Receipts: the base's own grid record (diff.base_events) and staging's grid lists

[MaxGhenis]

Stacked on #175. Merge #175 first, then this with a merge commit.

Draft until CI passes and an independent review agrees. The local full suite passes: 1,848 passed, 15 skipped.

W4's replay gate (d1344 decision record, agreed with W4 on 2026-10-15) counts a candidate gap as known only when there is positive evidence that the base had the same pair. Today a receipt can't show that: full_supported_grid_complete covers both inert and missing pairs, and diff flags can't prove the base's state. This adds the base side's own record.

Receipt changes

All additive and optional. Receipts already issued stay valid; the golden fixture is unchanged and still validates.

diff.base_events.<event> — the base namespace's grid record:

• staging_manifest_sha256 and run_manifest_sha256;
• supported_years, taken from the base's RUN_MANIFEST.json, because staging does not record supported years (the receipt's own corpus block already reads them from there);
• full_supported_grid_complete;
• inert_measure_years, always present, [] when there are none;
• missing_measure_years and unsupported_measure_years, with staging's names and meanings.

How it is read:

• Source: the base's STAGING_MANIFEST.json and RUN_MANIFEST.json, bound to the digests DIFF.json recorded for them. The receipt step fails if the files differ.
• When there is no entry: the base staging predates the variant grid fields (the legacy layout), or the base did not replay the event. A base gap is reported only from the base's own manifests, never inferred.
• Meanings:
  • a missing pair is in the full event grid but has no artifact, so the list includes unsupported pairs;
  • a supported-grid gap is a missing pair that is not unsupported;
  • W4's test pairs a candidate's inert or (missing − unsupported) pair with the same pair in the base's lists.

corpus.events.<event> now also carries staging's missing_measure_years and unsupported_measure_years, so W4 matches candidate pairs directly.

Schema: docs/uk_replay/schemas/replay_receipt.v1.json gains $defs.measure_years (now also used by inert_measure_years), $defs.base_event, the two optional corpus fields and the optional diff.base_events. QUALIFICATION_INTERFACE.md documents each field and when it is absent.

Invariants

• Digest binding: a base_events entry exists exactly when the base staging has full_supported_grid_complete and both grid lists (property-tested). Its digests equal those DIFF.json recorded.
• Verbatim lists: its lists are the staging manifest's, unchanged (property-tested).
• No inference: no entry is ever synthesized, for a legacy base, a missing event, or a diff without inputs.

Checks run

• Tests:
  • base record values and digest binding; refusal on a changed staging or run manifest;
  • no entry without the grid fields or the inputs;
  • diff_summary carries the record, and event_results carries the lists (legacy-shaped staging gets none);
  • the schema accepts the new fields, refuses a base record missing any field, and refuses a malformed pair.
• Mutation: each mutant fails at least one test: no digest binding, an entry without the fields, supported years from staging, inert_measure_years omitted, no candidate lists, and a summary without base_events.
• Suite: full suite and ruff format --check pass.

W4 vendors the schema change from this PR's head.

axiom: n/a: replay receipt format; no policy encoding.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
policyengine-scorecard	Ready	Preview	Oct 15, 2026 8:41pm UTC