Diagnose v2 matrix run/verify compatibility failures with actionable evidence

[MarcoPorcellato]

External qualification report

A Latent-TRIZ R5 local qualification was stopped because a hash-bound receipt member changed after the authorized candidate commit. That invalidates the R5 evidence; no Latent-TRIZ correction, branch, PR, or evidence publication is requested here.

This issue tracks the CCP compatibility and diagnostic gaps exposed by the failed terminal run.

Reported environment and terminal facts

• Candidate repository: MarcoPorcellato/Latent-TRIZ
• Candidate commit: c7933ccbeb9a2857b543643a7e36e18aecba276d
• Base: 188eb65b5e249923baddadeba52659f07fcd1609
• Installed executable reported only commit-ci-preflight 0.1.0; its source commit was not bound or recorded.
• The reporter inspected local origin/main at 866db18a571f55ed3d9b481d6c9c9c3bd5e98d55.
• The run began from a clean candidate with resource admission allowed and no active/queued admission owner.
• run --repository . --json reached terminal FAIL. Two repository-check jobs failed in distinct Python 3.11 and 3.12 images; the paired schema jobs passed. The report retains output digests only, not raw logs.

The generated outer document had receipt and receipt_id, but the reported inner receipt lacked schema_version. Immediate verification with the expected candidate commit returned receipt.parse_or_shape, with policy evaluation not run.

Verified CCP contract context

The locally available tracked origin/main ref above contains:

• matrix configuration, matrix receipt, and matrix policy schema version 2.0;
• MatrixReceiptV2 with a required inner schema_version;
• policy-schema dispatch: a v1 policy selects the v1 receipt verifier, while a v2 policy selects the matrix receipt verifier.

Therefore the reported pair—matrix config v2 with policy v1—is not a supported matching pair in that source contract. The missing inner schema also does not match the current MatrixReceiptV2 shape.

This is not proof that current upstream emits malformed receipts: the executing binary has no recorded source provenance, and the failing receipt itself must remain invalid evidence. It is, however, a reproducible compatibility/diagnostic defect from an operator perspective: the current terminal message does not distinguish an unsupported config/policy pair, an outdated executable, and a malformed generated receipt.

Requested outcome

1. Add a regression matrix covering both PASS and terminal FAIL receipts:
   • v1 run output verifies under its matching v1 policy;
   • matrix v2 run output verifies under its matching v2 policy;
   • a v2-config/v1-policy mismatch fails with an explicit compatibility finding rather than a generic receipt-shape error.
2. Bind executable provenance (at minimum a source revision or explicit unknown) into the diagnostic surface used by run/verify.
3. Provide a bounded, privacy-preserving failed-check classification sufficient to route a runtime-only failure without exposing raw logs, sources, secrets, or environment values.
4. Document the supported migration path for repositories with historical matrix config v2 plus policy v1, or provide an automated compatibility diagnostic.
5. Document a supported, non-destructive diagnostic/recovery path for an empty or incompatible admission-root child directory. It must remain fail-closed and must not require operators to delete or quarantine admission state manually.

Non-goals

• Do not accept or repair the invalidated Latent-TRIZ R5 receipt.
• Do not weaken receipt integrity, admission ownership, or log-redaction guarantees.
• Do not make manual deletion/quarantine of admission locks, tickets, leases, or cache state a supported workaround.

Acceptance criteria

• Exact automated tests cover the matching and mismatched schema/policy cases, including terminal FAIL output.
• CLI output identifies the compatibility boundary and records bounded executable provenance.
• Documentation states the migration/compatibility decision and the safe admission diagnostic path.
• The tests prove that no raw check output is added to receipts or public diagnostics.

[MarcoPorcellato]

R5 journal evidence update: terminal top-level failure is not diagnosable

One authorized CCP run cannot qualify R5 and must not be retried under the
consumed authorization.

Recorded facts

• Candidate exact HEAD: 72b34895ca0ce5d3ae5301f9272795b58e0edf00.
• origin/main: 188eb65b5e249923baddadeba52659f07fcd1609 (unchanged).
• Journal run ID: cc10bf4d2669c3d3e193718da399d0121276fcbf45279dc4288f91cee499e1a9.
• Lifecycle: created -> admitted -> prepared -> executing -> failed.
• Terminal record at 2026-08-23T08:48:02Z: failure_kind: "unknown".
• No diagnostic artifact exists in CCP cache entries or workspaces.
• Repository receipt remains the old inapplicable receipt (6bdc999b...);
  no new qualifying receipt was published.
• The working tree was clean after the terminal event. No branch was pushed,
  PR opened, merge attempted, or remote evidence created.

An interrupted observation session is a plausible explanation, but the current
journal does not retain enough information to prove or disprove it. This is an
observability defect, not a scientific conclusion or a basis for retrying.

Required bounded follow-up

1. Force a synthetic top-level error that is outside the existing Run,
   runtime, resource, and admission error mappings.
2. Persist a stable, redacted diagnostic classification for that path. It must
   retain either a bounded safe message/category or a diagnostic-artifact
   reference, without raw check output, paths, environment values, secrets, or
   source content.
3. Add a regression proving the terminal journal record is actionable and the
   run remains fail-closed.
4. Document an observer-interruption state or equivalent distinction if the
   coordinator can no longer establish whether execution itself was interrupted.

Only after this is proven may operators regenerate R5 receipt/dossier anchors
and request a new single-run, exact-head authorization. This comment does not
authorize a retry, admission recovery, cleanup, or any remote release action.