Machine-check the post-emit read-set of the 15 audit-unread hosted-template fields (no new kappa)

[navinor]

Machine-check the post-emit read-set of the 15 audit-unread hosted-template fields

Agent: Aaron Wang, with help from opencode (substantial AI assistance). No new kappa, certificate, supplier or frontier change. This is a scoped hosting transfer audit of the selected chain at #1094.

Scope

• Track adversarial-audit, card uniform-transfer-audit (scope key 603f341b99f590f17a76), chooser OS nonce 2bb90ec128a184bdec47e263785b9c5d, priority revision 4.
• Base main 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2; contribution head da92e957 on branch research/agent-45-uniform-transfer-603f341b; selected-record SHA-256 10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32.
• Claim: Handoffs and requests for independent checks #1166 (comment) (expires 2026-10-15 05:00 UTC).
• Scope status: refined. The drawn first-choice card selected-stock-envelope matched an already-claimed recent object (philippeVV's claim Handoffs and requests for independent checks #1166 (comment) and the completed first-stage coefficient work in Prove a conditional GL64 parent-stock envelope for the selected BIT bootstrap #2084 and Tighten the conditional selected BIT parent-stock bound #2120), so the second-choice card was taken and refined to one named claim.

Object. The frozen #1087 code/audit_allcold.py acceptance audit never reads 15 fields of the hosted template it checks (cover, m, version, port_restriction, provider_dispatch, replica_lift, route_semantics, supplier_substitution, expanded_scalar_interface, hosting.rule, hosting.scope, hosting.idle_remainder_semantics, hosting.owner_map_sha256, async_schedule.scope, async_schedule.source_plan_sha256). Josie Elliston's research/t16-audit-mutant-coverage (#1959) asserts "a text search of the PR 1087 archive and the maintainer frontier1094 scripts finds no reader of the 15 unread fields in the hosted template after emit", and labels it "a text search, not a proof". This PR replaces that text search with a pinned machine check and answers the acceptance question the text search left open.

What is established (package research/hosted-template-postemit-fields/)

Universe: all 57 *.py members of the pinned research/complex-t16-rare-pattern-exchanges/upstream1087.tar.gz (SHA-256 d4acf04daef85d4514f80ec5fcd2492d0c60e5d6c49fa71b3e6523f8db2dea86) plus five main-tree files: scripts/verify_frontier1094.py, research/community-batch1099-audit/check_frontier1094.py, the selected stage driver research/complex-t16-rare-pattern-exchanges/verify.py, and the in-process import closure of check_frontier1094.py (research/t16-owner-audit-seed67/verify.py, research/pending-claims-independent-pricing/sweep.py). Every file is SHA-256 pinned in EXPECTED.json.

1. No post-emit name-directed read. Of the 58 name-directed occurrences of the 15 names in the universe, exactly five are in the post-emit consumer closure (audit_allcold.py, invoice_allcold.py, assemble.py, assembly_controls.py, bit_supplier_controls.py, plus the audit's in-process helpers witness.py, generated_identity.py), and all five are output-receipt construction keys (scope= in five dict(...) receipt builders). A dict construction key writes another dict; it cannot read the template. Zero post-emit occurrences are reads, writes, presence tests or opaque calls of the 15 names. This upgrades the text search of Audit: mutant coverage of the selected T16 controller/owner audit (no gap found, no new kappa) #1959 to a machine-checked inventory.
2. Complete occurrence inventory. All 58 occurrences are pinned with file, line, syntactic context and access class. The only semantic reads of any of the 15 names in the whole universe are three pre-emit read-modify-writes of route_semantics (each overwrites its helper subfield during construction) and three reads of other objects that share a field name (the source SPEC dimension source['m'], and two assembly receipts' scope). Nothing reads the hosted template's 15 fields anywhere in the pinned universe.
3. Dynamic and whole-object channels. All 54 dynamic-access sites of the template variables are pinned with excerpts. There is no unbounded top-level dynamic read: the single top-level dynamic subscript is audit_allcold.py line 97, whose key set is the finite pair exact_data_phase_recipe_sha256 and adapter_policy, disjoint from the 15 fields. The two top-level presence tests probe retired field names (local_programs and friends), not the 15. No post-emit code iterates, serializes, hashes or compares the template object itself in-process; the single copy.deepcopy(ct) is the audit's own mutation harness.
4. Channel map: how the 15 fields can still reach acceptance. Through whole-object byte equality only, against receipts produced by the same emit run.

Channel	Pinned statement	Effect on a changed field
audit stage	audit_allcold.py line 185 recomputes the SHA-256 of the template file bytes and requires equality with the template_sha256 of HOSTED.json, written by emit_allcold.py	detected unless HOSTED.json is re-emitted consistently
invoice stage	invoice_allcold.py run() requires the template file content hash to equal three receipts at once: ASYNC-AUDIT.json, OWNERS-AND-PROFILE.json and HOSTED.json (the four-way binding)	detected unless all four values are consistent with the changed bytes
maintainer check	check_frontier1094.py line 18 pins the ROUND20 parent template, a pre-emit artifact, by file hash; geometry() reads only execution_schedule and recipe from it	does not touch the hosted emit output

Consequence (what would change downstream): with the emit-produced receipts kept consistent, no post-emit acceptance predicate in the pinned universe distinguishes any values of the 15 fields. Their presence in the hosted template is provenance documentation; the chain protects them by emit-stage byte-hash provenance binding, not by semantic validation. The prose of #1959 ("the audit alone accepts changed pooled-slot times and the 15 unread fields") therefore extends from audit() alone to the whole pinned post-emit chain, modulo the file-hash bindings above.

5. Detector self-test (corruption control). verify.py parses ten synthetic probe forms (subscript read and write, attribute read, dict() keyword, dict-literal key, get() argument, membership test, unbounded and bounded dynamic subscript, top-level iteration, top-level hash) and fails unless each is classified as intended. One injected ct['cover'] in any pinned file would trip the S1 gate and the inventory comparison.

What this does not establish (remaining obligations)

• Static analysis of pinned bytes only; it certifies the pinned universe, not arbitrary future code, and it is not a proof of semantic non-interference. Receiver binding for dynamic sites uses declared template variables; renamed receivers need a re-derivation (byte drift already fails the pins).
• The engines/moment.py, engines/base_two_moment.py and engines/outer.py modules that assemble.py loads from its own package directory are outside the frozen archive and were not scanned; assemble.py passes them profile dictionaries, not the template.
• No chain replay, no cold replay, no mutation testing, and no discharge of the all-size/compiler, precision, tape, hosting or restoration obligations themselves. Open question 2 of Audit: mutant coverage of the selected T16 controller/owner audit (no gap found, no new kappa) #1959 (template owner-map binding in the replay driver) is untouched; its open question 1 (the other audit_allcold.py versions) is this package's open next question 1.

Reproduce

python3 -B research/hosted-template-postemit-fields/verify.py
python3.12 scripts/research_package.py --package research/hosted-template-postemit-fields
python3 -B -m unittest discover -s tests -p 'test_research_*.py'

Fresh output on CPython 3.13 and 3.12 (Windows): PASS_POSTEMIT_FIELD_READSET with universe files: 62, universe name-directed sites (all classified and pinned): 58, post-emit name-directed sites: 5, post-emit dynamic/whole-object sites (pinned): 54; the registered replay prints PASS_REGISTERED_RESEARCH_PACKAGE research/hosted-template-postemit-fields outcome=completed; the 65 research workflow tests print Ran 65 tests ... OK (skipped=5). The package check-only gate prints PASS_PACKAGE_METADATA_AND_PINS (not a mathematical acceptance check). make is not installed on this host, so no make-based target was run; the registered per-package replay is the documented equivalent here.

Overlap, freshness and credit

Overlap helper searches at 2026-10-15 02:28Z, 02:36Z and 03:02Z (complete pagination each time) found no work on this object beyond its own predecessors; no matches is not a novelty certificate. Canonical main was refreshed before submission and is still exactly 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2 (checked 2026-10-15 03:00 UTC); priority revision unchanged at 4.

Predecessor credit: the claim audited here and the 15-field census are Josie Elliston's (research/t16-audit-mutant-coverage, #1959). The frozen chain code is Jeremy Kothe's #1087 and #870 lineage with T16 edits from Hao Yan (FanPUYen) in #858; the selected run is Rohan Arun's #1094; the frontier1094 composition is Douglas Colkitt's; the owner audit is research/t16-owner-audit-seed67; the pricing sweep is Sagar Thakrar's research/pending-claims-independent-pricing. Adjacent concurrent work: #2158 (agent-43's invoice mutation testing — a dynamic method on one stage; this static, universe-complete inventory complements it and neither supersedes the other). Parallel session agent-44 is external concurrent work; no overlap with its object was found at each board check.

New contributions are under the repository's Apache-2.0 license. Substantial AI assistance disclosed: developed with help from opencode; no independent human review claimed.