feat(certify): S2 step 12 — Final Evidence Certification (own-fix subscriptions certify)

[PhysShell]

S2 Step 12 — Final Evidence Certification (own-fix subscriptions certify)

A pure verifier + publisher that binds the six accepted S2 artifacts (validated plan,
candidates, step 8 bundle, step 9 gate-result.json, step 10 delta-result.json, step 11
target-result.json) plus the reference closure into one deterministic
certification-result.json (status evidence_complete). It runs no dotnet, applies no patch,
mutates no source, and re-executes nothing.

Lineage

• Base SHA (current main): 9fee6444ddf234e8ffba3e4b4fc45e5f1abbd05b (Step 11 merge anchor, PR S2 Step 11 — Verified Target Wrapper gate (own-fix subscriptions verify-target) #291)
• Final HEAD: 834e69f5ac6964b4790ae66ebb98036a0b726a82
• Verified before editing: origin/main contains the anchor and the Step 11 accepted head
  c7ab5e4fafcb7c2d0bc0f3eedcd96b8976294469; the seven frozen modules are byte-identical
  between the merge and the accepted head.

Contract

• Implements: S2_STEP12_SCOPE_PROPOSAL_revD + locked amendments P1-P3.
• Reported rev D contract SHA-256: 885aff8d8b0ca82dcaa5a64ed921c3ac2bf360cdd077ff6bacb3f3027a40f960
  — recorded as reported. The rev D file was supplied to this work as pasted text, not an
  attachment, so the arbiter did not independently verify the file bytes against this digest.

Locked amendments P1-P3, as applied:

• P1 — honest claims array. certification.claims is exactly
  ["evidence_chain_hash_bound_and_canonical", "representable_internal_invariants_revalidated", "upstream_pass_results_bound_not_reexecuted", "preimage_digest_cross_artifact_bound_bytes_not_supplied"].
  steps_8_11_gates_satisfied is not published or documented anywhere (asserted by a Tier A
  and a Tier B check).
• P2 — explicit evidence boundary. The step documents (module docstring + spec/CLI.md) that
  Step 12 does not prove the upstream artifacts were produced by the accepted implementations,
  and does not independently re-execute Git, Roslyn, the analyzer, the target probe, or the
  external toolchains; it verifies canonicality, hash bindings, closed schemas, the representable
  equations, upstream pass-status evidence and the reference-closure binding.
• P3 — single-valued taxonomy. Exactly ten refusal categories, no catch-all chain-mismatch;
  status remains evidence_complete; chain_kind ∈ {converted, manual_only}, a mixed plan
  certifying as converted.

Changed files (exactly six; nothing else)

File	Status
ownlang/fix_certify.py	new — the Step-12-local binder / publisher
tests/test_certify.py	new — Tier A (SDK-free)
tests/test_certify_tierb.py	new — Tier B (full public CLI)
ownlang/__main__.py	modified — one _cmd_certify + one dispatch line + usage
spec/CLI.md	modified — one certify row
.github/workflows/ci.yml	modified — one required Tier B step

Reused frozen helpers by import only: validate_gate_authority, validate_candidates_bundle,
validate_plan (only on a reconstructed two-key minimal plan, O6), bind_delta, bind_gate,
build_manifest / manifest_bytes, snapshot_reference_closure, _snapshot, _sha_bytes,
_canonical_json / _canonical_bytes, _execution_root, _remove_root_strict, and the
physical-path / staging predicates. The forbidden helpers (fix_target.bind_bundle,
fix_target._reval_inputs, fix_target._publish_target, and validate_plan on the seven-key
plan) are not called; Step 12 defines its own bundle binder, original-authority revalidation,
and single-file publisher.

Red-to-green history (unsquashed)

#	Commit
1	6f6c887	test(certify): red — the Step 12 Tier A contract, before the module exists
2	211c2f5	feat(certify): green — the core Final Evidence Certification binder
3	10a5c28	test(certify): red — the representable, verdict and isolation invariants
4	1bd5c06	feat(certify): green — the representable, verdict and isolation enforcement
5	aa19ba8	test(certify): red — the required Tier B public-CLI acceptance
6	bc6d27f	feat(certify): green — wire the CLI, the spec row and the required CI step
7	87072cc	test(certify): red — the arbiter's malformed-but-rehashed regressions
8	59cdb83	fix(certify): green — close the eight malformed-but-rehashed holes
9	8b3c51b	test(certify): harden the Tier B acceptance to a full public-CLI, tighter gate
10	857af59	test(certify): red — R_C authorization and the pre-rename originals boundary
11	028c2e7	fix(certify): green — bridge-authorized R_C and the pre-rename originals boundary
12	3384d33	test(certify): red — a converted chain must change the file (D6), + exact check-status
13	834e69f	fix(certify): green — a converted chain must actually change the file (D6)

Arbiter corrective round (commits 7-9) — the eight blocking defects, all closed

Each defect got a red regression first (commit 7) then its fix (commit 8):

1. delta.gate_binding is now a closed schema — bound / step9_operation / step9_version are
   validated (exact key set; version == 1 exact-int; bound is True) → DELTA_BINDING.
2. target.delta_binding is a closed schema — an extra "forged" key → TARGET_BINDING.
3. Step 10 toolchain scalars are typed (dotnet_host/core_runner/python_executable are sha256;
   dotnet_version/python_* are strings) and every extractor/ownlang/probe path is a canonical
   relative path → DELTA_BINDING / TARGET_BINDING.
4. probe_runtime_identity is bound back to the Step 10 runtime (all five fields), and
   probe_runner_sha256 must be a probe-deployment digest → TARGET_BINDING.
5. selected_wrapper.ordinal is exact-int-guarded before the equality (the False == 0 trap) →
   TARGET_BINDING.
6. manual-only no-op bundle — a manual chain must carry the empty patch with postimage ==
   preimage; a converted chain a non-empty patch → BUNDLE_BINDING.
7. publication is fully normalized — a Step-12-local strict claimant (no ignore_errors) and
   every open/write/scandir/stat/rename OSError → PUBLICATION.
8. lone surrogate / non-UTF-8 refuses in the artifact's own binding category via an
   encodability guard, never leaking a UnicodeEncodeError as INFRASTRUCTURE.

Acceptance-suite hardening (commit 9): Tier B now drives validate-plan through the public CLI
(not by import); the contract's claims/check-names are literal expected values in both tiers; the
no-mutation guard also fingerprints .git/config; absolute-path leak detection is broadened.

Second arbiter round (commits 10-11) — R1, R2, both red then green

• R1 — removed core OWN001 must equal the authorized R_C. removed_all_own001 was only bound to
  baseline − postimage, so an unrelated non-subscription OWN001 that also vanished (honestly
  listed, matching the multiset) was accepted. Now _authorized_removed reconstructs the candidate
  bridge Step-12-locally (mirroring the frozen fix_delta._bridge_r_c: K=(file, component, event, handler), single-shape group, exact cardinality, no mixed convert/manual under one K) and
  requires removed_all_own001 == R_C → DELTA_BINDING.
• R2 — final originals-only revalidation before the atomic rename. A second boundary
  (_revalidate_originals: the five inputs + the original bundle + the original --ref-dir closure
  re-derived from the caller directories) now runs inside publish_certification immediately before
  os.rename, wired via a pre_rename hook with a fresh throwaway scratch dir. A privileged
  mutation of an authoritative input between the first revalidation and publication is now
  ISOLATION.

Acceptance-suite: the no-absolute-path check now recurses over every published string with
posixpath/ntpath.isabs (not a prefix allowlist); the no-mutation guard fingerprints
git config --local --list --show-origin (robust to a linked-worktree .git file).

Third arbiter round (commits 12-13) — D6 second half + exact check-status, red then green

• D6 — a converted chain must actually change the file. The converted branch only required a
  non-empty change.patch; a hash-consistent chain with change.patch != empty but
  postimage == preimage was accepted (Step 12 applies no patch, so the equality is not otherwise
  self-evident). bind_certification_bundle now also requires sha256(postimage) != pre_sha256 for
  a converted chain — mirroring the frozen no-op invariant (manual-only: empty patch AND
  post == pre; converted: non-empty patch AND post != pre) → BUNDLE_BINDING.
• Exact check-status mapping. Both tiers now assert the status VALUES, not just the twelve key
  names: converted publishes all twelve == "pass"; manual-only publishes wrapper_identity == "not_applicable" and the other eleven == "pass".

Test counts

• Tier A (tests/test_certify.py, SDK-free): 114/114 pass (83 core + 31 corrective/coverage).
• Tier B (tests/test_certify_tierb.py, OWN_TIERB_REQUIRED=1, full public CLI, local): 32/32 pass
  — the real chain extract → candidates → validate-plan (CLI) → apply → gate → verify-delta → verify-target → certify for the converted and manual-only chains, two independent fresh-workspace
  runs byte-identical, repository (source / index / config / worktree) untouched.

Frozen Step 8-11 suites (unchanged)

Step	Suite	Count
S8	tests/test_patch_bundle.py	79/79
S9	tests/test_gate_patch.py	69/69
S10	tests/test_verify_delta.py (Tier A)	104/104
S11	tests/test_verify_target.py (Tier A)	108/108

The frozen Tier B suites (test_verify_delta_tierb.py, test_verify_target_tierb.py) share no code
with Step 12 and run in the same wpf-extractor CI job as the new Step 12 Tier B step.

Lint / type

• python -m ruff check . → All checks passed!
• python -m mypy --strict ownlang → Success: no issues found in 29 source files.

Two-run certification evidence SHA-256 (deterministic Tier A chains)

Two independent runs over fresh workspaces produce byte-identical certification-result.json:

• converted: 380fd0078f8d935eea291d91874513c66727453cb36b372dd41be2476898e656
• manual_only: bd5351d4fca1cf8a0c79e329b0a1402378f991240ad30f731a43567fc517de84
• mixed (certifies converted): 91f31b66254723e86dfd5382d41430de98bbb30cc84e723ae3f4c602cc82cfe3

Explicit evidence-claim limitations

The certification asserts only that the frozen S2 evidence chain is internally consistent
(canonical bytes, closed schemas, hash bindings, the representable Step 10/11 equations, the
cross-artifact preimage digest, and the reference-closure binding) and that upstream pass-status
is bound. It claims nothing about: patch application, compilation, production runtime
compatibility, absence of all leaks, general wrapper correctness, that the artifacts were produced
by the accepted implementations, or approval for unattended modification. The preimage digest is
cross-artifact-bound; the preimage bytes are never supplied to or reverified by Step 12.

Confirmations

• Frozen Steps 0-11 source-identical: git diff origin/main...HEAD over the seven frozen
  modules (fix_candidates, fix_plan, fix_apply, fix_bundle, fix_gate, fix_delta,
  fix_target) is empty. No frozen module or test was modified.
• No later step started: the change is Step 12 only; no Step 13+ work exists.

CI (final head 834e69f, all green)

Workflow	Run ID	Conclusion
CI	29640563323	✅ success
CI	29640564216	✅ success
Owen.Cli release	29640564215	✅ success
pr-issue-validation	29640564219 / 29640596854	✅ success

The CI workflow's wpf-extractor job ran the required step "S2 step 12 final-evidence
certification (Tier B, full public CLI)" → success (alongside the frozen Step 10 and Step 11
Tier B steps). Every prior head was likewise fully green: bc6d27f (CI 29636185615/29636220106),
8b3c51b (CI 29638982166/29638983823), 028c2e7 (CI 29639774465/29639775528). Kept OPEN
and unmerged for arbiter review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01JxKjqdGEFzq4UzZupw379G

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds S2 Step 12 final-evidence certification with strict artifact binding, invariant and isolation checks, atomic publication, a public CLI command, documentation, Tier A tests, and required Tier B CI coverage.

Changes

S2 Step 12 certification

Layer / File(s)	Summary
Certification contracts and authority binding ownlang/fix_certify.py	Defines canonical parsing and refusal categories, validates the Step 8 bundle, and authenticates plan and candidate authority.
Cross-artifact and invariant validation ownlang/fix_certify.py	Binds gate, delta, target, and reference-closure evidence while enforcing schemas, equations, ordering, and converted-target invariants.
Isolation, assembly, and publication ownlang/fix_certify.py	Revalidates inputs, builds canonical certification evidence, and atomically publishes certification-result.json.
CLI command and documented contract ownlang/__main__.py, spec/CLI.md	Adds own-fix subscriptions certify, argument handling, refusal reporting, dispatch routing, and command documentation.
Tier A validation tests/test_certify.py	Tests successful certification, deterministic output, tampering refusal categories, publication safeguards, representability checks, and isolation detection.
Tier B CLI acceptance and CI enforcement tests/test_certify_tierb.py, .github/workflows/ci.yml	Runs converted and manual public CLI chains, checks deterministic evidence and repository immutability, and enables required CI execution.

Estimated code review effort: 5 (Critical) | ~120 minutes

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant run_certify
  participant EvidenceArtifacts
  participant certification_result
  CLI->>run_certify: certify plan, bundle, gate, delta, target
  run_certify->>EvidenceArtifacts: snapshot and validate evidence
  EvidenceArtifacts-->>run_certify: bound hashes and closure
  run_certify->>certification_result: atomically publish canonical result
  certification_result-->>CLI: return output path

Loading

Possibly related PRs

• PhysShell/Own.NET#291: Adds the Step 11 target verification evidence consumed by this certification flow.
• PhysShell/Own.NET#285: Adds related subscription candidate output consumed by certification.
• PhysShell/Own.NET#288: Adds the Step 8 bundle outputs consumed by certification.

🚥 Pre-merge checks | ✅ 3 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description has rich detail, but it does not follow the required template sections and headings.	Rewrite it using the repo template: add 'Что и зачем', 'Тип изменения', 'Как проверено', 'Связанные issue', and 'Чеклист' sections with checkbox items.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly names the new Step 12 certification feature and the CLI subcommand.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/s2-step12-certify

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bc6d27fd18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Validate the full Step 10 gate binding

When someone tampers an otherwise hash-consistent delta-result.json (for example, keeps gate_result_sha256/git_gates_status but changes gate_binding.bound to false or step9_operation to another string and recomputes downstream hashes), this block still accepts it because only two fields are checked. That lets certify publish final evidence for a Step 10 artifact that no longer asserts the Step 9 binding it is supposed to certify; validate the exact gate-binding key set and fixed bound/operation/version values here.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Reject boolean selected-wrapper ordinals

When the derived wrapper ordinal is 0, a target-result.json with selected_wrapper.ordinal set to JSON false passes this comparison because Python booleans compare equal to integers (False == 0). The certification then publishes wrapper_identity.ordinal as false even though the closed schema expects a non-negative integer, so this should explicitly require ft._is_int(sw["ordinal"]) before comparing it to the derived ordinal.

Useful? React with 👍 / 👎.

[coderabbitai]

Actionable comments posted: 8

🧹 Nitpick comments (1)

tests/test_certify_tierb.py (1)

39-39: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Pin the certification contract independently of production constants.

Importing _CHECK_NAMES and _CLAIMS makes these assertions follow implementation drift automatically. Define frozen expected values in this acceptance test so unintended public-contract changes fail Tier B.

Also applies to: 278-280

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_certify_tierb.py` at line 39, Update the acceptance tests in
tests/test_certify_tierb.py to stop importing _CHECK_NAMES and _CLAIMS from
ownlang.fix_certify. Define frozen expected check names and claims locally in
the test, then use those values in the assertions so production constant changes
are detected as contract failures.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ownlang/fix_certify.py`:
- Around line 537-545: Extend the Step 10 validation in the surrounding
certification flow after the closed-key checks for tfp and ca to validate every
toolchain fingerprint value, not only the manifest pairs. Reuse the frozen Step
10 field validators for dotnet_host_sha256, runtime identity, runner/Python
hashes, versions, and implementation fields; otherwise reproduce their exact
nested schemas and scalar checks before publishing the evidence.
- Around line 717-723: Update the publication staging flow around the
certification-result write and _require_single() so all related file creation,
write, close, and validation OSError exceptions are caught and translated into
CertifyError with the PUBLICATION category. Preserve the existing destination
checks and publication behavior, and include the underlying failure context when
constructing the stable error.
- Around line 365-369: Update the delta_binding validation in the certification
flow to enforce the closed schema: require exactly the contract-defined fields
and reject any additional keys, while preserving the existing type and value
checks for delta_result_sha256, step10_operation, step10_status, and bound. Keep
raising CertifyError for any schema or binding mismatch.

In `@tests/test_certify_tierb.py`:
- Around line 176-185: Update the test helper _plan to generate and validate the
plan through the public own-fix subscriptions validate-plan CLI subcommand
instead of importing and calling validate_plan directly. Preserve the existing
candidates input, decisions, output plan path, and action selection while
ensuring the test exercises the public command-line boundary.
- Around line 262-266: Update _no_absolute_paths to recursively inspect JSON
string values and detect every absolute-path form, including drive-letter paths
with either slash style (such as C:/...), POSIX paths such as /Users/ and /opt/,
and CI workspace roots. Preserve the existing check failure behavior and message
while ensuring nested evidence values are covered.
- Around line 322-329: Extend the immutability snapshot around the _CASES loop
in tests/test_certify_tierb.py by capturing local Git configuration with git
config --local --list --show-origin before _run_case and comparing it afterward.
Preserve the existing HEAD and status checks, and fail through check if the
configuration snapshot changes.

In `@tests/test_certify.py`:
- Around line 390-398: Update the certification test around the claims and
checks assertions to use literal specification values instead of fc._CLAIMS and
fc._CHECK_NAMES, including the required twelve check names. Add a second
independent run with identical inputs and compare its raw
certification-result.json bytes to the first run, while retaining the
canonical-byte assertion for each output.
- Around line 771-793: Extend the revalidation tests near the existing ref-dir
drift cases to cover an initially empty --ref-dir: create and bind an empty
reference directory, add a DLL such as WeakEvents.dll afterward, then call
revalidate_certification_inputs through _raises_call and assert fc.ISOLATION.
Preserve the existing nonempty-directory and materialized-slot cases.

---

Nitpick comments:
In `@tests/test_certify_tierb.py`:
- Line 39: Update the acceptance tests in tests/test_certify_tierb.py to stop
importing _CHECK_NAMES and _CLAIMS from ownlang.fix_certify. Define frozen
expected check names and claims locally in the test, then use those values in
the assertions so production constant changes are detected as contract failures.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bb4d38b8-349b-4a3d-bdf7-c3e9380e19a3

📥 Commits

Reviewing files that changed from the base of the PR and between 9fee644 and bc6d27f.

📒 Files selected for processing (6)

• .github/workflows/ci.yml
• ownlang/__main__.py
• ownlang/fix_certify.py
• spec/CLI.md
• tests/test_certify.py
• tests/test_certify_tierb.py

[coderabbitai]

Actionable comments posted: 4

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@ownlang/fix_certify.py`:
- Around line 244-250: Update the bundle validation in the function binding the
accepted Step 8 bundle (around the converted-chain checks) to reject any
converted result whose postimage bytes are identical to the preimage bytes, even
when the patch is non-empty. Preserve the existing manual-only no-op rule and
raise the established BUNDLE_BINDING failure for this invalid converted-chain
state.

In `@tests/test_certify_tierb.py`:
- Around line 315-321: Update _git_config_sha to obtain the repository
configuration through the existing _git helper/CLI rather than opening
.git/config directly. Hash the returned configuration bytes or text consistently
with the current _sha call, and retain the "absent" result only when git reports
that no configuration is available.
- Around line 279-281: Update the leaked-path detection expression in the test
to check for a UNC JSON prefix using the raw four-backslash pattern r"\\\\",
replacing the current "\\\\" check. Preserve the existing drive-letter and Unix
path checks.

In `@tests/test_certify.py`:
- Around line 412-413: Update the assertion in the check-result test to validate
the complete expected status mapping, including each check’s value, rather than
only comparing the check-name set and count. Preserve the existing requirement
that exactly twelve checks are present and use the expected mapping already
defined by the test.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0683d021-811c-4ced-aba0-c3434760ab10

📥 Commits

Reviewing files that changed from the base of the PR and between bc6d27f and 8b3c51b.

📒 Files selected for processing (3)

• ownlang/fix_certify.py
• tests/test_certify.py
• tests/test_certify_tierb.py