rfc(0001): v0.7.0 — ward_hash leaf payload + role-scoped recompute MUST; fail-closed vector coverage (threads-8gg, threads-df9)

[BunsDev]

What

Closes both findings of the v0.6.0 post-merge review, as one draft minor (v0.7.0) under the §6.3 rule ratified in v0.5.0 (unchanged through v0.6.0; §6.3 untouched, so §6.3.1 is not in scope).

• threads-8gg — §5.6.1 named "per-thread leaf commitments" without defining the leaf payload, so ward_hash was not recomputable from the RFC alone; and the cross-implementation recompute MUST overclaimed its inputs for ward_hash (its preimage includes weave state absent from "the audit log and the surface bytes it references").
• threads-df9 — check-audit-records.js recomputed worked vectors only opportunistically: deleting/renaming a companion .entry/.surface file silently disabled the §6.1 vector demonstration while the suite stayed green.

Normative changes

• §5.6.1 ward_hash leaf payload defined — the thread's thread:v2 leaf commitment: surface path, writer id (UTF-8), count + sorted deduplicated covered-channel tags, full tension-state commitment bytes, count + lexicographically sorted strand commitment bytes; every field BE-u64 length-prefixed per the framing rule. The reference implementation's construction is adopted as the normative definition of the payload bytes (restores the design-basis D-2 delegation sentence dropped in the v0.6.0 transposition — "The existing implementation is adopted as the reference construction; its domain tags version it"); a change to the payload construction MUST change its embedded tag.
• §10.1 — new normative reference: coven-threads-core (weave.rs thread_leaf_bytes, manifest.rs merkle_root).
• §5.6.1 cross-implementation verification rescoped by hash role — content fingerprints (diff_hash, entry_hash): recomputable from log + referenced surface bytes alone, unchanged. Structural commitments (ward_hash): recomputation requires the committed authority state the hash commits to (threads/strands/tension), which the log references but does not embed; an implementation holding that state MUST recompute regardless of writer; a verifier holding only log + surfaces MUST verify the textual encoding and MUST NOT treat missing committed state as a recomputation mismatch. Tamper-evidence sentence unchanged. §9 gap bullet rescoped to match.

Conformance machinery

• validators/check-audit-records.js — fails closed unless ≥1 .entry and ≥1 .surface companion vector was found and verified per run. Mutation-tested: hiding 01-memory-entry-admitted.entry now yields FAIL … no .entry companion vector found and verified + exit 1 (previously: silent green). audit-records/README.md documents the guarantee.

Release mechanics

• rfcs/RFC-0001-v0.6.md — byte-exact snapshot of tag v0.6.0 (diff-verified).
• Version sweep to v0.7.0: README badge/lines, PRIMER, SPEC, docs/faq, conformance + validator READMEs, validator banner, ward.schema description, rfcs/README (index + snapshot row tag v0.6.0 (main cade5a0) + citations), package{,-lock}.json.
• CHANGELOG + §11 entries with the §6.3-required migration impact (none: leaf-payload definition codifies deployed thread:v2 practice; the rescoped MUST relieves an undischargeable obligation; v0.6.0-conformant directories remain conformant; consumers pinning v0.6.0 unaffected) and security rationale (unrecomputable commitments invite trust-not-verify; role-scoping prevents false tamper alarms; vector-coverage assertion closes a fail-open in the conformance machinery itself).

Verification

npm test → positive 7/7, negative 38/38, audit-records READY, unexpected 0
npm run validate:examples → sage PASS, minimal PASS
snapshot: git show v0.6.0:rfcs/RFC-0001-familiar-contract.md ≡ rfcs/RFC-0001-v0.6.md (0-diff)
mutation test: companion-vector removal → suite FAIL exit 1; restored → green
leaf-payload prose cross-checked against coven-threads-core weave.rs:255-280 (thread_leaf_bytes),
  thread.rs/strand.rs commitment_bytes, manifest.rs put_field/merkle_root

Gates

Fresh-context review to follow as a PR comment. Merge + tag v0.7.0 is Val's gate.

Refs: threads-8gg · threads-df9 · v0.6.0 review record (PR #12 comment) · design doc #9

[Copilot]

Pull request overview

Updates RFC-0001 to v0.7.0 with a normative clarification that makes ward_hash recomputation well-defined (by defining the leaf payload and tying it to the reference construction), scopes the cross-implementation recomputation MUST by hash role, and hardens the audit-record conformance lane to fail closed if worked-vector companions are missing.

Changes:

• Define the ward_hash Merkle leaf payload (thread:v2) and add a normative reference to coven-threads-core.
• Rescope cross-implementation verification requirements so ward_hash recomputation is required only for verifiers who possess the committed authority state.
• Make validators/check-audit-records.js fail closed unless at least one .entry and .surface companion vector is found and verified per run; sweep version references to v0.7.0 and add an RFC v0.6.0 snapshot.

Reviewed changes

Copilot reviewed 15 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
validators/validate.js	Updates validator banner version to v0.7.0.
validators/README.md	Updates validator documentation references to v0.7.0.
validators/check-audit-records.js	Enforces fail-closed worked-vector coverage across the audit-record lane.
tests/conformance/README.md	Updates conformance suite version references to v0.7.0.
tests/conformance/audit-records/README.md	Documents the new fail-closed companion-vector guarantee.
SPEC.md	Updates pointer to the current normative RFC (v0.7.0).
schemas/ward.schema.json	Updates schema description string to reference v0.7 subset.
rfcs/RFC-0001-v0.6.md	Adds the historical snapshot of the v0.6.0 RFC text.
rfcs/RFC-0001-familiar-contract.md	Bumps RFC to v0.7.0 and introduces the ward_hash leaf payload definition + role-scoped recompute MUST.
rfcs/README.md	Updates the RFC index to v0.7.0 and adds the v0.6.0 snapshot row.
README.md	Updates top-level “current version” badge and usage text to v0.7.0.
PRIMER.md	Updates primer references to the v0.7.0 normative spec.
package.json	Bumps package version to 0.7.0.
package-lock.json	Bumps lockfile package version entries to 0.7.0.
docs/faq.md	Updates FAQ references to RFC-0001 v0.7.0.
CHANGELOG.md	Adds the 0.7.0 changelog entry describing the normative + conformance changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[BunsDev]

Fresh-context review — v0.7.0 (ward_hash recomputability + vector coverage)

Independent reviewer (fresh context, reviewer ≠ author), posted for the record per repo precedent. Reviewed head 5c5d8a2 vs main cade5a0.

Findings: Blocking — none. Should-fix — 1 (fixed before merge). Nits — none.

• Should-fix (fixed in 370b875): schemas/audit-record.schema.json:5 description still read "v0.6 subset" while ward.schema.json bumped to "v0.7 subset" — the two shipped schemas disagreed about the current version. Cosmetic only (description strings don't affect Ajv validation). Fixed: description bumped, and the file added to both sweep enumerations (CHANGELOG [0.7.0], RFC §11). Historical enumerations left untouched.

Verification evidence (reviewer-run):

• Leaf-payload prose vs reference code — exact match against coven-threads-core weave.rs:255-280 (thread_leaf_bytes): field order, put_field BE-u64 length prefixes (incl. tag and count fields), channel tags sorted+deduped vs strand commitment bytes sorted-not-deduped ("set" vs "sequence" wording mirrors this), full tension commitment (thread.rs:55-90), UTF-8 surface/writer; correctly omits thread id/created_at (identity, not commitment). Count-payload encoding not pinned in prose is by design — the normative delegation to coven-threads-core (D-2 restored) covers exact bytes.
• Tamper-evidence not weakened: the MUST NOT covers only "its own lack of the committed state"; the standalone mismatch-⇒-tamper-evidence sentence binds whenever recomputation is performed. §5.6 confirms the log records only (ward_version, ward_hash) — "references but does not embed" is accurate.
• Classification correct: draft minor under the v0.5.0 §6.3 rule (rescoping a MUST + promoting a construction to normative are conformance-affecting; draft patch would be wrong). §6.3 semantically untouched (anchor only). Migration impact + security rationale present in both changelogs and accurate.
• Validator hardening mutation-tested: hiding .entry → coverage FAIL exit 1; hiding .surface → exit 1; corrupting .entry → 2 FAILs exit 1; restored → green. Counting matches (not mere presence) is correct — present-but-mismatching already fails via the mismatch report. The ≥1-of-each assertion is load-bearing (exactly one companion of each kind exists).
• Snapshot: rfcs/RFC-0001-v0.6.md byte-identical to git show v0.6.0:… (cmp clean; tag v0.6.0 = cade5a0).
• Suite: npm test → 7/7 positive, 38/38 negative, audit-records READY, exit 0; validate:examples → both PASS. Re-verified green after the schema-description fix (370b875).

VERDICT: SIGN-OFF RECOMMENDED — single cosmetic finding, fixed pre-merge; all constructions fact-checked against the reference implementation.

Beads: threads-8gg, threads-df9 · Session: 86c62915