Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

ADR-061: Pinned Memory CI policy and separate proof dimensions

Date: 2026-10-13 Status: Accepted Author: Rômulo Febasi

Decision

Memory CI orchestrates the existing deterministic verify --deep and version-two state verify doors using a separately pinned executable and reviewed policy. It compares explicit base/head knowledge snapshots and emits bounded redacted JSON and a Markdown comment preview. It neither repairs source nor automatically posts comments. The policy names basic, strict-local or strict-team and optional additional required invariants/proof surfaces. Required Skip, Partial, missing and Fail deny; the native strict profile cannot be weakened by omitting a required surface.

Read from private bounded snapshot copies, including public retained governance evidence and a consistent disposable SQLite backup. Never recover a pending source transaction in the caller’s workspace. Reject symlinks, private key files, changing input snapshots, interrupted transactions and exceeded budgets. Missing indexes are built only in the private copy; an existing index is checked, never silently repaired. Git metadata is a private local clone pinned to the caller-selected revision, with read-only object sharing. Clear inherited Git repository variables. No network/model download or original workspace mutation is part of the runner.

The policy SHA-256 pins exact reviewed file bytes. Executable SHA-256 pins exact approved bytes, snapshotted before invocation. A digest by itself is not release authenticity; the operator must review its source/release trust. External trust and per-snapshot witness files/key pins remain separately supplied inputs. Workspace files and embedded receipt keys cannot choose their own trust roots.

Findings and coverage

Expose deterministic checks, source/drift, transition range, receipts, identity, trust freshness and witness separately. Base/head git labels, logical projection digests and frozen source-snapshot digests describe exactly what was checked. Limited baseline coverage never becomes proof of pre-baseline history. Basic may pass with explicitly incomplete evidence. Strict-team remains visibly failing until the complete authority/source/receipt/witness flow is integrated.

Current legacy invariant evidence is bounded aggregate text. Compare its fingerprints without exporting text, titles, paths, prompts or identifiers from knowledge contents. A changed aggregate is labelled changed/new evidence, not a fabricated list of individual new facts. Individual scoped semantic diagnostics remain SYN-319. General natural-language correctness, model enrichment and agent attention stay excluded.

Validation and integration

Test partial legacy basic coverage, required skipped receipts, strict missing trust, valid strict-local baseline migration, introduced deterministic contradiction, wrong pins, private-copy source immutability and malformed/oversized/timed-out subprocesses. Run the real pinned binary as well as adversarial runner fixtures. The repository’s existing required test job and native pre-push gate run these Python standard-library tests; no separate paid job or connector is required.

The composite action needs prepared explicit base/head workspaces, approved executable and policy pins. Its permissions remain read-only. The comment preview is an artifact for a caller to review/post under its own explicit permissions, not an automatic publication or a universal green integrity badge.

References