id: design: match attestation + audit v1

LIST 10 synthesis. Merge the attestation and audit investigations into the v1 design: attestation flows, witness protocol, audit interface, and how results land in central tracking without central live servers.

Program: Drew's 2026-10-28 directive (full text: hatch-personal memory/topics/id-program-2026-10-28.md).
Working pattern: parallel investigations, then the named synthesis issue merges them into a full design. Route guidance: Workhorse by default; Specialist/Summit for synthesis and ramification-heavy work. A result that says "done" is not the endpoint — the orchestrator reviews it and may commission another round. Deliverables: a markdown design/investigation doc (mermaid/SVG diagrams welcome) linked from this issue, plus follow-up issues for anything buildable. Build a proof of concept where the design calls for one, but do NOT build the permanent feature on top of an unreviewed PoC.

CODE-960

Parent epic: #2056 — ID platform expansion (2026-10-28 directive).

Input ready: #2038 (match audit investigation) is delivered — PR #2252, doc doc/2026-10-29T10-54-33Z_investigation_match_audit_netcode_replay/.

For this synthesis when its inputs complete: the audit side contributes the layered verdict model (L1 integrity / L2 replay / L3 plausibility), the observed-metadata list (incl. the witness-countersigned latency/path/IP treatment — the point where #2037's witness role and #2038's audit meet), and four proposed buildable slices in doc §6, determinism proof first.

This synthesis stays gated: sibling investigation #2037 (match-result attestation) is still open, so #2039 is not ready to start. No new issues were pre-filed from #2038 — the slices are proposed in the doc for this synthesis to adopt or cut.

— queue worker (repo-worker-code), Lane D, queue task 3351

Correction to my note above: sibling investigation #2037's triage (queue task 3350) is in fact complete — its investigation is posted on #2037 and its PoC follow-on was routed separately. So #2038 (PR #2252, currently parked on CI) is the last remaining input to this synthesis: once PR #2252 merges and task 3351 completes, both named inputs to #2039 are delivered and the gate lifts (subject to the orchestrator's review round on the two investigations).

— queue worker (repo-worker-code), Lane D, queue task 3351

docs(id): fix review round-3 findings on match audit — checkpoint-int…

agent-note:v1 — task 5730 design triage record (lane A shift, 2026-11-01). LIST 10 synthesis: merges investigation #2037 (match-result attestation, CLOSED; doc merged via PR #2805, doc/2026-10-30T19-20-40Z_investigation_match_result_attestation/) and #2038 (match audit, CLOSED; doc doc/2026-10-29T10-54-33Z_investigation_match_audit_netcode_replay/, on main) into the v1 design decisions + build order.

Already proven / landed (verified today)

The mutual-concession core is NOT speculative: PoC id: PoC: mutual-concession match attestation on the tic-tac-toe example — genesis agreement + dual signed result claims, offline-first (from #2037) #2248 is CLOSED, its fix task 3953 done — genesis agreement + dual signed result claims work on tic-tac-toe, offline-first.
The one hard prerequisite is open and was unqueued until today: id: player-signed move capture for world games — prerequisite for match attestation (#2037/#2039) #2814 player-signed move capture (inputs are host-journaled today, not player-signed — Codex finding on PR doc: match-result attestation investigation (#2037) #2805).
Both investigation docs are on main; the merge-queue jam that delayed the id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038 doc (PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252) has cleared.

Decisions (the synthesis calls, with why)

Objection windows: v1 accepts objections through the outer cap. The id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037 honesty limit stands: a self-authored frontier does not prove receipt time, so a short enforceable window needs countersigned sync-receipt evidence — new machinery v1 does not need to count results correctly. Receipt evidence is the named v1.1 upgrade, not a silent gap.
Validity lives at the attestation layer. Fork invalidation does not propagate through the store (resolve.rs, per the id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037 round-2 finding), so v1 counting views apply the attestation-layer validity rule from that doc; do not patch the store for this.
Witness policy is a registry view, not a global list. A registry expresses acceptable witnesses/logic as a witness set on its own view — the id: investigate: trust/visibility model — servers accept all signed objects; views count only allowed writers #2030 writer-set pattern. Witness decisions keep the partial evidence variant so non-submission cannot block adjudication.
Float policy: v1 claims pinned-runtime validity, labelled as such. The audit doc (§3.5, §6) is explicit that bit-determinism across architectures may fail on float discipline; L2 verdicts say "valid on the pinned runtime" until the determinism proof (task 5781) measures otherwise. A fixed-point mandate for competitive worlds is decided WITH that evidence, not before.
Stakes profiles are part of the rules hash (audit §6 Q3, adopting the recommendation in that doc): changing the screen must not silently re-judge old matches. Routine L2 spot-check sampling uses checkpoint-hash-committed selection, so neither side picks the segment after seeing the log.
Offline matches: L1/L2-valid, L3 permanently INCONCLUSIVE (no observed metadata exists). Worth: they count in casual/personal tracking views; staked or ranked registry views require a witness/relay-observed match. Pretending otherwise is the failure the audit doc warns against.
Audit is not prevention — every user-facing description of v1 must carry the limit from the audit doc: it raises cheating cost and makes disputes decidable after the fact; it does not stop a sophisticated in-match cheat.

Build order (all enqueued today)

task 5780 — fix id: player-signed move capture for world games — prerequisite for match attestation (#2037/#2039) #2814: player-signed move capture (phase 0 prerequisite). Dedupe repo-health:v1:fix:developing-today/code:issue:2814.
task 5781 — fix id: determinism proof — replay harness over the world clock, cross-machine checkpoint hashes (from #2039) #3791 (filed today): determinism proof — replay harness over the world clock, cross-machine checkpoint hashes. Gates the rest; a measured divergence routes decision 4 back here with evidence. Dedupe ...:issue:3791.
task 5782 — fix id: match attestation v1 — signed result objects, state machine, counting views in pkgs/id (from #2039) #3792 (filed today): attestation v1 — signed result objects, state machine, counting views; the four worked examples from the id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037 doc as tests. Dedupe ...:issue:3792.
task 5783 — fix id: match audit v0 — netcode log format + tic-tac-toe exporter + verifier CLI (L0-L2) (from #2039) #3793 (filed today): audit v0 — log format + tic-tac-toe exporter + verifier CLI (L0–L2, closed verdict vocabulary, technically-valid vs actually-valid kept distinct). Dedupe ...:issue:3793.
Deferred deliberately: observed-metadata capture (audit slice 4 — needs a production witness role), dispute-remedy automation (policy exists in the docs; automation is v1.1), sync-receipt evidence (decision 1).

Questions for Drew

None blocking. The two judgment calls a reader might expect to escalate — dispute-remedy policy and witness trust defaults — are already answered inside the ratified investigation docs (remedy policy in the abuse cases of #2037; witness selection/trust in its witness section), so v1 implements those; if Drew wants different remedy terms for staked play, that is a registry-policy choice he can set per registry under decision 3, not a blocker for the build.

agent-note:v1
state: triaged (coverage pass)
Coverage pass 2026-11-03: reviewed in the fleet-wide per-issue pass (drift / overlap / already-handled / stale / blockers / ordering). Verdict: still live; queued in repo-health-code-pilot as triage at priority 30 (priority/none). If this is already handled at current main, the triage closes it with evidence; if it needs splitting, the triage files the split.
Found via: coverage pass 2026-11-03

🤖 Agent note · done

Agent: queue worker (repo-worker-code), lane code-h
Session / ID: task 8585
Found via: queue claim
Task: Triage of issue id: design: match attestation + audit v1 #2039 at current main — outcome: already done, verified fresh this shift (third pass reaching this verdict, after task 5909 on 2026-11-02 and task 7830 on 2026-11-03).
Expectation: effort s; done = evidence below.
Links: queue task 8585 (repo-health-code-pilot)

Evidence (fresh, 2026-11-03):

The synthesis the issue asks for exists on main: doc/2026-11-01_design_id2039.md — §1–2 attestation flows (signed agreement, transcript, claims), §3 witness protocol, §4 objections/receipt/finality, §5 audit interface and verdict vocabulary, §6 observed metadata/privacy, §7 tracking without central live servers, plus invariants, implementation acceptance criteria, and a phased plan in §8.
Both named inputs are delivered and CLOSED: issue id: investigate: match-result attestation — mutual concession, witness adjudication, offline play #2037 (attestation investigation) and issue id: investigate: match audit — netcode log format, replay validation, and cheating signals #2038 (audit investigation); PR docs(id): match audit investigation — netcode log format, replay validation, cheating signals (#2038) #2252 merged 2026-10-30.
No follow-up implementation task is enqueued from this triage, by the design's own instruction (§8): "Do not create implementation issues in this design change; split them after this design receives its review" — the phased split is gated on the design review under parent epic epic: ID platform expansion — apps, comms, currency, hosting, boards (2026-10-28 directive, LIST 6–15) #2056, and the signed-input prerequisite already exists as issue id: player-signed move capture for world games — prerequisite for match attestation (#2037/#2039) #2814.
The issue itself stays OPEN for that design review (the LIST-10 pattern: a synthesis result is reviewed by the orchestrator, who may commission another round); queue task 8585 completes as already_done.

Navigation Menu

Repository navigation

id: design: match attestation + audit v1 #2039

LIST 10 synthesis. Merge the attestation and audit investigations into the v1 design: attestation flows, witness protocol, audit interface, and how results land in central tracking without central live servers.

Already proven / landed (verified today)

Decisions (the synthesis calls, with why)

Build order (all enqueued today)

Questions for Drew

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

id: design: match attestation + audit v1 #2039

Description

LIST 10 synthesis. Merge the attestation and audit investigations into the v1 design: attestation flows, witness protocol, audit interface, and how results land in central tracking without central live servers.

Activity

developing-today commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Oct 29, 2026

dezren39 commented on Nov 1, 2026

Already proven / landed (verified today)

Decisions (the synthesis calls, with why)

Build order (all enqueued today)

Questions for Drew

11 remaining items

dezren39 commented on Nov 3, 2026

dezren39 commented on Nov 3, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions