Audit: executed counterexample to the selected chain's cross-stage owner-map binding (no new kappa)

[navinor]

Scope

Scoped adversarial audit of one named acceptance boundary of the selected chain: the cross-stage owner-map binding. No kappa, certificate, supplier or frontier change. Contributor: Aaron Wang, with help from opencode (substantial AI assistance; no independent human review).

Task card: supplier-boundary-audit (adversarial-audit; chooser OS nonce f96018873928dd5ec93e3ca2fe16f1d9, priority revision 4), refined to the cross-stage owner-map binding. Drawn cards uniform-transfer-audit and selected-stock-envelope matched recent claimed objects (#2273 completed the uniform-transfer object today; the one-stage stock object was claimed in #1166 (comment) and sits under several open PRs), so the second-choice card was taken per the pair-collision rule. Base main 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2; selected-record SHA-256 10b9e340fd8e354a37a0c4813c90e5de1dd42044b5f6aca4a3fc5a42b685fa32. Claim: #1166 (comment)

Question and result

The frozen PR 1087 selected chain certifies the frozen data/OWNERS.json.gz role map twice: lift16 checks every role inside its owner's actual window and independent-t16 rechecks it against invocation times. emit copies that map verbatim into the hosted template's hosting.pooled_slots (eleven fields per role, time included), and audit_allcold.py line 172 binds ten of the eleven fields back to the base-derived call owners. The chain also binds the template's bytes tightly by hash (audit line 185, invoice line 175, assemble line 240, plus verify_t16.py's asm/owner/inv template-sha equality).

Two fields bind to nothing: the pooled slot's time and hosting.owner_map_sha256. Josie Elliston's #1959 recorded this in source text ("line 172 compares a pooled slot's roles fields but not its time"; the owner-map link "was previously implied by that determinism, not checked") and checked the binding inside its own verifier. This package executes the gap end to end through the complete frozen caller.

Fixtures are canonical re-emits of the archived selected hosted template (every template-hash binding stays tight; only the audited field differs from the frozen owner map):

Fixture	Mutation	Chain outcome	Final binding	Link check
F0	none (re-emit fidelity control)	all six post-emit stages pass	20/20	passes
F1	two equal-width pooled slots exchange time	all six post-emit stages pass	20/20	fails on 2 role times
F2	hosting.owner_map_sha256 set to a wrong digest	all six post-emit stages pass	20/20	fails on the naming field
F3	one pooled slot's port (checked roles field) changed	rejected by audit at line 172	not run	fails on port
F4	F1's swap with a stale HOSTED.json hash	rejected by audit at line 185	not run	fails on 2 role times

The six stages are the frozen audit, invoice, assembly, admission-controls, bit-supplier-controls and independent-t16, run out-of-process through the pinned run_portable.py exactly as verify_t16.py invokes them. The 20 final-binding assertions are verify_t16.py's own (driver pinned by archive-member SHA-256 050e2dfb...), reimplemented 1:1.

Accepted counterexample (F1). Pooled slots 0 and 480, that is (stage 0, replica 0, helper 0) and (stage 0, replica 8, helper 0), both width 9, exchange their invocation times 0 and 1. Every per-time width count is preserved, so no count, profile, rank-mass, deficit, prefix or row coefficient moves. The complete frozen chain accepts the template and all 20 final-binding assertions pass; the only receipt differences from the archived selected run are the expected template_sha256 hash cascades. The owner-map binding fails on exactly those two roles: the template now says each helper runs at the other's invocation.

What would change downstream. The certified owner-window and invocation-time evidence applies to the frozen OWNERS times, not to the template's. A hosted-schedule consumer reading hosting.pooled_slots from the accepted template would host those two helpers at invocations no check validated. Inside the frozen chain the time column is inert (F1's receipt diffs are hash cascades only), so this is a contract gap at the accepted artifact boundary, not a change to the selected arithmetic.

What the chain does catch (controls). A checked roles field is rejected at audit line 172 (F3); a template whose bytes disagree with HOSTED.json's recorded hash is rejected at audit line 185 (F4). Artifact integrity is enforced; semantic equality of the pooled role map with the frozen owner map is not, beyond the ten fields line 172 compares.

Reproduce

python3 -B research/selected-ownermap-binding-gap/verify.py

Expected status PASS_SELECTED_OWNERMAP_BINDING_GAP, output equal to the committed EXPECTED.json (about 3-5 minutes). Stdlib only; checked on CPython 3.12. scripts/research_package.py --package research/selected-ownermap-binding-gap --check-only passes (PASS_PACKAGE_METADATA_AND_PINS), and the 65 research workflow tests pass.

Serialisation notes (per CONTRIBUTING.md's regenerated-artifact rule): two machine-dependent serialisations are normalized before comparing receipts with the archived ones - independent-t16 keys its input_sha256 by absolute input paths, and the frozen invoice's artifact_semantic_sha256 map is serialized in directory-enumeration order, so the byte hash assemble records as input_sha256.fresh_invoice varies by filesystem. Everything else reproduces the archived receipts exactly.

Not checked

• Pre-emit stages (restore-parent, bind8, lift16, bind, emit) are not re-run: the fixture mutation stands in for an emit defect in the unchecked fields (or post-emit tampering), and emit pins the OWNERS input by hash against the SPEC. Provider content binding against baseline1042's slots/local is not re-checked (upstream of the mutation point).
• audit's module-level provider checks (lines 20-80), the nine other archived audit_allcold.py versions (Audit: mutant coverage of the selected T16 controller/owner audit (no gap found, no new kappa) #1959 open question 1), and the cold baseline are untouched.
• No cold rebuild, no Linux/macOS run, no formal kernel, no human review. The archived selected fixture satisfies the binding; the counterexample is synthetic and scoped to this interface. This is one missing implication at one interface, executed end to end, not a general statement about emitter correctness.

Repair status and credit

The minimal repair is the two-equality guard the package's link_check implements (pooled slots equal the frozen OWNERS content; owner_map_sha256 equals the SHA-256 of the frozen gzip), added to a successor replay driver with frozen code unchanged. That repair stays blocked on a maintainer decision on wrapping the frozen verify_t16.py (#1959 open question 2) and is not attempted here.

Predecessor credit: Josie Elliston's #1959 (research/t16-audit-mutant-coverage/) identified the gap, supplied the boundary-check precedent and open question 2, and is the direct predecessor. The frozen chain is Jeremy Kothe's #1087 / #870 gauge44-barch-t16 code with Hao Yan's (@FanPUYen) #858 T16 controller, lift16 and indep16; Rohan Arun's #1094 supplies the selected exchanges and archived run; the maintainer's frontier1094 audit archived the fixture. Concurrent and complementary: #2273 machine-checks that the 15 audit-unread fields (owner_map_sha256 among them) have no post-emit reader; this PR supplies the executed end-to-end acceptance of the wrong value and of the retimed role map.

Branch research/agent-46-ownermap-binding-f9601887, contribution head pushed to navinor/integer-mult-bounds. Package: research/selected-ownermap-binding-gap/ (README, TASK.json, SOURCES.json, VERIFY.json, verify.py, EXPECTED.json). New contributions are under the repository's Apache-2.0 license; source notices are retained.