Repository navigation
Tooling: audit unchecked selected dependency heads and add an opt-in consistency guard - #1750
Conversation
verify_selected_result accepts four metadata-only mutants while certificate inventory stays intact. Adds research/selected-dependency-heads-audit with reproducible evidence and an opt-in guard.py. No new kappa; selected frontier unchanged.
Document that research_package registration requires Python 3.12, narrow VERIFY.json static-scan wording to top-level scripts/*.py, and drop the unsupported cold-replay clause from severity_rationale.
|
Batch review at Merged to Reviewed scope: Opt-in selected dependency-head consistency guard and metadata mutations identify unchecked provenance fields while leaving certificate/inventory binding intact. It checks local checkpoint/integration consistency, not GitHub authenticity or mathematical admission; the production checker is unchanged. The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions. Batch review, attribution and evidence. Thank you for the contribution. |
2 participants
Change and scope
At base
0b1cccf86e2f5132ed286a26ef0a681a495740ea, the fast selected-record checker accepts four metadata-only mutants: false reviewed heads, false previous kappa, false source PRs, and false publication text. Certificate, source-inventory, and proof-supplement checks remain intact; a corrupted certificate digest is still rejected.This adds
research/selected-dependency-heads-audit/with reproducible mutation evidence and an opt-inguard.py. The guard rejects the three head/previous-kappa/source-PR mutants and accepts the published record. Publication prose is documented as unchecked; the guard does not establish its correctness.Low-severity provenance-metadata audit; no new kappa. The production checker and selected frontier are unchanged. The guard checks local consistency, not GitHub authenticity or mathematical validity. The published record's 48 reviewed heads remain consistent: 35 shared heads agree with the preceding checkpoint, and 13 agree with the batch1099 integration record.
Validation
The audit and guard themselves run with Python 3.10+. The registered package runner requires Python 3.12.
Expected statuses:
PASS_SELECTED_DEPENDENCY_HEADS_AUDIT,PASS_SELECTED_DEPENDENCY_HEADS_GUARD, andPASS_REGISTERED_RESEARCH_PACKAGE. The audit reports four metadata mutants accepted by the existing checker and three rejected by the proposed guard. Normal verification compares the committedEXPECTED.jsonwithout rewriting it.The full
make frontier1094-verifyreplay was not run. No full-suite, Lean, or multiplication-theorem validation is claimed.Sources and attribution
Task:
supplier-boundary-audit, refined to dependency metadata.SOURCES.jsonpins the consumed files at base0b1cccf86e2f5132ed286a26ef0a681a495740ea. This concerns different fields from #1735 / discussion #1730's certificate-to-replay binding. Credit remains with the authors of the selected #1094, frontier1042, batch1099 integration, and predecessor audit/binding packages linked in the README.Prepared by Wentao Li (VictorLiwentao, @Is__Victor) with substantial AI assistance, under Apache-2.0.