fix(step7): the witness needs positive controls, or refusal proves nothing

Two holes in the proof, not in the mechanism.

The authority table exercised three of the four states. R15 defines all four,
and `NOT_FROZEN+false` was the one nobody checked — so a future tree in which a
reader quietly authorised it would have passed the gate. It is in the table now,
and `DEAD_AUTHORITY` has a twin that breaks `execbinding.t0_at` instead of
`hostqual.bind_t0`: the gate's message claims enforcement on both readers, and a
control that only breaks the first left half that claim resting on nothing. Both
mutations must now be caught naming all three forbidden states.

The campaign-swap witness asserted only that a swapped campaign is inadmissible.
A `session_admissibility` returning `admissible: False` unconditionally would
have satisfied it — the witness would have read "nothing is admissible" as "the
swap was caught". It now requires the unchanged campaign to survive preflight to
postflight first, and requires the swapped one to be refused by a reason naming
the campaign link, so a broken closing probe cannot stand in for the continuity
check.

Two mutations prove each half bites: removing only the preflight/current
campaign-link comparison while leaving `check_campaign_link` intact, and a
postflight that refuses everything. A mutation that changes no bytes now raises
rather than passing as a second positive control nobody reads as one.

15 controls, 0 failed. The probes are unchanged: full chain rc 0, #354 alone rc 1
on three predicates, #354 without the tools rc 1 on one.

30d2f32 is untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018xhcg5opoFbSTdYHpkSXCh

Author: claude

scripts/step7/mergegate.py

@@ -99,6 +99,7 @@ def w(name, doc):
 # --- W3/W4: the authority state must bite on both readers -------------------
 for label, status, flag, must_pass in (("FROZEN+false", "FROZEN.", "false", False),
                                        ("NOT_FROZEN+true", "NOT_FROZEN.", "true", False),
+                                       ("NOT_FROZEN+false", "NOT_FROZEN.", "false", False),
                                        ("FROZEN+true", "FROZEN.", "true", True)):
     body = "```text\nStatus:\n  %s\n  collection_authorized: %s\n```\n" % (status, flag)
     root, commit = repo_with("t0-" + flag + status[:4], {"t0.md": body})
@@ -199,9 +200,20 @@ def link_for(binding_file, root, commit_sha, payload_file, att_file, blob_sha):
 if not pre["eligible"]:
     failures.append("a correctly linked session was refused: " + str(pre["reasons"])[:120])
 ppath = w("preflight.json", pre)
+# The positive half first. Without it a postflight hard-wired to inadmissible
+# would satisfy the negative half, and this witness would read "everything is
+# refused" as "the swap is refused" — a broken closing probe standing in for the
+# check it was meant to prove.
+kept = hq.session_admissibility(bpath, qpath, ppath, mpath, cand, probe, l2, r2)
+if not kept["admissible"]:
+    failures.append("an unchanged campaign was inadmissible at postflight: "
+                    + str(kept.get("reasons"))[:140])
 after = hq.session_admissibility(bpath, qpath, ppath, mpath, cand, probe, l3, r3)
 if after["admissible"]:
     failures.append("a campaign swapped between preflight and postflight was admissible")
+elif not any("campaign link" in str(r) for r in after.get("reasons", ())):
+    failures.append("the swapped campaign was refused, but by no reason naming the campaign "
+                    "link: " + str(after.get("reasons"))[:140])
 
 print(json.dumps(failures))
 """
@@ -309,9 +321,11 @@ def gate(repo: Path, commit: str) -> list[dict[str, object]]:
         results.append(check(
             "step7_machinery_enforces", not refusals,
             "; ".join(refusals) if refusals else
-            "the target tree's own tools were run and refused all four attacks: a link naming "
-            "another binding, a freeze edited after linking, FROZEN with collection_authorized "
-            "false, and a campaign swapped between preflight and postflight"))
+            "the target tree's own tools were run: both readers refused all three forbidden "
+            "authority states and accepted FROZEN+true; a link naming another binding and a "
+            "freeze edited after linking were refused; an unchanged campaign survived "
+            "preflight to postflight and a swapped one was refused by campaign-link "
+            "continuity"))
 
     note = (blob(repo, commit, STEP7_NOTE) or b"").decode("utf-8", "replace")
     revoked = "AUTOMATIC AUTHORISATION OF THE FIRST STEP-7 COLLECTION IS REVOKED" in note

tests/test_step7_mergegate.py

@@ -7,17 +7,22 @@
     mergegate-exact-binding-field the digest is read at each artifact's own path
     mergegate-decoy-digest        the right digest in a field nobody binds is not a binding
     mergegate-noop-campaign-link  a permissive link check must not satisfy the gate
-    mergegate-dead-authority      an authority check that always passes must not satisfy it
+    mergegate-dead-authority      hostqual authorising anything must not satisfy it
+    mergegate-dead-authority-eb   nor must execbinding — the claim covers both readers
+    mergegate-dead-continuity     nor must a postflight that stops comparing campaign links
+    mergegate-always-inadmissible nor must one that refuses every campaign
     mergegate-missing-machinery   the tools must be there at all
     mergegate-lingering-auto      the revoked automatic authority must stay revoked
     mergegate-unfrozen-t0         an unfrozen or unauthorised T0 is not merged as frozen
     mergegate-reads-t0-digest     the expected digest comes from T0, not from a constant
     control-inventory-complete    this list and the executed set are the same set
 
-Fixtures ship the real tools, and two controls mutate them. An earlier revision
-shipped a stub whose check_campaign_link was a bare pass and called that world
-compliant: the fixture demonstrated the false positive it was meant to exclude.
-Checking for the name of a mechanism is not checking the mechanism.
+Fixtures ship the real tools, and four controls mutate one enforcement point
+each. An earlier revision shipped a stub whose check_campaign_link was a bare
+pass and called that world compliant: the fixture demonstrated the false
+positive it was meant to exclude. Checking for the name of a mechanism is not
+checking the mechanism, and a witness that only ever sees refusals is not
+checking one either — hence a positive control beside each negative one.
 
 Failures print FAIL[<check>]: <detail>; nothing stops at the first one.
 
@@ -94,8 +99,11 @@ def guarded(check: str, control: Callable[[], None]) -> None:
         lambda d: {"bindings": {"measurement_harness_digest": d}},
 }
 
-# Mutations appended to the real hostqual: a later definition wins, so each stub
-# disables exactly one enforcement point and leaves the rest genuine.
+HOSTQUAL, EXECBINDING = mg.STEP7_TOOLS[1], mg.STEP7_TOOLS[2]
+
+# Mutations of the real tools, one enforcement point each. Appending a definition
+# is enough where a later definition wins; the continuity check lives inside a
+# larger function, so that one is a targeted edit of its condition.
 NOOP_LINK = '''
 
 def check_campaign_link(link, binding_path, repo):
@@ -110,6 +118,33 @@ def bind_t0(repo, path, commit):
     return block, check("t0", True, "stubbed: always authorised")
 '''
 
+# The second reader. The gate's message claims enforcement on both, so a control
+# that only breaks the first leaves half of that claim unproved.
+DEAD_AUTHORITY_EB = '''
+
+def t0_at(repo, path, commit):
+    return {"commit": commit, "path": path, "blob_sha": "b" * 40, "sha256": "f" * 64,
+            "status": "FROZEN", "collection_authorized": True}
+'''
+
+# The mutation the positive postflight control exists to catch: a tool that
+# refuses every campaign satisfies a negative-only witness, which would then be
+# reading "nothing is admissible" as "the swap was caught".
+ALWAYS_INADMISSIBLE = '''
+
+def session_admissibility(*args, **kwargs):
+    return {"admissible": False, "reasons": ["stubbed: nothing is ever admissible"]}
+'''
+
+CONTINUITY_CONDITION = ('preflight.get("campaign_link_sha256") != '
+                        "sha256_file(campaign_link_path)")
+
+
+def dead_continuity(src: str) -> str:
+    """Leave check_campaign_link working and remove only the comparison of the
+    preflight's campaign link with this pass's."""
+    return src.replace(CONTINUITY_CONDITION, "False")
+
 
 def real_tools() -> dict[str, str]:
     """The tools as they actually are. A fixture that shipped a stub would prove
@@ -140,16 +175,23 @@ def run(*args: str) -> None:
 def world(tmp: Path, *, frozen: bool = True, authorized: bool = True,
           instrument: str = "print('instrument')" + NL, rebound: bool = True,
           machinery: bool = True, auto_authority: bool = False, decoy: bool = False,
-          wrong_field: bool = False, mutate: str = "", name: str = "w") -> tuple[Path, str]:
+          wrong_field: bool = False, mutate: dict[str, object] | None = None,
+          name: str = "w") -> tuple[Path, str]:
     """A synthetic target tree, and the commit a merge into it would produce."""
     repo = tmp / name
     files = {eb.INSTRUMENT_SOURCES[0]: instrument,
              eb.INSTRUMENT_SOURCES[1]: '{"decisive": []}' + NL,
              mg.STEP7_NOTE: NOTE_AUTO if auto_authority else NOTE_REVOKED}
     if machinery:
         tools = real_tools()
-        if mutate:
-            tools[mg.STEP7_TOOLS[1]] = tools[mg.STEP7_TOOLS[1]] + mutate
+        for tool, change in (mutate or {}).items():
+            before = tools[tool]
+            tools[tool] = change(before) if callable(change) else before + str(change)
+            if tools[tool] == before:
+                # A mutation that lands nowhere turns an attack control into a
+                # second positive control that nobody reads as one.
+                raise AssertionError(f"the mutation for {tool} changed nothing; the source it "
+                                     "targets has moved")
         files.update(tools)
     else:
         files[mg.STEP7_TOOLS[0]] = "# capture only" + NL
@@ -269,7 +311,7 @@ def control_decoy_digest() -> None:
 def control_noop_campaign_link() -> None:
     """The attack the previous revision of this gate could not see."""
     with tempfile.TemporaryDirectory() as raw:
-        repo, commit = world(Path(raw), mutate=NOOP_LINK, name="noop")
+        repo, commit = world(Path(raw), mutate={HOSTQUAL: NOOP_LINK}, name="noop")
         if verdicts(repo, commit).get("step7_machinery_enforces") != "fail":
             fail("mergegate-noop-campaign-link",
                  "a permissive check_campaign_link satisfied the gate; the name of a mechanism "
@@ -284,20 +326,70 @@ def control_noop_campaign_link() -> None:
        "that got through")
 
 
+def _dead_authority(check_name: str, tool: str, stub: str, reader: str) -> None:
+    """Both readers carry the authority state machine, and the gate says so.
+    A control that breaks one of them leaves the other half of that claim
+    standing on nothing."""
+    with tempfile.TemporaryDirectory() as raw:
+        repo, commit = world(Path(raw), mutate={tool: stub}, name="deadauth")
+        if verdicts(repo, commit).get("step7_machinery_enforces") != "fail":
+            fail(check_name, f"a {reader} authority check that always passes satisfied the gate")
+            return
+        detail = details(repo, commit)["step7_machinery_enforces"]
+        wrongly = [s for s in ("FROZEN+false", "NOT_FROZEN+true", "NOT_FROZEN+false")
+                   if f"{reader} accepted {s}" in detail]
+        if len(wrongly) != 3:
+            fail(check_name, f"refused, but named {wrongly} rather than all three forbidden "
+                             f"states: {detail}")
+            return
+    ok(check_name,
+       f"a tree whose {reader} authorises anything is refused, and the refusal names every "
+       "forbidden state it accepted: FROZEN+false, NOT_FROZEN+true, NOT_FROZEN+false")
+
+
 def control_dead_authority() -> None:
+    _dead_authority("mergegate-dead-authority", HOSTQUAL, DEAD_AUTHORITY, "hostqual")
+
+
+def control_dead_authority_eb() -> None:
+    _dead_authority("mergegate-dead-authority-eb", EXECBINDING, DEAD_AUTHORITY_EB, "execbinding")
+
+
+def control_dead_continuity() -> None:
+    """The campaign-swap witness needs its own sensitivity proof: a postflight
+    that refuses everything would satisfy a negative-only control."""
     with tempfile.TemporaryDirectory() as raw:
-        repo, commit = world(Path(raw), mutate=DEAD_AUTHORITY, name="deadauth")
+        repo, commit = world(Path(raw), mutate={HOSTQUAL: dead_continuity}, name="deadcont")
         if verdicts(repo, commit).get("step7_machinery_enforces") != "fail":
-            fail("mergegate-dead-authority",
-                 "a bind_t0 that always returns pass satisfied the gate")
+            fail("mergegate-dead-continuity",
+                 "a postflight that no longer compares the preflight's campaign link with "
+                 "this pass's satisfied the gate; the swap witness proves nothing")
             return
         detail = details(repo, commit)["step7_machinery_enforces"]
-        if "accepted" not in detail:
-            fail("mergegate-dead-authority", f"refused for an unrelated reason: {detail}")
+        if "swapped" not in detail:
+            fail("mergegate-dead-continuity", f"refused for an unrelated reason: {detail}")
+            return
+    ok("mergegate-dead-continuity",
+       "removing only the preflight/postflight campaign-link comparison, and leaving "
+       "check_campaign_link intact, is caught and named as the swap becoming admissible")
+
+
+def control_always_inadmissible() -> None:
+    """A refusal is only evidence if acceptance was possible."""
+    with tempfile.TemporaryDirectory() as raw:
+        repo, commit = world(Path(raw), mutate={HOSTQUAL: ALWAYS_INADMISSIBLE}, name="noadmit")
+        if verdicts(repo, commit).get("step7_machinery_enforces") != "fail":
+            fail("mergegate-always-inadmissible",
+                 "a postflight that refuses every campaign satisfied the gate; the swap "
+                 "witness was reading a blanket refusal as enforcement")
+            return
+        detail = details(repo, commit)["step7_machinery_enforces"]
+        if "unchanged campaign was inadmissible" not in detail:
+            fail("mergegate-always-inadmissible", f"refused for another reason: {detail}")
             return
-    ok("mergegate-dead-authority",
-       "a tree whose authority check always passes is refused, and the refusal says which "
-       "state it wrongly accepted")
+    ok("mergegate-always-inadmissible",
+       "the unchanged campaign must survive preflight to postflight, so a tool that refuses "
+       "everything cannot pose as one that caught the swap")
 
 
 def control_missing_machinery() -> None:
@@ -384,6 +476,9 @@ def control_inventory_complete() -> None:
     ("mergegate-decoy-digest", control_decoy_digest),
     ("mergegate-noop-campaign-link", control_noop_campaign_link),
     ("mergegate-dead-authority", control_dead_authority),
+    ("mergegate-dead-authority-eb", control_dead_authority_eb),
+    ("mergegate-dead-continuity", control_dead_continuity),
+    ("mergegate-always-inadmissible", control_always_inadmissible),
     ("mergegate-missing-machinery", control_missing_machinery),
     ("mergegate-lingering-auto", control_lingering_auto),
     ("mergegate-unfrozen-t0", control_unfrozen_t0),