CC evidence lockdown: 30 decimals still point at closed #155 — publish impl rows so CC can pin symbols (halt, founder quorum, reverse quorum among them)

[emooreatx]

CC evidence lockdown: 30 decimals still resolve to the closed tracking ticket #155 — publish impl rows so the Constitution can point at symbols

CIRISConstitution is locking down its claim registry for the RC4 cut. 116 claims.tsv rows carry impl:CIRISServer#155 (or staged:CIRISServer#155) — the pre-manifest placeholder. #155 is closed and evidence/cc_impl.tsv exists, so the placeholder is the #65 defect class. Against the re-pinned head (65ea7f6), the manifest backs 86 of those decimals with a real path#symbol (repo ≠ —, crate ≠ open) — CC is repointing those to your symbols in this cut. The remaining 30 decimals are either absent from the manifest or carry —/open. Where a row has no other backing, CC is demoting it from established to staged on this issue.

Three of the 30 are load-bearing on the public /safety and /constitutional-mesh pages: 4.2 (halt authority — "no objective can outvote it"), 4.4.3.2.4.1 (founder quorum — "fake members cannot vote themselves in"), 4.5.13 (reverse quorum). They demote quietly unless rows land.

CC decimal	claim id(s)	CC status after this cleanup
1.2	CLM-admission	no other backing — CC demotes to staged on this issue
2.1.1	CLM-forward-compatibility	still established via a green CIRISConformance test: id
2.3.1	CLM-subject_kind-subject-2	no other backing — CC demotes to staged on this issue
2.3.2.1	CLM-registry-canonical	no other backing — CC demotes to staged on this issue
2.6.1.2	CLM-per-field	still established via a green CIRISConformance test: id
2.6.1.4	CLM-worked	still established via a green CIRISConformance test: id
2.6.5	CLM-references	no other backing — CC demotes to staged on this issue
2.6.9	CLM-conformance-language	no other backing — CC demotes to staged on this issue
3.1.2.1	CLM-provenance	still established via a green CIRISConformance test: id
3.4.6	CLM-reservation-delivery	no other backing — CC demotes to staged on this issue
3.4.11	CLM-age-assurance	no other backing — CC demotes to staged on this issue
3.4.12	CLM-adult-incapacity	no other backing — CC demotes to staged on this issue
4.1.1	CLM-anti-pattern-delegation	no other backing — CC demotes to staged on this issue
4.2	CLM-halt-authority	no other backing — CC demotes to staged on this issue
4.4.3.1.1	CLM-sub-quorum	no other backing — CC demotes to staged on this issue
4.4.3.2.4.1	CLM-deterministic	no other backing — CC demotes to staged on this issue
4.4.3.2.8	CLM-affiliations	no other backing — CC demotes to staged on this issue
4.4.3.6	CLM-policy-attestation	no other backing — CC demotes to staged on this issue
4.4.3.10	CLM-policy-trusted	no other backing — CC demotes to staged on this issue
4.5.2.1	CLM-subject_kind-subject-3	no other backing — CC demotes to staged on this issue
4.5.8.1	CLM-cohabitation	no other backing — CC demotes to staged on this issue
4.5.8.3	CLM-settled	no other backing — CC demotes to staged on this issue
4.5.10.4	CLM-documents-what-2	no other backing — CC demotes to staged on this issue
4.5.13	CLM-reverse-quorum	no other backing — CC demotes to staged on this issue
5.1	CLM-epoch-keying	no other backing — CC demotes to staged on this issue
5.2	CLM-structural-invisibility	still established via a green CIRISConformance test: id
5.3.2.4.1	CLM-authority-local	still established via a green CIRISConformance test: id
5.3.4	CLM-multi-steward	no other backing — CC demotes to staged on this issue
6.1.1	CLM-wholeness-witness	no other backing — CC demotes to staged on this issue
6.2.3.1	CLM-sigma-attest	no other backing — CC demotes to staged on this issue

Plus one row that moved house

• 3.1.8.1 CLM-capacity-composite — 𝒞_CIRIS = min(C, I_int, R, I_inc, S); a product form is non-conformant (sign-cancelling); a missing factor is undefined, not zero. LensCore folded into CIRISServer, so the implementing symbol (src/capacity/score.rs lineage) is now yours to publish. Currently staged on the closed CC chore(substrate): persist v9.4.1 + edge v6.2.2 + verify v6.7.1 — the safe-mesh-floor verify deps (v0.5.16) #50.

Ask: rows with real path#symbol at each decimal (your tools/check_evidence.py already enforces symbol resolution at the pinned crate). CC will pin symbols, not sections, and retire #155 as a pointer.

[emooreatx]

Correction after the re-vendor, so the table above reads right: the "CC demotes to staged" column did not come true for any row. Re-vendoring all eight pins at heads found sibling-manifest backing (Persist / Verify / Edge / Agent, or a green Conformance row) for every decimal listed, so no row demoted — the registry now has 269 established / 39 staged / 7 normative, every token resolving. The ask stands unchanged: these decimals are established on another lane's evidence, and this lane's rows are what let CC pin them in the lane that owns the control. Landed in CIRISConstitution rc4 (Evidence lockdown commit).

One addition — 8.8.7, five rows. CIRISAgent's manifest declares CLM-await-oauth-state-single-use, CLM-await-oauth-redirect-allowlist, CLM-await-apple-id-token-verified, CLM-await-google-token-fails-closed, CLM-await-degraded-path-no-weaker as status = substrate with no symbol — i.e. server-tier controls. They are staged on this issue; rows at 8.8.7 naming the server-side OAuth/token symbols flip them.

[emooreatx]

Two additions (CIRISConstitution#40 and #9, both discharged on rc5). (1) 4.2.1 / 4.4.3.8 — src/trust_root_qa.rs#mint_portable_root is the shipped, tested root-minting ceremony (2-of-3 co-scrub, charter, grant, trust edge) and is not in evidence/cc_impl.tsv; rows at both decimals let CLM-accord-reach and CLM-trust-root flip. (2) 8.4.2.2 — CLM-c2pa-emit is staged here as dormant: CC now says C2PA emit is normative wherever generated media is published and must ship with the first release that publishes any; no row is owed until that release exists, but this is where it lands.

[emooreatx]

The five 8.8.7 rows staged here: four are yours and I have the symbols, one is a gap rather than a row.

You asked (my comment of 2026-09-03) for rows at 8.8.7 naming the server-side OAuth/token symbols. Before pushing you for rows you may not owe, I checked which tier each control actually sits in. All five moved in CIRISAgent#1028/#1029 (ciris-server 0.5.170) when the agent's routes/auth.py was deleted — that is confirmed, the file is gone and only auth_proxy.py remains — so none of the five are ours to implement. But one of them is asking you to attest a property your code does not have.

Four that resolve cleanly — paste-ready

Read at CIRISServer@main, 2026-09-07:

decimal	claim id	path#symbol
8.8.7	CLM-await-oauth-state-single-use	src/auth/oauth.rs#CsrfStore::consume
8.8.7	CLM-await-apple-id-token-verified	src/auth/oauth.rs#HttpProviderClient::verify_apple_native
8.8.7	CLM-await-google-token-fails-closed	src/auth/oauth.rs#HttpProviderClient::verify_google_native
8.8.7	CLM-await-degraded-path-no-weaker	see note below

CsrfStore::consume is a genuine one-use pop with an expiry check, and a missing verifier and a wrong one deliberately return the same answer. verify_apple_native pins RS256, selects by kid from Apple's JWKS, and requires aud/iss/exp. verify_google_native is stronger than the Python it replaced: the unverified local-decode fallback is gone, and empty allowed_audiences now refuses instead of skipping the check — the distinct-zeroes bug where "nothing configured" read as "nothing to enforce", which the two providers used to disagree about. Worth saying plainly since our claim text was written against the weaker version.

CLM-await-degraded-path-no-weaker is the general rule ("no exception handler in the verifier may produce an identity"). It holds structurally today — both verifiers return Result<OAuthIdentity, String> and every dependency-failure branch maps to Err — but there is no single symbol that is the control and no test asserting it as a rule. Your call whether to anchor it on verify_google_native or add a test worth pointing at; I would take the test, because the next degraded path will be written by someone who has not read this one.

One that is a gap, not a missing row

CLM-await-oauth-redirect-allowlist claims a control that drops any redirect_uri "whose public hostname is not on the configured allowlist". What actually survives is src/auth/oauth.rs#is_safe_redirect, and it is a scheme check, not an allowlist:

if uri.starts_with('/')            { return true; }                 // relative
if let Some(r) = strip("https://") { return !r.is_empty(); }        // ANY public host
if let Some(r) = strip("http://")  { return r.starts_with("127.0.0.1") || … }
false

https://evil.example.com/cb passes. There is no configured allowlist anywhere in the repo — one call site (:1792), no config key, and a code search returns nothing.

I am not reporting this at the severity our old claim text implies, because the thing that made it severe is fixed. The success redirect no longer carries a live bearer: since CIRISServer#439 it carries ciris_code, 256 bits from the CSPRNG, single-use via WebExchangeStore::redeem, 60s TTL, with the session handed over only in the body of POST /v1/auth/oauth/exchange. Your comment there — that a live bearer in a URL lands in history, Referer, and every proxy log — is exactly right and is why this is now a much smaller thing.

What remains: an attacker-chosen https destination still receives a credential-equivalent it can redeem inside 60s, and the exchange binds the code to nothing but itself. On a node bound to 0.0.0.0:4243 that is reachable. Narrower and time-boxed, not closed.

So this decimal should not get a row pointing at is_safe_redirect — that would attest an allowlist that does not exist. It needs either the allowlist restored, or the claim re-worded to what is_safe_redirect actually guarantees. That is a decision for the lane that owns the control, not something I should paper over from our side.

What we changed on our side

CIRISAgent@010d2aa7c rewrites the comment block above that row. It previously read "the claim did not go away with our copy of the code; its evidence moved" — true of the other four, wrong here. It now records what the substrate enforces, what did not survive the move, and that the row stays substrate with no symbol pending your decision. Our check_evidence.py is green (55 in-repo pointers resolved, 3 declared gaps, 0 failed).

Separately, on the other 30

For the record against the RC5 catch-up: at main today evidence/cc_impl.tsv is 113 rows, 91 real and 22 placeholder — and the 22 placeholders are precisely the decimals this issue lists, still in — — open form:

2.6.5         CLM-references      —  —  open
3.1.2.1       CLM-provenance      —  —  open
4.4.3.2.4.1   CLM-deterministic   —  —  open
4.5.13        CLM-reverse-quorum  —  —  open

The remaining 8 have no row at all: 1.2, 3.4.11, 3.4.12, 4.2, 5.1, 5.2, 6.1.1, 6.2.3.1. So of the three flagged as load-bearing on the public /safety and /constitutional-mesh pages, founder quorum and reverse quorum are present-but-unbacked and halt authority (4.2) has no row at all. 4.2.1 / 4.4.3.8 (the mint_portable_root ceremony) and the 8.8.7 set above are also still absent; 8.4.2.2 is correctly absent, being dormant by design.