[MaxGhenis]

Lets any team member or agent session build, sign and assemble a Microcosm UK national cut, and open its policyengine.py certification, without the one machine that held the key and some of the inputs. Every input is fetched by the pins the build already enforces. Draft until the independent review agrees.

What's in it

1. Signing-key registry (microcosm.data.gate_signing_keys).
   • The gap. UK gate reports are HMAC-SHA256 signed, and every verifier trusted whichever key was in MICROCOSM_UK_TERMINAL_GATE_SIGNING_KEY.
   • Verification. The publisher's schema-4 checks (battery report, release-cut certification, dense report) now accept only a registered active or retired key.
   • Signing. Every UK signer requires an active one: the gate battery, the certifier, the scoped re-signer and the local preflight.
   • The national role checks its key before loading any input; a missing key used to fail only after the solve (runbook F8).
   • The registry holds one key per builder. HMAC verification needs the signer's secret, so a cut is signed, certified and published by one key holder.
   • Continuity. It starts with the key that signed every cut on record, 66bf0e29…. The team key dd31e325… is registered separately in Register a team UK gate signing key (hold: needs María's agreement) #1350, held for María's agreement.
   • CLI. python -m microcosm.data.gate_signing_keys {check,list,generate}.
2. tools/run_uk_cut.py: one resumable command. fetch → preflight → spine → national (dry run first) → score (only if the in-build evaluation did not pass) → certify → stage-1 (diagnostic) → assemble → publish preflight → publish (opt-in).
   • Done-checks read the exact fields the tools write (build record, score receipt, certification, assembly summary), so re-running resumes.
   • Never destructive. It never rebuilds over a spine, overwrites a calibration run (it moves one aside only with --retry-national) or re-assembles a release.
   • Inspection only. --publish is always --no-latest --tag-only, so main's files and latest-*.json never move (runbook Q12, F14).
   • From main. It builds only from origin/main, unless --allow-off-main "<who agreed>".
3. tools/uk_cut_inputs.json says only where each input lives. Digests come from source_stages.json, frs_release.json, chronicle_feed.json, gates.json and the mass-reference pin.
   • Verified here on 10/22:
     • FRS, SPI, WAS and ETB come byte-exact from the gated zips in policyengine-uk-data-private (all 18 tabs match their pins).
     • The HMRC ODS comes from gov.uk.
     • The incumbent eFRS comes from HF.
     • The input-mass reference comes from the new private policyengine/microcosm-uk-build-inputs. It was reproduced byte-for-byte to fd41cb5f… at microcosm 0eac9bbbd with policyengine-uk 2.89.0; today's engine emits 2 more columns, and the shared 131 totals are identical.
   • Pending:
     • NTS 2002-2024 and LCFS 2024-25 need a one-time upload by a UKDS licence holder (exact commands in the doc).
     • The Chronicle UK artifact is being rebuilt on Modal.
4. tools/modal_rebuild_uk_chronicle_artifact.py rebuilds the pinned Chronicle UK artifact from the public repo, which needs no R2 credentials. It hosts the artifact privately only if both digests reproduce; otherwise it uploads diagnostics.
5. tools/certify_uk_cut_in_policyengine_py.py: the policyengine.py certification handoff, as Net-new UK stages: UC deduction attributes, bus fares, WAS debt #685 did it by hand.
   • Checks first: one writer per cut, and a regional-route pre-check.
   • Then: certify-data, the lock, TROs, policyengine.py's own constant rewrite, snapshots, the strict check, the UC floor and the tests.
   • PR body. It drafts the PR with every judgment call as a checklist.
   • Accepted mismatch. For an accepted regional mismatch (Allow a UK local-area release on an accepted model mismatch (hold: needs María's routing call) policyengine.py#699) it measures what area runs lose and refuses dropped columns.
6. docs/uk-cut-anyone.md documents all of this, plus key rotation and revocation and the regional routes, with a recommendation.

Regions (runbook Q13, María's call)

• The blocker. The only dense cut is on 2.132.6, so policyengine.py refuses to keep area routing for a national cut on a newer policyengine-uk.
• Measured cost of keeping it anyway (2.132.6 dense under 2.146.4):
  • no column is dropped on load;
  • PIP categories still load (they became formulas in 2.144.0, and stored values win);
  • 13 inputs default in area runs, including salary_sacrifice_returned_to_income and local_bus_uncapped_single_fare;
  • national figures are unaffected.
• Recommendation:
  • an accepted, recorded mismatch (policyengine.py#699) for the Sat/Mon re-cuts;
  • a dense cut on the final version for the Budget pair, if it can be started by Monday; otherwise the accepted mismatch.

Invariants (tested)

• Signing key:
  • An unregistered key never signs or verifies.
  • A registered key verifies only itself.
  • Active signs and verifies, retired only verifies, revoked does neither (Hypothesis).
  • A report signed under an active key passes the publisher's dense check, still passes once retired, and fails once revoked or unregistered (round trip).
  • The key behind every cut on record stays registered.
• Fetch:
  • A file whose bytes miss its pin is never installed, and no partial file is left behind (Hypothesis).
  • A second fetch downloads nothing.
  • A corrupted installed file is replaced, never trusted.
  • Archive digests are checked when pinned.
• Runner:
  • Each step runs once, and a second all runs nothing.
  • A failed step stops the run, and a rerun resumes at it without repeating finished steps.
  • A half-built spine is never rebuilt over.
  • A retried national run keeps the failed attempt.
  • A candidate that loses the incumbent score is never certified.
  • Every argv is accepted by its tool's own parser, or uses only flags its --help declares.
  • Publication is inspection-only for any tag.
• Pins. The runner's pins are the build's pins (lockstep with chronicle_feed.json, frs_release.json, gates.json and source_stages.json).
• Handoff:
  • Only cut tags are certified, never @main.
  • The constant rewrite touches quoted literals only, and is invertible.
  • The input-surface change is exact set algebra (Hypothesis).

Local results

• New tests: registry 17 (microcosm-data) + 15 (microcosm-build), runner 27, handoff 13 (+3 properties), all passing.
• Full engine-free suite (4 workers): 20,243 passed, 6 failed.
  • 1 was mine: the retired-package reference guard. It is fixed by allowlisting the inputs manifest and the doc, both of which name the gated input repo, as frs_release.json does.
  • 5 are environmental. 4 Orrery parser tests need the Orrery contract's node modules, which this checkout doesn't have installed, and 1 asserts the UK engine is absent, but this venv has the uk extra.

axiom: n/a: build infrastructure (no policy encoding)

🤖 Generated with Claude Code