RegLineage

60-second judge guide · Run the demo · Raw evidence · Architecture

RegLineage makes AI data capabilities revocable. It reads governed DataHub context, issues a narrowly scoped lease, suspends only affected work when that context changes, and requires approved repair plus verified DataHub writeback before a replacement can activate.

question → real result → governance change → targeted suspension → safe fallback → approved repair → DataHub writeback → fresh client-neutral STDIO rerun

Terminal proof

The following abridged transcript is derived from the committed raw 22-step rehearsal evidence, not a narrated mock:

$ uv run --locked python -m reglineage taxi-rehearse ...
[01] LIVE_REPLAYED 2,964,606 checksum-bound January 2024 NYC Taxi rows
[02] 21 governed MCP tools discovered
[04] exact zone-v1 plan approved through a separate taxi-approve CLI/PTY process
[07] aggregate-only zone result released after separate result approval + fresh fence
[08] INJECTED PULocationID governance change: borough_only
[09] zone-v1: ACTIVE -> PENDING_REVALIDATION -> SUSPENDED
[10] overall-v1: ACTIVE; separately approved fallback released
[13] borough-v2 physical candidate: QUARANTINED; validation PASS
[16] DataHub manifest published and freshly read back with exact hashes
[17] borough-v2 replacement ACTIVE; zone-v1 SUPERSEDED
[18] fresh official-SDK STDIO process discovers overall-v1 + borough-v2
[22] separately approved borough aggregate released; exact restoration receipt recorded

This evidence is LOCAL_LIVE_REPLAY of historical vendor-supplied records with network_used=false. The repaired-client path is CLIENT_NEUTRAL_STDIO_PROTOCOL_TEST: actual Claude Code and Codex tool invocation remains NOT_RUN. Approval prompts were exercised through separate durable CLI processes but typed automatically; authenticated or actual human participation is not claimed.

What the control loop proves

1. A registered analysis binds its tool/version, purpose, jurisdiction, datasets, fields, operations, transformations, constraints, policy, permission, metadata, lineage, source watermark, approvals, expiry, and client attribution into an immutable lease.
2. A complete-snapshot DataHub poll detects a relevant PULocationID policy change and computes exact field, tool, lease, and downstream-lineage impact.
3. Only the intersecting zone capability fails closed. The unrelated overall-revenue capability stays active.
4. A fixed borough-repair recipe waits for exact repair approval, creates a physical candidate, and keeps it quarantined through database validation.
5. Separate publication approval precedes DataHub Dataset, Flow, Job, fine-grained lineage, and Context Document publication. Fresh semantic readback—not caller-provided hashes—must match.
6. Only then does borough-v2 activate, zone-v1 become terminally SUPERSEDED, and a fresh STDIO client inherit the durable repaired context.

There is no arbitrary SQL, generic mutation tool, MCP self-approval, or autonomous LLM loop. Raw rows, direct identifiers, suppressed values, secrets, credentials, and reviewer overrides are denied at egress.

Run the judge demo

Requires Python >=3.11,<3.12, uv, about 125 MB for the pinned source plus derived verified cache, and temporary runtime space. First prepare the reusable cache:

uv sync --locked
DEMO_CACHE="$(pwd)/var/demo-cache"
DEMO_PREP="$(mktemp -d "${TMPDIR:-/tmp}/reglineage-prep.XXXXXX")"
uv run --locked python -m reglineage demo \
  --cache-dir "$DEMO_CACHE" \
  --work-dir "$DEMO_PREP" \
  --evidence "$DEMO_PREP/rehearsal.json" \
  --prepare-only --no-color

Then launch a fresh offline proof and capture the console at the printed http://127.0.0.1:8000/?demo=1 URL:

DEMO_RUN="$(mktemp -d "${TMPDIR:-/tmp}/reglineage-demo.XXXXXX")"
uv run --locked python -m reglineage demo \
  --cache-dir "$DEMO_CACHE" \
  --work-dir "$DEMO_RUN" \
  --evidence "$DEMO_RUN/rehearsal.json" \
  --host 127.0.0.1 --port 8000 --offline --no-color

The console runs after step 22 on the exact open rehearsal identity and before exact restoration. Press Enter when capture is complete; the server stops, governance restores, and the evidence persists. Do not reopen the post-exit runtime as a substitute for the restricted-state capture. The complete setup, recording, recovery, and truth boundaries are in the UI demo runbook.

Project-scoped Claude Code and Codex configuration examples remain in examples/mcp_runtime. They are setup examples, not evidence that either named client invoked a tool.

To reproduce the deterministic Agent 6 benchmark twice and require a matching functional hash:

benchmark_tmp="$(mktemp -d)"
uv run --locked python scripts/benchmark_north_star.py \
  --output "${benchmark_tmp}/run1.json" \
  --report "${benchmark_tmp}/run1.md"
uv run --locked python scripts/benchmark_north_star.py \
  --compare-output "${benchmark_tmp}/run1.json" \
  --output evidence/north-star/agent-06-benchmark.json \
  --report docs/benchmark/north-star-benchmark.md

Data, truth labels, and evidence modes

Evidence	Observed scope	Truth label	Evidence mode
January 2024 Yellow Taxi Parquet	49,961,641 bytes; SHA-256 c4d59da7bbc8abaeeeb1727947ee93d9891a71acb42854bd80db1571b2030510; 2,964,606 selected trip rows	HISTORICAL source; LIVE_REPLAYED emissions	LOCAL_LIVE_REPLAY
NYC Taxi zone lookup	12,331 bytes; SHA-256 1a99e105092230f8620f301edcca7f80d3080642ff404d28ed957d3fa222c8ed; 265 rows	HISTORICAL	LOCAL_LIVE_REPLAY
Governance restriction	Deliberate in-process PULocationID borough-only mutation with external-datahub-admin actor attribution	INJECTED	INJECTED_GOVERNANCE_EVENT
Full terminal rehearsal	Strict durable local DataHub adapter; no network during replay	HISTORICAL, LIVE_REPLAYED, INJECTED, and OBSERVED as applicable	LOCAL_LIVE_REPLAY
Three focused SDK/GMS checks	Local DataHub GMS 1.5.0.6 native-aspect and publication/readback tests	OBSERVED	LIVE_DATAHUB
Thirty enforcement timing roots	Local in-memory governance gateway plus durable poll/observation and capability stores; no network	INJECTED scenario; OBSERVED timing/outcome	LOCAL_RUNTIME_TIMING
Five benchmark repair repetitions	5/5 complete repairs on the committed 35-trip/7-lookup provenance fixture	HISTORICAL source, LIVE_REPLAYED emissions, INJECTED event	OFFLINE_REAL_FIXTURE
Fresh repaired clients	Two official Python MCP SDK STDIO processes on each of five repaired roots	OBSERVED	CLIENT_NEUTRAL_STDIO_PROTOCOL_TEST

TLC says trip data is supplied by technology providers. Checksums prove the bytes used, not the factual accuracy or completeness of provider-submitted records. Historical replay is not current traffic; complete-snapshot polling is not CDC.

Architecture

Claude/Codex/other MCP host (conversation only)
                 |
                 v
21 closed RegLineage MCP tools -- requests/status only; no approval authority
                 |
                 v
registered plan -> scoped lease -> SOURCE_OPEN -> fixed aggregate -> sealed result
                                      |                                  |
                     DataHub polling + deterministic impact      separate result approval
                                      |                                  |
                         affected lease only fails closed <- fresh release fence
                                      |
                                      v
fixed ContextPatch repair -> separate repair approval -> quarantined candidate
                                      |
                         database validation -> separate publication approval
                                      |
                 DataHub write + fresh semantic readback -> replacement lease

DataHub is the durable institutional-memory boundary: seven native governance aspects, the published Dataset/Flow/Jobs, graph and fine-grained lineage, five Context Documents, and exact repair/decision bindings. SQLite provides local process-safe evidence and fencing for this deadline slice; no distributed-consensus claim is made.

Measured adversarial gate

The committed raw benchmark and generated report passed at candidate fdff02727844f63e911a42ffa061c550d14602a7:

• 24/24 unique affected/control cases, 30/30 event-to-enforcement runs, and 5/5 complete fixture repairs;
• zero violations for all 12 release targets, including false allows, unrelated suspensions, unapproved actions, premature activation, approval reuse, leakage, and protocol hash mismatch;
• 30 deliberately attempted affected source reads denied after suspension;
• identical two-run functional hash 96ad6de21a709147b81f704cb8641740f34bdf1b1f8b63b55c4ef8e25d93095e;
• exact manifest/readback equality for 13 entities, five memberships, 11 dataset-lineage edges, 20 field-lineage mappings, and five Context Documents in every repair.

Local timing	Median ms	Nearest-rank p95 ms	Max ms
Event to detection	2.763146	3.143666	3.145458
Detection to suspension	0.834667	0.915583	0.964959
Suspension to denial	0.676292	0.715459	0.743250
Event to enforcement	4.277729	4.672041	4.729583

These timings cover local complete-snapshot polling through the in-memory monitoring gateway, durable observation, runtime suspension, and the next denied SOURCE_OPEN; they exclude network and are not a production SLA. The five repair repetitions use the strict local adapter and OFFLINE_REAL_FIXTURE. Separately, Agent 5's focused LIVE_DATAHUB evidence is 3/3 local-GMS tests, and its full LOCAL_LIVE_REPLAY artifact covers 2,964,606 historical trip rows.

Evidence status

• Integrated rehearsal: PASS, 22/22 steps; 2,964,606 historical trip rows; exact outer restoration.
• One-command UI proof: PASS, 22/22 steps; HTTP root/status/console 200; exact restoration and evidence persistence.
• Local DataHub GMS verification: 3/3 passed for settings propagation, native drift/CAS conflict, and exact publication/readback.
• Adversarial benchmark: PASS, 24/24 cases, 30/30 timing runs, 5/5 repairs, functional determinism PASS, and all 12 zero-violation targets met.

The live badge above is the current CI status. Reports under docs/implementation/ preserve build-time decisions and are historical, not current release status. The benchmark's raw JSON is the source of its generated Markdown.

Governance foundations retained

The earlier California fitness-retention workflow remains tested and available as a legacy deterministic example. It still demonstrates purpose-bound ACCESS/COMPUTE/MODEL_CONTEXT/DESCRIBE/PUBLISH decisions, separate plan/result approvals, field minimization, tokenization, cohort suppression, strict publication/readback, and a cautious synthetic Insight Brief. Its 78.3% versus 20.0% synthetic comparison is not the North-Star headline and is not evidence about NYC Taxi or current users.

That legacy path turns one registered California retention question into an Insight Brief under a current governed use contract. RegLineage owns the registered template; its applicable-context check is bounded to the registered demo corpus. When separately configured, an optional model can return only typed navigation directives that the deterministic service validates; it cannot authorize, access rows, approve, execute, publish, or mutate DataHub.

• Current NYC Taxi UI demo runbook
• Superseded legacy browser demo runbook
• Architecture and trust boundaries
• North-Star implementation reports
• Submission draft and evidence checklist

Limits

RegLineage does not claim legal compliance, legal advice, authenticated identity, current traffic, production CDC, autonomous approval, unrestricted autonomy, or self-healing. The local DataHub adapter uses optimistic compare-read-write-read conflict detection because DataHub has no single atomic transaction across all native aspects, graph edges, documents, and the capability database.