Convergence wave: bind provenance on the real audit path; dashboard favicon + honest sub-cent cost

2026-08-28

governancedashboardcdn

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["POST /v1/chat/completions (evidence_mode:required now binds provenance on the real audit path)"] sdk_methods_updated: ["none — handler-internal + frontend/CDN"] mcp_tools_updated: ["none"] ---

What We Built

The final convergence push against the two round-6 blockers that a prior wave only partially closed.

Provenance binding on the REAL audit path (compliance). The round-6 attempt force-bound the wrong lineage row: it patched model-router.captureCompletionLineage, whose output is _discarded_ on the non-streaming allow path. The audit row that POST /v1/governance/audit/verify actually reads is written by recordCompletionAudit (non-streaming.ts) with no provenance param → an EMPTY_PROVENANCE_STAMP → a null committed lineage_digest → verify returns incomplete. Now, when the resolved requirement's evidenceMode is required/strict (read via the same getDataProtection(c)?.snapshot.requirement accessor that already drives the evidence-coverage header in prod), the handler re-captures a bound lineage row and threads it into the audit write, so verify recomputes a matching digest and returns summary: verified. Proven end-to-end through commit + verify in a new test. (Streaming remains a documented residual — it never captures completion lineage.)

Dashboard favicon via the Cloudflare Worker (dashboard). The favicon served the 506KB SPA index.html because the Worker's /dashboard/ SPA catch-all matched /dashboard/favicon.. Added a static-asset rewrite above the fallback so /dashboard/*.{svg,ico,png,css,js,woff2,…} resolve to their real S3 object. The prior vercel.json edit was inert — the Worker fronts S3, not Vercel.

Honest sub-cent cost. The dashboard's formatUsd truncated $0.000045 to $0.0000 (reads as free). Now sub-cent values show ~2 significant figures with a <$0.00000001 floor, so a real charge never renders as $0.00.

Why It Matters

evidence_mode: required now delivers what it says: an independently recomputable provenance record, not a receipt over an unbound decision. And a compliance product's dashboard can no longer render a real charge as free.

Lockstep Checklist

[x] API Routes: no route surface change (handler internals only).
[x] SDK / MCP: none.
[x] Deploy: API via ECS; dashboard SPA via deploy-site; **Worker via

wrangler deploy** (separate pipeline — required for the favicon fix).

Open Follow-ups

Streaming completions don't capture provenance lineage (broader gap).
Observability cross-task config persistence (writes honest-503, feature down).
Circuit-breaker fast-fail; router 9→10 residuals; /attestation verified:false; PyPI token.