Step Sixteen — Replay the exception, budget the motion, notarize the map.

We extend Step 15 with three concrete powers:

  1. Per‑lease replay (downloadable JSONL slices).
    Tail and export every lease_minted, lease_used, and lease_denied event with filters by token_hash, subject, and time window.
  2. Budgeted “hotness” windows.
    Rank the noisiest schema paths over any time window (since, until, or window_sec) using weighted counts:
    score = added + removed + 2×typechanges.
  3. Archive notarization hooks.
    Each schema change writes a canonical manifest snapshot (.json) and detached signature (.sig) and emits a notary record via one of:
    • jsonl (append to audit/notary.jsonl – default),
    • webhook (HTTP POST with JSON payload), or
    • shell (execute a command with templated fields).

In plain terms: we remember every hall pass, measure change where it matters, and attest the public map — on-device.

✅ Fresh artifact (download + integrity)

  • solveforce_phone_sixteen.py — Download
    SHA‑256: 3ed691d8fa1ba2a41ea2f40e237745d40c7a171b1de2d4fbd4115c2b176e5a93

This step subsumes Steps 14–15: leases + per‑path metrics + schema freeze + detached signatures + audit + windowed hotness + notarization.

What’s new — precisely

Per‑lease replay (audit + export)
  • Append‑only log: --audit-dir ./audit → audit/leases.jsonl.
  • SSE events: lease_minted, lease_used, lease_denied.
  • Endpoints:
    • GET /audit/leases?n=50[&token_hash=t#abcd1234][&subject=ron]
    • GET /audit/leases/export[&since=2025-08-19T00:00:00Z][&until=...][&token_hash=...][&subject=...]
      → returns text/plain JSONL slice for direct download/archival.

Mint, use, and even failed lease attempts are logged without leaking secrets (we store a short token_hash only).

Budgeted hotness windows
  • EndpointGET /schema_hot?plugin=<name>&n=10[&window_sec=3600]
    or GET /schema_hot?since=2025-08-19T10:00:00Z&until=...
  • Scoringscore = added + removed + 2×typechanges.
  • Storagea rolling, per‑plugin ring buffer of the most recent ~5K diff events (cap keeps memory predictable).
  • Fallbackwith no window, it uses the lifetime Prometheus counters from Step 14 for a total ranking.

Use this to focus refactors where the interface churns most.

Notarized schema archives (detached)
  • Turn it on:--schema-archive-on-change + choose signer:
    • Ed25519 (preferred): --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed
    • HS256 fallback: --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key
  • Files written on each change:
    • schema_archive/<YYYYMMDD-HHMMSSZ>-<ALG>-<KID>.json (canonical manifest)
    • schema_archive/<YYYYMMDD-HHMMSSZ>-<ALG>-<KID>.sig (detached signature; omitted if unsigned)
  • Retention: keep last --schema-archive-keep (default 200).
  • Notary modes:
    • --notary-mode jsonl (default) → append a record to audit/notary.jsonl.
    • --notary-mode webhook --notary-webhook-url https://... → POST the record.
    • --notary-mode shell --notary-shell-cmd 'echo {digest} {manifest_path}' → run a command with substituted fields.
  • SSE: schema_archived and schema_notarized fire with details (digest, alg, kid, paths).

    • You can continue verifying any snapshot with your existing verify_schema_manifest.py from Step 14.

    Android / Termux quickstart

    pkg update
pkg install python
# optional Ed25519 libs (either works)
pip install pynacl || pip install cryptography

# Keys
head -c 32 /dev/urandom > /sdcard/solveforce/schema.ed25519.seed    # Ed25519 preferred
head -c 32 /dev/urandom > /sdcard/solveforce/schema.hmac.key        # HS256 fallback

# Run Step 16
python solveforce_phone_sixteen.py \
  --host 0.0.0.0 --port 8080 \
  --plugins-dir ~/solveforce/plugins \
  --auth-mode protected \
  --auth-token READER1:reader \
  --allow-admin --admin-token ADMIN123 \
  --schema-freeze-mode quarantine --schema-freeze-sec 1800 \
  --schema-ed25519-secret-file /sdcard/solveforce/schema.ed25519.seed \
  --schema-signing-secret-file /sdcard/solveforce/schema.hmac.key \
  --audit-dir ./audit \
  --schema-archive-on-change \
  --schema-archive-dir ./schema_archive --schema-archive-keep 200 \
  --notary-mode jsonl --notary-jsonl-file ./audit/notary.jsonl \
  --open-ui --allow-query-token

    Open http://<phone-ip>:8080/ui and drop in READER1 if you want quick reads without minting S1 tokens.

    “Show me” commands

    A) Lease replay demo

    # Freeze a plugin
curl 'http://127.0.0.1:8080/admin/freeze?token=ADMIN123&plugin=net&sec=600' -X POST

# Fails without lease (423)
curl 'http://127.0.0.1:8080/read?plugin=net&access_token=READER1'

# Mint a 2-min lease for net
LEASE=$(curl -s 'http://127.0.0.1:8080/admin/lease?token=ADMIN123&plugins=net&sec=120' -X POST | jq -r .token)

# Success; also emits lease_used SSE + audit record
curl -H "Authorization: Bearer $LEASE" 'http://127.0.0.1:8080/read?plugin=net'

# Tail the last 20 lease events
curl 'http://127.0.0.1:8080/audit/leases?n=20'

# Export a time-bounded slice (JSONL)
curl 'http://127.0.0.1:8080/audit/leases/export?since=2025-08-19T00:00:00Z' -o leases-20250819.jsonl

    B) Hotness windows

    # Top-10, last hour
curl 'http://127.0.0.1:8080/schema_hot?window_sec=3600&n=10' | jq .

# Top-5 for the battery plugin in an absolute window
curl 'http://127.0.0.1:8080/schema_hot?plugin=battery&since=2025-08-19T09:00:00Z&until=2025-08-19T12:00:00Z&n=5' | jq .

    C) Notarized archives

    # Force a schema change (scaffold + refresh + read)
curl 'http://127.0.0.1:8080/admin/scaffold?token=ADMIN123&name=stub16&kind=plain' -X POST
curl 'http://127.0.0.1:8080/admin/refresh?token=ADMIN123' -X POST
curl 'http://127.0.0.1:8080/read?plugin=stub16&access_token=READER1' | jq .

# See artifacts and notary log
ls -1 ./schema_archive | tail -n 4
curl 'http://127.0.0.1:8080/audit/notary?n=10' | jq .

    To verify any archived snapshot (as before):

    PUB=$(curl -s 'http://127.0.0.1:8080/schema_pubkey?access_token=READER1' | jq -r .pubkey_b64)
python verify_schema_manifest.py --manifest schema_archive/2025...Ed25519-<kid>.json \
  --sig schema_archive/2025...Ed25519-<kid>.sig \
  --alg Ed25519 --pubkey-b64 "$PUB"

    WordPress — Step 16 (drop‑in)

    ## Step 16 — Replay the exception, budget the motion, notarize the map

**New capabilities**
- **Lease Replay:** Append‑only `audit/leases.jsonl` with `lease_minted/used/denied`; export slices via `/audit/leases/export` filtered by `token_hash`, `subject`, `since`, `until`.
- **Windowed Hotness:** `/schema_hot?plugin=<name>&n=<N>&window_sec=<sec>` ranks paths by `score = added + removed + 2×typechanges` over any time budget.
- **Notarized Archives:** With `--schema-archive-on-change`, every schema change writes a canonical manifest (`.json`) and detached signature (`.sig`), then pushes a notary record (`jsonl` | `webhook` | `shell`) and emits `schema_archived` + `schema_notarized` SSE events.

**Why it matters**
- We **allow** precise exceptions (leases) and we **remember** them.
- We focus engineering on the **hottest** seams of change.
- We **attest** the contract at every shift, turning drift into an auditable chain.

**Endpoints**
- `GET /audit/leases?n=50[&token_hash=...][&subject=...][&since=...][&until=...]`
- `GET /audit/leases/export[&filters...]` — download JSONL slices.
- `GET /schema_hot?plugin=<name>&n=<N>[&window_sec=3600 | &since=...&until=...]`
- `GET /schema_manifest` + `GET /schema_manifest.sig` + `GET /schema_pubkey`
- `GET /audit/notary?n=50`

    Operational notes

    • SecurityNo secrets in audit; only token_hash (SHA‑1 short) and subject.
    • CardinalityPath metrics still capped (~200 (plugin,path) counters) for Prometheus sanity; windowed hotness uses a bounded in‑memory ring.
    • Failure‑tolerant notarizationIf webhook/shell fails, we still append to audit/notary.jsonl and continue.

    Logos Codex — recursive alignment

    • Memory with shape.Exceptions without record are noise; with replay they become stories.
    • Change with budget.Motion without measure is drift; with a window, it’s a vector.
    • Truth with witness.A map unsigned is a rumor; notarized, it is a covenant.

    If you want Step Seventeen, we can:

    • add per‑lease downloadable bundles (auto‑redacted tarballs),
    • hotness deltas (compare windows A vs. B), and
    • notary adapters for Nostr, Git commits, or an append‑only Merkle journal that you can mirror to IPFS/S3.

    Key terms in plain language

    Open a term for a concise explanation of language used on this page.

    VoIP

    Voice over Internet Protocol carries phone calls over an IP network instead of a traditional analog phone line. Call quality depends on network stability, latency, and traffic management.

    Unified Communications (UCaaS)

    A cloud-based combination of business calling, messaging, meetings, presence, and collaboration tools managed as one communications service.

    SIP Trunking

    A service that connects a business phone system to the public telephone network using Internet Protocol, replacing or supplementing traditional phone lines.

    Bandwidth

    The amount of data a connection can carry in a given time, usually measured in Mbps or Gbps. More bandwidth supports more users, devices, and simultaneous applications.

    Latency

    The time it takes data to travel between two points. Lower latency improves voice, video meetings, cloud applications, gaming, and other real-time services.

    Service-Level Agreement (SLA)

    A provider’s written commitment covering service targets such as availability, response time, repair time, and sometimes financial credits when commitments are missed.