causal-continuity-engine 0.2.0__tar.gz → 0.3.0__tar.gz

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/.github/CONTRIBUTING.md

@@ -258,7 +258,11 @@ outcome, say what distinguishes it from "nothing happened".
 
 **No authorship attribution to tooling.** The `.githooks/` hooks and the CI
 attribution guard both reject it, in commit messages and in committed files.
-Do not work around them.
+Do not work around them. This is a rule about credit, not secrecy: AI coding
+assistants are used in this project's development, and every change is
+reviewed, tested, signed off, and committed by the maintainer, who is
+responsible for it. If AI tools did significant work on your patch, say so in
+plain words in the pull request; never list a tool as an author or co-author.
 
 ## Security
 

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/.github/scripts/check_attribution.py

@@ -76,6 +76,13 @@ _ARTIFACT_AI_CREDIT = re.compile(
 _TOOL_BYLINE = re.compile(
     rf"{_AI_ALIAS.pattern}\s*\((?:anthropic|openai)\)[.!]?"
 )
+# An AI coding session appends provenance rather than credit: a trailer whose key
+# names the tool ("<tool>-Session: <link>") and a bare link to the session. Neither
+# names an actor, so the credit grammar above never reached them.
+_AI_SESSION_KEY = re.compile(
+    rf"{_AI_ALIAS.pattern}[- ]session(?:[- ](?:id|link|url))?"
+)
+_AI_SESSION_LINK = re.compile(r"<?https?://claude\.ai/code/session_[a-z0-9_-]+/?>?")
 _TRAILER_KEYS = frozenset({
     "assisted-by",
     "authored-by",
@@ -233,6 +240,11 @@ def scan_prose(
         key, separator, value = line.partition(":")
         if separator and key.replace("_", "-") in _TRAILER_KEYS:
             reason = _actor_reason(value)
+        if reason is None and separator and _AI_SESSION_KEY.fullmatch(
+                key.replace("_", "-")):
+            reason = "tool/model session trailer"
+        if reason is None and _AI_SESSION_LINK.fullmatch(line):
+            reason = "tool/model session link"
         if reason is None:
             match = _CREDIT.fullmatch(line) or _ROLE.fullmatch(line)
             if match is not None:

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/AGENTS.md

@@ -14,9 +14,13 @@ history and a bi-temporal causal graph. Event-derived projections are
 rebuildable only while source payloads remain inside the retention window;
 runtime records are authenticated/audited rather than replay-derived. Memory
 tiers L0–L4 and token-budgeted Resume Packets are what
-an agent actually receives on resume. When a requirement changes or evidence
-contradicts an assumption, causal invalidation computes the blast radius
-over typed edges, bounds it, and classifies it deterministically. When policy
+an agent actually receives on resume. When a requirement changes, when the
+source that stated an assumption withdraws it, or when an integration records
+contradicting evidence through `engine.invalidation.fire(...)`, causal
+invalidation computes the blast radius over typed edges, bounds it, and
+classifies it deterministically. It does not read prose for meaning; a trusted
+explicit negation of an active assumption's own wording raises a human-gated
+notice (ADR-133). When policy
 requires proof, a task cannot be marked complete without a signed proof envelope
 whose required verifiers actually ran — `Engine.complete_task` has twenty-two
 independently instrumented rejection gates, including current confirmed authority,
@@ -325,8 +329,11 @@ below what it is about to do (ADR-048).
 
 Never add AI authorship credit to a commit message, PR title or body, code
 comment, documentation file, changelog, or example. No co-author trailers,
-no "generated with" lines, no tool bylines, no mention of AI involvement in
-this codebase anywhere.
+no "generated with" lines, no tool bylines. This is a rule about credit, not
+secrecy: `.github/CONTRIBUTING.md` states plainly that AI coding assistants
+are used in development and that the maintainer reviews, tests, and commits
+every change. Disclosure in plain words is allowed; crediting a tool as an
+author is not.
 
 This is enforced, not requested. `.githooks/commit-msg` and
 `.githooks/pre-commit` block it locally (`core.hooksPath` is set to

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/CHANGELOG.md

@@ -9,6 +9,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 No unreleased changes.
 
+## 0.3.0 — 2026-10-16
+
+### Added
+
+- **A trusted explicit negation of an active assumption raises a human-gated
+  notice.** An OWNER, MEMBER or COLLABORATOR sentence that restates an active
+  assumption with one negator ("the feed is NOT ordered by timestamp"), negates
+  its cue ("we no longer assume …") or calls it wrong fires a
+  `contradictory_evidence` invalidation in `pending_confirmation`: nothing
+  changes until the owner records `confirm_invalidation` or
+  `reject_invalidation` through `authority --request`, with operands from
+  `Engine.authority_invalidation`. The notice appears in the resume packet and
+  makes `check` report `action_required`. The rule is closed and lexical; other
+  wordings are outside it (ADR-133).
+
+### Changed
+
+- **Breaking: processor compatibility advances to `cce-processor/1.10.0` and
+  extraction to `cce-deterministic/1.5.0`.** Preserve older projected stores and
+  their SQLite sidecars after stopping writers. Re-ingest retained sources into
+  a separate new store/project and review its proposals before confirming them.
+  Older projections do not upgrade in place; erased source payloads cannot be
+  reconstructed by replay (ADR-114, ADR-132).
+
+### Fixed
+
+- **A negated assumption cue no longer proposes the assumption it denies.**
+  "We no longer assume X", "We do not assume X" and "nothing relies on X"
+  extracted the same positive proposal as "We assume X", so a sentence written
+  to retire an assumption offered it for confirmation. The extractor now
+  abstains when a negator stands immediately before the cue. A prohibition or
+  decision form still proposes the constraint or decision the author wrote;
+  other wordings of a denial are outside this closed rule (ADR-132).
+
 ## 0.2.0 — 2026-09-23
 
 ### Changed

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/CITATION.cff

@@ -8,8 +8,8 @@ authors:
   - given-names: Thomas
     family-names: Albrecht
     alias: The Quantum Falcon
-version: 0.2.0
-date-released: 2026-09-23
+version: 0.3.0
+date-released: 2026-10-16
 license: Apache-2.0
 repository-code: https://github.com/thequantumfalcon/causal-continuity-engine
 url: https://github.com/thequantumfalcon/causal-continuity-engine

{causal_continuity_engine-0.2.0/causal_continuity_engine.egg-info → causal_continuity_engine-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: causal-continuity-engine
-Version: 0.2.0
+Version: 0.3.0
 Summary: Causal Continuity Engine - continuity, causal invalidation, and proof for long-running coding agents
 Author: Thomas Albrecht
 License-Expression: Apache-2.0
@@ -71,9 +71,16 @@ and neither is an unexamined green check.
 CCE addresses each with a mechanism rather than a better prompt. Decisions,
 assumptions, requirements and evidence become nodes in a bi-temporal causal
 graph over an application-enforced append-only, hash-chained event log, so
-*why* is a queryable edge and not a memory. When a requirement changes or evidence contradicts an assumption, the
+*why* is a queryable edge and not a memory. When a requirement changes, when the
+source that stated an assumption withdraws it, or when an integration records
+contradicting evidence through `engine.invalidation.fire(...)`, the
 blast radius is computed over typed edges, bounded, and classified
-deterministically. When policy requires proof, a task cannot be marked complete
+deterministically. CCE does not read prose for meaning. It does recognize one
+closed form: a trusted comment that restates an active assumption with a
+negator, like the one above, raises a human-gated notice that changes nothing
+until the owner confirms or rejects it; a differently worded dispute proposes
+nothing and fires nothing.
+When policy requires proof, a task cannot be marked complete
 without a signed envelope whose required verifiers actually ran — the rejection gates are
 mechanically enumerated and mutation-tested below.
 
@@ -97,7 +104,9 @@ command are already used by an unrelated published project.
 ## Use it from an editor
 
 `cce-engine mcp` speaks the Model Context Protocol over stdio, so an MCP client
-can read a project's control state directly. Four read-only tools:
+can read a project's control state directly. [docs/MCP.md](docs/MCP.md) walks the
+whole path on this repository, from install to a connected agent, and shows how
+the continuity check runs in CI on a runner that holds the store. Four read-only tools:
 `resume_packet`, `list_assumptions`, `list_invalidations`, `continuity_check`.
 
 The subcommand first ships in 0.1.6. The published 0.1.0, 0.1.2 and 0.1.3
@@ -165,15 +174,15 @@ with `.\.venv\Scripts\python.exe -m pip install causal-continuity-engine`
 and invoke the environment's `cce-engine.exe` by its absolute path in the
 commands below. After activation, `cce-engine --help` checks the installation.
 
-**Upgrading an existing project:** this release uses processor 1.9.0 and
-extractor 1.4.0; projections written by 0.1.6's processor 1.8.0 or earlier
+**Upgrading an existing project:** this release uses processor 1.10.0 and
+extractor 1.5.0; projections written by 0.2.0's processor 1.9.0 or earlier
 processors are refused. There is no in-place projection or authority upgrade. Stop writers,
 preserve the complete old project state (including its database and any SQLite
 sidecars), and re-ingest retained sources into a separate new project/store.
 Review and explicitly confirm the new proposals there; old prose is not approval.
 Do not remove markers or sidecars to bypass refusal. Payloads already removed
 by retention cannot be reconstructed from their digests. New users can simply
-start a fresh project. See [the upgrade notes for this release](CHANGELOG.md#020--2026-09-23);
+start a fresh project. See [the upgrade notes for this release](CHANGELOG.md#030--2026-10-16);
 the [0.1.6 notes](CHANGELOG.md#016--2026-09-20) remain historical.
 
 To run this exact checkout instead of the published package, or to work on the
@@ -191,6 +200,12 @@ python -m pip install -e .
 On Windows, use the PowerShell environment-creation and activation commands
 above, then `python -m pip install -e .` from the checkout.
 
+The editable install is enough for the engine but not for the test suite,
+which fails at collection without the hash-locked development tools. Install
+them with `python -m pip install -r requirements-dev.lock` (or `just setup`),
+then run `python -m pytest tests -q`. The full suite can take around fifteen
+minutes.
+
 Global flags come **before** the subcommand: `cce-engine --dir <path> <subcommand>`.
 
 ```bash
@@ -899,6 +914,9 @@ condition.
 - [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — the register of every control
   that could not be enabled while this repository was private, with the exact
   command that turned each one on at the flip.
+- [docs/MCP.md](docs/MCP.md) — connecting an agent over MCP, walked end to end on
+  this repository: install, init, ingest real events, confirm, verify, packet, check,
+  client configuration, and the freshness rule.
 - [docs/RELEASE.md](docs/RELEASE.md) — the reproducible, signed, immutable-ready
   release procedure and its continuity-bound attestation roadmap.
 - [docs/RESEARCH-ROADMAP.md](docs/RESEARCH-ROADMAP.md) — standards-backed

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/README.md

@@ -36,9 +36,16 @@ and neither is an unexamined green check.
 CCE addresses each with a mechanism rather than a better prompt. Decisions,
 assumptions, requirements and evidence become nodes in a bi-temporal causal
 graph over an application-enforced append-only, hash-chained event log, so
-*why* is a queryable edge and not a memory. When a requirement changes or evidence contradicts an assumption, the
+*why* is a queryable edge and not a memory. When a requirement changes, when the
+source that stated an assumption withdraws it, or when an integration records
+contradicting evidence through `engine.invalidation.fire(...)`, the
 blast radius is computed over typed edges, bounded, and classified
-deterministically. When policy requires proof, a task cannot be marked complete
+deterministically. CCE does not read prose for meaning. It does recognize one
+closed form: a trusted comment that restates an active assumption with a
+negator, like the one above, raises a human-gated notice that changes nothing
+until the owner confirms or rejects it; a differently worded dispute proposes
+nothing and fires nothing.
+When policy requires proof, a task cannot be marked complete
 without a signed envelope whose required verifiers actually ran — the rejection gates are
 mechanically enumerated and mutation-tested below.
 
@@ -62,7 +69,9 @@ command are already used by an unrelated published project.
 ## Use it from an editor
 
 `cce-engine mcp` speaks the Model Context Protocol over stdio, so an MCP client
-can read a project's control state directly. Four read-only tools:
+can read a project's control state directly. [docs/MCP.md](docs/MCP.md) walks the
+whole path on this repository, from install to a connected agent, and shows how
+the continuity check runs in CI on a runner that holds the store. Four read-only tools:
 `resume_packet`, `list_assumptions`, `list_invalidations`, `continuity_check`.
 
 The subcommand first ships in 0.1.6. The published 0.1.0, 0.1.2 and 0.1.3
@@ -130,15 +139,15 @@ with `.\.venv\Scripts\python.exe -m pip install causal-continuity-engine`
 and invoke the environment's `cce-engine.exe` by its absolute path in the
 commands below. After activation, `cce-engine --help` checks the installation.
 
-**Upgrading an existing project:** this release uses processor 1.9.0 and
-extractor 1.4.0; projections written by 0.1.6's processor 1.8.0 or earlier
+**Upgrading an existing project:** this release uses processor 1.10.0 and
+extractor 1.5.0; projections written by 0.2.0's processor 1.9.0 or earlier
 processors are refused. There is no in-place projection or authority upgrade. Stop writers,
 preserve the complete old project state (including its database and any SQLite
 sidecars), and re-ingest retained sources into a separate new project/store.
 Review and explicitly confirm the new proposals there; old prose is not approval.
 Do not remove markers or sidecars to bypass refusal. Payloads already removed
 by retention cannot be reconstructed from their digests. New users can simply
-start a fresh project. See [the upgrade notes for this release](CHANGELOG.md#020--2026-09-23);
+start a fresh project. See [the upgrade notes for this release](CHANGELOG.md#030--2026-10-16);
 the [0.1.6 notes](CHANGELOG.md#016--2026-09-20) remain historical.
 
 To run this exact checkout instead of the published package, or to work on the
@@ -156,6 +165,12 @@ python -m pip install -e .
 On Windows, use the PowerShell environment-creation and activation commands
 above, then `python -m pip install -e .` from the checkout.
 
+The editable install is enough for the engine but not for the test suite,
+which fails at collection without the hash-locked development tools. Install
+them with `python -m pip install -r requirements-dev.lock` (or `just setup`),
+then run `python -m pytest tests -q`. The full suite can take around fifteen
+minutes.
+
 Global flags come **before** the subcommand: `cce-engine --dir <path> <subcommand>`.
 
 ```bash
@@ -864,6 +879,9 @@ condition.
 - [docs/PUBLIC-FLIP.md](docs/PUBLIC-FLIP.md) — the register of every control
   that could not be enabled while this repository was private, with the exact
   command that turned each one on at the flip.
+- [docs/MCP.md](docs/MCP.md) — connecting an agent over MCP, walked end to end on
+  this repository: install, init, ingest real events, confirm, verify, packet, check,
+  client configuration, and the freshness rule.
 - [docs/RELEASE.md](docs/RELEASE.md) — the reproducible, signed, immutable-ready
   release procedure and its continuity-bound attestation roadmap.
 - [docs/RESEARCH-ROADMAP.md](docs/RESEARCH-ROADMAP.md) — standards-backed

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/causal_continuity_engine/__init__.py

@@ -7,7 +7,7 @@ authenticated runtime records are not replay-derived (ADR-001). Storage is
 SQLite implementing the PostgreSQL-first relational adjacency design (ADR-011).
 """
 
-__version__ = "0.2.0"
+__version__ = "0.3.0"
 
 SCHEMA_VERSIONS = {
     "anchor": "cce.anchor.v1",

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/causal_continuity_engine/engine.py

@@ -65,7 +65,7 @@ from .evidence import (
     run_determinism_probe,
     run_mutation_probe,
 )
-from .extraction import DeterministicExtractor, normalize_statement
+from .extraction import DeterministicExtractor, explicit_negations, normalize_statement
 from .github import (
     TRUSTED_ASSOCIATIONS,
     WEBHOOK_BODY_MAX_BYTES,
@@ -104,12 +104,14 @@ from .store import (
 )
 from .verifiers import VerifierRunner, VerifierSpec, record_verification
 
-PROCESSOR_VERSION = "cce-processor/1.9.0"
+PROCESSOR_VERSION = "cce-processor/1.10.0"
 _AUTHORITY_SCHEMA = "cce.authority-decision.v1"
 _AUTHORITY_SOURCE = "cce:authority-decision:v1"
 _AUTHORITY_EXTRACTOR = "cce.authority-decision"
 _PROPOSAL_SCHEMA = "cce.proposal-id.v1"
 _AUTHORITY_KINDS = frozenset({"requirement", "constraint", "decision", "assumption", "task"})
+_INVALIDATION_OPERATIONS = frozenset({"confirm_invalidation", "reject_invalidation"})
+_NOTICE_SCHEMA = "cce.contradiction-notice.v1"
 # Version of the statement normalization contract that feeds stable_node_id.
 # It is deliberately separate from the extractor version: pattern behavior can
 # change without changing identity, while an identity change survives forever
@@ -141,8 +143,8 @@ _CONTINUITY_STATE_FIELDS = (
 _AUTHORIZED_ASSOCIATIONS = TRUSTED_ASSOCIATIONS
 
 _VOLATILE_PROJECTION_KEYS = {
-    "captured_at", "checked_at", "completed_at", "composed_at", "created_at",
-    "decided_at", "fired_at", "generated_at", "packet_generation_time",
+    "captured_at", "checked_at", "completed_at", "composed_at", "confirmed_at",
+    "created_at", "decided_at", "fired_at", "generated_at", "packet_generation_time",
     "ran_at", "started_at", "superseded_at",
 }
 _INTERNAL_RANDOM_ID = re.compile(
@@ -171,6 +173,15 @@ def _authority_request(request: dict) -> dict:
             required.add("authority_scope")
         optional = {"note"}
         binding = "confirmation"
+    elif isinstance(operation, str) and operation in _INVALIDATION_OPERATIONS:
+        # The human gate of CI-005, as a canonical decision: accepting or
+        # rejecting a pending invalidation binds the exact pending revision,
+        # so a notice re-fired or already decided under another request
+        # cannot be confirmed by a stale operand set (ADR-133).
+        required = common | {"invalidation_id", "expected_invalidation_version",
+                             "expected_invalidation_digest"}
+        optional = {"note"}
+        binding = "invalidation"
     else:
         raise ValueError("unknown authority operation")
     if not required <= request.keys() or request.keys() - required - optional:
@@ -212,6 +223,8 @@ def _authority_request(request: dict) -> dict:
 
 
 def _confirmation_id(event: dict, request: dict) -> str:
+    if request["operation"] in _INVALIDATION_OPERATIONS:
+        return request["invalidation_id"]
     if request["operation"] != "confirm":
         return request["confirmation_id"]
     basis = [_AUTHORITY_SCHEMA, event["tenant_id"], event["project_id"], event["event_id"]]
@@ -2451,6 +2464,27 @@ class Engine:
                 "expected_confirmation_digest": digest_obj(state),
                 "authority_scope": state["authority_scope"]}
 
+    def authority_invalidation(self, project_id: str, invalidation_id: str) -> dict:
+        """Return exact request operands for a pending invalidation; this is not
+        an authorization operation (ADR-133).
+
+        The digest covers the pending revision's semantic data with processor
+        wall clocks removed, so the same operands bind on live ingest and on
+        canonical replay.
+        """
+        self._require_project(project_id)
+        try:
+            inv = self.graph.get(invalidation_id, tenant_id=self.tenant_id,
+                                 project_id=project_id, entity_type="invalidation")
+        except KeyError:
+            raise ValueError("unknown invalidation") from None
+        if inv["status"] != "pending_confirmation":
+            raise ValueError("invalidation is not pending confirmation")
+        return {"invalidation_id": invalidation_id,
+                "expected_invalidation_version": inv["version"],
+                "expected_invalidation_digest": digest_obj(self._projection_value(
+                    inv["data"], {}, anonymize_unknown_ids=False))}
+
     def authority_is_current(self, node: dict) -> bool:
         """Canonical authority witness, not human authentication or status resolution.
 
@@ -2484,6 +2518,11 @@ class Engine:
     def _validate_authority_operands(self, project_id: str, request: dict) -> dict | None:
         if request["tenant_id"] != self.tenant_id or request["project_id"] != project_id:
             raise PermissionError("authority request is outside the local project")
+        if request["operation"] in _INVALIDATION_OPERATIONS:
+            binding = self.authority_invalidation(project_id, request["invalidation_id"])
+            if any(request[key] != value for key, value in binding.items()):
+                raise ValueError("authority request does not bind the pending invalidation")
+            return None
         if request["operation"] == "confirm":
             binding = self.authority_proposal(project_id, request["proposal_id"])
             if any(request[key] != value for key, value in binding.items()):
@@ -2710,6 +2749,15 @@ class Engine:
     def _process_authority_decision(self, event: dict, report: dict) -> None:
         request = self._authority_payload(event)
         project_id = event["project_id"]
+        if request["operation"] in _INVALIDATION_OPERATIONS:
+            self._validate_authority_operands(project_id, request)
+            inv = self.invalidation.confirm(
+                request["invalidation_id"], actor="owner-local",
+                accept=request["operation"] == "confirm_invalidation",
+                event_id=event["event_id"])
+            report["invalidations"].append(inv["node_id"])
+            report["created"].append({"node_id": inv["node_id"], "kind": "invalidation"})
+            return
         state = self._validate_authority_operands(project_id, request)
         node_id = _confirmation_id(event, request)
         criticality = None
@@ -3182,6 +3230,8 @@ class Engine:
             if quarantined_block:
                 self.store.audit(actor="extractor", action="injection.quarantined",
                                  object_id=node.id, detail=item.statement[:200])
+        if not quarantined_block and authority_rank(authority) >= authority_rank("human_intent"):
+            self._notice_explicit_negations(event, text, report)
         if not quarantined_block:
             # Read producer history rather than current mutable metadata. An
             # unrelated field edit or equal restatement does not withdraw this
@@ -3231,6 +3281,56 @@ class Engine:
                             valid_to=event["recorded_at"], event_id=event_id)
         return not quarantined_block
 
+    def _notice_explicit_negations(self, event: dict, text: str, report: dict) -> None:
+        """Raise a human-gated notice when trusted prose explicitly negates an
+        active assumption (ADR-133).
+
+        "The feed is NOT ordered by timestamp" or "we no longer assume the feed
+        is ordered by timestamp", from an author the project trusts, fires a
+        `contradictory_evidence` invalidation in `pending_confirmation`: the
+        assumption and everything built on it are untouched until the owner
+        confirms or rejects the notice through the authority grammar (CI-005).
+        One notice per assumption; a rejected notice is not re-raised for the
+        same sentence. This reads nothing for meaning: only the assumption's
+        own wording with one negator, or a negated assumption cue, counts.
+        """
+        project_id = event["project_id"]
+        active = [node for node in self.graph.current(
+            project_id, "assumption", status=["active", "supported"], tenant_id=self.tenant_id)
+            if self.authority_is_current(node)]
+        if not active:
+            return
+        denied = explicit_negations(
+            text, {node["node_id"]: node["data"].get("statement", "") for node in active})
+        if not denied:
+            return
+        recorded = self.graph.current(
+            project_id, "invalidation", status=["open", "pending_confirmation", "rejected"],
+            tenant_id=self.tenant_id)
+        for node_id in sorted(denied):
+            try:
+                reason = validate_human_text(
+                    denied[node_id][:300], field="invalidation reason", max_length=300)
+            except ValueError:
+                # The sentence carried control characters; the notice still
+                # stands, the quoted text does not.
+                reason = "explicit negation of the assumption (sentence withheld)"
+            if any(inv["data"].get("trigger_type") == "contradictory_evidence"
+                   and inv["data"].get("target_node_id") == node_id
+                   and (inv["status"] != "rejected" or inv["data"].get("reason") == reason)
+                   for inv in recorded):
+                continue
+            # The identity derives from the ingest event and the target, so a
+            # later canonical decision that names it replays onto the same node.
+            notice_id = "inv_" + digest_obj(
+                [_NOTICE_SCHEMA, self.tenant_id, project_id, event["event_id"], node_id])[7:31]
+            inv = self.invalidation.fire(
+                tenant_id=self.tenant_id, project_id=project_id, target_node_id=node_id,
+                trigger_type="contradictory_evidence", trigger_confidence=0.9,
+                reason=reason, event_id=event["event_id"], requires_human=True,
+                invalidation_id=notice_id)
+            report["invalidations"].append(inv["node_id"])
+
     @staticmethod
     def _initial_status(entity_type: str, item, existing) -> str | None:
         if existing is not None:
@@ -4554,8 +4654,23 @@ class Engine:
                     + "; ".join(shape_errors))
             check = verify_envelope(proof, self.signer)
             if not check["valid"]:
-                raise PermissionError("completion rejected: proof envelope invalid"
-                                      " or tampered")
+                # Name the check that failed (PA-002). One undifferentiated
+                # message made an envelope under an unregistered key, or one
+                # whose recorded status no longer matches its contents, read
+                # exactly like an edited body, so the operator could not tell
+                # which of the four to repair. The gate phrase itself is
+                # unchanged: tests/test_instrument_validation.py keys on it.
+                failed = [name for name, ok in (
+                    ("digest", check.get("digest_ok")),
+                    ("signature", check.get("signature_ok")),
+                    ("authenticity", check.get("authentic")),
+                    ("sufficiency", check.get("sufficiency_ok", True)),
+                ) if not ok]
+                detail = check.get("reason")
+                raise PermissionError(
+                    "completion rejected: proof envelope invalid or tampered"
+                    f" (failed: {', '.join(failed) or 'unclassified'})"
+                    + (f": {detail}" if detail else ""))
             if proof.get("status") != "verified":
                 raise PermissionError(
                     f"completion rejected: proof status is {proof.get('status')!r},"

{causal_continuity_engine-0.2.0 → causal_continuity_engine-0.3.0}/causal_continuity_engine/extraction.py

@@ -31,7 +31,7 @@ from .core import canonical_json, strict_json_loads
 from .ontology import AUTHORITY_RANK, authority_rank
 
 EXTRACTOR_NAME = "cce-deterministic"
-EXTRACTOR_VERSION = "1.4.0"
+EXTRACTOR_VERSION = "1.5.0"
 
 
 @dataclass
@@ -92,6 +92,17 @@ _CLAUSE_TAIL = r"(?:[^.\n]|\.(?!\s|\Z)|" + _SOFT_WRAP + r")"
 # statement is worse than dropping one: nothing downstream can tell.
 _GAP = r"(?:[ \t]|" + _SOFT_WRAP + r")+"
 
+# A cue that is itself negated denies the assumption instead of making it.
+# "We no longer assume X" and "nothing relies on X" extracted the same positive
+# proposal as "We assume X", so a sentence written to retire an assumption
+# could, once confirmed, re-assert it. The negator has to stand immediately
+# before the cue (allowing only a pronoun or "to" in between); a `not`
+# elsewhere in the sentence is not read as denial (ADR-132).
+_NEGATED_CUE = re.compile(
+    r"(?:\bnot|n['\u2019]t|\bcannot|\bnever|\bno[ \t]+longer|\bstop(?:s|ped)?|"
+    r"\bwithout|\bnothing|\bnobody|\bno[ \t]+one)"
+    r"(?:[ \t]+(?:we|you|they|it|to|be))*[ \t]*\Z", re.I)
+
 # Patterns: (kind, regex, base_confidence)
 _PATTERNS: list[tuple[str, re.Pattern, float]] = [
     ("assumption", re.compile(
@@ -233,6 +244,10 @@ class DeterministicExtractor:
                 if _boundary_has_mark_or_zwj_continuation(text, raw_after):
                     result.abstained += 1
                     continue
+                if kind == "assumption" and _NEGATED_CUE.search(
+                        prose[max(0, m.start() - 40):m.start()]):
+                    result.abstained += 1
+                    continue
                 statement = _clean(
                     text[offsets[m.start("s")]:offsets[m.end("s")]])
                 if not _plausible(statement):
@@ -364,6 +379,90 @@ def normalize_statement(statement: str) -> str:
     return re.sub(r"\s+", " ", s).strip()
 
 
+# An explicit negation of a statement: the statement itself with exactly one
+# negator inserted after an auxiliary ("the feed is NOT ordered"), or a negated
+# assumption cue ("we no longer assume the feed is ordered"), or the assumption
+# named and called wrong. This is the same closed lexical control as ADR-119,
+# aimed at assumptions: it reads nothing for meaning, so "the feed arrives
+# unordered" is outside it and stays outside it on purpose (ADR-133).
+_SENTENCE_END = re.compile(r"(?<=[.!?])\s+|\n+")
+_AUXILIARY_NEGATION = re.compile(
+    r"\b(is|are|was|were|does|do|did|can|will|has|have|had|should|must|shall|would|could)"
+    r"(?:\s+not|n['\u2019]t|\s+never|\s+no\s+longer)\b", re.I)
+_IRREGULAR_NEGATION = (
+    (re.compile(r"\bcannot\b", re.I), "can"),
+    (re.compile(r"\bwon['\u2019]t\b", re.I), "will"),
+)
+_NEGATED_CUE_CLAUSE = re.compile(
+    r"(?:\bnot|n['\u2019]t|\bcannot|\bnever|\bno\s+longer|\bstop(?:s|ped)?|\bwithout|"
+    r"\bnothing|\bnobody|\bno\s+one)(?:\s+(?:we|you|they|it|to|be))*\s+"
+    r"(?:assum(?:e|es|ing|ption)(?:\s+that)?|rel(?:y|ies|ying)\s+on(?:\s+the\s+fact\s+that)?|"
+    r"depend(?:s|ing)?\s+on(?:\s+the\s+fact\s+that)?)\s+(?P<s>.+)", re.I)
+_ASSUMPTION_CALLED_WRONG = re.compile(
+    r"\bthe\s+assumption\s+that\s+(?P<s>.+?)\s+(?:is|was)\s+"
+    r"(?:wrong|false|incorrect|invalid|no\s+longer\s+(?:true|valid))\b", re.I)
+
+
+def _denial_candidates(sentence: str) -> list[str]:
+    """Statements a single sentence explicitly denies, before normalization."""
+    found = []
+    cue = _NEGATED_CUE_CLAUSE.search(sentence)
+    if cue:
+        found.append(cue.group("s"))
+    wrong = _ASSUMPTION_CALLED_WRONG.search(sentence)
+    if wrong:
+        found.append(wrong.group("s"))
+    positive, count = _AUXILIARY_NEGATION.subn(r"\1", sentence, count=1)
+    if count == 0:
+        for pattern, auxiliary in _IRREGULAR_NEGATION:
+            positive, count = pattern.subn(auxiliary, sentence, count=1)
+            if count:
+                break
+    if count == 1 and not _AUXILIARY_NEGATION.search(positive):
+        found.append(positive)
+    return found
+
+
+def explicit_negations(text: str, statements: dict[str, str]) -> dict[str, str]:
+    """Map each statement key that `text` explicitly denies to the denying
+    sentence (ADR-133).
+
+    `statements` maps an opaque key to a statement, normally an active
+    assumption's node id to its statement. Only prose is read: fenced code,
+    quotes and HTML comments are masked exactly as for extraction, and format
+    controls are removed before matching. Comparison uses the extractor's
+    normalized statement identity, so case, punctuation and stop words do not
+    matter but every content word does.
+    """
+    if not text or not statements:
+        return {}
+    wanted = {}
+    for key, statement in statements.items():
+        normalized = normalize_statement(statement or "")
+        if normalized:
+            wanted.setdefault(normalized, []).append(key)
+    if not wanted:
+        return {}
+    visible, _ = _without_invisibles(text)
+    denied: dict[str, str] = {}
+    for raw in _SENTENCE_END.split(_prose_only(visible)):
+        sentence = re.sub(r"\s+", " ", raw).strip().rstrip(".!?;:,")
+        if not sentence:
+            continue
+        # "Correction: the feed is not ordered" and "Checked the producer today:
+        # the feed is not ordered" carry one leading label or clause ending in a
+        # colon; it is not part of the statement being denied. The clause is
+        # bounded so a colon deep inside unrelated prose cannot manufacture one.
+        unlabelled = re.sub(r"^[^:]{1,80}:\s+", "", sentence)
+        candidates = _denial_candidates(sentence)
+        if unlabelled != sentence:
+            candidates += _denial_candidates(unlabelled)
+        for candidate in candidates:
+            for key in wanted.get(normalize_statement(candidate.rstrip(".!?;:,")), ()):
+                denied.setdefault(key, sentence)
+    return denied
+
+
 # Regions of a comment that are not the author asserting something. A fenced
 # block is code, and code comments are full of modal verbs; a blockquote is
 # someone else's words, frequently quoted in order to disagree with them; an