Execute detection source mutation replay across seven repositories

[raylee-hawkins]

Objective / new capability. Extends the existing command-center lifecycle to execute and replay validation-owned detection quality through platform and Hoxline, with the concise reviewer result in the GitHub job summary. The existing immutable seven-source manifest selects the reviewed integration set.

System role / why this matters. Canonical seven-repository orchestration and reviewer routing. No second orchestration system or duplicated metric authority is added. The fixed workflow-body contract and expected check list include the two new execution/replay commands. Proof remains unchanged at 77b7874dd753369792330508fa3438cf397cd050. Website artifact a5330385c479cad29a7f892b5388c7426452faaa is selected; Website PR head 306ea85390a95fc83afc05d464840d80a089a67e adds only the workflow pin back to this organization head.

Files changed (4).

• .github/workflows/command-center-invariants.yml
• README.md
• governance/CONVERGENCE_SOURCE_MANIFEST.json
• scripts/verify-command-center-invariants.py

Dependencies / topology. Stacked draft on existing .github #58, branch feature/hoxline-case-growth-convergence-v1; reviewed base branch was not edited. Coordinates detection #48, validation #72, platform #88, Hoxline #27 and Website #84, plus unchanged proof #87. Website's reviewed artifact and workflow-only packaging head are deliberately distinct to avoid a circular commit pin. Existing presentation PR #59 remains separate and unchanged.

Validation commands. Run from this repository with the scoped sibling checkouts at the reviewed revisions and documented dependencies installed.

python -B scripts/verify-command-center-invariants.py --self-test
python -B -m unittest discover -s tests
# The existing command-center-invariants workflow executes the complete pinned source set.

Local validation. 33 command-center tests passed. Final seven-source run passed detection 81, validation 163, proof 83, platform 225, Hoxline 93 unittest tests and 244 pytest tests (existing skips retained), source quality replay, case-growth/batch replay and Website hostile checks/typecheck/static build.

Current-head CI. Head e523bd1ccec1ece01a305d36908c6c966c249c41. Final seven-repository run 34040757187 completed SUCCESS at e523bd1. Both command-center-invariants and seven-repository-convergence passed; sanitized convergence records were uploaded. The existing main-drift-only step is skipped for this PR event.

Measurable and hostile results. The integrated controlled corpus covers HO-DET-001/009/010/011/012/013: 69 events, 33 positive and 36 negative. Before source repair: TP 30, TN 30, FP 6, FN 3. After repair: TP 33, TN 36, FP 0, FN 0; precision/recall/F1 1.0, false-positive rate 0.0. Real source mutants: 205 generated, 165 killed, 40 survived, 0 errors; mutation score 0.804878. Survivors remain visible. Actual Hoxline CLI replay blocked 20/20 tampered reports, including 8 authority-boundary edits and 3 AI-focused edits; recomputed checksums did not bypass fresh owner execution.

Windows and AI authority. Validation run 34038177088 passed hosted Windows Server 2025 and Ubuntu source-predicate execution and deterministic replay. This is offline controlled fixture execution, not endpoint or SIEM backend execution. AI authored candidate engineering changes and tests; it cannot change ground truth, authorize disposition, close cases, approve evidence or promote proof. Controlled auto-close was not implemented.

Proof boundary and scans. CONTROLLED_TEST_VALIDATED predicate/corpus result; NOT_PUBLIC_SAFE; human review required. No new proof record, ProofCard, runtime signal, real case closure, production performance or public-safe promotion is established. Changed-content scan found no unexplained credential, private-address, operator-path or employer-data exposure. Six path-pattern hits were escaped generic tool-name unit fixtures, not private paths. Claim wording was checked against these limits; adversarial vocabulary remains as test inputs.

Human review order and rollback. Review the existing convergence bases first, then detection #48 and validation #72 together, platform #88, Hoxline #27, and organization #60 / Website #84 as a paired integration. Proof #87 supplies unchanged proof authority. Existing presentation branches remain separate. With drafts unmerged, withholding integration is the rollback; any later revert must be a reviewed scoped change that restores owner/consumer pins together.

Merge gate. Green CI is not approval. AI review is not human approval. No merge is authorized. Visible eligible human GitHub review and human-supplied MERGE_APPROVED remain required. Current readiness: NEEDS_HUMAN_REVIEW.