F4 stamped the embedded pawl bundle with a deterministic content hash; this surfaces it in
`ao pawl doctor` so the landed!=installed class (an installed ao silently running OLD pawl scripts —
it bit this very session) is diagnosable.
THE DESIGN IS THE LESSON. Two cross-family codex refutes killed the obvious implementation:
round 1 — I hashed any repo containing scripts/pawl-*.sh and reported STALE. A stranger repo with
same-named files would be falsely failed.
round 2 — I gated that on "identity markers" (the verdict schema + pawls contract). Codex refuted
again, correctly: FILE PRESENCE IS NOT IDENTITY. Every marker is attacker-controlled and
spoofable, so no marker list can ever make it safe.
The real fix is not a better marker list — it is a TRUST BOUNDARY. A staleness FAILURE must never be
asserted against a repo the binary does not trust. So:
- trusted dogfood path (untrustedRoot == "", i.e. the ao binary lives inside the checkout — the ONE
trust decision the whole pawl surface is built on): the LIVE scripts run in place, so there is
nothing to compare and nothing to warn about;
- untrusted/installed path: surface the stamp INFORMATIONALLY (so the operator can diagnose
landed!=installed themselves and rebuild), and assert NO verdict about a repo we cannot trust.
This is the honest feature, not a weaker one: the diagnostic signal is preserved while doctor cannot
be weaponized into failing on an untrusted tree.
Tests: TestPawlBundleStaleness — dogfood surfaces the stamp and never says STALE; an untrusted repo
is never reported STALE *whatever it contains*, including a repo that SPOOFS every identity marker a
naive check might have used.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
THE ADVISORY WINDOW DID EXACTLY ITS JOB, and the answer is NOT the one the bead expected.
Measured over the 261 local verdicts whose head_sha is a live commit: 26 PASS, **199 FLOOR-fail
(76%)**, 36 fail for unrelated (stale/missing) reasons. The FLOOR failures include verdicts from
unambiguously SUBSTANTIVE reviews — codex caught 3 real defects in this session and those verdicts
still fail the floor.
ROOT CAUSE: pawl_evidence_floor demands a `file:line` finding OR a reviewed-scope attestation. But a
CONFIRMED review has, by definition, NO DEFECT TO CITE — a clean review legitimately reads "no
blocking defects". The floor CONFLATES "no defects found" with "no review performed", so every clean
CONFIRM from codex/agy fails it. Right idea, wrong signal.
CONSEQUENCE: FLOOR_ENFORCE_AFTER=2026-07-16 was FIVE DAYS AWAY and would have started HOLDing ~76%
of real reviews on a CALENDAR TRIGGER with nobody watching — silently breaking the membrane.
THIS COMMIT DEFUSES THE CLOCK ONLY (the minimal, safe, time-critical fix): the date is pushed to a
deliberately distant 2027-01-01 so no calendar event can auto-enforce a floor with a measured 76%
false-positive rate. The floor still MEASURES and WARNs (unchanged), and PAWL_FLOOR_ENFORCE=1 still
forces enforcement for tests/opt-in operators — enforcement is now an EXPLICIT, evidence-gated
decision instead of a silent clock event.
FIXING THE SIGNAL stays on .10: a clean CONFIRM must be provable-substantive WITHOUT a defect
citation, which means changing the REVIEWER PROMPT + verdict writer (emit an explicit reviewed-scope
attestation every time), then re-measuring, then flipping deliberately.
Tests: the floor suite is green (it pins behavior via the env override, clock-independent) + a new
regression pinning that the date cannot auto-fire in the near term.
Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
boshu