Selected binding coverage: which check pins each consumed source? (scoped adversarial audit, no new kappa)

research/selected-binding-coverage-seeda342/EXPECTED.json

@@ -0,0 +1,172 @@
+{
+  "binding_counts": {
+    "NONE": 4,
+    "checkpoint-self-binding": 1,
+    "manifest-roots-inventory": 8,
+    "record-certificate-sha256": 1,
+    "record-proof-supplement": 5,
+    "record-root-of-trust": 1
+  },
+  "consumed": [
+    {
+      "binding": "record-root-of-trust",
+      "cls": "fast-path",
+      "exists": true,
+      "path": "certificates/selected-result.json",
+      "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32"
+    },
+    {
+      "binding": "record-certificate-sha256",
+      "cls": "fast-path",
+      "exists": true,
+      "path": "research/community-frontier1094-audit/ASSEMBLY.json",
+      "sha256": "1122cb3a575f8c788345fc1bf4c108ac7c3250fb81a5988671f5eb04b3ab3045"
+    },
+    {
+      "binding": "NONE",
+      "cls": "fast-path",
+      "exists": true,
+      "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json",
+      "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b"
+    },
+    {
+      "binding": "record-proof-supplement",
+      "cls": "fast-path",
+      "exists": true,
+      "path": "docs/research/community-batch1099-review.md",
+      "sha256": "7e76d2c38e5fce30587835b7251df1430488ae4dd372611ef69a3f03f476b6cb"
+    },
+    {
+      "binding": "NONE",
+      "cls": "fast-path",
+      "exists": true,
+      "path": "docs/research/community-batch1099-integration.json",
+      "sha256": "684c50d1ac69863e1fcc0a34bf76c54bac576f6bbde79b3c67d8432a495c8c1c"
+    },
+    {
+      "binding": "NONE",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "scripts/verify_selected_result.py",
+      "sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199"
+    },
+    {
+      "binding": "record-proof-supplement",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "scripts/verify_frontier1094.py",
+      "sha256": "c7e20f59968ed5736fb859735de4de207de3418083e37012310ebcded946b949"
+    },
+    {
+      "binding": "record-proof-supplement",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "scripts/verify_frontier1042.py",
+      "sha256": "700fdcaeb6e8f57f6e63c71c2dd1652fc5b183e8d706cd092779bdc0d271e854"
+    },
+    {
+      "binding": "record-proof-supplement",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "scripts/verify_replay_coverage.py",
+      "sha256": "babe5941d7e6dac4248613ef01f950ee7bb6199e7355021aea4cf854fd1b91c5"
+    },
+    {
+      "binding": "checkpoint-self-binding",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "certificates/checkpoints/frontier1042.json",
+      "sha256": "207d1f49f113c585024b9d3c17eadbb8b1be17c1321e3d190aabe2f18ce1c5b7"
+    },
+    {
+      "binding": "NONE",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "research/community-frontier1042-audit/RESULT.json",
+      "sha256": "bf12c6ed3b412539638b76addb40591a631609b2ab9e5ee0db1f6bbe067d0ec0"
+    },
+    {
+      "binding": "record-proof-supplement",
+      "cls": "reproduce-driver",
+      "exists": true,
+      "path": "research/community-batch1099-audit/check_frontier1094.py",
+      "sha256": "2608ef213260a43d09a40b3429742f7a5f280861b54acae66400a7c29a123f51"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/verify.py",
+      "sha256": "b8c2f76b305c5c9ceb42df203deef564857d17f1f8182d0745dda9ab96e3d4de"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/MANIFEST.json",
+      "sha256": "16a964621e718c8da4c859ccbb280c3c00816ca72874e955910fdf0ef27a0adc"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/SOURCE.json",
+      "sha256": "4cfd44cebfe88f4450294239fbea8feecb564338dc3027b76065227f5d19cb6f"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/CANDIDATE.json",
+      "sha256": "e5fe28718bd517bbb2e9cd377778bf76bd89012b71e48889784ea45e4dfd7dd4"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz",
+      "sha256": "d4acf04daef85d4514f80ec5fcd2492d0c60e5d6c49fa71b3e6523f8db2dea86"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/data/OWNERS.json.gz",
+      "sha256": "87902c528dfab7d503dcf8a784260e3ab6fb7424c418a1820f7261f25be7b6bc"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/data/PLAN.json",
+      "sha256": "7bd786ba8e66408f02aa9ef446eaf20c1bfe981ea2e4dd1e5a929f0aa7767bc0"
+    },
+    {
+      "binding": "manifest-roots-inventory",
+      "cls": "frozen-complex-chain",
+      "exists": true,
+      "path": "research/complex-t16-rare-pattern-exchanges/data/SPEC.json",
+      "sha256": "8cb51f25a5da4a29d3783853025b73ff1f452429d4fdb30c599e598bcab0e71d"
+    }
+  ],
+  "fixtures": {
+    "consistent_manifest_forgery_accepted": true,
+    "decimal_mutation": "Selected decimal differs from exact kappa",
+    "existence_only_mutation_accepted": true,
+    "healthy_accepted": true,
+    "inventory_mutation": "Selected package inventory or bytes changed",
+    "supplement_mutation": "Selected proof supplement changed: research/toy-side/PROOF.md",
+    "unbound_sidecar_accepted": true,
+    "uncovered_proof": "Selected primary proof is not covered by a verified digest"
+  },
+  "script_literals_outside_enumeration": [],
+  "selected_record_sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32",
+  "selected_source_sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b",
+  "status": "PASS_SELECTED_BINDING_COVERAGE_AUDIT",
+  "unbound_consumed": [
+    "docs/research/community-batch1099-integration.json",
+    "research/community-frontier1042-audit/RESULT.json",
+    "research/community-frontier1094-audit/SELECTED-SOURCE.json",
+    "scripts/verify_selected_result.py"
+  ]
+}

research/selected-binding-coverage-seeda342/README.md

@@ -0,0 +1,134 @@
+# Selected binding coverage: which check pins each consumed source?
+
+**Scoped adversarial audit of one acceptance obligation; no new kappa.** The
+selected record carries a `source_manifest` whose inventory check ("Selected
+package inventory or bytes changed") is what binds the audited supplier
+sources. This package traces that obligation to its actual source-bound checks:
+for every repository input consumed by the selected fast acceptance
+(`scripts/verify_selected_result.py`) and by the documented reproduce driver
+(`scripts/verify_frontier1094.py`, including its `--baseline1042` reuse mode and
+the frozen `research/complex-t16-rare-pattern-exchanges` chain), it names the
+check that pins the bytes, and it exercises the real `check()` acceptance
+function on fixtures that are semantically invalid but superficially
+well-formed.
+
+Prepared by **Aaron Wang**, with help from opencode. Apache-2.0. Substantial AI
+assistance is disclosed in [TASK.json](TASK.json); this is not independent human
+review.
+
+## Reproduce
+
+From the repository root, standard library only (Python 3.10+; the registered
+replay uses 3.12):
+
+```sh
+python3 -B research/selected-binding-coverage-seeda342/verify.py
+```
+
+Expected final line:
+
+```text
+PASS_SELECTED_BINDING_COVERAGE_AUDIT unbound=4 fixtures=7
+```
+
+## Result
+
+Of the 20 consumed repository inputs:
+
+| Binding class | Count | Examples |
+| --- | ---: | --- |
+| manifest-roots inventory (1,579 pinned files over 13 package roots) | 8 | the whole frozen complex chain, including `upstream1087.tar.gz` |
+| record `proof_supplements` digests | 5 | `verify_frontier1094.py`, `verify_frontier1042.py`, `verify_replay_coverage.py`, `check_frontier1094.py`, the batch1099 review |
+| record `certificate_sha256` | 1 | `ASSEMBLY.json` |
+| checkpoint self-binding (its own record re-enters `check()`) | 1 | `certificates/checkpoints/frontier1042.json` |
+| record root of trust | 1 | `certificates/selected-result.json` |
+| **NONE** | 4 | see below |
+
+The four unbound consumed inputs:
+
+1. `research/community-frontier1094-audit/SELECTED-SOURCE.json` — the inventory
+   anchor itself. `check()` binds all 1,579 inventory files to the manifest's
+   digest list, but the record has no `source_manifest_sha256`, so the manifest's
+   own bytes are read unverified. Fixture 7 shows the consequence: a
+   semantically invalid but superficially well-formed forgery that changes an
+   inventory file **and** the manifest digest list consistently passes the
+   acceptance unchanged.
+2. `scripts/verify_selected_result.py` — the acceptance checker's own bytes are
+   pinned by no record-level check (root-of-trust observation).
+3. `research/community-frontier1042-audit/RESULT.json` — the published baseline
+   receipt that `verify_frontier1094.py --baseline1042` compares its supplied
+   work directory against. The comparison target is unbound at record level; the
+   receipt's *claims* are still constrained downstream (the driver checks its
+   stage list, kappa constant and recorded script hashes against the live
+   repository scripts), but the anchor bytes are trusted.
+4. `docs/research/community-batch1099-integration.json` — an existence-only
+   publication pointer by documented design ("Other publication pointers retain
+   their existence check").
+
+## Fixtures (through the real `check()` of `scripts/verify_selected_result.py`)
+
+| Fixture | Outcome | Exact error / note |
+| --- | --- | --- |
+| healthy synthetic record | accepted | — |
+| mutate one manifest-inventory file | rejected | `Selected package inventory or bytes changed` |
+| mutate one proof-supplement file | rejected | `Selected proof supplement changed: ...` |
+| proof with no covering digest | rejected | `Selected primary proof is not covered by a verified digest` |
+| wrong `decimal` | rejected | `Selected decimal differs from exact kappa` |
+| mutate existence-only pointer | **accepted** | documented boundary |
+| mutate unbound sidecar | **accepted** | no check covers it |
+| consistent manifest-anchor forgery | **accepted** | the pin mechanism cannot bind its own anchor |
+
+So the obligation "the audited sources are the consumed sources" does follow
+from source-bound checks for the entire frozen supplier payload (all 1,579
+manifest files, both upstream archives via package MANIFEST self-pins, and the
+five pinned harness scripts), and does not follow for the four items above. No
+selected certificate, supplier, or frontier value is affected; this changes no
+kappa.
+
+## Scope, method and controls
+
+- Exact base `0b1cccf86e2f5132ed286a26ef0a681a495740ea`; selected-record SHA-256
+  `10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32`.
+  Pins: [SOURCES.json](SOURCES.json); task card: [TASK.json](TASK.json).
+- The consumed set is enumerated from the pinned scripts' literal path reads and
+  subprocess calls. A control regex-scans both pinned scripts for path literals
+  resolving to repository files and requires every one to sit inside the
+  enumeration or the record's `proof_supplements`; the receipt records the
+  (empty) remainder.
+- Fixtures run the imported production `check()` in a temporary directory; the
+  working tree is read-only. The receipt is deterministic and compared to
+  [EXPECTED.json](EXPECTED.json).
+- Not checked: the mathematical content of any supplier obligation, the full
+  cold replay (`make frontier1094-verify`, whose make target could not run on
+  this host; make is not installed), CI, and any proposed record change. The
+  enumeration covers the fast acceptance and the documented reproduce driver;
+  deeper frozen-chain internals are classified by their package pins, not
+  line-audited.
+
+## Nearest prior work and what this adds
+
+`research/selected-source-coverage-audit` (seed 97 consolidation note) maps
+*review* coverage of the selected record's `source_prs` list against the PR
+ledger; it asks whether dispositions exist. This package asks a different
+question: which check pins the *bytes* of each consumed input, with fixtures
+against the live acceptance function. `research/frontier1094-ancestry-binding-seed69`
+(Sagar Thakrar) reproduces the PR799/PR741 ancestry binding of the reuse path
+through `check_selected`; that binding is counted here as `checkpoint-self-binding`
+and not re-audited. `research/retained-bit-supplier-binding` guards the bit
+supplier identity across committed assemblies; this package does not touch that
+identity. Credit to the `research/owner-boundary-audit` line (Tekalign) for the
+"trace one obligation, then try to break it with one fixture" method.
+
+## Open next questions
+
+- **Should the selected record pin the bytes of its source manifest?**
+  Why it matters: the inventory anchor is currently trusted, and fixture 7
+  shows a consistent forgery passes. First step: add `source_manifest_sha256`
+  to `certificates/selected-result.json` and one `require()` in
+  `scripts/verify_selected_result.py`. Blocked by: maintainer authorization to
+  change the selected record and its acceptance script.
+- **Should the `--baseline1042` comparison target and the acceptance checker
+  itself be record-pinned?** Why it matters: both are unbound anchors of the
+  documented acceptance. First step: add the two digests to `proof_supplements`
+  and re-run this trace. Blocked by: maintainer authorization, and a decision
+  on whether a checker should pin itself inside the record it verifies.

research/selected-binding-coverage-seeda342/SOURCES.json

@@ -0,0 +1,31 @@
+{
+ "base_commit": "0b1cccf86e2f5132ed286a26ef0a681a495740ea",
+ "files": [
+  {
+   "git_blob": "ae6a99f28aa468649eb66a361e764d769363bf11",
+   "path": "certificates/selected-result.json",
+   "sha256": "10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32",
+   "usage": "input"
+  },
+  {
+   "git_blob": "6a75493790b4eff9c4a98051ef8b01d6aad0d5a8",
+   "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json",
+   "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b",
+   "usage": "input"
+  },
+  {
+   "git_blob": "c755b76e0d44ba4917aa94440ebe54daefce5b2a",
+   "path": "scripts/verify_selected_result.py",
+   "sha256": "d7fd929726b326aeeaf0a3996475adec88eee9aac09ae0bebeeaa0bc1fc8f199",
+   "usage": "input"
+  },
+  {
+   "git_blob": "06c96f5579bb67ed1b86d334e78fbed7da6945f1",
+   "path": "docs/research/agent-task-catalog.json",
+   "sha256": "6686ad58f1fbdbc87134a78901b60fd53a20d3984355e91defbbebc9e9fa8075",
+   "usage": "provenance"
+  }
+ ],
+ "note": "Pins are Git blobs and SHA-256 at the exact base commit. The consumed-input classification target is certificates/selected-result.json plus its SELECTED-SOURCE.json inventory; scripts/verify_selected_result.py provides the real check() acceptance function used by the fixtures. The task catalogue is pinned for card provenance only.",
+ "schema_version": 1
+}