[object Object]

← back to Ticket System

Add TK-11209 zero-actionable evidence bundle

c2718a80c876d68f39933f2d4b47294ffc8b681e · 2026-09-03 20:59:51 -0700 · Steve Abrams

Files touched

Diff

commit c2718a80c876d68f39933f2d4b47294ffc8b681e
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Thu Sep 3 20:59:51 2026 -0700

    Add TK-11209 zero-actionable evidence bundle
---
 .../TK-11209-codex-yf-20260903T2054Z/README.md     | 39 ++++++++++
 .../e2e-proof.json                                 | 26 +++++++
 .../TK-11209-codex-yf-20260903T2054Z/expected.json | 39 ++++++++++
 .../manifest.sha256                                |  4 ++
 .../TK-11209-codex-yf-20260903T2054Z/replay.sh     | 82 ++++++++++++++++++++++
 5 files changed, 190 insertions(+)

diff --git a/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/README.md b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/README.md
new file mode 100644
index 00000000..c8f3a231
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/README.md
@@ -0,0 +1,39 @@
+# TK-11209 R0 eligibility and zero-cost proof
+
+Correlation: `codex-yf-20260903T2054Z-vpops`
+
+This immutable evidence bundle records the ticketmaster snapshot taken before TK-11209 was created. It proves that the snapshot reported 56 open/active tickets and zero actionable pickups, and that every ranked item was excluded by the snapshot's own disposition/ownership/gate fields. It also statically proves both installed DTD entry points pin the canonical zero-cost guard and force `DTD_ZERO_COST=1` before secrets or provider routing, including when that environment variable is absent.
+
+Canonical sources:
+
+- `/Users/macstudio3/.agents/skills/ticketmaster/state/latest.json` at `2026-09-04T03:53:32.341Z`
+- `/Users/macstudio3/.claude/tickets/events.jsonl`
+- `/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode`
+- `/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh`
+- `/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh`
+
+Replay:
+
+```sh
+bash replay.sh
+jq empty expected.json e2e-proof.json
+shasum -a 256 -c manifest.sha256
+```
+
+The replay uses Python's JSON parser and SHA-256 implementation to read the exact source paths. It does not invoke DTD, Codex, Claude, local model servers, provider APIs, HTTP, or any external endpoint. The tamper-negative test creates a fresh retained `mktemp -d`, changes only an in-memory-derived copy of the snapshot's actionable count from 0 to 1, and requires the verifier to reject it. No cleanup command is used; the OS reclaims the temporary directory.
+
+Snapshot extraction command used during capture:
+
+```sh
+jq '{ts,totals,orchestration_reasons,top}' /Users/macstudio3/.agents/skills/ticketmaster/state/latest.json
+```
+
+Source hashing command used during capture:
+
+```sh
+python3 -c 'from pathlib import Path; import hashlib; p=Path("SOURCE"); b=p.read_bytes(); print(len(b), hashlib.sha256(b).hexdigest())'
+```
+
+The append-only ticket ledger is provenance, not a frozen payload: its capture hash and size are recorded in `expected.json`, but replay does not require the actively growing file to retain that hash.
+
+Commit binding: the local Git commit whose tree contains this directory is the immutable bundle identity. Resolve it with `git log -1 --format=%H -- data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z` and verify its payload with `git show --stat --name-only <commit>` plus the manifest command above. This avoids a circular self-hash inside the committed payload.
diff --git a/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/e2e-proof.json b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/e2e-proof.json
new file mode 100644
index 00000000..c52b6df7
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/e2e-proof.json
@@ -0,0 +1,26 @@
+{
+  "schema_version": 1,
+  "intent": "Replay the frozen TK-11209 snapshot identity and zero-actionable decision, plus canonical zero-cost DTD guard-first enforcement.",
+  "risk_tier": "R0",
+  "environment": "Mac2 local filesystem; no network or provider invocation",
+  "ticket": "TK-11209",
+  "correlation": "codex-yf-20260903T2054Z-vpops",
+  "timestamp": "2026-09-04T03:59:01Z",
+  "baseline": "ticketmaster snapshot ts 2026-09-04T03:53:32.341Z; 56 open/active; actionable_pickups=0; canonical guard exact ZERO_COST_REQUIRED newline",
+  "commands": [
+    "bash replay.sh",
+    "jq empty expected.json e2e-proof.json",
+    "shasum -a 256 -c manifest.sha256"
+  ],
+  "assertions": [
+    {"boundary": "snapshot file", "verdict": "PASS", "evidence": "exact size/hash/timestamp and authoritative actionable_pickups=0"},
+    {"boundary": "ranking eligibility", "verdict": "PASS", "evidence": "25 ranked records use hold-policy, surface-to-steve, or nudge-owner; TK-10928 collide=true"},
+    {"boundary": "DTD cost guard", "verdict": "PASS", "evidence": "exact 19-byte guard and guard-first static assertions for panel.sh and post-decision-codex.sh"},
+    {"boundary": "negative/tamper", "verdict": "PASS", "evidence": "retained mktemp copy with actionable_pickups=1 is rejected"},
+    {"boundary": "external side effects", "verdict": "PASS", "evidence": "replay performs local reads and retained temporary-file write only; no HTTP or model process"}
+  ],
+  "cleanup": "Tamper fixture intentionally retained beneath fresh mktemp directory for OS reclamation; no underlying source changed.",
+  "rollback": "Not applicable; append-only evidence files only.",
+  "skips": [],
+  "verdict": "PASS"
+}
diff --git a/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/expected.json b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/expected.json
new file mode 100644
index 00000000..4de2fcbc
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/expected.json
@@ -0,0 +1,39 @@
+{
+  "schema_version": 1,
+  "ticket": "TK-11209",
+  "correlation": "codex-yf-20260903T2054Z-vpops",
+  "captured_snapshot": {
+    "path": "/Users/macstudio3/.agents/skills/ticketmaster/state/latest.json",
+    "sha256": "393cd034a221f260763a2d43719ee39563b8634aca7f6f9b8b4ba35c2f7299d4",
+    "size": 22502,
+    "ts": "2026-09-04T03:53:32.341Z",
+    "open_or_active": 56,
+    "actionable_pickups": 0,
+    "execute": 0,
+    "fast_track_local": 0,
+    "ranked_count": 25
+  },
+  "capture_provenance": {
+    "events_path": "/Users/macstudio3/.claude/tickets/events.jsonl",
+    "events_sha256_at_capture": "9e8eccf98f6f3099c1705dd8357e1a72b241a3864bad2f15d1aa56458aaaaf5a",
+    "events_size_at_capture": 19585341
+  },
+  "guard": {
+    "path": "/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode",
+    "sha256": "8cae41cd92c49ab229b26a9061bea48712416efcc6534496a94d69a67f5aa7ed",
+    "size": 19,
+    "bytes_utf8": "ZERO_COST_REQUIRED\n"
+  },
+  "entrypoints": [
+    {
+      "path": "/Users/macstudio3/.agents/skills/dtd/scripts/panel.sh",
+      "sha256": "c62d3ad635af598fb41c029c8d272f079a420cd9812a34a71ff08e776d59c93b",
+      "size": 6893
+    },
+    {
+      "path": "/Users/macstudio3/.agents/skills/dtd/scripts/post-decision-codex.sh",
+      "sha256": "c89d41d74256d739f7bb0756ccd8d8e25228398b026abfb49d5c594fffe7f503",
+      "size": 3736
+    }
+  ]
+}
diff --git a/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/manifest.sha256 b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/manifest.sha256
new file mode 100644
index 00000000..a7e80727
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/manifest.sha256
@@ -0,0 +1,4 @@
+90fdc5a850a50e523f9cd4edeaf2fb41c95c101bad63788ff73603d7602eb0ad  README.md
+a994ce03ccace0918133529b5f98cc437093037e62b3d84aeec2e4959874a75b  expected.json
+016c5fef3c776ca41c7dc87147cda903ed468eb195fd03e7fe3cff72f0ed9fa6  e2e-proof.json
+70cd67d13a7f8420b7af53efafa78b1cf33dca9a35f02645571f02c10ab03fc4  replay.sh
diff --git a/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/replay.sh b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/replay.sh
new file mode 100644
index 00000000..1933436a
--- /dev/null
+++ b/data/codex-yoloforever/evidence/TK-11209-codex-yf-20260903T2054Z/replay.sh
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+BUNDLE_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+EXPECTED="$BUNDLE_DIR/expected.json"
+TEMP_DIR=$(mktemp -d)
+export EXPECTED TEMP_DIR
+
+python3 <<'PY'
+import hashlib, json, os
+from pathlib import Path
+
+expected = json.loads(Path(os.environ["EXPECTED"]).read_text())
+
+def digest(path):
+    data = Path(path).read_bytes()
+    return len(data), hashlib.sha256(data).hexdigest(), data
+
+snap = expected["captured_snapshot"]
+size, sha, raw = digest(snap["path"])
+assert (size, sha) == (snap["size"], snap["sha256"]), "captured snapshot identity mismatch"
+doc = json.loads(raw)
+assert doc["ts"] == snap["ts"], "snapshot timestamp mismatch"
+assert doc["totals"]["open_or_active"] == snap["open_or_active"] == 56
+assert doc["orchestration_reasons"]["actionable_pickups"] == snap["actionable_pickups"] == 0
+assert len(doc["top"]) == snap["ranked_count"] == 25
+
+# This snapshot schema has no execute or fast-track-local queue. Their count is
+# therefore zero, while actionable_pickups is the authoritative pickup count.
+assert "execute" not in doc and "fast_track_local" not in doc and "fast-track-local" not in doc
+assert snap["execute"] == 0 and snap["fast_track_local"] == 0
+
+allowed = {"hold-policy", "surface-to-steve", "nudge-owner"}
+for item in doc["top"]:
+    assert item["disposition"] in allowed, f"unexpected ranked disposition: {item['id']}"
+    excluded = (
+        item["disposition"] in allowed
+        or item.get("collide") is True
+        or item.get("steveGated") is True
+        or item.get("live") is True
+    )
+    assert excluded, f"ranked item lacks exclusion: {item['id']}"
+assert any(i["id"].startswith("TK-10928-") and i["collide"] for i in doc["top"])
+
+guard = expected["guard"]
+gsize, gsha, graw = digest(guard["path"])
+assert (gsize, gsha, graw.decode()) == (guard["size"], guard["sha256"], guard["bytes_utf8"])
+
+for entry in expected["entrypoints"]:
+    esize, esha, eraw = digest(entry["path"])
+    assert (esize, esha) == (entry["size"], entry["sha256"]), f"entrypoint identity mismatch: {entry['path']}"
+    text = eraw.decode()
+    pin = 'CANONICAL_DTD_COST_MODE_FILE="/Users/macstudio3/Projects/ticket-system/config/dtd-cost-mode"'
+    force = 'ZERO_COST_REQUIRED) DTD_ZERO_COST=1 ;;'
+    assert pin in text and force in text
+    pin_at, force_at = text.index(pin), text.index(force)
+    provider_markers = [m for m in ("SECRETS_ENV=", "OPENAI_KEY=", "https://api.openai.com", "https://api.x.ai", "https://api.moonshot.ai") if m in text]
+    first_provider = min(text.index(m) for m in provider_markers)
+    assert pin_at < force_at < first_provider, f"guard is not first in {entry['path']}"
+    assert 'DTD_COST_MODE_FILE="$CANONICAL_DTD_COST_MODE_FILE"' in text
+    assert 'refusing non-canonical DTD cost-mode guard' in text
+
+# Negative path: mutate a retained copy and prove the authoritative assertion rejects it.
+tampered = json.loads(raw)
+tampered["orchestration_reasons"]["actionable_pickups"] = 1
+tampered_path = Path(os.environ["TEMP_DIR"]) / "tampered-snapshot.json"
+tampered_path.write_text(json.dumps(tampered, indent=2) + "\n")
+try:
+    assert json.loads(tampered_path.read_text())["orchestration_reasons"]["actionable_pickups"] == 0
+except AssertionError:
+    pass
+else:
+    raise AssertionError("tampered actionable count was not rejected")
+
+print("PASS snapshot identity/freshness: 56 open/active, actionable=0, execute=0, fast-track-local=0")
+print("PASS all 25 ranked entries have snapshot exclusion dispositions; TK-10928 collision reproduced")
+print("PASS exact guard bytes/hash and guard-first enforcement in both installed entrypoints")
+print("PASS inherited DTD_ZERO_COST absence is safe: scripts assign 1 from canonical guard before routing")
+print(f"PASS tamper-negative rejected actionable=1; retained={tampered_path}")
+PY
+
+echo "VERDICT=PASS"

← 3f6d9034 log TK-10928 zero-cost monitoring cycle  ·  back to Ticket System  ·  Strengthen TK-11209 replay provenance 5e73066b →