Skip to content

feat(uci): add admitted collective memory boundary - #278

Open
Tarik Skalić (tarikskalic33) wants to merge 30 commits into
feat/uci-5-atomic-admission-reference-v1from
feat/uci-6-collective-memory-admission-v1
Open

feat(uci): add admitted collective memory boundary#278
Tarik Skalić (tarikskalic33) wants to merge 30 commits into
feat/uci-5-atomic-admission-reference-v1from
feat/uci-6-collective-memory-admission-v1

Conversation

@tarikskalic33

@tarikskalic33 tarikskalic33 commented Aug 20, 2026

Copy link
Copy Markdown
Member

UCI-6 — Collective Memory Admission

Status: IMPLEMENTED / SECURITY-REVIEW HARDENED / RESTACKED / EXACT-HEAD VERIFIED / READY FOR REVIEW

Exact hardened stacked parent: #277@be07805af9887ff15272167740b07cf958c3137e
Exact reviewed head: 156062855a91b77133d8999ce34883432435b167

Established local/reference contract

  • arbitrary provider/tool/human observations enter only quarantined evidence memory with authority=EVIDENCE_ONLY and authority weight 0;
  • quarantine cannot self-promote into canonical memory;
  • canonical projection requires a persisted UCI-5 AdmissionRecordV1 re-read from the local admission store and exact TransitionIdentity.action_digest == MemoryProjectionRequestV1.root binding;
  • canonical memory remains evidence-only and does not imply proposition truth;
  • projection/control requests bind expected memory sequence + prior event root and re-check that pre-state inside the SQLite transaction;
  • revocation/supersession are append-only admitted control events, never destructive history edits;
  • direct use of the older prestate-less internal memory-store path fails closed through the normal API surface (MEMORY_INTERNAL_BASE_DIRECT_USE_FORBIDDEN);
  • no memory object grants capability, authority, execution permission, effect truth, or epistemic tier promotion.

UCI-6 security RED → GREEN

Independent UCI-6 diff review found the importable prestate-less internal memory-store path. A regression was committed before the patch:

RED_CANDIDATE = 46c474309254fc6909071ea4d8e79a0bbce48d47
RED_RUN = 32373063733
RED_JOB = 96437875969
PRIOR_UCI6_BASELINE = 24/24 PASS
INTERNAL_BASE_GUARD = 1 FAIL / 1 PASS
INTENDED_FAILURE = DID NOT RAISE CollectiveMemoryError

Focused GREEN:

CANDIDATE = 8a2d2d6859619e5dd69b2c12bb6627c0cfc7760c
RUN = 32373519415
JOB = 96439327563
RESULT = 26/26 PASS

Parent-chain hardening inherited by UCI-6

Parent #276 was independently reviewed and hardened after the first UCI-6 reviewed checkpoint. The inherited effect-evidence boundary now rejects ordinary fabricated EffectWitness construction, uses descriptor-relative POSIX O_NOFOLLOW containment for the local filesystem reference adapter, applies bounded streaming hashing, and locks its own frozen-parent CI contract. Parent #277 was then restacked and reverified on that hardened UCI-4 head.

Current reviewed parent evidence:

UCI4_PARENT = #276@bda5c5369b15ec91f2651ddbf6d219f6b7a1d0f6
UCI4_PROOFLINE = 85/85 PASS
UCI5_PARENT = #277@be07805af9887ff15272167740b07cf958c3137e
UCI5_PROOFLINE = 105/105 PASS
UCI5_CI_GUARDS = 3/3 PASS

The detailed chronology is repo-bound in docs/audits/2026-08-20-uci6-parent-review-hardening-addendum.md.

Second fail-closed UCI-6 restack

UCI-6 was advanced with a true two-parent Git merge, not copied parent state:

RESTACK_MERGE = 757be2bc6241a92c4e0393096e8db180442cdd7a
PARENTS = 33e2fc03c035185a194b40301c0f0b575b01946e + be07805af9887ff15272167740b07cf958c3137e

The exact parent delta from the prior reviewed UCI-5 head c1a562… to be07805… was six files only: four UCI-4 hardened files plus the UCI-5 workflow and CI-contract test.

Before changing UCI-6's frozen-parent contract, native CI failed closed exactly as intended:

RESTACK_RED_CANDIDATE = 757be2bc6241a92c4e0393096e8db180442cdd7a
RESTACK_RED_RUN = 32383209016
RESTACK_RED_JOB = 96471230807
WORKFLOW_EXPECTED_PARENT = c1a562013d521959d92cbd7f84f615f2d120e663
ACTUAL_PR_BASE = be07805af9887ff15272167740b07cf958c3137e
RESULT = EXACT_LINEAGE_FAILURE
ARTIFACT_ID = 9411839846
ARTIFACT_ZIP_SHA256 = 247b686b2d31fe1bef2802e5f3f71dd0fc4441c779fa6ae8df112b6281a60885

No semantic result is promoted from that failed-lineage candidate.

Final exact-head evidence

UCI-6 Collective Memory Contract — run 32383398222, job 96471870476SUCCESS

CANDIDATE_SHA = 156062855a91b77133d8999ce34883432435b167
EXPECTED_PARENT_SHA = be07805af9887ff15272167740b07cf958c3137e
PR_BASE_SHA = be07805af9887ff15272167740b07cf958c3137e
EXACT_LINEAGE = PASS
SCHEMAS = 12/12 PASS
HARDENED_UCI4_UCI5_UCI6_SEMANTIC_FALSIFIERS = 131/131 PASS
INHERITED_UCI5_CI_CONTRACT_GUARDS = 3/3 PASS
FAILURES = 0
ARTIFACT_ID = 9411917835
ARTIFACT_ZIP_SHA256 = 2c889de4dba8e488b7980ab0c79dc2808e39fd1623e6e08a6d20b0cd0cfc3e03

Other exact-head gates on 156062855…:

  • UCI-6 Collective Memory Contract — 32383398222SUCCESS
  • Coq Formal Attestation — 32383398194SUCCESS
  • Kernel One — 32383398202SUCCESS
  • AEGIS Coordinator Authority — 32383398216SUCCESS
  • AEGIS Agent Dispatch — SKIPPED; not counted as pass/failure evidence

The UCI-5 PR-native workflow is intentionally scoped to its own frozen-parent PR. Its three CI-contract guards execute directly inside the UCI-6 exact-head gate instead.

Explicit non-claims / residual boundary

This PR establishes a local SQLite reference memory boundary, not production distributed memory or semantic truth.

MEMORY_IS_AUTHORITY = FALSE
MEMORY_IS_PROPOSITION_TRUTH = FALSE
QUARANTINE_SELF_PROMOTION = FORBIDDEN
PERSISTED_UCI5_ADMISSION_LOOKUP = REQUIRED_AND_TESTED
MEMORY_PRESTATE_BINDING = REQUIRED_AND_TESTED
INTERNAL_PRESTATE_LESS_BASE_DIRECT_USE = FORBIDDEN_AND_TESTED
APPEND_ONLY_REVOKE_SUPERSEDE = IMPLEMENTED_AND_TESTED_REFERENCE
HARDENED_UCI4_EFFECT_BOUNDARY = INHERITED_AND_TESTED
LOCAL_SQLITE_REFERENCE = IMPLEMENTED

CROSS_PROCESS_EFFECT_WITNESS_CRYPTOGRAPHIC_ATTESTATION = NOT_ESTABLISHED
MALICIOUS_SAME_PROCESS_PYTHON_SANDBOX = NOT_ESTABLISHED
ATOMIC_CONCURRENT_FILESYSTEM_SNAPSHOT_PROOF = NOT_ESTABLISHED
NON_POSIX_PRODUCTION_FILESYSTEM_OBSERVATION = NOT_ESTABLISHED
CROSS_DATABASE_ATOMICITY_BETWEEN_UCI5_AND_UCI6 = NOT_ESTABLISHED
SQLITE_AUTHENTICATED_TAMPER_RESISTANCE = NOT_ESTABLISHED
SIGNED_MEMORY_PERSISTENCE = NOT_IMPLEMENTED
MULTI_PROCESS_LINEARIZABILITY = NOT_ESTABLISHED
DISTRIBUTED_LINEARIZABILITY = NOT_ESTABLISHED
PRODUCTION_MEMORY_BACKEND = NOT_ESTABLISHED
PRODUCTION_MEMORY_ADMISSION = NOT_ESTABLISHED
SEMANTIC_TRUTH_OF_STORED_CONTENT = NOT_ESTABLISHED
MEMORY_CONFIDENTIALITY_OR_ENCRYPTION = NOT_ESTABLISHED
QUARANTINE_QUOTA_RETENTION_POLICY = NOT_IMPLEMENTED
VECTOR_RETRIEVAL_IN_THIS_UCI6_PYTHON_REFERENCE = NOT_IMPLEMENTED
AGI = NOT_ESTABLISHED

The process-local effect-witness issuance boundary inherited from UCI-4 is not a cryptographic attestation mechanism. The descriptor-relative filesystem hardening is a POSIX local/reference boundary and does not establish an atomic snapshot against a privileged adversary.

Parents #276 and #277 are READY FOR REVIEW on their exact hardened heads. No merge to #277, #276, #275, or canonical main occurred.

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

Deployment failed for project hub with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/tariks-projects-e9198507?upgradeToPro=build-rate-limit

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 20, 2026

Copy link
Copy Markdown
Contributor

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
aegisomega 1560628 Commit Preview URL

Branch Preview URL
Aug 20 2026, 03:00 PM

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

Deployment failed for project hook-generator with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/tariks-projects-e9198507?upgradeToPro=build-rate-limit

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

Deployment failed for project hub with the following error:

Resource is limited - try again in 1 day (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/tariks-projects-e9198507?upgradeToPro=build-rate-limit

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

Deployment failed for project platform-picker with the following error:

Resource is limited - try again in 24 hours (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/tariks-projects-e9198507?upgradeToPro=build-rate-limit

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
hook-generator Ready Ready Preview Aug 20, 2026 1:23pm
hub Ready Ready Preview Aug 20, 2026 1:23pm
platform-picker Ready Ready Preview Aug 20, 2026 1:23pm

@vercel

vercel Bot commented Aug 20, 2026

Copy link
Copy Markdown

Deployment failed for project platform-picker with the following error:

Resource is limited - try again in 1 day (more than 100, code: "api-deployments-free-per-day").

Learn More: https://vercel.com/tariks-projects-e9198507?upgradeToPro=build-rate-limit

@tarikskalic33
Tarik Skalić (tarikskalic33) marked this pull request as ready for review August 20, 2026 15:02
@qodo-code-review

Copy link
Copy Markdown

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing

@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant