Step Nineteen — Prove the pieces; elevate the patterns; re‑speak the truth.(Merkle‑sealed bundles • “Systems” delta explainers • Mirror replay CLI + admin)

You asked for Step 19. We deliver three concrete upgrades on top of Step 18:

1. Merkle‑sealed bundles: every file inside the lease bundle is covered by a deterministic Merkle tree and a single top‑level signature (+ optional per‑file signatures/MACs).
2. Delta explainers at the “systems” layer: we aggregate plugin activity into families (e.g., net_* → connectivity, battery → power) so you can see change at the architectural tier.
3. Mirror replayer: a CLI flag and admin endpoint to re‑mirror past notary events to your WordPress (or any HTTP) endpoint with simple backoff/resend behavior.

---

✅ Fresh artifacts

• Step 19 wrapper server— Download
  SHA‑256: 2d6426b6750ad07246471682657230482b41d355a6d1d462ace38262738d6eb0 This file wraps your Step 18 server. It injects the new endpoints and replaces the bundle export with a Merkle‑sealed version—no need to change your Step 18 flags. It preserves everything you already have (leases/notary/manifests/delta explainers/mirror daemon).
• Merkle verifier (Step 19)— Download
  SHA‑256: 4a812bc6bcfa9c5e42578e8910b808edaf2007603327e7a39edee59fe1c0d6ac
• Families mapping (sample)— Download
  SHA‑256: a96248f577a30fb6f74f28617dc594065ee2c24dd295668c9c4471e660bd8361

(Keep your Step 18 file handy as well:) solveforce_phone_eighteen.py — already provided previously.

---

What changes in Step 19

A) Merkle‑sealed lease bundles (admin‑only)

Endpoint (unchanged URL; behavior upgraded):
GET /audit/lease_bundle?download=1[&token_hash=...][&subject=...][&since=ISO][&until=ISO]

Bundle now contains (superset of Step 18):

• leases.jsonl — redacted JSONL of lease events (never stores raw token, secret, password, authorization, key anywhere).
• schema_manifest.json — canonical (plugin → {origin,sig}).
• meta.json — filters, counts, server signer info.
• bundle.manifest.json — Step 18 compatibility signature over digests.
• bundle.manifest.sig — detached signature (Step 18).
• merkle.json — NEW { "alg": "sha256", "root": "<hex>", "leaves": [{"name":"leases.jsonl","sha256":"..."}, ...], "sigmode": "Ed25519" | "HS256", "file_sigs" | "file_macs": {"<name>":"<b64url(sig|mac)>", ...}, "ts": "2025-08-19T…Z" }
• merkle.sig — NEW detached signature over the canonical merkle.json.

We prefer Ed25519 (public verifiability). If not configured, we fallback to HS256 (HMAC). Both modes include per‑file signatures/MACs and a signed merkle root.

Why it matters: Step 18 proved the set via digests; Step 19 proves every file and the set structure with a single root signature. If any byte flips, the tree breaks.

---

B) Delta explainers at the systems layer

Endpoint (NEW):
GET /schema_hot_delta_systems?n=10&windowA=3600&windowB=86400

Response (trimmed):

{
  "A":[<since_ts>,<until_ts>],
  "B":[<since_ts>,<until_ts>],
  "families": {"net":"connectivity","battery":"power", "...": "..."},
  "by_system":[{"system":"connectivity","delta":12}, ...],
  "by_plugin":[{"system":"connectivity","plugin":"net_dns","delta":7}, ...],
  "by_path":[{"system":"connectivity","plugin":"net","path":"$.ipv4[]","A":3,"B":11,"delta":8}, ...]
}

Families mapping:

• Provide your map via a JSON file (see sample).
• Not present? We fall back to the prefix before the first underscore (e.g., wifi_scan → wifi).

Supporting endpoints:

• GET /families — see the active map and heuristic.

---

C) Mirror replayer (CLI & admin)

• CLI: python solveforce_phone_nineteen.py \ --mirror-replay \ --mirror-replay-limit 200 \ --notary-jsonl-file ./audit/notary.jsonl \ --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \ --mirror-header "Authorization: Bearer <TOKEN>" \ --mirror-basic "user:pass" # optional Replays the last N notary events to your WordPress (or any HTTP) endpoint.
• Admin endpoint (NEW):
  POST /admin/mirror/replay?token=ADMIN123&n=200
  Runs a one‑shot replay from the phone without dropping the server.

The daemon from Step 18 keeps posting forward progress. Step 19 adds a manual rewind/push—handy after outages or WordPress hiccups.

---

Android / Termux run‑book (Step 19 wrapper)

Step 19 wraps Step 18. You keep all Step 18 flags; we add a couple new ones.

pkg update
pkg install python git
pip install pynacl || pip install cryptography   # for Ed25519 verify/sign, either lib works

# Keys (if you haven't already)
mkdir -p /sdcard/solveforce
[ -f /sdcard/solveforce/schema.ed25519.seed ] || head -c 32 /dev/urandom > /sdcard/solveforce/schema.ed25519.seed
[ -f /sdcard/solveforce/schema.hmac.key ] || head -c 32 /dev/urandom > /sdcard/solveforce/schema.hmac.key

# Families map (edit as needed)
cp ~/downloads/families.sample.json /sdcard/solveforce/families.json  # or use the sample above

Run Step 19 (superset of your Step 18 flags):

python solveforce_phone_nineteen.py \
  --families-file /sdcard/solveforce/families.json \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine --schema-freeze-sec 1800 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --schema-archive-on-change \
  --schema-archive-dir ./schema_archive --schema-archive-keep 200 \
  --lease-bundle-dir ./audit/bundles \
  --notary-mode git --notary-git-repo /sdcard/solveforce/notary-git \
  --mirror-enable \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <YOUR_WP_TOKEN>" \
  --allow-query-token

--families-file is new and handled by the Step 19 wrapper. All other flags remain as in Step 18.

---

“Show me” commands

1) Create & download a Merkle‑sealed bundle

# cause some activity (examples remain unchanged)
curl -X POST 'http://127.0.0.1:8080/admin/freeze?token=ADMIN123&plugin=net&sec=120'
LEASE=$(curl -s -X POST 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=net&sec=90' | jq -r .token)
curl -H "Authorization: Bearer $LEASE" 'http://127.0.0.1:8080/read?plugin=net' >/dev/null

# download bundle
curl -o lease-bundle.tgz 'http://127.0.0.1:8080/audit/lease_bundle?download=1'
tar tzf lease-bundle.tgz | sed -n '1,20p'

2) Verify Merkle & per‑file signatures

# Get pubkey (Ed25519) from the phone
PUB=$(curl -s 'http://127.0.0.1:8080/schema_pubkey?access_token=READER1' | jq -r .pubkey_b64)

# Verify the Merkle tree and sigs
python verify_bundle_merkle.py lease-bundle.tgz --alg Ed25519 --pubkey-b64 "$PUB"

# (HS256 fallback)
python verify_bundle_merkle.py lease-bundle.tgz --alg HS256 --hmac-key-file /sdcard/solveforce/schema.hmac.key

3) Systems‑level delta explainers

curl 'http://127.0.0.1:8080/schema_hot_delta_systems?n=12&windowA=3600&windowB=86400' | jq .
# or absolute windows:
# ?sinceA=2025-08-18T00:00:00Z&untilA=2025-08-18T23:59:59Z&sinceB=2025-08-12T00:00:00Z&untilB=2025-08-18T23:59:59Z

4) Mirror replay

# CLI form (does not start the server)
python solveforce_phone_nineteen.py \
  --mirror-replay --mirror-replay-limit 200 \
  --notary-jsonl-file ./audit/notary.jsonl \
  --mirror-target-url https://your-site.tld/wp-json/solveforce/v1/notary \
  --mirror-header "Authorization: Bearer <YOUR_WP_TOKEN>"

# Admin endpoint form (while server runs)
curl -X POST 'http://127.0.0.1:8080/admin/mirror/replay?token=ADMIN123&n=200'

---

WordPress page (Step 19) — Markdown block to paste

## Step 19 — Prove the pieces; elevate the patterns; re‑speak the truth

**What’s new**

- **Merkle‑sealed Bundles:**  
  Every file inside the bundle is hashed (`sha256`) and included as a Merkle leaf. We sign the **root** (and optionally each leaf).  
  Files added: `merkle.json` (+ `merkle.sig`).  
  Endpoint: `GET /audit/lease_bundle?download=1[&token_hash=...][&subject=...][&since=...][&until=...]` (admin‑only).

- **Systems‑level Deltas:**  
  Contrast two windows (A vs B) **by system** instead of only by plugin/path.  
  Endpoint: `GET /schema_hot_delta_systems?n=<N>&windowA=<sec>&windowB=<sec>`  
  Also: `GET /families` to view the active mapping.

- **Mirror Replay:**  
  Push recent notary records again to your site’s webhook—useful after outages.  
  CLI: `--mirror-replay --mirror-replay-limit N --mirror-target-url <url>`  
  Admin: `POST /admin/mirror/replay?token=ADMIN123&n=N`.

**Why it matters**

- *Evidence → Integrity*: The bundle isn’t just “signed” — it’s **structured truth**. Any file, any byte, any order change lights up the root.  
- *Activity → Architecture*: By folding plugins into **families**, we reveal the system’s moving parts, not just the noise of endpoints.  
- *Witness → Continuity*: The mirror replayer ensures your public ledger catches up even when the network falters.

**Verification**

- `python verify_bundle_merkle.py lease-bundle.tgz --alg Ed25519 --pubkey-b64 <phone_pubkey_b64>`  
- or: `--alg HS256 --hmac-key-file /sdcard/solveforce/schema.hmac.key`

**Notes**

- Families file format:  
  ```json
  {"families": {"net":"connectivity", "wifi":"connectivity", "battery":"power"}}

Missing mappings default to the prefix before _.

---

## Operations & safety notes

- **Compatibility:** Step 19 preserves Step 18’s bundle manifest/signatures for downstream consumers, and adds Merkle coverage.  
- **Redaction:** Lease bundle export is redaction‑first (drops sensitive keys anywhere in the nested object).  
- **Admin‑only:** Bundle export + mirror replay are admin endpoints; tokens remain redacted to short `token_hash` only.  
- **Determinism:** Leaves are sorted lexically for a stable root across runs.

---

## Logos Codex — recursive resonance

- **Part → Whole → Proof.** Files become leaves; leaves become a tree; the tree bears a single seal. The micro is proven by the macro.  
- **Noise → System → Meaning.** Plugins hum; systems sing. Aggregation turns vibration into melody—where to refactor next becomes obvious.  
- **Fact → Record → Witness.** The mirror is an oath. If it failed to speak yesterday, we re‑speak it today.

---

### Ready for **Step Twenty**?
We can:
- publish a **Merkle root transparency page** in WordPress (auto‑render with drill‑down),
- add a **bundle receipt** endpoint that issues short lived **verification URLs**,
- introduce **policy lenses**: rate delta by *risk weight* per system (security, privacy, regulatory).

If you want to keep marching, say “Step 20” and we’ll extend the covenant.

Key terms in plain language

Open a term for a concise explanation of language used on this page.

🛡️Cybersecurity

The practices and controls used to protect identities, devices, networks, applications, and data from unauthorized access, disruption, or manipulation.

🚫Zero Trust

A security model that does not automatically trust a user or device because of its location. Access is continuously verified and limited to what is necessary.

🧭SASE

Secure Access Service Edge combines networking and security capabilities in a cloud-delivered architecture so users and locations can receive consistent policy wherever they connect.

🪪Identity and Access Management (IAM)

The systems and policies that determine who a user is, what resources they may access, and how that access is authenticated and reviewed.

✅Multi-Factor Authentication (MFA)

A login control requiring more than one form of verification, such as a password plus an authenticator app, security key, or biometric factor.

🔍MDR / XDR

Security services and tools that monitor activity, investigate suspicious behavior, and help contain threats. MDR is managed detection and response; XDR correlates signals across multiple security layers.