3.4 Trusted Handoff Hooks & Independent Verification
chinwag handoff verify --hooks H1,H2,H3,H4,H5Deep dive into Hooks H1..H5, why a 1-byte post-review edit triggers WP-04 Stale Evidence, and why Policy Satisfied never grants automatic merge authority (WP-06).
3.4 Trusted Handoff Hooks & Independent Verification
chinwag handoff verify --hooks H1,H2,H3,H4,H5
Outcome Summary & Δ Velocity Proof: End the #1 AI coding agent lie, where an agent runs tests at
t = 0, makes "one tiny cleanup edit" att = 1, and claims "All tests pass!" HooksH1..H5bind every receipt to the exact 32-byte commit commitment (C_checkpoint == C_remote_ls == C_ci == C_reviewed).
1. The 5 Trusted Handoff Hooks (H1..H5)
C_checkpoint (JJ @- 80c1012d) : blake3:9f8a7c12..e4019b2c [✓ MATCH]
C_remote_ls (git ls-remote) : blake3:9f8a7c12..e4019b2c [✓ MATCH · H1 RemoteReceiptV1]
C_ci_bundle (Run #1842 · 20x): blake3:9f8a7c12..e4019b2c [✓ MATCH · H2 T_coalesce = 50 cr]
C_reviewed (@reviewer#91a4) : blake3:9f8a7c12..e4019b2c [✓ MATCH · Model != Author]
C_uigate (UiGateReceiptV1): blake3:9f8a7c12..e4019b2c [✓ MATCH · 0 Bleed/Crush · 3/3]
Slack #ci-builds Mirror : "🟢 ENG-412 fix verified on 80c1012d · Awaiting Acceptor (WP-06)"
| Hook | Name | Cryptographic Function |
|---|---|---|
H1 | git ls-remote Remote Receipt Verifier | Closes the local-only jj snapshot gap by executing an independent git ls-remote readback against the remote repository and signing RemoteReceiptV1 (✓ed25519). |
H2 | Revision Evidence Binder | Binds CI runs (C_ci_bundle), Cross-Model Reviews (C_reviewed), and UiGateReceiptV1 (C_uigate) to the exact (source_commit_sha, policy_commit_sha) pair. |
H3 | #![forbid(unsafe_code)] YAML Lattice Validator | Verifies CandidatePolicy ⊑ OrgPolicyFloorV1 (WP-05) and two-person policy activation (WP-08). |
H4 | X25519MLKEM768 .hpke Sealer | Compresses (zstd) and seals logs, diffs, screenshots, and YAML snapshots on the runner/workstation using OrgHpkePubKey + OriginSigV1. |
H5 | Blind Relay 32-Byte Commitment Gate | Verifies C_checkpoint == C_remote_ls == C_ci == C_reviewed over keyed 32-byte BLAKE3 commitments in 0.51 ms without decrypting payload bytes, then counter-signs CloudRelayBlobSigV1. |
2. The WP-04 Stale-Evidence Trap (1-Byte Edit Detection)
If a Driver agent modifies even 1 byte of code or CSS after CI or Cross-Model Review completes, C_checkpoint advances (b04a11c8 != 9fde325c) and chinwag immediately blocks handoff:
⚠️ BLOCKED (WP-04 Stale Evidence):
Reviewed Commit: 9fde325c (Approved by @qa-verifier#8c99baf2)
Current Working: b04a11c8 (+1 line modified in src/task_writer.rs)
Action Required: Re-verify C_source == b04a11c8 before handoff
3. WP-06 Separation of Powers: Policy Satisfied ≠ Task Acceptance
In Chinwag, Policy Satisfied is an objective cryptographic proof that the pinned commit has a valid jj checkpoint, an independent git ls-remote receipt, passing coalesced CI, and orthogonal review/ui-gate receipts. Per WP-06, it never grants an autonomous coding agent authority to self-accept a task, merge a protected branch, or trigger a production release (auto_merge: forbidden).
Verification Command
chinwag bus tail --room "#eng" --limit 5 --json
- Ready to ship verified code at autonomous speed? Reserve Your Organization Credit Pack →
3.3 Two-Tier Organization Governance Lattice
How the CISO-signed OrgPolicyFloorV1 sets the non-waivable organizational security floor (WP-05) while repository chinwag.workflow.yaml files can only tighten constraints.
12-Tuple DOM Geometry (176/176)
How chinwag ui-gate evaluates 11 mathematical bounding-box, typography, and contrast invariants across 8 viewports and 2 themes in under 900ms locally at 0 Cr.