Scan memory promotion gates

Author: nshkrdotcom

examples/adaptive_control_roundtrip/lib/stack_lab/examples/adaptive_control_roundtrip.ex

@@ -120,6 +120,7 @@ defmodule StackLab.Examples.AdaptiveControlRoundtrip do
           shadow_gate_refs: ["shadow://candidate/worker/v2"],
           canary_gate_refs: ["canary://candidate/worker/v2"],
           approval_refs: ["approval://operator/worker/v2"],
+          citadel_authority_refs: ["authority://citadel/promotion/a"],
           promotion_refs: ["promotion://candidate/worker/v2"],
           rollback_refs: ["rollback://candidate/worker/v1"],
           stale_artifact_rejection_refs: ["stale-rejection://candidate/worker/v1"],

support/adaptive_control_scanner/lib/stack_lab/adaptive_control_scanner.ex

@@ -42,6 +42,7 @@ defmodule StackLab.AdaptiveControlScanner do
     :shadow_gate_refs,
     :canary_gate_refs,
     :approval_refs,
+    :citadel_authority_refs,
     :promotion_refs,
     :rollback_refs,
     :stale_artifact_rejection_refs,

support/adaptive_control_scanner/test/stack_lab/adaptive_control_scanner_test.exs

@@ -54,6 +54,7 @@ defmodule StackLab.AdaptiveControlScannerTest do
              :shadow_gate_refs,
              :canary_gate_refs,
              :approval_refs,
+             :citadel_authority_refs,
              :promotion_refs,
              :rollback_refs,
              :stale_artifact_rejection_refs,
@@ -79,6 +80,24 @@ defmodule StackLab.AdaptiveControlScannerTest do
     assert has_finding?(receipt, :raw_payload, {:forbidden_raw_field, :provider_payload})
   end
 
+  test "rejects promotion facts that lack eval or Citadel gates" do
+    fact =
+      complete_fact()
+      |> Map.delete(:eval_dataset_refs)
+      |> Map.delete(:citadel_authority_refs)
+
+    assert {:ok, receipt} =
+             AdaptiveControlScanner.scan(%{
+               owner_repo: "mezzanine",
+               package_path: "core/adaptive_control_engine",
+               adaptive_control_facts: [fact]
+             })
+
+    assert receipt.status == :open_defect
+    assert has_finding?(receipt, :eval_dataset_refs, :missing_required_refs)
+    assert has_finding?(receipt, :citadel_authority_refs, :missing_required_refs)
+  end
+
   defp has_finding?(receipt, rule, reason) do
     Enum.any?(receipt.findings, fn finding ->
       finding.rule == rule and finding.reason == reason
@@ -95,6 +114,7 @@ defmodule StackLab.AdaptiveControlScannerTest do
       shadow_gate_refs: ["shadow://candidate/worker/v2"],
       canary_gate_refs: ["canary://candidate/worker/v2"],
       approval_refs: ["approval://operator/worker/v2"],
+      citadel_authority_refs: ["authority://citadel/promotion/a"],
       promotion_refs: ["promotion://candidate/worker/v2"],
       rollback_refs: ["rollback://candidate/worker/v1"],
       stale_artifact_rejection_refs: ["stale-rejection://candidate/worker/v1"],

support/memory_fabric_scanner/lib/stack_lab/memory_fabric_scanner.ex

@@ -37,9 +37,17 @@ defmodule StackLab.MemoryFabricScanner do
     :idempotency_key,
     :trace_ref
   ]
+  @promotion_gate_refs [
+    :candidate_ref,
+    :promotion_ref,
+    :rollback_ref,
+    :eval_evidence_refs,
+    :citadel_authority_ref,
+    :appkit_projection_ref
+  ]
   @direct_adapter_module "OuterBrain.MemoryEngine.Store"
   @owner_path "outer_brain/core/memory_engine"
-  @rules [:direct_adapter_calls, :required_runtime_refs]
+  @rules [:direct_adapter_calls, :required_runtime_refs, :silent_memory_candidate_mutation]
 
   @spec scan(map()) :: {:ok, Receipt.t()} | {:error, term()}
   def scan(attrs) when is_map(attrs) do
@@ -132,32 +140,68 @@ defmodule StackLab.MemoryFabricScanner do
       @required_runtime_refs
       |> Enum.reject(&present_string?(fact, &1))
 
-    case missing do
-      [] ->
-        []
-
-      fields ->
-        [
-          finding(
-            :required_runtime_refs,
-            :missing_required_memory_refs,
-            "runtime_fact:#{index}",
-            %{fields: fields}
-          )
-        ]
-    end
+    required_runtime_ref_findings(missing, index) ++ promotion_gate_findings(fact, index)
   end
 
   defp runtime_fact_findings(_fact, index),
     do: [finding(:required_runtime_refs, :invalid_runtime_fact, "runtime_fact:#{index}", %{})]
 
+  defp required_runtime_ref_findings([], _index), do: []
+
+  defp required_runtime_ref_findings(fields, index) do
+    [
+      finding(
+        :required_runtime_refs,
+        :missing_required_memory_refs,
+        "runtime_fact:#{index}",
+        %{fields: fields}
+      )
+    ]
+  end
+
+  defp promotion_gate_findings(fact, index) do
+    if promotion_fact?(fact) and missing_promotion_gate_refs(fact) != [] do
+      [
+        finding(
+          :silent_memory_candidate_mutation,
+          :silent_memory_candidate_mutation,
+          "runtime_fact:#{index}",
+          %{fields: missing_promotion_gate_refs(fact)}
+        )
+      ]
+    else
+      []
+    end
+  end
+
+  defp promotion_fact?(fact) do
+    present_string?(fact, :candidate_ref) or present_string?(fact, :promotion_ref)
+  end
+
+  defp missing_promotion_gate_refs(fact) do
+    Enum.reject(@promotion_gate_refs, fn
+      :eval_evidence_refs -> non_empty_string_list?(fact, :eval_evidence_refs)
+      field -> present_string?(fact, field)
+    end)
+  end
+
   defp present_string?(fact, field) do
     case Map.get(fact, field) || Map.get(fact, Atom.to_string(field)) do
       value when is_binary(value) -> String.trim(value) != ""
       _other -> false
     end
   end
 
+  defp non_empty_string_list?(fact, field) do
+    case Map.get(fact, field) || Map.get(fact, Atom.to_string(field)) do
+      values when is_list(values) and values != [] ->
+        Enum.all?(values, &(is_binary(&1) and String.trim(&1) != ""))
+
+      _other ->
+        false
+    end
+  end
+
   defp owner_path?(path), do: String.contains?(path, @owner_path)
 
   defp status([]), do: :pass

support/memory_fabric_scanner/test/stack_lab/memory_fabric_scanner_test.exs

@@ -22,6 +22,29 @@ defmodule StackLab.MemoryFabricScannerTest do
     assert [%{reason: :missing_required_memory_refs}] = receipt.findings
   end
 
+  test "runtime facts reject silent memory candidate mutation" do
+    assert {:ok, receipt} =
+             MemoryFabricScanner.scan(%{
+               owner_repo: "outer_brain",
+               runtime_facts: [promotion_fact()]
+             })
+
+    assert receipt.status == :pass
+
+    assert {:ok, receipt} =
+             MemoryFabricScanner.scan(%{
+               owner_repo: "outer_brain",
+               runtime_facts: [
+                 promotion_fact()
+                 |> Map.delete(:eval_evidence_refs)
+                 |> Map.delete(:citadel_authority_ref)
+               ]
+             })
+
+    assert receipt.status == :open_defect
+    assert [%{reason: :silent_memory_candidate_mutation}] = receipt.findings
+  end
+
   test "static scanner catches direct adapter references outside memory engine owner path" do
     path = Path.expand("../fixtures/direct_adapter_reference.source", __DIR__)
 
@@ -61,4 +84,16 @@ defmodule StackLab.MemoryFabricScannerTest do
       trace_ref: "trace://a"
     }
   end
+
+  defp promotion_fact do
+    runtime_fact()
+    |> Map.merge(%{
+      candidate_ref: "memory-candidate://tenant-a/a",
+      promotion_ref: "memory-promotion://tenant-a/a",
+      rollback_ref: "memory-rollback://tenant-a/a",
+      eval_evidence_refs: ["eval://memory/a"],
+      citadel_authority_ref: "authority://citadel/promotion/a",
+      appkit_projection_ref: "appkit://memory/promotion/a"
+    })
+  end
 end