2617,2618,2619,2546,2620,2621,1258,2546,2576,2621,1258,1021,209,2525,2622,2623,2539,209,2624,2625,2626,2627,2628,2629,209,2630,2631,2616,2632,2633,2634,2635,2619,209,2636,2637,2616,2638,2639,2619,209,2640,2641,2642,2563,2643,1021,209,2525,2644,2645,2646,2647,1021,209,2525,2648,2649,2507,2508,2650,2651,2298,2652,2653,2654,2655,2303,2512,1258,2656,1021,209,2525,2657,2649,2507,2508,2658,2509,2659,2660,2661,2662,2303,2512,1258,2656,1021,209,2525,2663,2649,2507,2508,2664,2665,2510,2511,2303,2512,1258,209,2666,1021,209,2525,2667,2649,2507,2508,2664,2509,2510,2668,2303,2512,1258,2546,2669,2670,2671,2205,1258,1021,209,2525,2672,2673,2674,2649,2507,2508,2675,2509,2510,2511,2303,2512,1258,2546,2669,2676,2677,2205,1258,1021,209,2525,2678,2679,2649,2507,2508,2680,2681,2682,2683,2684,2685,2686,2681,2682,2687,2684,2688,2686,2689,2509,2510,2511,2303,2512,1258,209,2690,1021,209,2525,2691,2649,2507,2508,2680,2692,2681,2693,2683,2684,2688,2686,2689,2509,2510,2511,2303,2512,1258,209,2694,1021,209,2525,2695,2696,2697,2698,209,2699,2700,2701,2702,2563,2703,2704,2705,2701,2706,2563,2707,209,2708,2709,2699,2710,2701,2711,2563,2712,2713,2714,1021,209,2525,2715,2623,2716,2717,2718,2719,2720,2721,2718,2719,1021,209,2525,2722,2649,2507,2508,2664,2509,2510,2511,2303,2723,1258,2616,2669,2724,2619,1021,209,2525,2725,2649,2507,2508,2650,2509,2510,2511,2303,2512,1258,2546,2669,2726,2727,2205,1258,1021,209,2525,2728,2696,2697,2293,2507,2508,2650,2651,2298,2652,2653,2729,2730,2303,2512,1113,2558,2731,209,2732,2733,2734,209,2735,2546,2736,2737,2738,2205,1258,1021,209,2525,2739,2696,2697,209,2546,2740,2741,2742,2743,2744,2745,2746,2747,2748,2749,2750,2751,2752,2753,2754,2755,2205,1258,1021,209,2525,2756,2645,2757,2546,2758,2759,2760,1903,2205,1258,1021,209,2525,2761,2762,2763,2507,2508,2557,2509,2510,2764,2303,2512,1113,2558,2765,2507,2508,1830,2509,2510,2766,2303,2512,1113,2558,2531,209,2767,2768,2769,2563,2546,2770,2771,1258,1021,209,2772,2773,2774,2775,209,2525,2776,2777,209,2696,2697,2778,2779,209,2780,2781,2782,2563,2783,2784,2701,2785,2563,209,2546,2786,2298,2652,2653,2787,2730,1059,1258,2788,209,2789,2790,2791,2734,2792,2793,2546,2794,2795,1258,1021,209,2525,2796,2696,2697,2779,209,2699,2700,2701,2702,2563,209,2797,2798,2706,2563,2799,2800,1021,209,2525,2801,2623,2802,2803,1021,209,2525,2804,2623,209,2805,2716,2717,2806,2807,2808,2809,2810,2719,2720,2811,2718,2719,2720,2812,2718,2719,1021,209,2525,2813,2814,2815,2816,2817,2818,2609,2819,2820,2612,2821,2614,209,2822,2823,2824,2825,2826,2827,2619,2828,2824,2825,2829,2827,2619,2720,2830,2718,2719,2716,2831,1955,1956,1530,1957,2832,2718,2719,2833,2834,2835,1955,1956,1530,1957,1059,1258,2836,2837,1021,209,2525,2838,2839,209,2762,209,2840,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,2841,2842,2843,209,2844,2845,2560,2561,2846,2563,209,2847,2507,2508,2557,2509,2510,2511,2303,2512,2848,1113,2558,2849,2850,2851,2852,2853,1258,209,2854,2855,2856,2857,1054,2616,2858,2859,2619,209,2860,2861,2560,2561,2862,2563,2863,2507,2508,2557,2509,2510,2511,2303,2512,2864,1258,2616,2865,2866,2867,2868,2869,2750,2870,2619,209,2871,2872,2560,2873,2846,2563,2874,2507,2508,1830,2509,2510,2511,2303,2512,2875,1258,2616,2876,2866,2877,2205,2619,1021,209,2525,2878,2839,209,2762,2556,2507,2508,2557,2509,2510,2511,2303,2512,1113,2558,209,2879,2880,2741,2742,2881,2744,2882,2883,2750,2751,2884,2885,2886,2887,2888,2889,2890,2891,2892,2893,2894,2895,1054,1021,209,2525,2896,2897,2898,2899,2900,209,2901,2902,2903,2904,2563,209,2905,2906,2824,2907,2826,2827,2619,209,2908,2909,2824,2907,2826,2827,2619,209,2910,2911,2912,2913,2907,2826,2827,2619,209,2914,2915,2912,2824,2916,2826,2827,2619,209,2917,2912,2824,2907,2918,2827,2619,209,2919,2912,2824,2907,2826,2920,2619,1021,886],[3390,3391,3392,3393,3394,3395,3396,3397,3398],{"_844":46,"_46":2944},{"_844":2932,"_161":1443,"_868":2942,"_870":2943},{"_844":46,"_46":2941},{"_844":2932,"_161":1443,"_868":2939,"_870":2940},{"_844":46,"_46":2938},{"_844":2932,"_161":995,"_868":2936,"_870":2937},{"_844":46,"_46":2935},{"_844":2932,"_161":862,"_868":2933,"_870":2934},{"_844":46,"_46":2931},[3401,3402,3403,3404,3405,3406,3407,3408,3409,3410,3411,3412,3413,3414,3415,3416,3417,3418,3419,3420,3421,3422,3423,3424,3425,3426,3427,3428,3429],{"_2954":2955,"_262":196,"_2956":303,"_273":-5,"_2957":256,"_2958":-5,"_2959":2960,"_2961":2962,"_2963":-5,"_2964":-5,"_2965":2966,"_2967":15,"_2968":59,"_2969":54,"_2970":15},{"_92":436,"_96":323,"_431":3430},{"_310":311,"_312":313,"_3042":317,"_3043":129,"_319":-5,"_92":3044},{"_92":3000,"_312":3041,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3039,"_161":1443,"_3002":3005,"_3003":3040},{"_92":3000,"_312":3038,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3036,"_161":995,"_3002":3005,"_3003":3037},{"_92":3000,"_312":3035,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3034,"_161":1443,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3033,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3032,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3030,"_161":3021,"_3002":3005,"_3003":3031},{"_92":3000,"_312":3028,"_161":3026,"_3002":3005,"_3003":3029},{"_92":3000,"_312":3019,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3027,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3025,"_161":3026,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3024,"_161":995,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3022,"_161":995,"_3002":3005,"_3003":3023},{"_92":3000,"_312":3020,"_161":3021,"_3002":3005,"_3003":-5},{"_92":3000,"_312":3019,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3018,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3016,"_161":1443,"_3002":3005,"_3003":3017},{"_92":3000,"_312":3014,"_161":862,"_3002":3005,"_3003":3015},{"_92":3000,"_312":3011,"_161":3012,"_3002":3005,"_3003":3013},{"_92":3000,"_312":3010,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3009,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3007,"_161":1443,"_3002":3005,"_3003":3008},{"_92":3000,"_312":3006,"_161":-5,"_3002":-5,"_3003":-5},{"_92":3000,"_312":3004,"_161":995,"_3002":3005,"_3003":2937},{"_92":3000,"_312":3001,"_161":-5,"_3002":-5,"_3003":-5},[3431],{"_844":46,"_46":3047},"task_e_6a3289f0d2b8832a8bbed24e2a7a3882",1781697008.823354,"GitHub Mention: Complete witness receipts and plurality law hardening","has_generated_title","has_unread_turn","denormalized_metadata",{"_3463":32,"_3464":3465,"_3466":-5,"_3467":-5,"_3458":3468,"_3469":-5,"_3470":-5,"_3471":-5,"_3472":-5},"task_status_display",{"_3451":3452,"_3453":196,"_130":127,"_3454":-5,"_3455":3456},"creator_workspace","external_pull_requests",[3444],{"_42":3445,"_3446":83,"_3447":3448,"_3449":129},"github-1082070703-552","assistant_turn_id","pull_request",{"_302":303,"_294":304,"_305":306,"_307":15,"_308":59,"_309":15,"_310":311,"_312":313,"_314":266,"_315":127,"_316":317,"_318":129,"_319":320,"_321":-5,"_322":-5,"_323":3450,"_325":326,"_327":328,"_329":330,"_331":332},"codex_updated_sha",{"_288":289,"_181":289,"_333":-5,"_292":293,"_42":290},"latest_turn_status_display",{"_3457":83,"_112":113,"_3458":-5,"_94":3459,"_3460":-5,"_3461":-5,"_3462":3456,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_3473":-5,"_3474":-5,"_3475":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_3487":3488,"_3489":3490},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","statsigGateEvaluationsPromise",["P",3486],"traceId","10566845980759981702","traceTime",1781772140919]