12 — AgentData KB canonicalization + readback + hash proof (macro §3.1)

Evidence SSOT = AgentData KB. All 31 package files uploaded to the KB, read back, and byte-exact hash-verified against local staging.

Method (byte-faithful, no model re-typing)

The MCP content parameter would force content through the model context (proven to drift — a manual re-type of runA corrupted single→double quotes, content_length 182≠169). Instead:

• Upload via curl JSON-RPC tools/call → upload_document with content supplied by jq -n --rawfile reading the exact file bytes (no transcription).
• Readback via curl JSON-RPC tools/call → batch_read {full:true}; extract the stored content with a Python json.loads(strict=False) extractor (the KB wrapper emits literal newlines that break jq) and sha256(content).
• Compare KB-side sha256 to local shasum -a 256.
• Endpoint: https://vps.incomexsaigoncorp.vn/api/mcp (X-API-Key from .env.local, never echoed). Method validated on runA: local 4419de57… == KB 4419de57… ✓.

Result

• KB path: knowledge/dev/laws-new/reports/c1-lego-dryrun-plan-hardening-no-prod-write/
• files uploaded: 31 · read back: 31 · local==KB sha256: 31 / 31 · MISMATCH: 0 · missing: 0
• Independent corroboration: list_documents at the prefix returns count = 31, next_offset = null.

Full manifest (status · bytes · sha256:16 · path)

MATCH      4302  c3e7e431aedba2af  00-index-…-2026-06-22.md
MATCH      4983  fbda3c06317dcdfd  00a-SSOT-source-of-truth-classification-2026-06-22.md
MATCH      4482  51559392030c5c1e  01-current-state-and-source-readback-2026-06-22.md
MATCH      5913  8f37894b7148bb58  02-registrar-path-normalization-defect-and-mitigation-proof-2026-06-22.md
MATCH      3800  f6005de4933027c2  03-targeted-registration-dot-approved-proof-2026-06-22.md
MATCH      3419  764d3e5835874262  04-contract-register-path-proof-2026-06-22.md
MATCH      4611  167fada60994cc55  05-c1-endpoint-no-mutation-deploy-path-proof-2026-06-22.md
MATCH      2978  e53b232dc3cea164  06-grant-ownership-issuer-path-proof-2026-06-22.md
MATCH      3651  f628f7adc678bbf5  07-dot-c1-lifecycle-birth-governance-ledger-proof-2026-06-22.md
MATCH      4890  f4867f04800791a3  08-staged-artifacts-kb-readback-hash-proof-2026-06-22.md
MATCH      9193  a7dcd58aa1d733cf  09-owner-approved-write-plan-w1-to-w9-2026-06-22.md
MATCH      5636  477af9c016d68f0f  10-internal-codex-negative-review-2026-06-22.md
MATCH      4770  6868924567be5cfd  11-final-decision-2026-06-22.md
MATCH       815  c5a77309a36a48dc  staged-artifacts/_SSOT-CLASSIFICATION.md
MATCH      2700  bddd9dcdc8276eff  staged-artifacts/dot-manage/dot-manage-c1-ledger-update.staged.md
MATCH      4574  da03d15a42012cc3  staged-artifacts/evidence/codes.txt
MATCH     13178  a3c170baffc90ad0  staged-artifacts/evidence/disk.txt
MATCH      7895  188f5b2afe08afab  staged-artifacts/evidence/registered.txt
MATCH       169  4419de57533c839f  staged-artifacts/evidence/runA-old-matcher-repro.txt
MATCH      1176  fcd6848ec10448ca  staged-artifacts/evidence/runB.txt
MATCH       476  57f4ccd17e704308  staged-artifacts/evidence/runC1.txt
MATCH       858  8d3f9c4ca236c127  staged-artifacts/evidence/runC2.txt
MATCH      5371  d42c9e61e89a9b7c  staged-artifacts/patches/executor-main-py-c1.additive-design.md
MATCH      2359  5791dd0502ea931c  staged-artifacts/payloads/c1_vocab_fixture_v1.json
MATCH      3058  3b52cd1c7ec8036c  staged-artifacts/payloads/c1_vocab_manifest.json
MATCH      2222  8461b23948ba7ee7  staged-artifacts/payloads/dot_agent_api_contract_rows.json
MATCH      1023  535509d041993ffe  staged-artifacts/payloads/governance_build_authorization_grant.json
MATCH      3339  9bbd87506cb8fcae  staged-artifacts/scripts/dot-c1-bad-input-harness
MATCH      3101  fa858ec977d6bd79  staged-artifacts/scripts/dot-c1-contract-register
MATCH      3787  189faf1fb73b8b98  staged-artifacts/scripts/dot-c1-grant-issue
MATCH      6622  c7049342b617c6d6  staged-artifacts/scripts/dot-dot-register-c1-hardened

(sha256 shown truncated to 16; full 64-char digests = local shasum -a 256, identical KB-side.)

Verdict for §3.1

KB readback PROVEN. local hash == KB hash for every file; missing = 0. C1_LEGO_PREWRITE_HOLD_KB_EVIDENCE_NOT_READBACKABLE and C1_LEGO_PREWRITE_HOLD_PACKAGE_HASH_MISMATCH do not fire. Files 13–15 (this round's gate reports) are uploaded after authoring; their hashes are recorded in file 15.

The KB content is the canonical evidence; local files remain LOCAL_STAGING. Both are now provably identical byte-for-byte.