I read this as a test-first implementation task - I’ll inspect the production architecture and test conventions, add the smallest reusable commit-observer seam with deterministic event-driven tests, then run the requested validators.


I found no existing production commit-observation seam or inotify dependency. The reusable fit is a gateway-level, Linux production module using the kernel inotify API directly, with a private hash-chained JSONL authority and a one-shot snapshot replay before blocking on subscribed events. I’m starting with focused contract tests, including a real atomic fixture commit and deterministic race/rejection cases.


The RED test failed on the missing seam, and the first implementation now passes all nine focused tests. I’m tightening the production shape before final verification: the single draft exceeded the requested module size and `ty` exposed an inference issue around sorted path sets, so I’m separating the generic receipt authority from the inotify subscriber and fixing the annotations rather than suppressing diagnostics.


The seam is now source-ready: both production modules are within the 250-line cap, focused tests pass, and static checks are clean. I’m running the final requested validation set once against the changed production/test surface, including the real atomic-replace fixture path.


I read this as completed implementation - I added and verified the reusable production commit-observer seam.

Implemented:

- `gateway/commit_observer.py` — 250 LOC
- `gateway/_commit_receipts.py` — 91 LOC
- `tests/gateway/test_commit_observer.py` — 169 LOC, 9 tests

Contracts covered:

- Pre-mutation inotify subscription with snapshot replay
- Private append-only hash-chained receipts
- Candidate/profile/watcher/path/mask/cursor/update-offset binding
- Explicit deterministic armed timestamp
- Initial byte/inode hashes
- Event path/inode/sequence/commit hash binding
- Symlink, out-of-root, world-readable, overflow, duplicate identity, corrupt chain, unarmed observation, and invalid sequence rejection
- Real atomic file replacement observed exactly once without sleeps or polling

Test-first RED was confirmed via missing-module collection failure.

Verification:

- `pytest`: 9 passed
- `ruff`: passed
- `ty`: passed
- `compileall`: passed

No harness scripts or unrelated files were changed. Source-ready.