Audit and preserve T37 receipt input-role bindings (no new kappa)

[commdata2338]

Change and mathematical scope

PR #1006's T37 receipt normalizer checks the eight input hashes as an unordered collection and then replaces their path labels. So exchanging, for example, the native-word and native-replay receipt hashes still compares equal. This package adds a source-bound audit and an opt-in comparator. The comparator checks each hash against its explicit input role, while still permitting relocated invocation roots.

Status: verifier tooling and a scoped audit finding about receipt comparison on its own. The original runner independently pins its sources and actual inputs and executes the original wrapper. No incorrect owner result was demonstrated, and that protection was not bypassed. No new circuit, supplier, speedup or κ is claimed. Frozen predecessors, including research/t37-slice-bitmaps/, and the selected frontier are unchanged.

Precise delta: eight new files under research/t37-receipt-role-binding/:

• receipt.py: explicit path/role normalization and complete comparison.
• verify.py: checks the pinned inputs, the exhaustive collision domain, the relocation and failure controls, and both fresh T37 engines.
• test_receipt.py: six focused test groups.
• README, RESULT, TASK, SOURCES and VERIFY carry the contract, the evidence and the registered replay.

Evidence.

• Legacy comparison: all 40,320 of 40,320 hash permutations compare equal.
• Strict comparison: it accepts the one identity assignment and rejects the other 40,319. The smallest witness exchanges the word and local native-replay hashes, with every other receipt field fixed.
• Both fresh complete engines agree on 167,832 roles, 333 calls and all 14 inherited controls. The complete canonical receipt has SHA256 1a0e4a30fc8b18c3db52cde322fc2a7646462497186cc6276e056b58253532fd.
• Controls: five accepted layouts plus a check that the caller's data is not mutated, and eleven role, path and field rejection cases. Both fresh receipts reject a swapped association.

Remaining obligations.

• Not run: no fresh native word or replay construction (the archived inputs are pinned), no selected PR Conditional kappa 0.001672660197076918: rare-pattern T16 exchanges #1094 cold replay and no full repository suite.
• Not checked: the native compiler, whole-hosted emission, the invoice, moments, outer assembly, Lean, remote CI, and any other interpreter or operating system.
• Still open: the inherited compiler, realization, hosting, precision/tape, analytic and bit-interface obligations.
• Not claimed: authentication of third-party execution, or independent human review. A corrupted manifest or binding supplied by the caller is outside this comparison contract.

Task and overlap

• Task ID / scope key: portable-replay / 91a9a2afec282c926282, refined to PR1006-T37/input-role-map/eight-input-permutations. Chooser nonce 3293b0b65763e4677f4efbb57cde1c08, track verifier-engineering, priority revision 2. The other suggestion, replay-runtime (b1dd41940c60d240b47a), was passed over: this concrete comparison failure is bounded and needs no performance claim.

• Base and exact heads: base bce54fb3f895cbe5cd4c0eb477c3afeed100190f; contribution 9b00c9f93a05351fb1a712dc201539de30f8738b. PR Tooling: exact T37 occupancy bitmaps reduce audit time and memory #1006 predecessor head 2b047edb2b3fedccc4f538608b1bd56dc711673d; PR Conditional κ = 0.001661960547713947: T37 whole-owner packing and all-T bound #942 wrapper/witness head 1960cfa919a0945d0ca4cb14ea96237000037903. There is no pending PR dependency, and SOURCES.json pins every live consumed byte from the base.

• Concrete object and question: research/t37-slice-bitmaps/common.py:normalize and its eight-role input_sha256 map. Does making receipts portable erase the role association?

• Exact claim audited: that only machine-specific path labels are normalized while the complete original receipt stays bound. The separate actual-input admission boundary is kept and explicitly distinguished.

• Scope status: refined. The chooser's method asks for an audit of a canonical-payload comparison for omitted fields; this tests the input identity association, not gzip/header or Windows codec behaviour.

• Method and domain: all 8! permutations of eight distinct pinned digests across the fixed path labels, with explicit relocation and malformed-binding controls. The rest of the receipt JSON is compared in full, and the unchanged reference and bitmap owner stages are run fresh.

• Nearest work:

  • Gareth Davidson's PR Tooling: exact T37 occupancy bitmaps reduce audit time and memory #1006 supplies the original adapter; this audits its normalization boundary.
  • PR Research consolidation: reconcile selected #626 Linux replay evidence #695 and Rohan Guliani's diagnostic concern different assembly provenance digests and missing CI payloads.
  • PR Tooling: cross-platform byte/codec reproducibility of the make verify surface (no new kappa) #946 and PR Tooling: Windows portability for research onboarding scripts and tests (no new kappa) #1298 concern codecs and platforms.
  • PR Tooling: opt-in parallel layer-end controls for the frontier1042 leaver chain, byte-identical receipts, 3.1x (extends #1059, no new kappa) #1151 parallelizes layer-end controls, and PR Tooling: preserve registered replay coverage for input and workflow changes #1354 addresses registered-workflow invalidation.

  None is adopted or replaced here.

• Claim and final check: the claim is in discussion #1355. A live overlap check just before submission (842 open PRs and 92 discussion records at 23:36 UTC, complete pagination) found no competing role-map audit.

Validation

python3 -B scripts/research_baseline.py
python3 -B scripts/research_package.py --package research/t37-receipt-role-binding --check-only
python3 -B scripts/research_package.py --package research/t37-receipt-role-binding

The registered command repeats the full census and both fresh T37 stages against RESULT.json, then runs the complete focused test file. That file covers duplicate and nonfinite JSON, source drift before import, and stored census tampering. It runs on Linux with CPython 3.12.3 and the standard library; the Windows path labels are lexical fixtures only. The full replay takes about 20 seconds. The new comparator derives its bindings from the invocation roots and never infers them from receipt hash values. The registered replay and the metadata/pin check were run again on the final commit before submission, and both passed.

PASS_T37_RECEIPT_ROLE_BINDING: 40320 legacy-equal permutations; 40319 rejected by role binding; both complete T37 engines agree
PASS_REGISTERED_RESEARCH_PACKAGE research/t37-receipt-role-binding outcome=completed

Credit

• Gareth Davidson (PR Tooling: exact T37 occupancy bitmaps reduce audit time and memory #1006), whose adapter this audits.
• Jonathan Capalbo (PR Conditional κ = 0.001661960547713947: T37 whole-owner packing and all-T bound #942).
• Chafik Boukhalfa, Hao Yan and Jeremy Kothe, and the retained U8/controller contributors.

Apache-2.0; predecessor attribution and notices are retained.

AI assistance: submitted by @commdata2338 with substantial AI assistance. OpenAI Codex (GPT-6 Astra) did the audit design, the implementation, the verification and the writing; it was packaged and submitted with Claude Code. No independent human review is claimed.

Open next questions

From the package README: should a future maintained T37 entry point use the explicit role map when comparing receipts? It would keep the provenance association in saved evidence. First step: integrate the pure comparator at a nonfrozen successor boundary and keep the fresh reference and bitmap controls. Blockers: maintainer adoption and the desired policy for historical layouts; this package does not alter frozen code. The structured question is in TASK.json.

Workflow feedback (optional)

• Friction: broad portability overlap terms mostly returned gzip and codec work. Finding the relevant receipt comparison took a local function search. That was orientation overhead, not evidence that the card is saturated.
• Suggestion: optionally index public function and file names for the overlap helper, so that a query such as t37-slice-bitmaps/common.py or normalize finds comparison-specific predecessor work, with its coverage limits stated.

[Mister-Meeseeks]

100-PR batch review at 9b00c9f93a05351fb1a712dc201539de30f8738b.

Merged to main, preserving the original contributor commits and package attribution.

Reviewed scope: Independent receipt-role-binding audit: unordered hash normalization accepts all 40,320 permutations, while an opt-in role/path binding accepts exactly one. Both original T37 engines replay unchanged; this is not an immutable-source bypass or a fresh native supplier build.

The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions.

Batch review, attribution and evidence. Thank you for the contribution.