ce-615: public dispatch-receipt surface + brain assertion supersession

[ce-overwatch]

Supersedes #1048, which was opened from a branch whose carrier slug no longer matches and whose head is 8 merges stale. Same work, rebased onto current main with the brain-drift blocker resolved.

Content

The dispatch-receipt v1 surface: schema, shared library module with fail-closed typed errors, additive ce dispatch-receipt CLI group, public docs row, regenerated reference docs. Product-lens scrub applied.

Plus the piece that was blocking it: a brain assertion supersession.

Why the supersession was needed

Assertion brain-assertion-0ca9d4cfca4dc66ee6e5286e states that adding a top-level ce CLI group couples docs reconciliation and generated CLI reference updates in the same change. ce-615 adds ce dispatch-receipt and its carrier modifies validators/tests/unit/test_v1_docs_reconciliation.py — the evidence file that assertion pins — without updating the pinned digest.

Main itself is clean (claim and file both hash 8c1514f5…), so this was ce-615's own incomplete coupling, not inherited debt. The gate was correctly refusing an unfinished carrier.

How it was fixed — and how it was NOT fixed

Editing evidence_sha256 in place would have broken the record hash chain from sequence 197 onward. The supported path is ce brain correct — append a supersession marker plus a corrected successor. Append-only, never mutate; the same discipline ce-627 enforced on the side-effect ledger.

Verified: zero removed lines in assertions.yaml, record 197 untouched, successor pins b77d8e04… matching the evidence file exactly as shipped, and the marker deliberately retains the old digest as historical record rather than scrubbing it.

A second supersession, and why it is there

Independent review caught that the first successor's statement field had collapsed to a generic doctrine-item asserts … template — the real doctrine survived only in claim.details. Since the successor is the record that goes forward active and is read by every future consumer, the doctrine had been quietly hollowed out on exactly the record that matters.

ce brain correct has no amend route, so repairing it required appending a second supersession pair. The lineage is therefore 197 → 199 → 201, with the doctrine text restored verbatim on the active record. That is correct append-only behaviour, not noise to be cleaned up.

The underlying tool defect is filed as ce-ops#636: omitting --statement derives a lossy template, and the loss lands asymmetrically on the surviving record while the superseded marker keeps the true wording.

Verification

• ce brain verify: PASS — 202 records, 45 active, zero errors.
• verify-path-manifest against 607fd6b6: PASS.
• verify-work-sizing-floor --declared-work-class epic: PASS.
• Carrier byte-verified controller-side: 11 paths, digest ba091396a3c8380b9347d6b7733aa4c5806b34e157ac8a6aee72cbf0f4e91b02.

Prior review on the receipts work: COMMENT 0 High / 2 Medium / 4 Low, Mediums folded into the slice-2 ticket. Supersession reviewed separately: REQUEST_CHANGES 0/1/1, both items now closed.

• Declared work class: epic

🤖 Generated with Claude Code

ce-approval-capability: v1.eyJhcHByb3ZlZF9ieSI6ImNlLWRldi0yIiwiZXhwaXJlc19hdCI6MTc4NDU2NzIzMSwiaGVhZF9zaGEiOiJiY2U0NzAxZDNiZDgzNDJiZTVmNDBhZDliYTdkNGY1ZGZmMjdlNWRkIiwiaXNzdWVkX2F0IjoxNzg0NTYzNjMxLCJwb2xpY3lfc2hhIjoiNzliOWRjOGI0MjllNGFmMTA5ZWNjNjhhZjE5YjI2ZTliM2Y2NDdkOWZhZDhkZDM3MzA5ZDZmNWVhZDgxYjNiMCIsInByX251bWJlciI6MTA1NiwicmVwbyI6ImNyZWF0b3ItZW5naW5lL2NyZWF0b3ItZW5naW5lIn0.T9GdhH_eMBwvl2l9LHSk1_EWByETAPQCQHp82eReSPU

[ce-dev-2]

Two-key approval bound to exact head f8153592156164e3e92ca2b060b456fbddac8c6c.

Controller byte-verification: 11 paths, LC_ALL=C sort -u digest ba091396a3c8380b9347d6b7733aa4c5806b34e157ac8a6aee72cbf0f4e91b02, base 607fd6b6 confirmed ancestor, zero gate-surface paths.

Independently verified rather than accepted from the seal:

• .ce/brain/assertions.yaml has zero removed lines — the supersession is genuinely append-only and record 197 is untouched.
• The successor pins evidence_sha256: b77d8e04…, matching the evidence file exactly as this carrier ships it. A supersession pinning the old or a wrong digest would look fixed while leaving the drift live; it does not.
• The active record now carries the real doctrine text verbatim; the degraded templated statement remains only on the superseded intermediate, where it is harmless historical record.

Review chain: receipts work COMMENT 0H/2M/4L (Mediums → slice-2 ticket); supersession REQUEST_CHANGES 0H/1M/1L, Medium closed by restoring the doctrine statement, Low dismissed by the controller after verifying epic is a valid legacy alias for L in work_sizing.py and that a higher declared class always clears the floor.

Seat-side gate evidence: ce brain verify PASS (202 records, 45 active, zero errors), verify-path-manifest PASS, verify-work-sizing-floor PASS.

Supersedes #1048, closed as stale-base with slug mismatch. Author dev-3; approver ce-dev-2; independent review venues throughout. No signing performed by any worker.

[ce-dev-2]

Two-key approval re-bound to exact head 448546760ebf8707793afab60569ae531d7fed78. Supersedes the approval on f8153592, voided by a CI failure that was mechanical, not substantive.

WHY THE HEAD MOVED. schema_reference_autogen_sync failed: ce-615 adds dispatch-receipt.v1.schema.yaml, and the generated reference still declared the pre-addition schema count. This is the same coupling class the brain supersession in this very carrier already fixed — adding a schema obliges regenerating its reference in the same change, exactly as adding a top-level ce CLI group obliges reconciling the docs. The gate correctly refused an incomplete carrier.

WHAT CHANGED — a single line, verified by diff against the previously approved head:

-Schema files: 79
+Schema files: 80

Produced by the supported generator (scripts/gen_schema_reference.py --write), not by hand-editing the generated file. The registered sync check now returns PASS.

Carrier UNCHANGED: still 11 paths, digest ba091396a3c8380b9347d6b7733aa4c5806b34e157ac8a6aee72cbf0f4e91b02, base 607fd6b6 ancestor, zero gate surface. The prior review verdicts are inherited — a regenerated schema count cannot alter reviewed behaviour.

Worth recording: the author first reported this BLOCKED, believing PyYAML was missing. I verified inside the container — PyYAML 6.0.3 was present in both the default interpreter and the validator venv; the check had simply been invoked under an interpreter that could not see it. Re-running under PYTHONPATH=validators /opt/ce-validator-venv/bin/python resolved it. The author correctly did NOT commit unverified output or hand-edit the generated artifact to force the check green, which is why this cost one unblock rather than a correction round.

Author dev-3 (supersession) and dev-4 (schema sync); approver ce-dev-2; independent review venues throughout. No signing performed by any worker.

[ce-dev-2]

Two-key approval re-bound to exact head bce4701d3bd8342be5f40ad9ba7d4f5dff27e5dd. Supersedes the approval on 448546760.

WHY THE HEAD MOVED. test_ce_brain_drift.py:819 asserted a hardcoded global count, assert len(active) == 121. This carrier's two legitimate brain supersessions moved the real count to 123. Unlike the three prior blockers on this carrier — schema-reference sync, confidentiality guard, drift check — this was a test asserting an accident rather than an invariant: it pinned a global number that governed work is supposed to change, so every legitimate assertion append would break it in perpetuity.

WHAT CHANGED. Replaced with assert len(active) >= 123, the floor independently measured at the admitted head, with a comment explaining the intent. That retains the check's real protection — silent loss of a material portion of the migrated active set — while no longer making every governed append a mandatory test edit. The concrete probe and record assertions immediately below preserve semantic coverage.

I asked the author to assess whether the assertion should exist in that form at all, and said explicitly that if it concluded the exact count was correct for a reason I was not seeing, it should say so and leave it — I would rather be corrected than have a check weakened to stop it complaining. It chose the floor and justified it. That is the right distinction between fixing a brittle test and defeating a real one.

Carrier grows to 12 paths, digest 01d19850141088b474fe4e3eaf1af4e73c3608146834686d45373af396f298ab, matching the manifest and my independent recomputation.

Author dev-3 (supersession, test floor) and dev-4 (schema sync); approver ce-dev-2; independent review venues throughout. No signing performed by any worker.

[ce-dev-2]

Two-key approval bound to exact head bce4701d3bd8342be5f40ad9ba7d4f5dff27e5dd.

Re-issued: the prior approval bound to 448546760e, not to this head, because I chained the push and the approve in a single command and the approval registered before GitHub saw the new head. The PR was therefore genuinely unapproved at its current commit despite showing three APPROVED reviews — a stale-marker head mismatch, self-inflicted. Verified corrected below.

Carrier byte-verified controller-side: 12 paths, LC_ALL=C sort -u digest 01d19850141088b474fe4e3eaf1af4e73c3608146834686d45373af396f298ab, matching the manifest. Base 607fd6b6 confirmed ancestor. Zero gate-surface paths.

Both required checks are GREEN at this head — the first clean run on this carrier after four consecutive, distinct blockers: brain-assertion drift, schema-reference autogen sync, and a brittle hardcoded active-count test.

Content verified independently rather than taken from seals:

• .ce/brain/assertions.yaml: zero removed lines — the supersessions are genuinely append-only, record 197 untouched.
• The active successor pins b77d8e04…, matching the shipped evidence file exactly, and carries the real doctrine text verbatim.
• test_ce_brain_drift.py: the hardcoded == 121 is replaced by a floor >= 123 at the independently measured count, retaining protection against silent loss of the migrated active set without making every governed append a mandatory test edit.
• Work class recomputed, not eyeballed.

Review chain: receipts work COMMENT 0H/2M/4L (Mediums → slice-2 ticket); supersession REQUEST_CHANGES 0H/1M/1L with the Medium closed by restoring the doctrine statement and the Low dismissed after verifying epic is a valid legacy alias.

Authors dev-3 (supersession, test floor) and dev-4 (schema sync); approver ce-dev-2; independent review venues throughout. No signing performed by any worker.