feat(0.7.1g1P2-1): bind M34 to a canonical authority projection, not raw PIT status

[GionaGranchelli]

Base

ec8b4da59bc9e22711b0cd802417d297f803b4e0 — the #469 design record is already authority on the Epic.

Step 1 of three from TASK-0.7.1g1P2-AUTHORITY-MODEL-RECONCILIATION.md: the authority-v2 projection. No certificate logic, no consumption rules, no P2.

Scope

Seven files, all intentional:

• build-logic/.../quality/MutationRatchetVerifier.kt — new authorityProjection() / authorityProjectionHash(): identity|outcome|family|module, sorted, plus the shared topology=/analyzer= suffix. MutationPopulationEvolutionProof now carries two hashes, both computed by the verifier from the same fresh measurement. The suffix both projections share is serialized by one private helper, contextLines(), so "the authority projection is exactly the raw projection minus raw status" is structural rather than incidental (byte-identical output, so no digest moved).
• build-logic/.../quality/MutationPopulationAdmissionCeremony.kt — M34 compares the authority hash; the parameter is renamed freshAuthorityProjectionHash through the whole chain (verifier → context → ceremony → appearanceVerdict) so the name cannot lie; the diagnostic and the trust-properties doc now state that an authorization binds the measured population's authority content and deliberately not raw PIT status.
• MutationRatchetTestSupport.kt — digestOf returns the authority digest (its own doc already said it is "the value the admission ceremony compares against"); new rawDigestOf for M21 assertions. One line, 18 call sites.
• MutationPopulationEvolutionProofTest.kt — T1, T2, T8.
• MutationPopulationAdmissionCeremonyTest.kt — T1 at ceremony level; the M34 negative test's expected diagnostic substring.
• MutationRatchetAuthorityTest.kt — one fixture line, evidenced below.
• MutationPopulationAdmissionIntegrationTest.kt — the real mint→transport fixture, changed from the raw projectionHash to authorityProjectionHash, with projectionDigest() renamed authorityProjectionDigest() so the semantics are explicit at every call site. This is the fixture that actually writes the admission ledger and drives the task end to end, so minting the raw-v1 measurement digest there meant the lane passed while the real transport was broken. Both call sites (writeAdmissionLedger(...) and the base≠candidate precondition) were updated, and the assertion exceeding MaxLineLength after the rename was wrapped rather than baselined.

Why

C7 (BaselineModel.kt:348-354) declares raw PIT status diagnostic evidence and not authority, and explicitly anticipates TIMED_OUT↔SURVIVED scheduler races. Four complete unrestricted campaigns at identical effective PIT inputs produced four distinct raw-status digests — three identities of 2544 oscillating only SURVIVED↔TIMED_OUT, all NON_KILLED in every campaign — while the authority content was byte-identical: e6ad01dc1d2966894a6555304bc8ca9a04c8174e3c83ae88760fcfebf1464dad.

M34's digest was projectionHash, the measurement proof, whose raw-status content is correct for its own purpose. Reusing that one hash for the population-context question let a scheduler race on unrelated neighbours invalidate adjudicated authority. This was not a deliberate override of C7 — it was one hash serving two different trust questions.

Invariants preserved

• exactComparison(), matches(), canonicalProjection() and M21 stay raw-exact. No relaxation where raw status genuinely is authority.
• M32 stays status-inclusive. The 67 authorized rows were byte-identical (status included) in all four campaigns, and the G5b/G5c/G5d rationales are status-specific — a NO_COVERAGE → SURVIVED reading would falsify the UNREACHABLE proof.
• The authority hash is computed by the verifier from its own fresh measurement; it is never read from the candidate, so the anti-self-authorization property is intact.
• Analyzer semantics remain inside the authority digest (M33 + M16-M18 unchanged).

Verification

• ./gradlew :build-logic:compileKotlin — BUILD SUCCESSFUL
• ./gradlew :build-logic:test --tests 'dev.tramai.build.quality.MutationPopulation*' --tests '...MutationRatchet*' --tests '...MutationEvolution*' --tests '...MutationEnrollment*' --rerun-tasks — BUILD SUCCESSFUL, 8 tasks executed, 12 classes / 142 tests / 0 failures (a genuine execution, not an up-to-date pass)
• ./gradlew verifyCancellationSafety — PASSED: 317 findings in scoped modules, no new critical/high findings or risk worsenings against origin/master (auto-resolved merge base 41ac9151)
• ./gradlew spotlessKotlinCheck -PtramaiFormattingBaseRef=ec8b4da59bc9e22711b0cd802417d297f803b4e0 — BUILD SUCCESSFUL (three violations in the touched files fixed by hand; spotlessApply deliberately not used because the ratchet reformats legacy files whole)
• ./gradlew verifyStaticAnalysis — no new findings; Detekt baseline unchanged (base 4792 → current 4792, 0 added, 0 removed). The MaxLineLength finding introduced by the transport-fixture rename was wrapped into the standard multiline form, not baselined and not suppressed.
• ./gradlew verifyChangePolicy -PchangePolicyBase=ec8b4da59bc9e22711b0cd802417d297f803b4e0 — PASSED, 7 changed files, change class build-logic, no policy violations
• ./gradlew :build-logic:canonicalProbeIntegrationTest — fails on CanonicalProbeFunctionalTest.kt:507 (IllegalStateException) with an identical signature at the pristine base (BASE_INTEGRATION_RC=1), so pre-existing and not regenerated. MutationPopulationAdmissionIntegrationTest — the authority-transport lane this PR actually fixes — is not among the failures.
• ./gradlew :build-logic:test --tests 'dev.tramai.build.quality.MutationPopulation*' --tests '...MutationRatchet*' --tests '...MutationEvolution*' --tests '...MutationEnrollment*' --rerun-tasks — BUILD SUCCESSFUL, 8 tasks executed, 12 classes / 142 tests / 0 failures (a genuine execution, not an up-to-date pass)
• ./gradlew verifyPr -PchangePolicyBase=ec8b4da59bc9e22711b0cd802417d297f803b4e0 — red only on pre-existing failures, each reproduced at the exact base (below). Development-time runs that overlapped each other produced additional spurious failures in FormattingGateConfigCacheTest and verifyCancellationSafety; both pass when run alone, and the concurrency was self-inflicted.

Pre-existing failures, classified with base evidence

• CancellationWiringTest > C1 cancellation authority remains exact base task() — reproduces at the pristine base ec8b4da5 (3 tests, 1 failure), same assertion. Left alone: out of scope for this slice.
• TramaiDocsGuardsPluginTest > verifyVersionAlignment … (4 failures) — reproduces at the pristine base on a branch checkout (fresh worktree, branch tmp-base-branch at ec8b4da5, BASE_BRANCH_DOCS_RC=1). Branch-dependent: the same test passes in a detached-HEAD worktree at the same SHA. Environment/workflow-dependent, not caused by this change, and evidently not in CI's filtered matrix.
• MutationRatchetAuthorityTest > certified authority passes its own ratchet against identical candidate — reproduces at the pristine base with an identical signature (8 tests, 1 failure, M37 ... 050d2b83), and the changed code path cannot reach it (consumed = mutant != null && … short-circuits before M34 when the identity is absent from the candidate). Diagnosed test-defect: the candidate passed admissions = NONE while the real base holds 67 pending authorizations, asserting a transition M37 forbids. Corrected to retain authority.admissions, so absent targets are M39 warnings as designed. Now passes.
• TramaiDocsGuardsPluginTest / ReleaseVerificationPluginTest also show red in a full local run and are not classified — they cannot exercise the changed code path, and CI's filtered contract-tests matrix is the authority on them.

Discriminators added (design record §7, T1/T2/T8)

• T1 — a neighbour's raw status movement leaves the authority projection unchanged, while the raw-exact proof still distinguishes the populations (proving nothing was relaxed where raw status is authority).
• T1 at ceremony level — an authorization minted while a neighbour was SURVIVED remains consumable when that neighbour is TIMED_OUT: the case-3 discriminator, and the exact scenario four campaigns produced.
• T2 / T8 — an outcome change, and an analyzer-semantics change, both move the authority digest.

Quality impact

• cancellation findings: no change
• nondeterminism findings: no change
• API changes: none (internal build-logic verifier API; MutationPopulationEvolutionProof gains a field on a private constructor)
• deviations changed: none

Not run

• The full unfiltered :build-logic:test suite does not pass locally for reasons unrelated to this change (see above); CI's filtered matrix is the final authority.
• No P2 consumption, no campaign rerun, no baseline regeneration, no classification change.

Remaining risks

• Interim semantics, by design: the committed 67 admissions carry the raw digest 9aebd320…, so under authority-v2 they are not consumable until the migration certificate exists in a base. P2 stays blocked; nothing here consumes them.
• Steps 2 and 3 (certificate type/ledger/loader + M45/M46/M47, then certificate-aware M34 + M40-M44, plus the full T1-T19 matrix at both verifier and authority-transport level) are not in this PR.
• Local environment note: several runs shared one worktree's results root during development, which made intermediate tallies untrustworthy; the numbers reported above come from a single clean --rerun-tasks execution.

[Copilot]

Copilot review overview

🔵 Needs a closer look

This change to core authority-digest semantics is high-risk governance machinery, and the required real-task authority-transport test (MutationPopulationAdmissionIntegrationTest, outside the diff) still mints populationDigest from the raw projectionHash, which would be non-consumable under the new M34 — a cross-file inconsistency that needs human verification.

Review effort: Balanced
Findings: 1

Open (1)

• Duplicate topology/analyzer serialization risks projection drift · New

What changed in this PR

This PR is step 1 of 3 of the authority-model reconciliation for the mutation ratchet (build-logic quality governance). It changes the M34 population-context check so that a population authorization is bound to a new authority projection (identity, canonical outcome, family, module, topology, analyzer semantics) rather than the raw PIT-status–inclusive measurement digest. The motivation (documented in design record #469 and BaselineModel.kt C7) is that raw PIT status is diagnostic evidence, not authority: SURVIVED↔TIMED_OUT scheduler races on unrelated neighbours were able to invalidate already-adjudicated authority even though the authority content was byte-identical across four campaigns. The raw-exact paths (matches(), canonicalProjection(), M21, M32) are deliberately left unchanged.

Changes:

• Add authorityProjection()/authorityProjectionHash() to the verifier and a second authorityProjectionHash field on MutationPopulationEvolutionProof, both computed by the verifier from the same fresh measurement.
• Make M34 compare the authority hash, renaming freshProjectionHash → freshAuthorityProjectionHash through the whole chain, and update the M34 diagnostic and trust-properties docs.
• Update test support (digestOf now returns the authority digest; new rawDigestOf) and add discriminator tests T1/T2/T8 plus a ceremony-level T1; fix a pre-existing MutationRatchetAuthorityTest fixture (admissions = authority.admissions).

File	Description
MutationRatchetVerifier.kt	Adds authorityProjection()/authorityProjectionHash(), a second proof hash, and the freshAuthorityProjectionHash plumbing/docs.
MutationPopulationAdmissionCeremony.kt	M34 now compares the authority hash; parameter renamed end-to-end; diagnostic/trust-doc updated to state raw status is excluded.
MutationRatchetTestSupport.kt	digestOf returns the authority digest; adds rawDigestOf for raw-exact (M21) assertions.
MutationPopulationEvolutionProofTest.kt	Adds T1/T2/T8 verifier-level discriminators for the authority projection.
MutationPopulationAdmissionCeremonyTest.kt	Adds ceremony-level T1; updates the M34 negative test's expected diagnostic substring.
MutationRatchetAuthorityTest.kt	Retains base admissions in the self-ratchet fixture to fix a pre-existing M37 false failure.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.