[1337isnot1337]

Summary

Adds a focused source-binding audit for the selected #1094 composition's PR589
bit supplier. The T16 assembler verifies its input record against the pinned
Git blob ID before parsing it. The source file at the PR head, the same record
at the merge path, and the selected T16 copy are byte-identical. A one-nibble,
still-valid 40-hex digest mutant is rejected by the production loader.

The package also binds the source record's loaded bit_lower to the selected
assembly field and checks the assembly's input SHA-256. The complete #1094
caller retains and compares the same T16 bit_supplier record.

This is a source-identity audit only. It does not validate the supplier's full
mathematical derivation, admit a supplier, run the full #1094 replay, or change
the selected kappa.

Scope and provenance

The task-card scatter/export example is separately covered by open PR #3801.
This package addresses one distinct source-binding field, BIT_BLOB. It keeps
PR #589, PR #555, the T16 controller lineage, and the selected assembly's
predecessor credit in the README.

Base: 20ecf2891d80b5acf18d980b2164fb44ea7faa90; priority revision 6.
Package commit: c68ba95d7b145490c005001af49301ac98f66b8b.

Validation

• Direct verifier on Python 3.14.8: pass, including positive and valid-digest
  negative fixtures.
• Package metadata and source pins: pass.
• Commit-byte check: pass for 19 package/input files.
• Selected research baseline: PASS_RESEARCH_BASELINE_BINDINGS_ONLY.
• Registered package replay was not started because this host lacks Python 3.12,
  the package runner's required interpreter. The full make frontier1094-verify
  replay was not run.

No PR was opened or pushed, in accordance with the session's external-scope
restriction.

Publication validation

python3.12 scripts/research_package.py --package research/selected-bit-source-binding-audit passed on CPython 3.12.3, and python3.12 scripts/check_research_commit.py --package research/selected-bit-source-binding-audit --check-source-history passed. The registered replay left the worktree clean. This supersedes any earlier pending note above for the registered package replay; separate full selected cold-replay limits remain as stated.

[rcfc-jreed]

Independent scoped audit of the selected PR589 source blob binding at 920900f6: pins, byte identity, and mutant rejection agree (20/20)

Code-disjoint checks; does not import package verify.py. Package bytes from head 920900f66ff250a8a49a9d4c4ec5873f6036e682 via GitHub contents API; inputs + historical PR589 blobs re-fetched. CLAIM.

No packaging defect in scope. RESULT.json matches recomputation.

What passes:

1. Pins: selected-record/κ; source inventory binds PR589/T16/assembler digests.
2. Identity: head / merge / T16 / tuned EXPECTED.json byte-identical; git blob e293ddc5…; assembly binds T16 sha256.
3. Loader: BIT_BLOB matches; loaded bit_lower equals assembly; mutant blob ID rejected with bit supplier blob pin.

Not covered: construction replay or supplier admission (package scope); new κ; formal-kernel proof.

This is a finite source-identity replay, not a formal proof.

check.py

#!/usr/bin/env python3
"""Code-disjoint audit of PR #3921 selected PR589 source blob binding."""

from __future__ import annotations

import hashlib
import importlib.util
import json
import os
import re
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
PKG = ROOT / "pkg"
TREE = ROOT / "tree"
BASE = "20ecf2891d80b5acf18d980b2164fb44ea7faa90"
HEAD = "920900f66ff250a8a49a9d4c4ec5873f6036e682"
SELECTED_SHA = "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
BLOB = "e293ddc557742637f9f679f083a1a282d87b1b13"
SUPPLIER_SHA = "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4"


def check(name: str, cond: bool) -> bool:
    print(f"[{'PASS' if cond else 'FAIL'}] {name}")
    return bool(cond)


def sha256_bytes(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()


def sha256_file(path: Path) -> str:
    return sha256_bytes(path.read_bytes())


def git_blob(raw: bytes) -> str:
    return hashlib.sha1(b"blob " + str(len(raw)).encode() + b"\0" + raw).hexdigest()


def load_assembler():
    code = TREE / "research/gauge44-slots-t16/code"
    source = (
        TREE / "research/complex-sw4-frame8/vendor/main/research/"
        "complex-k492-owner-repair/vendor/multicold"
    )
    os.environ["GAIN_PR564_SOURCE"] = str(source)
    os.environ["WITNESS_SPEC"] = str(TREE / "research/gauge44-slots-t16/data/SPEC.json")
    sys.path.insert(0, str(code))
    spec = importlib.util.spec_from_file_location("selected_bit_audit_assemble", code / "assemble.py")
    module = importlib.util.module_from_spec(spec)
    assert spec and spec.loader
    spec.loader.exec_module(module)
    return module


def main() -> int:
    results: list[tuple[str, bool]] = []
    sources = json.loads((PKG / "SOURCES.json").read_text(encoding="utf-8"))
    task = json.loads((PKG / "TASK.json").read_text(encoding="utf-8"))
    verify = json.loads((PKG / "VERIFY.json").read_text(encoding="utf-8"))
    committed = json.loads((PKG / "RESULT.json").read_text(encoding="utf-8"))
    package_files = {row["path"]: row for row in sources["files"]}

    results.append(("D1 RESULT.json present", (PKG / "RESULT.json").exists()))
    results.append(("D2 SOURCES.base_commit", sources.get("base_commit") == BASE))
    results.append(("D3 TASK.base_commit", task.get("base_commit") == BASE))
    results.append(("D4 VERIFY.status ready", verify.get("status") == "ready"))
    results.append(("D5 TASK.outcome", task.get("outcome") in ("completed", "partial", "negative-result")))

    pin_ok = True
    for path, row in package_files.items():
        if row.get("usage") != "input":
            continue
        fp = TREE / path
        if not fp.exists() or sha256_file(fp) != row["sha256"]:
            pin_ok = False
            break
    results.append(("P1 all input sha256 match base", pin_ok))

    record = json.loads((TREE / "certificates/selected-result.json").read_text())
    source_manifest = json.loads((TREE / record["source_manifest"]).read_text())
    certificate = json.loads((TREE / record["certificate"]).read_text())
    results.append(("P2 selected-record sha256", sha256_file(TREE / "certificates/selected-result.json") == SELECTED_SHA))
    results.append(("P3 selected kappa", record.get("kappa") == "836330098538459/500000000000000000"))

    source_path = "research/e8-bit-p111-tuned/tune/EXPECTED.json"
    t16_path = "research/gauge44-slots-t16/inputs/PR589-EXPECTED.json"
    assembler_path = "research/gauge44-slots-t16/code/assemble.py"
    inv_ok = True
    for relative in (source_path, t16_path, assembler_path):
        data = (TREE / relative).read_bytes()
        if source_manifest["files"].get(relative) != sha256_bytes(data):
            inv_ok = False
        if package_files[relative]["sha256"] != sha256_bytes(data):
            inv_ok = False
    results.append(("P4 selected inventory binds PR589/T16/assembler", inv_ok))

    hist_head = (TREE / "hist/source_at_head.json").read_bytes()
    hist_merge = (TREE / "hist/source_at_merge.json").read_bytes()
    input_bytes = (TREE / t16_path).read_bytes()
    tuned_bytes = (TREE / source_path).read_bytes()
    results.append(("B1 head/merge/T16/tuned byte-identical", hist_head == hist_merge == input_bytes == tuned_bytes))
    results.append(("B2 supplier sha256", sha256_bytes(input_bytes) == SUPPLIER_SHA))
    results.append(("B3 git blob sha1", git_blob(input_bytes) == BLOB))

    bit_record = certificate["bit_supplier"]
    results.append(("C1 certificate supplier commits/paths", bit_record["commit"] == "a5afc8c6169ea61ba7c51dfd3cade02cc7b13b46" and bit_record["merged_as"] == "b3eb785ac5b4b1ca2beea0f80db078a505626a90" and bit_record["git_blob_sha1"] == BLOB))
    results.append(("C2 assembly binds T16 input digest", certificate["input_sha256"]["package:inputs/PR589-EXPECTED.json"] == sha256_bytes(input_bytes)))

    assembler = load_assembler()
    expected_blob = bit_record["git_blob_sha1"]
    results.append(("L1 assembler BIT_BLOB pin", assembler.BIT_BLOB == expected_blob == assembler.git_blob(input_bytes)))
    parsed = assembler.load_bit(input_bytes)
    results.append(("L2 loaded bit_lower matches assembly", parsed["nine"]["bit_lower"] == certificate["bit_lower"]))
    results.append(("L3 selected certificate_sha256", record["certificate_sha256"] == sha256_file(TREE / record["certificate"])))

    mutant_blob = ("0" if expected_blob[0] != "0" else "1") + expected_blob[1:]
    results.append(("N1 mutant is distinct valid hex", bool(re.fullmatch(r"[0-9a-f]{40}", mutant_blob)) and mutant_blob != expected_blob))
    assembler.BIT_BLOB = mutant_blob
    rejected = False
    rejection = ""
    try:
        assembler.load_bit(input_bytes)
    except AssertionError as error:
        rejected = True
        rejection = str(error)
    finally:
        assembler.BIT_BLOB = expected_blob
    results.append(("N2 mutant rejected as bit supplier blob pin", rejected and rejection == "bit supplier blob pin"))

    recomputed = {
        "status": "PASS_SELECTED_BIT_SOURCE_BINDING_AUDIT",
        "base_commit": BASE,
        "selected_record_sha256": SELECTED_SHA,
        "selected_kappa": record["kappa"],
        "supplier_pr": bit_record["pr"],
        "supplier_head": bit_record["commit"],
        "supplier_source_path_at_head": "research/e8-bit-p111/tune/EXPECTED.json",
        "supplier_merge": bit_record["merged_as"],
        "supplier_path_at_merge": bit_record["path"],
        "supplier_git_blob_sha1": expected_blob,
        "supplier_source_sha256": sha256_bytes(input_bytes),
        "selected_bit_lower": certificate["bit_lower"],
        "loaded_bit_lower": parsed["nine"]["bit_lower"],
        "mutant_git_blob_sha1": mutant_blob,
        "mutant_rejected_by": "assemble.load_bit: bit supplier blob pin",
        "scope": committed["scope"],
    }
    results.append(("R1 RESULT.json matches recomputation", committed == recomputed))

    digests = {p.name: sha256_file(p) for p in sorted(PKG.iterdir()) if p.is_file()}
    (ROOT / "digests.json").write_text(json.dumps(digests, indent=2) + "\n", encoding="utf-8")

    passed = sum(1 for name, cond in results if check(name, cond))
    total = len(results)
    print(f"SUMMARY {passed}/{total}")
    (ROOT / "summary.txt").write_text(f"{passed}/{total}\n", encoding="utf-8")
    return 0 if passed == total else 1


if __name__ == "__main__":
    raise SystemExit(main())

James Reed (@rcfc-jreed), with substantial AI assistance (Claude, in Cursor).