fix(holoindex): restore truthful RedDog query boundary

Merge PR #1282: canonical HoloIndex truth boundary, serialized RedDog owner, governed maintenance, WSP evidence, and CodeQL log-redaction fix.

Author: Foundup

.env.example

@@ -54,10 +54,31 @@ HOLO_DISABLE_PIP_INSTALL=false
 HOLO_BREADCRUMB_ENABLED=true
 HOLO_BREADCRUMB_LOGS=true
 HOLO_REWARD_VARIANT=A
+# Canonical HoloIndex store (legacy HOLO_SSD_PATH remains supported during migration)
+HOLOINDEX_SSD_PATH=E:/HoloIndex
 HOLO_SSD_PATH=E:/HoloIndex
 HOLO_CACHE_PATH=E:/HoloIndex/cache
 HOLO_MODEL_ROOT=E:/HoloIndex/models
 
+# The supported RedDog adapter queries a host-owned service at literal
+# 127.0.0.1. This application boundary exposes no indexing API; it is not an
+# operating-system privilege boundary. Deploy worker processes under an OS
+# identity without write access to the canonical store when hard isolation is
+# required.
+# For an externally supervised owner, generate a token of at least 32
+# characters outside the repository and set the same value in the owner and
+# worker environments before enabling the URL. Automatic startup instead uses
+# an ephemeral process-private handoff and never exports its token here or to
+# the parent environment.
+# HOLOINDEX_QUERY_SERVICE_URL=http://127.0.0.1:8127
+# HOLOINDEX_QUERY_SERVICE_TOKEN=
+# Trusted-host RedDog lifecycle: auto-start and exact-HEAD refresh are enabled
+# for autonomous/headless work. The supported worker adapter has no maintenance
+# surface; filesystem/process rights must be restricted separately by the host.
+REDDOG_HOLOINDEX_OWNER_AUTO_START=1
+REDDOG_HOLOINDEX_AUTO_MAINTENANCE=1
+REDDOG_HOLOINDEX_MAINTENANCE_TIMEOUT_SECONDS=1800
+
 # Central local model routing (single source of truth for local LLM files)
 # Model root with role-based folders:
 #   triage -> gemma-270m

ModLog.md

@@ -1,5 +1,44 @@
 # FoundUps Agent - Development Log
 
+## [2026-07-18] HoloIndex / RedDog Operational Truth Boundary POC Phase 1
+
+**WSP Protocol**: WSP 00, 05, 06, 15, 22, 34, 50, 62, 64, 81, 84, 87, 96, 97
+**Phase**: Cross-module POC implementation complete; publication pending
+**Agent**: 0102 architect for 012 with delegated audit/test workers
+
+**Changes**:
+
+- Established one canonical HoloIndex storage, maintenance-lease, invalidation,
+  exact-HEAD receipt, and seven-collection complete source-scope contract.
+- Added semantic-only trusted full maintenance and a literal-127.0.0.1 bearer query
+  owner with process-private handoff, authenticated health canary, generation
+  binding, and timeout poisoning.
+- Wired interactive/headless RedDog and startup maintenance dispatch to fail
+  closed before Holo-dependent worker execution.
+- Corrected incremental, malformed-registry, scoped/capped source, linked
+  worktree, direct-adapter, and downstream freshness truth boundaries.
+- Replaced caller-controlled HoloIndex timeout/exception log text with stable
+  redacted codes after the PR CodeQL gate identified two high-severity flows.
+- Added the WSP_97 high-risk assumption audit, WSP_15 P0 record, module
+  ROADMAP/TestModLogs, operator runbook, and machine contract.
+
+**Impact**: The migrated RedDog POC consumers can consume generation-bound
+semantic repository evidence without opening Chroma through the supported
+adapter. HoloIndex writes remain a separate trusted-host authority; startup may
+route maintenance requests through governed WRE dispatch. OS privilege
+isolation and the legacy foundups_mcp_bridge `holo_tools.py` direct-store path
+remain outside this claim. This is a prerequisite for governed FoundUp
+build/repair recursion, not a claim of unrestricted production autonomy.
+
+**WSP Compliance**: Work was isolated from concurrent lanes in a dedicated Git
+worktree and focused branch; no framework WSP or knowledge mirror changed.
+MODULE_CONCATENATION_GATE.md remains correctly unmirrored because it is a
+non-protocol quick reference. The final HoloIndex matrix passed 346 tests, the
+final non-overlapping focused matrices passed 745 tests, the independent
+boundary/security review passed 289 tests, all 81 changed or added Python files
+compiled, WSP_00 remained green, and the WSP_97 structural receipt validated.
+PR evidence and clean-main post-merge activation remain pending.
+
 ## [2026-07-04] docs(audit): RedDog FoundUp creation path audit + WSP_109 slice ordering (0102 architect, WSP_97)
 
 **Change Type**: DECISION_ONLY_DOCS — audit record and slice specs; no runtime mutation.

docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md

@@ -0,0 +1,81 @@
+{
+  "execution_id": "HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1",
+  "execution_plane": "wre_runtime",
+  "outcome": "completed",
+  "action_evidence": {
+    "retrieve_wsps": [
+      "HoloIndex was queried before implementation in offline lexical diagnostic mode; authoritative framework WSP files were then read directly.",
+      "WSP_framework/src/WSP_00_Zen_State_Attainment_Protocol.md",
+      "WSP_framework/src/WSP_15_Module_Prioritization_Scoring_System.md",
+      "WSP_framework/src/WSP_62_Large_File_and_Refactoring_Enforcement_Protocol.md",
+      "WSP_framework/src/WSP_96_WRE_Skills_Wardrobe_Protocol.md",
+      "WSP_framework/src/WSP_97_WSP_CODING_AGENTS_SYSTEM.md"
+    ],
+    "retrieve_evidence": [
+      "docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md",
+      "holo_index/docs/HOLO_INDEX_MACHINE_LANGUAGE_SPEC_0102.json",
+      "modules/infrastructure/foundups_mcp_bridge/HOLO_QUERY_OWNER_RUNBOOK.md"
+    ],
+    "research": [
+      "Audited canonical storage, receipt freshness, semantic backend, linked-worktree HEAD, RedDog startup, and downstream worker paths.",
+      "Verified the cached sentence-transformers artifact loads offline at dimension 384 and bound its content fingerprint to all baseline collections.",
+      "Compared framework WSP authority with knowledge backups; no WSP or backup was modified."
+    ],
+    "micro_pass": [
+      "Focused regressions cover malformed and duplicate receipts, model/runtime fingerprint mismatch, owner poisoning, redirect/proxy denial, response-body timeout, and repository races.",
+      "modules/infrastructure/foundups_mcp_bridge/tests",
+      "holo_index/tests/test_holoindex_embedding_space.py"
+    ],
+    "macro_pass": [
+      "Final no-overlap focused validation: 745 passed across HoloIndex, infrastructure owner, RedDog query/downstream, and idle-maintenance matrices.",
+      "Final HoloIndex validation: 346 passed across storage/source/CLI/embedding, freshness/maintenance, incremental/work-ledger, and machine-contract matrices.",
+      "Independent owner/client/maintenance/security validation: 289 passed.",
+      "All 81 changed or added Python files compiled without writing bytecode."
+    ],
+    "hard_think": [
+      "docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md#3-failure-modes",
+      "Separated response-body absolute deadlines from the documented trusted cooperative loopback-header assumption.",
+      "Rejected legacy receipts and stores without generation and embedding-space fingerprints."
+    ],
+    "dialectic_sweep": [
+      "docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md#4-alternatives-considered",
+      "Adversarial reviewers tested false-CURRENT paths, stale owner generations, cross-lane repository changes, malformed scope, and duplicate collection entries."
+    ],
+    "first_principles": [
+      "One canonical writer, one serialized semantic owner, exact repository identity, exact seven-collection scope, and fail-closed freshness are the minimum truthful POC boundary.",
+      "docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md#5-decision-record"
+    ],
+    "execute": [
+      "holo_index/storage_contract.py",
+      "holo_index/freshness_receipt.py",
+      "holo_index/embedding_space.py",
+      "modules/infrastructure/foundups_mcp_bridge/src/holo_query_service.py",
+      "modules/communication/moltbot_bridge/src/reddog_holoindex_owner_query_client.py"
+    ]
+  },
+  "wsps_applied": [
+    "WSP_00",
+    "WSP_05",
+    "WSP_06",
+    "WSP_15",
+    "WSP_22",
+    "WSP_34",
+    "WSP_50",
+    "WSP_62",
+    "WSP_64",
+    "WSP_81",
+    "WSP_84",
+    "WSP_87",
+    "WSP_96",
+    "WSP_97"
+  ],
+  "compliance_evidence": [
+    "Dedicated worktree and branch: fix/holoindex-reddog-poc-phase1.",
+    "No framework WSP or knowledge-backup file changed.",
+    "MODULE_CONCATENATION_GATE.md remains unmirrored because it is an annex, not a WSP.",
+    "docs/audits/infrastructure/HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1.md",
+    "holo_index/tests/TESTModLog.md",
+    "modules/infrastructure/foundups_mcp_bridge/tests/TestModLog.md",
+    "modules/communication/moltbot_bridge/tests/TestModLog.md"
+  ]
+}

docs/audits/infrastructure/HOLOINDEX_REDDOG_WSP97_EXECUTION_RECEIPT_PHASE1.json

@@ -32,6 +32,27 @@ holo = HoloIndex(ssd_path="E:/HoloIndex", quiet=True)
 results = holo.search("send chat message", limit=5, doc_type_filter="all")
 ```
 
+Storage resolution is deterministic:
+
+1. explicit ssd_path / --ssd
+2. HOLOINDEX_SSD_PATH
+3. legacy HOLO_SSD_PATH
+4. platform-safe absolute default
+
+HOLOINDEX_QUERY_READONLY=1 requires an existing
+vectors/chroma.sqlite3, never creates directories or collections, and never
+writes the repository activity log. Storage failures raise
+HoloIndexStorageError with one of the stable codes
+HOLOINDEX_STORAGE_UNAVAILABLE, HOLOINDEX_STORAGE_NOT_WRITABLE,
+HOLOINDEX_STORAGE_PATH_MISMATCH, or HOLOINDEX_COLLECTION_UNAVAILABLE.
+ChromaDB itself is not a read-only database client. The supported RedDog
+operational adapter uses the host-owned service at literal `127.0.0.1`, as
+documented by modules/infrastructure/foundups_mcp_bridge/INTERFACE.md. This
+adapter boundary is not an OS privilege boundary; host deployment must enforce
+filesystem/process permissions separately when required. Legacy consumers,
+including foundups_mcp_bridge `holo_tools.py`, remain outside this Phase-1
+migration and may still open the store directly.
+
 Search response contract:
 ```python
 {
@@ -92,6 +113,29 @@ holo.index_test_registry()
 holo.index_skillz_entries()
 ```
 
+Each indexing method returns IndexResult. A zero/invalid test registry does
+not reset navigation_tests. The canonical
+WSP_knowledge/WSP_Test_Registry.json envelope is read from its tests list;
+legacy mapping-only registries remain supported during migration. Any
+malformed row in a mixed registry fails the result before embeddings or reset;
+it cannot be silently filtered from a complete proof.
+
+Scoped maintenance receipts must name only successfully refreshed
+collections. Untouched collection proof is carried forward with its original
+repository SHA, or marked UNVERIFIED when no prior proof exists.
+
+Mutation owners use MaintenanceSession (CLI) or the incremental executor to
+prove a clean Git worktree, acquire the canonical cross-process lease, and
+publish atomic IN_PROGRESS invalidation before collection access. Final PASS
+requires the same clean HEAD, exact declared collection scope, non-empty
+manifests, the canonical source_scope_id for every baseline collection, zero
+recorded source-read, cap, or Python-AST failures, and a durable atomic receipt
+write. Canonical proofs cover Git-tracked sources and full raw source content.
+They do not assert zero failures for every legacy format parser. Query
+consumers fail closed
+with HOLOINDEX_MAINTENANCE_ACTIVE or
+HOLOINDEX_MAINTENANCE_LOCK_UNPROVEN.
+
 ### Module Compliance Helper
 ```python
 status = holo.check_module_exists("modules/communication/livechat")
@@ -125,10 +169,23 @@ python holo_index.py --search "query" --fast-search
 python holo_index.py --index-all
 python holo_index.py --index-code
 python holo_index.py --index-wsp
+python holo_index.py --index-tests
 python holo_index.py --index-symbols --symbol-roots modules/foundups
 python holo_index.py --index-skillz
 ```
 
+--index is an exact alias for --index-all. The baseline set is code, symbols,
+WSP, tests, skills, docs, and knowledge. Work-ledger and CLI-catalog
+generation remain explicit targeted operations and are not implied by
+--index-all.
+
+Canonical --index-all fixes its symbol roots to modules, scripts, and
+holo_index; its WSP root to WSP_framework/src; and its web root/extensions to
+the versioned source-scope contract. Scoped roots, file/entry caps, disabled
+web indexing, or unreadable sources are diagnostic/incomplete and cannot
+publish CURRENT baseline proof. Semantic backend initialization is required
+before any baseline collection reset.
+
 ### Machine Bundle Output
 ```bash
 python holo_index.py --bundle-json --search "task" --bundle-module-hint modules/foundups/agent_market
@@ -157,9 +214,15 @@ python holo_index.py --health-check
 - `HOLO_SKIP_MODEL=1`: force lexical retrieval path.
 - `HOLO_MIN_SIMILARITY=0.35`: vector hit floor.
 - `HOLO_FAST_SEARCH=1`: retrieval-only fast path.
-- `HOLO_INDEX_WEB=1`: include web assets during `--index-code`.
+- `HOLO_INDEX_WEB=1`: include web assets during a targeted diagnostic
+  `--index-code`; trusted baseline maintenance uses the canonical tracked web
+  scope and does not accept this override.
 - `HOLO_SYMBOL_AUTO=1`: auto symbol indexing during `--index-code`.
 
+- HOLOINDEX_SSD_PATH: canonical persistent store root.
+- HOLO_SSD_PATH: legacy store-root alias, lower precedence.
+- HOLOINDEX_QUERY_READONLY=1: fail-closed query posture; no HoloIndex maintenance writes.
+
 ## Internal CLI Module Layout
 
 The monolithic `cli.py` has been restructured into a package:

holo_index/INTERFACE.md

@@ -1,5 +1,66 @@
 # HoloIndex Package ModLog
 
+## [2026-07-18] HOLOINDEX_REDDOG_OPERATIONAL_TRUTH_BOUNDARY_POC_PHASE1
+
+**WSP Protocol**: WSP 00, 05, 06, 15, 22, 34, 50, 62, 64, 84, 87, 96, 97
+**Phase**: POC implementation complete; focused validation green; PR checks pending
+**Agent**: 0102 architect for 012 with delegated audit/test workers
+
+**Changes**:
+
+- ADD canonical storage resolution and typed failure codes; read-only
+  initialization no longer creates paths, collections, or repository logs.
+- FIX canonical test-registry indexing and expose --index-tests; --index and
+  --index-all now select the same seven-collection baseline without implicitly
+  generating CLI catalogs or work-ledger state.
+- ADD clean-repository proof, cross-process maintenance lease, atomic
+  IN_PROGRESS invalidation, and same-HEAD final PASS publication. Incomplete
+  CLI plans and receipt failures exit nonzero and leave invalid proof in place.
+- BIND every baseline collection to a versioned canonical source_scope_id.
+  Canonical proof includes Git-tracked sources, full raw-content manifests,
+  and zero recorded source-read, cap, or Python-AST failures; scoped
+  diagnostics cannot publish CURRENT. No blanket all-parser claim is made.
+- REQUIRE semantic backend initialization before baseline collection reset.
+- BIND PASS receipts to each collection's backend, logical model, and
+  deterministic local-artifact embedding_space_fingerprint; canonical
+  maintenance rejects lexical, quantized-only, legacy blank, and mixed-space
+  proof.
+- FIX offline Hugging Face snapshot discovery (models--.../snapshots/<rev>)
+  with refs/main selection and complete-artifact checks. Model/import timeout
+  helpers now return promptly instead of waiting during executor shutdown.
+- REDACT timeout/dependency/failure diagnostics to stable codes and exception
+  class names; caller-controlled query, path, hint, and exception text is never
+  written to the timeout-wrapper log.
+- HARDEN the resident RedDog owner by forcing fp32 routing, disabling the
+  generation-unbound SearchCache, comparing all seven live/reported
+  collection_embedding_space_map values, and poisoning a backend that sees a
+  different receipt generation.
+- ADD owner-only strict-semantic execution: collection count/query failures,
+  missing models, and encoding failures reject the request; lexical and
+  symbol/rg augmentation remain available only to non-owner diagnostics.
+- FIX scoped freshness so untouched proof retains its original SHA or becomes
+  UNVERIFIED instead of being restamped current.
+- UPGRADE the FoundUp incremental executor to receipt schema v2: exact-path
+  legacy cleanup, deterministic AST symbol records, exact collection scope,
+  partial-mutation truth, and mandatory lease/invalidation. Snapshot-only
+  output now remains invalid and returns proof failure instead of APPLIED.
+- UPDATE machine/human contracts for the supported RedDog owner-adapter
+  boundary, explicitly separate from OS privilege isolation.
+- HoloIndex was queried before implementation in offline lexical mode. The
+  lexical result was retained as an index-gap signal and not claimed as
+  semantic evidence. No WSP framework file or knowledge backup was changed.
+
+**Impact**: Trusted-host maintenance can prove an exact canonical generation
+while the migrated RedDog adapter remains query-only. OS isolation and legacy
+direct-store consumers remain outside that claim. Malformed, narrowed, capped,
+lexical, dirty, raced, and snapshot-only paths cannot claim operational
+freshness through the migrated boundary.
+
+**WSP Compliance**: New helpers meet focused WSP_62 thresholds; exact temporary
+exemptions and ROADMAP remediation cover inherited monolith debt. The final
+HoloIndex matrix passed 346 tests, changed Python compiled, and the WSP_97
+assumption audit and WSP_15 P0 score are recorded in the cross-module audit.
+
 ## [2026-07-16] HOLOINDEX_MEMEX_PER_TARGET_RETRIEVAL_VERDICT_PHASE1
 
 **Agent**: 0102 (Codex) | Commander: 012 | Gate: implementation slice