cto/.sot/03-PROTOCOLS/CTO-HERMES-REAL-REFRESH-CONTROL-REPLAY-PRD.md

---
name: cto-hermes-real-refresh-control-replay-prd
tier: local
status: draft
owner: jp
source: .sot/03-PROTOCOLS/CTO-CASE-STAGE6-REAL-GOVERNED-REFRESH-EVIDENCE.md
created: 2026-06-01
last_reviewed: 2026-06-01
lifecycle_classification: planning
core_promotion_status: not-promoted
description: Child-local PRD for exposing Stage 6 real-governed refresh evidence through the Hermes CTO control summary and replay path.
---

# CTO Hermes Real Refresh Control Replay PRD

Local planning SOT only. Not a Core Protocol. Not active Core authority.

## Problem Statement

Hermes already has a Harness-backed control summary, but that summary was validated before the Stage 6 real-governed refresh route existed. JP can now prove Case candidate-default readiness against the first real governed Stage 5 pass, but the Hermes-facing control surface does not yet expose that real-refresh status, artifact path, read-only target proof, or next operator action.

## Solution

Add a bounded real-refresh control replay slice. The CTO Harness summary must consume the Stage 6 real-governed refresh comparison artifact and expose it as replayable Hermes control state. Hermes may display and replay evidence; it must not govern, mutate targets, activate Case by default, or reinterpret raw backend logs as authority.

## Scope

- Extend the Hermes-facing CTO Harness summary contract with Stage 6 real-governed refresh fields.
- Expose the refresh comparison artifact path.
- Expose real Stage 5 pass report and Stage 5 proof paths as replay inputs.
- Expose read-only target repository proof status.
- Expose candidate-default refresh eligibility separately from runtime default activation.
- Expose blocked Codex/Pi lane rationale from the refresh artifact.
- Expose next operator action after real-refresh validation.
- Keep the source of truth as Harness Evidence Interface artifacts.

## Non-Goals

- Do not build a full Hermes WebUI panel in this slice.
- Do not add approval mutation actions.
- Do not activate Case as default backend.
- Do not rerun or mutate the real Target Repository.
- Do not promote child-local CTO artifacts into Core.
- Do not mutate vendor source, external developer repositories, Cortex Core, or unowned repositories.
- Do not expose secrets, endpoints, credentials, or raw Target Repository content.

## User Stories

1. As JP, I want the Hermes control summary to show Stage 6 real-refresh status, so that I can inspect candidate-default readiness without opening raw artifacts first.
2. As Hermes, I want replay paths for the refresh artifact, Stage 5 pass report, and Stage 5 proof, so that a future panel can link evidence without recomputing it.
3. As CTO, I want read-only target proof visible, so that real-repo safety is part of the operator surface.
4. As Harness, I want the summary generated from validated artifacts, so that control state remains proof-backed.
5. As Cortex, I want runtime default activation to remain explicit and false, so that candidate-default evidence cannot become authority by presentation.

## Acceptance Criteria

- [ ] PRD states Hermes displays and replays evidence but does not govern.
- [ ] PRD requires Harness Evidence Interface artifacts as the source of truth.
- [ ] PRD requires Stage 6 real-governed refresh status in the summary.
- [ ] PRD requires refresh comparison artifact path in the summary.
- [ ] PRD requires real Stage 5 pass report and Stage 5 proof paths in the summary.
- [ ] PRD requires read-only target repository proof status in the summary.
- [ ] PRD separates candidate-default refresh eligibility from runtime default activation.
- [ ] PRD requires blocked Codex/Pi lane rationale from the refresh artifact.
- [ ] PRD forbids target mutation, default activation, Core promotion, vendor-source mutation, external developer repository mutation, unowned repository mutation, and secret exposure.
- [ ] Local CTO validator checks the PRD and issue artifact.

## Validation

Planning validator: `python3 tools/validate_cto_child.py`.

Implementation validator planned for Hermes: `python3 harness/runner/validate-webui-summary.py --json`, then `./harness/evals/health.sh --json` after focused validation passes.

## Risks

- A UI consumer may mistake candidate-default refresh eligibility for runtime default activation.
- A summary may become stale if it does not consume the latest refresh artifact.
- A replay path may expose too much target context if raw repository content is included instead of artifact paths.
- Building WebUI runtime behavior now would overreach the stable summary contract.

## Dependencies

- `CTO-WORK-055` Stage 6 real-governed refresh evidence is validated.
- Hermes CTO Harness has `validate-case-stage6-real-refresh.py`.
- Hermes CTO Harness aggregate health includes `case_stage6_real_governed_refresh`.
- Existing Hermes control summary route remains Harness-backed.

## Challenge Notes

Accepted feedback: This route is useful because the existing Hermes summary predates real-refresh evidence and therefore cannot yet be the operator replay surface for the strongest Case proof.

Accepted feedback: The slice must update the summary contract before any WebUI panel work, because the stable machine-readable surface is the real dependency.

Rejected feedback: Building a visual WebUI panel now is premature; proof-backed summary fields are the minimum useful control layer.

Rejected feedback: Activating Case as default is out of scope because runtime default remains earned by a later governed route.

## Success Definition

This slice succeeds when CTO has a validated child-local PRD and issue route for exposing Stage 6 real-governed refresh evidence through the Hermes CTO Harness control summary and replay path, while preserving Cortex authority, Harness proof, target protection, and runtime default activation false.