A verdict taught one path or one hash, so the operator's rebuilds were strangers forever

[opencdlee-dotcom]

What this fixes

On the live store, 72 hand verdicts across 45 classes were followed by 109 new incidents in classes the operator had already judged. Tolerance was keyed on process:<path>:<trust>, plus the exact bytes since #51. Every rebuild, new worktree, runner self-update and translocated copy produces a new path and new bytes, so each one arrived as a stranger. The custody ladder already knows more about a binary than where it sits, but none of that reached the layer that learns.

The change (plan step S6, Phase 3)

A benign-positive verdict now also teaches the classes the ladder has verified. One function, _finding_classes(f), spells every class key, and both the memory builder (_class_memory via _incident_classes) and _signal_decision call it:

class	when	width	floor
signer:<team>	publisher_sig(trust) and a 10-char team id	anchored	1
package:<manager>:<name>	custody package-managed + receipt (version dropped)	anchored	1
buildrepo:<repo root>	custody build-output, git said self-committed	content	3
supervisor:<parent sha>	custody supervised	content	3

• _signal_decision checks classes after the exact and content identities. Every existing guard still applies: never CRITICAL, never attack-defined, never above the reviewed severity, never a _NEVER_TOLERATE_PREFIXES fingerprint.
• Disputes: a dispute on any incident in a class revokes the whole class. _disputed_identities adds its class keys.
• Two new refusals, class-specific (my call, not in the brief):
  • Only findings about a binary (process, net-beacon) carry a class. A persistence job signed by team X can run anything X ships, with arguments nobody reviewed.
  • An interpreter or script host carries no class. This covers _INTERPRETERS, versioned names like python3.13, and pwsh/cmd/wscript/java/deno/bun. A signed python or pwsh is whatever script it runs; this is the S3 chain-leg rule applied to the widest join there is.
• Where the facts come from: _class_facts attaches team/authority/package/build_repo/supervisor(_path) at emission, from answers the scan already holds. It runs in check_processes and both _beacon_from_sightings emitters. _supervised_rung is split into _supervising_parent, which returns which parent was vouched. _reobserve attaches the same facts, so the replay can score classes.
• Visibility:
  • incident <id> benign-positive and family … benign-positive print one line per class, e.g. Learned: anything signed by team 8LAYR367YV (Corporation for Digital Scholarship) — wherever it runs (1 verdict, tolerates now) or Learned: build output of <repo> (1 of 3 verdicts).
  • A class crossing its floor is logged as class-tolerance-granted in actions.jsonl.
  • families and family <n> show a would teach: line.
  • false-positive teaches nothing.
• Replay: class memory is the 6th element of _suppression_memory, and the teaching line prints N class(es) taught.
• Merged Thirty verdicts on one binary taught nothing, because tolerance asked where it was #51 (tolerance-follows-bytes) first, with no conflict.

Measured, including what did not move

python3 aegis.py backtest replay --days 30 --reobserve, on the live store, read-only:

	integration (brief)	integration + #51	this PR
process interrupt	24	23	23
noise re-opened	126/213	124/213	124/213
— benign-positive	37/56	35/56	35/56
cases left OPEN	131	130	130
assay recall	9/21	9/21	9/21
classes taught	—	—	0

Why 0 classes are taught: no finding in the live store carries the class facts yet. For example, 8LAYR367YV appears in sigcache.json and on btm events, but never on a process or beacon finding. The brief assumed it did.

Backfill not done: I measured what a sha-bound backfill from disk would recover for the existing verdicts. It came to 2 classes: buildrepo:…/codex-apple-integrate (#501, #502, still below its floor of 3) and package:uv-python:cpython-3.13 (#505, which the content identity from #51 already covers). The signer classes the verdicts imply cannot be bound safely:

• the Zotero beacons were recorded with no content hash;
• the Anthropic claude binaries they name are gone from disk.

Deriving a team from a path without binding it to bytes would let one replaced file teach a whole publisher, at a floor of 1. So classes start accumulating with the first verdicts given after install. The corpus numbers above are unchanged, and assay recall did not drop.

Cost: _suppression_memory goes from ~75 ms to ~80–110 ms CPU per scan on the live store. _incident_classes reads only the newest observation per signal.

Verification

• tests/test_class_tolerance.py: 43 tests, all pass. They cover:
  • signer at a floor of 1 on a different path
  • adhoc → no class
  • buildrepo 2 verdicts not enough, 3 enough
  • reopen revokes the class for the rest
  • CRITICAL and attack-defined never tolerated by a class
  • reviewed-severity cap
  • interpreters refused
  • lesson text, action log, families preview, replay teaching line
  • single-source mutation test plus an AST check that only _finding_classes spells a class key. I confirmed separately that the mutation test goes red when either the memory side or the decision side bypasses _finding_classes.
• tests/test_tolerance_follows_bytes.py (Thirty verdicts on one binary taught nothing, because tolerance asked where it was #51): pass (66 together with the above).
• pytest tests/ -k "toleran or identity or famil or dismiss": 242 passed.
• Full suite: 2220 passed, 6 skipped, 30 xfailed, 41 subtests passed in 1576.00s, run on the committed tree (sha-checked).
• gitleaks over integration..HEAD: no leaks. Every author is the noreply identity.
• Not run: the simbody win/linux diff. The new tests use conftest.PUBLISHER_TRUST/SUSPICIOUS_TRUST, not macOS verdict literals.

Follow-up (fe8f9ad): exact bytes tolerate on one verdict

The verifier decided that #51's content identity tolerates on one verdict, not three:

• process:content:<sha>
• beacon:content:<sha>:<ip>:<port>

An exact-bytes identity reaches nothing the operator did not judge. Asking three times about one fact was the teaching-evaporates defect in its purest form.

One table, _TOLERANCE_FLOOR:

identity	verdicts needed
exact bytes	1
signer / package	1
build repo / supervisor / producer	3
path identities	3

_PRODUCER_MIN_SIBLINGS is now read from it.

Guards unchanged:

• never CRITICAL
• never attack-defined
• never above the reviewed severity
• never _NEVER_TOLERATE_PREFIXES
• a dispute on any incident holding those bytes revokes the identity (_disputed_identities already carried it)

Other changes:

• _tolerance_memory is split into _tolerance_verdicts (buckets, each with a width) plus the floor applied to them. The verdict lesson now counts what the decision sees.
• incident <id> benign-positive prints Learned: these exact bytes (sha256 1a2b3c4d…) — anywhere (1 verdict, tolerates now), and families previews it.
• The class width named content in the first commit is renamed derived, so "content" now means only the exact bytes.

#51 tests changed (tests/test_tolerance_follows_bytes.py::TestVerdictsConvergeAcrossPaths, which pinned three for content):

• _teach_three_paths became _teach_one.
• test_three_paths_one_binary_reaches_the_floor became test_one_verdict_reaches_the_floor.
• test_two_verdicts_are_not_enough became test_the_path_identity_still_needs_three. The path identity still needs three: two verdicts on two builds at one path do not cover a third.
• New: test_the_copies_at_the_other_paths_open_pre_closed.
• test_the_next_sighting_at_a_fourth_path_is_tolerated, test_different_bytes_at_a_taught_path_still_alert, test_false_positive_verdicts_teach_nothing_here and test_critical_is_never_tolerated now teach one verdict.
• test_a_dispute_reaches_the_content_identity keeps its INVESTIGATING dispute. It now opens the disputed copy before the single verdict.

New tests (tests/test_class_tolerance.py::ExactBytesTolerateAtOneVerdict):

• one verdict tolerates the same bytes at another path
• never above the reviewed severity
• different sha at the same path not covered
• CRITICAL never tolerated
• reopening a tolerated copy revokes the identity
• reopening the judged incident revokes the identity
• the path identity keeps three
• the Learned: line
• the floor table

Measured — live store, one snapshot, backtest replay --days 30 --reobserve

df4c8d4 and fe8f9ad were replayed against the same store state:

	df4c8d4 (class tolerance)	fe8f9ad (exact bytes at 1)
tolerated identities	10	46
process interrupt	23	6
total interrupts	—	112
noise re-opened	125/214	112/214
— benign-positive	35/56	22/56
cases left OPEN	131	116
new interrupts from corpus	13	13 (identical list)
assay recall	9/21	9/21

The corpus grew between my first measurement (62,647 events) and this one (62,707), so the first-commit column here is a fresh run on the new snapshot.

Verification (follow-up)

• tests/test_class_tolerance.py + tests/test_tolerance_follows_bytes.py: 76 passed.
• pytest tests/ -k "toleran or identity or famil or dismiss": 252 passed.
• Full suite: 2230 passed, 6 skipped, 30 xfailed, 41 subtests passed in 908.96s. The tree sha was checked before and after the run.
• ~/.aegis/custody.jsonl held 151 lines before the suite and 151 after. S7's conftest guard is not on this base.
• gitleaks over the pushed range found no leaks.

🤖 Generated with Claude Code