Anchor the witnessed journal in Bitcoin from main: OTS proofs, tool, and daily job (supersedes #182, #183)

[MaxGhenis]

Summary

Anchors the witnessed observation journal in Bitcoin from the trusted branch. Supersedes #182 and #183 after their Fable+Sol gate rounds (findings recorded on both PRs): the bot cannot publish to the journal branch (its required checks never run for token pushes), the old job executed mutable-branch code with a write credential, verified after pushing, and could publish a stale tree after a rebase; the tool trusted substrings of CLI output, deleted .bak files before checking results, and did not guard symlinks.

Design. Everything trusted lives on main: scripts/ots_anchor.py, its tests, .github/workflows/ots-anchor.yml, ots/README.md, and the proofs ots/<stem>.json.ots. The job checks out the journal branch credential-free into a separate path purely as manifest input (--manifests), runs main's pinned script, verifies the whole tree, runs a scope guard (only ots/ may change), and publishes proof-only commits. It never pushes the journal branch.

Proofs. The fifteen proofs from #182 are carried over upgraded in place from a networked session: each now carries BitcoinBlockHeaderAttestation entries on disk (the #182 files only held pending calendar attestations; ots verify had been resolving the upgrade in memory). The five manifests appended since 19 August (0015–0019) are stamped and pending. All twenty bind to their manifest bytes; status reports 15 stored Bitcoin attestations.

Tool hardening (Sol's #182 findings). Local proof state is read from ots info with full-line patterns rather than substrings; Bitcoin-complete proofs are re-verified for binding on every run; failed or timed-out upgrades restore the original from .bak; symlinked proof directories or paths are refused; guard refuses any changed path outside ots/; --manifests reads an external checkout.

Open items before merge (a follow-up lane is on them):

1. Publication path. The lane, working without network, could not read main's rules and built a bot-branch + auto-merge path; main in fact has no required checks, no rulesets, and default_workflow_permissions: write, while allow_auto_merge is off. The job will push proof-only commits to main directly (bounded fetch, rebase, re-run, re-verify loop) and drop the pull-request machinery.
2. Pending-proof classification. With real 0.7.2 output for a multi-calendar pending proof, status/verify report unrecognized; the verbatim output contract is captured and the patterns will be fixed with fixtures taken from it.

Chronicle Governance

No source-data boundary change: no source packages, facts, or schemas. Proof files and a workflow on main; nothing under releases/ or ledger/ on any branch.

Tests

tests/test_ots_anchor.py (15): stamping, idempotence and upgrades, filename/digest contradiction, missing and mismatched proofs, --manifests, guard scope, re-verification of complete proofs, resistance to calendar-output spoofing, backup restoration on failed/timed-out upgrades, symlinked directory refusal. Lane-verified against the real journal checkout; carried proofs match #182 byte-for-byte before the upgrade commit.

Authored by a Sol lane (no network); proofs upgraded and stamped, branch pushed and PR opened from the dispatching session.

🤖 Generated with Claude Code