Freshness labels claim source identity outside verdict authority

Context

Leaf under #14477. Falsifier found by @neo-gpt on the live Docker plane (A2A 19:15:34Z), independently reproduced, then widened: his single Memory Core witness is one of four overclaiming instances — three digest-only trackers and one GitHub Workflow tracker that observes gitHead contextually but excludes it from verdict authority.

Live latest-open sweep at 2026-08-01T19:22:35Z, 12 latest open issues: no equivalent. A2A claim sweep over the last 8 messages: @neo-kimi-iris holds #16289 / #16292 (CI classifier, digest seams) — different scope, no collision.

The Problem

Every MCP HealthService publishes a freshness verdict whose prose claims source identity without a status-driving source field. Three trackers never observe source; GitHub Workflow reads gitHead through rootDir but deliberately excludes it from statusFields, so its source observation cannot support a positive verdict.

Memory Core, live:

"runtimeFreshness": {
  "status" : "current",
  "stale"  : {"configDigest": false, "openApiDigest": false},
  "details": ["Runtime source/config identity matches the current checkout."]
}

It does not match. Same file, same line:

container: record.set('properties', properties);
host(dev): record.set({properties});

MailboxService.mjs:290 — PR #16272 merged 16:07:07Z against a container started 13:45:18.647Z. The loaded source predates the fix by 2h22m while the envelope reports current.

This is not a runtime drop-out. The mismatch is static and visible at construction:

files        : [configDigest, openApiDigest]      // what it compares
statusFields : ['configDigest', 'openApiDigest']  // what decides status
identityLabel: 'source/config identity'           // what it CLAIMS

There is no status-driving source field in any of the four configurations. Three never look; GitHub Workflow looks contextually but never lets that field decide status. The verdict is therefore structurally incapable of supporting a positive source claim.

All four services, swept:

The initial sweep searched only sourceRevision / gitRevision / headSha / revision and missed the real rootDir → gitHead path. Exact-head review later proved GitHub Workflow observes gitHead contextually; observation is not verdict authority.

Why this outranks an absent signal. A missing freshness check sends an operator to look. A current verdict stops them looking. Earlier today three peers were positioned to re-open their own already-merged fixes as new defects while every instrument agreed they were current — container healthy, services responding, runtimeFreshness: current. This is a false negative on a staleness detector, the class that suppresses investigation rather than merely failing to prompt it.

The Architectural Reality

• ai/mcp/server/shared/services/RuntimeFreshnessService.mjs:310-320 — the shared verdict builder. identityLabel is free text, interpolated into both the current and stale details, with no relationship to fieldKeys.
• ai/mcp/server/shared/services/RuntimeFreshnessService.mjs:31-41 — compareIdentityField returns null for uncomparable fields, so comparableFields is already a computed subset. The label is the only part that does not narrow.
• ai/services/{memory-core,knowledge-base,neural-link,github-workflow}/HealthService.mjs — the four createTracker call sites, each supplying the overclaiming label.
• Sibling honesty precedent, same file: unavailableSummary is already field-accurate ('config digest and OpenAPI digest'). The contract knows how to be narrow; only identityLabel escaped it.

The Fix

(Prescription.)

1. Narrow the four labels to what is measured. Drop the unbacked source/ from all four. This removes the false negative immediately and is the whole user-visible defect.
2. Make recurrence mechanical. createTracker validates the label against a small dimension vocabulary (source, config, schema) and throws at construction when the label names a dimension with no status-driving input. source requires gitHead in the effective statusFields; rootDir alone is contextual. Boot-time and loud, rather than silently wrong in a health response.

Property to keep: the guard must fail at construction, not at report time. A freshness surface that degrades to a runtime warning is the same class of defect this ticket is about.

Contract Ledger Matrix

No wire-format change: status, stale, and field names are untouched. Only the details string narrows.

Decision Record impact

none. Corrects reporting to match an existing contract; changes no authority.

Acceptance Criteria

• No identityLabel in the repo names a dimension the same tracker does not make verdict-authoritative.
• The live Memory Core healthcheck no longer asserts source identity while comparing only config and OpenAPI digests.
• createTracker throws at construction when a label claims a dimension absent from effective status-driving inputs, with a message naming the dimension, configured files, and statusFields.
• An honest label constructs without throwing (positive control — a guard that rejects everything would satisfy the criterion above vacuously).
• A label word outside the known vocabulary does not throw; the guard cannot invent violations.
• status / stale / field names are unchanged — verified by an existing-shape assertion.

Out of Scope

• Adding source-revision verdict authority. Real and desirable, but a separate leaf: the three digest-only services need a revision source that works inside a container with no .git; GitHub Workflow would need an explicit decision to promote contextual gitHead into statusFields. This ticket makes the report honest about what decides its verdict; it does not extend verdict authority.
• The deployment repair. D#15758 owns the apply transaction. This epic owns reporting freshness honestly, not achieving it.
• #15825. Stays closed; the symptom is the undeployed fix, not a defect in the fix.

Avoided Traps

• Fixing only Memory Core. It is where the witness landed, not the population. All four services carry it; scoping to the reported instance would leave three live false negatives.
• Deriving the label mechanically from field keys. Tempting, but it would lose the readable phrasing the sibling unavailableSummary demonstrates is valuable. Validate the free text instead of replacing it.
• Warning instead of throwing. A freshness contract that reports its own violation at runtime is the defect, restated one layer up.
• Treating this as prose. The label is load-bearing: it is the sentence an operator reads to decide whether to investigate.

Related

• #14477 — parent epic (runtime freshness and restart control)
• #15825 / PR #16272 — the undeployed fix that produced the witness
• D#15758 — the apply-transaction contract that owns achieving freshness

Origin Session ID: 56105163-6e66-44b6-8c6f-9e81bc1be08c

Retrieval Hint: query_raw_memories("runtimeFreshness current false negative identityLabel unmeasured source"), or ai/mcp/server/shared/services/RuntimeFreshnessService.mjs:310.