Mirror stale

The check is mirror_stale. Stage verify. Default-on. It walks each declared Mirror in proof/mirrors/MIR-*.yaml, fingerprints every file under the source globs and the target globs (sha256 of bytes, then one digest per side), and compares those digests to proof/mirrors/affirmations/<MIR-id>.yaml. It never mutates the mirror record. It never writes the affirmation. Reaffirmation is always a human act: proof mirror reaffirm.

The rewrite method lives on characterization testing and mirrors. That page's command is proof audit --check mirror_complete: cell-set parity, keyed by annotation, not by test name. A source edit that adds no new annotation leaves the cell sets untouched. The mirror stays at 100% ledger parity while the implementations silently diverge. That is the hole this hop closes.

// pkg/numeric/approved_form.go
// Verifies: SYS-REQ-010
func approvedForm(s string) string { return s }

// same Verifies line after a rule fix that changed the body
// mirror_complete still green: the cell set did not move

Three live comparisons. No affirmation record: no affirmed baseline, run proof mirror reaffirm. Source digest differs: STALE, the source changed since the last review. Source equal and target differs: STALE, the target moved ahead; re-baseline both sides. Both equal: affirmed and current. A file matching both globs contributes to both digests. It is genuinely part of both file-sets.

Severity follows the mirror's own status, the same way mirror_complete does. planned is info. in_progress is warn, and it stays warn even under audit.evidence_strict. complete is error. A finished rewrite whose source drifted therefore re-opens at error until a human re-baselines it.

proof mirror status MIR-3
proof mirror reaffirm MIR-3 --reason "Reviewed the approved-form rule fix; target port already covers the new behavior"
proof audit --check mirror_stale --verbose

No declared mirrors is a silent no-op: the check has zero cost until the project adopts Mirror. Opt out with enabled: false; the check then reports skip, never pass, and names the setting that silenced it. Staleness is orthogonal to parity. Reaffirming is allowed with gaps still open. The command prints the gap count as context and never flips status.

The teaching graph is still one complete Mirror next to one unsigned source edit. Reaffirm it, or the hop names the drift.

proof mirror reaffirm MIR-3 --reason "Reviewed the approved-form rule fix; target port already covers the new behavior"
proof audit --check mirror_stale

--reason is required and must be at least 32 characters, the same floor as a mirror exemption. A reaffirmation without a substantive reason is not a review. --reviewer defaults to the resolved actor. --dry-run prints what would be written. Re-affirming unchanged digests with the same reviewer and reason is idempotent: the original affirmed_at is kept.

Ledger parity stays on characterization testing and mirrors. KI path relevance stays on known issue mirror anchor relevant. Do not treat a wiki of rewrite notes as this cell. Jama still authors. Proof vs Jama.

The hop does not write the affirmation, does not flip status, and does not close parity gaps. A missing record is a finding, not a rewrite. No declared mirrors is a silent no-op. Opt-out is skip, never pass. Planned is info. In-progress is warn even under audit.evidence_strict. Complete is error. The digest is file bytes, not semantic behavior: two trees that print the same can still hash differently, and two trees that hash the same can still disagree on I/O. The hop does not run characterization tests. It does not fuzz. It does not prove the Go. We have not scored this floor against a frozen rewrite corpus or a frozen Jama pack. The loss is named, not scored.

The rewrite method stays on characterization testing and mirrors. The engagement stays on software correctness audit. Jama still authors.

What is mirror stale? Same question. Same URL.

Is this characterization testing? No. That page is the rewrite method and mirror_complete (ledger parity). This hop is content drift against a human reaffirmation. See characterization testing and mirrors.

Is this mirror_complete? No. That hop is whether the target still carries the source's annotation cells. This hop hashes the files those cells sit in.

Is this known issue mirror anchor relevant? No. That hop is whether a KI still names a live mirror path. This hop is the Mirror's own content baseline. See known issue mirror anchor relevant.

Does a project with no mirrors fail? No. Zero declared Mirrors is a silent no-op.

Does reaffirming close the rewrite? No. Reaffirming never flips status and never closes parity gaps.

Does a green hop prove the Go? No. The hop does not execute the source or the target. It does not prove the function.

Is Proof a Jama alternative for the rewrite? No. Jama still authors. Proof vs Jama.