Repository navigation
Check package bytes against the publication commit - #2602
Merged
Merged
Conversation
4 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A source-hash receipt can pass locally while describing different bytes from its publication commit: Git text normalization or a clean filter may change the blob even when
git diffis empty. This occurred during PR2597 preparation and was corrected with a fresh kernel run before publication.Add an optional read-only preflight,
python3 scripts/check_research_commit.py --package research/NAME [--ref COMMIT]. It compares raw package bytes and declared VERIFY inputs with the named commit, detects omitted or extra nonignored package files, and rejects committed nonregular entries. It never normalizes evidence or runs a verifier. Ignored runtime artifacts, undeclared dependencies, mathematical validity and CI environment equivalence remain outside its scope. Existing replay behavior is unchanged.Validation:11 focused actual-Git tests pass under optimized CPython3.12.14, including real CRLF-to-LF normalization with a clean Git diff, binary inputs, omitted/staged files, old refs, missing files, symlink Git modes, Unicode/wildcard-literal paths, CLI failure/success and read-only behavior. Separate AI review caught a skipped final iterator status check; the fix and a yield-then-fail regression pass. The checker also passes all10 exact committed PR2597 package files.
Started from and refreshed canonical main0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, priority4. Picker nonce98436992d2f3a676112f3eec2d5728df assigned complex-new-helper-inventory; scope explicitly changed after the prescribed ceiling/lever controls to this concrete publication-reproducibility failure. No new local profile or research acceptance gate is claimed. Overlap inspected historical CRLF repairs and source adapters; no equivalent general preflight found in the bounded metadata search. Latest complete REST snapshot797 open PRs at15:52UTC; Discussion1239 records remain15:22UTC because GraphQL quota prevents refresh. Metadata coverage is not a novelty certificate. Claim: #2597 (comment)
Reuse and credit Douglas Colkitt's package path/blob validation helpers. Prepared for ywz65 with substantial OpenAI Codex assistance; no hosted-CI or independent human review claimed.