The Auditability Floor — a measured, CI-pinned audit guarantee¶
Milestone 21 (spec 0137). The audit analogue of the Faithfulness Floor: a standing number that can fail.
Trust bundles (BUNDLE.md) let a stranger re-check an answer or action offline by re-executing its verification. This page is the proof that the mechanism itself holds — regenerated and byte-pinned on every commit, so a regression turns the build red instead of quietly eroding the guarantee.
Two floors, both 100%, both able to fail:
- Re-derivation equality. Every gold case of all three committed
batteries is emitted as a bundle and verified in a separate
interpreter — the strongest form of "a stranger runs
tessera verifyoffline." All must verify PASS. - Mutation detection. A deterministic tamper battery
(
tessera/bundle/mutations.py) over a representative answer bundle and a representative action bundle. Each mutant must produce the correct verdict class and a report that names the broken claim or link. Where re-sealing is the realistic attack (a content edit whose hashes are recomputed), the mutant is re-sealed, so the battery exercises the semantic layer, not merely the hash.
Re-derivation equality — every committed gold case, emitted as a bundle and verified in a separate interpreter, verifies PASS:
| battery | gold cases | re-derived PASS |
|---|---|---|
| business | 11 | 11 |
| devex | 9 | 9 |
| github_actions | 5 | 5 |
| total | 25 | 25 |
Floor (100%): holds.
Mutation detection — each deliberate tamper produces the correct verdict class and a report that names the broken claim or link:
| mutation | expected | observed | cause named |
|---|---|---|---|
| evidence_value_edit | FAIL (2) | FAIL (2) | yes |
| evidence_record_omission | FAIL (2) | FAIL (2) | yes |
| claim_text_edit | FAIL (2) | FAIL (2) | yes |
| verdict_flip | FAIL (2) | FAIL (2) | yes |
| question_swap | FAIL (2) | FAIL (2) | yes |
| fabricated_render | FAIL (2) | FAIL (2) | yes |
| closure_kind_downgrade | FAIL (2) | FAIL (2) | yes |
| leaf_tamper | TAMPERED (4) | TAMPERED (4) | yes |
| root_mismatch | TAMPERED (4) | TAMPERED (4) | yes |
| engine_version_spoof | DEGRADED (3) | DEGRADED (3) | yes |
| extra_top_section | TAMPERED (4) | TAMPERED (4) | yes |
| wire_body_injection | FAIL (2) | FAIL (2) | yes |
| wire_method_repoint | FAIL (2) | FAIL (2) | yes |
| wire_slot_edit | FAIL (2) | FAIL (2) | yes |
| outcome_forgery | FAIL (2) | FAIL (2) | yes |
| approval_strip | FAIL (2) | FAIL (2) | yes |
Floor (100%): 16/16 detected — holds.
What each floor does and does not prove¶
The equality floor proves the round trip is lossless and deterministic: a bundle emitted here re-derives to the same PASS verdict on a clean, separate interpreter — the offline-stranger guarantee, measured. The mutation floor proves the verifier's teeth: every class of tamper we know how to write is caught in the right layer with a named cause, so a silent false PASS would fail this build. Both are scoped to the committed corpora; neither is a claim about arbitrary external data (that boundary is the honest limit stated in BUNDLE.md).
The signature-tamper class needs the optional sign extra and so is not in
this environment-independent block; it is pinned separately by
tests/test_bundle_signing.py::test_reseal_breaks_the_signature.
Reproduce¶
$ uv run tessera-auditability # summary; exits non-zero if a floor slips
$ uv run tessera-auditability --markdown # the exact block pinned above
The block above is regenerated by a test on every run; if it drifts from a fresh computation the build fails, so the numbers here are always current.