Research: require exact Contract B index at Decision ingress

[camerontjs-dot]

Classification

Draft Research Infrastructure / exact-ingress authority prototype. No production promotion, merge, release, tag, Authorization, execution, or maintained-source change.

Exact base

Decision Engine main@a4425f8eb47449ff6c683222921bbea9483742e2.

Why

Pressure PR #49 established that maintained DE currently proves exact Contract C identity and top-level Contract B bundle identity but does not independently re-establish C proposition/evidence references against the contents of that exact B bundle. The released Contract C 1.0.0 validator already supports contract_b_index validation and rejected every tested internal-reference substitution when supplied the exact real B index.

Result

SUPPORTED_WITH_BOUNDARY.

Science head: cc0bf642a41812dc57a0a0d9b4778199bf03ed69.

Hosted evidence on that exact head:

• push research run 34253951200: SUCCESS;
• PR-event research run 34253982723: SUCCESS;
• normal repository CI run 34253982705: SUCCESS;
• push artifact required-contract-b-index-ingress-34253951200, ID 10067084160, ZIP SHA-256 89323909efc72a4d2d5254e20c3d73838f4d60dc02c20dd92efb5e424d6d9c23.

Prototype

The smallest research-only strict ingress tested:

• exact C bytes + external exact C SHA;
• exact released Contract C authority;
• expected B version/bundle ID/bundle hash;
• exact Contract B index bytes;
• independently supplied exact SHA-256 of those index bytes;
• released Contract C validator invoked with contract_b_index;
• unchanged maintained Decision policy semantics and exact Contract D output.

The implementation is intentionally a research wrapper around maintained ingress so src/** remains unchanged. A production implementation, if justified, should fold the indexed validator call into the shared ingress rather than duplicate validation.

Exact baseline preservation

Exact real CAL Contract C:

sha256:c599e97fd5b4da80ae558d5d57a351fa3b2d37081432013a9dbeaae65a80b5a3

Exact real Contract B index:

sha256:a6a7205c67e912e8f929094c4fb50349b19d768e7742ee26163590fd19de7d63

Observed through strict ingress:

• Policy A -> CLEAR, canonical D unchanged at sha256:db47ebc844c14aa28bbc02524684b1ea7e388e1f1eea7ee8cbc7153af7548200;
• Policy B -> CLEAR, canonical D unchanged at sha256:1f2ddf98a05d5772833984c3747e6cfda5ef7448d5580a73e077897e60cdfa5b.

Therefore the candidate changes ingress authority only, not current positive policy semantics or Contract D bytes.

Reference-substitution pressure

With the exact real B index fixed, every PR #49 substitution was rejected before either policy could run:

• proposition text hash;
• proposition ID;
• evidence passage hash;
• evidence source ID;
• evidence passage ID.

Missing index and wrong expected index digest were also rejected.

Main falsifier: colluding index

A fabricated index was constructed to match a mutated C while retaining the exact same B version, bundle ID, and bundle hash.

Fake index SHA:

sha256:4da1cb03d706385aa5a70f8fdb699cc816d233f0e02a64165c93e1aa7c84b8e7

With the independently fixed expected real index SHA, the fake index failed closed before indexed C validation.

Negative control: when the fake index was allowed to self-declare its own new SHA, the mutated C + fake index became a self-consistent pair and the released indexed validator accepted it; Policy A could CLEAR.

Therefore index presence is not sufficient authority. The exact index identity must itself be established independently of the party supplying the C/index pair. Copying the correct bundle ID/hash into the index does not provide that independence.

Residual boundary

Current CAL RC0 already creates canonical CONTRACT-B-INDEX.json and uses it to validate each produced Contract C object. Its current pipeline receipt records B bundle ID/hash and C validation state, but does not carry an independently authority-bearing SHA-256 for the index file.

So the DE validation shape is supported, but production integration still needs an independent source for the expected index identity, for example a bound upstream receipt or independent reconstruction from exact Contract B. This PR does not choose or implement that upstream authority mechanism.

Durable records

• research/required-contract-b-index-ingress/FINDINGS_AND_APPARATUS_MAP.md records the September pressure findings and exact live DE machinery map, including what prior evidence is maintained versus research-only.
• research/required-contract-b-index-ingress/RESULT.md records this prototype result and boundary.

Non-claims

• no maintained ingress change authorized;
• no Policy A assessment decision resolved;
• no producer-identity policy resolved;
• no Contract B/C/D amendment;
• no Authorization or execution;
• no claim that caller-supplied index + caller-supplied digest is sufficient.

Keep Draft.