[engine-accuracy] senderTrust provenance: split corroborators by write authority (stop model-authored history laundering into the anchor)

[k08200]

Raised in the dev.to thread (post #5) — the sharpest attack anyone's surfaced on the corroborator design. Relates to #678 (world-anchored gate), #655 (EPIC).

The attack — self-authorship laundered through the ledger.
senderTrust grounded on observed sender history looks world-anchored at read time, but the dangerous question is what gets to write that history. If a sender's record improves because earlier messages were accepted by this same classifier, the model is already in the provenance chain — the history table looks external later, yet it contains delayed model opinion. The attack doesn't need to beat the gate on payload day: it can spend weeks sending cooperative-looking mail the model rates highly, turning those accepts into a clean sender record. When the real payload lands, senderTrust is genuinely high in the table, and the gate approves on a feature the model effectively helped author.

Where it stands today (partial):
Sender priors are already typed by source — override (manual user correction, human-authored) vs history (the model's own past classifications). History is deliberately weaker: it may only short-circuit to QUEUE (never PUSH), and SILENT is excluded from both. So the write-authority instinct exists at the prior-kind level.

The gap:

• The senderTrust feature still leans on facts (tier distribution) the model helped write; no per-entry provenance class feeds the score.
• Events the classifier cannot cause — a sent reply, a manual approval recorded outside the classifier path — should be a strictly stronger anchor than "the model rated this sender highly for three weeks." They aren't weighted that way.
• Each history entry should carry a provenance class so the gate can treat model-adjacent history as thin even when the aggregate looks healthy.
• Trace attestation: have the component that sourced each corroborator sign or content-address its value when it lands in the decision trace, so post-incident review has a check outside the host process's own log.

"Sort by write authority, not only by read source."

[k08200]

Follow-up from the thread (dipankar_sarkar + anp2network) — sharper framing and a code-grounded correction.

The "taint" framing (dipankar): a feature is world-anchored only if its entire write path is model-free, not just its read at decision time. Color every gate feature by the transitive closure of its inputs; if the model appears anywhere in that closure (even through the ledger), it's context, not authorization. anp2network's refinement: the closure runs forever unless you define a small root set whose model-freeness is enforced by capability separation — then "clean" means the closure bottoms out only in those roots.

Correction to the mechanism, verified against HEAD. The comment framed the loop as "an AUTO action (auto-file/auto-reply/auto-archive) mutating the stats." Klorn's AUTO is classify-only — there are no auto-file/reply/archive actions. The loop is more direct and more pervasive than that: it closes through the classification write itself. Every judged email (any tier) persists judgement.tier → AttentionItem.tier (attention-mirror.ts:841,860), and buildJudgeContext reads those same rows back as this sender's history (judge-context.ts:161,201-213). So:

• buildPrior history branch counts all rows regardless of authorship (judge-context.ts:161) → a history prior can be built purely from the model's own past classifications → short-circuits the LLM to QUEUE.
• buildTierHistory grounds the LLM-scored senderTrust on the same rows (judge-context.ts:201-213, prompt at poc-judge.ts:479).

The loop is real but bounded, precisely: history priors are QUEUE-only, never PUSH (sender-policy.ts:111); SILENT is excluded from both; AUTO is never reachable by any prior — AUTO comes only from the feature vector through tierFromFeatures. And senderTrust is LLM-advisory grounding, not a deterministic gate feature. So the model→history→prior loop can auto-QUEUE a sender but cannot auto-AUTO one.

Concrete gaps this leaves (filed):

• No per-entry provenance column — authorship is inferred from a tierReason string prefix (isManualOverrideReason, tiers.ts:51). The model writes that same field unsanitized, so it can mint the stronger override class → [engine-accuracy] Sender-prior provenance is a mutable string prefix — the model can mint the human-only "override" class #722.
• Reusable authorship already exists off-path: DecisionLabel.decidedBy records fast-path|sender-prior|llm|keyword-fallback (decision-label.ts:98) but the gate doesn't read it. That's the root-set signal to wire in.

"Sort by write authority, prove the classifier's output never feeds back into the anchor" is the invariant. Tracking the split here (#712) and the minting gap in #722.