Audit hashes of regenerated gzip containers and propose a one-paragraph rule (no κ)

[maxime-fleury]

No κ, no certificate change, no new mathematics. This audits one reproducibility pattern and proposes a rule for it.

The pattern

A package writes a container with gzip.compress(...), hashes the compressed bytes, and requires that hash to equal a value committed or pinned when the container was produced elsewhere. A gzip container's deflate stream depends on the writing interpreter and zlib build, so that check can fail on unchanged inputs and can hide a real change behind an environment difference.

Two observations establish it, from opposite directions:

1. A check that fails on unchanged inputs. Compose the v4 source-assisted complex word with the PR200 bit supplier: conditional κ = 6.768823e-4 #202's headline verifier (research/source-assisted-v4/verify.py:162) stops with Canonical certificate does not reproduce. Exactly seven leaves differ and all derive from one value: the sha256 of the compressed lift certificate, written by research/source-assisted/decision/exact_complex_flow_lift.py:409 and recorded at :419 as certificate_sha256=digest(cert_path) of the file. Every other leaf, including κ, the complex saving, the bit effective saving and the assembly records, is equal. PR Replays of the verifiers of #207, #202, #197 and #199 (no new κ) #214 reproduces this on CPython 3.13.16 with the pinned numpy 2.3.5 / scipy 1.17.0, and reports the same failure for Source-assisted v4 complex word with PR189's bit supplier: conditional κ = 6.674324e-4 #194's own verifier under CPython 3.12.3, with the lift inputs unchanged between the two commits; Source-assisted v4 complex word with PR189's bit supplier: conditional κ = 6.674324e-4 #194's CI passed the same check under the same versions.
2. A rebuild instruction that does not reproduce. A frame-layout ceiling for #200's bit word: coarse < 6.964e-4 under the banked ledger, so κ < 6.959e-4 on #205–#207's word (no new κ) #212's pinned archive rebuilds byte for byte as a tar payload from a1175449 (verified), but not as a container: shipped 316aa694… / 1,405,363 bytes against cb71d72d… / 1,404,558 bytes here, and no zlib level 1–9 reproduces the shipped length. No number changes; ceiling.py still checks the archive's file hashes.

What the repository already does right

• Compare the payload. research/paired-cube-bit/paired_cube_bit_word.py:935-937 (at Source-assisted v4 complex word with PR189's bit supplier: conditional κ = 6.674324e-4 #194's head, inherited by its successors) carries the reason in a comment: if name.endswith('.gz'): # gzip bytes depend on the zlib build; compare the compressed content → old, data = gzip.decompress(old), gzip.decompress(data) → require(old == data, …). Source-assisted v4 complex word with PR189's bit supplier: conditional κ = 6.674324e-4 #194's bit/prove.py decompresses before comparing too.
• Record both, require only the payload. research/pair-assembly/frame/frame_compile.py:41-49 records gzip_sha256 next to word_sha256; Conditional κ = 6.84696826673891e-4: paid XOR butterflies with cascade-optimized frames #217's run_bit.py:151 records prime_witness_sha256 next to prime_canonical_sha256; Conditional κ = 6.84696826673891e-4: paid XOR butterflies with cascade-optimized frames #217's expected-bit.json pins payload hashes for graph_p12.json, word_p12.json, frames_p12.json.
• Check semantic fields. Conditional kappa 6.831904550365e-4: coordinated frame optimization and completed entrance banks #207's verify_inner.py:23,29-30 compares exact_scalar_program_sha256 and the complex profile's fields instead of a container.
• Pin committed containers. Pinning the sha256 of a committed .gz is safe — those bytes are fixed and no check regenerates them (research/aligned-final-pricing-result/SOURCE.json:12-21, and the vendored upstream SOURCE.json files).

What is added here

research/gzip-container-reproducibility/ with the audit above (file and line evidence), gzip_hash_audit.py (a heuristic scanner: writes / container-digest / comparison, printed with its evidence), and CONTRIBUTING-note.md, which carries the paragraph proposed for CONTRIBUTING.md — place it after the paragraph asking contributors to include regenerated certificates. Its text: compare payloads not containers when a check regenerates a file; pin payloads or semantic fields rather than container digests; committed containers are fine to pin; a container digest may be recorded only as an environment receipt, with the interpreter and zlib versions beside it, and must not be required to match across environments.

Scanner findings, one full-tree checkout per pinned head (git worktree add --detach), "risky" being a file that writes a container and records a digest of it: main 3b6b668 639 .py files, 3 risky (research/pair-assembly/frame/frame_compile.py:48, research/machine-transfer-verification/stream-transfer/experiments/balanced_split.py:64, scripts/experiments/probe_pair_ranked.py:41); #194 a8c8778 578 files, 3 (those three, plus research/source-assisted/decision/exact_complex_flow_lift.py:419, the record observation 1 follows); #202 8d8d67b 605 files, 3 (the same three); #207 cd14825 650 files, 4 (the merged tree's three plus coordinated-crossover-pr200/geometry/audit-gauge-charts.py:50); #212 9b6ad03 640 files, 3 (the merged tree's three); #216 34abdc5 660 files, 5 (theirs plus audit-gauge-charts.py:50 twice, in the package and in its vendored baseline); #217 b739fc2 654 files, 3 (the merged tree's three; the scanner does not flag run_bit.py:151). Opened rather than counted, the three shared flags read as records beside the payload digest (frame_compile.py:48), a record nothing reads back (probe_pair_ranked.py:41), and the one container digest in the merged tree that is required against a stored value -- balanced_split.py:64 with verify_balanced_split.py:67, safe while the container and its receipt travel together from one run, observation 1 if a harness ever regenerates the container from the candidate's inputs. The scanner is a heuristic, not a proof of absence: it cannot see a digest recorded in one file and required in another (the #202 case is written out as a chain of file and line for that reason).

Prepared with Anthropic Claude assistance; Apache-2.0. No existing file is changed; the CONTRIBUTING.md edit is left to the maintainers.