Make Genesis probe isolation evidence attribution-safe under concurrent writers

Context

The synchronized Genesis journey in #15291 requires a reliable local rehearsal before the bilateral window. A fresh rehearsal against exact origin/dev commit f3b36f627b5a57ea0ad14090fa45915689c23766 exercised the intended three-tool profile, oracle, termination, and whole-root cleanup, but the runner still returned failure because an unrelated active Neo process changed a shared default diagnostic path during the probe window.

The current receipt treats whole-window equality of shared live paths as evidence that the probe did not touch them. In an active Agent OS checkout, other MCP and Memory Core processes legitimately write those same paths. The observed delta contains no writer identity, so it cannot answer whether the probe caused the change.

Live duplicate sweep at creation checked the latest 20 open issues, recent A2A claims, Knowledge Base ticket retrieval, and the current #15291/#15187 conversations; no equivalent issue exists.

The Problem

ai/scripts/diagnostics/genesisProbe.mjs captures the default SQLite family and log tree before the run, captures them again during finalization, and computes defaultPathsUntouched through serialized equality. A mismatch fails the probe.

That measurement proves only that the shared paths were globally quiet. It does not prove probe attribution. Concurrent legitimate writers therefore create false failures, forcing the external proof to depend on global quiescence and making the rehearsal unreliable precisely when the Agent OS is active.

A separate generic pre-oracle UNEXPECTED_FAILURE symptom was also observed during CLI-shaped attempts. The runner currently writes the private cause inside the disposable root and then correctly erases that root, leaving only the generic public code. That protects secrets, but it also erases the secret-free fact of which bounded phase failed. A rehearsal whose failure phase is unobservable cannot prove that the corrected isolation gate actually ran, so phase-level observability belongs to this proof-integrity repair; raw exception detail remains excluded.

The Architectural Reality

• createProbeEnvironments() already gives the probe-owned MCP child an explicit SQLite path and gives both diagnostic-writing children an explicit log root under the unique disposable root.
• assertDiagnosticPathsWithinRoot() already rejects runner-computed sink paths that escape that root.
• The Neural Link config template owns NEO_MEMORY_DB_PATH and NEO_NL_LOG_PATH resolution through AiConfig leaves. Per ADR 0019, child entrypoints must consume those resolved leaves rather than re-read or re-derive environment state.
• The child-private readiness logs are already the startup authority used before TCP reachability or bearer use.
• snapshotSqliteFamily() correctly detects WAL-family mutation, but its current use against shared live defaults has no attribution field.
• Existing focused coverage proves that a WAL change is visible; it does not prove that concurrent unrelated writes are harmless to an isolated probe.

The Fix

Replace the ambient before/after equality check with positive, child-owned runtime evidence that every raw-diagnostic sink resolved inside the unique disposable root.

Each diagnostic-writing child must attest its resolved sink roles only after AiConfig resolution. The runner must validate the complete required role set and root containment from child-private startup evidence before TCP reachability or bearer use. The public evidence is a boolean/role-level isolation result; it must not expose absolute paths, tokens, headers, raw tool data, or raw logs.

Remove the misleading defaultPathsUntouched receipt field rather than preserve its invalid semantics. Replace it with an explicitly positive isolation field whose name states what was actually proven. Concurrent writes to unrelated shared default paths must no longer influence probe success.

Positive-control the new proof before trusting a green: feed the runner a missing, duplicate, malformed, or default/outside-root child attestation and prove it fails before TCP reachability or bearer use. The red control must exercise the same validator as the live success path.

Preserve the closed public error allowlist and whole-root erasure, but retain a secret-free bounded phase identifier for UNEXPECTED_FAILURE in the final receipt. The phase may name only a fixed runner stage; it must not carry raw exception text, paths, headers, tokens, tool data, logs, or unrevealed oracle material.

Do not add a quiescence requirement and do not solve this through runtime AiConfig mutation. Keep existing whole-root deletion, process-absence, listener-closure, and closed public-error contracts intact.

Contract Ledger

Decision Record impact

aligned-with ADR 0019 and ADR 0020; no ADR amendment. This corrects evidence in the existing bring-your-harness diagnostic lane without changing the Neural Link architecture.

Decision Record

NOT_NEEDED — the change consumes the existing config SSOT, child-private readiness, and disposable-root authorities.

Acceptance Criteria

• A regression witness changes a shared default SQLite/log surface during an otherwise isolated rehearsal and proves that the old equality guard fails while the corrected attribution-safe proof succeeds.
• Every diagnostic-writing child emits child-private, secret-free evidence of its resolved sink roles after AiConfig resolution and before TCP reachability or bearer use.
• The runner requires the complete expected sink-role set and fails closed on a missing, duplicate, malformed, default-root, or outside-root resolution.
• A positive-control witness deliberately supplies at least one invalid/default-root attestation and proves the exact live validator goes red before TCP reachability or bearer use; a no-op control is a test failure.
• Runtime path evidence contains no absolute path, bearer, Authorization header, raw tool argument/result, raw log, or unrevealed oracle material.
• The public receipt removes defaultPathsUntouched and reports a positively named field that reflects the runtime isolation property actually proven.
• Unrelated concurrent writers on shared default paths cannot cause probe failure; no global quiescence prerequisite is introduced.
• UNEXPECTED_FAILURE adds only a fixed, secret-free runner-phase field to the receipt; tests prove raw exception text, paths, credentials, headers, tool payloads, logs, and unrevealed oracle material never escape.
• Existing process-group termination, listener closure, recursive manifest, whole-root deletion, cleanup-clock, and closed public-error behavior remains unchanged.
• The Genesis journey guide documents the corrected isolation evidence and receipt field.
• Focused unit/security coverage passes, and one bundled live BigData rehearsal proves both child attestations (diagnosticPathsIsolated: true) on the exact PR head; the separately scoped generic pre-oracle failure does not block this gate-specific proof.
• The implementation PR Resolves this bug and relates to #15291 without closing the bilateral proof ticket.
• Changed classes and methods satisfy Contextual Completeness JSDoc and @summary requirements.

Out of Scope

• The synchronized bilateral Genesis execution and public success receipt owned by #15291.
• Retaining or publishing the raw private cause of an UNEXPECTED_FAILURE; this ticket preserves only a fixed phase identifier so cleanup can erase the root without erasing whether the isolation gate executed.
• Adding write attribution to every Memory Core or log record.
• Stopping active MCP/Memory Core processes to manufacture a quiet proof window.
• Runtime mutation of AiConfig, new public ingress, wider tools, or retained raw diagnostics.

Avoided Traps

• Quiescence as proof: a smaller race window is still attribution-free.
• Legacy alias: keeping defaultPathsUntouched with changed semantics would preserve a false claim.
• Env re-derivation: child entrypoints read resolved AiConfig leaves; they do not rebuild Provider precedence.
• Raw-failure retention: phase-level observability is enough to prove gate execution; raw causes still die with the disposable root.
• Path disclosure: containment evidence is role/boolean level, never an absolute-path receipt.

Related

BLOCKS #15291
Related: #15187
Implementation origin: PR #15279
Source discussion: D#15173

Origin Session ID: 7efa8a03-b5cb-46c6-b1e9-bda072fead25

Retrieval Hint: Genesis probe defaultPathsUntouched concurrent writers attribution-safe isolation