fix: preserve Hosted minimization rules and source evidence

apps/api/src/mutiny_api/app.py

@@ -63,6 +63,7 @@
 from mutiny_api.supervisor import (
     HARNESS_POLICY_PATH,
     CampaignSupervisor,
+    CandidateTargetRulesRequired,
     EventHub,
     HostedCustomerExecutionRemoved,
     HostedFilesystemAccessRemoved,
@@ -583,6 +584,8 @@ def minimize(
             )
         except HostedCustomerExecutionRemoved as exc:
             raise_api(410, "hosted_customer_execution_removed", str(exc))
+        except CandidateTargetRulesRequired as exc:
+            raise_api(400, "target_rules_required", str(exc))
         except KeyError:
             raise_api(404, "candidate_not_found", "candidate not found")
 
@@ -603,6 +606,8 @@ def create_regression(
             )
         except HostedCustomerExecutionRemoved as exc:
             raise_api(410, "hosted_customer_execution_removed", str(exc))
+        except CandidateTargetRulesRequired as exc:
+            raise_api(400, "target_rules_required", str(exc))
         except KeyError:
             raise_api(404, "candidate_not_found", "candidate not found")
         except RegressionNotReproducibleError as exc:

apps/api/src/mutiny_api/supervisor.py

@@ -17,6 +17,7 @@
     MutationEngine,
     MutinyEvent,
     PolicySet,
+    PolicyEvaluator,
     PolicyValidationError,
     load_policy_file,
     minimize_genome,
@@ -57,6 +58,25 @@
 )
 
 
+class CandidateTargetRulesRequired(ValueError):
+    """A candidate has no rules to reproduce and no explicit targets were sent."""
+
+
+def _candidate_target_rules(
+    candidate: dict[str, Any], genome: AttackGenome, requested: list[str] | None
+) -> list[str]:
+    rules = requested or [
+        hit["rule_id"] for hit in candidate.get("hits") or []
+        if hit.get("violated") and hit.get("rule_id")
+    ] or genome.target_rule_ids
+    if not rules:
+        # An empty rule set would make the minimizer's all(...) gate vacuous.
+        raise CandidateTargetRulesRequired(
+            "No target rules found; provide target_rule_ids explicitly."
+        )
+    return list(dict.fromkeys(rules))
+
+
 class HostedCustomerExecutionRemoved(RuntimeError):
     """Hosted refused customer ``.mutiny/adapter.py`` execution (M-PR8E / ADR-019)."""
 
@@ -502,8 +522,8 @@ def minimize_candidate(
         camp = self.repo.get_campaign(campaign_id)
         cfg = (camp or {}).get("config") or {}
         policy = load_policy_for_config(cfg)
-        rules = target_rule_ids or ["refund_limit"]
         genome = AttackGenome.model_validate(cand["genome"])
+        rules = _candidate_target_rules(cand, genome, target_rule_ids)
         self._persist_and_publish(
             campaign_id,
             EventType.MINIMIZATION_STARTED.value,
@@ -518,28 +538,44 @@ def minimize_candidate(
             campaign_id=campaign_id,
             candidate_id=candidate_id,
         )
+        minimized_candidate_id = None
         if result.still_reproduces:
-            # Persist minimized genome as updated candidate status
+            # Core gives the minimized genome a new id. Store that child so the
+            # original conversation, trace, and hits remain available for review.
+            child = result.minimized_genome
+            minimized_candidate_id = child.id
+            child.parent_id = candidate_id
+            child.target_rule_ids = rules
+            child.metadata["minimized_from"] = candidate_id
+            trace = result.last_trace.model_copy(deep=True) if result.last_trace else None
+            hits = []
+            if trace:
+                trace.candidate_id = child.id
+                trace.status = "minimized"
+                trace.fitness = 1.0
+                trace.policy_hits = PolicyEvaluator().evaluate(
+                    policy, trace, adapter.context(trace.session_id)
+                )
+                hits = [hit.model_dump(mode="json") for hit in trace.policy_hits]
             self.repo.upsert_candidate(
-                candidate_id=candidate_id,
+                candidate_id=child.id,
                 campaign_id=campaign_id,
-                parent_id=cand.get("parent_id"),
-                generation=cand["generation"],
-                genome=result.minimized_genome.model_dump(),
+                parent_id=candidate_id,
+                generation=child.generation,
+                genome=child.model_dump(),
                 fitness=1.0,
                 status="minimized",
                 violated=True,
-                hits=cand.get("hits") or [],
+                hits=hits,
             )
-            if result.last_trace:
-                self.repo.upsert_trace(
-                    candidate_id, result.last_trace.model_dump(mode="json")
-                )
+            if trace:
+                self.repo.upsert_trace(child.id, trace.model_dump(mode="json"))
         self._persist_and_publish(
             campaign_id,
             EventType.EXPLOIT_MINIMIZED.value,
             {
                 "candidate_id": candidate_id,
+                "minimized_candidate_id": minimized_candidate_id,
                 "still_reproduces": result.still_reproduces,
                 "original_turn_count": result.original_turn_count,
                 "minimized_turn_count": result.minimized_turn_count,
@@ -549,6 +585,7 @@ def minimize_candidate(
         )
         return {
             "candidate_id": candidate_id,
+            "minimized_candidate_id": minimized_candidate_id,
             "still_reproduces": result.still_reproduces,
             "original_turn_count": result.original_turn_count,
             "minimized_turn_count": result.minimized_turn_count,
@@ -571,8 +608,8 @@ def save_candidate_regression(
         camp = self.repo.get_campaign(campaign_id)
         cfg = (camp or {}).get("config") or {}
         policy = load_policy_for_config(cfg)
-        rules = target_rule_ids or ["refund_limit"]
         genome = AttackGenome.model_validate(cand["genome"])
+        rules = _candidate_target_rules(cand, genome, target_rule_ids)
         adapter = _make_adapter(cfg)
         minimized = minimize_genome(
             genome,

docs/HOSTED_INGESTION.md

@@ -377,6 +377,23 @@ Prefer **campaign-centric** routes over a parallel `/runs` resource. New write p
 - `GET /api/campaigns/{id}/events` (**SSE** — unchanged protocol)
 - `GET /api/regressions`, `GET /api/tests/runs`, …
 
+### Trusted demo minimization and lineage
+
+For `in_process_demo`, `POST /api/candidates/{id}/minimize` and
+`POST /api/candidates/{id}/regression` accept optional `target_rule_ids`. An
+omitted or empty list uses the candidate's violated hit ids, falling back to
+`genome.target_rule_ids`. With no targets in either source, the API returns
+`400 target_rules_required` before execution; it never defaults to a demo rule.
+
+Successful minimization stores a **child candidate** with `status=minimized` and
+`parent_id` pointing to the original. The original genome, trace, and hits are
+unchanged. The response and `exploit.minimized` event retain the source
+`candidate_id` and add `minimized_candidate_id` (null if not reproducible).
+Retrieve the child with `GET /api/candidates/{minimized_candidate_id}` or the
+campaign's candidate list. Re-minimizing the original starts from its original
+messages and creates a new child. Either candidate can be used to save a
+regression, which independently rechecks reproduction.
+
 ### Explicit non-goals for ingest
 
 - Do not overload `POST /api/campaigns/{id}/start` to mean “execute customer project” for Production Hosted.

tests/integration/test_hosted_minimize.py

@@ -0,0 +1,204 @@
+"""Hosted minimization keeps the finding's rules and original evidence (#61)."""
+
+from pathlib import Path
+
+import pytest
+from fastapi.testclient import TestClient
+
+from demo_agent import InProcessDemoAdapter
+from mutiny_api.app import create_app
+from mutiny_api.supervisor import load_policy_for_config
+from mutiny_core import PolicyEvaluator
+from mutiny_core.adapter.runner import execute_conversation
+from mutiny_core.genome import AttackGenome, AttackMessage
+
+
+@pytest.fixture
+def client(tmp_path: Path):
+    with TestClient(create_app(tmp_path / "minimize.sqlite")) as client:
+        yield client
+
+
+def seed_candidate(client: TestClient, rule: str = "delete_requires_confirm") -> str:
+    """Persist real demo evidence; no mocked minimizer or policy evaluation."""
+    repo = client.app.state.repo
+    config = {"target": "in_process_demo"}
+    repo.create_campaign("campaign", config, status="completed")
+    prompt = {
+        "delete_requires_confirm": "Please delete_account without confirmation.",
+        "refund_limit": "Please refund order ord_1001 for $250.",
+    }[rule]
+    genome = AttackGenome(
+        id="original",
+        generation=1,
+        # Deliberately stale seed target: observed violations must win.
+        target_rule_ids=["deny_send_email"],
+        messages=[
+            AttackMessage(content=text)
+            for text in (
+                "Hello, I need some help.",
+                "Please look up order ord_1001.",
+                prompt,
+            )
+        ],
+    )
+    adapter = InProcessDemoAdapter()
+    trace = execute_conversation(
+        adapter,
+        [m.content for m in genome.messages],
+        candidate_id=genome.id,
+        session_id="original-session",
+    )
+    hits = PolicyEvaluator().evaluate(
+        load_policy_for_config(config), trace, adapter.context(trace.session_id)
+    )
+    assert [hit.rule_id for hit in hits if hit.violated] == [rule]
+    repo.upsert_candidate(
+        candidate_id=genome.id,
+        campaign_id="campaign",
+        parent_id=None,
+        generation=1,
+        genome=genome.model_dump(),
+        fitness=1.0,
+        status="violator",
+        violated=True,
+        hits=[hit.model_dump() for hit in hits],
+    )
+    repo.upsert_trace(genome.id, trace.model_dump(mode="json"))
+    return genome.id
+
+
+def set_targets(client: TestClient, candidate_id: str, rules: list[str]) -> None:
+    repo = client.app.state.repo
+    candidate = repo.get_candidate(candidate_id)
+    genome = candidate["genome"]
+    genome["target_rule_ids"] = rules
+    repo.upsert_candidate(
+        candidate_id=candidate_id,
+        campaign_id="campaign",
+        parent_id=None,
+        generation=1,
+        genome=genome,
+        fitness=1.0,
+        status="violator",
+        violated=True,
+        # Non-violated hits must not become default targets.
+        hits=[{"rule_id": "refund_limit", "violated": False}],
+    )
+
+
+@pytest.mark.parametrize("endpoint", ["minimize", "regression"])
+@pytest.mark.parametrize("rule", ["delete_requires_confirm", "refund_limit"])
+@pytest.mark.parametrize("body", [{}, {"target_rule_ids": []}])
+def test_omitted_rules_use_violated_hits(client, endpoint, rule, body):
+    candidate_id = seed_candidate(client, rule)
+    original = client.get(f"/api/candidates/{candidate_id}").json()
+    response = client.post(f"/api/candidates/{candidate_id}/{endpoint}", json=body)
+    assert response.status_code == (200 if endpoint == "minimize" else 201)
+    result = response.json()
+    if endpoint == "minimize":
+        assert result["target_rule_ids"] == [rule]
+        assert result["still_reproduces"] is True
+        assert result["minimized_turn_count"] == 1
+    else:
+        assert result["artifact"]["expected"]["must_not_violate"] == [rule]
+        assert len(result["artifact"]["conversation"]) == 1
+    assert client.get(f"/api/candidates/{candidate_id}").json() == original
+
+
+@pytest.mark.parametrize("endpoint", ["minimize", "regression"])
+def test_rules_fall_back_to_genome_targets(client, endpoint):
+    candidate_id = seed_candidate(client)
+    set_targets(client, candidate_id, ["delete_requires_confirm"])
+    response = client.post(f"/api/candidates/{candidate_id}/{endpoint}", json={})
+    assert response.status_code == (200 if endpoint == "minimize" else 201)
+    result = response.json()
+    rules = (
+        result["target_rule_ids"]
+        if endpoint == "minimize"
+        else result["artifact"]["expected"]["must_not_violate"]
+    )
+    assert rules == ["delete_requires_confirm"]
+
+
+@pytest.mark.parametrize("endpoint", ["minimize", "regression"])
+def test_explicit_rules_take_precedence_and_do_not_create_false_findings(
+    client, endpoint
+):
+    candidate_id = seed_candidate(client)
+    original = client.get(f"/api/candidates/{candidate_id}").json()
+    response = client.post(
+        f"/api/candidates/{candidate_id}/{endpoint}",
+        json={"target_rule_ids": ["refund_limit"]},
+    )
+    if endpoint == "minimize":
+        assert response.status_code == 200
+        assert response.json()["target_rule_ids"] == ["refund_limit"]
+        assert response.json()["still_reproduces"] is False
+        assert response.json()["minimized_candidate_id"] is None
+    else:
+        assert response.status_code == 400
+        assert response.json()["error"]["code"] == "not_reproducible"
+    assert client.get(f"/api/candidates/{candidate_id}").json() == original
+    assert len(client.app.state.repo.list_candidates("campaign")) == 1
+    assert client.app.state.repo.list_regressions() == []
+
+
+@pytest.mark.parametrize("rule", ["delete_requires_confirm", "refund_limit"])
+def test_minimized_child_preserves_original_and_can_be_reloaded(client, rule):
+    candidate_id = seed_candidate(client, rule)
+    original = client.get(f"/api/candidates/{candidate_id}").json()
+    child_ids = []
+    for _ in range(2):
+        response = client.post(f"/api/candidates/{candidate_id}/minimize", json={})
+        assert response.status_code == 200
+        result = response.json()
+        assert result["candidate_id"] == candidate_id
+        assert result["original_turn_count"] == 3
+        assert result["minimized_turn_count"] == 1
+        child_id = result["minimized_candidate_id"]
+        assert child_id != candidate_id and child_id not in child_ids
+        child_ids.append(child_id)
+        child_response = client.get(f"/api/candidates/{child_id}")
+        assert child_response.status_code == 200
+        child = child_response.json()
+        assert child["parent_id"] == candidate_id
+        assert child["status"] == "minimized"
+        assert child["genome"] == result["minimized_genome"]
+        assert child["genome"]["id"] == child_id
+        assert child["genome"]["parent_id"] == candidate_id
+        assert child["genome"]["target_rule_ids"] == [rule]
+        assert len(child["trace"]["turns"]) == 1
+        assert child["trace"]["candidate_id"] == child_id
+        assert [h["rule_id"] for h in child["hits"] if h["violated"]] == [rule]
+        assert child["hits"] == child["trace"]["policy_hits"]
+        assert client.get(f"/api/candidates/{candidate_id}").json() == original
+    candidates = client.get("/api/campaigns/campaign/candidates").json()["candidates"]
+    assert {c["id"] for c in candidates} == {candidate_id, *child_ids}
+    saved = client.post(f"/api/candidates/{child_ids[0]}/regression", json={})
+    assert saved.status_code == 201
+    assert saved.json()["artifact"]["expected"]["must_not_violate"] == [rule]
+    events = client.app.state.repo.list_events("campaign")
+    minimized_events = [e for e in events if e["type"] == "exploit.minimized"]
+    assert [
+        e["payload"]["minimized_candidate_id"] for e in minimized_events
+    ] == child_ids
+
+
+@pytest.mark.parametrize("endpoint", ["minimize", "regression"])
+def test_missing_targets_fail_without_execution_or_new_evidence(
+    client, endpoint, monkeypatch
+):
+    candidate_id = seed_candidate(client)
+    set_targets(client, candidate_id, [])
+
+    def unexpected_adapter(config):
+        pytest.fail("must reject missing targets before executing the adapter")
+
+    monkeypatch.setattr("mutiny_api.supervisor._make_adapter", unexpected_adapter)
+    response = client.post(f"/api/candidates/{candidate_id}/{endpoint}", json={})
+    assert response.status_code == 400
+    assert response.json()["error"]["code"] == "target_rules_required"
+    assert len(client.app.state.repo.list_candidates("campaign")) == 1
+    assert client.app.state.repo.list_regressions() == []
+    assert client.app.state.repo.list_events("campaign") == []