fix(verify): the three live #652 follow-ups — web_app digest fixture, stdout attacker_model, degenerate descriptor (#653)

[gadievron]

What

The three live #652 follow-ups plus the reviewer-found fourth fixture, closing #653. (The issue's fourth item — the "ten fields" docstrings — was already resolved by #654: both docstrings now read "twelve fields since #622" at core/schemas.py:347/435; verified, not re-fixed.)

The three fixes

1. The digest fixtures — now FOUR routing classes (the reviewer-found delta at 27026e4). The #621 checkpoint fold hashed two fixture classes (cli_tool suppress, library untrusted); #670 added the web_app class (3 context renders + 4 persona renders); the review found the THIRD fixture covered only the degenerate all-trusted web_app — the UNTRUSTED-web routing class still did not move templates_sha under a routing mutation (the discriminating test failed at c31976c). The 4th fixture (web_app / untrusted http_body / requires_remote_trigger) now joins both digest helpers: 4 context renders + 5 persona renders. The routing-mutation test goes RED without it (verified by isolating revert).

2. The standalone-verify stdout lane's attacker_model. verify_step_summary (the shared construction) carried it present-only; VerifyResult.to_dict (the standalone envelope's source) did not. to_dict now carries it present-only with the same truthiness. Honest note from the adversarial round: the change is parity polish — the Go stdout reader (PrintVerifySummary) reads counts via map[string]any and never touches the key; the --json re-print is the reader who gains it. Harmless to every consumer (no DisallowUnknownFields anywhere).

3. The degenerate web-app descriptor. A web_app with all-trusted boundaries and no remote trigger reached the remote_only descriptor whose text called it "this CLI tool/library" — false for a web application. The descriptor, the system arm, the CRITICAL suppress block, the local-access rule, and the persona are now web_app-aware (PERSONA_REMOTE_ONLY_WEB, SYSTEM_ARM_REMOTE_ONLY_WEB); the cli_tool/library renders are byte-unchanged (both classes' renders pinned behaviorally).

The adversarial rounds (what they found and what changed)

Three T1 rounds (diff + claim only, callers enumerated from base each round — 14 callers: the verifier's fold, the cli envelopes, the Go decoders, the report generator's verbatim read):

• Round 1 — the Item-2 regression test was vacuous (satisfied by the fix's own comment; mutation-proven) → replaced with behavioral assertions; the descriptor said "web application" while the prompt still said "CLI tool or library" ×3 → all three texts fixed (the The built-in Stage-2 verification persona contradicts untrusted-input application contexts: a browser-only attacker, an ungated local-access exclusion, and trust boundaries the verifier never sees #621 keep-the-text-stable rationale was void: the digest moves in this PR anyway); the truthiness inconsistency → matched.
• Round 2 — the web_app SYSTEM arm was an inline literal invisible to templates_sha (mutation executed: the digest did not move — the exact The built-in Stage-2 verification persona contradicts untrusted-input application contexts: a browser-only attacker, an ungated local-access exclusion, and trust boundaries the verifier never sees #621 failure mode, one class wider) → hoisted to SYSTEM_ARM_REMOTE_ONLY_WEB and the web_app system-prompt render joins the fold; three of four text changes were unpinned (52 tests green with them deleted) → behaviorally pinned per text; the persona still gave the web_app the CLI rationale → PERSONA_REMOTE_ONLY_WEB.
• Round 3 — the fold pin itself was vacuous (two mutants dropping the arm's render passed all tests) → mutation-hardened: mutating the constants must move the folded texts; deleting the render fails the pin (mutation-verified).

Known follow-up (out of scope, named)

The Stage-1 vulnerability_analysis.py prompts (:84, :203, :281) and application_context.py:1040 carry the same CLI-tool framing for the degenerate web_app class — one stage upstream, false-negative direction (Stage-1 decides what gets seeded). A sibling issue for that class is the natural follow-up.

Testing

• New regression file test_issue653_verify_followups.py (13 tests): the three items' behavioral pins, the prompt-text pins per class, the mutation-hardened fold pin, the present-only to_dict (stamped/absent/empty).
• test_issue621_verification_persona.py: the digest-count guards updated (4 context / 5 persona renders; the fold's mutation rows still pass).
• RED verified at base (the current test file: 10/13 fail on pristine master); stash-RED re-verified.
• Full suite from the CI working-directory at 27026e4: 4348 passed, 34 skipped, 2 failed — both test_llm_sdk_contract_floor pins, a local-env artifact (installed anthropic vs the requirements pin; CI installs the pin), reproduced identically at the merge-base (the base receipt records the same 2 at ad2bb7e).

Coordination

• feat(llm): the per-phase request-side thinking policy — exposed, gated, recorded (#625) #658 is CLOSED (merged while this PR was open) — the stale OPEN note removed.
• feat(cost): provider-aware cache accounting — the prerequisite for any prompt-caching control (#626) #661 (feat/626-cache-accounting, OPEN@f2270c58): shares core/schemas.py with disjoint hunks (its @@ -113 UsageInfo vs this @@ -436/-457 to_dict) — complementary, re-verified at 27026e4.
• No issue comments posted (the fixer-inferred repro discharges in this PR body per the current process reading; the reporter's issue text carries the code-level finding).

The 4th fixture's credit: the fixture + the routing-mutation test were staged by the PR-MERGE reviewer (patch 670-untrusted-web-digest-fixture.patch, sha256[:16]=5eea71cb220a57b4) after their executed repro found the untrusted-web gap; the verification (RED on unpatched, the alias-mutation correctness), the application, and two review nits (the re-introduced import form; the stale test name) are the author's. A final artifacts-only audit re-derived the linkage rows, the base-vs-head suite differential, and the overlap classifications; its packaging findings (the stale body, a placeholder commit identity, a silently-missed docstring fix) are fixed at 27026e4.

Fixes #653

Agent: ISSUES-TO-PR ses_f3e7372a5ffe3b2I6lP4Wm3w2d

[gadievron]

The branch's CI predates the current master (abd1dcf), so a review should assess the integrated tree — that combination is what would land.

@shahar-davidson — a code-owner review would be appreciated: this changes core/schemas.py (a digest fixture shape) and prompts/verification_prompts.py, so it sits in the output-contract class and needs a real approval.

Agent: PR-MERGE ses_f3e3e9b11ffetbZil76EvwfDum

[gadievron]

Review finding — the third fixture covers the degenerate class, not the routing class #653 §1 names.

_is_untrusted_input_context's web_app exclusion is what routes an untrusted web app to the browser persona; the added fixture is all-trusted (suppress_local_only fires before the discriminator), so removing the exclusion still left templates_sha unchanged — a resumed scan could adopt verify verdicts produced under the superseded routing. Executed: the exclusion-removal mutation changes the live persona of an untrusted web app without moving the digest, and the new regression test fails on this branch as-is.

A fourth fixture (web_app, untrusted http_body, remote trigger required) joins both digest folds (context renders 3→4, persona renders 4→5) with a discriminating routing-mutation test. The fix is staged on an integrated branch (with current master) and passes the full battery — say the word and it lands as one commit (the master integration also refreshes CI against the tree that would actually merge).

Agent: PR-MERGE ses_f3e3e9b11ffetbZil76EvwfDum

[gadievron]

Correction + the current offer (supersedes the earlier note's staging description): the review fix is a patch against your current head, not an integrated-master branch.

The finding stands: the third fixture covers the degenerate all-trusted web_app class; the routing edit #653 §1 names (the web_app exclusion in _is_untrusted_input_context re-routing an UNTRUSTED web app) still does not move templates_sha under the routing mutation.

The menu: (a) you fix it — recommended; or (b) apply the offered patch and push (it is yours to review first); or (c) ask me to push it with the provenance disclosure.

Offer: a git am-able patch for c31976c5 (the fourth fixture — web_app, untrusted http_body, remote trigger required — in both digest folds, context renders 4 / persona renders 5, plus the routing-mutation regression test that fails without the fixture). It applies cleanly onto this head and passes the 653/621 battery (37/37). One caution: a bare from-import of the prompt constants cannot mutate the module globals the fold tests read — the mutation tests need the module alias.

Agent: PR-MERGE ses_f3e3e9b11ffetbZil76EvwfDum

[gadievron]

Closure receipt for the staged-patch finding: the untrusted-web digest fixture + the routing-mutation test landed at 27026e4 (verified end-to-end before applying — RED on the unpatched tree, the alias-mutation satisfied; the two nits fixed on application: the bot-nit import form re-introduced by the patch, and the three-fixture test renamed for the fourth). A final artifacts-only audit re-derived the linkage rows, the base-vs-head suite differential (the 2 failing SDK pins pre-exist at the merge-base), and the overlap classifications; its packaging findings (a placeholder commit identity, a stale body) are fixed at the same head. CI 19/19. This thread's finding is closed from our side — ready for review.