gargoyle-receipts 0.14.1.dev0__tar.gz → 0.15.0.dev0__tar.gz

{gargoyle_receipts-0.14.1.dev0/gargoyle_receipts.egg-info → gargoyle_receipts-0.15.0.dev0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.14.1.dev0
+Version: 0.15.0.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.14.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.15.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -383,6 +383,7 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | issuer `GARGOYLE_WITNESS_PATH` | the issuer's signed, hash-chained record of every decision (`gargoyle issuer` sets `witness.jsonl` beside the keys); `gargoyle audit --witness` reconciles a client's evidence against it, `--check-tree DIR` finds files changed outside the gate |
 | issuer `GARGOYLE_LOG_JSON` | one JSON line per decision on stderr: issued, refused, granted, declined, plan, enrolled |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
+| `GARGOYLE_MCP_INSTRUCTIONS` | replaces the standing instructions the gate hands the model in the MCP handshake (default: all work on the target goes through these tools, a wait is normal, a refusal is final, plans and undo exist); the user never has to name the server |
 | `GARGOYLE_MCP_STATE_PROBE` | `filesystem` (default) binds a held file write to the file's current state: the approver sees the change as a diff, the call refuses if the file moved before the run (`REF_VERIFY_STATE_MISMATCH`), and the execution receipt records pre and post state; `none` disables |
 | `GARGOYLE_MCP_ADAPTER_SPEC` | with `GARGOYLE_MCP_STATE_PROBE=graph`: the tool-to-resource mapping JSON (default: the reference naming) |
 | `GARGOYLE_MCP_UPSTREAM_URL`, `GARGOYLE_MCP_UPSTREAM_TOKEN` | remote mode: the MCP server to front over Streamable HTTP, and its bearer |

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/README.md

@@ -21,7 +21,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.14.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.15.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -345,6 +345,7 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | issuer `GARGOYLE_WITNESS_PATH` | the issuer's signed, hash-chained record of every decision (`gargoyle issuer` sets `witness.jsonl` beside the keys); `gargoyle audit --witness` reconciles a client's evidence against it, `--check-tree DIR` finds files changed outside the gate |
 | issuer `GARGOYLE_LOG_JSON` | one JSON line per decision on stderr: issued, refused, granted, declined, plan, enrolled |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
+| `GARGOYLE_MCP_INSTRUCTIONS` | replaces the standing instructions the gate hands the model in the MCP handshake (default: all work on the target goes through these tools, a wait is normal, a refusal is final, plans and undo exist); the user never has to name the server |
 | `GARGOYLE_MCP_STATE_PROBE` | `filesystem` (default) binds a held file write to the file's current state: the approver sees the change as a diff, the call refuses if the file moved before the run (`REF_VERIFY_STATE_MISMATCH`), and the execution receipt records pre and post state; `none` disables |
 | `GARGOYLE_MCP_ADAPTER_SPEC` | with `GARGOYLE_MCP_STATE_PROBE=graph`: the tool-to-resource mapping JSON (default: the reference naming) |
 | `GARGOYLE_MCP_UPSTREAM_URL`, `GARGOYLE_MCP_UPSTREAM_TOKEN` | remote mode: the MCP server to front over Streamable HTTP, and its bearer |

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/gargoyle/cli.py

@@ -375,9 +375,16 @@ def cmd_audit(args) -> int:
             print("witness: %d entries, %s, tail %s" % (w["count"], w["reason"], w["tail_sha256"][:16]))
             principal = next((e.get("principal") for e in entries if isinstance(e, dict) and e.get("principal")), None)
             r = reconcile(entries, read_witness(args.witness), principal=principal)
+            older = [f for f in r["findings"] if f["finding"] == "PREDATES_WITNESS"]
             for f in r["findings"]:
+                if f["finding"] == "PREDATES_WITNESS":
+                    continue
                 print("  FINDING %-22s %s" % (f["finding"], " ".join("%s=%s" % (k, str(v)[:40]) for k, v in f.items() if k != "finding")))
-            print("reconciled: %d issued by the issuer, %d in evidence, %d finding(s)" % (r["issued"], r["evidence_with_receipt"], len(r["findings"])))
+            if older:
+                print("  note: %d honored row(s) predate the witness (started %s) and cannot be vouched for either way: seq %s"
+                      % (len(older), (r.get("horizon") or "?")[:19], ", ".join(str(f["seq"]) for f in older[:12]) + (" ..." if len(older) > 12 else "")))
+            hard = len(r["findings"]) - len(older)
+            print("reconciled: %d issued by the issuer, %d in evidence, %d finding(s)" % (r["issued"], r["evidence_with_receipt"], hard))
             rc = rc or (0 if (w["accepted"] and r["accepted"]) else 1)
         if args.check_tree:
             # Every file the gate wrote must still be as the gate left it.

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/gargoyle/mcp_server.py

@@ -100,6 +100,7 @@ ENV_POLL_SECONDS = "GARGOYLE_MCP_POLL_SECONDS"
 ENV_AUDIT_LOG = "GARGOYLE_MCP_AUDIT_LOG"
 ENV_STATE_PROBE = "GARGOYLE_MCP_STATE_PROBE"
 ENV_ADAPTER_SPEC = "GARGOYLE_MCP_ADAPTER_SPEC"    # with GARGOYLE_MCP_STATE_PROBE=graph: the tool mapping JSON
+ENV_INSTRUCTIONS = "GARGOYLE_MCP_INSTRUCTIONS"   # override the standing instructions the gate gives the model (default: gate_instructions())
 ENV_SNAPSHOT_DIR = "GARGOYLE_MCP_SNAPSHOT_DIR"   # where pre-change snapshots live (default: snapshots/ beside the audit log); "none" disables undo   # "filesystem" (default): bind held calls to the target file's state; "none" to disable
 REF_TARGET_LOGIN_REQUIRED = "REF_TARGET_LOGIN_REQUIRED"   # Entra login mode and no usable token: run `gargoyle login`   # the evidence log: one hash-chained JSON line per decision, honored or refused
 
@@ -284,6 +285,26 @@ def _without_gargoyle_meta(params: Dict[str, Any]) -> Dict[str, Any]:
     return forwarded
 
 
+def gate_instructions(target_id: str, upstream_instructions: Optional[str] = None, override: Optional[str] = None) -> str:
+    """The standing instructions an MCP server may hand the model in its
+    initialize answer; clients place them in the model's context for the
+    session. This is how the gate is mandated rather than named by the
+    user each time: the model is told, by the server itself, that all work
+    on this target goes through these tools, that a refusal is final, and
+    that there is nothing to type. The upstream's own instructions, if
+    any, follow the gate's."""
+    text = override if override else (
+        "Every operation on %s goes through this server's tools; do not use any other tool, built-in "
+        "capability or workaround for that target. Reads run at once. A write may pause for a human "
+        "approval: wait for the result, it is normal. A refused call is a decision, not an error: report "
+        "the reason to the user and stop; do not retry or route around it. For a task with several "
+        "writes, gargoyle_plan may ask for one approval covering them; gargoyle_revert undoes an approved "
+        "change through the same approval. The user never needs to name this server." % target_id)
+    if upstream_instructions:
+        text += "\n\n" + upstream_instructions
+    return text
+
+
 def client_label(params: Any) -> Optional[str]:
     """"name version" from an initialize request's clientInfo, or None."""
     info = params.get("clientInfo") if isinstance(params, dict) else None
@@ -348,6 +369,8 @@ class ServerState:
             )
         self.executed: List[Dict[str, Any]] = []
         self.plans: List[Dict[str, Any]] = []     # approved scoped grants: {"plan", "grants", "consumed": set()}
+        import os as _os
+        self.instructions: Optional[str] = _os.environ.get(ENV_INSTRUCTIONS) or None
         self.initialized = False
         self.client: Optional[str] = None     # "name version" from the MCP initialize handshake
 
@@ -576,6 +599,9 @@ def handle_message(state: ServerState, msg: Dict[str, Any]) -> Optional[Dict[str
         if method == "initialize":
             state.client = client_label(params)
         reply = _relay(state, msg)
+        if method == "initialize" and isinstance(reply, dict) and isinstance(reply.get("result"), dict) and state.config:
+            reply["result"]["instructions"] = gate_instructions(state.config.get("target_id", "the gated target"),
+                                                                reply["result"].get("instructions"), state.instructions)
         if method == "tools/list" and state.snapshots is not None and isinstance(reply, dict) \
                 and isinstance(reply.get("result"), dict) and isinstance(reply["result"].get("tools"), list):
             from gargoyle.revert import REVERT_TOOL_DEF
@@ -595,6 +621,7 @@ def handle_message(state: ServerState, msg: Dict[str, Any]) -> Optional[Dict[str
                 "protocolVersion": PROTOCOL_VERSION,
                 "capabilities": {"tools": {"listChanged": False}},
                 "serverInfo": SERVER_INFO,
+                "instructions": gate_instructions((state.config or {}).get("target_id", "the gated target"), None, state.instructions),
             },
         )
 

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/gargoyle/reconcile.py

@@ -2,6 +2,7 @@
 the gated folder against the evidence.
 
 Findings, never silently fixed:
+  PREDATES_WITNESS      evidence from before the witness began; it can be vouched for neither way (information)
   UNWITNESSED_RECEIPT   evidence honors a decision the issuer never issued (forged or foreign)
   UNWITNESSED_RELEASE   a held call was honored but the issuer saw no grant for its hold (or plan)
   MISSING_EVIDENCE      the issuer issued a receipt to this principal and the client recorded nothing
@@ -33,9 +34,12 @@ def reconcile(evidence: Iterable[Any], witness: Iterable[Any], *, principal: Opt
     issued: Dict[str, Dict[str, Any]] = {}
     granted: Dict[str, List[Dict[str, Any]]] = {}
     plan_granted: Dict[str, List[Dict[str, Any]]] = {}
+    horizon: Optional[datetime] = None
     for w in witness:
         if not isinstance(w, dict):
             continue
+        if horizon is None:
+            horizon = _parse(w.get("at"))
         if w.get("event") == "issued" and isinstance(w.get("decision_id"), str):
             issued[w["decision_id"]] = w
         elif w.get("event") == "granted" and isinstance(w.get("approval_request_id"), str):
@@ -54,7 +58,11 @@ def reconcile(evidence: Iterable[Any], witness: Iterable[Any], *, principal: Opt
         w = issued.get(did)
         if e.get("kind") == "honored":
             if w is None:
-                findings.append({"finding": "UNWITNESSED_RECEIPT", "seq": e.get("seq"), "decision_id": did, "tool": e.get("tool")})
+                at_e = _parse(e.get("at"))
+                if horizon is not None and at_e is not None and at_e < horizon:
+                    findings.append({"finding": "PREDATES_WITNESS", "seq": e.get("seq"), "decision_id": did, "tool": e.get("tool")})
+                else:
+                    findings.append({"finding": "UNWITNESSED_RECEIPT", "seq": e.get("seq"), "decision_id": did, "tool": e.get("tool")})
                 continue
             if w.get("decision_sha256") != receipt.get("decision_sha256") or w.get("principal") != receipt.get("request_context", {}).get("principal"):
                 findings.append({"finding": "UNWITNESSED_RECEIPT", "seq": e.get("seq"), "decision_id": did, "tool": e.get("tool")})
@@ -78,7 +86,8 @@ def reconcile(evidence: Iterable[Any], witness: Iterable[Any], *, principal: Opt
             continue
         findings.append({"finding": "MISSING_EVIDENCE", "decision_id": did, "tool": w.get("tool"), "principal": w.get("principal"),
                          "held": bool(w.get("held")), "at": w.get("at")})
-    return {"accepted": not findings, "findings": findings,
+    hard = [f for f in findings if f["finding"] != "PREDATES_WITNESS"]
+    return {"accepted": not hard, "findings": findings, "horizon": horizon.isoformat() if horizon else None,
             "issued": len(issued), "evidence_with_receipt": len(seen_decisions)}
 
 

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/gargoyle/remote.py

@@ -168,6 +168,10 @@ def build_remote_app(
             upstream_init["serverInfo"] = {"name": "gargoyle+" + str(upstream_init.get("serverInfo", {}).get("name", "upstream")),
                                            "version": SERVER_INFO["version"]}
         upstream.send({"jsonrpc": "2.0", "method": "notifications/initialized"})
+    from gargoyle.mcp_server import gate_instructions
+    import os as _os
+    upstream_init["instructions"] = gate_instructions(config.get("target_id", "the gated target"), upstream_init.get("instructions"),
+                                                      _os.environ.get("GARGOYLE_MCP_INSTRUCTIONS") or None)
 
     def new_state(principal: str, issuer_token: str) -> ServerState:
         nonlocal shared_evidence, shared_snapshots

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/gargoyle/witness.py

@@ -64,10 +64,12 @@ class WitnessLog:
                     self.entries.append(e)
                     self._seq, self._tail = int(e["seq"]), e["entry_sha256"]
         elif self.path is not None:
-            # Exists from the first start, so an operator can copy it before
-            # the first decision and a monitor can see it is in place.
             self.path.parent.mkdir(parents=True, exist_ok=True)
             self.path.touch()
+        # Every start is on record: the first "started" entry is the witness's
+        # horizon (evidence older than it cannot be vouched for either way),
+        # and later ones mark restarts for the operator.
+        self.record("started", resumed=bool(self.entries))
 
     def record(self, event: str, **fields: Any) -> Dict[str, Any]:
         with self._lock:

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0/gargoyle_receipts.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gargoyle-receipts
-Version: 0.14.1.dev0
+Version: 0.15.0.dev0
 Summary: Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls.
 Author: Justin LaPorte
 License-Expression: Apache-2.0
@@ -59,7 +59,7 @@ your MCP server and lets through only what both agreed to.
 
 [![PyPI](https://img.shields.io/pypi/v/gargoyle-receipts)](https://pypi.org/project/gargoyle-receipts/)
 
-Status: pre-release (`0.14.1.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
+Status: pre-release (`0.15.0.dev0`, on PyPI as `gargoyle-receipts`). The wire format is `gargoyle/3` and may
 still change before the first release; it is specified in [SPEC.md](SPEC.md).
 
 ## What a receipt gives you
@@ -383,6 +383,7 @@ cannot attach receipts work unchanged. Configuration is by environment:
 | issuer `GARGOYLE_WITNESS_PATH` | the issuer's signed, hash-chained record of every decision (`gargoyle issuer` sets `witness.jsonl` beside the keys); `gargoyle audit --witness` reconciles a client's evidence against it, `--check-tree DIR` finds files changed outside the gate |
 | issuer `GARGOYLE_LOG_JSON` | one JSON line per decision on stderr: issued, refused, granted, declined, plan, enrolled |
 | `GARGOYLE_HOLD_WEBHOOK_URL`, `GARGOYLE_APPROVE_URL` | issuer: POST a notice of every new hold (Slack incoming-webhook shape, `text` plus the hold) with a link to the console; notice only, the grant still needs the approver's key |
+| `GARGOYLE_MCP_INSTRUCTIONS` | replaces the standing instructions the gate hands the model in the MCP handshake (default: all work on the target goes through these tools, a wait is normal, a refusal is final, plans and undo exist); the user never has to name the server |
 | `GARGOYLE_MCP_STATE_PROBE` | `filesystem` (default) binds a held file write to the file's current state: the approver sees the change as a diff, the call refuses if the file moved before the run (`REF_VERIFY_STATE_MISMATCH`), and the execution receipt records pre and post state; `none` disables |
 | `GARGOYLE_MCP_ADAPTER_SPEC` | with `GARGOYLE_MCP_STATE_PROBE=graph`: the tool-to-resource mapping JSON (default: the reference naming) |
 | `GARGOYLE_MCP_UPSTREAM_URL`, `GARGOYLE_MCP_UPSTREAM_TOKEN` | remote mode: the MCP server to front over Streamable HTTP, and its bearer |

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "gargoyle-receipts"
-version = "0.14.1.dev0"
+version = "0.15.0.dev0"
 description = "Signed, single-use, argument-bound receipts and human-approval holds for agent tool calls."
 readme = "README.md"
 requires-python = ">=3.12"

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/tests/test_mcp_self_issue.py

@@ -229,3 +229,27 @@ def test_every_decision_lands_in_the_evidence_log(tmp_path):
                    approver_public_keys={"approver-alice": approver.public_key()})
     assert v["accepted"] and (v["honored"], v["refused"]) == (1, 2)
     assert [r["reason"] for r in v["entries"]] == [ACCEPT_CHAIN_VERIFIED, ACCEPT_ENTRY_VERIFIED, ACCEPT_ENTRY_VERIFIED]
+
+
+def test_the_gate_hands_the_model_standing_instructions(monkeypatch):
+    """The initialize answer carries instructions in both modes, so the user
+    never has to name the server; an operator may override the text."""
+    from gargoyle.mcp_server import gate_instructions
+    client = TestClient(issuer_app())
+    state = middleware(client)
+    r = handle_message(state, {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}})
+    text = r["result"]["instructions"]
+    assert TARGET in text and "do not use any other tool" in text and "gargoyle_plan" in text and "never needs to name this server" in text
+    # Through a real upstream, the upstream's own instructions follow the gate's.
+    fixture = str(Path(__file__).parent / "fixtures" / "echo_mcp_server.py")
+    up = StdioUpstream([sys.executable, "-I", fixture])
+    try:
+        state = middleware(client); state.upstream = up
+        r = handle_message(state, {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}})
+        assert r["result"]["instructions"].startswith("Every operation on " + TARGET)
+    finally:
+        up.close()
+    monkeypatch.setenv("GARGOYLE_MCP_INSTRUCTIONS", "House rule: files only.")
+    state = middleware(client)
+    assert handle_message(state, {"jsonrpc": "2.0", "id": 1, "method": "initialize", "params": {}})["result"]["instructions"] == "House rule: files only."
+    assert gate_instructions("t", "Upstream says hi").endswith("Upstream says hi")

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/tests/test_remote.py

@@ -79,6 +79,7 @@ def test_remote_gate_over_stdio_upstream(tmp_path):
         assert r.status_code == 200 and r.headers[SESSION_HEADER]
         sid = r.headers[SESSION_HEADER]
         assert r.json()["result"]["serverInfo"]["name"].startswith("gargoyle+")
+        assert "do not use any other tool" in r.json()["result"]["instructions"]
         assert rpc(c, alice, {"jsonrpc": "2.0", "method": "notifications/initialized"}, sid).status_code == 202
         # Tools: the upstream's plus undo.
         tools = rpc(c, alice, {"jsonrpc": "2.0", "id": 2, "method": "tools/list", "params": {}}, sid).json()["result"]["tools"]

{gargoyle_receipts-0.14.1.dev0 → gargoyle_receipts-0.15.0.dev0}/tests/test_witness.py

@@ -46,12 +46,13 @@ def test_witness_entries_are_signed_and_chained(tmp_path):
     again.record("declined", approval_request_id="r-2")
     entries = read_witness(str(tmp_path / "w.jsonl"))
     v = verify_witness(entries, issuer_public_keys=ISSUER_KEYS)
-    assert v["accepted"] and v["count"] == 3 and [e["seq"] for e in entries] == [1, 2, 3]
-    forged = dict(entries[1], approver="mallory")
-    assert verify_witness([entries[0], forged, entries[2]], issuer_public_keys=ISSUER_KEYS)["entries"][1]["reason"] == REF_WITNESS_HASH_MISMATCH
+    assert v["accepted"] and v["count"] == 5 and [e["event"] for e in entries] == ["started", "issued", "granted", "started", "declined"]
+    assert entries[3]["resumed"] is True and entries[0]["resumed"] is False
+    forged = dict(entries[2], approver="mallory")
+    assert verify_witness(entries[:2] + [forged] + entries[3:], issuer_public_keys=ISSUER_KEYS)["entries"][2]["reason"] == REF_WITNESS_HASH_MISMATCH
     from gargoyle.witness import entry_sha256
     forged["entry_sha256"] = entry_sha256(forged)              # rehashed, but the issuer did not sign it
-    assert verify_witness([entries[0], forged], issuer_public_keys=ISSUER_KEYS)["entries"][1]["reason"] == REF_WITNESS_SIGNATURE_INVALID
+    assert verify_witness(entries[:2] + [forged], issuer_public_keys=ISSUER_KEYS)["entries"][2]["reason"] == REF_WITNESS_SIGNATURE_INVALID
     assert not verify_witness(entries, issuer_public_keys={"other": executor.public_key()})["accepted"]
 
 
@@ -95,14 +96,18 @@ def test_honest_evidence_reconciles_and_tampering_is_found(tmp_path):
     finally:
         up.close()
     evidence = read_log(str(tmp_path / "audit.jsonl")); witness = read_witness(str(tmp_path / "witness.jsonl"))
-    assert [e["event"] for e in witness] == ["issued", "issued", "granted"]
+    assert [e["event"] for e in witness] == ["started", "issued", "issued", "granted"]
     assert evidence[1]["ref"] == str(root / "n.md") and evidence[1]["evidence_version"] == "gargoyle-evidence/4"
     assert verify_log(evidence, issuer_public_keys=ISSUER_KEYS, executor_public_keys={"executor-1": executor.public_key()},
                       approver_public_keys={"approver-1": approver.public_key()})["accepted"]
     r = reconcile(evidence, witness, principal=PRINCIPAL)
     assert r["accepted"] and r["issued"] == 2 and r["evidence_with_receipt"] == 2
     # The witness is served to an authenticated caller too.
-    assert len(c.get("/witness", headers=h).json()["entries"]) == 3
+    assert len(c.get("/witness", headers=h).json()["entries"]) == 4
+    # Evidence from before the witness began is information, not a finding.
+    old = dict(evidence[0], at="2026-01-01T00:00:00+00:00", receipt=dict(evidence[0]["receipt"], decision_id="before-the-witness"))
+    r = reconcile(evidence + [old], witness, principal=PRINCIPAL)      # beside the real rows, not in place of one
+    assert r["accepted"] and [f["finding"] for f in r["findings"]] == ["PREDATES_WITNESS"] and r["horizon"]
 
     # 1. A forged honored entry for a decision the issuer never issued: the user holds the executor key, so it verifies alone.
     now = datetime.now(timezone.utc)
@@ -145,7 +150,7 @@ def test_audit_command_reports_reconciliation_and_tree(tmp_path, capsys):
     assert main(["audit", "--log", str(tmp_path / "audit.jsonl"), "--out", str(out), "--witness", str(tmp_path / "witness.jsonl"),
                  "--check-tree", str(root)]) == 0
     text = capsys.readouterr().out
-    assert "witness: 2 entries, WITNESS_VERIFIED" in text and "0 finding(s)" in text and "1 gated file(s) checked" in text
+    assert "witness: 3 entries, WITNESS_VERIFIED" in text and "0 finding(s)" in text and "1 gated file(s) checked" in text
     (root / "n.md").write_text("tampered", encoding="utf-8")
     assert main(["audit", "--log", str(tmp_path / "audit.jsonl"), "--out", str(out), "--check-tree", str(root)]) == 1
     assert "CHANGED_OUTSIDE_GATE" in capsys.readouterr().out
@@ -162,4 +167,4 @@ def test_audit_names_a_missing_witness_or_folder_plainly(tmp_path, capsys):
     assert "not a directory" in capsys.readouterr().err
     # The issuer creates the witness file at start, before any decision.
     w = WitnessLog(str(tmp_path / "fresh" / "witness.jsonl"), issuer, "issuer-1")
-    assert (tmp_path / "fresh" / "witness.jsonl").exists() and w.entries == []
+    assert (tmp_path / "fresh" / "witness.jsonl").exists() and [e["event"] for e in w.entries] == ["started"]