fix(exp64): harden live receipt verifier against observable-data tampering

[heybeaux]

Follow-up to #53 (same RT54 experiment; not new nightly evidence, no runtime/threshold/harness/receipt change).

Independent audit showed verify-receipts.mjs --run accepted: missing/empty check maps, rule/input/action data altered with unchanged booleans, missing or retagged run id/summary, and stale timestamps. Manifest and unsafe-action tamper were already rejected. Admitted red/green traces were never affected.

Fix: exact per-scenario check keys; both-arm live scenario bodies must equal the content-addressed pinned green rows; log run id/trace path/summary/replay count bound to the recomputed trace; frozen receipts rejected as live runs; --since monotonic freshness (CI requires it). New test-verifier.mjs: 17 tamper rejections + positive control + CI freshness check, executed in CI against the fresh live log.

Local: build/typecheck, verify:evidence 49 claims/105 traces/980 assertions; fresh pinned-candidate run mro-mv97470j 21/21 (not admitted). Frozen main.ts, receipts.json, traces, CLAIMS, spec byte-identical. Limitation: run identity is filename-bound because the frozen harness does not embed runId.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0be5e27f-c744-4fac-b155-fb6d56ec361f

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}