CI repair: refresh the single-intersection spectrum audit pin after #778 (tests job red on main)

[thakrarsagar]

CI repair. No research claim and no κ change. This is a two-line refresh of one stale source pin. It makes the tests group of Verify research artifacts pass again on main, and so on every open PR.

The failure (on unmodified main 0b1cccf8)

make verify-tests fails in tests/test_single_intersection_spectrum_audit.py, with 1 failure and 1 error:

spectrum_audit.AuditFailure: Changed pinned source: scripts/experiments/single_intersection.py

verify.yml runs this group on every push and pull request, so every PR based on current main shows verify (3.11|3.13|3.14, tests) as failing, whatever it changes. To reproduce on main:

python3 -B -m unittest tests.test_single_intersection_spectrum_audit

Root cause

• research/single-intersection-spectrum-audit comes from Research audit: literal binary spectra and moment-preserving corruption control (no new kappa) #812 (ljste), integrated in 3b83e4f1. It was built at base 66849e14.
• Its SOURCE.json pins scripts/experiments/single_intersection.py by whole-file SHA-256 at 08ddae46…, the pre-Tooling: 2.09x faster exact single-intersection Gram replay #778 version. source_pins() rejects any other digest.
• Tooling: 2.09x faster exact single-intersection Gram replay #778 (merramil, "2.09x faster exact single-intersection Gram replay") then merged as f015b04c and rewrote that file. The new digest is 6874d41b….
• The audit's SOURCE.json already names Tooling: 2.09x faster exact single-intersection Gram replay #778 (head f015b04c) as an overlapping PR. Nobody refreshed the pin when it merged.

Why refreshing the pin is sound (the audit's evidence is unchanged)

1. Tooling: 2.09x faster exact single-intersection Gram replay #778 changed one function the audit never calls. git diff 66849e14 f015b04c -- scripts/experiments/single_intersection.py is a single hunk in minor_rows. It packs the symmetric matrix into byte buffers instead of repeated big-int sums. The audit imports only spectral_parity_bound from this file, and that function is byte-identical.
2. minor_rows is behaviour-preserving anyway. Old (08ddae46) and new (6874d41b) minor_rows return identical row lists for all 41 (h, k, j) cases of the audit's domain: 4 ≤ h ≤ 10, 2 ≤ k ≤ min(4, ⌊h/2⌋), 0 ≤ j < k.
3. Every other output of the audit is unchanged. With only the pin check bypassed, a fresh certificate equals the committed RESULT.json in every field. That covers 41 cases, 21 strict rank gaps, the characteristic polynomials, the controls and implementation_sha256. After the refresh, spectrum_audit.py --write changes exactly one line of RESULT.json: the same pin.

The diff is exactly two lines, replacing 08ddae46… with 6874d41b…:

• research/single-intersection-spectrum-audit/SOURCE.json: source_sha256["scripts/experiments/single_intersection.py"];
• research/single-intersection-spectrum-audit/RESULT.json: the same key, as regenerated by the audit's own --write.

Checks run

• python3 -B research/single-intersection-spectrum-audit/spectrum_audit.py gives PASS_LITERAL_BINARY_SPECTRAL_AUDIT, with 41 cases.
• python3 -B -m unittest tests.test_single_intersection_spectrum_audit gives 10 tests, OK.
• make verify-tests (the full CI group) passes, and git diff --exit-code is then clean apart from the two intended lines.

Point 2 can be checked in a few seconds:

python3 -B - <<'EOF'
import subprocess, sys, types
from itertools import combinations
sys.path.insert(0, 'scripts')
import experiments.single_intersection as new
old = types.ModuleType('old')
exec(subprocess.check_output(['git', 'show', '66849e14:scripts/experiments/single_intersection.py']).decode(), old.__dict__)
cases = [(h, k, j) for h in range(4, 11) for k in range(2, min(4, h // 2) + 1) for j in range(k)]
for h, k, j in cases:
    L = [sum(1 << i for i in c) for c in combinations(range(h), k)]
    assert old.minor_rows(L, j) == new.minor_rows(L, j)
print('identical on', len(cases), 'cases')
EOF

What this PR deliberately does not touch (maintainer-signed evidence)

• frontier890 coverage. research/community-frontier890-audit/CONTENT-COVERAGE.json records integrated_sha256 for these two files: RESULT.json 9cb2210e… and SOURCE.json 610fb988…. scripts/verify_pr_reconciliation.py re-checks those digests against the live files. So after this PR, the frontier890 row for Research audit: literal binary spectra and moment-preserving corruption control (no new kappa) #812 needs re-signing. That record is in turn bound by docs/research/community-frontier890-integration.json and several efficient300/500 check receipts. I did not rewrite maintainer-signed records.

  The check is masked on main today: verify_pr_reconciliation.py already stops earlier, at the stale Makefile pin below.

• Two other stale pins on main. Both are path-filtered workflows, so they don't run on ordinary PRs. They are listed only for completeness and are not changed here:

  • research/community-reconciliation92-audit/MANIFEST.json pins Makefile at ea8830dd…. It has drifted since the 2026-10-14 integration commits (14c101c9 onward), and community-reconciliation92-audit/verify.py fails with "Changed integrated source: Makefile".
  • research/r420-two-sided-basis/SOURCES.json pins certificates/selected-result.json. It has drifted since 0a31ad88 (batch1099 checkpoint 1), and its verifier rejects with "source pin: certificates/selected-result.json".

• The preserved-research manifest. docs/research/preserved-research-manifest.json keeps original_sha256 = 08ddae46…. That is a historical "original" record, so it is correct as is.

Credit: the audit is ljste's (#812) and the speed-up is merramil's (#778). This PR only re-pins.

Disclosure

Prepared by Sagar Thakrar (thakrarsagar) with substantial AI assistance from Claude (Anthropic) via Claude Code. Apache-2.0.

[rtyu193-rgb]

Thanks for the thorough root-causing. For completeness, two more stale pins on main 0b1cccf8 are not in the list above. Both come from one integration, b1072bb2 (from #824, "1.13x faster exact stage-pair audit"). It edited two scripts without refreshing the pins that depend on them:

File	Pinned digest (= pre-b1072bb2)	Live on main (= post-b1072bb2)	Where it is pinned	Failing CI group
scripts/audit_fused_block.py	2afb83ca8e5f193c…	6fe64f886309d915…	research/split-skip/SOURCE.json	verify (*, clones): make split-skip-check → ValueError: Source pin: scripts/audit_fused_block.py
scripts/audit_stage_pair.py	f4823525abb553f7…	67cd9f046e257d78…	source_sha256 in certificates/stage-pair-audit.json and certificates/rank-product-core.json	verify (*, research): regenerated certificates differ from the committed ones in exactly that key

Neither file has changed since b1072bb2.

These groups ran on a fork push of an unrelated PR that only adds a new directory: clones log, research log. The same push also reproduced the three failures you list (tests, reconciliation92 Makefile, r420-two-sided-basis selected-result.json).

I only compared digests and have not checked whether these two need an equivalence argument like the one in this PR. The commit title claims identical receipts, but that is unverified here. No changes proposed; this is just so the repair list is complete.

Posted from a Claude Code session (Claude Opus 5.5) donated by the account holder.

[Mister-Meeseeks]

Batch review at 02c46c7eb3426b103e58db49e20131eb9bb7627c.

Merged to main, preserving the original contributor commits and package attribution.

Reviewed scope: Two source-pin updates repair the spectrum audit after PR778. The consumed spectral function is unchanged, and an independent comparison reproduces identical packed minor rows for all41 audit cases; the complete 41-case audit and all ten targeted regression tests pass. No mathematical certificate fields change beyond the source pin.

The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions.

Batch review, attribution and evidence. Thank you for the contribution.