Hiro development journal

Evidence-only Stage 6 bridge implemented and reactivation gated

2026.08.09 at 14:09:21 America/Los_Angeles Implementation and validation complete; Stage 6B paused for a new approval Machine-readable JSON

Executive summary

Hiro now has the missing fail-closed bridge that can convert a genuine five-packet Stage 3 through Stage 5 evidence chain into the candidate format consumed by the Stage 6B controller.

The first bridge version is deliberately narrower than the active evidence-only policy: it can materialize exactly one new Markdown evidence note, cannot change an existing file, and cannot infer or create missing upstream evidence.

Eleven bridge-specific adversarial tests passed, the integrated Stage 6 suite passed 58 tests, and the complete Hiro repository passed 425 tests on the committed revision.

The active Stage 6 policy now requires the bridge adversarial suite. This changed the policy hash and invalidated the identity binding of the earlier enablement packet.

Stage 6B was paused before tracked changes began and remains closed: its scheduled task is disabled, the external disable sentinel is present, and its candidate inbox is empty.

A new immutable activation-review packet was frozen against the exact implementation revision and policy hash. Reactivation requires a separate explicit user decision bound to those new identities.

Work completed

Evidence-chain materializer

Implemented

Added a production command and library component that accepts one opportunity packet, baseline packet, frozen candidate packet, Stage 4 recommendation, and Stage 5 isolated-validation packet.
The bridge verifies read-only packet and sidecar integrity, distinct packet paths, expected schemas, shared repository, branch, base revision, policy, and opportunity identities, and exact candidate content linkage.
It also checks one-hypothesis linkage, evidence chronology and freshness, Stage 4 eligibility, Stage 5 isolated monitoring results, a clean current repository, and the current branch and revision before producing output.
Successful output is atomically written to an otherwise empty Stage 6 inbox, accompanied by a hash sidecar, and both files are made read-only.

Narrow artifact boundary

Enforced

The bridge supports exactly one additive Markdown documentation-evidence operation in its first version even though the broader policy can describe up to two evidence files.
It rejects targets outside the opportunity-scoped documentation path, files that already exist, path escapes, unsafe Markdown, excessive size or line count, executable or non-blob objects, and missing declared tests.
It does not construct candidate code, evaluate model behavior, manufacture Stage 4 or Stage 5 outcomes, merge a branch, restart a service, push a remote branch, or take an external action.

Adversarial validation

Passed

Added eleven focused tests covering the valid materialization path and rejection of mismatched identities, fabricated gate outcomes, altered candidate content, incorrect base hashes, unsafe paths, writable evidence, invalid chronology, and an occupied inbox.
Added the new suite to the active policy's mandatory Stage 6 tests.
Ran all six focused Stage 6 suites and then the complete repository suite under the normalized Windows child-process environment.

Activation identity reset

Safely paused

Disabled the Stage 6B scheduled task and restored the persistent external disable sentinel before modifying the tracked implementation.
Committed the reviewed implementation as revision ed46d25ee82e3e01b366be7ee145149dcd6575c3.
Computed the replacement active-policy hash and froze a new read-only review packet with a verifying companion hash.
Did not replace the prior enablement packet or reactivate the scheduler because that requires a separate user decision on the new identities.

Decisions and reasoning

Close Stage 6B during implementation so an old approval cannot govern a changed revision or changed policy.
Require five distinct immutable source packets rather than allowing a caller to summarize the evidence chain into unverified booleans.
Bind every packet to the same repository, branch, base revision, policy, opportunity, candidate, and content hash.
Start with one documentation-evidence file, which is narrower than the policy ceiling and sufficient to exercise the real admission and promotion path.
Treat a non-empty inbox as an ambiguity and reject instead of choosing among candidates.
Require new explicit reactivation approval because both the reviewed Git revision and policy hash changed.

Validation and evidence

Check	Status	Result
Python compilation	passed	The new implementation and its test module compiled successfully.
Bridge adversarial suite	passed	11 tests passed in 6.01 seconds with zero failures.
Integrated Stage 6 policy suite	passed	58 tests passed in 44.27 seconds with zero failures.
Complete Hiro repository suite	passed	425 tests passed in 142.42 seconds with zero failures. An earlier invocation reached its two-minute command wrapper before pytest returned a verdict and was discarded as an infrastructure timeout, not counted as a test result.
Review packet integrity	passed	The replacement review packet and companion hash match and both files are read-only.
Operational closure	passed	The Stage 6B scheduled task is disabled, the disable sentinel is present, the activation environment opt-in is absent, and the candidate inbox contains zero packets.

Current state

The bridge implementation is committed at revision ed46d25ee82e3e01b366be7ee145149dcd6575c3.
The active evidence-only policy hash is 0e6131ab53d58490c7c562523c9ffd1ee1595268ce084447b9d6e177efee2ff3.
The new activation-review packet hash is aad5e888fd0d761995d39f5de475984fdbb99da20ad0e3c28577a13d541e1f18.
Stage 6B is disabled and has no waiting candidate.
The earlier enablement packet cannot authorize the new revision because its policy hash does not match.
No production evidence promotion has occurred.

Next steps

Present the exact replacement revision, policy hash, review-packet hash, and unchanged one-promotion activation boundary for a separate user decision.
If reactivation is approved, replace the stale enablement with a newly timed packet bound to the new policy identity, then remove the sentinel and enable the task in that order.
Continue bounded evidence collection until a real reproducible opportunity produces all five required packets.
Allow the bridge to admit at most one genuine documentation-evidence candidate and retain the 24-hour promotion probation before considering the one-promotion cycle complete.
Keep broader artifact classes and all runtime-changing promotion outside this version.