Recovery Integrity v0.1: separate projection rebuild from execution continuation

[safal207]

What changed

Recovery Integrity v0.1 now has three increasingly concrete evidence layers:

1. a public sanitized fixture derived from openai/codex#26990;
2. an implementation-independent Generation-N simulator;
3. a real SQLite + atomic JSON process-crash fault-injection harness.

Key files:

• signals/018-recovery-integrity-projection-authority-continuation.md
• signals/README.md routing update
• protocols/recovery-integrity-v0.1/README.md
• protocols/recovery-integrity-v0.1/PROCESS_CRASH_EVIDENCE.md
• protocols/recovery-integrity-v0.1/schema/recovery-integrity-record.schema.json
• protocols/recovery-integrity-v0.1/validate.py
• protocols/recovery-integrity-v0.1/generation_crash_simulator.py
• protocols/recovery-integrity-v0.1/test_generation_crash_simulator.py
• protocols/recovery-integrity-v0.1/fault_injection_harness.py
• protocols/recovery-integrity-v0.1/test_fault_injection_harness.py
• protocols/recovery-integrity-v0.1/fixtures/codex-26990-sanitized.json
• protocols/recovery-integrity-v0.1/fixtures/unsafe-fork-must-fail.json
• protocols/recovery-integrity-v0.1/fixtures/generation-matrix.expected.txt
• protocols/recovery-integrity-v0.1/fixtures/process-crash-matrix.expected.txt
• .github/workflows/recovery-integrity-v0.1.yml

Core boundary

durable authority
≠
derived projection
≠
safe execution continuation

ALLOW_REBUILD never implies ALLOW_FORK.

Public fixture

The sanitized openai/codex#26990 fixture remains intentionally bounded:

projection=STALE
projection_decision=ALLOW_REBUILD
execution_decision=HOLD

The public evidence is enough to support a projection-rebuild classification, but not enough to prove the exact safe continuation edge.

Generation-N simulator

case             projection    rebuild          execution   validator
-----------------------------------------------------------------------------
healthy          HEALTHY       NO_REBUILD       HOLD        PASS
stale            STALE         ALLOW_REBUILD    HOLD        PASS
corrupt          CORRUPT       ALLOW_REBUILD    HOLD        PASS
split-generation UNPROVABLE    HOLD             HOLD        PASS

Load-bearing negative controls reject:

• projection generation > authority generation + ALLOW_REBUILD;
• ALLOW_FORK when continuation proof, side effects, or current authority remain unresolved.

Real SQLite + atomic projection crash harness

The new harness uses a real SQLite authority store with WAL / synchronous=FULL plus an atomically replaced JSON projection:

write projection.json.tmp
→ flush + fsync(temp)
→ os.replace(temp, projection.json)
→ fsync(directory) where supported

A child process advances generation 1 → 2 and terminates with os._exit(91) at selected durability boundaries. A fresh verifier then reads the actual post-crash files and SQLite state.

Observed matrix:

crash point                         auth proj projection rebuild          temp
--------------------------------------------------------------------------------
before_authority_commit             1    1    HEALTHY    NO_REBUILD       false
after_authority_commit              2    1    STALE      ALLOW_REBUILD    false
after_projection_temp_fsync         2    1    STALE      ALLOW_REBUILD    true
after_projection_commit             2    2    HEALTHY    NO_REBUILD       false

Every observed state becomes a RecoveryIntegrityRecord, passes the same semantic validator, and keeps execution_continuation=HOLD.

This mechanically establishes several useful boundaries:

• crash before SQLite commit does not invent generation 2;
• crash after authority commit exposes projection lag as STALE;
• an fsynced-but-unrenamed temp projection remains evidence/candidate, not committed projection authority;
• full projection commit restores generation alignment.

CI acceptance contract

The Recovery Integrity workflow now gates:

sanitized public fixture          → PASS
unsafe fork fixture               → expected FAIL
Generation-N simulator            → PASS
generation regressions            → PASS
SQLite + atomic JSON crash matrix → PASS
process-crash regressions         → PASS

Evidence boundary

The new harness is process-crash evidence, not proof of arbitrary physical power-loss durability.

os._exit process crash
≠
storage-controller power failure
≠
all filesystem power-fail semantics
≠
torn-sector simulation

This PR therefore does not claim that Codex implements generation markers, that SQLite is universally authoritative, that every projection is derivable, or that full power-loss safety is proven.

Next hardening frontier

After this layer is green on exact head, the next meaningful step is stronger storage/power-loss fault injection (VM/filesystem/product-native) and then routing emitted RecoveryIntegrityRecord evidence through ProofPath → CML → ContractGraph-QA for independent cross-repository verification.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ab5829fa-1703-47f6-bbfc-336fd546a9e9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[safal207]

Downstream independent verification — FCRP-SYSTEM-008

The exact Recovery Integrity source head remains intentionally immutable for this proof:

RESONANCE source
361b93cb773779afe24ca38e28d0ac22c60a93b6

ContractGraph-QA draft PR #64 independently reproduced the after_authority_commit process-crash case and routed its normalized RecoveryIntegrityRecord through existing canonical verification boundaries:

RESONANCE RecoveryIntegrityRecord
  projection=STALE
  rebuild=ALLOW_REBUILD
  execution=HOLD
        ↓
ProofPath proofpath.scig.v0.1
  canonical commit 685d50e256a5125a21f4c4584b326411caaa64ad
  RESULT VALID
  VERIFICATION PASSED
        ↓
Causal-Memory-Layer InformationFitness
  exact commit 90c7fdaaf31ad7c17ddc0c3c55b7ccd33f6affc2
  READY_FOR_AUTHORITY_CHECK
  authorizes_action=false
        ↓
ContractGraph-QA Recovery Receipt
  PROJECTION_REBUILD_ALLOWED_EXECUTION_HELD

Exact CGQA verification head:

71a37c7a6b71454edca2b50ef89ac3edff2d3855

Workflow:

FCRP SYSTEM-008 Recovery Integrity
run 31885315652
job 95013657491
SUCCESS

Receipt:

sha256:30f6966e3a55606f6ed3fc7ac04760a6c1ed6e53d858b589d51fde6d3daf6736

Evidence artifact:

artifact id 9247096835
artifact zip sha256:4210190c195484c57fe6ab9e0dce3fa2db93f35be97ca8f9b6a94003791b9ce1

Load-bearing negative controls also passed:

• HOLD → ALLOW_FORK escalation is rejected before the ProofPath bridge;
• CML authorizesAction=true cannot mint a receipt;
• source-record mutation after SCIG creation is rejected by digest binding;
• non-VALID/non-PASSED ProofPath output cannot mint a receipt.

This is downstream verification of the process-crash recovery boundary only. It does not prove arbitrary physical power-loss durability and grants no execution, mutation, deployment, or production recovery authority.

The source commit is not modified by this evidence note so the receipt continues to bind the same immutable subject rather than creating a self-referential proof cycle.