sots-re/campaign/rollout/controls-worker-state.md

# Controls worker checkpoint

Status: **approved R4/R6 and runner repairs implemented; independent integrated review pending**.
Model openai/gpt-6-astra; current logical checkpoint session `rollout-controls-repairs` (actual
harness session ID unavailable). Read the final repair handoff below; earlier sections are history.
No delegation, staging, project commits or lab I/O. Temporary fixture Git commits are authorized.

## Interface announcement (2026-09-09)

Canonical state root is the absolute RE repository path passed as `--state-root`.
Contracts live in `campaign/contracts/<id>.json`; every contract has required fields
`id,title,status,owner,baseline,scope,inputs,effects,original_dependencies,dependencies,acceptance,predictions,stop_conditions,checkpoint`.
`owner` is `{name,role}`. `baseline` is `{engine:{path,commit},re:{path,commit}}`
with canonical absolute repository paths and full git commit IDs. `scope`, `inputs`, `effects`,
`original_dependencies`, `dependencies`, `predictions`, `stop_conditions` are string arrays;
dependencies are contract IDs. Acceptance is an array of `{id,axis,criterion}` objects.
Checkpoint is null or a campaign-relative JSON path. Status is proposed/ready/implementing/
verification/integration/accepted/blocked/needs-revision. Optional `evidence` is an array of
source-bound records; exact schema and README follow. No scalar verified status.

Runtime directories: `campaign/runtime/checkpoints`, `surprises`, `decisions`, `verdicts`,
`leases`, `runs`. Open surprise JSON has `contract`, `status:"open"`, `id`, summary/probe.
Checkpoint JSON has `contract`, `summary`, `artifacts`, `next_action`, `model`, `session`,
`actor`, `timestamp`. Paths to durable artifacts must be under canonical campaign/.

## Implementation checkpoint (2026-09-09, quantum in progress)

Schema, models registry, proposed controls-bootstrap contract, campaign CLI and runner now exist.
No tests executed yet. `tools/campaign.py` exports `Campaign(root)` with `load`, `contracts`,
`validate`, `open_surprises`; CLI list/status/validate/checkpoint/transition/surprise/resolve/
evidence/verdict/lease. Model identity is explicitly a claim, not authentication.
Evidence record is `{id,axis,path,sha256,source,integrated}`; source uses the exact baseline object.
Evidence artifact contents are responsible for actual dirty-tree manifests (runner captures them).
Independent passing verdict is bound to complete evidence digest + contract basis. Integrated
evidence changes invalidate that digest, so acceptance requires another independent verdict.
Checkpoint freshness is 15 minutes; runner end checkpoint must also be after start and match
run-provided checkpoint session/model/actor/role. Run records retain requested versus observed model.

Coordination: read publishing checkpoint (its current.json gate manifest differs correctly from
contract base source), review checkpoint (pilot now adopting schema), lead opencode.json (steps 40,
matching role agents and GPT-5.5 compaction). No cross-cutting plan changes made.

## Pre-test checkpoint

Added campaign/README.md with strict fields, runtime formats, CLI examples, guarded lifecycle,
checkpoint/model provenance limitations, and runner command. Added verify/campaign/test_controls.py:
negative lifecycle/schema/source/model/checkpoint tests, actual concurrent lease contenders, fake
OpenCode subprocesses for quantum completion, and disposable shared clones/linked worktrees for
real Git identity tests. Tests never commit/stage or launch agents; all fixture writes are temporary.
Source repository baseline object existence is now checked before ready/implementing. Ordinary
needs-revision transitions also clear checkpoint/evidence. No test results yet.

Next action: run `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v` and fix failures.
No other worker checkpoints existed at initial inspection. Source bootstrap baseline:
engine 7741d42fc5e4e761e6449bdaf0e4a61d00036a23,
RE 3bfde5a70d874a723e797a695bbd847fd82c0aa7 (current concurrent work is uncommitted).

## Final handoff checkpoint — 2026-09-09T21:35Z

### Delivered and tested

- Owned source files: tools/campaign.py, tools/run_agent.py, campaign/contract.schema.json,
  campaign/models.json, campaign/contracts/controls-bootstrap.json, campaign/README.md,
  verify/campaign/test_controls.py, campaign/runtime/ records and this checkpoint.
- `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`: **23/23 passed**
  in 2.180s. Initial 22/23 caught Git 2.34 lacking worktree-list `-z`; fixed to porcelain lines
  with explicit unusual-path rejection. Closed subprocess stdout to remove ResourceWarning.
- `python3 tools/campaign.py --state-root /home/alex/sots-re validate`: passed both
  controls-bootstrap and research-replacement. No acceptance transition performed.
- Tests cover actual cross-process exclusive lease acquisition, token/owner/stale-release
  controls, fake process success/failure and missing checkpoint, model/config routing, real linked
  worktree/common-dir/baseline verification, schema/path/lifecycle/identity/WIP/surprise/evidence
  negatives and final integrated-package verdict refresh. Disposable shared clones reuse existing
  local history: **tests execute no git commit or staging**, addressing reviewer test restriction.
- RE source identity remains baseline plus concurrent uncommitted changes. Owned file SHA-256:
  - tools/campaign.py: fa6fc0914ca792daa5decaac8c48b285499a331287d4ccef35d953cca4b0965b
  - tools/run_agent.py: fc2233fcbc09dd8878e66cae6b0a9b9985146ef02ae22bff3a10643e0c14784e
  - contract.schema.json: ae4796b1f8e8336ddb63e60d774a81ff965461e4b884b5a2488e3865c6a6c5e0
  - models.json: 95f507237a8e4fcf14189da4aa102dfae1dbaa536d4d8db6bcbfc30162ac5443
  - verify/campaign/test_controls.py: 894cf3ef92e540daf5017c46acc526b56d9ac7441def917c1a2910a086954e18

### Surprises / lead decisions required

Read campaign/rollout/independent-review.md after successful tests. Recorded both findings with
`campaign surprise`; controls-bootstrap is machine-readably **blocked**. No affected interface
changes made after these cross-cutting findings, per assignment escalation rule.

1. **R4 / s-410e48d5ae6cc4da0a6ae649**: current evidence binds baseline path/commit, artifact hash,
   axis and declared integrated boolean; it does not machine-bind actual candidate/integrated bytes.
   Reviewer correctly demonstrates that same-HEAD source changes evade this check. README already
   assigned actual manifests/criteria to independent human review, but that is insufficient for
   stronger automatic acceptance. Proposed decision: typed acceptance package binding candidate
   and integrated source manifests, binary, immutable input hashes and per-criterion outcomes;
   coordinate shape with gate/publishing. Probe changes bytes at unchanged HEAD and rejects old
   verifier/integration result. Evidence: independent-review.md R4, current check_evidence/verdict.
2. **R6 / s-f1c41532e618c77d41538902**: launch uses 15-minute freshness, preventing next-day
   recovery; unconditional surprise rejection prevents resolver launch. Assignment explicitly said
   no open surprises at launch, so exception needs clarification. Proposed decision: recovery checks
   identity/basis/artifact integrity without age limit, fresh end checkpoint remains strict; permit
   explicit resolution-only Astra quantum while affected workers stay blocked. Probe old-valid vs
   missing/mismatched checkpoint and resolver vs implementer with open surprise.

Other known review limitation: runner hashes canonical config/overlay, not expanded prompt files
or every effective configuration source. Claimed role/model and agent permissions are not security
boundaries. No real OpenCode agent launched; actual effective-config/model execution remains an
independent integration check. Interrupted running reservations deliberately do not auto-expire;
manual lead inspection is currently required before clearing an interrupted record.

### ONE exact next action

Lead: record Astra resolutions for `s-410e48d5ae6cc4da0a6ae649` and
`s-f1c41532e618c77d41538902`, specifying the source-package interface and recovery/resolver policy,
then resume this controls worker from this checkpoint to implement and test those decisions.

## Repair handoff — 2026-09-09T21:54Z

### Authority, source and scope

- Recovered from the prior checkpoint and formally resolved surprises. Decisions
  `d-42c6d0b4ee5114e6f2e07c99` (R4) and `d-ab717735fc6c1661919f6894` (R6), plus
  controls-followup.md, authorize this implementation. Both surprise records are resolved.
- Baselines rechecked: RE `3bfde5a70d874a723e797a695bbd847fd82c0aa7`, engine
  `7741d42fc5e4e761e6449bdaf0e4a61d00036a23`. Bootstrap exclusive canonical file ownership
  exception applies. Concurrent source remains uncommitted; final machine checkpoint artifacts
  hash the exact owned source/schema/test/README bytes. No engine edits or resource leases.
- Changed: tools/campaign.py, tools/run_agent.py, campaign/contract.schema.json,
  campaign/contracts/controls-bootstrap.json (acceptance text), campaign/README.md,
  verify/campaign/test_controls.py, this handoff and canonical runtime checkpoints.
  Registry/config/agent files, pilot, gate/report and publishing ownership preserved.

### Precise interface changes for lead, publishing and pilot

1. Evidence now requires `source_binding`, `binaries`, `inputs`, `outcomes` in addition to existing
   fields. Source binding is `{engine:{path,commit,sha256},re:{path,commit,sha256}}`, generated by
   `campaign source-binding CONTRACT [--engine-worktree ABS --re-worktree ABS]`. No worktree args
   means canonical integrated trees. Actual Git manifests include dirty/untracked nonignored
   file bytes, modes and tracked deletions; fixed RE campaign-state/results and cache exclusions
   are documented in README. Source symlinks/submodules fail closed. Candidate paths must belong
   to paired repositories; integrated paths must be canonical. All final integrated evidence
   must share one binding. Every evidence/verdict/promotion check rehashes source content.
2. `binaries` and `inputs` are nonempty immutable `{path,sha256}` arrays. `outcomes` exactly covers
   criterion IDs for each axis with `{criterion,status,artifact:{path,sha256}}`. Passing declared
   outcomes do not prove arbitrary criterion meaning: independent reproduction/review remains
   responsible for actual execution, scope/branch exposure and input/effect completeness.
   Verdicts bind evidence digest plus explicit `source_bindings_digest`. Old evidence/verdicts
   need regeneration/reproduction; proposed pilot with no evidence still validates.
3. Scientific artifact references are canonical RE-relative, including existing `verify/`.
   Controls stay under campaign/runtime; absolute/traversing/outside-link/private-key/secret/Git
   artifact references fail. Both lexical path and resolved alias are checked. Hashing its own
   mutable contract in a checkpoint is explicitly rejected; contract metadata uses `basis`.
4. Recovery accepts old intact checkpoints, checks basis/artifacts and source-bound evidence,
   and independently verifies paired Git baseline/worktree identities. Promotion/end retain
   15-minute freshness. Astra lead/resolver may enter blocked surprises without worker checkpoint
   under resolution-only prompt/permissions and unchanged paired source at completion. Normal
   architecture actors receive authority appropriate to role; affected ordinary workers block.
5. Runner requires zero exit, no error event, successful `step_finish` reason `stop`, one actual
   nonempty session ID, consistent emitted model identity, and fresh matching end checkpoint.
   Missing observed model is explicitly unavailable. Canonical model/prompt/config fingerprints,
   expanded role prompt and effective live loader config hashes are recorded; config/contract
   changes around reservation/execution fail. Git HEAD/worktree validation repeats under lock.
6. Noninteractive overlay grants read/search, normal worker shell and exact root/subtree external
   access to paired worktrees/canonical RE, preserving role edit denies. Task/question denied;
   resolution shell/edit permissions narrowed to read/decision state. Effective loader model,
   steps, expanded prompt and requested permission entries are checked. No `--auto` required.
   These remain operational guards, not authentication, shell sandboxing or continuous auditing.
7. Gate remains `sots-gate/1` with `source.engine/re`; reporter is measured-only with
   `--require-match`. The new contract envelope references immutable gate/report packages rather
   than changing their schemas. No publishing acceptance/current pointers were changed.

### Measured verification

- `python3 -m unittest discover -s verify/campaign -p 'test_*.py' -v`: **36/36 passed**, 6.530s.
  Includes real disposable Git/worktree same-HEAD candidate and integrated drift, add/delete/mode,
  source/path/secret escapes, criterion/input omissions, concurrent leases, old recovery/resolver
  policy, zero-exit errors (also error followed by success), missing successful step/session,
  baseline race recheck, config drift, role authority and permission/environment provenance.
- Subsequently added checkpoint self-reference guard and exact-directory external grants:
  checkpoint bounds/self-reference regression **1/1 passed**, 0.098s; permission provenance and
  subprocess-success regressions **2/2 passed**, 0.391s. No unrelated changes after these checks.
- `python3 tools/campaign.py --state-root /home/alex/sots-re validate`: **passed** both contracts.
- Live `opencode debug config` with generated implementer env validated actual loader expansion,
  model, 40 steps and permissions. Prior overlay effective hash
  `25b06304c87586543d0607f0abc3f3d46c366cc664948f33c0900b38ab8b3248`, agent hash
  `5252aaec5ac9b7a8b3cc6265937651f09b00f87731e61e1582d9fbe2caa17b7a` (before additive exact-root
  grant). No real agent launch performed; normal-launch smoke belongs to the lead integration run.
- Checkpoint `2f0fe9ac4ec15b15a983bd75` attached its own contract before pointer mutation and thus
  has an invalid artifact hash. It is superseded by subsequent checkpoints; the new guard prevents
  recurrence. Final checkpoint intentionally references stable source/docs and this handoff only.

### Acceptance and ONE exact next action

Implementation and local measurements delivered; contract remains needs-revision, not accepted.
Independent verifier reproduction and integrated-tree/normal-launch smoke remain pending.
Lead: run the complete integrated test suite and a normal noninteractive launcher smoke, then
assign independent reproduction of this source-bound controls package before any promotion.