document live source staging and rebuild proof (#125)
Some checks are pending
CI / lint-and-test (push) Waiting to run

This commit is contained in:
twentyOne2x 2026-07-13 21:17:06 +02:00 committed by GitHub
parent 5dfcd32c34
commit 6167362396
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
5 changed files with 541 additions and 0 deletions

View file

@ -0,0 +1,179 @@
{
"application_roles_bootstrapped": [
"kb_apply"
],
"artifact": "local_canonical_postgres_rebuild_canary",
"canonical_schema_table_count": 39,
"cleanup": {
"absence_inspection_attempts": 1,
"attempted": true,
"container": "teleo-canonical-rebuild-20260713191212-f940b482e075",
"container_absent": true,
"force_remove_attempted": true,
"force_remove_exit_code": 0,
"status": "pass"
},
"container": {
"id_prefix": "775c664fcf81",
"image": "postgres:16-alpine",
"isolation": {
"image": "postgres:16-alpine",
"label": "teleo-canonical-rebuild-20260713191212-f940b482e075",
"network_mode": "none",
"postgres_data_tmpfs": "rw,nosuid,nodev,noexec,size=1024m",
"running": true
},
"name": "teleo-canonical-rebuild-20260713191212-f940b482e075",
"named_database_psql_attempts": 5,
"named_database_psql_ready": true,
"network_mode_required": "none",
"postgres_data_tmpfs_required": "rw,nosuid,nodev,noexec,size=1024m",
"preexisting_absence_proven": true,
"started": true
},
"database": "teleo",
"dump": {
"bytes": 13463365,
"custom_format_signature_valid": true,
"path": "/private/tmp/working-leo-gcp-refresh-20260713/teleo-canonical.dump",
"sha256": "3fc686ccc423651e86d1f0ad052fa89877215b634a07267a7e26a28e1c2bebe8"
},
"error": null,
"generated_at_utc": "2026-07-13T19:12:12.944754+00:00",
"key_counts": {
"kb_stage.kb_proposals": 27,
"public.claim_edges": 4916,
"public.claim_evidence": 4670,
"public.claims": 1837,
"public.reasoning_tools": 17,
"public.sources": 4145
},
"parity": {
"details": {
"application_role_mismatches": {},
"performance": [
{
"query": "claim_edges_by_claim_id",
"source_ms": 0.038,
"source_ratio": 0.23879999999999998,
"target_ms": 1.194
},
{
"query": "claim_evidence_by_claim_id",
"source_ms": 0.082,
"source_ratio": 0.013600000000000001,
"target_ms": 0.068
},
{
"query": "count_claims",
"source_ms": 0.251,
"source_ratio": 0.0442,
"target_ms": 0.221
},
{
"query": "pending_proposals_latest",
"source_ms": 0.013,
"source_ratio": 0.002,
"target_ms": 0.01
}
],
"performance_problems": [],
"required_extension_mismatches": {},
"source_connection": {
"database_collation": "en_US.utf8",
"database_ctype": "en_US.utf8",
"server_address": null,
"server_port": null,
"ssl": false,
"ssl_version": null
},
"source_database": "teleo",
"source_table_count": 39,
"source_total_rows": 52165,
"structural_hashes": {
"columns": {
"source": "50b502967aa85b88bd204c7b9035de60bf21a6a6973817e8b8121d0cd9faab81",
"target": "50b502967aa85b88bd204c7b9035de60bf21a6a6973817e8b8121d0cd9faab81"
},
"constraints": {
"source": "8b26d26fda56f09325e0603aae48051da08dfc6c35322fa88880acdabb8ad859",
"target": "8b26d26fda56f09325e0603aae48051da08dfc6c35322fa88880acdabb8ad859"
},
"functions": {
"source": "4bddee626b3ab62af236493001d2a09f2d56c084beb7e6c69cd082ce4aba155b",
"target": "4bddee626b3ab62af236493001d2a09f2d56c084beb7e6c69cd082ce4aba155b"
},
"indexes": {
"source": "5c4f7567e9ad0f25da0ab15f650a1005397ae9c727af1ab41e2675c46a5ebce5",
"target": "5c4f7567e9ad0f25da0ab15f650a1005397ae9c727af1ab41e2675c46a5ebce5"
},
"policies": {
"source": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"target": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
},
"schemas": {
"source": "2fdf551b403db2d79813c8fd2869dadfeba261fac2aaa718b355cd7414640979",
"target": "2fdf551b403db2d79813c8fd2869dadfeba261fac2aaa718b355cd7414640979"
},
"sequences": {
"source": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
"target": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945"
},
"triggers": {
"source": "4d5f3394480c8410035dac5457e144c7db80fa0820ff49beb93aa819a7282c64",
"target": "4d5f3394480c8410035dac5457e144c7db80fa0820ff49beb93aa819a7282c64"
},
"types": {
"source": "365e82ac205319d25d14c8b16026978f0e6023ae0c58767f700d7f2ea659b70b",
"target": "365e82ac205319d25d14c8b16026978f0e6023ae0c58767f700d7f2ea659b70b"
},
"views": {
"source": "5c33fa260f25dccffc214f795c66e3dbae89d91d0dbf8a98122ace1dcda46799",
"target": "5c33fa260f25dccffc214f795c66e3dbae89d91d0dbf8a98122ace1dcda46799"
}
},
"table_mismatches": [],
"target_connection": {
"database_collation": "en_US.utf8",
"database_ctype": "en_US.utf8",
"server_address": null,
"server_port": null,
"ssl": false,
"ssl_version": null
},
"target_database": "teleo",
"target_extra_application_roles": [],
"target_table_count": 39,
"target_total_rows": 52165
},
"problems": [],
"requested": true,
"source_manifest": {
"bytes": 164733,
"path": "/tmp/working-leo-gcp-refresh-20260713/source-manifest.jsonl",
"sha256": "cb1281f319f278616921991955b22a3c922e3f06e9b728d1903a5e903c6fe0af"
},
"status": "pass",
"target_manifest": {
"bytes": 164734,
"line_count": 56,
"sha256": "cc8e725464b738635f8a8db3a7ad11e279d7851bd9f8da839bc0dba4a1050d03"
},
"verifier": "ops.verify_postgres_parity_manifest.compare_manifests"
},
"safety": {
"network_access_available_to_container": false,
"persistent_postgres_storage_used": false,
"production_database_touched": false
},
"status": "pass",
"timings_seconds": {
"cleanup": 0.549311,
"container_start_and_named_database_ready": 2.648454,
"dump_validation_and_hash": 0.020994,
"key_count_readback": 1.975135,
"manifest_capture_and_parity_compare": 3.306323,
"pg_restore": 2.970513,
"total": 12.35369
}
}

View file

@ -0,0 +1,162 @@
{
"before_service": {
"ActiveState": "active",
"ExecMainStartTimestamp": "Mon 2026-07-13 19:00:32 UTC",
"MainPID": "2509826",
"NRestarts": "0",
"SubState": "running"
},
"changed_live_profile": false,
"database_context_all_ok": true,
"database_context_injection_count": 1,
"database_context_trace": [
{
"compiled_response_available": true,
"contract_ids": [
"reply_budget",
"source_intake"
],
"contract_sha256": "f7a02f2ca2f714d5673e6c414d006f08e98daecab8786f6ca0913dba89865b75",
"event": "pre_llm_call",
"generated_at_utc": "2026-07-13T19:02:02.875892+00:00",
"injected": true,
"query_sha256": "a7c7f2307c595949eaa90b0ab40c363e56052d672af835b72af1099f5043da52",
"source": "kb_tool.py --local context",
"status": "ok"
},
{
"compiled_response_enforced": true,
"compiled_response_issues": [],
"contract_ids": [
"reply_budget",
"source_intake"
],
"delivered_response_sha256": "26c9aa1f627070bd491be148263a953f071885f3b923484f37609e88fc042728",
"event": "post_llm_call",
"fail_closed": false,
"generated_at_utc": "2026-07-13T19:02:13.610686+00:00",
"issues": [
"missing_live_intake_ceiling"
],
"query_sha256": "a7c7f2307c595949eaa90b0ab40c363e56052d672af835b72af1099f5043da52",
"response_sha256": "f101e8ce421c6129a396e13db2b3b98c8f1a5dcee2c07fcf66014958a2b9fc7e",
"status": "ok",
"transformed": true,
"validated": true
}
],
"database_response_transform_count": 1,
"database_response_validation_all_ok": true,
"database_response_validation_count": 1,
"db_counts_after": {
"kb_stage.kb_proposals": 27,
"public.claim_edges": 4916,
"public.claim_evidence": 4670,
"public.claims": 1837,
"public.sources": 4145
},
"db_counts_before": {
"kb_stage.kb_proposals": 27,
"public.claim_edges": 4916,
"public.claim_evidence": 4670,
"public.claims": 1837,
"public.sources": 4145
},
"db_counts_changed": false,
"generated_at_utc": "2026-07-13T19:01:59.215469+00:00",
"handler": {
"authorized": true,
"session_key": "agent:main:telegram:group:-5146042086:9070919",
"temp_profile": "/tmp/leo-direct-claim-handler-4yd02_g3/profile"
},
"harness_notes": [
"Exact out-of-sample broad source-intake regression after merge 5dfcd32; no Telegram post and no apply authorization.",
"The harness uses a temporary copy of the leoclean profile and does not post to Telegram.",
"This proves handler-level live VPS GatewayRunner behavior, not human-visible Telegram delivery."
],
"mode": "live_vps_gatewayrunner_temp_profile_source_intake_oos_post_repair",
"mutates_kb_by_harness": false,
"pass_runtime": true,
"posted_to_telegram": false,
"remote_report_path": "/tmp/leo-source-intake-oos-post-repair-c82763075ece.json",
"remote_returncode": 0,
"remote_run_id": "c82763075ece",
"results": [
{
"claim_ceiling": "Live VPS GatewayRunner reply from temp leoclean profile; no Telegram post; no production DB apply authorized.",
"database_context_trace": [
{
"compiled_response_available": true,
"contract_ids": [
"reply_budget",
"source_intake"
],
"contract_sha256": "f7a02f2ca2f714d5673e6c414d006f08e98daecab8786f6ca0913dba89865b75",
"event": "pre_llm_call",
"generated_at_utc": "2026-07-13T19:02:02.875892+00:00",
"injected": true,
"query_sha256": "a7c7f2307c595949eaa90b0ab40c363e56052d672af835b72af1099f5043da52",
"source": "kb_tool.py --local context",
"status": "ok"
},
{
"compiled_response_enforced": true,
"compiled_response_issues": [],
"contract_ids": [
"reply_budget",
"source_intake"
],
"delivered_response_sha256": "26c9aa1f627070bd491be148263a953f071885f3b923484f37609e88fc042728",
"event": "post_llm_call",
"fail_closed": false,
"generated_at_utc": "2026-07-13T19:02:13.610686+00:00",
"issues": [
"missing_live_intake_ceiling"
],
"query_sha256": "a7c7f2307c595949eaa90b0ab40c363e56052d672af835b72af1099f5043da52",
"response_sha256": "f101e8ce421c6129a396e13db2b3b98c8f1a5dcee2c07fcf66014958a2b9fc7e",
"status": "ok",
"transformed": true,
"validated": true
}
],
"dimension": "source_composition",
"ended_at_utc": "2026-07-13T19:02:13.717112+00:00",
"evidence_tier": "live_vps_gatewayrunner_temp_profile",
"mutates_kb": false,
"ok": true,
"prompt": "If I send you a report here, can you learn it into your knowledge base and make it part of what you know? What actually happens right now?",
"prompt_id": "SRC-OOS-01",
"reply": "- VPS source-to-proposal staging is shipped for prepared inputs; autonomous chat attachment extraction is not shipped. Sending a report in chat does not by itself create a proposal or persistent knowledge. I can analyze content available in this conversation, but chat attachment capture and extraction are not connected to the staging command.\n\n- The live bounded path is to prepare and retain the artifact, UTF-8 extracted text, extraction manifest, URL or storage_path locator, and content hash, then run teleo-kb propose-source to validate and stage a pending_review proposal. It writes only kb_stage.kb_proposals. A chat label, filename, attachment reference, or source_ref is not provenance. Before review, deduplicate overlaps and retain exact excerpts, source caveats, uncertainty, and contradictory interpretations. Candidates are not canonical until reviewed and applied, and no public.sources or other public.* rows are created during staging.\n\n- Explicit approval begins before guarded canonical public.* apply, not before mechanical capture/staging. Receipt: locator and content hash, proposal ID/status, reviewed payload, applied_at, created row IDs, and postflight readback. Next proof-changing follow-up: prepare the three inputs, run teleo-kb propose-source, then review its typed candidates.",
"started_at_utc": "2026-07-13T19:01:59.966980+00:00",
"turn": 1
}
],
"service_before_after": {
"after": {
"ActiveState": "active",
"ExecMainStartTimestamp": "Mon 2026-07-13 19:00:32 UTC",
"MainPID": "2509826",
"NRestarts": "0",
"SubState": "running"
},
"before": {
"ActiveState": "active",
"ExecMainStartTimestamp": "Mon 2026-07-13 19:00:32 UTC",
"MainPID": "2509826",
"NRestarts": "0",
"SubState": "running"
},
"unchanged_from_preexisting_live_readback": true
},
"source": {
"chat_id": "-5146042086",
"chat_name": "Leo",
"chat_type": "group",
"platform": "telegram",
"user_id": "9070919",
"user_name": "codex handler direct claim"
},
"source_report_path": "docs/reports/leo-working-state-20260709/telegram-handler-source-intake-oos-current.json",
"temp_profile_removed": true
}

View file

@ -0,0 +1,56 @@
{
"artifact": "teleo_kb_source_proposal",
"compiler": {
"bundle_content_sha256": "a9178dce5d135b52df86a8a6d4a42efc8d5445a6a1636759ca2b7fd70bad1a3e",
"path": "/opt/teleo-eval/workspaces/deploy-infra/scripts/compile_kb_source_packet.py",
"sha256": "687402f88e4e99c87a814b7cc94f4ee148304623338e43ff4403682f7dde00f1"
},
"created": true,
"database": {
"after_counts": {
"claim_edges": 4916,
"claim_evidence": 4670,
"claims": 1837,
"kb_proposals": 27,
"sources": 4145
},
"backend": "teleo|postgres",
"before_counts": {
"claim_edges": 4916,
"claim_evidence": 4670,
"claims": 1837,
"kb_proposals": 26,
"sources": 4145
},
"canonical_counts_unchanged": true,
"proposal_count_delta": 1,
"proposal_count_matches_command": true
},
"proposal": {
"applied_at": null,
"created_at": "2026-07-13 18:45:57.524089+00",
"id": "b426019e-7eaa-5a52-be9b-27d771880802",
"payload_sha256": "59105d0e6dbb2aa2e7c3421b1a9ced55fb5c8872dfff8071f0f6fea98402e7c9",
"proposal_type": "approve_claim",
"reviewed_at": null,
"source_ref": "normalized:a12536da-8ef6-5760-a1bc-ed9f291045cb:59105d0e6dbb2aa2",
"status": "pending_review"
},
"receipt_path": "/home/teleo/.hermes/profiles/leoclean/state/kb-source-canary-20260713/propose-source-first.json",
"schema": "livingip.teleoKbSourceProposalReceipt.v1",
"source": {
"artifact_sha256": "a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"extracted_text_sha256": "a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"identity": "document:sha256:a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"locator": "artifact://sha256/a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"manifest_canonical_sha256": "ae62ab27feb5a63e54a239036eacc3f6bffee734b5baf3bc807b484811983487"
},
"status": "pending_review",
"write_contract": {
"canonical_apply_performed": false,
"database_write_performed_by_command": true,
"production_db_apply_ran": false,
"public_table_write_path_present": false,
"target_table": "kb_stage.kb_proposals"
}
}

View file

@ -0,0 +1,56 @@
{
"artifact": "teleo_kb_source_proposal",
"compiler": {
"bundle_content_sha256": "a9178dce5d135b52df86a8a6d4a42efc8d5445a6a1636759ca2b7fd70bad1a3e",
"path": "/opt/teleo-eval/workspaces/deploy-infra/scripts/compile_kb_source_packet.py",
"sha256": "687402f88e4e99c87a814b7cc94f4ee148304623338e43ff4403682f7dde00f1"
},
"created": false,
"database": {
"after_counts": {
"claim_edges": 4916,
"claim_evidence": 4670,
"claims": 1837,
"kb_proposals": 27,
"sources": 4145
},
"backend": "teleo|postgres",
"before_counts": {
"claim_edges": 4916,
"claim_evidence": 4670,
"claims": 1837,
"kb_proposals": 27,
"sources": 4145
},
"canonical_counts_unchanged": true,
"proposal_count_delta": 0,
"proposal_count_matches_command": true
},
"proposal": {
"applied_at": null,
"created_at": "2026-07-13 18:45:57.524089+00",
"id": "b426019e-7eaa-5a52-be9b-27d771880802",
"payload_sha256": "59105d0e6dbb2aa2e7c3421b1a9ced55fb5c8872dfff8071f0f6fea98402e7c9",
"proposal_type": "approve_claim",
"reviewed_at": null,
"source_ref": "normalized:a12536da-8ef6-5760-a1bc-ed9f291045cb:59105d0e6dbb2aa2",
"status": "pending_review"
},
"receipt_path": "/home/teleo/.hermes/profiles/leoclean/state/kb-source-canary-20260713/propose-source-second.json",
"schema": "livingip.teleoKbSourceProposalReceipt.v1",
"source": {
"artifact_sha256": "a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"extracted_text_sha256": "a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"identity": "document:sha256:a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"locator": "artifact://sha256/a6316baf2a6e1d2e2fde1d3b54097fc6fc76dafb268d34859d0e07588bb7480c",
"manifest_canonical_sha256": "ae62ab27feb5a63e54a239036eacc3f6bffee734b5baf3bc807b484811983487"
},
"status": "pending_review",
"write_contract": {
"canonical_apply_performed": false,
"database_write_performed_by_command": false,
"production_db_apply_ran": false,
"public_table_write_path_present": false,
"target_table": "kb_stage.kb_proposals"
}
}

View file

@ -0,0 +1,88 @@
# Working Leo source staging and refresh proof - 2026-07-13
## Outcome
Leo now has a deployed VPS command that converts prepared, hash-bound source
inputs into one reviewable `kb_stage.kb_proposals` row. The command does not
apply the proposal and has no `public.*` write path. Broad report-learning
questions now state the same capability boundary instead of claiming that a
Telegram attachment is automatically extracted and learned.
This proves prepared-input staging and a recoverable current database snapshot.
It does not prove Telegram-visible delivery, automatic chat attachment
extraction, canonical apply, or the refreshed GCP restore/replay.
## Live VPS proof
- Deployed source command: `teleo-kb propose-source` from merged PR #123.
- Deployed answer-boundary repair: merge `5dfcd32c34a8be15a064ff0c51d80fb39d3c9732`
from PR #124.
- First source run created proposal
`b426019e-7eaa-5a52-be9b-27d771880802` with status `pending_review` and
`applied_at = NULL`.
- Counts moved from 26 to 27 proposals while canonical counts stayed at 1,837
claims, 4,145 sources, 4,670 evidence rows, and 4,916 claim edges.
- Exact replay returned the same proposal ID with `created = false` and proposal
delta zero.
- Independent proposal readback showed one claim candidate, two source rows in
the proposed apply payload, two evidence links, exact source hashes, and no
review or apply receipt.
- Both private VPS receipts were mode `0600`.
Raw receipts:
- `vps-source-proposal-first-current.json`
- `vps-source-proposal-idempotent-current.json`
## Broad answer repair
The out-of-sample prompt was:
> If I send you a report here, can you learn it into your knowledge base and
> make it part of what you know? What actually happens right now?
Before the repair, Leo said it would extract and stage the report directly from
chat. That was beyond the shipped capability. After deployment, the live VPS
GatewayRunner selected the `source_intake` contract and enforced an answer that
says:
- sending a report in chat does not itself create a proposal or persistent
knowledge;
- chat attachment capture/extraction is not connected;
- prepared artifact, UTF-8 text, extraction manifest, locator, and hash can be
staged to `kb_stage.kb_proposals`;
- no `public.*` rows are created during staging;
- canonical knowledge still requires review, explicit apply authorization, and
a postflight receipt.
The handler run made no Telegram post, changed no database count, changed no
live profile, preserved the gateway PID/start time, and removed its temporary
profile. See `telegram-handler-source-intake-oos-current.json`.
## Current rebuild proof
A fresh repeatable-read snapshot captured all 39 tables and 52,165 rows from the
VPS after the staging canary. Its custom-format dump SHA-256 is
`3fc686ccc423651e86d1f0ad052fa89877215b634a07267a7e26a28e1c2bebe8`.
The dump rebuilt in an isolated Postgres 16 container with network mode `none`
and tmpfs-only storage. The rebuilt target matched:
- all 39 table row counts and rowset hashes;
- columns, constraints, indexes, functions, views, triggers, types, policies,
schemas, and sequences;
- required `pgcrypto` extension and `kb_apply` role attributes;
- bounded performance checks with no reported problems.
The container was removed and proven absent. See
`gcp-refresh-local-rebuild-current.json`. The private dump remains outside Git
under `/tmp/working-leo-gcp-refresh-20260713/`.
## Remaining live proof
1. Authenticate Telegram Web in the connected Google Chrome profile and run
visible broad-question, memory, identity, and restart canaries.
2. Complete GCP operator reauthentication, converge the reviewed least-privilege
IAP operator, restore this exact snapshot into a generated Cloud SQL target,
verify private/TLS parity, run the no-send model replay, and clean up the
generated target.