Merge pull request #131 from living-ip/codex/leo-v3-document-canary-proof-20260713

Retain live V3 document proposal proof

docs/reports/leo-working-state-20260709/leo-v3-document-source-lifecycle-current.json

@@ -0,0 +1,95 @@
+{
+  "artifact": "leo_v3_document_source_lifecycle",
+  "schema": "livingip.leoV3DocumentSourceLifecycleProof.v1",
+  "generated_at": "2026-07-13T20:20:14Z",
+  "verdict": "pass_at_pending_review_tier",
+  "required_runtime_tier": "vps_production_pending_review",
+  "current_runtime_tier": "vps_production_pending_review",
+  "source": {
+    "title": "LivingIP KB Agent Identity Architecture v3",
+    "artifact_sha256": "59d596e70d26fbc491b4de3228251c308eb9c83cb86ea2dccc9b3342801c5be7",
+    "extracted_text_sha256": "59d596e70d26fbc491b4de3228251c308eb9c83cb86ea2dccc9b3342801c5be7",
+    "identity": "document:sha256:59d596e70d26fbc491b4de3228251c308eb9c83cb86ea2dccc9b3342801c5be7",
+    "source_type": "other"
+  },
+  "deployed": {
+    "git_commit": "1a9c08c1a0f7a886ed9fdccb2b6912a8c55af100",
+    "gateway_active": true,
+    "gateway_nrestarts": 0,
+    "delivery_prs": [127, 128, 129, 130]
+  },
+  "repairs_proved_by_the_live_document": [
+    {
+      "failure": "model-copied evidence text was not an exact source substring",
+      "repair": "the model selects source references and the compiler restores original text"
+    },
+    {
+      "failure": "sparse physical line numbering allowed the model to infer a blank-line identifier",
+      "repair": "selectable non-empty source fragments use dense identifiers"
+    },
+    {
+      "failure": "the first strict packet planned a literal Markdown quote as canonical claim text",
+      "repair": "the compiler preserves the atomic proposition as claim text and the quote as evidence"
+    }
+  ],
+  "verification": {
+    "full_test_suite": "1155 passed",
+    "focused_source_compiler_bridge_suite": "62 passed",
+    "extractor_version": "2",
+    "selectable_source_fragments": 972,
+    "exact_quote_binding_count": 12,
+    "all_quote_bindings_are_exact_source_substrings": true,
+    "compiler_validated": true,
+    "preparation_database_write_performed": false,
+    "preparation_canonical_apply_performed": false,
+    "proposal_replay_created_new_row": false
+  },
+  "database": {
+    "baseline_before_source_lifecycle": {
+      "claims": 1837,
+      "sources": 4145,
+      "claim_evidence": 4670,
+      "claim_edges": 4916,
+      "kb_proposals": 27
+    },
+    "final": {
+      "claims": 1837,
+      "sources": 4145,
+      "claim_evidence": 4670,
+      "claim_edges": 4916,
+      "kb_proposals": 29
+    },
+    "canonical_counts_unchanged": true,
+    "final_proposal_status_counts": {
+      "applied": 2,
+      "approved": 3,
+      "canceled": 8,
+      "pending_review": 16
+    }
+  },
+  "corrected_proposal": {
+    "id": "10bc0719-1c2b-5f42-a41e-86e6478692cb",
+    "status": "pending_review",
+    "applied_at": null,
+    "review_required": true,
+    "canonical_candidate_count": 8,
+    "potential_existing_claim_ids": [],
+    "claim_texts": [
+      "Identity selections that pin exact immutable item versions and never follow supersession prevent silent identity drift because staleness becomes visible and requires explicit protected reselection",
+      "Computing effective risk level from explicit bounded dependency paths rather than proposer declarations prevents governance cost manipulation because the validator independently determines which changes require protected review based on actual impact flags",
+      "Retaining legacy knowledge in a visible separate tier with selective promotion through normal review preserves corpus breadth without pretending incompatible old rows satisfy modern admission requirements"
+    ]
+  },
+  "superseded_proposal": {
+    "id": "a9eb4158-5aa2-5484-b5a7-3d249588b3ec",
+    "status": "canceled",
+    "applied_at": null,
+    "reason": "The live canary exposed non-atomic planned claim text; the corrected proposal supersedes it."
+  },
+  "not_shipped": {
+    "review_approval": "not performed",
+    "canonical_apply": "not performed",
+    "telegram_visible_proof": "waiting for the connected Chrome Telegram tab to be authenticated",
+    "gcp_replay": "outside this proof artifact"
+  }
+}

docs/reports/leo-working-state-20260709/leo-v3-document-source-lifecycle-current.md

@@ -0,0 +1,46 @@
+# V3 document to reviewable knowledge: live VPS result
+
+## Outcome
+
+Leo can now take the supplied V3 architecture document on the production VPS,
+compare it with current canonical claims, extract grounded atomic propositions,
+bind every claim and evidence item to exact source text, and stage one
+idempotent proposal for human review.
+
+The corrected proposal is
+`10bc0719-1c2b-5f42-a41e-86e6478692cb`. It is `pending_review`; `applied_at` is
+null. No canonical row was approved or applied.
+
+## What the real document exposed and fixed
+
+1. Asking a model to reproduce a quote was not reliable enough. Leo now asks
+   for deterministic source-fragment IDs and restores the original text itself.
+2. Physical line numbers contained gaps at blank Markdown lines. Selectable
+   fragments now have dense IDs, so a valid in-range ID always resolves to
+   non-empty source text.
+3. The first strict proposal retained the atomic proposition only in metadata
+   and planned the literal Markdown quote as claim text. The compiler now
+   enforces the atomic proposition as the proposed claim and keeps the exact
+   source wording as hash-bound evidence.
+
+The flawed pending proposal `a9eb4158-5aa2-5484-b5a7-3d249588b3ec` was canceled
+before review or apply, with an audit note pointing to the corrected proposal.
+
+## Proof
+
+- Production deploy: `1a9c08c1a0f7a886ed9fdccb2b6912a8c55af100`.
+- Tests: 1,155 full-suite passes; 62 focused source/compiler/bridge passes.
+- Source hash and extracted-text hash both match
+  `59d596e70d26fbc491b4de3228251c308eb9c83cb86ea2dccc9b3342801c5be7`.
+- Twelve claim/evidence bindings were checked as exact source substrings.
+- Canonical counts stayed at 1,837 claims, 4,145 sources, 4,670 evidence rows,
+  and 4,916 edges.
+- Exact proposal replay created zero additional rows.
+- Gateway remained active with zero automatic restarts.
+
+## Current boundary
+
+This proves the document-to-`pending_review` VPS lifecycle. It does not prove
+review approval, canonical apply, Telegram-visible behavior, or GCP replay. The
+Telegram test must be sent through the connected authenticated Chrome instance;
+that tab currently presents Telegram's QR login.