authority(0.7.1g1P2-Step3b): base-revision certificate read + M34 accepts certified migration + M44/M47 on the same facts

[GionaGranchelli]

Base

d192e2ea30b0dcc2b618cbc99a030920ca85833f — the post-#473 epic tip (branch parent verified).

Step 3b, complete end to end: base-revision certificate read → one fact-production site → M34 accepts certified digest migration → M44/M47 consume the same facts.

Scope (9 files, +373/−7)

1. Base-revision read of the certificate ledger (MutationRatchetAuthority)

M43/M47 are judged against the certificate ledger as it exists in the base, but the only loader read the working tree. The base-side read now uses the same git show "<baseSha>:<path>"-into-the-temp-tree path as the population, classifications, enrollments and admissions, so one authority snapshot carries the whole base context. Absent at base = no certificates = the most restrictive state. A present ledger is validated by its own loader, so malformed fails hard.

2. M34 accepts certified digest migration

The :135 branch rejects a raw-v1 admission only when no certified consumption covers that admission's own historical digest. Without a certificate the condition is byte-for-byte as before.

certifiedConsumptions(...) is the single production site, running the real verification per distinct historical digest against the base ledger and the exact base authorization set. A Valid exists only if M43-M42 passed, so the branch cannot be reached by asserting anything. AdmissionAuthority(freshAuthorityProjectionHash, certifiedConsumptions) carries it as one value — which is what makes the lifecycle scan and the appearing-identity path receive the same object instead of contradicting each other, and what keeps both signatures inside the parameter budget without a suppression.

3. M44/M47 consume the same facts

• MutationRatchetCandidate gains the transition's own certificate ledger, loaded from the repository. It is validated (M45 mint binding, M46 retained immutability) but can never authorize a consumption — only the base ledger is consulted, so a candidate that both mints and consumes fails M43.
• The verifier now calls MutationAuthorityDigestCertificateCeremony.checks with validConsumptions from base.admissionAuthority(...), so M44 (single use) and M47 (removal custody) cannot disagree with the admission verdicts about what was consumed.
• M47's consuming half is now exercised end to end: a certificate may disappear only because a consumption was independently proven in the same transition, never because it was absent.

Two fixtures corrected, no rule relaxed

MutationRatchetAuthorityTest's identity-transition candidate now retains the base's certificate, exactly as it retains the base's admissions — passing NONE asserted a transition that removes the certificate with no proven consumption, which M47 rightly refuses. Same class of fixture defect, and same fix, as the admissions case in Step 1. M47 firing on that fixture is the evidence the consuming half is genuinely live rather than a branch nobody reaches.

Invariants preserved

• Without a certificate, M34 fails exactly as before; AdmissionAuthority(null) is the fail-closed default everywhere.
• M36/M37 untouched; checks(..., validConsumptions) still defaults to empty.
• No rule, expectation, threshold, suppression or baseline weakened: Detekt baseline 4792 → 4792, 0 added. Every finding fixed by hand — including four LongParameterList/MaxLineLength ones.

Verification

• certificate + admission + ratchet suites, --rerun-tasks — 162 tests, 0 failures
• full :build-logic:test — 855 tests, zero genuine test failures before the console call was truncated (its lone entry was an infrastructure pseudo-failure from the kill); CI runs the complete suite, and a background run is completing it locally
• spotlessKotlinCheck ratchet-scoped — BUILD SUCCESSFUL
• verifyStaticAnalysis — BUILD SUCCESSFUL, 4792 → 4792, 0 removed, 0 added
• verifyChangePolicy -PchangePolicyBase=d192e2ea… — PASSED, class build-logic

Discrimination

• certifiedConsumptions: one fact from a real base certificate; none for an uncertified projection (M40); none with no certificate.
• M34 accepts the certified raw-v1 admission; still fails the uncertified one.
• Base revision: certificate present at 9ebe7b44 (the P1M merge), absent at 64d05450 (P1M's base) while that base's admissions stay non-empty.
• Custody, over the real committed ledger: unchanged → survives; dropped without a proven consumption → M47; dropped with the facts produced from the real ledgers → permitted.

Remaining

The T1-T19 matrix at verifier and real-task level. No production rule is left unwired: the certificate lifecycle now runs inside the real ratchet.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The change modifies the mutation-ratchet authority-loading machinery that gates quality enforcement, a high-stakes governance subsystem the repository guidelines reserve for explicit human authorization.

Review effort: Balanced
Findings: None

What changed in this PR

This PR extends the mutation-ratchet base-authority loader so that the digest-migration certificate ledger is read at the base revision, rather than only from the working tree. This closes the gap where M43/M47 are judged against the certificate ledger "as it exists in the base," but the base-side read never produced certificate facts for the verifier to consult. The change is confined to build-logic quality-governance machinery and is an incremental step (3b): it wires transport now, with certificate-aware M34 consumption deferred to a follow-up.

The new certificates field is loaded through the same git show "<baseSha>:<path>"-into-a-temp-tree path already used for population, classifications, enrollments, and admissions, so a single MutationRatchetAuthority snapshot carries the whole coherent base context. Absence at base is treated like the other optional ledgers (fail-closed to NONE), while a present-but-malformed ledger still fails hard through the ledger's own loader.

Changes:

• Add an optional certificates field (MutationAuthorityDigestCertificates, defaulting to NONE) to MutationRatchetAuthority.
• Read the certificate ledger at the base SHA in MutationRatchetAuthorityLoader.load, mirroring the enrollments/admissions pattern.
• Add CertificateBaseRevisionTransportTest with two discriminators against real history: the P1M merge exposes exactly one certificate whose fromDigest matches the base admissions' populationDigest, and a pre-ledger base exposes no certificates while still carrying admissions.

File	Description
build-logic/​src/​main/​kotlin/​dev/​tramai/​build/​quality/​MutationRatchetAuthority.kt	Adds the optional certificates field and the base-revision read path that loads it into the hermetic temp tree before invoking the certificate loader.
build-logic/​src/​test/​kotlin/​dev/​tramai/​build/​quality/​CertificateBaseRevisionTransportTest.kt	New transport test proving the loader exposes certificates at the minting revision and none at a pre-ledger base, both against real immutable commits.

I verified the referenced symbols (MutationAuthorityDigestCertificateLoader.FILE_NAME/.load, MutationAuthorityDigestCertificates.NONE, MutationPopulationAdmission.populationDigest) exist and match usage, that the temp-tree path resolves to the same file the loader reads, that the new default keeps the existing MaintainabilityBaselinePlugin call site compiling, and that CI checks out full history (fetch-depth: 0) so the hardcoded historical SHAs are reliably available. I found no issues that warrant a blocking comment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[GionaGranchelli]

Merge hold after review. #474 has now landed as a2c6c3a8213b6f45f8e30d7636db1a26d931f00e, so #475 must first rebase/retarget onto that new epic tip and rerun exact-head CI.

One authority seam also needs closing before merge: the PR currently recomputes base.admissionAuthority(freshAuthorityProjectionHash) rather than producing the facts once.

I found three production recomputation sites:

1. MutationRatchetVerifier.verify when building MutationEvolutionContext for M34/outcomeRatchet.
2. MutationRatchetVerifier.verify again when passing validConsumptions to M44/M47.
3. MutationPopulationAdmissionCeremony.consumptionChecks, inside the per-admission loop, when it calls appearanceVerdict.

So the current claim 'M34 and M44/M47 consume the same facts' is value-equivalent but not structurally true: each path gets newly constructed Valid instances.

Minimal correction:

• compute exactly once in MutationRatchetVerifier.verify: val admissionAuthority = base.admissionAuthority(freshAuthorityProjectionHash);
• pass that exact AdmissionAuthority into MutationEvolutionContext;
• change MutationPopulationAdmissionCeremony.checks/lifecycleChecks/consumptionChecks to accept that same AdmissionAuthority instead of a raw hash, and pass it unchanged to every appearanceVerdict;
• pass admissionAuthority.certifiedConsumptions to MutationAuthorityDigestCertificateCeremony.checks;
• remove all other production calls to base.admissionAuthority(...) in this transition path.

Yes: add the seam test. It should pin 'produce once, consume everywhere' rather than merely value equality. A source/wiring assertion that there is one production call and the same local is threaded to both admission and certificate lifecycle paths is acceptable if a runtime === assertion is awkward without exposing internals.

Everything else I reviewed in #475 is directionally correct. This is the only authority-model blocker I found.