Receipts: record receipt_origin's contemporaneous/correction/back-port split beside 'snippets verified' (#2933)

[realmarcin]

Refs #2933 (second PR; the parts under "Left open" stay open).

Receipt origin in the provenance record and beside "snippets verified" (#2933, part 2)

#3034 added d4d receipts origin. It reads a native or direct run's transcript and classifies each coverage-receipt snippet as contemporaneous, phase1_correction or phase3_backport. It is report-only, so no record, gate or summary carried the split. As a result, "snippets N/N verified" still mixed evidence written while reading with evidence added after the draft: 53 of 329 snippets on the three direct-arm CHORUS attempts. This PR records the split under receipts.origin and prints it beside "snippets verified".

The record contract takes it unchanged

The pinned contract (src/data_sheets_schema/schema/d4d_generation_record.yaml, compiled by record_schema.py) types receipts as AnyBlock, which compiles to additionalProperties: true. GenerationRecord itself compiles to additionalProperties: false. So receipts.origin validates with no contract change, while a new top-level receipt_origin block would be rejected. test_the_record_contract_takes_the_block_inside_receipts_only pins both. No schema file changes.

What changes

receipt_origin_record.py (new) defines what a record keeps of receipt_origin.origin's block:

• every key except local paths: transcripts by basename, sha256 and line count, and the receipt by sha256 (the receipts block beside it names its path);
• the instrument (receipt_origin v6 …) and its NON_CHECKS, beside the counts;
• no snippet text and no tool payloads, like the instrument's own output.

Which block a writer records (for_record):

• Transcripts given: the block is measured from them and replaces what the record carried.
• No transcript: a measurement the record carries is kept while the receipt on disk still has the sha256 it was measured on. A recomputation that cannot read the evidence never erases a measurement, as Review-instrument fixes: identity receipt join (#899), review-aware selection (#660), spelling v3 (#836/#859), dispositions (#903) #907 holds for the receipts block itself.
• Receipt changed since: the block is unknown, with a reason naming both sha256s, and the measurement is kept under prior. A later writer keeps that prior, and restoring the measured bytes restores the measurement.
• No measurement at all: the block is unknown with the reason, and no classification; never contemporaneous. An API-path record (one carrying api_usage) says it has no tool-call transcript and names API v7: slots.without_receipt mixes phase-1 unreceipted values with reconcile rewrites; verified snippets can point at removed values #807 and v8 defect (CM4AI canary): a receipt addressed to a path the record does not carry ('subject' for a value placed under keywords) #952 as that path's own accounts.

split() returns counts only for a checked origin measured on the receipt the block checked (same sha256). A split of other bytes is never shown beside the block's counts.

d4d receipts check gains --transcript (repeatable, first invocation first), --receipt-at-run and --full-at-run. With --write, the measured block goes into the record.

• The split prints on the line after "snippets M/M verified", but only where a transcript was read, now or earlier. If the receipt has since changed, the line says unknown and gives the reason; it is never left out silently.
• With no transcript and no measurement in the record, the output is byte-identical to main. That is the playbook's mid-run call. Checked on one fixed fixture under both trees: no record yet; a record without --write, with --write twice, and with --strict; the receipts block minus origin; and the claims sidecar.
• One difference, which is a fix. When apply keeps a checked block over an unchecked recomputation (Review-instrument fixes: identity receipt join (#899), review-aware selection (#660), spelling v3 (#836/#859), dispositions (#903) #907), main still printed "✓ receipts block written". It now says the block was not written. Where --transcript was given, it also says the origin it read was not written either.

backfill_checks.compute, and so d4d provenance record and backfill-checks --blocks receipts, writes receipts.origin beside the receipts check: the record's measurement kept, or unknown. Neither command holds a transcript.

• provenance record rewrites the record from scratch before its inline checks run. It therefore reads the origin first and passes it through by keyword: _inline_checks(path, *, origin_prior=…) → compute(origin_prior=…).
• summarise appends (C contemporaneous, P post-draft), or (origin unknown) where a measurement stopped applying. It appends nothing for a record never measured, so the recorder's line during a run is unchanged.

Canary.

• d4d api batch's per-run line gains two reported-only rows next to snippets unverified: snippets contemporaneous and snippets post-draft. They read — wherever no transcript was read, which is every API-path run.
• d4d api verdict, the offline gate for a record of any arm, prints the origin line after its rows.
• Neither is a verdict row or a floor, and verdict() is identical with and without an origin (tested). Post-draft snippets stay unaccepted as semantic support until independent review (Clarify Phase 1 receipt correction versus terminal native evidence-check stops #2067).

What does not change

• No pinned file is touched: the schema directory, receipt_origin.py, receipts.py, api_runner.py, playbooks, agents, prompts, and the native and direct controllers.
• --strict, receipt_floors and verdict() read nothing new.
• Records written by the pinned API runner (api_runner._receipts_block) carry no origin key. The summaries read that as not measured.

No corpus backfill

No committed record under data/d4d_concatenated/** is rewritten. None of the 286 provenance records there carries an origin block, and none comes from the native or direct arms. Measuring a run is an owner decision, made per run with its preserved transcript(s):

poetry run d4d receipts check --method <method> --label <label> --project <PROJECT> --write \
    --transcript <transcript.jsonl> [--transcript <resumed.jsonl> ...] \
    [--receipt-at-run <receipt path as the transcript spelled it>] \
    [--full-at-run <full-record path as the transcript spelled it>]

backfill-checks --blocks receipts --overwrite --execute measures nothing, because it reads no transcript. In every receipts block it rewrites, it writes origin: unknown or keeps a measurement the record already carries. It also recomputes the whole receipts block, so running it over the corpus is a separate decision.

Tests

• tests/test_receipt_origin_record.py: 21 tests, synthetic transcripts only; none walks the corpus. They cover:
  • a contemporaneous snippet, a Phase 1 correction and a Phase 3 back-port;
  • an all-contemporaneous run;
  • the issue's re-address-only case (0 added, 0 removed, 3 re-addressed);
  • no transcript, an API-path record, and a missing or truncated transcript;
  • a kept measurement, and the prior chain after the receipt changes;
  • split() and line();
  • the canary rows, with verdict() equal with and without the origin;
  • d4d api verdict;
  • compute, apply and summarise;
  • receipts check --write --transcript end to end, after the receipt moved, and on a withheld write;
  • a d4d provenance record re-record that keeps a measured origin;
  • the contract check.
• Mutation: 28 distinct mutants on git archive copies, each counted killed only by a failure in this file. 27 ran at 5afd1fc. At 2376d2c the recorder hand-off mutants were re-run and one new one was added for the changed call site. All 28 were killed.
• The 110 test files that import a changed module or the root CLI group (-m "not corpus" -n 2, at 5afd1fc): 3,714 passed, 29 skipped, 3 failed.
  • The three failures were this branch's: test_agentic_render_to_record_preserves_selected_inputs[command|header|none] stubbed _inline_checks with lambda path: None, and the branch passed it a second argument.
  • Fixed in 2376d2c. origin_prior is now keyword-only, and that stub takes *a, **k, like the helper's stubs in test_profiles.py.
• After the fix, at 2376d2c:
  • every file that calls or stubs _inline_checks, plus the failing one: 178 passed;
  • the 25 further files that drive provenance record: 1,378 passed, 1 skipped.
• Corpus lane (-m corpus -n 2, at 2376d2c, run after the PR opened): 116 passed, exit 0.

Left open (#2933 stays open)

• The native-gate summary.
  • The pinned controllers' receipt acceptance (notes/matched_cborg_2026-09-13/run_api_canary.py) changes only with a new registration.
  • The src adapters (native_supervisor_gates.receipt_gate, used by native_execution_gates and native_attempt_supervisor) check sealed, captured bytes, while receipt_origin.origin reads files by path.
  • Add the native/direct adapter for the selected shared-generation protocol #4354 is reworking the native and direct adapters now. Follow-up: Native completion gates: report the receipt-origin split beside the receipts gate #4442; measuring at the controllers once the transcript is final is Native/direct controllers: measure the receipt origin once the attempt transcript is final #4445.
• A figure CSV column. The Figure set: summarizing generated D4D content and evaluation quality across the three arms (tracking) #2303 figure scripts are not on main (Figure set (#2303): carry the contemporaneous / post-draft snippet split in the receipt figure CSVs #4443).
• d4d receipts readdress, the issue's optional part 3 (d4d receipts readdress: native counterpart of the API path's full_readdress (#2933 part 3, optional) #4446).
• Owner step. Re-run the three direct-arm CHORUS transcripts through d4d receipts origin at receipt_origin v6. receipt origin v1: classify each receipt snippet as contemporaneous, Phase 1 correction or Phase 3 back-port from the transcript (report-only) (#2933 PR1) #3034 reproduced the issue's table at v1 (40ea81a). The transcripts are untracked in other worktrees, which this PR did not read. Which runs to measure is Measure receipts.origin for the preserved direct-arm and native attempts (owner decision) #4444.
• CLAUDE.md does not yet describe receipts.origin or the new options (Document receipts.origin and receipts check --transcript in CLAUDE.md's Coverage Receipts section #4447); the loop does not edit CLAUDE.md.

🤖 Generated with Claude Code