Connector discipline complete, the watermelon detector, and the wrong-test detector — every affirmative earned, zero known gaps

.github/workflows/review-hub-ci.yml

@@ -119,6 +119,27 @@ jobs:
         run: pnpm run proof:macos-posture
       - name: "Proof: uem (read-only MDM/UEM, gated, no actuators)"
         run: pnpm run proof:uem
+      - name: "Proof: entitlement-binding (grant reviewability)"
+        run: pnpm run proof:entitlement-binding
+      - name: "Proof: response-accountability (watermelon detection)"
+        run: pnpm run proof:response-accountability
+      - name: "Proof: device-resolver (read-only injection boundary)"
+        run: pnpm run proof:device-resolver
+      - name: "Proof: config-scope (per-tenant connector config keys)"
+        run: pnpm run proof:config-scope
+      - name: "Proof: unsafe-claim (negation-aware claim scan)"
+        run: pnpm run proof:unsafe-claim
+      # Both of these ran in preflight but in NO workflow — proven only on a developer
+      # machine while every status page said "CI runs the full gate suite".
+      # `check-ci-preflight-sync.mjs` now derives this list rather than trusting it.
+      - name: "Proof: dual-control (two-person integrity)"
+        run: pnpm run proof:dual-control
+      - name: "Proof: session-store (in-memory lifecycle)"
+        run: pnpm run proof:session-store
+      - name: "Proof: provisioning-order (zero-touch step order)"
+        run: pnpm run proof:provisioning-order
+      - name: "Proof: nac (read-only endpoint identity, gated, no actuators)"
+        run: pnpm run proof:nac
 
       - name: macOS posture ↔ apple/device-management schema alignment proof
         run: pnpm run proof:macos-apple-schema
@@ -173,9 +194,43 @@ jobs:
         run: pnpm run proof:platform-sso
       - name: Proof — passkey-assurance (credential worth, not just "passkey")
         run: pnpm run proof:passkey-assurance
+      - name: Proof — change-window (approved WHEN, by WHOM, on a current record)
+        run: pnpm run proof:change-window
+
+      # MCP answer discipline — the SECOND of two MCP proofs, and deliberately so.
+      # `proof:mcp-server` (further down, from the Mac lane) asks whether the published
+      # plugin path boots and serves the tools the manifest declares. This asks whether
+      # what it serves is EARNED: every optional input is a claim, and omitting one must
+      # not be answered as an affirmative. Different questions, both load-bearing.
+      - name: Proof — mcp-answer-discipline (silence is not an affirmative)
+        run: pnpm run proof:mcp-answer-discipline
 
       # Policy binding — membership IS the policy: unbound, too-wide (fail-open),
       # too-narrow, or mixed-membership group assignment.
+      - name: Proof — emitter-discipline (five outbound families gated, fixture never claims delivery)
+        run: pnpm run proof:emitter-discipline
+      - name: Proof — emit-gate (one shared tier gate for every in-adapter emitter route)
+        run: pnpm run proof:emit-gate
+      - name: Proof — absent-collection (nothing observed is not nothing wrong)
+        run: pnpm run proof:absent-collection
+      - name: Proof — caep-events (unsigned session signals, sixth emitter family)
+        run: pnpm run proof:caep-events
+      - name: Proof — mdm-profile (the shipped profiles say what the product claims)
+        run: pnpm run proof:mdm-profile
+      - name: Proof — benchmark-selection (which CIS benchmark graded this device, and from what content)
+        run: pnpm run proof:benchmark-selection
+      - name: Proof — shift-context (right time and site for this worker to be operating)
+        run: pnpm run proof:shift-context
+      - name: Proof — bootstrap-credential (a temporary pass reaches enrollment only)
+        run: pnpm run proof:bootstrap-credential
+      - name: Proof — challenge-capability (a step_up must be answerable, never a deny in disguise)
+        run: pnpm run proof:challenge-capability
+      - name: Proof — sse-egress (a mandated edge the traffic is not traversing is never protected)
+        run: pnpm run proof:sse-egress
+      - name: Proof — webhooks (outbound delivery gated; a withheld delivery says so)
+        run: pnpm run proof:webhooks
+      - name: Proof — facility-trust-graph (canonical space model + location certainty)
+        run: pnpm run proof:facility-trust-graph
       - name: Proof — policy-binding (group-assignment correctness)
         run: pnpm run proof:policy-binding
 
@@ -258,6 +313,18 @@ jobs:
       # All seven are pure Node and need no external service.
       - name: "Doc orphans (a new doc must be reachable from an index)"
         run: node scripts/check-doc-orphans.mjs
+      # The same shape one level down: doc-orphans asks whether a reader can reach a
+      # document, this asks whether a shipped artifact can reach a library. Both catch
+      # the failure mode that never announces itself — everything green, nothing
+      # arrives. Added after a design pass found `lib/dual-control` had zero shipped
+      # consumers AFTER the work to wire it had already been scoped.
+      - name: "Package reachability (a library nobody ships is a library nobody runs)"
+        run: node scripts/check-package-reachability.mjs
+      # The provenance stamp is GENERATED, so the gate is "regenerate and compare
+      # content" — deliberately not `git diff`, which is blind to untracked files and
+      # would have passed on the very commit that introduced the artifacts.
+      - name: "Core normalization-version (provenance stamp tracks the covered core source)"
+        run: node scripts/generate-core-normalization-version.mjs --check
       - name: "Proof — dual control"
         run: pnpm run proof:dual-control
       - name: "Pagination-truncation guard (a capped read must not look complete)"
@@ -283,6 +350,8 @@ jobs:
       # hardware can refresh that, so staleness never blocks a commit.
       - name: Live-sync manifest drift (Mac MCP + iOS instructions current)
         run: node scripts/check-live-sync.mjs
+      - name: MCP surface drift gate (server = docs = ready message = manifest)
+        run: node scripts/check-mcp-surface.mjs
 
       - name: Docs↔proof figure guard
         run: node scripts/check-proof-figures.mjs
@@ -410,6 +479,9 @@ jobs:
       - name: Edge-sync (config-down integrity) proof
         run: pnpm run proof:edge-sync
 
+      - name: Decision-continuity (which decision wins across a partition) proof
+        run: pnpm run proof:decision-continuity
+
       - name: Telemetry-up (decision plane → control plane) proof
         run: pnpm run proof:telemetry-up
 
@@ -434,6 +506,9 @@ jobs:
       # Required docs exist + affirmative-unsafe-claim scan. Shared with
       # `pnpm run preflight` via scripts/docs-sanity.mjs so the check is the same
       # locally and in CI.
+      - name: CI↔preflight drift (every proof runs in both places)
+        run: node scripts/check-ci-preflight-sync.mjs
+
       - name: Docs sanity (required docs + unsafe-claim scan)
         run: node scripts/docs-sanity.mjs
 

CLAUDE.md

@@ -90,6 +90,14 @@ proofs miss:
   — badge, location/zone, injected signals, screen-capture, seeded control-plane
   refs, etc. Pass via `xcrun simctl launch booted com.enterprise.shell -Flag ...`.
 
+## Multiple Claude lanes
+
+Parallel Claude sessions work this repo (cloud + Mac). Before touching a
+shared surface (discipline gate, mutation guard, sync manifest, proof
+registration, connector families the other lane's commits name), read
+`docs/LANE_COORDINATION.md` and follow its protocol — the nac/webhooks
+eight-file collision is why it exists.
+
 ## Ask before
 
 Destructive git (force-push, history rewrite, branch deletion), anything that

artifacts/api-server/src/app.ts

@@ -83,10 +83,17 @@ app.get(["/", "/console"], (_req, res) => {
   res.type("html").send(CONSOLE_HTML);
 });
 
-// Prometheus scrape endpoint (operational metrics). Unauthenticated and outside
-// the /v1 contract surface, per Prometheus convention; contains only aggregate
-// counters/latencies, never request payloads.
-app.get("/metrics", (_req, res) => {
+// Prometheus scrape endpoint (operational metrics). Global AGGREGATE only —
+// counters/latencies with no tenant label and no request payloads, so the
+// endpoint can never become a cross-tenant side channel. Open by default per
+// Prometheus convention; setting METRICS_TOKEN requires scrapers to present it
+// as a bearer, without breaking deployments that never set it.
+app.get("/metrics", (req, res) => {
+  const required = process.env.METRICS_TOKEN?.trim();
+  if (required && req.headers.authorization !== `Bearer ${required}`) {
+    res.status(401).type("text/plain").send("metrics: bearer token required");
+    return;
+  }
   res.type("text/plain; version=0.0.4").send(renderMetrics(Date.now()));
 });
 

artifacts/api-server/src/routes/v1.ts

@@ -1,6 +1,13 @@
 import { Router, type IRouter, type Request, type Response, type NextFunction } from "express";
 import { createHash, randomUUID, timingSafeEqual } from "node:crypto";
-import { CoreError, verifySnapshot, type EvaluateRequest } from "@workspace/signalgrid-core";
+import {
+  CoreError,
+  reconcileDecisions,
+  verifySnapshot,
+  type EvaluateRequest,
+  type ReconcilableDecision,
+  type StandingBound,
+} from "@workspace/signalgrid-core";
 import { getDecisionStore, getSessionStore, type Session } from "@workspace/persistence";
 import { listAppIntegrations, findAppIntegration, planAppSession } from "@workspace/app-workflows";
 import { webauthn, webauthnStore } from "@workspace/webauthn";
@@ -125,6 +132,32 @@ router.get("/v1/decisions/:id/evidence", async (req: Request, res: Response, nex
   }
 });
 
+/**
+ * Reconcile decisions that were made on both sides of a network partition.
+ *
+ * A frontline device that keeps working offline keeps DECIDING offline, so on
+ * reconnect two answers exist for one subject and action. `reconcileDecisions`
+ * (`lib/signalgrid-core/src/continuity.ts`) says which one stands; this is its wire arm.
+ *
+ * THE ROUTE STORES NOTHING AND READS NOTHING. Every record is caller-supplied and the
+ * reduction is pure, so there is no decision id to mint, no evidence snapshot, and
+ * nothing to persist. That is deliberate: the reconciler answers a question about
+ * records the caller already holds, and minting a new decision here would create a
+ * record with no evidence behind it.
+ *
+ * WHAT THIS PARSER DELIBERATELY DOES NOT DO: fill anything in. `evaluatedOffline` and
+ * `policyKnownSuperseded` are passed through exactly as sent, absent included, so the
+ * library's refusal is what the caller meets. A `?? false` here would be the MCP
+ * adapter's defect at a different layer — an omitted field buying the record the right
+ * to relax — and it would be invisible from the wire, because a defaulted request and
+ * an honest one produce the same 200.
+ */
+router.post("/v1/decisions/reconcile", (req: Request, res: Response) => {
+  const { records, standingBound } = parseReconcile(req.body);
+  const result = reconcileDecisions(records, standingBound ? { standingBound } : {});
+  res.json(envelope(req, { reconciliation: result }));
+});
+
 // ── Sessions: durable start / refresh / end lifecycle ────────────────────────
 // A session is gated by a real decision at start, then kept alive by refreshes
 // until it ends or its TTL lapses. Sessions persist in-memory by default and to
@@ -688,6 +721,86 @@ function parseEvaluate(body: unknown): EvaluateRequest {
   return { identityRef, deviceRef, workflowKey, requestContext };
 }
 
+/**
+ * How many decision records one reconcile call may carry.
+ *
+ * The reduction computes a Pareto frontier, which is O(n²) in the record count, so an
+ * unbounded array is a cost the caller controls. The bound REFUSES rather than
+ * truncates, and that is the load-bearing half: truncating would silently drop records
+ * from the set, and dropping a record can only ever remove a restriction — the same
+ * asymmetry that makes an expired local decision get RAISED to a floor instead of
+ * dropped. A partial answer here would be indistinguishable from a complete one.
+ *
+ * Sized for what the surface actually is: the decisions held for ONE subject and action
+ * across a partition, which is a handful in practice. A caller that genuinely has more
+ * has a different problem than reconciliation.
+ */
+const MAX_RECONCILE_RECORDS = 64;
+
+/**
+ * Parse a reconcile request WITHOUT completing it.
+ *
+ * Shape and type are checked here so a malformed body is a clean 400 instead of a
+ * library exception; SEMANTICS are left entirely to `reconcileDecisions`, which already
+ * refuses an unstated `evaluatedOffline`, a non-integer `policyVersion`, a negative
+ * elapsed, a duplicate id carrying two different answers, and an empty set. Re-checking
+ * those here would create a second place for the rules to live and a second place for
+ * them to drift.
+ */
+function parseReconcile(body: unknown): {
+  records: ReconcilableDecision[];
+  standingBound?: StandingBound;
+} {
+  if (!body || typeof body !== "object") {
+    throw new CoreError("validation", "Request body must be a JSON object.", 400);
+  }
+  const record = body as Record<string, unknown>;
+  const raw = record["records"];
+  if (!Array.isArray(raw)) {
+    throw new CoreError("validation", "records must be an array of decision records.", 400);
+  }
+  if (raw.length > MAX_RECONCILE_RECORDS) {
+    throw new CoreError(
+      "validation",
+      `records may carry at most ${MAX_RECONCILE_RECORDS} decisions; ${raw.length} were sent. ` +
+        "The request is refused rather than truncated — a dropped record can only remove a restriction.",
+      400,
+    );
+  }
+  for (const entry of raw) {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+      throw new CoreError("validation", "Each record must be a JSON object.", 400);
+    }
+    const provenance = (entry as Record<string, unknown>)["provenance"];
+    if (!provenance || typeof provenance !== "object" || Array.isArray(provenance)) {
+      throw new CoreError("validation", "Each record must carry a provenance object.", 400);
+    }
+  }
+  const records = raw as ReconcilableDecision[];
+
+  const boundRaw = record["standingBound"];
+  if (boundRaw === undefined) return { records };
+  if (!boundRaw || typeof boundRaw !== "object" || Array.isArray(boundRaw)) {
+    throw new CoreError("validation", "standingBound must be a JSON object when present.", 400);
+  }
+  const bound = boundRaw as Record<string, unknown>;
+  const elapsed = bound["elapsedSecondsById"];
+  if (elapsed !== undefined && (!elapsed || typeof elapsed !== "object" || Array.isArray(elapsed))) {
+    throw new CoreError("validation", "standingBound.elapsedSecondsById must be an object.", 400);
+  }
+  // A missing `elapsedSecondsById` becomes an EMPTY map rather than an absent bound —
+  // so every offline record reads as age-unstated and expires. Treating it as "no bound
+  // posed" would let a caller pose a bound and then escape it by omitting the ages,
+  // which is the shape this whole surface exists to refuse.
+  return {
+    records,
+    standingBound: {
+      ...(bound as unknown as StandingBound),
+      elapsedSecondsById: (elapsed ?? {}) as Record<string, number>,
+    },
+  };
+}
+
 const FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 // Linear, length-bounded key pattern (no nested quantifiers → no ReDoS).
 const CONTEXT_KEY = /^[a-zA-Z][a-zA-Z0-9_.-]{0,63}$/;