Audit Windows path-key rejection in selected PR1094 manifests

research/selected1094-windows-manifest-audit/README.md

@@ -0,0 +1,131 @@
+# Selected PR1094: Windows manifest-key admission failure
+
+**Reproduced portability defect and tested repair candidate. No new kappa.**
+The unchanged selected final-stage entry point stops on native Windows before
+creating its output directory: `Submission file inventory or hash changed`.
+All file bytes match their pins. Its two inventory guards serialize relative
+paths with `str(...)`, producing backslashes instead of the manifest's `/`.
+
+At canonical main `0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2`,
+`research/complex-t16-rare-pattern-exchanges/verify.py` has this problem at
+lines 9–10 (submission) and 18 (extracted upstream archive).
+
+| Guard | Pinned payload files | Keys whose spelling changes | Digest mismatches |
+| --- | ---: | ---: | ---: |
+| Submission | 13 | 3 | 0 |
+| Extracted PR1087 archive | 179 | 160 | 0 |
+
+For example, the unchanged `data/PLAN.json` becomes `data\PLAN.json` on
+Windows. The second guard is independently executed on the authenticated
+archive: it has the same defect, although the unmodified full entry point
+cannot reach it on Windows because the first guard fails.
+
+## Repair candidate and coverage
+
+Replace `str(f.relative_to(P))` with `f.relative_to(P).as_posix()`, and make
+the corresponding change for `source` in the second guard. The audit applies
+these two substitutions **only to separately compiled in-memory guard ASTs**.
+It changes neither the selected script nor its manifest, archive or source pins.
+This is a reviewable repair candidate, not an installed production repair.
+
+The test executes the actual pinned assignments/assertions. Filesystem
+enumeration and SHA-256 reads are real; the cross-platform models replace only
+the string conversion of a relative path. Both original guards accept POSIX
+spelling and reject Windows spelling. Both corrected guards accept the
+unchanged fixtures. Native guard execution agrees with the host's path model.
+On Windows, a child process also runs the unmodified original entry point and
+requires the exact first-guard failure before output-directory creation.
+
+All 192 payloads are then individually changed and individually omitted on
+disk while the original manifests remain fixed. Two extra-file and two
+same-bytes rename controls also reject. Three additional controls corrupt the
+immutable wrapper script, its manifest, or its archive and require source-pin
+rejection before code evaluation: **391 rejections total**. Fixtures are
+restored and checked again. The frozen assertions are compiled with
+`optimize=0`, so the audit's own `-O` run retains their checks.
+
+For this fixed, authenticated inventory, the repair is a bijective spelling
+change: canonical names have no backslashes, colons, absolute prefixes or dot
+components; their Windows spellings are distinct. The enumerated files,
+exclusion predicates, raw SHA-256 values and exact dictionary-equality
+conditions are otherwise identical. This establishes the coverage of these
+two guards, not a generic path sanitizer or a mathematical supplier proof.
+
+## Reproduce
+
+From a checkout containing the pinned inputs (Python 3.12, standard library):
+
+```sh
+python3.12 -I -O -B research/selected1094-windows-manifest-audit/verify.py
+python3.12 scripts/research_package.py --package research/selected1094-windows-manifest-audit --check-only
+python3.12 scripts/research_package.py --package research/selected1094-windows-manifest-audit
+```
+
+Expected marker:
+
+```text
+PASS_SELECTED1094_WINDOWS_MANIFEST_AUDIT guards=2 files=192 controls=391 no_new_kappa
+```
+
+`RESULT.json` records deterministic evidence, including every affected key.
+`SOURCES.json` pins all 14 wrapper-package files and the frozen selected source
+manifest; the selected record and catalogue are historical provenance.
+The archive's complete member hashes are also checked against its original
+manifest and PR1087 source inventory. The direct verifier does not need Git;
+the repository metadata checker uses the pinned base commit.
+
+The optional `--root` accepts a relocated minimal source export. `--report`
+writes host-specific observations separately from the deterministic receipt.
+`--write` regenerates the receipt only after the same checks have passed.
+
+## Local evidence and limits
+
+The investigation ran on native Windows with CPython 3.12.14. The original
+PR1824 portability caller failed at the first manifest guard. Separately,
+`scripts/research_baseline.py` passed after invoking its path with the Windows
+extended-length prefix: that verified all 1,579 selected input files and
+retained the selected kappa `836330098538459/500000000000000000`.
+The ordinary long workspace path initially caused Python to omit overlong
+paths; this environmental setup issue is distinct from the reproduced
+separator defect, which also occurs in short temporary directories.
+
+See `VALIDATION.json` for executed commands and results. The local sandbox
+requires a writable temporary directory; the runs set process-local `TEMP`
+and `TMP` to a workspace directory, using its extended-length Windows path.
+Neither system settings nor repository inputs were changed.
+
+No complete final-stage, cold ancestry, native mathematical supplier, Linux,
+macOS or hosted-CI replay is claimed. Pure-path models are not OS execution.
+PR2040/2059/2101 cover payload equivalence and reference binding downstream of
+these guards; their results are credited, not repeated or replaced here.
+
+## Open next questions
+
+Run a separately versioned successor wrapper with the two POSIX-key changes,
+then diagnose its next Windows failure while retaining all assertions and
+strict complete-output comparisons. This matters because inventory success
+alone is not supplier admission. The first step is to bind the successor to
+the original source and record its two-line delta. Full downstream execution
+is outside this audit's bounded scope; see the structured question in
+`TASK.json`.
+
+## Credit and overlap
+
+Rohan Arun supplied PR1094; Jeremy Kothe supplied the frozen PR1087 strict
+verifier, with Hao Yan's T16 controller and the retained supplier lineage.
+Douglas Colkitt supplied the selected driver and review records. Josie
+Elliston's PR1824 posed the Windows replay question. Maxime Fleury and Antoine
+Olivier established the payload/container convention. Credit commdata2338's
+PR2040 and Adam Gall's PR2059/2101 for later comparator and reference work.
+
+The one-shot assignment selected verifier engineering, nonce
+`effac00be71b189171c4803530783d88`, priority revision 4. `TASK.json` records
+the refined card, method choice, predecessor heads and partial overlap
+coverage. The local overlap helper lacked authenticated `gh`; supplemental
+live PR searches and Discussion reads do not imply a complete-board search.
+No advance public claim was posted.
+
+Prepared for `josecarlosgonzalezroque-design` with substantial OpenAI Codex
+assistance in investigation, implementation, testing and writing. Self-reviewed;
+no independent human review claimed. New work Apache-2.0. All predecessor
+licenses, frozen files and selected-frontier metadata are unchanged.

research/selected1094-windows-manifest-audit/RESULT.json

@@ -0,0 +1,197 @@
+{
+  "status": "PASS_SELECTED1094_WINDOWS_MANIFEST_AUDIT",
+  "guards": {
+    "submission": {
+      "files": 13,
+      "nested_keys": [
+        "data/OWNERS.json.gz",
+        "data/PLAN.json",
+        "data/SPEC.json"
+      ],
+      "digest_mismatches": 0,
+      "original_posix_accepts": true,
+      "original_windows_accepts": false,
+      "corrected_accepts": true,
+      "changed_file_rejections": 13,
+      "omitted_file_rejections": 13,
+      "extra_file_rejections": 1,
+      "rename_rejections": 1
+    },
+    "upstream": {
+      "files": 179,
+      "nested_keys": [
+        "code/assemble.py",
+        "code/assembly_controls.py",
+        "code/audit_allcold.py",
+        "code/bind_providers_portable.py",
+        "code/bit_supplier_controls.py",
+        "code/emit_allcold.py",
+        "code/freeze_spec.py",
+        "code/generated_identity.py",
+        "code/invoice_allcold.py",
+        "code/prepare_global.py",
+        "code/restore_parent.py",
+        "code/witness.py",
+        "construction/COLD44-RECIPE.json.gz",
+        "construction/COMPLETION-PRIORITY.json",
+        "construction/INPUTS.json",
+        "construction/LICENSE",
+        "construction/NOTICE.md",
+        "construction/REBUILD-CHECKS.json",
+        "construction/UPSTREAM-NOTICE.md",
+        "construction/barch/LOCAL-PINS-barch-U8.json",
+        "construction/barch/RECIPE-U8.json",
+        "construction/barch/build_tri.py",
+        "construction/barch/reproduce_barch.py",
+        "construction/barch/run_controls.py",
+        "construction/build_gauge_cold44.py",
+        "construction/construct_gauge_xcentre.py",
+        "construction/frames/FRAME-RECIPE-sw4.json",
+        "construction/frames/LOCAL-PINS-frames-sw4.json",
+        "construction/frames/build_frames.py",
+        "construction/frames/frame_controls.py",
+        "construction/frames/reproduce_frames.py",
+        "construction/jx/LOCAL-PINS-jx-X4.json",
+        "construction/jx/RECIPE-X4.json",
+        "construction/jx/build_jx.py",
+        "construction/jx/reproduce_jx.py",
+        "construction/layers/build_pivot_swap.py",
+        "construction/layers/layer_end_controls.py",
+        "construction/layers/reproduce_layers.py",
+        "construction/layers_np/COLD-LAYERS-RECIPE-NP.json.gz",
+        "construction/layers_np/HPE-RECIPE-NP.json",
+        "construction/layers_np/PIVOT-SWAP-NP.json",
+        "construction/layers_np/reproduce_np.py",
+        "construction/layers_p6n/COLD-LAYERS-RECIPE-P6N.json.gz",
+        "construction/layers_p6n/P6N-SPEC.json",
+        "construction/layers_p6n/layer_end_controls.py",
+        "construction/layers_p6n/reproduce_p6n.py",
+        "construction/leaver/CHAIN-PINS-k8.json",
+        "construction/leaver/CODED-CELLS-k8.json",
+        "construction/leaver/COLD-LAYERS-RECIPE-NP-k8.json.gz",
+        "construction/leaver/COLD-LAYERS-RECIPE-P6N-k8.json.gz",
+        "construction/leaver/FRAME-RECIPE-LV-k8.json",
+        "construction/leaver/HPE-RECIPE-k8.json",
+        "construction/leaver/LEAVER-PINS-k8.json",
+        "construction/leaver/LEC-REASON-PINS-STACK-k8.json",
+        "construction/leaver/LEC-REASON-PINS-k8.json",
+        "construction/leaver/PIVOT-SWAP-k8.json",
+        "construction/leaver/PROMO-RECIPE-k8.json",
+        "construction/leaver/RECIPE-U8-k8.json",
+        "construction/leaver/RECIPE-X4-k8.json",
+        "construction/leaver/REGROUP-LEAVER-k8.json",
+        "construction/leaver/TRI-LEAVER-k8.json",
+        "construction/leaver/build_frames_lv.py",
+        "construction/leaver/cells-k8/CORE-01+.json",
+        "construction/leaver/cells-k8/CORE-01-.json",
+        "construction/leaver/cells-k8/CORE-23+.json",
+        "construction/leaver/cells-k8/CORE-23-.json",
+        "construction/leaver/cells-k8/CORE-45+.json",
+        "construction/leaver/cells-k8/CORE-45-.json",
+        "construction/leaver/cells-k8/CORE-67+.json",
+        "construction/leaver/cells-k8/CORE-67-.json",
+        "construction/leaver/cgx_leaver.py",
+        "construction/leaver/layer_end_controls_leaver.py",
+        "construction/leaver/reproduce_leaver.py",
+        "construction/leaver/reproduce_leaver_chain.py",
+        "construction/notri/PRIO6.json",
+        "construction/notri/cgx.py",
+        "construction/notri/cold44x.py",
+        "construction/notri/port_stage_x.py",
+        "construction/notri/reproduce_notri.py",
+        "construction/promo/LOCAL-PINS-p6n-k4.json",
+        "construction/promo/PROMO-RECIPE-p6n-k4.json",
+        "construction/promo/build_promotion.py",
+        "construction/promo/make_recipe.py",
+        "construction/promo/promo_controls.py",
+        "construction/promo/reproduce_promo.py",
+        "construction/reproduce.py",
+        "construction/slots/RECIPE-SLOTS-k8.json",
+        "construction/slots/SLOT-PINS-k8.json",
+        "construction/slots/verify_slots.py",
+        "construction/sw4/LOCAL-PINS-sw4-P6k4.json",
+        "construction/sw4/NOTES.md",
+        "construction/sw4/SW4-RECIPE-P6k4.json",
+        "construction/sw4/build_sw4.py",
+        "construction/sw4/reproduce_sw4.py",
+        "data/FRONTIER.json",
+        "data/OWNERS.json.gz",
+        "data/PLAN.json",
+        "data/PREPARATION.json",
+        "data/SPEC-T8.json",
+        "data/SPEC.json",
+        "data/T8/OWNERS.json.gz",
+        "data/T8/PLAN.json",
+        "data/UPSTREAM-PINS.json",
+        "evidence/ADMISSION-CONTROLS.json",
+        "evidence/ASSEMBLY.json",
+        "evidence/BINDING.json",
+        "evidence/CENTER-COMPATIBILITY.json",
+        "evidence/LOCAL-STAGES.json",
+        "evidence/REPLAY.json",
+        "evidence/STAGES.json",
+        "evidence/audit/ASYNC-AUDIT.json",
+        "evidence/audit/GLOBAL-PREFIX.json",
+        "evidence/audit/IDLE-REMAINDER-FRAMES.json",
+        "evidence/audit/OWNERS-AND-PROFILE.json",
+        "evidence/audit/PREFIX-AND-INVOICE.json",
+        "evidence/global/ACTUAL-SIGMAS.json.gz",
+        "evidence/global/GLOBAL-TEMPLATE.json.gz",
+        "evidence/global/HOSTED.json",
+        "evidence/global/IDLE-REMAINDER-FRAMES.json.gz",
+        "evidence/layers/LOCAL-AUDIT-LAYERED.json",
+        "evidence/leaver/CELL-MUTANTS-LV.json",
+        "evidence/leaver/FRAME-CONTROLS-LV-k8.json",
+        "evidence/local/CANONICAL-WORD.json.gz",
+        "evidence/local/CLIFFORD-RECIPES.json",
+        "evidence/local/CLIFFORD-REVIEW.json",
+        "evidence/local/FULL-WORD.json.gz",
+        "evidence/local/INDEPENDENT-LOCAL-REPLAY.json",
+        "evidence/local/LOCAL-CHECKS.json",
+        "evidence/local/LOCAL-PROGRAMS.json.gz",
+        "evidence/local/RESIDUAL-ADAPTERS.json",
+        "evidence/local/SCALAR-FRAME-AUDIT.json",
+        "evidence/local/WRAPPER-CHECKS.json",
+        "hosting/PROOF.md",
+        "hosting/README.md",
+        "hosting/audit_frozen.py",
+        "hosting/expand_owners.py",
+        "hosting/frozen/FROZEN-AUDIT.json",
+        "hosting/frozen/MAJORIZATION.json.gz",
+        "hosting/frozen/MANIFEST.json",
+        "hosting/frozen/MATCHING-RECEIPT.json",
+        "hosting/frozen/OWNERS.json.gz",
+        "hosting/frozen/REPRODUCTION.json",
+        "hosting/frozen/SEED-OWNERS.json.gz",
+        "hosting/frozen/SEED-RECEIPT.json",
+        "hosting/frozen/SEED-REPRODUCTION.json",
+        "hosting/reproduce.py",
+        "hosting/reuse_owners.py",
+        "independent/CENTRE-GUARD-REVIEW.md",
+        "independent/GAUGE-COLD44-INDEPENDENT-AUDIT.json",
+        "independent/GAUGE44-GLOBAL-GUARD-REVIEW.json",
+        "independent/GAUGE44-INDEPENDENT-PRICE.json",
+        "independent/README.md",
+        "independent/audit_local.py",
+        "independent/price_profile.py",
+        "independent/review_guards.py",
+        "inputs/PR589-EXPECTED.json",
+        "t16/NOTICE.md",
+        "t16/build_parent.py",
+        "t16/indep16.py",
+        "t16/lift16.py"
+      ],
+      "digest_mismatches": 0,
+      "original_posix_accepts": true,
+      "original_windows_accepts": false,
+      "corrected_accepts": true,
+      "changed_file_rejections": 179,
+      "omitted_file_rejections": 179,
+      "extra_file_rejections": 1,
+      "rename_rejections": 1
+    }
+  },
+  "immutable_source_rejections": 3,
+  "total_corruption_rejections": 391,
+  "scope": "Two inventory guards only; no supplier replay or new kappa"
+}