Skip to content

Consolidation: overlap receipt for the fourth100 witness-MANIFEST pin family (#636/#638/#639/#640/#642/#644/#646) — one drifted larger_gain pin, partial retention, credit intact (no new kappa) #1665

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mister-Meeseeks merged 1 commit into from
Oct 14, 2026
+42,314 −0
Merged

Consolidation: overlap receipt for the fourth100 witness-MANIFEST pin family (#636/#638/#639/#640/#642/#644/#646) — one drifted larger_gain pin, partial retention, credit intact (no new kappa) #1665

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 74 additions & 0 deletions notes/task-card-agent-22.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
# Task card (autoresearch.md section 3)

Task ID / proposed scope key: `overlap-receipt` (consolidation track), scope key
757723e3fd38f20fa774, refined with nonce 6bc45fb7886eb99e0494a94781da0e58.

Base commit; exact predecessor and dependency heads: base main
1f7a934975e5eacaf83511c9ac870263bf095e05. Predecessor evidence:
research/community-reconciliation-fourth100-audit/{ARCHIVE.json,REVIEW.json},
docs/research/community-reconciliation-fourth100-review.md,
docs/research/pr-ledger.md (+ pr-ledger.json), CONTRIBUTORS.md. No code
dependency on any open PR head.

Concrete object and question: the seven PRs of the fourth100 reconciliation
whose contributed-package replay fails at the same vendored-witness MANIFEST
pin assertion (`assert sha(root/'MANIFEST.json') == src[...]` in
verify.py line 39): #636, #638, #639, #640, #642, #644 (vectorsss / Chi Zhao)
and #646 (jeremydiviney). For each exact recorded head: (a) is the recorded
replay failure a content defect of the vendored witness package (registered
MANIFEST hash vs actual blob) or a checkout/normalization artifact, and (b)
what exact content of the PR set is already byte-retained in main's tree or in
pinned archives, with complete predecessor credit?

Scope status: refined. The card's question ("what content and credit of a small
named PR set has already been retained") is kept; the concrete set is chosen
because the ledger records one shared, precisely described unresolved question
for it and the fourth100 receipt is the existing receipt to audit.

Existing restriction being changed (or exact claim being audited): none
changed. Auditing the fourth100 disposition receipt's unresolved question for
this family ("Required contributed-package replay has not completed
successfully").

Method; explicit parameter ranges/candidate alphabet: exact git-blob-identity
comparison. Per PR head (git tree via the GitHub git/trees API at the recorded
head SHA) every changed path's blob SHA is matched against local main's tree
(git ls-tree -r 1f7a9349) and against pinned archive inventories; the witness
MANIFEST pin is recomputed from the exact bytes returned by the contents API at
the same head. No heuristics, no floating point; the domain is exactly the
seven recorded heads and their changed-path sets.

Nearest overlapping PRs and why this adds something: PR1572 (receipt for
PR148's 14 unresolved paths) is a different object; the live claim in
discussion 1166#discussioncomment-18915531 covers the selected-replay tooling
family #1101/#1142/#1151/#1277/#1361/#1509/#1646; the PR99->PR103 retention
claim (discussion 1166#discussioncomment-18912011) is another object. A
find_overlap pass with the refined object terms (witness635, "combined cold
ends", vectorsss, pr643-improvement) returned only the PRs themselves and
their downstream credit mentions; no receipt or audit of this family is in
progress.

Optimistic full cost budget; required observable improvement: no kappa claim
and no moment pricing apply (documentation/consolidation). Required
improvement: every one of the seven unresolved ledger questions is replaced by
an exact, checkable status (complete integration / partial retention / changed
head / content defect), and any missing predecessor attribution is named.

Success evidence; falsification test; time/compute cap: offline stdlib checker
recomputing the per-PR blob-retention counts and the MANIFEST pin verdicts from
committed JSON inputs, with omission/substitution rejection controls; the
smallest falsifying instance is one PR head (#636) where the recomputed pin
disagrees with the recorded failure. Compute cap: single-digit minutes of API
fetches plus one local pass; session timebox keeps the final quarter for
verification and handoff.

Predecessor authors; intended artifact and reproduction command: vectorsss /
Chi Zhao (#636/#638/#639/#640/#642/#644), jeremydiviney (#646), the fourth100
reconciliation authors and the ledger maintainers. Artifact:
research/pr636-family-witness-manifest-receipt/ (README with Open next
questions, receipt JSON, offline checker). Reproduce:
`python3 -B scripts/research_package.py --package
research/pr636-family-witness-manifest-receipt` (and its --check-only
validation before submission).

Attribution: Aaron Wang / navinor, with help from opencode.
172 changes: 172 additions & 0 deletions research/pr636-family-witness-manifest-receipt/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
# Overlap receipt for the fourth100 witness-MANIFEST pin family

Scope key `757723e3fd38f20fa774` (`overlap-receipt`, consolidation track,
priority revision 3, chooser nonce `6bc45fb7886eb99e0494a94781da0e58`),
**refined** to one small named PR set: the seven entries of the fourth100
reconciliation whose contributed-package replay fails at `verify.py` line 39
with `AssertionError: larger_gain manifest pin` —
[#636](https://github.com/CrocSwap/integer-mult-bounds/pull/636),
[#638](https://github.com/CrocSwap/integer-mult-bounds/pull/638),
[#639](https://github.com/CrocSwap/integer-mult-bounds/pull/639),
[#640](https://github.com/CrocSwap/integer-mult-bounds/pull/640),
[#642](https://github.com/CrocSwap/integer-mult-bounds/pull/642),
[#644](https://github.com/CrocSwap/integer-mult-bounds/pull/644)
(vectorsss / Chi Zhao) and
[#646](https://github.com/CrocSwap/integer-mult-bounds/pull/646)
(jeremydiviney). Base main `1f7a934975e5eacaf83511c9ac870263bf095e05`.

This is a source-bound disposition receipt: a finite certificate of git-blob
identities and one diagnosed source-pin defect. It is **not** a kappa claim, a
construction, or a mathematical result, and it changes no disposition: the
seven PRs stay open, the selected frontier is unchanged, and no closure is
requested.

## What was audited

The existing receipt under audit is the fourth100 reconciliation
(`research/community-reconciliation-fourth100-audit/`,
`docs/research/community-reconciliation-fourth100-review.md`) as recorded in
`docs/research/pr-ledger.json`, which leaves all seven with the identical
unresolved question "Required contributed-package replay has not completed
successfully" and identical evidence text
`AssertionError: larger_gain manifest pin`. For each recorded head I checked
(a) the source-pin block of the package's own `verify.py` (lines 36-42: package
MANIFEST tree, each pinned source's `MANIFEST.json` pin, and each pinned file)
against the exact bytes committed at that head, and (b) the byte-retention of
every changed path against main's tree at the base commit. Method: exact
git-blob identity only (SHA256 of raw bytes for pins, blob SHAs for retention);
no heuristic matching. The fetching side is `tools/audit_witness_pins.py`, the
receipt builder is `tools/build_receipt.py`.

## Findings

**F1 — the seven failures share one cause: a drifted `larger_gain` pin.** All
seven SPECs register `larger_gain` with
`manifest_sha256 = 54d67f45ad520f4a134e069336bd0ff639aaeada28d13539298e4f2655c9692d`,
which is exactly `research/larger-gain/MANIFEST.json` at the pinned PR569
revision `897213a855b7fb8a1b8b0e552a2f5c42e6c1b326`. The same path **as staged
into main** (commit `df417acd`, "Stage frozen PR family through 588") hashes
`73c186c2807c703e43293c7cf785557a046958c245fa812e433f7fe208cdef6d`, and this
drifted copy is what every one of the seven recorded heads carries in its base
tree (checked at each head). The two manifests differ in exactly two `files`
entries: `NOTICE` and `README.md` (both 64-hex digests changed; byte length
40,559 in both). The staged package is self-consistent at its own revision:
main's `NOTICE` and `README.md` hash to the staged manifest's values, not to
PR569's. The other five pinned sources (`multicold`, `structural_gain`,
`joint_prefix`, `frame_coalescing`, `direct_delivery`) still match their pins in
the live repository packages.

**F2 — the six vectorsss packages vendor the pinned revision byte-exactly.**
For #636/#638/#639/#640/#642/#644, each source pin resolves to the package's
own `vendor/<name>/MANIFEST.json`, and every one matches its registered
`manifest_sha256` in raw bytes (zero CRLF bytes anywhere, so the repository's
text normalization is not involved). All their pinned files match too. Run
through their own `verify.sh` source overrides, these six pass the pin block
that the reconciliation recorded as failing; they evidently ran with the
sources resolved to live repository packages (as #646's defaults do), where
`larger_gain` is the first pin that fails. #646 has no vendored copy at all:
its `verify.py` defaults resolve `larger_gain` to the live
`research/larger-gain`, which reproduces its failure on any checkout of main.

**F3 — retention is partial, and dominated by re-vendored predecessor
content.** Against main's tree at the base commit (exact blob identity):

| PR | changed paths | byte-retained in main (other path) | not byte-retained |
|---|---:|---:|---:|
| #636 | 348 | 285 | 63 |
| #638 | 347 | 281 | 66 |
| #639 | 340 | 281 | 59 |
| #640 | 339 | 282 | 57 |
| #642 | 354 | 281 | 73 |
| #644 | 355 | 280 | 75 |
| #646 | 186 | 77 | 109 |

No path matches at the same path, and no path exists in main with different
content, so retention is entirely "same bytes at a different path": the
vendored copies of the six pinned source packages already live in main under
their own `research/` directories. The unretained remainder is each package's
own witness, tools, data and result files (listed path by path in
`evidence/pr{N}-audit.json`).

**F4 — the six vectorsss members share their vendored core with each other**
(250-268 shared blobs pairwise; #646 shares 31-33 with each). A reviewer can
treat the six as one content family plus six small per-PR deltas.

**F5 — predecessor credit is present.** `CONTRIBUTORS.md` credits vectorsss for
#636/#638/#639/#640/#642/#644 (line 835) and jeremydiviney for #646 (line
833). No missing attribution was found for this family; the downstream
incorporated work that credits vectorsss's owner-search methods (e.g. #654,
#671, #676, #699) is separate and unaffected.

## Reproduction

```sh
python3 -B research/pr636-family-witness-manifest-receipt/verify.py
python3 -B scripts/research_package.py --package research/pr636-family-witness-manifest-receipt
```

`verify.py` is offline and standard-library only. It recomputes the drift
identity from the two committed MANIFEST copies (and against the working tree's
`research/larger-gain/MANIFEST.json`), re-derives every pin verdict and every
retention class from the per-PR audit rows against `git ls-tree -r <base>`,
recomputes the cross-PR shared-blob counts, runs a positive fixture of the
classification rule, and runs four failure controls (tampered digest,
substituted manifest diff, omitted row, substituted class) that must each be
rejected. The evidence copies under `evidence/` are byte-exact unmodified
copies of two `MANIFEST.json` revisions, kept so the digests are checkable
without network access.

## Limitations (not checked)

- Head-side blob identities rest on the GitHub pulls/contents APIs at the
recorded head SHAs; the seven PR trees are not fetched into the reviewer's
git, so `verify.py` re-derives the main-tree side only.
- The `multicold` sources declare `full_tree: true`; their whole-tree manifests
were not recomputed file by file (the recorded failure is earlier, at the
`MANIFEST.json` pin).
- The seven packages' full contributed replays (construction, owner search,
admission) were not executed. This receipt resolves the recorded pin failure
and the retention/credit question only.
- That the fourth100 harness resolved sources to live packages is inferred
from the uniform `larger_gain manifest pin` assertion plus the pin data; the
harness's exact invocation was not recorded in the ledger.
- Retention matching is byte identity. Content rewritten equivalently would be
reported as not retained; no such case appeared at these paths.

## Open next questions

1. **What did the fourth100 harness actually pass to `verify.py`?** It matters
because the six vectorsss packages pass their pin block via their own
`verify.sh` overrides, so their ledger questions may be resolvable by a
re-run rather than a content fix. First step: re-run #636's `verify.sh` pin
block (`--check-pins`) in a byte-preserving checkout of its recorded head
`679621828a85bac68af869fb0e55b54508e6b14b`. Blocked by: the recorded
traceback stops at the assertion and does not record the harness's source
resolution.
2. **Should the `larger_gain` pin drift be reconciled in main?** The staged
`research/larger-gain` package is self-consistent but is a later revision
(NOTICE/README.md changed) than the pinned PR569 revision that all seven
packages register; every live-package resolution fails until someone either
re-pins or vendors the pinned revision. First step: confirm with the
maintainers whether `df417acd`'s NOTICE/README.md rewrite was intentional
(it looks like license/attribution staging) and then update the seven SPECs
or restore the pinned revision. Blocked by: maintainer decision on pin
policy; this receipt does not change any pin.
3. **Is any of the unretained content worth retaining for reuse?** The 57-109
unretained paths per PR are mostly per-package witness outputs; a bounded
follow-up could classify them into method code worth retaining versus
generated evidence. First step: classify the `not_retained` lists in
`evidence/pr{N}-audit.json` by extension and directory. Blocked by: nothing.

## Credit and attribution

Predecessor authors: vectorsss / Chi Zhao (#636/#638/#639/#640/#642/#644) and
jeremydiviney / Jeremy Diviney (#646); the fourth100 reconciliation authors
for the audited receipt and recorded evidence; the PR569 (`larger_gain`)
authors and the `df417acd` staging authors for the two manifest revisions
compared here. The receipt follows the source-retention receipt style of
[#1572](https://github.com/CrocSwap/integer-mult-bounds/pull/1572) (PR148),
which audited a different family.

Prepared by Aaron Wang / navinor with help from opencode. Substantial AI
assistance is disclosed; no independent human review is claimed. Apache-2.0.
Loading
Loading