Files
boshu2__agentops/scripts
boshu 287c2797eb feat(pawl): surface the embedded bundle stamp in ao pawl doctor — trust-honest (age-pawl-intent-zhndq.19)
F4 stamped the embedded pawl bundle with a deterministic content hash; this surfaces it in
`ao pawl doctor` so the landed!=installed class (an installed ao silently running OLD pawl scripts —
it bit this very session) is diagnosable.

THE DESIGN IS THE LESSON. Two cross-family codex refutes killed the obvious implementation:
  round 1 — I hashed any repo containing scripts/pawl-*.sh and reported STALE. A stranger repo with
            same-named files would be falsely failed.
  round 2 — I gated that on "identity markers" (the verdict schema + pawls contract). Codex refuted
            again, correctly: FILE PRESENCE IS NOT IDENTITY. Every marker is attacker-controlled and
            spoofable, so no marker list can ever make it safe.
The real fix is not a better marker list — it is a TRUST BOUNDARY. A staleness FAILURE must never be
asserted against a repo the binary does not trust. So:
  - trusted dogfood path (untrustedRoot == "", i.e. the ao binary lives inside the checkout — the ONE
    trust decision the whole pawl surface is built on): the LIVE scripts run in place, so there is
    nothing to compare and nothing to warn about;
  - untrusted/installed path: surface the stamp INFORMATIONALLY (so the operator can diagnose
    landed!=installed themselves and rebuild), and assert NO verdict about a repo we cannot trust.
This is the honest feature, not a weaker one: the diagnostic signal is preserved while doctor cannot
be weaponized into failing on an untrusted tree.

Tests: TestPawlBundleStaleness — dogfood surfaces the stamp and never says STALE; an untrusted repo
is never reported STALE *whatever it contains*, including a repo that SPOOFS every identity marker a
naive check might have used.

Claude-Session: https://claude.ai/code/session_01RDWPYn4ZS2SyBkcBvAM18u
2026-07-11 19:49:05 -04:00
..
…