Check derived labels at exact artifact and memory doors

[samrusani]

Stacked on #567.

Summary

Published draft head 21bbea936f42f9803bf4922637b7b130b70da17d has 22 successful GitHub checks in the exact-head snapshot observed at 2026-10-06T00:48:16.326311+00:00. All nine final draft heads are green in that same snapshot.

Final combined root 89e13def51b508ce42155d7dcad9a310e7b95fbb has 13,858 passing unit cases and 20 skips through the recorded complete corrective shards. Global statement-plus-branch coverage is 85.619226%; one aggregate statement gate across 14 API paths reaches 71.538857% (4170/5829), above its 45% floor. The source-equivalent CI migration model passes 669 PostgreSQL cases with one intentional skip; static, Bandit, LongMemEval, actual upgrade/restore and all 20 strict concurrency suites pass within their recorded heads. Capture and relabel budgets pass at their measured head with verified unchanged final source paths. These combined receipts are distinct from each historical local worker selection below.

The only restricted-owner full PostgreSQL failure is unchanged historical migration 0067; current 0096 retains restricted owner controls and the actual CI migration model passes. Designated control-tower merge approval and owner/security-team approval before the tag are external gates. Earlier force-push variance and the missing original standalone kernel-main proof remain disclosed; no release, deployment or second full independent scan is claimed.

The current published ordinary draft head is 21bbea936f42f9803bf4922637b7b130b70da17d. The ordinary dependency forward merge also carries the stage-appropriate saved-quote original-versus-derived control. At fixture correction 6297861f, the two complete owning modules pass 208 cases in 24.72 seconds on identical candidate bytes subsequently committed. Earlier CI has two fixture failures; the corrected controls preserve original quote/source/explain and candidate/dedup assertions. The midnight integration fixture belongs to #569. All later dependency updates use ordinary merges and normal pushes. Current-head GitHub CI now has 22 successful checks at the final snapshot. Designated outside premerge approval remains separate.

Exact artifact, explain, attachable-memory, review, redaction and open-loop reads authorize effective labels from complete ancestry. Collection limits count dependency depth independently from fanout, so a public report with 32 source inputs remains readable. Ambiguous UUID identities fail closed for locked readers. Original legacy memories retain their previously resolved explain scope; derived memories use effective scope and floor.

These changes are proposed and unmerged; they are not part of the released v0.20.0.

Historical validation

Exact-door, alias-twin, dependency-depth/fanout, legacy explain and MCP authorization controls passed, including the original review reproductions. The combined stack passed 512 PostgreSQL integration tests (1 skipped). Ruff, Bandit and release-static typing passed.

Historical combined-stack unit matrix: 13,401 passed, 20 skipped and 11 initial failures. All 11 failures passed the corrective rerun; the affected owning modules also passed 275 tests. Combined coverage is 85.64% (required 50%); API carrier coverage is 70.56% (required 45%). This was a complete matrix followed by focused corrective reruns, not one clean full invocation. Those historical local results did not establish current-head CI. The final exact-head remote checks are reported above; outside merge approval remains separate.

Reproduction and executed mutations

Historical builder evidence recovered from the original description at 4b6087588a91a192c0019ed440ea7aba986d8035:

tests/unit/test_label_guard_exact_doors.py (8), tests/unit/test_label_door_registry.py (2), tests/unit/test_source_refs_read_fence.py, and tests/unit/test_vnext_memory_commit.py: 216 passed.

test_explain_refuses_a_public_copy_of_a_confidential_source fails if explain authorizes the stored row. That was shown by skipping effective_row_for_fence: a trusted key was not refused. The call was restored.

Not verified in that historical local receipt: the full tests/unit run, Bandit, mypy, and Postgres.

The recovered description does not retain a complete main-failure command and output. That evidence remains a review obligation; a missing-module collection failure alone is weaker than an exercised behavior regression. The list above records reported executed mutations. It does not turn other mutations proposed in test docstrings into executed proof.

Remediation evidence at packet cutoff

These are synthetic local checks of the named worker checkout. They do not establish the final combined candidate, live CI, merge approval or release approval. The command spelling below uses python; private receipts retain the interpreter and environment.

Read fixes 3a5c39c5a2362ce066ec4e46136a23fedebb6ac6 and 8c1b5d5babcb528e027b228e6fa9c4e20ba698db preserve the real authenticated key scope and ceiling through exact reads, audit and resume. The latter head passed 36 selected unit tests and 11 real PostgreSQL acceptance cases. The original 8a851c52 guard was transplanted alone and executed the bound-admin test below: actual recall exposed an unverified memory ID and the assertion failed. This is a pre-fix stack baseline, not frozen release main.

python -m pytest tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[bound_admin] -q
FAILED test_sqlite_real_key_core_doors[bound_admin]
1 failed

Executed mutation	Named failing test
scope-sync-killed	tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[bound_admin]
resume-binding-killed	tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[bound_admin]
audit-authorization-killed	tests/integration/test_derived_labels_read_acceptance_postgres.py::test_postgres_real_key_core_doors[trusted]

These first three receipts are selected exact-door controls. Later direct unverified-rule, trusted-active and belief-backing controls are recorded below; complete individual-door coverage remains separate from registry discovery. The combined candidate remains separately gated.

Further executed reader controls

The later physical-site ledger records 15 behavioral kills and three surviving experiments. Those experiments and their 55-unit/18-PostgreSQL baseline and restored controls belong to clean 1165b3302a17c01429d39e13a6f4fd557b11d93e, before the later test follow-ups. The supplemental seven experiments were executed at clean 9d73f0e66e458d6eaac2fff864fdfd77b510e849, with original/restored source hashes and 58 unit plus 24 real PostgreSQL restored controls. The following rows record executed failures rather than source-string suggestions.

Executed physical mutation	Named failing test
M18-unverified-rule-killed	tests/unit/test_label_guard_exact_doors.py::test_a_locked_key_is_refused_an_unverified_row
M39-active-trusted-guard-killed	tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[trusted]
M37-artifact-helper-killed	tests/unit/test_label_guard_exact_doors.py::test_an_exact_artifact_door_uses_the_input_label
M37-explain-helper-killed	tests/unit/test_label_guard_exact_doors.py::test_explain_refuses_a_public_copy_of_a_confidential_source
M37-legacy-artifact-helper-killed	tests/unit/test_label_guard_exact_doors.py::test_the_legacy_artifact_authorizer_uses_the_input_label
M37-cited-memory-helper-killed	tests/unit/test_label_guard_exact_doors.py::test_a_cited_memory_is_judged_by_its_source
M37-memory-review-bound-admin-killed	tests/unit/test_label_guard_exact_doors.py::test_bound_admin_review_uses_the_effective_input_project_floor

The earlier FTS fixture survived, then each strict, OR-fallback and legacy branch failed under the stronger branch-specific fixture. The outer open-loop helper removal still survives because the inner policy decision independently settles effective labels. The earlier memory-review fixture also survived; the supplemental inner-policy floor bypass fails with the new bound-admin control. These results do not establish an individual behavioral guard-removal kill for every registered door. Registry discovery remains a separate structural check.

Frozen combined gate and staged corrective evidence

The complete frozen combined 68946a42e979833a39c300ed80c734d8f7288552 unit shards report 13,788 passed, 20 skipped and 12 failed. The strict full PostgreSQL run reports 544 passed, one skipped and 86 failed; fixture identity/lock compatibility corrections were underway at that historical cutoff. The later final combined gates and current-head CI pass. Default smoke has one pass and one old HTTP operation-count pin failure. These broad runs remain failed receipts, separate from later selected corrective controls. Release-static checks 281 files, Bandit, 216 LongMemEval cases, saved seven-arm evidence and all-backend operations pass at that same frozen head. All-backend operations include real SQLite recovery and PostgreSQL custom dump/destroy/recreate/restore with no declared proof gaps.

The historical local stage observed for this PR was f6d23e92: ten compatibility modules plus open-loop fence/exact doors861passed63.28s. That interim stage preceded the final ordinary dependency mapping and current published head.

A later workspace tripwire found an actual original-loop backing-reference leak through workspace, dashboard and source trace. Reader correction is committed as dda36a3d39e7e6e8a2819aa9b214b221fdf12f1d, using the shared #568 effective-reference helper and applying it to #569 view responses. The 27-case PostgreSQL run passed with identical patch bytes before commit, with original failures retained. Root additionally passes 165 focused controls at 059fbad3 in 32.95 seconds. Those selected results alone were bounded; the later final combined broad gate and current-head CI are separate passing receipts.

Final classified reader receipts

These later worker proofs preserve their actual heads and do not imply a full rerun on the native PR head below. The completed classified reader matrix covers 61 guarded functions and 54 explicit exceptions with no unmapped guarded row. Across six accepted tranches there are 108 physical experiments: 95 kills and 13 recorded survivals. The two fresh cache-isolated tranches have 66 experiments, 56 kills and 10 redundant survivals. The initial non-isolated pass is excluded because timestamp bytecode could be reused. Every accepted source mutation has byte restoration and SHA-256 checks.

The 62 fresh experiments belong to 32d01f7ecde4d3f61effb7321e840989ff23b080; the four additional experiments belong to 4f53e4d69e6c7b37edb5f37e0ee203f347fb5c1c. Latest restored controls at the latter head pass 126 unit cases and 57 actual PostgreSQL cases. This matrix classifies the registered readers and chosen guard sites; it does not claim every syntactic mutant or every alias/profile combination. Producer reader receipts retain their own heads.

The following 26 fresh experiments concern this PR's cumulative scope: 17 killed and 9 survived. Each killed row lists the actual failing test. Surviving rows list the exercised control and remain recorded as survivors.

Physical mutation	Result	Named test
M36-project-floor	Killed	tests/unit/test_derived_labels_kernel.py::test_project_floor_blocks_a_locked_key_and_does_not_change_an_empty_floor, tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_get]
M39-source-fence-inactive	Killed	tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[trusted]
M37-original-loop-reference-effective-memory	Killed	tests/unit/test_derived_labels_real_keys.py::test_original_loop_holds_back_stale_backing_memory_reference[trusted]
M37-reference-application-workspace_loop_refs	Killed	tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[workspace_loop_refs]
M37-reference-application-dashboard_loop_refs	Killed	tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[dashboard_loop_refs]
M37-reference-application-source-trace	Killed	tests/integration/test_derived_labels_read_acceptance_postgres.py::test_workspace_and_dashboard_original_loop_references_use_actual_key[trusted]
M37-shared-http-artifact-all-six-entrypoints	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_get], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_trace], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_export], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_review], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_feedback], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-artifact_rating]
M37-shared-explain-target-and-backing	Killed	tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[entity_explain], tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[entity_backing], tests/unit/test_derived_labels_real_keys.py::test_sqlite_real_key_core_doors[trusted]
M37-entity_explain-delegation	Killed	tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[entity_explain]
M37-entity_backing-delegation	Killed	tests/unit/test_label_reader_stage_matrix.py::test_each_stage_uses_current_parent_label[entity_backing]
M37-mcp-memory-review-detail	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_review_mcp]
M37-memory_review_http-guard-0	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_review_http]
M37-memory_review_http-guard-1	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_review_http]
M37-memory_review_http-both-guards	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_review_http]
M37-memory_correct_mcp-guard-0	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_correct_mcp]
M37-memory_correct_mcp-guard-1	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_correct_mcp]
M37-memory_correct_mcp-both-guards	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_correct_mcp]
M37-redact-outer-redundancy	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_redact_mcp]
M37-redact-outer-and-authorization-inner-policy-control	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_redact_mcp]
M37-redact-all-effective-guards	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-memory_redact_mcp]
M37-loop_review_http-outer-redundancy	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_http]
M37-loop_review_mcp-outer-redundancy	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_mcp]
M37-loop-outer-and-authorization-inner-policy-control	Survived	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_http], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_mcp]
M37-loop-all-effective-guards	Killed	tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_http], tests/integration/test_derived_labels_exact_entrypoints_postgres.py::test_exact_entrypoint_checks_effective_floor[bound_admin-loop_review_mcp]
M18-unverified-bound-admin-fresh	Killed	tests/unit/test_label_guard_exact_doors.py::test_a_locked_key_is_refused_an_unverified_row
M37-belief-state-service	Killed	tests/integration/test_derived_labels_read_acceptance_postgres.py::test_all_five_operator_screens_with_real_keys[trusted]

Individual memory review/correction guards can survive the other exact guard. Outer redaction and loop guards can survive the inner commit policy. Graph outer admission can survive the guarded ID loader. The campaign executes compound removals that reach a semantic failure, and separate inner-policy controls substantiate the remaining defense. A surviving outer omission is never relabeled as a kill. The earlier three surviving probes remain in their original historical tranche.

A separate native stage missing-import correction 3f1255c8 on 2bc0ac8d has one actual PostgreSQL control and release-static pass after an exercised API NameError. This is stage-only validation, separate from the combined candidate and guard campaign. Final native mapping remains coordinator-owned.

Native validation snapshots and remaining gates

The earlier validated native draft head was b26e8ebbaf360e435bd68084b901d1a799ffd65b, after the ordinary final #567 forward merge and explicit imports of the missing identity helpers. A staged actual API NameError is reproduced, then stage-only correction 3f1255c8 passes one real PostgreSQL control and release-static; native fd669 supplies those imports at this head. The earlier stage controls retain their head attribution; current-head CI remains separate.

At earlier 7c8b7fd1, the HTTP vNext, exact-door, open-loop-reference and registry scope passes 239 tests in 30.13 seconds. Earlier compatibility scope has 861 passes at f6d23e92. The dedicated project review S/exclusive-L adapter originally described as #568 was restaged in final #566 as dcea6ecb and forwarded here. Its actual a8672e94 baseline/control/mutation receipts retain that worker attribution; it is not a new #568-only guard. The shared effective reference helper remains #568; workspace/dashboard/source-trace applications remain #569 and require it.

Later combined head 65044cc37f0c61b7442557b3e5591fde474d939a, tree 22f792816bb48a5fcc03ee576640765b5496d82c, passes all seven CI-role gates: 669 PostgreSQL cases and one intentional legacy-flag skip; release-static, baseline Bandit, 216 LongMemEval, saved seven-arm replay, two flag-off default-smoke cases and actual all-backend upgrade/restore operations with no proof gaps. The strict-owner run has 668 passes, one skip and only the unchanged historical 0067 revision NOT NULL failure. Current 0096 acceptance retains NOSUPERUSER/NOBYPASSRLS owner controls; historical 0067 uses its unchanged CI migrator model.

Final concurrency head 94ff573e656a30761d382c8717b608e14f9e630d has production identical to corrected 6cf579d4 and completes 20 of 20 strict 27-case suites: 540 tests, 3,500 review/relabel races and 20 shared-dependent relabel pairs, with constant tracked hashes and no failures, retries or edits. The intermediate earlier twenty-series remains archived separately. The physical mutation runs retain their earlier heads.

The final complete corrective unit matrix uses 385ccd8a for shards 1 and 2 and the final owning shard 3 at 1319c69f: shard 1 has 4,489 passes and 15 skips, shard 2 has 5,600 passes and five skips, and shard 3 has 3,769 passes. Total: 13,858 passed and 20 skipped. The final root 89e13def51b508ce42155d7dcad9a310e7b95fbb differs from 1319c69f only by the integration report-window fixture; all unit files and production are identical. The older 13,857-case matrix and its archive remain preserved. Combined statement-and-branch coverage passes at 85.6192261959206%, with statement coverage 87.73828853% and branch coverage 78.89058621%. The global 50% requirement and the single 45% aggregate statement floor across 14 API paths passes at 71.538857%. Exact-head GitHub CI now passes as reported above; it is separate from these local combined receipts. The scoped skeptical probes and execution evidence above do not replace designated control-tower premerge approval or human security-team approval before the tag. One actual independent combined review cycle and its closure probes are retained; no second full independent scan is claimed. Earlier failed complete runs remain preserved. Merge, release tagging and advisory publication remain separate gates.

Upgrade Overview

Protected Areas

• memory schema
• evidence pipeline
• trust rules
• promotion logic
• continuity APIs

The checked areas cover the complete cumulative diff of this exact published head against the frozen release base.

Compatibility Impact

Derived content may become stricter or disappear from restricted reads when current input labels, project scope or incomplete ancestry require it. Provenance, text and original-row trust meanings are preserved. Owner and unbound admin controls retain their applicable policy contracts. List counts must use the complete admitted population; a limited fetched page cannot substantiate a total.

Migration / Rollout

No migration is added by this PR. Land the kernel before runtime consumers. Ship the seven-PR set together in the dedicated security release.

Operator Action

After a restore at head or older-binary writes, run the store-specific labels check and labels repair commands. Confirm a source-move preview before a move that hides derived rows. Regenerate fresh candidates with POST /v0/vnext/sources/{source_id}/regenerate as the owner or unbound admin, and rerun each report's normal generation route.

Validation

Earlier worker commands retain their actual tested revisions and limits. Final exact-head remote CI and the source-equivalent combined acceptance are separately established in the current summary; they do not backdate the historical local receipts. Designated control-tower merge approval and owner/security-team release approval remain external gates. Historical process and evidence limits remain disclosed.

Rollback

Revert consumers before the kernel. Raised labels and scrubbed content persist; reverting code or migration 0096 does not lower labels or restore removed text. Keep a compatible backup and rerun restricted-read verification after recovery.

Process variance

The existing review branch name is preserved. It differs from the handoff naming convention. Earlier updates to #565 through #569 used identity-only force-pushes and violated the mandatory no-force-push rule; preserving source trees did not make them compliant. This historical violation cannot be erased by later tests. Further updates use ordinary commits and plain merges. The handoff contains a later rebase sentence that contradicts its mandatory plain-merge rule; the mandatory rule governs.