Skip to content

Audit Windows path-key rejection in selected PR1094 manifests - #2316

Merged
Mister-Meeseeks merged 1 commit into
CrocSwap:mainfrom
josecarlosgonzalezroque-design:research/windows-final-stage-audit
Oct 15, 2026
Merged

Mister-Meeseeks merged 1 commit into
CrocSwap:mainfrom
josecarlosgonzalezroque-design:research/windows-final-stage-audit

Conversation

@josecarlosgonzalezroque-design

Copy link
Copy Markdown
Contributor

Change and mathematical scope

The unchanged selected PR1094 entry point fails on native Windows with Submission file inventory or hash changed, before output-directory creation. Both inventory guards serialize relative paths with str(...), producing backslashes that disagree with the pinned manifests despite unchanged bytes.

This audit reproduces that failure and tests two in-memory .as_posix() substitutions against the authenticated original guard ASTs. It covers 13 submission files and 179 archived PR1087 files, with 3 and 160 affected names and zero digest drift. Frozen sources and the selected frontier remain unchanged. No complete supplier replay or new kappa is claimed.

Task and overlap

Base: current canonical main 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, refreshed before submission. One-shot task: portable-replay, scope key 91a9a2afec282c926282; scope refined to the Windows handoff in #1824. This is inventory admission before the downstream payload/reference work in #2040, #2059 and #2101 (head a247ef876e50bf3a7d890c7c1f9b409576674d7d). Source pins, method choice and partial overlap-search coverage are recorded in TASK.json and SOURCES.json. No advance public claim was posted.

Validation

Native Windows 11 / CPython 3.12.14:

  • Selected baseline passed with 1,579 pinned files.
  • python -B scripts/research_package.py --package research/selected1094-windows-manifest-audit --check-only passed.
  • python -B scripts/research_package.py --package research/selected1094-windows-manifest-audit passed; registered child uses -I -O -B, while the frozen assertions are explicitly compiled at optimization level 0.
  • 391 deliberate corruptions rejected: changed/omitted payloads, extra/renamed files, and modified immutable script/manifest/archive inputs.

Metadata plus registered replay took 42.89 seconds. Deterministic RESULT.json and host-specific VALIDATION.json record evidence and setup. No complete final-stage, cold ancestry, Linux, macOS, hosted-CI or mathematical proof replay is claimed.

Credit

Credit Rohan Arun, Jeremy Kothe, Hao Yan, Douglas Colkitt, Josie Elliston, Maxime Fleury, Antoine Olivier, commdata2338, and Adam Gall for the retained sources and predecessor work. Existing licenses and attribution remain intact; new work is Apache-2.0. Substantial OpenAI Codex assistance in investigation, implementation, testing and writing; self-reviewed, with no independent human review claimed.

Open next questions

The package README and structured task record specify the next step: a separately versioned successor wrapper with the two documented key conversions, followed by complete native Windows execution with all assertions and strict output comparison enabled. Passing these inventory guards alone does not establish supplier admission.

Reproduce the unchanged entry-point failure, test a two-expression
in-memory repair, and reject 391 payload/inventory/source mutations.
Frozen sources and the selected frontier remain unchanged.

Prepared with substantial OpenAI Codex assistance.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants