create-egregore 0.21.6 → 0.22.0

package/runtime/claude/egregore_runtime/memory_push.py

@@ -0,0 +1,349 @@
+"""One managed memory push, freshly inspected at dispatch.
+
+Ordinary callers cannot publish native history. The optional private record
+owner can supply its typed, single-use in-process permit. This transport never
+fetches, rebases, changes Git configuration, retries a push or writes a queue.
+Manual Git remains outside this boundary. Existing Git configuration owns auth.
+"""
+from __future__ import annotations
+
+import argparse
+from dataclasses import dataclass, replace
+import hashlib
+import json
+import math
+import os
+from pathlib import Path
+import re
+import subprocess
+import time
+from urllib.parse import urlsplit
+
+from . import record_publish as history
+
+
+@dataclass(frozen=True)
+class PushLimits:
+    seconds: float = 90
+    command_seconds: float = 15
+    push_seconds: float = 45
+    output_bytes: int = 65536
+    history: history.HistoryLimits = history.DEFAULT_LIMITS
+
+
+DEFAULT_LIMITS = PushLimits()
+EXIT_CODES = {"pushed": 0, "deferred": 2, "rejected": 3, "unknown": 4}
+
+
+class _Refusal(Exception):
+    def __init__(self, cause, *, status="rejected"):
+        self.cause, self.status = cause, status
+
+
+class _Transport(history._Git):
+    def __init__(self, root, deadline, limits, allow_local):
+        super().__init__(root, deadline)
+        # Transport uses normal system/global/local credential configuration.
+        # Repository/config/ref redirection from caller environment is removed.
+        self.env.pop("GIT_CONFIG_NOSYSTEM", None)
+        self.env.pop("GIT_CONFIG_GLOBAL", None)
+        for key in ("GIT_ASKPASS", "GIT_SSL_CAINFO", "GIT_SSL_CAPATH"):
+            if key in os.environ:
+                self.env[key] = os.environ[key]
+        self.limits, self.allow_local = limits, allow_local
+
+    def start(self, args, *, stdin=False):
+        return super().start(["-c", "protocol.https.allow=always", "-c",
+            "protocol.file.allow=" + ("always" if self.allow_local else "never"),
+            "-c", "http.followRedirects=false", "-c", "push.followTags=false",
+            "-c", "push.recurseSubmodules=no", "-c", "push.gpgSign=false",
+            "-c", "push.autoSetupRemote=false", *args], stdin=stdin)
+
+    def command(self, *args, seconds=None):
+        outer = self.deadline
+        self.deadline = min(outer, time.monotonic() + (seconds or self.limits.command_seconds))
+        try:
+            return self.run(*args, limit=self.limits.output_bytes, allowed=tuple(range(256)))
+        finally:
+            self.deadline = outer
+
+
+def _branch(value):
+    if not isinstance(value, str):
+        raise _Refusal("invalid_destination_branch")
+    ref = value if value.startswith("refs/") else "refs/heads/" + value
+    if not ref.startswith("refs/heads/") or not history._ref(ref):
+        raise _Refusal("invalid_destination_branch")
+    return ref
+
+
+def _safe_ref(git_dir, ref):
+    seen = set()
+    while True:
+        if ref in seen or len(seen) >= 8:
+            raise _Refusal("ambiguous_source_ref")
+        seen.add(ref)
+        if ref != "HEAD" and (not history._ref(ref) or not ref.startswith("refs/heads/")):
+            raise _Refusal("invalid_source_ref")
+        selected = git_dir
+        for part in ref.split("/"):
+            selected /= part
+            if selected.is_symlink():
+                raise _Refusal("unsupported_repository")
+        if (git_dir / "packed-refs").is_symlink():
+            raise _Refusal("unsupported_repository")
+        if not selected.exists():
+            return
+        raw = history._regular(selected, 1024).strip()
+        if not raw.startswith(b"ref: "):
+            return
+        ref = raw[5:].decode("ascii")
+
+
+def _url(value, allow_local):
+    if not value or len(value) > 4096 or any(ord(char) <= 32 or ord(char) == 127 for char in value):
+        raise _Refusal("unsupported_destination")
+    parsed = urlsplit(value)
+    if (parsed.scheme == "https" and parsed.hostname and parsed.username is None and parsed.password is None
+            and not parsed.query and not parsed.fragment and parsed.path.startswith("/")
+            and not re.search(r"[^A-Za-z0-9.:-]", parsed.netloc)):
+        return value
+    if allow_local and not parsed.scheme and value.startswith("/"):
+        path = Path(value)
+        if path == path.resolve() and path.is_dir():
+            return value
+    raise _Refusal("unsupported_destination")
+
+
+def _snapshot(transport, repository, head_ref, branch_ref):
+    root, git_dir = history._repository(repository, transport.deadline)
+    _safe_ref(git_dir, head_ref)
+    config, code = transport.command("config", "--null", "--list", "--includes")
+    if code:
+        raise _Refusal("configuration_unavailable", status="deferred")
+    values = {}
+    for entry in config.split(b"\0"):
+        if not entry:
+            continue
+        key, sep, value = entry.partition(b"\n")
+        if not sep:
+            # A valueless Boolean key is true in Git's own configuration.
+            value = b"true"
+        name = key.decode("utf-8").lower()
+        values.setdefault(name, []).append(value.decode("utf-8"))
+    if any(re.fullmatch(r"url\..*\.(?:push)?insteadof", key) for key in values):
+        raise _Refusal("destination_rewrite_unsupported")
+    if (len(values.get("remote.origin.url", [])) != 1 or len(values.get("remote.origin.pushurl", [])) > 1
+            or any(values.get(key) for key in ("remote.origin.push", "remote.origin.pushoption", "push.pushoption",
+                                              "remote.origin.receivepack", "remote.origin.uploadpack", "remote.origin.vcs"))
+            or any(value.lower() not in {"false", "no", "off", "0"} for value in values.get("remote.origin.mirror", []))):
+        raise _Refusal("ambiguous_destination")
+    selected = values.get("remote.origin.pushurl", values["remote.origin.url"])[0]
+    selected = _url(selected, transport.allow_local)
+    resolved, code = transport.command("remote", "get-url", "--push", "--all", "origin")
+    if code or resolved.decode("utf-8").splitlines() != [selected]:
+        raise _Refusal("ambiguous_destination")
+    raw_head, code = transport.command("rev-parse", "--verify", head_ref)
+    head = raw_head.strip().decode("ascii")
+    if code or not history.OID.fullmatch(head):
+        raise _Refusal("source_unavailable", status="deferred")
+    info, git_info = root.stat(), git_dir.stat()
+    return {"url": selected, "head_oid": head, "head_ref": head_ref, "branch_ref": branch_ref,
+            "repository_identity": [info.st_dev, info.st_ino, git_info.st_dev, git_info.st_ino],
+            "repository_fingerprint": history._digest({"repository": str(root), "git_dir": str(git_dir)}),
+            "configuration_digest": hashlib.sha256(config).hexdigest(),
+            "destination_fingerprint": history._digest({"url": selected, "ref": branch_ref})}
+
+
+def _remote(transport, selection):
+    raw, code = transport.command("ls-remote", "--refs", "--heads", "--", selection["url"], selection["branch_ref"])
+    if code:
+        raise _Refusal("remote_evidence_unavailable", status="deferred")
+    lines = raw.decode("ascii").splitlines()
+    if not lines:
+        return None
+    if len(lines) != 1:
+        raise _Refusal("ambiguous_remote_evidence", status="deferred")
+    oid, sep, ref = lines[0].partition("\t")
+    if not sep or ref != selection["branch_ref"] or not history.OID.fullmatch(oid) or len(oid) != len(selection["head_oid"]):
+        raise _Refusal("ambiguous_remote_evidence", status="deferred")
+    return oid
+
+
+def _same(expected, current):
+    if expected != current:
+        raise _Refusal("source_or_destination_changed", status="deferred")
+
+
+def inspect_destination(repository, *, branch, head_ref="HEAD", limits=DEFAULT_LIMITS,
+                        allow_local_transport=False, deadline_monotonic=None):
+    """Fresh read-only host selection. This fact carries no publication grant.
+
+    The native record owner uses the same bounded destination resolver before
+    committing and while reconciling an uncertain exact commit. No fetch,
+    reconciliation mutation or push occurs here.
+    """
+    _validate_arguments(limits, allow_local_transport, head_ref)
+    branch_ref = _branch(branch)
+    deadline = _deadline(limits, deadline_monotonic)
+    root, _ = history._repository(repository, deadline)
+    transport = _Transport(root, deadline, limits, allow_local_transport)
+    selection = _snapshot(transport, root, head_ref, branch_ref)
+    base = _remote(transport, selection)
+    _same(selection, _snapshot(transport, root, head_ref, branch_ref))
+    return selection, base
+
+
+def _deadline(limits, inherited):
+    if inherited is not None and (type(inherited) not in (float, int) or not math.isfinite(inherited)):
+        raise ValueError("invalid inherited deadline")
+    value = time.monotonic() + limits.seconds
+    if inherited is not None:
+        value = min(value, inherited)
+    if value <= time.monotonic():
+        raise ValueError("publication deadline expired")
+    return value
+
+
+def _validate_arguments(limits, allow_local_transport, head_ref):
+    if (not isinstance(limits, PushLimits) or type(allow_local_transport) is not bool
+            or any(type(getattr(limits, key)) not in (int, float) or not 0 < getattr(limits, key) <= getattr(DEFAULT_LIMITS, key)
+                   for key in ("seconds", "command_seconds", "push_seconds"))
+            or type(limits.output_bytes) is not int or not 1 <= limits.output_bytes <= DEFAULT_LIMITS.output_bytes
+            or not isinstance(limits.history, history.HistoryLimits)):
+        raise _Refusal("invalid_limits")
+    if not isinstance(head_ref, str) or not (head_ref == "HEAD" or head_ref.startswith("refs/heads/") and history._ref(head_ref)):
+        raise _Refusal("invalid_source_ref")
+
+
+def _empty_receipt():
+    return {"schema": "egregore.managed-memory-push/v1", "status": "deferred", "cause": "not_started",
+               "source_oid": None, "source_ref": None, "base_oid": None, "destination_ref": None,
+               "repository_fingerprint": None, "destination_fingerprint": None, "configuration_digest": None,
+               "history_digest": None, "history_status": None, "dispatch_attempted": False,
+               "reconciled": False, "retry_safe": False, "observed_remote_oid": None, "native_publication_authority": False}
+
+
+def push_memory(repository, *, branch, head_ref="HEAD", limits=DEFAULT_LIMITS, allow_local_transport=False,
+                native_permit=None, deadline_monotonic=None):
+    """Inspect and perform at most one exact managed push; no reusable permit.
+
+    HTTPS is the production transport. The explicit local-transport host option
+    retains every history/CAS guard and exists for disposable local receivers.
+    Config/source checks detect ordinary concurrent changes, not hostile local
+    filesystem mutation after the final check. An explicit remote lease closes
+    the destination-ref race; it is used only after proving fast-forward ancestry.
+    """
+    receipt = _empty_receipt()
+    selection, transport = None, None
+    try:
+        _validate_arguments(limits, allow_local_transport, head_ref)
+        branch_ref = _branch(branch)
+        if native_permit is not None:
+            # The fixed native owner is private. Human-only public bundles do
+            # not carry it and must retain the same denied-native boundary.
+            try:
+                from .record_admission import NativePublicationPermit
+                valid_permit = type(native_permit) is NativePublicationPermit
+            except ImportError:
+                valid_permit = False
+            if not valid_permit:
+                raise _Refusal("invalid_native_publication_permit")
+        deadline = _deadline(limits, deadline_monotonic)
+        root, _ = history._repository(repository, deadline)
+        transport = _Transport(root, deadline, limits, allow_local_transport)
+        selection = _snapshot(transport, root, head_ref, branch_ref)
+        receipt.update(source_oid=selection["head_oid"], source_ref=head_ref, destination_ref=branch_ref,
+                       **{key: selection[key] for key in ("repository_fingerprint", "destination_fingerprint", "configuration_digest")})
+        base = _remote(transport, selection)
+        receipt.update(base_oid=base, observed_remote_oid=base)
+        if base is not None:
+            local = history._Git(root, deadline)
+            kind, code = local.run("cat-file", "-t", base, limit=32, allowed=(0, 128))
+            if code == 128:
+                raise _Refusal("remote_base_unavailable_locally", status="deferred")
+            if kind.strip() != b"commit":
+                raise _Refusal("remote_base_not_commit", status="deferred")
+        inspection = history.inspect_outgoing_history(root, base_oid=base, base_ref=None,
+                    head_oid=selection["head_oid"], head_ref=head_ref,
+                    limits=replace(limits.history, seconds=min(limits.history.seconds, transport.remaining())))
+        receipt.update(history_digest=inspection["digest"], history_status=inspection["status"])
+        if inspection["status"] == "present" and native_permit is None:
+            raise _Refusal("native_history_requires_admission")
+        if inspection["status"] not in {"none", "present"} or not inspection["complete"]:
+            raise _Refusal("outgoing_history_unavailable", status="deferred")
+        _same(selection, _snapshot(transport, root, head_ref, branch_ref))
+        if _remote(transport, selection) != base:
+            raise _Refusal("remote_changed", status="deferred")
+        # A further source/config check follows the potentially slow remote read.
+        _same(selection, _snapshot(transport, root, head_ref, branch_ref))
+        if native_permit is not None:
+            try:
+                native_permit._admit_dispatch(selection, base, inspection)
+            except (ValueError, TypeError, AttributeError, OSError, RuntimeError):
+                raise _Refusal("native_publication_admission_changed")
+            # The fixed owner rechecks source and permissions, potentially over
+            # an inherited pipe. Bind HEAD/config once more after that return.
+            _same(selection, _snapshot(transport, root, head_ref, branch_ref))
+            receipt["native_publication_authority"] = True
+        if base == selection["head_oid"]:
+            receipt.update(status="pushed", cause="already_current", reconciled=True)
+        else:
+            receipt["dispatch_attempted"] = True
+            push_code = None
+            try:
+                _, push_code = transport.command("push", "--porcelain", "--no-verify", "--no-follow-tags",
+                    "--recurse-submodules=no", "--force-with-lease=" + branch_ref + ":" + (base or ""),
+                    "--", selection["url"], selection["head_oid"] + ":" + branch_ref, seconds=limits.push_seconds)
+            except (history._Unknown, OSError, ValueError, subprocess.SubprocessError):
+                pass  # The only follow-up is a read; never another push.
+            try:
+                _same(selection, _snapshot(transport, root, head_ref, branch_ref))
+                observed = _remote(transport, selection)
+                receipt["observed_remote_oid"] = observed
+                if observed == selection["head_oid"]:
+                    receipt.update(status="pushed", cause="acknowledged" if push_code == 0 else "acknowledgement_reconciled", reconciled=True)
+                else:
+                    receipt.update(status="unknown", cause="remote_changed_after_dispatch" if observed != base else "push_acknowledgement_unknown")
+            except (history._Unknown, _Refusal, OSError, ValueError, UnicodeError, subprocess.SubprocessError):
+                receipt.update(status="unknown", cause="push_acknowledgement_unknown")
+    except _Refusal as exc:
+        receipt.update(status="unknown" if receipt["dispatch_attempted"] else exc.status,
+                       cause="push_acknowledgement_unknown" if receipt["dispatch_attempted"] else exc.cause,
+                       retry_safe=not receipt["dispatch_attempted"] and exc.cause in {
+                           "source_or_destination_changed", "remote_changed", "remote_base_unavailable_locally"})
+    except (history._Unknown, OSError, ValueError, TypeError, UnicodeError, RecursionError, subprocess.SubprocessError):
+        receipt.update(status="unknown" if receipt["dispatch_attempted"] else "deferred",
+                       cause="push_acknowledgement_unknown" if receipt["dispatch_attempted"] else "bounded_evidence_unavailable")
+    return {**receipt, "digest": history._digest(receipt)}
+
+
+def main(argv=None):
+    parser = argparse.ArgumentParser(description="Guard one exact managed memory push; native history remains local.")
+    parser.add_argument("--repository", required=True)
+    parser.add_argument("--branch", required=True)
+    parser.add_argument("--head-ref", default="HEAD")
+    parser.add_argument("--allow-local-transport", action="store_true", help="explicit local bare fixture transport; all guards remain enabled")
+    args = parser.parse_args(argv)
+    deadline = time.monotonic() + DEFAULT_LIMITS.seconds
+    try:
+        # The host selects the memory repository, normally project/memory -> a
+        # sibling checkout. Bind that alias once here; the strict history and
+        # transport owners receive only its physical path and never reread it.
+        repository = Path(args.repository)
+        if not repository.is_absolute() or any(ord(c) < 32 or ord(c) == 127 for c in args.repository):
+            raise ValueError("invalid repository selection")
+        repository = repository.resolve(strict=True)
+    except (OSError, ValueError, RuntimeError, UnicodeError):
+        receipt = _empty_receipt()
+        receipt["cause"] = "bounded_evidence_unavailable"
+        receipt["digest"] = history._digest(receipt)
+    else:
+        receipt = push_memory(repository, branch=args.branch, head_ref=args.head_ref,
+                              allow_local_transport=args.allow_local_transport, deadline_monotonic=deadline)
+    print(json.dumps(receipt, sort_keys=True, separators=(",", ":")))
+    return 75 if receipt["retry_safe"] else EXIT_CODES[receipt["status"]]
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/claude/egregore_runtime/observe.py

@@ -2,10 +2,12 @@
 
 from __future__ import annotations
 
+import json
 import time
 from dataclasses import dataclass, replace
 from datetime import UTC, datetime
 from uuid import uuid4
+from pathlib import Path
 
 from .contracts import (
     ActionAuthorizer,
@@ -14,6 +16,7 @@ from .contracts import (
     OrgContext,
     OrgContextCompiler,
     Permission,
+    PolicyDecision,
     RetrievalHit,
     RetrievalRequest,
     Retriever,
@@ -21,10 +24,10 @@ from .contracts import (
     TelemetrySink,
     TemporalScope,
 )
-from .admin_gate import AdminGate
 from .errors import AuthorizationDenied, ContextBudgetError
+from .held import RedactionError, identity, redact
 from .lifecycle import AuthorityState, CanonicalLifecycleService, LifecycleRecord
-from .policy import scope_allows_path
+from .policy import allows, check, narrow, strips
 
 
 def _token_count(content: str) -> int:
@@ -37,13 +40,28 @@ def _truncate_to_budget(content: str, budget: int) -> str:
     return content[: max(0, budget * 4)]
 
 
+def _packaged(decision: PolicyDecision, content: str, root: Path) -> str:
+    """``held.redact`` for one passage; a JSON object (discovery's metadata) field by field, keys too, so a
+    title that runs into the next field name never breaks it."""
+    if not strips(decision):
+        return content
+    try:
+        fields = json.loads(content) if content.startswith("{") else None
+    except (ValueError, RecursionError):
+        fields = None
+    if not isinstance(fields, dict):
+        return redact(decision, content, root=root)
+    kept = redact(decision, fields, root=root, keys=True)
+    return content if kept == fields else json.dumps(kept, ensure_ascii=False)
+
+
 @dataclass(slots=True)
 class DefaultOrgContextCompiler(OrgContextCompiler):
     authorizer: ActionAuthorizer
     retriever: Retriever
     telemetry: TelemetrySink
+    memory_root: Path
     lifecycle: CanonicalLifecycleService | None = None
-    admin_gate: AdminGate | None = None
 
     def observe(
         self,
@@ -68,12 +86,13 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
 
         scopes = tuple(
             scope
-            for scope in (request.authorized_scopes or decision.scopes)
-            if not decision.scopes or scope_allows_path(scope, decision.scopes)
+            for scope in (request.authorized_scopes or decision.read_prefixes)
+            if allows(decision, scope, "read", root=self.memory_root)
         )
         if not scopes:
             raise AuthorizationDenied("policy produced no authorized retrieval scope")
 
+        narrowed = narrow(decision, "read", scopes)
         allowed_ids = request.allowed_artifact_ids
         if decision.resource_ids:
             allowed_ids = tuple(
@@ -92,33 +111,28 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
         scoped_retrieve = getattr(self.retriever, "retrieve_authorized", None)
         result = (
             scoped_retrieve(authorized_request, actor=actor,
-                            admin_gate=self.admin_gate, lifecycle=self.lifecycle)
+                            decision=narrowed, lifecycle=self.lifecycle)
             if callable(scoped_retrieve)
             else self.retriever.retrieve(authorized_request)
         )
 
         # Defense in depth: an adapter returning an out-of-scope candidate
         # cannot place it in model context.
-        authorized_hits = tuple(
-            hit
-            for hit in result.hits
-            if scope_allows_path(hit.canonical_path, scopes)
-            and (not allowed_ids or hit.artifact_id in allowed_ids)
-        )
-
         # Egregore-surface admin protection: QMD may match an admin-marked
         # document internally, but for a non-admin actor it must contribute
         # nothing to evidence — no title, path, snippet, count detail, or
         # model context. Only an opaque withheld tally survives.
+        visible_hits = []
         withheld_admin = 0
-        if self.admin_gate is not None and not self.admin_gate.actor_is_admin(actor):
-            visible_hits = []
-            for hit in authorized_hits:
-                if self.admin_gate.path_is_admin(hit.canonical_path):
-                    withheld_admin += 1
-                else:
-                    visible_hits.append(hit)
-            authorized_hits = tuple(visible_hits)
+        for hit in result.hits:
+            verdict = check(narrowed, hit.canonical_path, "read", root=self.memory_root)
+            if allowed_ids and hit.artifact_id not in allowed_ids:
+                continue
+            if verdict.reason.startswith("held:"):
+                withheld_admin += 1
+            if verdict.allowed:
+                visible_hits.append(hit)
+        authorized_hits = tuple(visible_hits)
 
         lifecycle_by_path: dict[str, LifecycleRecord] = {}
         lifecycle_revision = "unavailable"
@@ -128,7 +142,7 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
                 resolved, lifecycle_revision = self.lifecycle.resolve_paths(
                     tuple(hit.canonical_path for hit in authorized_hits),
                     source_revision=result.source_revision,
-                    authorized_scopes=scopes,
+                    decision=narrowed,
                     allowed_artifact_ids=allowed_ids,
                 )
                 lifecycle_by_path = dict(resolved)
@@ -189,6 +203,7 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
             request,
             token_budget,
             lifecycle_by_path,
+            decision=decision,  # names are shared or not against all the reader may see
         )
         # A rolling-window receipt is reusable only until its oldest delivered
         # source expires. Omitted/withheld hits must not affect this boundary.
@@ -209,6 +224,20 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
             for permission in Permission
             if self.authorizer.authorize_action(actor, permission).allowed
         )
+        # Retrieval and source packaging may outlive the authority that admitted
+        # them. Do not deliver a prepared context after revocation or a changed
+        # policy: even its omissions may name sources the reader can no longer
+        # see. The caller can retry with the current effective decision.
+        current_decision = self.authorizer.authorize_observe(actor, request)
+        if not current_decision.allowed or current_decision != decision:
+            raise AuthorizationDenied("retrieval authority changed; retry the request")
+        # Holds can change in canonical files without changing a policy receipt.
+        # Recheck every selected path, including sources named only by omissions.
+        if any(
+            not allows(current_decision, hit.canonical_path, "read", root=self.memory_root)
+            for hit in selected_hits
+        ):
+            raise AuthorizationDenied("retrieval source access changed; retry the request")
         context = OrgContext(
             schema_version="egregore-context/v1",
             context_id=f"ctx_{uuid4().hex}",
@@ -275,6 +304,8 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
         request: RetrievalRequest,
         token_budget: int,
         lifecycle_by_path: dict[str, LifecycleRecord] | None = None,
+        *,
+        decision: PolicyDecision,
     ) -> tuple[tuple[EvidenceItem, ...], tuple[str, ...], tuple[str, ...], int]:
         evidence: list[EvidenceItem] = []
         opened_ids: list[str] = []
@@ -298,8 +329,16 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
                     omissions.append(f"stale-passage:{hit.canonical_path}")
             else:
                 content = hit.passage or ""
+            # The one packaging, before the budget cuts: names of documents held from this reader leave
+            # every excerpt, title, source, revision and id; a text that cannot be redacted is not handed over.
+            try:
+                content = _packaged(decision, content, self.memory_root)
+                revision = redact(decision, hit.revision or "unknown", root=self.memory_root)
+                artifact_id = identity(decision, hit.artifact_id, hit.canonical_path, root=self.memory_root)
+            except RedactionError:
+                continue
             if not content:
-                omissions.append(f"empty:{hit.artifact_id}")
+                omissions.append(f"empty:{artifact_id}")
                 continue
 
             count = _token_count(content)
@@ -310,9 +349,9 @@ class DefaultOrgContextCompiler(OrgContextCompiler):
                 omissions.append(f"truncated:{hit.canonical_path}")
             evidence.append(
                 EvidenceItem(
-                    artifact_id=hit.artifact_id,
+                    artifact_id=artifact_id,
                     canonical_path=hit.canonical_path,
-                    revision=hit.revision or "unknown",
+                    revision=revision,
                     reason=self._evidence_reason(
                         hit,
                         (lifecycle_by_path or {}).get(hit.canonical_path),

package/runtime/claude/egregore_runtime/observers.py

@@ -0,0 +1,19 @@
+"""Disposable observers for completed, authorized Runtime operations."""
+
+from dataclasses import dataclass
+from typing import Callable
+from .contracts import ExecutionAuthority
+
+
+@dataclass(frozen=True, slots=True)
+class RuntimeEvent:
+    kind: str
+    actor_id: str
+    session_id: str
+    harness: str
+    paths: tuple[str, ...]
+    execution: ExecutionAuthority | None = None
+
+
+Observer = Callable[[RuntimeEvent], None]
+MAX_EVENT_PATHS = 40

package/runtime/claude/egregore_runtime/optional_modules.py

@@ -0,0 +1,13 @@
+"""Load a separately delivered module; failures inside installed code still raise."""
+from importlib import import_module
+from importlib.util import resolve_name
+
+
+def optional_module(name: str):
+    absolute = resolve_name(name, __package__)
+    try:
+        return import_module(absolute)
+    except ModuleNotFoundError as exc:
+        if exc.name != absolute:
+            raise
+        return None