CC Verifier Sidecar — Observe Pilot and Identity Binding (MC #105472)

Purpose

This page records the independently reviewed WP2 design and correctly attributed live Claude Code Stop-hook pilot. The verifier remains an independent, read-only trust domain. It binds verdicts to an exact MC task and immutable repository revision, rejects ambiguous identity, never executes builder-provided commands, and currently runs in observe mode with enforcement disabled.

Architecture

pi-orchestrator.js injects numeric MC_TASK_ID into each spawned Claude CLI environment and strips stale inherited values.
The Stop hook accepts agreeing explicit hook/env identity or an exact session-owned marker; unsafe global-derived PID fallback is deprecated.
The hook emits cc.verification_requested through the durable event bus.
The existing com.john.event-dispatcher invokes the independent cc-verifier.js handler. No second daemon exists.
Verdict evidence is stored under the task and exact revision in the system evidence tree.
Rollout remains observe; enforcement remains disabled. WP3 gate activation requires separate implementation, exact-SHA review, and rollout approval.

Live pilot evidence

CC Verifier WP2 — Correctly Attributed Live Stop-Hook Pilot

Date: 2026-07-13 Parent MC: #105472 WP2 MC: #105479 Live pilot task: #105501 Superseded non-Claude probe: #105500 (local eval/Ollama; no Stop event; excluded)

Verdict

PASS for WP2 live-pilot handoff DoD. A real orchestrator-spawned Claude Code session inherited the explicit task identity MC_TASK_ID=105501; its installed global Stop hook emitted one post-watermark event for MC #105501 at exact revision ad28aa306350b44d568aa9c75f4502ec04634bfb. The durable dispatcher retried one transient git timeout, completed the event, and persisted a PASS verdict. A deliberate replay reused the same event id and did not create a second event.

This report does not enable WP3 enforcement and does not claim parent MC #105472 complete.

Reviewed remediation integrated before pilot

Exact remediation commit: ad28aa306350b44d568aa9c75f4502ec04634bfb
Independent Proveo verdict: PASS
Proveo report: /Users/makinja/system/evidence/105479/proveo-review-identity-remediation/REPORT.md
Proveo report SHA-256: ddfed7f124480220b260933891be9189a02088c42b58a5261efcb1d4693ed2d7
Canonical syntax/test rerun: verifier suites 36/36 PASS; orchestrator identity suite 4/4 PASS.

Real live-session identity evidence

Orchestrator LaunchAgent was reloaded after canonical integration, PID 20592 for this pilot.
Real Claude CLI process: PID 41787, child of orchestrator PID 20592.
Runtime process-environment probe while Claude was live returned:
- MC_TASK_ID_PRESENT=yes
- MC_TASK_ID_MATCH_105501=yes
Claude session ID: 0bc54f92-2335-4e8c-b2fa-f1e48d7cfda9
Session transcript: /Users/makinja/.claude/projects/-Users-makinja-system--claude-worktrees-codecraft-105501/0bc54f92-2335-4e8c-b2fa-f1e48d7cfda9.jsonl
Transcript SHA-256: 718723ac8926f11ac2c3dd2f64c744e2b2d424794753e948a9cc7c53aebe7a52
Session worktree: /Users/makinja/system/.claude/worktrees/codecraft-105501
Session worktree HEAD: ad28aa306350b44d568aa9c75f4502ec04634bfb
Session worktree status after completion: clean.
Session final report explicitly identified MC #105501, observe mode, disabled enforcement, exact HEAD, syntax PASS, identity tests 4/4, and no edits.

Durable event and telemetry evidence

Event ID: 103785
Event type: cc.verification_requested
Aggregate/task: 105501
Publisher: cc-verifier-stop-hook
Created: 2026-07-13 12:00:11
Processed: 2026-07-13 12:01:18
Status: completed
Retry count: 1
Idempotency key: cc-verify:105501:ad28aa306350b44d568aa9c75f4502ec04634bfb
Payload repository: /Users/makinja/system/.claude/worktrees/codecraft-105501
Payload revision: ad28aa306350b44d568aa9c75f4502ec04634bfb
Stop-hook log source: task_source:"env-mc-task-id"
Stop-hook telemetry outcome: emit_ok, task 105501, event 103785, exact remediation revision.
First handler attempt recorded spawnSync git ETIMEDOUT; the durable retry succeeded and persisted PASS. The completed row retains the prior error_message, so completion is established by status, retry count, final telemetry, and persisted verdict rather than by treating that field as empty.
Final handler telemetry: outcome:"verdict_persisted", verdict:"PASS", task_id:"105501", revision:"ad28aa...", check_count:5, reused:false.

Persisted verdict

Path: /Users/makinja/system/evidence/105501/cc-verifier/ad28aa306350b44d568aa9c75f4502ec04634bfb/verdict.json
SHA-256: 259a800b021cce4cad26d35f5fede71f3460912da41cb0d31e04527b0a4e5a01
Verdict: PASS
Bound task: 105501
Source event: 103785
Bound revision: ad28aa306350b44d568aa9c75f4502ec04634bfb
Verifier identity: cc-verifier-2e313ff0-c936-4fd5-9dfb-1f7817d32630
Checks: checkout integrity plus four Node syntax checks, all PASS.
Combined check evidence SHA-256: bd44841bf28e57aa5cad801a50f8cd7001b65d5b7680c408ba47a536c769c95a

Idempotency proof

The same trusted hook envelope was replayed once with MC_TASK_ID=105501 and the same session/repository/revision.

Matching event count before replay: 1
Matching event count after replay: 1
Reused event ID: 103785
Hook log: duplicate:true, task_source:"env-mc-task-id", same exact revision.

Safety state after pilot

Global verifier Stop-hook registration count: 1
Settings JSON SHA-256: d98f55c455843fc32e6855bbfc362dffebbd689a31a7349e059b965df237600f
Pilot mode: observe
Enforcement: disabled
Activation watermark: 1783936171000
No new daemon/LaunchAgent, no MC ready/done gate changes, no merge/deploy, and no automatic task completion occurred.
MC #105501 being paused by the generic no-file-change quality gate is an orchestration artifact and is separate from the successful Stop-hook handoff evidence.

Adjudication

The earlier misbound event 103707 for unrelated MC #105489 remains quarantined and invalid for acceptance. The accepted live pilot is only event 103785 / verdict task 105501 / exact revision ad28aa306350b44d568aa9c75f4502ec04634bfb.