GROWTH CONTROL ACTIVATION v2.1 — BUILD REPORT

Date: 2026-08-21 · Branch: claude/growth-control-activation-v2.0 (LOCAL — nothing pushed; GATE 1 pending) · Rebase base: 7907f96e (origin/main tip at re-gate; full battery re-run green on the rebased tip) · Diff: 30 files, +4,054 / −107, 8 commits · Step 0: docs/reports/GC_ACTIVATION_STEP0_2026-08-21.md

Workstreams delivered (every v2.1 review defect addressed by construction, each with a failing-direction test)

A — Continuous dosage estimator (services/lift-engine/src/core/continuous_dosage.py, sha256 c8d8c65f71475528…; named-path shim at services/lift-engine/continuous_dosage.py): local-marginal-effect estimand with loss and optimizer in agreement — FOC solved directly on τ (margin·τ(d*)=cost; the exact-equality pin is a test), explicit evaluation at interior stationary points + support boundaries (profit-minimum trap test), per-grid GPS positivity with named refusals, grouped cross-fitting, cluster-bootstrap uncertainty on every estimate, direct WLS (no residual ratio anywhere). Correction beyond the review list, found by the ground-truth gate: the literal reference loss Σ(Ỹ−τ(Dᵢ)D̃ᵢ)² is attenuated for the marginal-effect estimand under curvature+confounding (measured: fitted slope −0.23 vs true −0.5) because the observed-dose basis mixes ê(X) into the treatment term; replaced with the Gaussian-moment residualized design documented at _fit_theta (still direct WLS). Advisory-only: numpy+stdlib module, injected submit seam, requires_approval always true, actuator dosage-advisory-only unregistered (absence-scanned against the action-runner). 17 hermetic tests.

B — Edge inference hardening (edge_inference_integration.py, boss_agent_core.py hunks, onnx-runtime-web.ts, index.ts): fail-open removed at every measured site (no default LEARNING gate; store-failure and unknown-treatment refuse; low-confidence refuses; browser gate check fails closed ×2; client auto-treat + Math.random exploration deleted — recommendation is always advisory-only). Signing/versioning mandatory end-to-end: registration and client-config refuse unsigned models; the browser fetches bytes, verifies sha256 (SubtleCrypto) + RSA-PSS signature against a pinned key before session creation, and refuses without a pinned key; persistence failure is loud. Mutation routes writer-gated fail-closed (EDGE_WRITE_TOKEN unset ⇒ 503 — boss-agent-adk has public ingress). ENABLE_EDGE_INFERENCE default flipped to false. Benchmark run with real numbers (edge_latency_benchmark.py, monotonic perf_counter_ns; report docs/reports/GC_ACTIVATION_EDGE_BENCHMARK_2026-08-21.md): CPU p50 0.011 ms / p95 0.020 ms / p99 0.045 ms for the lite-model shape; browser WebGPU path stated UNMEASURED — sub-10ms relabeled design-target at every edge-tied site (OFFERING_MAP:299 reviewed: already inside a RESEARCH/benchmark-gated section as a Goal — no edit needed). Zero "distillation" language introduced (measured zero pre-existing in edge files). 16 tests incl. the edge→platform-adapter absence invariant.

C — Passport authenticity (signing.py sha256 d6b1b5ef00a2c155…, passport_package.py, service-audit-replay/main.py): detached asymmetric signature over the exact mizoki-jcs-v1 canonical bytes (scheme fully specified: UTF-8, sorted string keys, compact separators, finite floats via shortest-round-trip repr, no default= hook — refuses ambiguity loudly) with signed_at + key metadata INSIDE the signed payload (backdating breaks verification — tested). Real Cloud KMS asymmetric_sign in production (SigningUnavailable raised when it cannot run — no placeholder branch exists); tests exercise the identical signature format through a real local RSA-PSS keypair over the same verify path. verify_passport_signature fail-closed on unsigned/unconfigured/tampered; new GET /api/v1/passport/{id}/verify checks seal AND signature; armed-but-broken signer 503s (never silently downgrades); unconfigured stays byte-compatible unsigned with honest health. Legacy sha256 seal kept unchanged. 11 tests.

D — Treasury reservations (treasury_reservations.py sha256 bd7181e665eddcf5…, store.transact_update, DCP + action-runner hunks): the atomic committed-spend ledger v1 declared out of scope — per-tenant head document mutated only through a real Firestore transaction (the audit chain's production-proven pattern) / locked critical section in memory, so headroom check + reservation write are ONE transaction across instances (12-thread × 2-instance race test: exactly 5 of 12 grants at 100-per-500 headroom). TTL reconciliation inside every transaction (crash leaks self-heal; expiry test); explicit idempotency contract (active-identical returns existing; active-different and terminal reuse refuse). DCP reserves atomically at _issue_authorization on BOTH paths (the approved path now carries the decision's recorded estimated_value — it defaulted to 0.0, and that path is where the approval race lives); refusal routes a non-redeemable review naming treasury_committed_headroom_exceeded. Runner revalidates at act time (reservation validity + fresh constraint re-check → treasury_acttime_veto), consumes only on dispatched spend, releases on Stage-3. Snapshot verifier refuses unsigned/stale/mistenanted positions outright (tamper battery); v1 serving positions stay owner-declared config per ruling 2026-08-19-B, with the verifier as the mandatory gate for the treasury-feed v2 seam. Unconfigured posture byte-identical (tested; the standing byte-identity test also still green). 14 tests. New stores registered in the erasure-posture register (ledger-retention; module added to the register's machine scan — its scan list had not covered the new module, the exact F-1 class).

E — Pilot configuration (F3 schema extension + verification): configs verified null-template across F1–F5 + net_yield_costs.yaml — nothing populated (no owner values were supplied in-session; the system never invents values). Build half: F3 previously had NO freshness rule at all (schema-absent, evaluator unwindowed — the one lane where a stale level could silently drive a recommendation); added tenant-level freshness.max_observation_age_hours (null default = no bound claimed, behavior unchanged, gap NAMED by tenant_gaps and the CLI; zero/negative refused) with stale-exclusion in the evaluator (stale_signal state, partial-staleness breakdown, counters; undatable observations count stale). 10 tests. Invariant inventory verified live: F3 no-dispatch, F4 evidence-gated autonomy + ≥2 clean-cycle refs, F1 triple provisional layers, F2 two-quarter gate, F5 fail-closed, both writebacks fail-if-flipped.

F — Docs/canon/vocabulary: plans of record verified byte-present (sha256s in Step 0 §0.6); vocabulary ratification + OFFERING_MAP v2.3 verified already-landed; CANON_STATUS generator/doc/route verified fresh (--check: 0 drift). Completion v1.1 prompt gained the do-not-run supersession banner (duplicate-package hazard + the mizoki_canon.py --check no-op correction); the governing Activation v2.1 prompt landed verbatim (sha256 89de240f79ab9c63…). Skill parity ×2 green + canon audit 0 findings across 14 skills; skill-content delta logged, not edited (rule 03 — skill bodies change only through the Boss's skill process): the platform-expert skill does not yet describe KMS passport signing, treasury reservations, the dosage estimator, or the edge writer gate.

Gate results (rebased tip `= 7907f96e + 8 commits`, fresh venv, Step-0-verified commands)

Suite / gate	Result
`pytest tests/governance -c tests/governance/pytest.ini`	416 passed (baseline 391 → +14 D, +11 C; register update)
`pytest tests/remediation`	294 passed (the second DCP/runner e2e suite)
`pytest tests/connectors`	336 passed
`pytest tests/market_signal`	260 passed (baseline 250 → +10 F3 freshness)
cell33 suite (O-1 both directions, consent fail-closed, DSAR/erasure, retention)	271 passed + 42 subtests
`tests/test_edge_inference_hardening.py`	16 passed
lift-engine `tests/test_continuous_dosage.py`	17 passed (hermetic); pre-existing suite state byte-identical (4 collection-error modules + 36F/5P → 36F/22P — additions only; the old failures are real API drift, recorded in Step 0)
net-yield writeback+api pins / measurement-rails flag pins	29 / 32 passed (fail-if-flipped intact)
`content_qa.py --self-test` + `--root .`	self-test PASS (gate fires) + 59 scoped files clean
`gen_canon_status.py --check`	doc fresh, 0 drift
`skill_sync.py --audit` / `skills_sync.py --check` / `ontology_skills_sync.py --check`	0 findings / parity OK / parity OK
`claude_memory.py check --strict`	structurally valid
V1/V2/V3 canon greps over the diff	0 hits (one pre-existing model-string line in `boss_agent_core.py:19182` confirmed OUTSIDE my hunks)
Protected paths / site files in diff	none (measured: no `.github/`, `deployment/terraform/`, cloudbuild, CODEOWNERS, `# MIZ OKI 3.5/**`)

Adversarial verifier round (findings → dispositions)

The independent verifier (diff + plans + rules only; its report travels verbatim to the owner) returned 1 BLOCKING, 3 MAJOR, 5 MINOR, 3 NOTE. Dispositions, each with its enforcement test:

#	Severity	Finding	Disposition
1	BLOCKING	Model signature fields never persisted (`_model_to_dict`/`_dict_to_model`) — signed models died on restart/cross-instance read	FIXED — fields travel through both serializers; round-trip → serve pinned (`test_signed_model_survives_persistence_roundtrip`)
2	MAJOR	Self-graded causal CATE: arms defined by the model's own uplift sign, minted as `CATEEdge` + persisted to `cate_edges`	FIXED — causal computation refused by construction: buckets renamed to score strata, flush mints nothing, writes nothing to `cate_edges`, emits explicitly `non_causal` advisory summaries + `causal_writes: refused_self_graded_arms`; governed `edge_cate_update` ingest door unchanged (`test_flush_never_mints_causal_cate_from_self_graded_arms`)
3	MAJOR	Canonicalization docstring falsely claimed ES6/RFC-8785 float equivalence (measured: `50000.0` vs JCS `50000`) — false-tampering hazard for external auditors	FIXED — docstring states the truth (NOT RFC 8785; measured divergences named; auditors implement THIS scheme); exact float bytes pinned (`test_canonical_float_bytes_are_pinned_and_not_jcs`)
4	MAJOR	`edge_inference_integration.py` absent from `deploy-boss-agent-core.yml`'s paths allowlist — an edge-only fix would land without deploying	RECORDED — not fixable in-branch by design (protected path routes to human review): needs an owner-routed PR adding the file to the allowlist; on the owner checklist
5	MINOR	Triton lane outside the signing perimeter; infer route ungated	PARTIALLY FIXED — route now writer-gated (`test_triton_infer_route_is_writer_gated`); Triton-side registry/version/signature consultation recorded as residual (client unconfigured today, `TRITON_URL` unset)
6	MINOR	Single-use authorization was check-then-act — two concurrent Stage-4 executes could both dispatch (pre-existing)	FIXED — atomic dispatch claim via `transact_update` immediately before the adapter runs (exactly one concurrent winner), released on fail-closed refusal paths (retry semantics preserved — the pre-existing fail-closed guard was moved WITH its intent per rule 01, now also proving an actual retry passes), finalized at settlement; crash between claim and settlement leaves the authorization fail-CLOSED (deliberate trade, documented) (`test_dispatch_claim_is_atomic_across_threads` + updated `test_adapter_refusal_…`)
7	MINOR	Triton latency measured with `datetime.utcnow()` deltas	FIXED — `perf_counter` at all 3 sites (`test_triton_latency_uses_monotonic_clock`)
8	MINOR	Approved-authorization path (the named race) untested with treasury armed; DCP health posture unpinned	FIXED — full approved-path e2e (low-DEL → approval → authorize-approved reserves the DECISION's recorded value; second approval crossing headroom → 409) + health pin
9	MINOR	Tautological `assert … or True` in the benchmark test	FIXED — replaced with real clock-wrapping pins
10	NOTE	One shared `EDGE_WRITE_TOKEN` spans model registration, gate control, and event ingestion; browser carries it	RECORDED — dark today (unset ⇒ 503); token tiering is a named precondition before any arming (owner checklist)
11	NOTE	Homoscedastic-dose assumption undiagnosed; measured attenuation under heteroscedasticity	FIXED — in-band `assumption_diagnostics` with `heteroscedasticity_flag` (quartile residual-sd ratio > 1.5), tested in both directions
12	NOTE	Merge auto-deploys boss (dark: flag now defaults off) while DCP/audit-replay are dispatch-only; armed signer meeting a non-canonical value 500'd instead of 503	500→503 FIXED (`CanonicalizationError` caught into the named signing-unavailable refusal); deploy asymmetry RECORDED as GATE-2 sequencing material (C/D serve only after a human governance-services dispatch)

Post-fix re-gate (everything): governance 420, remediation 294, connectors 336, market_signal 260, edge hardening 20, dosage 18, cell33 271+42 subtests — all green; parity/canon/memory gates unchanged green.

Honest residuals

lift-engine remains an orphan (no CI workflow, no registry row, retired-Neo4j client in src/integration/knowledge_graph.py, pre-existing test suite broken by API drift) — registering/deploying it is an owner decision (Step 0 §0.8); Workstream A's tests run green but nothing runs them in CI until the service gets a workflow (a protected-path change this run deliberately did not make).
UI typecheck: this sandbox lacks the UI's installed node_modules, so tsc --noEmit under the real tsconfig could not run; the edited TS parses clean standalone and the UI deploy workflow's build is the authoritative gate at merge.
Browser latency remains unmeasured — the benchmark bounds the model's CPU compute only; sub-10ms stays a labeled design target.
KMS end-to-end requires a provisioned key (PASSPORT_SIGNING_KMS_KEY) — the GATE-2 smoke ("synthetic decision → passport with KMS signature verified") needs that operator input; the crypto path is proven with real RSA-PSS locally.
Registry live-read was impossible (gcloud absent in this sandbox — Step 0 §0.2); registry ground truth came from the repo registry + ≤24h live-verified records.

Owner-input checklist (unchanged critical path)