Liberty Stack: 10-point deletion gate + LibertyContextRecord contract - #26
Merged
Conversation
Fills the Agentic Liberty Stack gaps (from the spec-intake analysis) over exodus's existing zone-gate + ForensicBundle (the evidence bundle already exists as exodus_bundle.py). - scripts/exodus_deletion_gate.py: executable 10-point deletion gate over a DeletionEligibilityRecord. Fail-closed: a source is deletion-eligible ONLY when all ten preconditions hold (raw captured/hashed, normalized import + destination parity, proof pack, dependency graph clean, downstream sign-in preserved, redaction review, cooldown elapsed, restore-to-staging passed [restore-proof, not import-succeeded], human DELETE_APPROVAL recorded, evidence bundle sealed + offsite). Missing boolean => NOT satisfied (fail-closed). - deletion-eligibility-record.schema.json extended with the (optional) restoreToStagingPassed, evidenceBundleSealed, evidenceBundleRef, approvals[] — existing cooling-off example still validates; new fully-eligible example added. - packages/contracts/liberty-context-record.schema.json + validate_liberty_context_record.py + example: the canonical multi-plane semantic cell (plane RAW/EVENT/ENTITY/DERIVED/GLOBAL x truth_class x validity x merge x surfaces). Validator enforces core rules: RAW plane => overwrite_allowed=false (raw immutable); DERIVED => no OVERWRITE strategy. - ci.yml: both new gate/validator wired into CI (enforced at merge). Dependency-free gate/test (repo idiom); jsonschema validator. 4 gate tests + validators green; each of the 10 preconditions proven load-bearing.
…schema) exodus CI is dependency-light and has no jsonschema; the validator now does a stdlib structural check (required fields, enum membership, no-unexpected-keys, nested required/enum) plus the core rules. Verified: valid example passes; RAW+overwrite_allowed=true and bad enums fail.
Member
Author
|
Copilot reviewer did not post (intermittent this session). Self-review: the deletion gate is fail-closed (missing boolean = NOT satisfied; each of the 10 preconditions proven load-bearing by tests incl. cutover≠delete-approval and sealed-flag-without-ref); the LibertyContextRecord validator (now stdlib, no jsonschema — matching the repo's dependency-light CI) enforces required/enum structure + the core rules (RAW⇒immutable, DERIVED⇒no-overwrite). Both wired into CI; validate green. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fills the Agentic Liberty Stack gaps (from the spec-intake gap analysis)
exodus already had the zone-gate engine + ForensicBundle (the doc's evidence bundle — BLAKE3/SHA-256/Ed25519 sealed) + a DeletionEligibilityRecord data model. This adds the two genuine gaps.
1. Executable 10-point deletion gate (
scripts/exodus_deletion_gate.py)The doc's central invariant — deletion gated by restore proof, not "import succeeded". A source is deletion-eligible only when all ten preconditions hold, fail-closed (a missing boolean = NOT satisfied; any regression →
BLOCKED):raw captured · raw hashed/manifest · normalized import + destination parity · proof pack · dependency graph clean · downstream sign-in preserved · redaction review · cooldown elapsed · restore-to-staging passed · human DELETE_APPROVAL recorded · evidence bundle sealed + offsite.
deletion-eligibility-record.schema.jsonextended with optionalrestoreToStagingPassed/evidenceBundleSealed/evidenceBundleRef/approvals[](the existing cooling-off example still validates; a new fully-eligible example is added).2.
LibertyContextRecordcanonical contract (packages/contracts/liberty-context-record.schema.json)The one shared internal contract — a multi-plane semantic cell:
plane(RAW/EVENT/ENTITY/DERIVED/GLOBAL) ×truth_class(OBSERVED/ASSERTED/INFERRED/REPUTED) ×validity×merge×surfaces.validate_liberty_context_record.pyenforces the load-bearing core rules: RAW plane ⇒overwrite_allowed=false(raw evidence immutable); DERIVED ⇒ noOVERWRITEstrategy.CI
Both the deletion gate and the LibertyContextRecord validator are wired into
ci.yml— enforced at merge, dependency-free (repo idiom) / jsonschema.Verification
4 deletion-gate tests (fully-eligible passes; cooling-off blocked; each precondition load-bearing incl. cutover≠delete approval and sealed-flag-without-ref; missing-boolean fail-closed) + both validators green.
🤖 Generated with Claude Code