Add privacy-preserving model-specific Commons

CHANGELOG.md

@@ -6,6 +6,10 @@ All notable changes to MARGINAL are documented here. The project follows Semanti
 
 ### Added
 
+- optional model-specific Commons modes: Local Only by default, bounded Read-Only pack refresh, and
+  explicit Contributor upload through a recursively closed aggregate schema;
+- owner-only durable outbox retry, exact reviewed public-model attribution, verified cache fallback,
+  and synthetic lifecycle-to-aggregate-to-next-session acceptance coverage.
 - a Claude Code plugin labeled **Observe**: it records normalized tool-call evidence and
   repeated-work recommendations in a local Decision Ledger, declares no control capability, and never
   blocks a tool call or returns hook output;
@@ -21,6 +25,14 @@ All notable changes to MARGINAL are documented here. The project follows Semanti
 - `marginal install claude-code`, `marginal install opencode`, `marginal install privacycode`, and
   their `uninstall` counterparts.
 
+### Security
+
+- Commons priors remain outside all local trust, promotion, Autopilot, and Tool Enforcement inputs;
+- shared envelopes exclude prompts, source, commands, outputs, repository data, local hashes,
+  timestamps, free text, credentials, and persistent contributor identity;
+- Commons network and shared-state failures fail open; production contribution remains blocked on
+  verified Wrangler authentication and a dedicated least-privilege GitHub service credential.
+
 ### Changed
 
 - the authenticated loopback session transport moved from `marginal.integrations.codex.transport` to

MANIFEST.in

@@ -8,6 +8,7 @@ recursive-include .github *.yml *.md
 
 include ROADMAP.md
 recursive-include schemas *.json
+recursive-include contracts *.json
 recursive-include demos *.md *.json *.html *.svg *.jsonl
 
 recursive-include assets *.png

PRIVACY.md

@@ -2,8 +2,9 @@
 
 **Effective date:** 2026-08-13
 
-MARGINAL is local-first open-source software. The Codex plugin makes no network request and does
-not operate a SignalLayer Labs telemetry service.
+MARGINAL is local-first open-source software. Commons is `local_only` by default for new and
+existing Codex plugin installations, so the plugin makes no Commons network request unless the user
+explicitly selects `read_only` or `contributor`.
 
 ## Data processed locally
 
@@ -19,13 +20,28 @@ until the user deletes it or runs an explicit purge.
 
 ## Sharing and remote processing
 
-MARGINAL does not transmit plugin evidence to SignalLayer Labs. GitHub, Codex, package registries,
-and any model provider remain governed by their own policies. Exporting a ledger or attaching files
-to an issue is an explicit user action; inspect exports before sharing them.
+`read_only` downloads a bounded, verified aggregate pack. `contributor` also sends a recursively
+closed envelope containing an exact reviewed public-model namespace and bounded aggregate counts.
+It excludes prompts, source, commands, outputs, paths, repository data, local hashes, timestamps,
+free text, credentials, and persistent client or contributor identity. A one-time random retry
+token is carried only in the `Idempotency-Key` HTTP header and is not part of the envelope or pack.
+
+Contributor transport uses Cloudflare infrastructure. Cloudflare's handling of transport metadata,
+including source IP addresses, is outside MARGINAL's application-level guarantees; MARGINAL makes
+no anonymity claim. The application disables Worker observability and invocation logs and does not
+persist request-derived metadata. Production contribution is not active until Wrangler
+authentication and a dedicated least-privilege GitHub service credential are both verified.
+
+Commons aggregates are model-specific priors only. They cannot affect local coverage, trust,
+promotion, Autopilot, Decision Ledger identity, or Tool Enforcement. GitHub, Codex, Cloudflare,
+package registries, and model providers remain governed by their own policies. Exporting a ledger
+or attaching files to an issue is a separate explicit user action; inspect exports before sharing.
 
 ## User controls
 
 - `$marginal` in Codex uses the bundled native control plane to show status or demote.
+- `marginal install codex --commons-mode local_only|read_only|contributor` records an explicit
+  Commons network posture when the optional Python package is installed.
 - `codex plugin remove marginal@marginal` removes the plugin and preserves evidence.
 - the optional Python package command `marginal uninstall codex --purge-data --yes` removes plugin
   data explicitly.

README.md

@@ -68,6 +68,27 @@ marginal install codex --autopilot-consent
 4. **Intervene narrowly** — only exact eligible actions can be denied under the proven no-progress condition.
 5. **Recover** — immediate retry is allowed; drift, unknown outcomes or failures demote authority and fail open.
 
+### Optional Commons modes
+
+Commons is **Local Only by default** for new and existing installations. An explicit Python
+installer choice can enable one of two network postures:
+
+```bash
+marginal install codex --commons-mode read_only
+marginal install codex --commons-mode contributor
+```
+
+Read-Only downloads a bounded, verified model-specific aggregate pack. Contributor also sends only
+closed-schema aggregate counts for an exact reviewed public model; it sends no prompt, source,
+command, output, repository data, local hash, timestamp, or persistent contributor identity. A
+one-time retry token exists only in an HTTP header. Commons data is a prior only and cannot affect
+local trust, promotion, Autopilot, or Tool Enforcement. Network failures fail open.
+
+Contributor transport uses Cloudflare infrastructure, whose processing of network-layer metadata is
+outside MARGINAL's application boundary. The production contribution endpoint is not active until
+Wrangler authentication and a dedicated least-privilege GitHub service credential are both
+verified. See the [privacy model](docs/operations/privacy.md).
+
 ## Current integrations
 
 | Engine | Capability | Current behavior |
@@ -125,6 +146,8 @@ MARGINAL counts actual avoided actions and recoveries. It does not invent token
 - Integration errors demote enforcement and allow the requested action.
 - `SAFE_TELEMETRY` exports derived pseudonyms and approved measurements, never raw private payloads.
 - `AGGREGATE_EXPORT` publishes only grouped statistics that meet the configured minimum group size.
+- Optional Commons sharing remains Local Only unless the user explicitly selects Read-Only or
+  Contributor; shared Commons priors never grant enforcement authority.
 
 Read the [privacy model](docs/operations/privacy.md) and [governance evidence standard](docs/evaluation/governance-evidence.md).
 

contracts/commons-contract-v1.manifest.json

@@ -0,0 +1,8 @@
+{
+  "schema_version": "1.0",
+  "sha256": {
+    "canonical-model-registry-v1.json": "142a8bc5645141f9c467279d6935663b5b11af03092ce4bd493edd42f3278ea6",
+    "commons-evidence-envelope-v1.json": "7a7601748e94107e5a2ccbf54a376a1d074de48d2f7ddd85dfd2b6b335091277",
+    "commons-pack-v1.json": "2db170ba822cf2dd2052eddd4e3ac84b5a998922201267f0e9fca9bcb06d8305"
+  }
+}

docs/getting-started/quickstart.md

@@ -25,6 +25,20 @@ Remove an integration with its matching uninstall command. See the
 python -m pip install -e ".[dev]"
 ```
 
+For the native Codex plugin, Commons remains Local Only unless you explicitly choose otherwise:
+
+```bash
+marginal install codex                              # local_only; no Commons network calls
+marginal install codex --commons-mode read_only    # verified pack download only
+marginal install codex --commons-mode contributor  # download plus closed aggregate submission
+```
+
+Contributor mode sends no prompt, source, command, output, repository data, local hash, timestamp,
+free text, or persistent identity. Its Cloudflare transport is not an anonymity boundary, and
+Commons priors never affect local Tool Enforcement. Production contribution remains unavailable
+until both Wrangler authentication and a dedicated least-privilege GitHub service credential are
+verified.
+
 ## Shadow first
 
 ```python

docs/integrations/codex.md

@@ -24,6 +24,26 @@ An installed Python package can perform the same native transaction:
 marginal install codex
 ```
 
+## Commons network posture
+
+The plugin defaults to `local_only`, including upgrades of existing installations. The optional
+Python installer records a different posture only when explicitly requested:
+
+```bash
+marginal install codex --commons-mode read_only
+marginal install codex --commons-mode contributor
+```
+
+Read-Only downloads a bounded verified pack. Contributor also queues and submits recursively closed
+aggregate counts for an exact reviewed public model. It sends no prompt, source, command, output,
+path, repository data, local hash, timestamp, free text, credential, or persistent identity. The
+one-time retry token remains an HTTP header and queued local metadata, never shared evidence.
+
+Commons priors are diagnostics only and cannot enable Tool Enforcement. All shared failures fail
+open. Contributor transport depends on Cloudflare network infrastructure, so MARGINAL does not make
+an anonymity claim. Production contribution is blocked until Wrangler authentication and a
+dedicated least-privilege GitHub Commons write credential are both verified.
+
 ## Remove
 
 ```bash

docs/operations/privacy.md

@@ -189,3 +189,30 @@ explicitly allowlists them.
 
 Use `load_schema("safe-telemetry-v1.json")` and
 `load_schema("aggregate-export-v1.json")` to validate shareable outputs from an installed wheel.
+
+## Optional Commons sharing
+
+Commons has three persistent modes, independent of Shadow or Enforce Mode:
+
+- `local_only` is the default for new and existing installations and performs zero Commons network
+  calls;
+- `read_only` downloads only a bounded, digest-verified, model-specific aggregate pack;
+- `contributor` also submits verified local aggregate counts through a recursively closed envelope.
+
+The envelope contains only schema version `1.0`, one exact namespace from the reviewed public-model
+registry, and closed aggregate atoms. It contains no prompt, source, command, output, path,
+repository data, local pseudonym or hash, timestamp, free text, credential, or persistent identity.
+The one-time random retry token is an `Idempotency-Key` header only; it is not written into the
+envelope, response, Commons aggregate, or pack.
+
+Contributor transport crosses Cloudflare infrastructure. Network-layer metadata processing by
+Cloudflare, including source IP addresses, is outside MARGINAL's application boundary, so this is
+not an anonymity guarantee. Worker observability and invocation logs are disabled at the
+application configuration boundary, and request-derived metadata is not persisted by the service.
+Production contribution remains inactive until Wrangler authentication and a dedicated
+least-privilege GitHub Commons write credential are both verified.
+
+Every Commons lifecycle state is a prior only. Candidate, supported, validated, and promoted shared
+aggregates have zero authority over local coverage, trust, promotion, Autopilot, or Tool
+Enforcement. Network, schema, filesystem, DNS, TLS, GitHub, and Cloudflare failures fail open and do
+not change local enforcement state.

docs/product/architecture.md

@@ -74,3 +74,22 @@ protection.
 
 Keys remain local and are not part of a trace transaction. Losing a key prevents future stable
 correlation but does not make existing pseudonyms anonymous.
+
+## Commons boundary
+
+The optional Commons loop is separate from the authority path:
+
+```text
+verified local finalization → closed aggregate compiler → owner-only outbox
+    → Ingress-compatible boundary → aggregate-only Commons pack → same-model prior
+```
+
+`local_only` is the default and performs no Commons network calls. `read_only` downloads a bounded,
+digest-verified pack. `contributor` additionally submits only closed atoms for an exact reviewed
+public-model namespace. It carries a one-time retry token in an HTTP header and no persistent
+client identity. Cloudflare remains an external network processor; the application cannot promise
+anonymity at that layer.
+
+Downloaded priors enter a separate read-only diagnostic path. They are not inputs to coverage,
+trust, promotion, Autopilot, Decision Ledger hashes, or enforcement eligibility, and local evidence
+takes precedence. Shared failures fail open without changing the local mode.