From f4d6f9176c458d5c9efb832ff1966dc89dd78098 Mon Sep 17 00:00:00 2001 From: timmy Date: Wed, 26 Aug 2026 01:30:39 +0000 Subject: [PATCH] docs: record Human Gates identity invariants --- README.md | 8 ++++++-- tests/test_human_gates_readme.py | 2 ++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 57ee604..f64be36 100644 --- a/README.md +++ b/README.md @@ -856,8 +856,12 @@ JSON. Full behavior and safety gates are documented in Authenticated release producers use `POST /api/v1/human-gates/intake` with an `Idempotency-Key` and an immutable `"candidate_hash"`; durable account-bound -SQLite storage is configured by `STACKCHAIN_HUMAN_GATE_DB`. Review decisions -carry `expected_revision`, a new idempotency key, and return durable receipts. +SQLite storage is configured by `STACKCHAIN_HUMAN_GATE_DB`. Account isolation +binds each queue to the upstream principal ID and login, including its offline +browser cache. Review decisions carry `expected_revision`, a stable idempotency +key across network retries, and return durable receipts. If producer evidence +changes after a release or hold, the update reopens the exact hash for a new +revision-checked decision instead of silently retaining the old outcome. New hashes mark older pending candidates `superseded` without removing their audit history. See [`docs/human-gates.md`](docs/human-gates.md) for the complete producer body, decision API, and **Telegram coalescing contract**. Lock-screen diff --git a/tests/test_human_gates_readme.py b/tests/test_human_gates_readme.py index e3feaf4..71acac0 100644 --- a/tests/test_human_gates_readme.py +++ b/tests/test_human_gates_readme.py @@ -11,6 +11,8 @@ def test_readme_documents_hash_bound_producer_intake_and_revision_decisions(): assert '"candidate_hash"' in text assert "expected_revision" in text assert "STACKCHAIN_HUMAN_GATE_DB" in text + assert "principal ID and login" in text + assert "reopens the exact hash" in text def test_readme_defines_privacy_safe_telegram_coalescing_contract():