Skip to content

Fix receipt and callback digest split from a changing proposal #340

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aruintelligence merged 1 commit into from
Oct 14, 2026
Merged

Fix receipt and callback digest split from a changing proposal #340

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/action-boundary-vectors.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,33 +7,43 @@ on:
- "protocol/canonicalJson.js"
- "docs/action-dispatch-matrix.json"
- "docs/action-policy-tuple.json"
- "docs/action-snapshot-proof.json"
- "docs/action-dispatch-mutants.json"
- "docs/dispatch-matrix.html"
- "docs/dispatch-matrix.js"
- "docs/policy-tuple.html"
- "docs/policy-tuple.js"
- "docs/snapshot-binding.html"
- "docs/snapshot-binding.js"
- "test/action-boundary-dispatch-matrix.test.js"
- "test/action-boundary-policy-tuple.test.js"
- "test/action-boundary-snapshot-proof.test.js"
- "test/action-boundary-mutation-proof.test.js"
- "test/dispatch-matrix-view.test.js"
- "test/policy-tuple-view.test.js"
- "test/snapshot-binding-view.test.js"
- ".github/workflows/action-boundary-vectors.yml"
pull_request:
paths:
- "pilots/action-boundary/**"
- "protocol/canonicalJson.js"
- "docs/action-dispatch-matrix.json"
- "docs/action-policy-tuple.json"
- "docs/action-snapshot-proof.json"
- "docs/action-dispatch-mutants.json"
- "docs/dispatch-matrix.html"
- "docs/dispatch-matrix.js"
- "docs/policy-tuple.html"
- "docs/policy-tuple.js"
- "docs/snapshot-binding.html"
- "docs/snapshot-binding.js"
- "test/action-boundary-dispatch-matrix.test.js"
- "test/action-boundary-policy-tuple.test.js"
- "test/action-boundary-snapshot-proof.test.js"
- "test/action-boundary-mutation-proof.test.js"
- "test/dispatch-matrix-view.test.js"
- "test/policy-tuple-view.test.js"
- "test/snapshot-binding-view.test.js"
- ".github/workflows/action-boundary-vectors.yml"

permissions:
Expand All @@ -57,9 +67,13 @@ jobs:
- run: python3 pilots/action-boundary/verify_dispatch_matrix.py docs/action-dispatch-matrix.json
- run: node pilots/action-boundary/policy-tuple.mjs --check
- run: python3 pilots/action-boundary/verify_policy_tuple.py docs/action-policy-tuple.json
- run: node pilots/action-boundary/snapshot-proof.mjs --check
- run: python3 pilots/action-boundary/verify_snapshot_proof.py docs/action-snapshot-proof.json
- run: node pilots/action-boundary/dispatch-mutants.mjs --check
- run: node --test test/action-boundary-dispatch-matrix.test.js
- run: node --test test/action-boundary-policy-tuple.test.js
- run: node --test test/action-boundary-snapshot-proof.test.js
- run: node --test test/action-boundary-mutation-proof.test.js
- run: node --test test/dispatch-matrix-view.test.js
- run: node --test test/policy-tuple-view.test.js
- run: node --test test/snapshot-binding-view.test.js
2 changes: 2 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,6 +102,8 @@

**Two code paths, one published contract:** [Explore the JavaScript ↔ Python comparison](https://aruintelligence.github.io/aml-core/action-cross-runtime.html?case=mutated-while-awaiting). Both project-maintained implementations produce exact matching plans, receipts, callback counts, and frozen proposals on all 13 action-boundary cases. Run `node scripts/build-action-cross-runtime-report.mjs --check` to compare a fresh run with the visual page's checked-in machine report. This is cross-language engineering evidence for a limited JSON subset, not an independent external witness.

**A receipt must name the dispatched bytes:** [Inspect the snapshot-binding counterexample](https://aruintelligence.github.io/aml-core/snapshot-binding.html?mode=requires_approval#comparison). A changing JavaScript getter made the reference boundary hash one proposal for its receipt and pass another to the local callback. The boundary now canonicalizes and validates the caller proposal once, then uses that frozen value throughout planning, approval, receipt, and dispatch. Two local cases and a separate Python oracle check the fix; an exact source mutation reintroduces the mismatch. The three bounded suites detect 10/10 selected source changes, not arbitrary bugs or real delivery.

[![JavaScript and Python match on 13 published action-boundary cases; project-maintained evidence only.](docs/cross-runtime-proof.svg)](https://aruintelligence.github.io/aml-core/action-cross-runtime.html)

**After a timeout, no blind retry:** [Explore the dispatch ledger](https://aruintelligence.github.io/aml-core/dispatch-ledger.html?scenario=crash). A host-generated operation ID is bound to the exact proposal and claimed before a simulated callback. A two-process race yields one callback; a crash or callback error remains `unknown`, while a changed payload cannot reuse the ID. The six-scenario report is regenerated in CI. This is a local, project-maintained fail-closed pilot—not a distributed exactly-once or delivery guarantee.
Expand Down
248 changes: 245 additions & 3 deletions docs/action-dispatch-mutants.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,23 +2,27 @@
"protocol": "aml-action-dispatch-mutants/1",
"provenance": "project-authored exact source substitutions and local callbacks",
"limits": "Selected mutations and finite fixtures only. No external side effect, arbitrary bug coverage, outside witness, or formal proof of production safety.",
"boundary_source_sha256": "4a7d72c4df073c669312f614cad109ea487772c852e4cb00880e566fc9ad329f",
"boundary_source_sha256": "e0a16067f023a5281b22115f142f84c83fad29aeeec6327370cf0989aaecc11e",
"matrix_report_sha256": "2ccdb17341e4406960ec8e6f519d3d1a5dca7f8a4efa8a57d5c9b1b5c0b7c075",
"tuple_report_sha256": "988d17e701fff4d0b18cf68449d415786cf757a7fea93bc3bfd4f83d511635dd",
"snapshot_report_sha256": "12b891289014973e5d86327dc912d179b1537140557d4d120784116193f9477b",
"matrix_vectors": 384,
"tuple_cases": 8,
"snapshot_cases": 2,
"resource_probe_reference": {
"execution_status": "blocked",
"reason": "no_exact_rule",
"policy_decision": "deny",
"callback_count": 0
},
"summary": {
"selected_mutants": 9,
"selected_mutants": 10,
"matrix_detected": 7,
"tuple_detected": 3,
"tuple_only_detected": 2,
"combined_detected": 9,
"snapshot_detected": 3,
"snapshot_only_detected": 1,
"combined_detected": 10,
"undetected": 0
},
"mutations": [
Expand Down Expand Up @@ -76,6 +80,8 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -138,6 +144,49 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 1,
"snapshot_changes": [
{
"index": 1,
"mode": "requires_approval",
"reference": {
"mode": "requires_approval",
"accessor_reads": 1,
"approval_requests": 1,
"approval_digest": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"claim_attempts": 1,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
},
"mutant": {
"mode": "requires_approval",
"accessor_reads": 1,
"approval_requests": 1,
"approval_digest": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"claim_attempts": 0,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
}
}
],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -200,6 +249,8 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -262,6 +313,8 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -324,6 +377,89 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 2,
"snapshot_changes": [
{
"index": 0,
"mode": "allow",
"reference": {
"mode": "allow",
"accessor_reads": 1,
"approval_requests": 0,
"approval_digest": null,
"claim_attempts": 0,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "allow",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
},
"mutant": {
"mode": "allow",
"accessor_reads": 2,
"approval_requests": 0,
"approval_digest": null,
"claim_attempts": 0,
"callback_count": 1,
"callback_body": "Changed on second read",
"callback_sha256": "3ccbe74259301cf7521a83652ae2e8f2fdf0f56c9542e97574bff66e296633cc",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "allow",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": false
}
},
{
"index": 1,
"mode": "requires_approval",
"reference": {
"mode": "requires_approval",
"accessor_reads": 1,
"approval_requests": 1,
"approval_digest": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"claim_attempts": 1,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
},
"mutant": {
"mode": "requires_approval",
"accessor_reads": 2,
"approval_requests": 1,
"approval_digest": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"claim_attempts": 1,
"callback_count": 1,
"callback_body": "Changed on second read",
"callback_sha256": "3ccbe74259301cf7521a83652ae2e8f2fdf0f56c9542e97574bff66e296633cc",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": false
}
}
],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -386,6 +522,8 @@
},
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -475,6 +613,8 @@
"callback_count": 1
}
},
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": true,
"resource_probe_result": {
"execution_status": "dispatched",
Expand Down Expand Up @@ -517,6 +657,8 @@
"callback_count": 1
}
},
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down Expand Up @@ -559,6 +701,106 @@
"callback_count": 1
}
},
"snapshot_changed_cases": 0,
"snapshot_changes": [],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
"reason": "no_exact_rule",
"policy_decision": "deny",
"callback_count": 0
}
},
{
"id": "double_snapshot_receipt_split",
"change": "Read a changing caller proposal again after planning",
"matrix_changed_rows": 0,
"first_changed_vector": null,
"tuple_changed_cases": 0,
"first_changed_tuple": null,
"snapshot_changed_cases": 2,
"snapshot_changes": [
{
"index": 0,
"mode": "allow",
"reference": {
"mode": "allow",
"accessor_reads": 1,
"approval_requests": 0,
"approval_digest": null,
"claim_attempts": 0,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "allow",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
},
"mutant": {
"mode": "allow",
"accessor_reads": 2,
"approval_requests": 0,
"approval_digest": null,
"claim_attempts": 0,
"callback_count": 1,
"callback_body": "Changed on second read",
"callback_sha256": "3ccbe74259301cf7521a83652ae2e8f2fdf0f56c9542e97574bff66e296633cc",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "allow",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": false
}
},
{
"index": 1,
"mode": "requires_approval",
"reference": {
"mode": "requires_approval",
"accessor_reads": 1,
"approval_requests": 1,
"approval_digest": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"claim_attempts": 1,
"callback_count": 1,
"callback_body": "First observed body",
"callback_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": true
},
"mutant": {
"mode": "requires_approval",
"accessor_reads": 2,
"approval_requests": 1,
"approval_digest": "3ccbe74259301cf7521a83652ae2e8f2fdf0f56c9542e97574bff66e296633cc",
"claim_attempts": 1,
"callback_count": 1,
"callback_body": "Changed on second read",
"callback_sha256": "3ccbe74259301cf7521a83652ae2e8f2fdf0f56c9542e97574bff66e296633cc",
"receipt": {
"protocol": "aml-action-dispatch/1",
"proposal_sha256": "92450646537d3defc7e639d7450a8cdbdd15fb12288668fa9f31eb8a2482b6f5",
"policy_decision": "requires_approval",
"execution_status": "dispatched",
"reason": "host_dispatch_returned"
},
"receipt_matches_callback": false
}
}
],
"resource_probe_changed": false,
"resource_probe_result": {
"execution_status": "blocked",
Expand Down
Loading
Loading