Phase 2: bind and verify the whole outbound context

[johnnygreco]

Objective

Issue attestation v2 over the complete ordered user/tool context immediately before sending and verify the provider wire body against that exact subject.

Context

• Tracker: GitHub goal delivery: close Pi attested-admission gaps #50
• Append-time admission protects storage; provider-context admission protects the model and is the only operation that issues an attestation.
• Stateless design is required; Phase 2b ledger is optional and not part of this issue.

Scope

• Runtime adapter: derive full ordered entries, admit provider_context, apply per-index replacements, and bind handle lookup to the final admitted context.
• Egress Gate: add provider-context adapter; attestation v2 subject hash/count; adapters derive all user/tool entries from Chat Completions and Responses bodies; verify before and after gate mutations; append-time allows return empty attestation.
• OpenShell: allow an admission allow with empty attestation to return no handle.
• Shared golden vectors pin JS/Python context-entry derivation.
• Non-goals: persistent provenance ledger, assistant/system-prompt hashing, caller identity.
• Dependencies: Phase 1.

Acceptance Criteria

• Any earlier-entry mutation, insertion, or deletion is denied with stable reason codes.
• Matching multi-turn Chat Completions and Responses requests pass.
• Send-time replacements bind the replacement and reject the original.
• Append-time admissions issue no handle; exactly one provider-context bridge call occurs per provider request.

Required Validation

Research make check; JS golden-vector tests; focused OpenShell bridge tests; current Pi admission tests and npm run check.

PR Expectations

Reviewer notes must reproduce the canonical entry derivation and hash/count checks, and state the intentional assistant/system exclusions.

[johnnygreco]

Phase 2 started after Phase 1 completed review-clean.

Implementation ownership is split by repository:

• Research/Egress Gate: full ordered user/tool context derivation, stateless v2 attestation hash/count, send-time replacement binding, and shared JS/Python vectors.
• OpenShell: only the bridge behavior required to accept an append-time allow with empty attestation and return no handle.
• Pi: no implementation changes planned; its existing provider-context hook is the integration surface and will be validation-only unless a concrete contract defect is found.

POC ceiling remains binding. Phase 2b ledger, assistant/system hashing, caller identity, provider redesign, protobuf changes, compatibility shims, and speculative abstractions are explicitly excluded.

[johnnygreco]

Phase 2 implementation and independent review are complete on the existing draft PRs.

• Research PR feat(egress-gate): add attested Pi prompt admission #38 head: 3fedae0
• OpenShell fork PR Add Reachy Mini OpenShell demo project #1 head: 8f208f5c
• Pi fork PR Add Reachy Mini OpenShell demo project #1 remains at c58c59f00 with no Phase 2 code changes

The implemented POC now binds one v2 attestation to the complete ordered user/tool subject, verifies hash/count before policy, rejects policy mutations that change the subject, supports matching multi-turn Chat and Responses requests, applies send-time replacements by index, and issues no append-time handles.

One availability-only limitation is intentionally deferred to avoid a non-surgical Pi provider-preparation architecture: cross-transport tool histories and orphaned tool calls can fail closed after Pi transport rewrites. The example documents the limitation and workaround; reviewers confirmed no security bypass.

No new implementation PRs, ledger, Phase 2b, protobuf changes, or speculative infrastructure were added. Head-matched Review Records are posted to the existing Research and OpenShell draft PRs.