[bitmaster162]

Current target and exact revision — reviewed integration scope

A4 → A3, targeting protected master after #213 merged. The owner has explicitly approved APPROVE_CONTINUITYOS_PR214_REVIEW_NOTE_READY_AND_NORMAL_MERGE_ONLY for the pinned revision below: update this description, change Draft to Ready, then perform one ordinary merge commit only after a fresh successful base/head/tree/scope/CI/protection preflight. This authorization is not itself a claim that those operations have completed; the live PR state and post-operation readback determine completion. Deployment, release, runtime activation and production admission remain unauthorized.

• Base branch: master.
• Pinned BASE SHA: 79d5fc783cf6c735067f26bdfad3ea0e396dd3e8.
• BASE TREE: 12f878b06bef3435226ce51436a37d8a876f2dda.
• Head branch: agent/person-a3-publication-result-local-r1.
• Current HEAD: c7d1d8ec2183b082e17c47f99e42360a600d1aad.
• Current HEAD TREE: de6a73eceea53ec2e864bf1254a7de0ef7d129b6.
• Expected ordinary merge result TREE: de6a73eceea53ec2e864bf1254a7de0ef7d129b6.
• Expected merge parents, in order: pinned BASE 79d5fc783cf6c735067f26bdfad3ea0e396dd3e8, then HEAD c7d1d8ec2183b082e17c47f99e42360a600d1aad.
• Update commit parents, in order: original A3 HEAD 34d02e44104146beba7b174a88d58270606891fd, then pinned master 79d5fc783cf6c735067f26bdfad3ea0e396dd3e8.
• 3 commits against pinned master; ahead=3 / behind=0. Exactly 6 files: 4 modified + 2 added, +652 / -3.

The two original corrective commits remain unchanged: A4 fe04df409f86bc773d7210dbfaefa620afc3a231 (tree 8b52fb2e3986e2c159cbcf38e0e56497e0369b4a) → A3 34d02e44104146beba7b174a88d58270606891fd (tree 41f31d9ce16693b47c392c31d1f4b845cc6b0f2e). Their original prerequisite was #213 HEAD b11af1a69957e77accc0a6d74dedb7c4dab8ee28, and the old base branch was agent/person-export-actor-deny-local-r1. Those identifiers describe historical publication, not the current PR target.

The extra commit is the ordinary, history-preserving branch update, not a new code fix. Its delta against the original A3 HEAD is only the four already-integrated Company Twin demo files (+763/-0). No additional source edits, rebase, force-push, workflow changes or new corrective commits were made. Only this feature branch was pushed during that update; protected master and other branch heads were preserved.

A4 — enforce the saved admission-to-memory-row binding

Reproduced predecessor behavior

A synthetic admission was persisted for mem:3. A distinct CURRENT row mem:4 with identical text, namespace and acceptable metadata could be selected by the intent. The real R21H path then produced ALLOW and sent mem:4 to a recording model client. Different text, different namespace, superseded metadata and missing-row controls were already denied.

This was a source-identity guarantee violation, not proof of cross-tenant disclosure or a live-model exploit.

Correction

• PersonTwinAdmissionStore.read_current_memory_binding_bytes() reads one verified persisted CURRENT snapshot. It receives no request/intent row id and does not manufacture admission from caller pins.
• Existing Person R21H compares exact canonical binding bytes with the intended row, namespace, candidate/source identities, and CURRENT pointer/candidate commitments, after R4 validation and before the selected Memory row is read.
• Missing, malformed, unavailable or mismatching binding is DENY; there is no legacy fallback. The same _read path is used for preparation and final prompt revalidation.
• Integration-contract change: an admission-store used by Person R21H must now provide this saved-binding read method. A plain R4-only store remains valid for R4 but is insufficient for the protected R21H path. Test fixtures bind their seeded row once, before creating intent/provider inputs.
• No new database/schema/authority issuer, no replacement Twin runtime, and no change to R3/R4 or the public R21H receipt schema.

A3 — distinguish an attempted publication from an acknowledged COMMIT

Reproduced predecessor behavior

An injected denial immediately before promotion COMMIT returned HOLD with an allocated publication_id, although no publication row existed. Candidate staging could already be committed. A failed post-COMMIT readback, conversely, could legitimately leave a persisted publication while returning HOLD.

Correction

Only _result changes in the A3 runtime delta (one line replaced by two):

• New attempt_publication_id retains the allocated attempt id, including uncertain outcomes, for later reconciliation.
• publication_id is emitted only when promotion COMMIT was acknowledged as CONFIRMED; otherwise it is null.
• A confirmed COMMIT followed by failed readback remains HOLD with its publication id retained. Unknown COMMIT retains only the attempt id. No automatic retry or invented rollback is introduced.
• Existing staging/promotion state fields, effect ceilings, transactions, guards, rollback handling, stored receipts, SQL schema and A4 binding behavior are unchanged.

Consumer-contract change: strict consumers of the outer admit() result must account for the additional field. A non-null publication_id is not fresh CURRENT, consent, READ authority, or production signoff. Consumers must inspect status, commit_state, the receipt and applicable fresh authorization rather than infer permission from a non-null ID.

Exact file scope against pinned master

• continuityos/person_twin_admission_store.py: modified, +22/-2; saved-binding read port and publication-result clarification.
• continuityos/person_twin_r21h_evidence.py: modified, +37/-0; mandatory binding verification in the existing adapter.
• docs/PERSON_ADMISSION_PUBLICATION_RESULT_A3_R1.md: added, +94/-0; attempted/confirmed publication contract and outcome matrix.
• docs/PERSON_R21H_MEMORY_BINDING_A4_R1.md: added, +82/-0; A4 contract, checks and limitations.
• tests/test_person_twin_admission_store.py: modified, +401/-0; A4 and A3 regressions; old test bodies retained.
• tests/test_person_twin_r21h_evidence.py: modified, +16/-1; seeded binding support in the existing synthetic fixture; prior test bodies retained.

Historical local evidence — original corrective revision, not a new local run

The following results belong to the original A4/A3 revision and are not relabelled as local tests of the new merge HEAD. Windows / Python 3.11.9, synthetic temporary SQLite databases and recording model clients only:

Evidence	Observed result
Eleven-file regression	423 passed, 2 skipped, 0 failed
New A4 targeted cases	31 passed (included in extended regression, not additive)
New A3 targeted cases	19 passed (included in extended regression, not additive)
Original unchanged A3/A4/backup-revoke-restore acceptance bodies	12 passed, 0 failed
Source CLI cos demo person-continuity --json	COS_DEMO_PERSON_CONTINUITY_PASS
Deterministic A4 scope audit	21 checks passed
Deterministic A3 scope audit	17 checks passed; 36 pure-result combinations checked

The two skips concern real filesystem symlink creation unavailable to that Windows process. They are not PASS. Backup → revoke → restore still denies READ before model generation with a current external revocation ledger; a deliberately stale ledger remains a trusted-input limitation, not a newly solved native witness problem. No cross-machine or authenticated-principal qualification is claimed.

Historical failed attempts are preserved: the first A4 candidate unnecessarily added a receipt field incompatible with the exact demo validator; the field was removed rather than relaxing validation. A separate A3 audit runner initially omitted SCHEMA; the runner was corrected outside product source and passed on the same runtime bytes. Original red reproductions remain separate from later green runs.

Original publication preflight rechecked the clean branch, exact two-commit chain/scope, 728/728 tracked files against git archive, all 19 members of the sealed A3 manifest, and the bundle. Original A3 manifest SHA-256: a9260da827138bd08f467d7fed7b1b8d657d5344fbf4ff3137be6fd3f073e2fa. Original two-commit bundle SHA-256: 00307649e2e255394a7957c5b72e6601243871000f436fa00a054bdb1bdd0b0d; its prerequisite is the original #213 HEAD. These original artifacts were not rewritten by this update. Unsigned commit hashes are not owner-identity attestations.

Current exact-HEAD CI — 5/5 SUCCESS

All five registered checks on exact HEAD c7d1d8ec2183b082e17c47f99e42360a600d1aad completed successfully. Times below are UTC on 2026-10-20:

Check	Conclusion	Completed at
Ubuntu / Python 3.11	SUCCESS	19:45:15
Windows / Python 3.11	SUCCESS	20:03:31
Analyze Python	SUCCESS	19:43:23
CodeQL	SUCCESS	19:43:16
offline-shadow-continuity	SUCCESS	19:42:39

Automatically triggered workflows, all completed with SUCCESS on attempt 1:

• review-gates #39485743052: Ubuntu and Windows qualification.
• CodeQL #39485743467: Analyze Python and the associated CodeQL check.
• P0 #39485743047: offline-shadow-continuity.

Both review-job logs record checkout of refs/pull/214/merge at synthetic commit 9f770fb1b5d7b92518d71c35f6430d80cc69fb3f. Its parents are pinned master 79d5fc783cf6c735067f26bdfad3ea0e396dd3e8 and current HEAD c7d1d8ec2183b082e17c47f99e42360a600d1aad; its verified TREE is de6a73eceea53ec2e864bf1254a7de0ef7d129b6, identical to the current HEAD TREE. This synthetic CI commit is not a merge of PR #214 into master.

Linux clean-source/editable: 2665 passed / 69 skipped each; isolated wheel: 2582 passed / 120 skipped. Windows clean-source/editable: 2675 passed / 59 skipped each; isolated wheel: 2585 passed / 117 skipped. Each mode also recorded 870 passing subtests. Skips are not passes, and overlapping test modes must not be added as unique coverage.

Historical Ubuntu/Windows success on original 34d02e44... is separate evidence, not reused as qualification of the updated HEAD. No manual dispatch or rerun was requested.

Independent model source review — Opus 5.5 High R2

The owner accepted the completed R2 source review for integration of this exact narrow A4/A3 patch: overall PASS WITH CONDITIONS; A4 PASS WITH CONDITIONS; A3 PASS WITH CONDITIONS; no blocking code defect reported within the reviewed scope. This is a separate model source review, not a new test run, a formal GitHub reviewer identity attestation, or proof of whole-system security.

• Report SHA-256: 14e54a0c30403972b44afd9bb4069b4ea02c7af63721000055e45fdfabc68edc.
• Reported model: claude-opus-5-5-high; requested effort: high.
• R2 conversation: 5e2b677c-d97e-4d0e-a271-8fbe7ad0b6e0; completed 2026-10-20T20:37:33.259780+00:00; CLI exit 0 / SUCCESS.
• R2 packet SHA-256: 248b6c52fa17241f420ca93372e318fa76d49dbb1691039d52220d5d10f0f4c5; end marker PR214_END_13154216e88edbfa9ec3 reproduced in the response.
• Scope: full changed runtime modules and the complete six-file diff, with selected R3/R4 functions and bounded callsite evidence. Some unchanged test bodies, helper definitions and full demo/runtime sources were not included; their absence was explicitly disclosed. The model invoked no tools and ran no tests.
• The first oversized/truncated request and incomplete output were retained separately and are not counted as a completed review. R2 requalified transport completeness; it did not replace an adverse verdict.

The reviewer supports the saved-row binding check and attempted/confirmed publication separation in the stated trusted-host model. A host source inspection additionally found the visible demo uses the durable store and inspects status/commit_state/receipt; that limited inspection is separate from the model report and is not a new test run.

Accepted compatibility conditions and retained nonblocking observations

• R21H integrations must implement the saved-binding reader; a minimal R4-only store intentionally fails closed in this path.
• Strict consumers of the outer admit() dictionary must accept attempt_publication_id and the narrowed publication_id semantics. A HOLD can retain a confirmed publication ID after failed readback; no authority follows from that ID alone.
• Dynamic and external consumer compatibility is unproven. Repository text searches do not establish its absence or safety.
• Test gaps and observations remain recorded: unchanged old tests were not fully reviewed by the model, real concurrent SQLite republication was not exercised by the model, some wrong-row tests now reject earlier at binding mismatch, and the read-only-snapshot docstring does not mean the method can only be called on a reader instance. No additional code or test change is implied by accepting this review.
• Database identity across admission/runtime stores, ABA/A6, receipt origin/A5, external revocation-ledger freshness, malicious trusted-host objects, H3/C0 and model egress remain separate requirements. Neither CI nor this merge automatically closes them.

Historical status of the A3_R1/A4_R1 documents

The owner explicitly accepts docs/PERSON_ADMISSION_PUBLICATION_RESULT_A3_R1.md and docs/PERSON_R21H_MEMORY_BINDING_A4_R1.md as historical records of their individual local corrective stages. Their older parent/base SHAs, local-stage restrictions and the A4-stage statement that A3 remains red describe those earlier stages, not the current combined A4+A3 PR. Current pinned source, CI and review evidence are identified in this description. Both document files remain byte-identical to the reviewed HEAD; no evidence manifests or historical records were rewritten. The review's documentation observation is retained, not silently removed or claimed fixed in source.

Authorization boundary and post-merge verification

The accepted token permits this description update, Ready transition and one ordinary merge commit of the exact HEAD into the pinned BASE after a fresh passing preflight. Any base/head/tree/scope/CI/protection drift requires STOP. No squash, rebase, force-push, new feature-branch commit, additional source edit, protection bypass, auto-merge or branch deletion is authorized. The merge result must have BASE as first parent, HEAD as second, and the exact expected TREE above; post-merge Actions must be read separately from pre-merge CI.

#209/#210/#215 and already merged PRs are outside the mutation scope. Their heads, base-branch settings and metadata must remain unchanged; #215 is not retargeted by this operation. Separate issues and remaining risks are not automatically closed. No deployment, release, installation/runtime switch, Scheduler/TPM/service change, real personal-data ingestion or trading is authorized.

Acceptance of the narrow corrective integration is not blanket closure of every A3/A4-related risk and is not production admission. Nonblocking review observations and all stated trust-boundary limitations remain recorded.

C0 HOLD; T11/T12 UNEXECUTED; NOT_PRODUCTION_ADMITTED; execution_authority=NONE; can_execute=false; can_trade=false; capital_permission=DENY.