[nomed]

Summary

Executes the real #81 OV-4 memory profile on the pinned OpenViking revision 234a2d9fe778a9512fd7ebe9807198e847c647ec after the OV-4A public-seam preflight (#82).

This is the first Track C2 slice that exercises the actual public session-memory pipeline end to end:

create_session(memory_policy) → add_message → commit → SessionCompressorV3 memory extraction → persisted memory → fresh host/process read → server restart → fresh host/process read → provider outage.

Bounded inference profile

The candidate is not patched and no private extractor/storage API is used.

OpenViking is configured through its documented OpenAI-compatible public model seams for both:

• VLM / memory extraction;
• dense embedding.

A loopback-only deterministic OpenAI-compatible qualification provider is bound to 127.0.0.1:21935. It returns a valid preferences operation for the synthetic HTTP/JSON memory and deterministic 4-dimensional embeddings. External provider credentials are blank and all model endpoints are loopback.

This lets us test the production public pipeline without cloud credentials, uncontrolled external egress or direct MemoryUpdater/DB mutation.

Gates exercised

• OV-4A: public session-memory seam is actually invoked, not simulated by direct content writes.
• OV-4B: host A commits the memory; host B is a separate Python process and fresh SDK client and reuses the persisted provider memory.
• OV-4C: remembered HTTP/JSON intentionally conflicts with an external accepted Yukh fact gRPC/protobuf; the evidence model keeps them separately classified and never promotes memory to accepted state/evidence truth.
• OV-4D: OpenViking is stopped and restarted against the same local storage before host B reads the memory.
• OV-4E: OpenViking is then stopped; the external accepted fact remains independently available/correct while provider context is unavailable.

Fail-closed evidence

The verifier requires:

• distinct host process IDs;
• completed commit task;
• a persisted viking://.../memories/... provider URI;
• identical memory digest across host replacement + server restart;
• explicit remembered-vs-accepted conflict;
• memory_is_accepted_state=false and memory_is_evidence_truth=false;
• accepted fact authority external to OpenViking;
• provider outage observed while accepted fact remains available;
• at least one bounded /chat/completions and /embeddings call through the loopback model provider;
• no external model endpoint in the qualified profile.

A green run is an OV-4 PASS only. It authorizes OV-5 visibility/revocation; it does not yet conclude OPENVIKING_ALONE.

Related: #81, #63, #77, #80, #82.

[nomed]

BLOCKER — evidence claim is stronger than what the harness proves.

The executable OV-4 semantics themselves look solid on this head: public session→commit pipeline is used, the memory is persisted, host A/B are separate processes, restart persistence is demonstrated, the remembered-vs-accepted authority boundary stays external to OpenViking, and the outage probe is now a real public remote request. Run #4 32887486547 is green end-to-end.

One evidence claim must be fixed before merge: the report currently emits external_egress_observed=false with basis all configured model/embedding endpoints are loopback; production provider credentials are blank. That does not constitute observation of all process egress. It proves only that the qualified model/inference path is loopback-only and no production provider credentials were supplied. OpenViking or one of its libraries could still perform unrelated telemetry/network traffic and this harness does not instrument sockets/network namespaces to exclude that.

Please either:

1. rename/narrow the evidence to something actually proven, e.g. external_model_egress_configured=false / model_egress_basis=loopback-only configured VLM+embedding endpoints and blank production credentials, and make the verifier require that narrower statement; or
2. add real runtime egress observation/enforcement if we want to retain the broader external_egress_observed=false claim.

I recommend option 1 for OV-4; full network isolation is not necessary to qualify memory semantics and would add complexity without changing the candidate verdict.

No other blocker found in the current diff. This is an evidence-precision fix, not a semantic OV-4 failure. After this is corrected and CI remains green, I expect the PR to be READY TO MERGE.

[nomed]

PASS — READY TO MERGE

Re-review on current head 9bfa7de107fdb178f099b51c588d2e531385e7fd after blocker review 5024475999.

The evidence claim is now correctly scoped: the report no longer asserts external_egress_observed=false. It records external_model_egress_configured=false, with the precise basis that all configured VLM/embedding endpoints are loopback and production provider credentials are blank, while explicitly stating that general process egress was not instrumented or observed. The verifier also fails if the old stronger claim reappears.

All current-head workflows are green, including OV-4 executable run #6 33120600445, OV-4 preflight, OV-2/OV-3, base OpenViking qualification and Pages.

The OV-4 executable evidence remains valid: public session→commit→memory extraction, persisted canonical memory URI, separate host processes/fresh clients, server restart persistence, remembered-vs-accepted authority separation, bounded loopback model traffic, and real API outage correctness all remain enforced fail-closed.

No remaining blocker found. This is an OV-4 PASS only and authorizes OV-5 visibility/revocation; it does not yet establish OPENVIKING_ALONE.