Tooling: audit unchecked selected dependency heads and add an opt-in consistency guard

research/selected-dependency-heads-audit/CLAIM.md

@@ -0,0 +1,32 @@
+# CLAIM (advisory)
+
+**CLAIM** (supplier-boundary-audit, scope refined)
+
+Question: do `certificates/selected-result.json` fields
+`reviewed_dependency_heads`, `audited_source_head`, `source_prs`,
+`previous_kappa`, `status`, `scope` and `reproduce` follow from any
+source-bound acceptance check on the selected reproduce path, or can a
+well-formed record with false dependency heads still pass
+`scripts/verify_selected_result.py` while leaving
+certificate/kappa/inventory/supplements unchanged?
+
+Base / predecessors: main `0b1cccf8`; `research/owner-boundary-audit`
+(method pattern); `research/selected-proof-binding` (primary-proof coverage
+gap, repaired); `research/ledger-decision-binding` (considered selected
+dependency-head consistency but chose a ledger failure mode at an earlier
+base); `research/frontier1094-ancestry-binding-seed69` (reuse-mode ancestry
+binding; orthogonal). Distinct from discussion #1730
+(certificate/invoice/outer field binding to cold replay).
+
+Method and domain: (1) mutate only the named metadata fields and re-run
+`verify_selected_result.check` against the live checkout; (2) confirm that no
+top-level Python file under `scripts/` (`scripts/*.py`) mentions the head
+fields; (3) independently recheck the published heads for internal consistency
+with `previous_record` and batch1099 integration `reviewed_heads`; (4) ship a
+scoped package with positive/negative fixtures and a proposed opt-in guard
+(not applied to selected scripts).
+
+Expected artifact: `research/selected-dependency-heads-audit/`; no κ claim;
+selected frontier untouched.
+
+Claim expires: 2026-10-14T10:11Z UTC.

research/selected-dependency-heads-audit/EXPECTED.json

@@ -0,0 +1,100 @@
+{
+  "status": "PASS_SELECTED_DEPENDENCY_HEADS_AUDIT",
+  "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+  "selected_kappa": "836330098538459/500000000000000000",
+  "selected_record_sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32",
+  "checker_sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199",
+  "live_checker_accepts_selected": {
+    "accepted": true,
+    "kappa": "836330098538459/500000000000000000",
+    "error": null,
+    "label": "live_selected_record"
+  },
+  "live_checker_accepts_metadata_mutants": {
+    "false_heads": {
+      "accepted": true,
+      "kappa": "836330098538459/500000000000000000",
+      "error": null,
+      "label": "false_heads"
+    },
+    "false_previous_kappa": {
+      "accepted": true,
+      "kappa": "836330098538459/500000000000000000",
+      "error": null,
+      "label": "false_previous_kappa"
+    },
+    "false_source_prs": {
+      "accepted": true,
+      "kappa": "836330098538459/500000000000000000",
+      "error": null,
+      "label": "false_source_prs"
+    },
+    "false_publication": {
+      "accepted": true,
+      "kappa": "836330098538459/500000000000000000",
+      "error": null,
+      "label": "false_publication"
+    }
+  },
+  "live_checker_rejects_certificate_digest_mutant": {
+    "accepted": false,
+    "error_prefix": "ValueError: Selected certificate bytes changed"
+  },
+  "static_scan": {
+    "verify_selected_result_record_access_lines": {
+      "reviewed_dependency_heads": [],
+      "audited_source_head": [],
+      "source_prs": [],
+      "previous_kappa": [],
+      "status": [],
+      "scope": [],
+      "reproduce": []
+    },
+    "top_level_scripts_py_mentioning_head_fields": [],
+    "static_scan_scope": "top-level scripts/*.py only; not a recursive repository scan"
+  },
+  "published_consistency": {
+    "audited_equals_lead_head": true,
+    "lead_pr": 1094,
+    "previous_kappa_matches_checkpoint": true,
+    "heads_subset_of_source_prs": true,
+    "shared_with_previous_count": 35,
+    "shared_with_previous_diffs": [],
+    "shared_with_integration_count": 13,
+    "shared_with_integration_diffs": [],
+    "new_heads_since_previous": [
+      "987",
+      "1050",
+      "1053",
+      "1055",
+      "1056",
+      "1061",
+      "1063",
+      "1065",
+      "1068",
+      "1074",
+      "1082",
+      "1087",
+      "1094"
+    ],
+    "n_reviewed_dependency_heads": 48,
+    "n_source_prs": 101,
+    "hex40_heads": true
+  },
+  "proposed_guard": {
+    "accepts_live": true,
+    "rejects_mutations": {
+      "false_heads": true,
+      "false_previous_kappa": true,
+      "false_source_prs": true
+    },
+    "mutation_errors": {
+      "false_heads": "ValueError: audited_source_head differs from reviewed head for source_prs[0]",
+      "false_previous_kappa": "ValueError: previous_kappa differs from previous_record kappa",
+      "false_source_prs": "ValueError: audited PR missing from reviewed_dependency_heads: 999999"
+    }
+  },
+  "severity": "low",
+  "severity_rationale": "Publication/attribution metadata only; certificate, inventory and supplements remain hash-bound. No kappa change and no counterfeit construction acceptance was demonstrated.",
+  "scope": "Finite metadata audit of the selected #1094 record and verify_selected_result.py acceptance surface, plus a static scan of top-level scripts/*.py only. Not a full cold replay, Lean proof, repository-wide source scan, or GitHub authenticity theorem."
+}

research/selected-dependency-heads-audit/README.md

@@ -0,0 +1,130 @@
+# Selected dependency-head metadata is unchecked by the fast selected-record checker
+
+**Adversarial metadata audit and proposed opt-in guard; no new kappa.**
+Task card `supplier-boundary-audit`, scope **refined** to the selected record's
+dependency-head and related publication fields. Base
+`0b1cccf86e2f5132ed286a26ef0a681a495740ea`. The selected frontier, cold replay
+and `scripts/verify_selected_result.py` are **not** modified.
+
+## Finding
+
+`scripts/verify_selected_result.py` binds certificate bytes, exact κ, the
+selected source inventory and every proof supplement. It does **not** read:
+
+- `reviewed_dependency_heads`
+- `audited_source_head`
+- `source_prs`
+- `previous_kappa`
+- `status` / `scope` / `reproduce`
+
+Mutating only those fields, while leaving the certificate digest, inventory and
+supplements untouched, still yields acceptance. Among top-level Python files
+under `scripts/` (`scripts/*.py`), none mention `reviewed_dependency_heads` or
+`audited_source_head`. This package does not run `make frontier1094-verify` and
+does not claim a repository-wide source scan.
+
+**Severity: low.** This is a publication/attribution consistency gap, not a
+counterfeit construction acceptance. κ, the finite assembly and inventoried
+supplier packages remain hash-bound. Reviewers who treat the head table as
+machine-checked provenance currently over-read the checker.
+
+The published #1094 record is nevertheless internally consistent:
+
+| Check | Result |
+| --- | --- |
+| `audited_source_head` equals head of `source_prs[0]` (#1094) | yes |
+| `previous_kappa` equals `certificates/checkpoints/frontier1042.json` κ | yes |
+| All 48 reviewed head keys appear in `source_prs` | yes |
+| Shared heads with the previous checkpoint (35) | identical |
+| Shared heads with batch1099 integration `reviewed_heads` (13) | identical |
+
+Independent GitHub PR-head spot checks for #1094, #1087, #1042, #589, #858 and
+#987 matched the published digests in the session that authored this package;
+those network observations are **not** part of the offline replay.
+
+## Reproduce
+
+The audit and guard run with Python 3.10+ (standard library only). The
+registered `scripts/research_package.py` runner for this package requires
+**Python 3.12**. Prefer the copy/paste recipe below:
+
+```sh
+python3.12 -B research/selected-dependency-heads-audit/verify.py
+python3.12 -B research/selected-dependency-heads-audit/guard.py
+python3.12 -B scripts/research_package.py --package research/selected-dependency-heads-audit
+```
+
+Expected final verifier status: `PASS_SELECTED_DEPENDENCY_HEADS_AUDIT`.
+The deterministic receipt must equal [EXPECTED.json](EXPECTED.json).
+Normal verification writes no files. After an intentional code change, regenerate
+with `python3.12 -B research/selected-dependency-heads-audit/verify.py --write`.
+
+The verifier refuses `-O` (assertions must stay enabled). Positive control: the
+live selected record passes `verify_selected_result.check`. Negative control: a
+mutated `certificate_sha256` is still rejected. Four metadata mutants are
+accepted by the live checker; three head/`previous_kappa`/`source_prs` mutants
+are rejected by the proposed [guard.py](guard.py).
+
+## Proposed guard (not applied)
+
+[guard.py](guard.py) is an opt-in consistency check. It binds:
+
+1. `audited_source_head` to the reviewed head of `source_prs[0]`;
+2. every reviewed head key to membership in `source_prs` and 40-hex form;
+3. `previous_kappa` to the kappa of `previous_record`;
+4. shared heads with the previous checkpoint;
+5. optionally, shared heads with
+   `docs/research/community-batch1099-integration.json` `reviewed_heads`.
+
+It does **not** authenticate GitHub, prove a head is the reviewed mathematical
+source, or replace certificate/inventory checks. This package deliberately does
+not patch `scripts/verify_selected_result.py`; wiring the guard is a maintainer
+decision.
+
+## Task card, overlap and scope
+
+Chooser track `adversarial-audit`, nonce `1e43292e32b5524502e2a2fde0d33272`,
+card `supplier-boundary-audit`. First working command
+`research/owner-boundary-audit/verify.py` passed. Scope refined to one named
+current condition: whether selected dependency-head metadata follows from the
+actual source-bound selected-record checker.
+
+Nearest predecessors (credit retained; this package adds a different object):
+
+- [owner-boundary-audit](../owner-boundary-audit/README.md) — method pattern
+  (timing-only omission vs full controller);
+- [selected-proof-binding](../selected-proof-binding/README.md) — primary-proof
+  coverage gap in the same checker family (repaired upstream);
+- [ledger-decision-binding](../ledger-decision-binding/README.md) — considered
+  selected dependency-head consistency at an earlier base, then audited a
+  ledger failure mode instead;
+- [frontier1094-ancestry-binding-seed69](../frontier1094-ancestry-binding-seed69/README.md)
+  — reuse-mode ancestry binding; orthogonal to this metadata surface;
+- Discussion/claim #1730 — certificate/invoice/outer binding to the cold replay;
+  distinct fields and path.
+
+Advisory claim text: [CLAIM.md](CLAIM.md).
+
+## Open next questions
+
+1. **Should `verify_selected_result.py` grow an optional or mandatory dependency-head
+   consistency clause?** It matters because reviewers cite the head table as
+   provenance. First step: decide whether previous-checkpoint agreement and
+   `source_prs[0]` binding are enough, or whether integration `reviewed_heads`
+   must also be named by the selected record. Blocked by: maintainer product
+   choice; this package only supplies the mutation evidence and a draft guard.
+
+2. **Should `status` / `scope` / `reproduce` gain digest pins or schema checks?**
+   They are also unchecked, but have no local oracle in this package beyond
+   non-emptiness. First step: inventory which publication fields are machine
+   cited by downstream tooling. Blocked by: no current consumer identified among
+   top-level `scripts/*.py` during this session.
+
+## Credit and limits
+
+Prepared by Wentao Li ([VictorLiwentao](https://github.com/VictorLiwentao),
+[@Is__Victor](https://x.com/Is__Victor)) with substantial AI assistance.
+Not independent human peer review. Apache-2.0. Predecessor authors above retain
+credit for their packages and reviews. Inherited all-size/compiler, hosting,
+precision/tape, analytic and bit H1–H5 obligations are untouched. This is not a
+formal multiplication theorem. Selected frontier left unchanged.

research/selected-dependency-heads-audit/SOURCES.json

@@ -0,0 +1,36 @@
+{
+  "schema_version": 1,
+  "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+  "files": [
+    {
+      "path": "certificates/checkpoints/frontier1042.json",
+      "usage": "input",
+      "git_blob": "f451ced6626a1f03aba6915ce23a136b01ebe51d",
+      "sha256": "207d1f49f113c585024b9d3c17eadbb8b1be17c1321e3d190aabe2f18ce1c5b7"
+    },
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "input",
+      "git_blob": "ae6a99f28aa468649eb66a361e764d769363bf11",
+      "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "06c96f5579bb67ed1b86d334e78fbed7da6945f1",
+      "sha256": "6686ad58f1fbdbc87134a78901b60fd53a20d3984355e91defbbebc9e9fa8075"
+    },
+    {
+      "path": "docs/research/community-batch1099-integration.json",
+      "usage": "input",
+      "git_blob": "9d60e86c0e494d17bec5e28eda41b275c9ede64e",
+      "sha256": "684c50d1ac69863e1fcc0a34bf76c54bac576f6bbde79b3c67d8432a495c8c1c"
+    },
+    {
+      "path": "scripts/verify_selected_result.py",
+      "usage": "input",
+      "git_blob": "c755b76e0d44ba4917aa94440ebe54daefce5b2a",
+      "sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199"
+    }
+  ]
+}

research/selected-dependency-heads-audit/TASK.json

@@ -0,0 +1,69 @@
+{
+  "schema_version": 1,
+  "task_id": "supplier-boundary-audit",
+  "priority_revision": 3,
+  "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+  "chooser_seed": "1e43292e32b5524502e2a2fde0d33272",
+  "original_card": {
+    "id": "supplier-boundary-audit",
+    "question": "Does one selected supplier obligation follow from its actual source-bound checks?",
+    "starting_points": [
+      "certificates/selected-result.json",
+      "research/owner-boundary-audit/README.md"
+    ],
+    "methods": [
+      "Trace one hypothesis through the source, checker and complete caller.",
+      "Construct one semantically invalid but superficially well-formed fixture and test rejection."
+    ],
+    "acceptance_gate": "Pin the current sources and one obligation; the historical owner audit is an example, not evidence of a current bug.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "research/owner-boundary-audit/verify.py"
+      ],
+      "expected": "PASS_PR626_NEXT_TOUCH_BOUNDARY_AUDIT",
+      "inspect": "Identify why the timing-only omission passes but the full production controller still rejects it.",
+      "scope": "Positive control / source-bound orientation only; this is not a new construction or full cold replay."
+    },
+    "first_experiment": "Choose one current supplier obligation and trace whether its acceptance depends on an independent check.",
+    "bottleneck_link": "Closing a current acceptance gap or proof obligation strengthens reliability even without changing kappa.",
+    "allowed_variations": [
+      "Audit one named current condition using a new semantic counterexample."
+    ],
+    "scope_change_triggers": [
+      "Reporting the historical timing-only diagnostic as a new current acceptance bug."
+    ],
+    "overlap_terms": [
+      "owner boundary",
+      "bridge omission",
+      "hosting"
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Does acceptance of certificates/selected-result.json by scripts/verify_selected_result.py depend on an independent check of reviewed_dependency_heads, audited_source_head, source_prs and previous_kappa, or can false dependency-head metadata still pass while certificate/inventory/supplements stay intact?",
+  "scope_change_reason": "The catalogue card asks for one current supplier obligation traced through source-bound checks. The named obligation here is the selected record's dependency-head provenance table (and closely related publication fields), which reviewers treat as checked metadata. The historical owner-boundary timing omission is used only as the method pattern, not re-reported as a current bug.",
+  "bottleneck_link": "Side result on acceptance reliability: closing a provenance-metadata gap strengthens trust in the selected record without changing the binding complex/bit budgets or kappa.",
+  "budget_minutes": 60,
+  "stop_rule": "Finish the mutation audit of verify_selected_result on the named fields, the static scripts/ scan, the published consistency checks against frontier1042 and batch1099 integration reviewed_heads, and an opt-in proposed guard with positive/negative fixtures. Do not patch selected scripts or run the full cold frontier1094 replay.",
+  "outcome": "completed",
+  "evidence": "PASS_SELECTED_DEPENDENCY_HEADS_AUDIT via research/selected-dependency-heads-audit/verify.py; EXPECTED.json; proposed guard.py rejects false heads/previous_kappa/source_prs mutants that the live checker accepts.",
+  "author": "Wentao Li",
+  "github": "VictorLiwentao",
+  "email": "wentaol4@illinois.edu",
+  "ai_assistance": "Substantial AI assistance for orientation, overlap search, task selection, audit design, verifier/guard implementation, package drafting and verification. Not independent human peer review.",
+  "open_questions": [
+    {
+      "question": "Should verify_selected_result.py adopt an optional or mandatory dependency-head consistency clause along the lines of guard.py?",
+      "why_it_matters": "Reviewers currently may treat reviewed_dependency_heads as machine-checked provenance even though the fast selected-record path ignores them.",
+      "first_step": "Decide whether previous-checkpoint agreement plus source_prs[0] binding is enough, or whether integration reviewed_heads must also be named by the selected record.",
+      "blocked_by": "Maintainer product choice; this package only supplies mutation evidence and a draft guard."
+    },
+    {
+      "question": "Should status/scope/reproduce gain digest pins or schema checks?",
+      "why_it_matters": "Those publication fields are likewise unchecked by verify_selected_result.py, but this package found no top-level scripts/*.py consumer that reads them for acceptance.",
+      "first_step": "Inventory downstream tooling that cites those fields before adding pins.",
+      "blocked_by": "No current top-level scripts/*.py acceptance consumer identified in this session."
+    }
+  ]
+}