Event chain E0–E5: warranted finding → identity → verified repair → qualified learning #984

Objective: prove a complete event chain before upgrading the context engine

This is an integration programme, not a new graph/database proposal. Begin with one real event chain from a GitHub finding through gitbot-fleet/Hypatia observations and ultimately a verified learning outcome. Keep VeriSimDB, VCL-UT, Odraz/JEG, residual-evidence and invariant-path independently useful. Do not force any of them to become Hypatia-only. No automation should increase repair confidence or authorise a merge from unverified external reports.

Observed as-built state (2026-10-30)

• Hypatia lib/vcl/client.ex routes primarily to a flat-file FileExecutor, with remote executor for multi-URL sources; it does not currently demonstrate a fully integrated VeriSimDB/VCL-UT/JEG analysis path.
• VeriSimDB elixir-orchestration/lib/verisim/query/vclt_gate.ex supports an optional VERISIM_VCLT_GATE binary. Unconfigured returns :skip; proof discharge and mutations use other paths. This gate is a static admissibility check, not a factual attestation that a code change is good.
• vcl-ut owns the proof-backed VCL admissibility semantics; the exact reachable L7–L10 source surface and residual obligations must be treated as observed/version-specific, never asserted from README badges alone.
• Odraz JEG is a pre-alpha independently useful claim/evidence mechanism. It is not deployed as Hypatia's generic graph service.
• #919 wants support-named gate verdicts. #971 wants a single KYAML-parsed workflow model. These are adjacent but do not block the initial outcome chain.
• PR #982 attempts replay-safe, postcondition-backed fleet ingestion. At inspected head 579e969c6343c9a4a312eae78bf2033754c61b93 it had nine unresolved inline review threads (six Codex, three CodeRabbit), and red Security Status, Rust Dependency Audit, Rust License & Ban Check, and governance / Allowlist Preflight; it was returned to draft. Do not report it as complete or learning-verified.
• lib/cross_repo_learning.ex on main still counts outcome: "success" in local and transferred evidence without the stricter verification qualification. Repairing just OutcomeTracker is insufficient to close the overall feedback loop.

Event-chain trace (MVP; all steps must be inspectable)

1. Source change: identify repo/ref, immutable commit SHA, relevant path/symbol and scan tool version. A path/line alone is not stable identity; use file/revision identity and reanchoring when available.
2. Observed finding: structural scanner emits a reproducible observation and its evidence reference. Keep asserted, inferred, observed, tested, contradicted different; do not certify assertions because they were received.
3. Identity/relationship context: link affected symbol, transitive callers and previous version through existing VeriSimDB graph/temporal/provenance modalities; record modality/profile and missing witnesses explicitly. Vector results can nominate candidates, never establish identity or equivalence alone. Later seam, not a prerequisite for the MVP outcome chain.
4. Admissibility: where operations need VCL-UT checking, record the actual certified level, input/schema digest, gate version and whether invoked/skipped/failed. A skipped gate is NOT a pass. Preserve verifier limitations. Later seam, not fabricated today.
5. Judgement: record claimed effect, supporting and contradicting evidence IDs, policy version, qualification status and current-head context. JEG-like evidence model is an interchange concept, not a mandatory dependency on Odraz.
6. Attempt: append an identifiable attempt_id with stable producer identity and source event provenance before execution. Do not use a hash of the JSON contents as an attempt ID: separate attempts can have identical content. Avoid host-specific absolute paths and credentials.
7. Test/verification: record before/after predicates, test runner+toolchain, exit status, test/scan digests, verified | incomplete | failed | unverified, independent failure/timeout cases. A zero exit code or neural self-assessment alone does not establish successful remediation.
8. Durable ingestion: use a stable event identity and idempotent destination write, detect corrupt and unreadable logs, retry transient reads/writes, prevent producer feedback echoes and duplicates after restart. Different attempts with identical payloads must remain distinct. Record causality (parent IDs) and timestamps as metadata, not as trust substitutes.
9. Qualified learning and review verdict: Bayesian counts, annealing temperatures/stages, cross-repo transfer and dispatch decisions use the SAME verified-evidence qualification. Unsupported records may still count as auditable attempts, not successful fixes. Findings/approvals name exactly which evidence they depend on. If evidence is withdrawn, recompute/revise dependent verdicts (link Gate verdicts that name their support #919 and residual-evidence Revision).
10. Receipt: emit a compact machine-readable chain with head_sha, subject_id, event_id, parent_event_ids, source, provenance, assertion, observations, proof_or_test_ref, qualification, verdict, missing_evidence, chain_version. Final format must respect KYAML / I-JSON/JCS policy through their actual canonical tools, not introduce ad-hoc parsing or Python.

First implementation slice: close PR #982's epistemic leaks

Do not create a grand new data model before fixing the actual false-learning path.

• Fix all outstanding review findings in PR fix: stop replay and false success in fleet learning ingestion #982 with fixtures: local failed fixes must count as failures; unqualified results may appear in the audit log but not advance Bayesian confidence, annealing maturity or dispatch tier; unqualified-only attempts must persist as such.
• Handle missing/unreadable destination log, dropped append, changes during poll, and restart/replay. A failed persistence operation must not advance a source cursor/signature.
• Deduplicate the same actual event, not different attempts containing byte-identical JSON. Define an exact stable source identifier and prove how producer emits it or an equivalent source-location identity; event-ordering and crash-recovery tests are required.
• Prevent re-reading imported fleet outcomes as new local outcomes on the following scheduler tick.
• Audit and fix CrossRepoLearning's unqualified success counts/transfer and anomaly classification, in a separate targeted PR or explicitly linked follow-up, with negative tests. Otherwise higher-level confidence remains vulnerable.
• Run the pinned Elixir tests and an integration fixture across two polls + scheduler restart, synthetic identical-but-distinct attempts, missing/corrupt logs, retry-after-write-failure, red->green transition, and withdrawn evidence. Treat incomplete tool execution as BLOCKED.
• Resolve all app review threads substantively and inspect current-head CI, including the four red checks named above. Never bypass a rule to get green. Preserve Verified signature policy.

Acceptance evidence

Only claim E0 outcome chain verified when tests show:

• 1 verified event credits one outcome and one learning update across poll/restart/replay.
• 2 distinct attempts with identical outcomes credit twice if both verified, while replay of one event never credits twice.
• Exit-zero-only / absent verifier / contradictory evidence contributes zero positive learning and zero maturity increase.
• A true failed attempt lowers confidence appropriately; a failed write does not commit or acknowledge an event.
• Missing/unreadable/corrupted evidence causes a visible failure/unknown, never a silent success.
• Cross-repo consumers cannot re-introduce unqualified confidence.
• A resulting gate/learning receipt names its exact evidence and supports retraction/revision without erasing audit history.

Following E0 (not before): E1 parsed workflow identity with #971 and KYAML; E2 VeriSimDB graph/temporal/provenance identity and optional native-vector retrieval (reusing existing HNSW); E3 VCL-UT validation seam; E4 JEG-style support/contradiction exchange with Odraz-compatible semantics; E5 controlled neuro-symbolic synthesis. Each state must be separately demonstrated as source-existing / tested / integrated / operational. Never claim features are operational because their repos exist.

Boundaries

No new Python. No forced cloud vector DB, blockchain, login or mandatory new sandbox. No breaking changes to unrelated research repos. No unapproved fixes or automatic merges. Keep this scoped to event-source integrity and reproducible evidence before expanding to formal consonance. This is event-chain integration, not an architectural restart.