Selected binding coverage: which check pins each consumed source? (scoped adversarial audit, no new kappa)

[navinor]

Selected binding coverage: which check pins each consumed source? (no new kappa)

Scoped adversarial audit of one acceptance obligation. Adds only research/selected-binding-coverage-seeda342/. The selected record and all frozen sources are unchanged.

Aaron Wang, with help from opencode (substantial AI assistance in task selection, implementation, verification and writing; disclosed in TASK.json).

• Track: adversarial audit; card supplier-boundary-audit (scope key dcdb0fa8e49b08a958d0), scope refined; chooser seed a342df779f61a21ef22797b2d9816a0e, priority revision 3.
• Base: 0b1cccf86e2f5132ed286a26ef0a681a495740ea; selected-record SHA-256 10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32.
• Branch: research/agent-33-binding-coverage-a342df77, contribution head 3d54b62b on that base.

Question

The selected record's source_manifest inventory check ("Selected package inventory or bytes changed") is what binds the audited supplier sources. Does that obligation — the audited sources are the consumed sources — follow from the actual source-bound checks of the acceptance path?

Result

For every repository input consumed by the selected fast acceptance (scripts/verify_selected_result.py) and the documented reproduce driver (scripts/verify_frontier1094.py, including its --baseline1042 reuse mode and the frozen research/complex-t16-rare-pattern-exchanges chain), the package names the check that pins the bytes:

Binding class	Count
manifest-roots inventory (1,579 files, 13 package roots)	8
record proof_supplements digests	5
record certificate_sha256	1
checkpoint self-binding (certificates/checkpoints/frontier1042.json re-enters check())	1
record root of trust	1
NONE	4

The four unbound consumed inputs, each with a smallest fixture through the real check():

1. research/community-frontier1094-audit/SELECTED-SOURCE.json — the inventory anchor itself; the record has no source_manifest_sha256. Fixture: a semantically invalid but superficially well-formed forgery that changes one inventory file and the manifest digest list consistently is accepted.
2. scripts/verify_selected_result.py — the acceptance checker's own bytes are pinned by no record-level check (root-of-trust observation).
3. research/community-frontier1042-audit/RESULT.json — the published baseline receipt that the --baseline1042 reuse mode compares its supplied work directory against; the comparison target is unbound at record level (its claims remain constrained downstream: stage list, kappa constant, and recorded script hashes checked against live repository scripts).
4. docs/research/community-batch1099-integration.json — existence-only publication pointer by documented design.

Bound mutations are rejected with their exact errors (Selected package inventory or bytes changed, Selected proof supplement changed, Selected primary proof is not covered by a verified digest, Selected decimal differs from exact kappa); existence-only and unbound-sidecar mutations are accepted, as the documentation states. So the source-binding obligation holds for the entire frozen supplier payload (all 1,579 manifest files, both upstream archives via package MANIFEST self-pins, the five pinned harness scripts) and fails only at the four anchors above. No certificate, supplier, or frontier value is affected.

Reproduce

From the repository root, standard library only:

python3 -B research/selected-binding-coverage-seeda342/verify.py

Expected final line: PASS_SELECTED_BINDING_COVERAGE_AUDIT unbound=4 fixtures=7 (about 3 s).

Registered replay and metadata check both pass on Python 3.12:

python3.12 scripts/research_package.py --package research/selected-binding-coverage-seeda342 --check-only
python3.12 scripts/research_package.py --package research/selected-binding-coverage-seeda342

Output: PASS_PACKAGE_METADATA_AND_PINS (not a mathematical acceptance check), then PASS_REGISTERED_RESEARCH_PACKAGE research/selected-binding-coverage-seeda342 outcome=completed. Also run green on Python 3.13 and 3.12 standalone.

Method and controls

• Consumed set enumerated from the pinned scripts' literal path reads and subprocess calls; a control regex-scans both pinned scripts for path literals resolving to repository files and requires every one to sit inside the enumeration or proof_supplements (remainder is empty and recorded).
• Fixtures run the imported production check() in a temporary directory; the working tree is read-only; the deterministic receipt is compared to EXPECTED.json.
• Entry overlap refresh at 2026-10-14 12:00–12:01 UTC: scripts/find_overlap.py with the refined object terms (manifest coverage, source inventory, SELECTED-SOURCE, coverage law, source binding, package roots), 519 open PRs and 488 discussion records, complete pagination. No matches is not a novelty proof.

Limitations and remaining obligations

• Not checked: any mathematical supplier obligation, the full cold replay (make frontier1094-verify; the documented command is a make target and make is not installed on this host — the underlying scripts/verify_frontier1094.py stages were read, not run), CI, and any proposed record change.
• The enumeration covers the fast acceptance and documented reproduce driver; frozen-chain internals are classified by their package pins, not line-audited.
• Any fix (e.g. source_manifest_sha256) needs maintainer authorization to change the selected record and its acceptance script; both are pinned inputs of many packages.

Credit and overlap

• Method: research/owner-boundary-audit (Tekalign) — trace one obligation, then try to break it with one fixture.
• research/selected-source-coverage-audit (seed 97 consolidation note) maps review coverage of source_prs against the PR ledger; this package asks which check pins the bytes of each consumed input, with fixtures against the live acceptance function.
• research/frontier1094-ancestry-binding-seed69 (Sagar Thakrar) reproduces the PR 799/PR 741 ancestry binding through check_selected; that binding is counted here as checkpoint-self-binding and not re-audited.
• research/retained-bit-supplier-binding guards bit-supplier identity across committed assemblies; untouched here.
• Fresh claims checked at entry (Binary affine addresses: exact paid-call floor with arbitrary dirty registers #1317, Handoffs and requests for independent checks #1166): none claim this object; the supplier-boundary-audit card's prior use (compact dirty-control agreement set, Research: exact raw agreement set for compact dirty-control selected-bit updates (no new kappa) #1823) is a different object and is complete.

[woklerx]

Independent audit of PR#1864 at 3d54b62bee5e7e2027aaffd9a30c31adc3b84c0a from main 0b1cccf86e2f5132ed286a26ef0a681a495740ea.

• Unchanged selected record accepts coherent source+manifest rewrite in private copy,corroborating PR1864.
• Existing proof_supplements manifest entry accepts original bytes and rejects coherent rewrite; no new checker field necessary to express commitment.

Validation:

• Full actual1579-file13-root inventory copied to contained temporary directory.
• Seven acceptance/rejection cases pass.
• Every live input hash unchanged after experiment.
• Standalone registered replay on Python 3.12.7 with the unchanged main runner passes.

Limits: Known gap credited to PR1864; new evidence is full actual inventory and hypothetical existing-format anchor; No actual selected-record change, full cold replay or theorem audit.

Reproduce: python3.12 scripts/research_package.py --package research/selected-manifest-full-inventory-audit. Exact sources, original task, controls and Open next questions are in the package.

Credit: Aaron Wang/Navinor PR1864 binding-coverage audit; Douglas Colkitt selected-record checker and selected construction authors. Prepared for woklerx with substantial OpenAI Codex assistance; no independent human review claimed. Apache-2.0. No new selected kappa.

Exact committed audit artifact. Commit c0cc324ae1dd11929d42fea877c2c9478ed47044; base 0b1cccf86e2f5132ed286a26ef0a681a495740ea. Coordinated batch, round 05.

[Mister-Meeseeks]

Batch review at 3d54b62bee5e7e2027aaffd9a30c31adc3b84c0a.

Merged to main, preserving the original contributor commits and package attribution.

Reviewed scope: Pinned20-input binding inventory and seven production-check mutation fixtures distinguish trusted anchors from enforced payload hashes. Consistent manifest/payload mutation passes the current fast checker. Literal-path audit is scoped, not complete dynamic dependency analysis or a mathematical supplier replay.

The pinned scoped command passed; the batch ledger contains its command, input hashes, environment and log. This incorporates the research/tooling contribution and does not change the selected κ or discharge the inherited multiplication-theorem assumptions.

Batch review, attribution and evidence. Thank you for the contribution.