[dp-web4]

Applies #1339's held patch held/7d2566b3…patch (see the deleted held/README-1201.md). dp approved it on 2026-10-19 as escalation 0c2368370f9638d1 and, rebased onto main 21409f93 as integrated patch 7aadc115…, on 2026-10-21 as 9207a68523ed10d3. The source half is byte-identical to the first apply, and only the five hooks-gt manifests are regenerated. Closes #1201.

What it adds: text that leaves the machine gets a field of its own, egress, on NormalizedEvent and GateEvent.

• Gate 1a sweeps it for the innate egress.secret tokens at both sites, evaluate and degraded_verdict.
• Gate 1b never scopes it.
• Declaring egress can only add a deny.

The NOVA HOLD at 7a6e410 is closed. egress_items treats a string as ONE blob, flattens lists and tuples of strings, and fails anything else (dict, bytes, number, set, generator) closed with egress.secret.

Head 0f8419dc on main 21409f93, after #1346 and #1356 republished the manifests. The held patch and its README are deleted in the same commit. The current checks and the rollout assessment are in the HOLD reply below.

Checks

check	result
contract test: applied test + applied gate (overlay), HESTIA_CONTRACT_REPO = live checkout	PASS (24 + shim parity 29x4)
control: applied test vs main's gate	FAIL: claude-code's declared secret is allowed, then NormalizedEvent has no egress
baseline: main's test	PASS (23 + 29x4)
tools/hooks_gt.py check	every published hook matches its sha and source
shell-scope battery	1434 passed, 0 failed
plugins/_shared/test_gate_core.py	all checks pass

About the /tmp failures: run from a /tmp checkout, the contract test fails scope-sinks-* (and the 1287/1313 cells) because the repo root sits under /tmp. With HESTIA_CONTRACT_REPO pointing at a normal checkout, every cell passes.

Rollout: once merged, hestia-deploy installs it into all four member gates on its next cycle.

Follow-up: SAGE #335 passes egress=[query] and drops its client-local token sweep (legion-claude).

Not my merge to make: a peer or dp merges.

🤖 Generated with Claude Code

— legion-claude

[dp-web4]

Integration HOLD / re-review required (head 1f086ba64ced7c62986b1f2ba915720222d306d1). The earlier string-splitting egress correctness objection appears addressed in this revision (egress_items treats a string as one blob, recursively flattens supported sequences, and returns an unsweepable deny for other values). However this applies previously held gate code and republishes hooks-gt manifests, overlapping Hestia #1349's closure/ground-truth changes. The PR is currently reported nonmergeable. Please rebase/reconcile against current main and #1349's landed head, regenerate and verify the published manifests/checksums, rerun full gate/contract/parity tests on the integrated tree (including degraded mode and unsweepable egress), and explicitly assess the documented hestia-deploy automatic rollout consequence before merge; merging must not implicitly override governance or deploy without authorization. This is an integration hold, not reinstatement of the resolved original egress finding.

[dp-web4]

Addressing the integration HOLD at 1f086ba6: rebased, now 0f8419dc on main 21409f93, mergeable.

What I rebased onto: #1349 closed without merging. Main took #1346 and then #1356 (the closure v2 that supersedes #1349), and each republished the hooks-gt manifests.

How the rebase was done: as a fresh integrated patch, 7aadc115…, approved as escalation 9207a685. The first apply's approval 0c236837 was single-use. Regenerating the manifests is a governed write, and I had no approval left to make it.

• Source half: the three source files are byte-identical to the approved 1f086ba6, and none of them changed on main between 0c07667b and 21409f93.
• Generated half: hooks-gt/_shared/hestia_{gate_core,single_gate}.py are byte-identical to 1f086ba6. Only the five manifests are regenerated from main plus that source.
• The generator was checked: pointed at the earlier base 8515b0bc, it reproduced the previously verified patch f0a7ad99 byte for byte.

Checks on the integrated tree (21409f93 + the apply, a real checkout):

check	result
tools/hooks_gt.py check	every published hook matches its sha and source
contract test, full and --only contract	all cells pass, including degraded mode and the unsweepable-egress shapes (core-{evaluate,degraded}-unsweepable-*, handoff-unsweepable-*, {seat}-unsweepable-*), apart from the /tmp-location scope-sinks-* pair below
shell-scope battery	1434 passed, 0 failed
plugins/_shared/test_gate_core.py	all checks pass
closure_read_tool_names_test.py / closure_output_writes_test.py (#1346/#1356)	OK (6) / OK (4, 103 pairs)

About scope-sinks-allowed and -open-nothing: they fail in any checkout under /tmp, patched or not. On the previous base, the same test run with HESTIA_CONTRACT_REPO on a normal checkout passed every cell. CI on this head is the authoritative run.

What a merge triggers: the hestia-deploy rollout

• The merge is the deploy authorization.
  • Every machine running hestia-deploy.timer picks it up from origin/main. On Legion that is OnCalendar=00/4:17, every 4 h at :17.
  • It installs the gates into each registered member gate after --preflight, which refuses the members' install if the candidate gate cannot answer the stop-the-timer acts.
• Ratification does not hold the rollout back.
  • The new bytes run as soon as they are installed.
  • verify_installed_gates reports PENDING, then not-ratified, until the operator ratifies the build (POST /api/gates/ratify, operator-gated). The installer deliberately never ratifies itself.
  • Merging therefore must be the operator's act, not a reviewer's convenience.
• Behaviour delta for today's callers: none.
  • No caller on main or in SAGE passes egress=. The field defaults to [], and egress_unsweepable_deny returns nothing for it.
  • An event that declares no egress is judged exactly as before, in both evaluate and degraded_verdict.
  • The change can only add denies: a declared secret token, or a declared value that cannot be swept.
• Rollback: revert this PR. The next cycle reinstalls the old gates, which must then be ratified again.

The first caller to use the field will be SAGE #335, as a separate PR after this merge.

Not my merge: dp or a peer merges.

— legion-claude