Growth Control Completion v1.1 — Build Report

Date: 2026-08-19 · Branch: claude/growth-control-completion-v1-1-w7vg1c (local until GATE 1) Prompt: docs/prompts/CLAUDE_CODE_MASTER_PROMPT_GROWTH_CONTROL_COMPLETION_v1.1.md (vendored byte-exact) Step 0: docs/reports/GC_COMPLETION_STEP0_2026-08-19.md · Base at build start: origin/main@8c7a85e Rebase base at gate: origin/main@0058f65 (main moved twice during the build: 14 commits → rebase 1 onto 78ed26f; +1 memory commit → rebase 2 onto 0058f65; see §6 item 10. Commit ids below are the presented tip's; a push-time re-rebase, if main moves again, re-derives them mechanically)

Everything below is [IN BUILD] — committed on the branch, pushed nowhere. Merged ≠ deployed ≠ live-verified; the GATE-2 path is docs/runbooks/GROWTH_CONTROL_RUNBOOK.md.

1. Plans of record (Workstream 0.1)

Committed byte-identical to the Drive prompt-board copies, sha256-verified; each carries one inserted amendment-pointer header line (the only permitted edit — removing it restores the source sha):

Doc	sha256 (first 16)
`docs/MIZOKI_3.5_WHITEPAPER_r3.5.1_AUG2026.md`	`6f0ded9ce9bbdc1d`
`docs/MIZOKI_SIGNAL_GROWTH_CONTROL_UNIFIED_SYSTEM_r2.0.md`	`397ebcdb97e07846`
`docs/MIZOKI_3.5_WHITEPAPER_r3.5.2_AMENDMENT_AUG2026.md`	`6d827a5849c48767`

2. Commits (in order)

Commit	Workstream	Summary
`6dbf7f3`	0.1–0.2	Plans of record + Step 0 report + coordination claim
`49b1a9c`	0.3–0.6	Vocabulary ratification (ruling 2026-08-19-A): `RATIFIED_VOCABULARY` in `scripts/mizoki_canon.py`, V5 retired with tombstone, O-1 capability-language arms in content_qa (negation-refusing), 25 both-direction seeds in `tests/skills/test_canon_vocabulary.py`, OFFERING_MAP → v2.3 (+§B.6), README narrative, CLAUDE.md + template pointers, rule-03 ratified-vocab clause
`e10967f`	B, E, I	`contracts/mizoki_contracts/`: treasury.py (F5 v1 gate) + treasury_feed.py (honest v2 stub) + passport_package.py (16-field read-model + sha256 seal) + passport_fixtures.py (SIG-042, Google Ads drop) + decision_jobs.py (J-01…J-06 ⇄ generated yaml) + pilot.py (90-day state machine) + canon_status.py (probe-backed status) · policy-engine treasury-first hard block + `constraint_veto` · DCP breach-review routing + `authorize_approved` eligibility guard · audit-replay routes (passport/jobs/canon/breaches/pilot) · action-runner `POST /api/v1/outcomes/{id}/actual` · `scripts/gen_canon_status.py` + `docs/CANON_STATUS.md` · `docs/pilot/PLAYBOOK.md` (r2.0 §4.2 verbatim) · governance suite 237→288
`074e423`	C	net-yield deltas: ast flag pin, no-live-HTTP guard, dry-run on both senders, truth-drift fixes, registry row → `deployed-dispatch` with run evidence, RUNBOOK §8a, ADR amendment · 103 passed
`e3e0a48`	D	F3 observe-only inventory sync in cell37 (`F3_INVENTORY_SYNC` default off), `f3_recommendations` DDL, no-dispatch invariant AST-proven both directions · market_signal 225 passed
`d77c7c6`	A	IEv2 retention I-01…I-05 as code: `mizoki_intent/engine_v2.py` registry + machine-readable retention contracts; sweeps flag-off in cells 33/34/35; creative-retirement cascade + vectors seam · 271/316/366 passed
`9ee4c4e`	0	Master prompt vendored + `src/shared/growth_control/` skeleton
`adfb8d6`	0.7	Skill layer v3.2: Skill 22 + skillpack §13 (§9 byte-unchanged, sha pinned), parity plumbing (skill_context twins, MCP pin, registry regen — also clears the pre-existing registry-stale red), test baselines 12→13 sections · tests/skills 179 passed, virtuoso_models 43 passed, audit 0 HIGH
`cc55d61`	H	F2 LTV regimes: retention curves + DTR evaluator, `MIN_OBSERVED_QUARTERS = 2` hard guard → `data_insufficient`, additive ledger horizon columns, PLAN seam · +27 governance tests
`fbf0c04`	G	F1 creative unbundling: closed element schema, `Role.CREATIVE_MM` extraction w/ deterministic fallback, provisional-always double-lock, pure-Python AIPW estimator + jackknife CI, gated writer seam · 63 unit + 12 governance tests
`fba7ced`	docs	GATE-2 ops runbook + this report (living)
`2c34125`	F	F4 micro-geo calibration: config fail-closed w/ evidence-carrying autonomy flip, refusal-gated donor matching + deterministic simplex solver, reservation engine (`F4_CALIBRATION_DEFAULT = False`, actuator `f4-geo-reservation` registered nowhere), synthetic-control estimator w/ RMSPE refusal + placebo CIs, clean-cycles-only priors, `matched_geo` design type (itt precedent) · +60 governance tests → 390 passed · erasure-posture register green across all 7 new stores · CANON_STATUS 0 drift
`71394d8`	UI	Command Center internal surfaces (O-5): passport dossier page (DEL breakdown, veto banner, absent_fields honesty strip), Jobs J-01…J-06 table (dossier_url as text), canon-status page, treasury reviews on Decisions (deliberately NOT Approvals); BFF routes identity/tenant-gated (tenant only from `x-tenant-id`; cross-tenant battery 6→7) · tsc 0 · vitest 132 files/962 passed · lint 0 errors · build exit 0, all 7 routes emitted
`463987b`	0	Kept-banned seed probes annotated with their legal-class markers (grep delta → 0)
`8d62e6a`	fix	CLAUDE.md union-merge splice repaired per rule 02 from origin/main's authoritative copy (caught by check --strict inbox-spliced-entry)
`27c704d`	mem	Completion record + governed bounded-inbox rollover (lossless: archive sha256 == pre-record file; entries preserved in the dated inbox)
`e29f66e`	fix	All six adversarial-verifier findings addressed (§7)

3. Frontier invariants, as landed (each with its enforcing test)

F5: treasury check FIRST among policy hard blocks; veto names its constraint; breach → treasury_breach_reviews (NOT approvals); authorize_approved redeems only APPROVAL_REQUIRED (409 otherwise); absent config = not_configured honest health — tests/governance/test_treasury_gate.py (20).
Passport: read-model, never a ninth decision object; sha256 seal; absent_fields honesty; internal-only surfacing — test_passport_package.py (8).
Pilot: window AND checklist double gate; reports skeleton=true, verified_numbers=[] — test_pilot.py (10).
F3: actuator f3-recommendation-only registered NOWHERE (AST both directions) — tests/market_signal/test_f3_no_dispatch.py.
IEv2: purge hits expired AND keeps active (both directions); undatable timestamps KEEP data; flag-off = 503; erasure suites untouched-green (104/38/89) — test_retention_sweep.py ×3 cells + coverage guard.
F2: MIN_OBSERVED_QUARTERS = 2 literal (tenant floor raise-only); data_insufficient carries NO value fields; partial quarters never enter findings — test_f2_ltv.py (27).
F1: every path emits provisional=true; store seam REFUSES provisional=False outright (double-lock: config flip alone can never publish); identity-shaped keys/values rejected at the seam — test_f1_creative.py (12) + 47 unit tests.
F4: every proposal requires_approval=True; autonomy eligible: true refused at parse without approved_by + approved_on + ≥2 clean_cycle_refs; null spend cap REFUSES (spend_cap_not_declared); actuator f4-geo-reservation registered NOWHERE (verified 0 hits in the adapter registry); flag-off emits nothing even to the seam; perturb callbacks record intent only (executed:true raises); priors consume clean cycles only — test_f4_calibration.py (60).
Writebacks: MEASUREMENT_WRITEBACK + NET_YIELD_WRITEBACK remain OFF with fail-if-flipped source-literal tests.

4. Test matrix (§13) — final numbers, re-run on the rebased tip

All orchestrator-verified (re-run, never builder-claimed) on rebase-1's tip; rebase 2 changed ONLY CLAUDE.md + .claude/memory/index.json (proven: git diff <gated-tip> HEAD -- . ':!CLAUDE.md' ':!.claude/memory' is empty), so the matrix carries over; governance (391 with the verifier-round scanner) + skills + memory-strict re-ran green on the final tip:

Suite	Result
tests/governance (`-c tests/governance/pytest.ini`)	390 passed (baseline 237 → 288 after B/E/I → 390)
tests/skills	179 passed, 2 skipped
tests/connectors	236 passed
tests/market_signal (CI shape, `--ignore=…test_stores_market_bq.py`)	225 passed
tests/remediation/test_execution_adapters.py	139 passed
tests/shared/test_virtuoso_models.py	43 passed
services/service-marketing-connectors	83 passed
services/measurement-rails	397 passed (+matched_geo)
services/net-yield	103 passed
cell33 / cell34 / cell35	271 / 316 / 366 passed
cell37	33 passed
src/shared/creative_aesthetic	63 passed
UI: `tsc --noEmit` / vitest / lint / `next build`	exit 0 / 962 passed (132 files) / 0 errors / exit 0
content_qa `--self-test` + scan	PASS + 57 files clean
skills_sync / skill_sync `--check` / `--audit` / ontology	OK / parity OK, registry current / 0 HIGH / OK
`gen_canon_status.py --check`	fresh, 0 drift warnings
check_legacy_model_ids.sh	passed
claude_memory check --strict	structurally valid, 0 errors
rule-03 greps V1/V2/V3 (delta vs origin/main@78ed26f)	0 / 0 / 0 new hits

5. Known reds and their owners

tests/remediation/test_contracts_hardening.py::test_store_deployed_firestore_failure_refuses_memory_fallback — pre-existing (reproduced identically with all changes stashed); not CI-gated (CI runs only test_execution_adapters.py from that dir).
tests/governance/test_new_store_erasure_posture.py::test_evidence_paths_exist — was red while F4 was mid-build; green since 2c34125 (confirmed in the 390-passed run).
Skillpack registry-stale red on main — fixed by this branch (adfb8d6).
tests/market_signal/test_stores_market_bq.py — 6 setup errors in any venv without google-cloud-bigquery; pre-existing (identical on origin/main with the same venv: 151 passed, 6 errors) and explicitly CI-excluded (ci.yaml runs the suite with --ignore= that file).

6. Deviations from the master prompt, with reasons

Passport package is a read-model dict, not a schema/contract — the "no ninth decision object" rule in the landed decision-objects chain; additive schema requirement satisfied at the store layer (16 named fields + seal), asserted by tests.
F5 veto routes to treasury_breach_reviews, not the approvals queue — a veto must not be redeemable by the normal approve path; DCP's authorize_approved eligibility guard enforces it.
Pure-Python estimators (F1 AIPW, F4 synthetic control, F2 DTR) — the CI dependency set for gated suites has no numpy; hand-computed fixtures prove the math; fuller MMM recorded as labeled follow-on.
IEv2 graph deletes: no non-identity delete path existed; retire_node added following delete_identity's durable-first ordering; retired-Neo4j backend refuses loudly rather than shipping unverifiable dead Cypher.
F1 store double-lock (stronger than spec): seam refuses provisional=False even after a legal config flip.
Skill layer section-count baselines moved 12→13 with intent kept (contiguous-range assertion); §9 governance sha pins prove byte-identity.
F4 propose_reservations returns a status batch dict, not a bare list — refusals must surface by name (spend_cap_not_declared, donor_pool_invalid, not_configured); matches the package's F2 result-dict convention.
F4 priors consume clean cycles only (stricter than valid-estimate-only): a cap-breaching cycle's valid estimate is recorded but never feeds the posterior.
Treasury reviews surfaced on the Decisions page, not Approvals and not a new nav page — the backend forbids treating a veto as redeemable, so the review queue lives beside decisions with rows linking into the passport dossier where the named veto renders.
Pre-push rebase (mandatory) onto 78ed26f: one conflict (index.json generated_at — took main's regenerated index) plus a union-merge splice in CLAUDE.md caught by check --strict and repaired per rule 02 from origin/main's authoritative rolled-over copy (8d62e6a); the archived #736 entry stays archived. Both-sides semantics preserved in the four overlap files (creative_vectors NOT-NULL fix + F1 columns; registry GATE-2 comments + net-yield row; session-board both rows; CLAUDE.md canon bullet + claim). Full gate re-run on the rebased tip — every number in §4 is from that re-run.

7. Adversarial verifier — verdict and disposition

Independent verifier (inputs: diff + plans + rules ONLY; builder reports excluded): PASS-WITH-FINDINGS — "No safety invariant is broken"; every §3 invariant positively confirmed command-by-command; measured diff 156 files, +18,477/−121. Recommendation was merge-eligible once F-1 addressed. All six findings are FIXED in-branch (commit e29f66e; governance 390→391):

#	Sev	Finding	Fix
F-1	MEDIUM	Erasure register missed `f4_reservations`/`f4_cycles`; coverage claim hand-maintained	Both registered (person-data-free, seam-rejection evidence) + a MACHINE layer: the register now scans the run's new modules for `*_COLLECTION` literals and fails on any unregistered store; docstring states exactly what is enforced. Governance 390→391
F-2	LOW	README "mirrors §B.6" dropped the Measurement-rails-writeback row	Row added verbatim — README now truly mirrors all 14 rows
F-3	LOW	creative store comment stated a config-conditional property as a code property	Reworded to the verified basis (shipped config emits provisional-only; seam refuses independently)
F-4	LOW	New `/outcomes/{id}/actual` write path caller-verified but not tenant-scoped	Matches the file's `/rollback` posture by design; route docstring now names TENANT-001 (convergence plan) as the owning burn-down — enforcement lands with the file, not ahead of it
F-5	LOW	Meta dry-run echo embedded the bearer token	Echo masks `access_token`; live body still carries the real token; byte-equality test updated to assert both directions; RUNBOOK §8a + README amended
F-6	LOW	Session-board row stale ("Step 0 in progress")	Row updated to GATE-1-ready

Verifier observations accepted without change (each deliberate and documented in-file): 404-vs-403 decision-existence oracle matches pre-existing route patterns; treasury stale-position semantics = "stale declared position disables proximity tightening, covenant caps still enforce" (owner should be aware); F4 config parse is the only config entry and the actuator + DCP gates backstop it structurally.

8. Owner-provided-inputs checklist (§15)

Nothing in this build requires an owner input to stay safe (all fail-closed). To make surfaces OPERATE (GATE 2 and later, per the runbook):

[ ] Real treasury_constraints.yaml values + mount + /reload (F5)
[ ] config/f4_geo_candidates.yaml candidate pools + spend caps (F4)
[ ] config/f2_ltv.yaml tenant horizon/discount (F2)
[ ] config/f1_creative.yaml volume floors when pilot evidence exists (F1)
[ ] config/f3_triggers.yaml thresholds (F3)
[ ] Retention sweep enablement + scheduler wiring (IEv2, per-cell flag)
[ ] 90-day pilot start decision per tenant
[ ] Any autonomy-eligibility flip: evidence-carrying config change (never code)

9. GATE 2 execution record (addendum, 2026-08-19/20)

Owner approvals, all in-session (loose-phrasing forms recorded verbatim on the board): GATE 1 via the disambiguation question ("APPROVED: MERGE — land it") → fast-forward auto-merge, main tip == branch tip 620996f; GATE 2 "Approved:deploy"; governance-trio dispatch "Dispatched documented committed to memory"; PR merges via "Pishbit" (→ push it) and "approved:merge — merge it".

Deploys, all green (9 runs): merge-fired action-runner / canonical-ingestion / virtuoso-models (skillpack v3.2) / coding-moa / Command Center UI / boss-agent-core on 620996f9; dispatched net-yield 32293083304, cell37 32293080452, intent-platform 32293078143 (cells 33–36, fail-closed smokes).

Governance trio — the no-CI-path gap closed as code (deploy-governance-services.yml, review PR #743, owner-merged) and executed: run 32313888638 deployed policy-engine 00024-xt8 (posture probe PROVED treasury: not_configured live) and audit-replay 00021-qhj; run 32315932562 deployed DCP 00032-xtf. Registry rows flipped to deployed-dispatch with those measured revisions.

The one false red, and its lesson (rule 01): run #1's route probe curl --fail'd on the routes answering 403 — the CORRECT behavior (verify_caller refusing the CI identity; auth.py:117-119). Fixed in review PR #745 (owner-merged, c3897d2a): the probe asserts 403 with verify_caller's exact JSON detail (route present + guard enforcing), fails 404 (pre-merge image) and 200 (unexpected privilege), and — per Codex's P2 — the rollout check now requires the 100% traffic entry to TARGET the ready revision, closing the pinned-service false-pass. Review round absorbed: Copilot (timeouts, §-markers, PR scope), Codex (exact-body hardening, reimplemented from its unpushed commit), one Copilot push race reconciled.

Still deliberately OFF/unset: both writebacks, every frontier flag, all retention sweeps, TREASURY_CONSTRAINTS_PATH; the §8 checklist remains the owner's. Post-run pending issues swept to zero (stale #739/#741/#734 closed with measured evidence; #742/#744 closed against their PRs).