Authenticate accepted source updates in historical reconciliation checks

.github/workflows/community-tooling799.yml

@@ -1,8 +1,8 @@
 name: Community exact tooling and scoped audits
 on:
   workflow_dispatch:
+  # Keep these path-scoped checks available on contributor fork branches.
   push:
-    branches: [main]
     paths:
       - 'research/clifford-state-performance/**'
       - 'research/gram-prefix-performance/**'
@@ -11,6 +11,10 @@ on:
       - 'research/sw4-owner-optimality/**'
       - 'research/pr695-digest-audit/**'
       - 'scripts/verify_pr_reconciliation.py'
+      - 'scripts/replay_historical_check.py'
+      - 'scripts/historical-ci-inputs/**'
+      - 'tests/test_pr_reconciliation.py'
+      - 'tests/test_historical_check.py'
       - 'tests/test_reconciliation_archive.py'
       - '.github/workflows/community-tooling799.yml'
   pull_request:
@@ -22,6 +26,10 @@ on:
       - 'research/sw4-owner-optimality/**'
       - 'research/pr695-digest-audit/**'
       - 'scripts/verify_pr_reconciliation.py'
+      - 'scripts/replay_historical_check.py'
+      - 'scripts/historical-ci-inputs/**'
+      - 'tests/test_pr_reconciliation.py'
+      - 'tests/test_historical_check.py'
       - 'tests/test_reconciliation_archive.py'
       - '.github/workflows/community-tooling799.yml'
 permissions:
@@ -53,6 +61,7 @@ jobs:
       - name: Current ledger and archive integrity controls
         run: |
           python -B scripts/verify_pr_reconciliation.py
+          python -B -m unittest discover -s tests -p 'test_historical_check.py' -v
           python -B -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
           python -B -O -m unittest discover -s tests -p 'test_*reconciliation*.py' -v
       - run: git diff --exit-code

.github/workflows/verify.yml

@@ -37,7 +37,8 @@ jobs:
       - name: Check arithmetic, source hashes, finite identities, and patches
         run: |
           if [ "${{ matrix.group }}" = clones ]; then
-            make skip-clones-verify split-skip-producer
+            python -B scripts/replay_historical_check.py skip-clones
+            make split-skip-producer
             python -B scripts/replay_historical_check.py split-skip
           else
             make verify-${{ matrix.group }}

scripts/historical-ci-inputs/README.md

@@ -3,7 +3,7 @@
 These are exact Git blobs, not new source pins or changes to the selected result.
 The maintenance launcher `scripts/replay_historical_check.py` verifies each blob
 against its unchanged predecessor manifest, copies tracked working files into a
-temporary tree, replaces just the declared historical input there, and executes
+temporary tree, replaces only the declared historical inputs there, and executes
 the original checkers. It works with shallow CI checkouts and changes no live
 source file. The live Makefile must still preserve its entire authenticated
 historical prefix; appended targets are allowed, prefix mutations reject. All other inputs remain the current tracked working
@@ -19,6 +19,16 @@ reproducibility gate as well as protecting the live checkout.
 | `Makefile` | `Makefile` | `b84ba67156a01f9c2cb34fe1e3cb1dcdeab00d9c` | `research/community-reconciliation92-audit/MANIFEST.json` |
 | `audit_fused_block.py` | `scripts/audit_fused_block.py` | `6e564879f51ae16f23d392e9e196c605f36d90df` | `research/split-skip/SOURCE.json` |
 
+The split-skip replay restores all three exact helpers named by its unchanged
+manifest: the fused-block snapshot above, the exclusion circuit preserved in
+`research/exclusion-embedding-masks/baseline.py`, and the shared-point circuit
+preserved in `research/shared-point-digest/baseline.py`. The latter two are
+Wentao Li's retained baselines for the accepted support-mask and digest
+optimizations. Both also match the PR53 parent `3ffd4021995c959ac02d12920e0279ae97dd03c7`.
+Each replacement and reviewed live successor is independently authenticated;
+missing pins, corrupted baselines, duplicate paths, untracked dependencies and
+unknown live source changes reject before copying. No original checker is edited.
+
 Use `python3 -B scripts/replay_historical_check.py r420` (add `--native` for
 C++17/Boost), `reconciliation92`, or `split-skip`. These check historical finite
 constructions/provenance; they do not recertify the current selected supplier or

scripts/replay_historical_check.py

@@ -48,6 +48,53 @@
 }
 
 
+# Keep PR53's frozen source pin intact while replaying against the reviewed
+# successor of the faster exclusion support-mask checker. Original exact bytes
+# are retained by the linked baseline package (Wentao Li / VictorLiwentao).
+# Dennis with substantial OpenAI Codex assistance; Apache-2.0.
+CONFIG['skip-clones'] = {
+    'manifest': 'research/skip-clones/SOURCE.json',
+    'field': 'files',
+    'path': 'scripts/exclusion_circuit.py',
+    'input_from_root': True,
+    'input': 'research/exclusion-embedding-masks/baseline.py',
+    'sha256': 'b253f9d7318becda1c1f3b24e2287ed44a9c27fcea00cf9d531afb950d0457a0',
+    'accepted_live_sha256': [
+        'f9fbcd6e85e442cbd0926ac0887414e20735b2dc923d2d5822c803ceb46726d3',
+    ],
+    'commands': [
+        ['research/skip-clones/producer.py'],
+        ['research/skip-clones/witness.py', '--output',
+         'research/skip-clones/certificate.json'],
+        ['-m', 'unittest', 'discover', '-s', 'tests',
+         '-p', 'test_skip_clones.py', '-v'],
+    ],
+}
+CONFIG['skip-clones-tests'] = {
+    **CONFIG['skip-clones'],
+    'commands': [CONFIG['skip-clones']['commands'][-1]],
+}
+
+
+# The split-skip manifest binds three historical helpers. Restore each exact
+# dependency, retaining Wentao Li's two optimized live successors unchanged.
+CONFIG['split-skip']['accepted_live_sha256'] = [
+    '6fe64f886309d9154e33a3d67a16e8714cebc424a7a248b3080f8cab7d94179b',
+]
+CONFIG['split-skip']['additional_inputs'] = [
+    {**CONFIG['skip-clones'], 'manifest': 'research/split-skip/SOURCE.json'},
+    {
+        'manifest': 'research/split-skip/SOURCE.json', 'field': 'files',
+        'path': 'scripts/shared_point_circuit.py', 'input_from_root': True,
+        'input': 'research/shared-point-digest/baseline.py',
+        'sha256': 'c9bb7a5df92d260a4e3ad532b53e26936730d7c93f7facfb0784957c1e81c8ba',
+        'accepted_live_sha256': [
+            'f5abbf6d61f3c10349416a3e1a1ed038bbd1279ed223367f2df549de46dd7ea5',
+        ],
+    },
+]
+
+
 def require(condition, message):
     if not condition:
         raise ValueError(message)
@@ -67,7 +114,13 @@ def authenticated_input(root, config, inputs=INPUTS):
         require(entry.get('representation') == 'bytes', 'Expected exact byte representation')
         entry = entry.get('sha256')
     require(entry == config['sha256'], 'Missing or changed predecessor source pin')
-    data = safe_path(inputs, config['input']).read_bytes()
+    # A replay must not hide an unrelated live source mutation.
+    if 'accepted_live_sha256' in config:
+        live = hashlib.sha256(safe_path(root, config['path']).read_bytes()).hexdigest()
+        require(live in (config['sha256'], *config['accepted_live_sha256']),
+                'Unrecognized live source update: ' + config['path'])
+    input_root = root if config.get('input_from_root') else inputs
+    data = safe_path(input_root, config['input']).read_bytes()
     require(hashlib.sha256(data).hexdigest() == entry, 'Changed historical input')
     if config.get('preserve_prefix'):
         require(data.endswith(b'\n') and safe_path(root, config['path']).read_bytes().startswith(data),
@@ -82,9 +135,16 @@ def tracked_paths(root):
 
 def materialize(root, destination, config, paths, inputs=INPUTS):
     """Copy tracked working bytes only; never share writable links with the checkout."""
-    data = authenticated_input(root, config, inputs)
-    require(config['path'] in paths and config['manifest'] in paths,
-            'Historical input or manifest is not tracked')
+    configurations = [config, *config.get('additional_inputs', [])]
+    replacements = {}
+    for entry in configurations:
+        require(entry['path'] not in replacements, 'Duplicate historical replacement')
+        data = authenticated_input(root, entry, inputs)
+        require(entry['path'] in paths and entry['manifest'] in paths,
+                'Historical input or manifest is not tracked')
+        if entry.get('input_from_root'):
+            require(entry['input'] in paths, 'Historical baseline is not tracked')
+        replacements[entry['path']] = data
     require(not destination.exists(), 'Replay destination already exists')
     destination.mkdir(parents=True)
     expected = {}
@@ -95,10 +155,12 @@ def materialize(root, destination, config, paths, inputs=INPUTS):
         target.parent.mkdir(parents=True, exist_ok=True)
         shutil.copyfile(source, target)
         expected[name] = hashlib.sha256(target.read_bytes()).hexdigest()
-    safe_path(destination, config['path']).write_bytes(data)
-    expected[config['path']] = config['sha256']
-    # Authenticate again in the copied tree before executing any checker.
-    authenticated_input(destination, config, inputs)
+    for entry in configurations:
+        safe_path(destination, entry['path']).write_bytes(replacements[entry['path']])
+        expected[entry['path']] = entry['sha256']
+    # Authenticate every replacement again before executing any checker.
+    for entry in configurations:
+        authenticated_input(destination, entry, inputs)
     return expected
 
 

scripts/run_isolated_tests.py

@@ -10,6 +10,8 @@
 --workers controls the width). Every module keeps the exact sequential
 command and its captured stdout/stderr bytes are replayed in sorted module
 order, so the combined receipts match a sequential run module for module.
+For PR53 skip-clones, the unchanged module command runs in a temporary
+copy with its authenticated frozen source instead of the optimized successor.
 """
 import argparse
 from concurrent.futures import ThreadPoolExecutor
@@ -22,7 +24,7 @@
 
 
 def module_command(python, tests_dir, name):
-    """The one command every module runs, unchanged from the sequential runner."""
+    """Default unchanged command for a test module."""
     return [python, '-m', 'unittest', 'discover', '-s', str(tests_dir), '-p', name, '-v']
 
 
@@ -45,7 +47,17 @@ def run_modules(files, python=None, tests_dir=None, cwd=None, workers=None):
     env.pop('PYTHONOPTIMIZE', None)
 
     def run_one(path):
-        result = subprocess.run(module_command(python, tests_dir, path.name),
+        command = module_command(python, tests_dir, path.name)
+        # Run this frozen package's original tests in its authenticated overlay.
+        # Other test modules continue to exercise the live checkout unchanged.
+        if (path.name == 'test_skip_clones.py'
+                and Path(tests_dir).resolve() == (ROOT / 'tests').resolve()
+                and Path(cwd).resolve() == ROOT.resolve()
+                and (ROOT / 'research/skip-clones/SOURCE.json').is_file()
+                and (ROOT / 'scripts/replay_historical_check.py').is_file()):
+            command = [python, '-B', str(ROOT / 'scripts/replay_historical_check.py'),
+                       'skip-clones-tests']
+        result = subprocess.run(command,
                                 cwd=cwd, env=env,
                                 stdout=subprocess.PIPE, stderr=subprocess.PIPE)
         return path, result.returncode, result.stdout, result.stderr

scripts/verify_pr_reconciliation.py

@@ -8,6 +8,8 @@
 import tempfile
 import json
 import zipfile
+import subprocess
+import sys
 
 ROOT = Path(__file__).resolve().parents[1]
 AUDIT = ROOT / 'research/pr-reconciliation-20261012'
@@ -33,6 +35,65 @@ def check_batch1047_file(item):
     require(original.endswith(b'\n') and current.startswith(original), 'Historical Makefile content changed')
 
 
+def check_frontier890_file(item):
+    """Authenticate the exact spectrum pin refresh accepted in 02c46c7e.
+
+    Preserve the frozen frontier890 receipt. Sagar Thakrar's refresh changed
+    only the single_intersection.py source digest in SOURCE.json and RESULT.json;
+    every other byte, including all 41 mathematical cases, must still match.
+    Dennis with substantial OpenAI Codex assistance; Apache-2.0.
+    """
+    name = item['integrated_path']
+    current = (ROOT / name).read_bytes()
+    if hashlib.sha256(current).hexdigest() == item['integrated_sha256']:
+        return
+    predecessors = {
+        'research/single-intersection-spectrum-audit/RESULT.json':
+            '9cb2210e148b2cce3fe59cf529fbf99f3b663dc7673db2e3969246595692f580',
+        'research/single-intersection-spectrum-audit/SOURCE.json':
+            '610fb9887add31b4f597a39dc58b3beff0e14c91a5fd7ee340c3b2e7d4b0fb4c',
+    }
+    require(name in predecessors and item['integrated_sha256'] == predecessors[name],
+            'Changed integrated file: ' + name)
+    old = b'08ddae46e5621a5b4c525b504e67ae655abe9b49461d894feaa7abc89a51847d'
+    new = b'6874d41b75590369182ed61e0c6da5b547e035e0e43b50ea2b39e1f3861dca6d'
+    source = 'scripts/experiments/single_intersection.py'
+    require(hashlib.sha256((ROOT / source).read_bytes()).hexdigest().encode() == new,
+            'Changed spectrum successor source')
+    require(json.loads(current)['source_sha256'][source].encode() == new
+            and current.count(new) == 1, 'Changed spectrum source pin')
+    require(hashlib.sha256(current.replace(new, old)).hexdigest() == predecessors[name],
+            'Changed spectrum evidence beyond the accepted source pin')
+
+
+def check_batch932_file(item):
+    """Bind exact assertion-safety and historical replay runner successors.
+
+    Credit woklerx for keeping assertions enabled in child research processes.
+    These two exact successor blobs are an explicit maintenance adaptation,
+    not permission to change any other bytes or the frozen batch932 receipt.
+    Also authenticate the exact PR53 replay adapter and its test from c58c1778;
+    this extension retains the earlier assertion guard and every module.
+    """
+    name = item['integrated_path']
+    digest = hashlib.sha256((ROOT / name).read_bytes()).hexdigest()
+    if digest == item['integrated_sha256']:
+        return
+    successors = {
+        'scripts/run_isolated_tests.py': (
+            '96ea543e6c707424afe247e77bd86c82152f90fc76a0773c4232145da5cdf8d1',
+            ('b1c645e815a6abfbfdc2d77c4121c543ed0ca958095e97e1181d64e84cac0ed8',
+             '05839996482058359b2ab8087d7d96e76934bd03d79981df9b99447e8ed09331')),
+        'tests/test_isolated_test_runner.py': (
+            '628391b6abfbc8674ceec1751867a4392f2cc0b5b66886243e139af86cf355ac',
+            ('8262f36202e426b849a925123ff789843115d5e564962710c31ab14f84c88067',
+             '6f5ad20a5f174be0aab874cf524cba01c5401dafa46dd176999bad43ab566522')),
+    }
+    require(name in successors and successors[name][0] == item['integrated_sha256']
+            and digest in successors[name][1],
+            'Changed integrated file: ' + name)
+
+
 def check_family_decision(item, decision):
     """Bind projected ledger state to its authoritative, pinned family decision."""
     fields = ('number', 'reviewed_head', 'current_head', 'disposition',
@@ -416,8 +477,7 @@ def main():
                 if item['action'] == 'pending':
                     require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review')
                 if item.get('integrated_sha256'):
-                    require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest()
-                            == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path'])
+                    check_frontier890_file(item)
                 if item['action'] != 'retained':
                     require(bool(item.get('reason')), 'Missing scope or adaptation reason')
         print('PASS frontier890 batch: reviewed sources, finite replays, scoped claims and closure bindings')
@@ -444,8 +504,7 @@ def main():
                 if item['action'] == 'pending':
                     require(not decision['review_completion']['changed_file_coverage'], 'Incomplete review')
                 if item.get('integrated_sha256'):
-                    require(hashlib.sha256((ROOT / item['integrated_path']).read_bytes()).hexdigest()
-                            == item['integrated_sha256'], 'Changed integrated file: ' + item['integrated_path'])
+                    check_batch932_file(item)
                 if item['action'] != 'retained':
                     require(bool(item.get('reason')), 'Missing scope or adaptation reason')
         print('PASS batch932 batch: reviewed sources, finite replays, scoped claims and closure bindings')
@@ -573,7 +632,10 @@ def main():
         runpy.run_path(str(historical_five), run_name='__main__')
     reconciliation92 = ROOT / 'research/community-reconciliation92-audit/verify.py'
     if reconciliation92.exists():
-        runpy.run_path(str(reconciliation92), run_name='__main__')
+        # The original checker binds the pre-PR154 Makefile. Reuse the
+        # authenticated isolated replay rather than weakening that pin.
+        subprocess.run([sys.executable, '-B', str(ROOT / 'scripts/replay_historical_check.py'),
+                        'reconciliation92'], cwd=ROOT, check=True)
     third100 = ROOT / 'research/community-reconciliation-third100-audit/verify.py'
     if third100.exists():
         runpy.run_path(str(third100), run_name='__main__')