research: audit selected PR589 source blob binding

research/selected-bit-source-binding-audit/README.md

@@ -0,0 +1,96 @@
+# Selected PR589 bit supplier source binding
+
+## Question and scope
+
+For the selected #1094 composition, does the T16 assembler bind the cited PR589
+bit supplier bytes to the source identity recorded in the assembly and retained
+by the complete composition caller? This checks one source field only: the
+expected Git blob ID `BIT_BLOB` for the supplier record. It does not audit the
+supplier's mathematical derivation, rerun the complete composition, admit a
+supplier, or change the selected result.
+
+The scatter/export example from the task card is now covered by the live
+handoff's PR #3801, so this is a complementary source-binding scope. The remote
+hypothesis-tracing and semantic-supplier-fixture lanes remain separate.
+
+## Result
+
+**The pinned source identity is enforced.** The T16 assembler loads
+`inputs/PR589-EXPECTED.json` only after `load_bit()` recomputes its Git blob ID
+and matches the hardcoded 40-hex `BIT_BLOB`. The record copy is byte-identical
+to the PR589 head blob at
+`a5afc8c6169ea61ba7c51dfd3cade02cc7b13b46:research/e8-bit-p111/tune/EXPECTED.json`
+and to the merged source path
+`b3eb785ac5b4b1ca2beea0f80db078a505626a90:research/e8-bit-p111-tuned/tune/EXPECTED.json`.
+Both are Git blob `e293ddc557742637f9f679f083a1a282d87b1b13` (SHA-256
+`b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4`). This
+also resolves the source path rename between the PR head and merged tree by
+content identity.
+
+The positive fixture calls the production `assemble.load_bit()` on the pinned
+T16 input and confirms it yields the selected `bit_lower` value
+`1733427039589844234749/10^24`. The negative fixture changes only
+`BIT_BLOB`'s first hexadecimal digit, preserving a valid 40-character lowercase
+SHA-1 representation. The same production loader rejects the unchanged source
+bytes with `AssertionError: bit supplier blob pin`. The selected assembly's
+`input_sha256["package:inputs/PR589-EXPECTED.json"]` independently matches the
+same T16 source bytes.
+
+The record-to-caller chain is source-bound as follows:
+
+- `certificates/selected-result.json` hashes the selected assembly bytes, and
+  the selected record checker compares every file in the source inventory with
+  its listed digest. This audit separately pins the selected manifest and its
+  relevant inputs at the assigned base commit. The inventory includes the
+  original supplier record, the T16 copy, and `gauge44-slots-t16/code/assemble.py`.
+- The T16 assembler emits the supplier blob ID in `ASSEMBLY.json` and computes
+  the bit profile only after the loader check. The existing bit supplier
+  controls separately exercise 12 semantic and profile mutations; this audit
+  does not repeat those fixtures.
+- `make frontier1094-verify` runs the selected record check and
+  `scripts/verify_frontier1094.py`; that caller requires the final assembly's
+  `bit_supplier` record to equal the retained T16 baseline record and checks the
+  selected exact kappa and full control counts.
+
+This establishes a checked source identity edge for the selected bit input. It
+does not replay `make frontier1094-verify`, prove the supplier's mathematical
+claim, or resolve the inherited all-size/compiler, mutable-source,
+whole-call-hosting, precision/tape, or analytic assumptions in the selected
+scope.
+
+## Reproduce
+
+From the repository root, with the selected package source paths materialized:
+
+```sh
+python3 scripts/research_package.py --package research/selected-bit-source-binding-audit --check-only
+python3.12 scripts/research_package.py --package research/selected-bit-source-binding-audit
+```
+
+The direct standard-library verifier is:
+
+```sh
+python3.14 -I -X pycache_prefix=/tmp/selected-bit-source-binding-pycache -B research/selected-bit-source-binding-audit/verify.py
+```
+
+`RESULT.json` records its deterministic output. The test uses the pinned
+production loader in a fresh Python module instance and mutates only its
+expected blob ID in memory.
+The metadata check passed here and the direct verifier passed under Python
+3.14.8. The registered package replay could not start because this host has no
+Python 3.12 interpreter; no substitute registered replay is claimed.
+
+## Open next questions
+
+No new question is justified by this one closed source-identity check. Reopen
+this audit if the selected bit supplier bytes, path, or composition route
+changes.
+
+## Credit
+
+The selected assembly and verifier retain Douglas Colkitt's and credited
+predecessor contributions. The T16 controller lineage credits Hao Yan. The
+bit record is from DreamingOfClouds's PR #589 and its tuned word lineage from
+PR #555, as described in the pinned source package. This source-binding audit
+was prepared by OpenAI Codex (laptop-11), with substantial OpenAI Codex
+assistance. No independent human or formal-kernel review is claimed. Apache-2.0.

research/selected-bit-source-binding-audit/RESULT.json

@@ -0,0 +1,18 @@
+{
+  "status": "PASS_SELECTED_BIT_SOURCE_BINDING_AUDIT",
+  "base_commit": "20ecf2891d80b5acf18d980b2164fb44ea7faa90",
+  "selected_record_sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129",
+  "selected_kappa": "836330098538459/500000000000000000",
+  "supplier_pr": 589,
+  "supplier_head": "a5afc8c6169ea61ba7c51dfd3cade02cc7b13b46",
+  "supplier_source_path_at_head": "research/e8-bit-p111/tune/EXPECTED.json",
+  "supplier_merge": "b3eb785ac5b4b1ca2beea0f80db078a505626a90",
+  "supplier_path_at_merge": "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+  "supplier_git_blob_sha1": "e293ddc557742637f9f679f083a1a282d87b1b13",
+  "supplier_source_sha256": "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4",
+  "selected_bit_lower": "1733427039589844234749/1000000000000000000000000",
+  "loaded_bit_lower": "1733427039589844234749/1000000000000000000000000",
+  "mutant_git_blob_sha1": "0293ddc557742637f9f679f083a1a282d87b1b13",
+  "mutant_rejected_by": "assemble.load_bit: bit supplier blob pin",
+  "scope": "One source identity binding only; no construction replay or supplier admission."
+}

research/selected-bit-source-binding-audit/SOURCES.json

@@ -0,0 +1,96 @@
+{
+  "schema_version": 1,
+  "base_commit": "20ecf2891d80b5acf18d980b2164fb44ea7faa90",
+  "files": [
+    {
+      "path": "certificates/selected-result.json",
+      "usage": "input",
+      "git_blob": "b1fea0c94436b236cc2b7d41a7be032811b94c81",
+      "sha256": "bb2eaa58647b353f88d0aec2eafb9d30df1be53589231b23e12ceef3e4bad129"
+    },
+    {
+      "path": "docs/research/agent-task-catalog.json",
+      "usage": "provenance",
+      "git_blob": "67f085acd86acd7d4e03922d9cf4b26bca66fed5",
+      "sha256": "47b42433f5a85809a3aadd29c2c339da2c6ed728e4f7762df6b88bccb7874cf0"
+    },
+    {
+      "path": "research/community-frontier1094-audit/ASSEMBLY.json",
+      "usage": "input",
+      "git_blob": "5fd676df060f3b450782fdf5ff5f6beb63a5eeb0",
+      "sha256": "1122cb3a575f8c788345fc1bf4c108ac7c3250fb81a5988671f5eb04b3ab3045"
+    },
+    {
+      "path": "research/community-frontier1094-audit/SELECTED-SOURCE.json",
+      "usage": "input",
+      "git_blob": "6a75493790b4eff9c4a98051ef8b01d6aad0d5a8",
+      "sha256": "79b3de5db3dbcb9829789ba58e9e45758926031e2a7d80667a08429d369be53b"
+    },
+    {
+      "path": "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+      "usage": "input",
+      "git_blob": "e293ddc557742637f9f679f083a1a282d87b1b13",
+      "sha256": "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4"
+    },
+    {
+      "path": "research/gauge44-slots-t16/code/assemble.py",
+      "usage": "input",
+      "git_blob": "581dd9cb29a45bd68cc651538311b63f6966ad68",
+      "sha256": "15f6986a476bac76bcdc0bfcf51da115389b46f1950d2766b6822f757888b13a"
+    },
+    {
+      "path": "research/gauge44-slots-t16/code/bit_supplier_controls.py",
+      "usage": "input",
+      "git_blob": "e86b8527b464277a926a788f2493e8f2e091fff1",
+      "sha256": "e6d33fb61a570c3f50669412acc467a3fd06ef0b806da6a75bc296c6ba2142a5"
+    },
+    {
+      "path": "research/gauge44-slots-t16/inputs/PR589-EXPECTED.json",
+      "usage": "input",
+      "git_blob": "e293ddc557742637f9f679f083a1a282d87b1b13",
+      "sha256": "b9f0e5ca038abe837b0007c8fe006f366a6f02009244ac57705a8a200e2301f4"
+    },
+    {
+      "path": "scripts/verify_frontier1094.py",
+      "usage": "input",
+      "git_blob": "96e6c1386bd052b9bcaf136d934406f3f0c3f777",
+      "sha256": "c7e20f59968ed5736fb859735de4de207de3418083e37012310ebcded946b949"
+    },
+    {
+      "path": "research/gauge44-slots-t16/code/witness.py",
+      "usage": "input",
+      "git_blob": "c5c7fbc1142220ce854907de4e439420ac12d30c",
+      "sha256": "779c5172894b992131e85be1e592ed2a1aec8c287b872ff42007d36a7291e444"
+    },
+    {
+      "path": "research/gauge44-slots-t16/data/SPEC.json",
+      "usage": "input",
+      "git_blob": "84450b3b278e0409b66176598900b74412298a72",
+      "sha256": "78fb24ab0852fa52ceada755aff737165e92f80e5fff89a5452c9eceaae4f63c"
+    },
+    {
+      "path": "research/gauge44-slots-t16/construction/leaver/PIVOT-SWAP-k8.json",
+      "usage": "input",
+      "git_blob": "7a8edeb1e404c441577427e72557e26b06c945f1",
+      "sha256": "3ef7acf0cf67442a532f25b53d5fbeda76d3a84524118df8e003ca69b5cac0bb"
+    },
+    {
+      "path": "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/moment.py",
+      "usage": "input",
+      "git_blob": "7d697cb45203fe72d97037403d6da41f71f3b7fd",
+      "sha256": "81cbc864e106418fc7854322746f72180cb8110ff39f74450a3b8d55a82c1482"
+    },
+    {
+      "path": "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/base_two_moment.py",
+      "usage": "input",
+      "git_blob": "14a90fa0e788217856f070382c9e61bd7c603c61",
+      "sha256": "aee70c242a2f1d225528fabe2002e1564d1dc884797c07d28a831c7878ee9098"
+    },
+    {
+      "path": "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/outer.py",
+      "usage": "input",
+      "git_blob": "43007488ad2c43187c77cc6798beff8b1cd76ad2",
+      "sha256": "c1ebb52163a7219504c728a5c2b098bf1e50bf20148a2879c5a74c3cadc7c03c"
+    }
+  ]
+}

research/selected-bit-source-binding-audit/TASK.json

@@ -0,0 +1,60 @@
+{
+  "schema_version": 1,
+  "task_id": "supplier-boundary-audit",
+  "priority_revision": 6,
+  "base_commit": "20ecf2891d80b5acf18d980b2164fb44ea7faa90",
+  "original_card": {
+    "id": "supplier-boundary-audit",
+    "question": "Does one selected supplier obligation follow from its actual source-bound checks?",
+    "starting_points": [
+      "certificates/selected-result.json",
+      "research/owner-boundary-audit/README.md",
+      "research/scatter-export-parity-audit/README.md"
+    ],
+    "methods": [
+      "Trace one hypothesis through the source, checker and complete caller.",
+      "Construct one semantically invalid but superficially well-formed fixture and test rejection."
+    ],
+    "acceptance_gate": "Pin the current sources and one obligation; the historical owner audit is an example, not evidence of a current bug.",
+    "first_step": {
+      "command": [
+        "python3",
+        "-B",
+        "scripts/research_baseline.py"
+      ],
+      "expected": "PASS_RESEARCH_BASELINE_BINDINGS_ONLY",
+      "inspect": "Read #2977 reported duplicate-scatter counterexample and its opt-in repair. The archive is not a production fix or an independently validated selected-result failure; the selected generator emits unique rows.",
+      "scope": "Source-binding orientation only; does not replay or validate the reported bug."
+    },
+    "first_experiment": "First check whether the scatter repair has been adopted. If still open, independently reproduce #2977 symbolic-versus-exported parity on the tiny duplicate fixture, compare the selected unique-row positive control, and define either enforced uniqueness or consistent multiplicity semantics. A bounded guard-adoption patch must preserve valid inputs and test the actual exported action. Stop after this obligation; no full historical replay or frontier change follows from the mutant alone.",
+    "bottleneck_link": "Closing a current acceptance gap or proof obligation strengthens reliability even without changing kappa.",
+    "allowed_variations": [
+      "Audit one named current condition using a new semantic counterexample."
+    ],
+    "scope_change_triggers": [
+      "Reporting the historical timing-only diagnostic as a new current acceptance bug.",
+      "Calling a malformed mutant a failure of the selected construction, or importing an opt-in repair without testing the exporter boundary."
+    ],
+    "overlap_terms": [
+      "owner boundary",
+      "bridge omission",
+      "hosting",
+      "2977",
+      "scatter export",
+      "duplicate index",
+      "parity semantics"
+    ]
+  },
+  "scope_status": "refined",
+  "actual_scope": "Does the selected PR589 bit supplier's Git blob identity bind the source record that the T16 assembly reads and the #1094 composition retains?",
+  "scope_change_reason": "The live scatter-boundary handoff is complete in PR #3801, and the laptop assignment was specifically the source-binding lane. This audit isolates the T16 supplier blob pin from the remote hypothesis-tracing and semantic-fixture scopes.",
+  "bottleneck_link": "The selected complex-side composition retains this bit supplier as the other certified cap; authenticating the exact bit record is a necessary source-binding obligation, but does not establish supplier admission or change kappa.",
+  "budget_minutes": 60,
+  "stop_rule": "Stop after checking the pinned source/certificate/caller chain and one valid 40-hex digest mutant. Do not run the full historical composition replay or change the selected frontier.",
+  "outcome": "completed",
+  "evidence": "The T16 loader accepts the PR589 source bytes at Git blob e293ddc557742637f9f679f083a1a282d87b1b13 and produces the selected bit_lower. A one-nibble, still-valid SHA-1 digest mutant is rejected by the production load_bit guard. See README.md and RESULT.json.",
+  "author": "OpenAI Codex (laptop-11)",
+  "ai_assistance": "Substantial OpenAI Codex assistance for source tracing, fixture construction, and verification.",
+  "open_questions": [],
+  "no_open_questions_reason": "This exact source-identity check is closed for the selected PR589 record. Reopen only if the selected supplier bytes or source route changes."
+}

research/selected-bit-source-binding-audit/VERIFY.json

@@ -0,0 +1,34 @@
+{
+  "schema_version": 1,
+  "status": "ready",
+  "python": "3.12",
+  "requirements": [],
+  "inputs": [
+    "certificates/selected-result.json",
+    "research/community-frontier1094-audit/ASSEMBLY.json",
+    "research/community-frontier1094-audit/SELECTED-SOURCE.json",
+    "research/e8-bit-p111-tuned/tune/EXPECTED.json",
+    "research/gauge44-slots-t16/code/assemble.py",
+    "research/gauge44-slots-t16/code/bit_supplier_controls.py",
+    "research/gauge44-slots-t16/inputs/PR589-EXPECTED.json",
+    "scripts/verify_frontier1094.py",
+    "research/gauge44-slots-t16/code/witness.py",
+    "research/gauge44-slots-t16/data/SPEC.json",
+    "research/gauge44-slots-t16/construction/leaver/PIVOT-SWAP-k8.json",
+    "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/moment.py",
+    "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/base_two_moment.py",
+    "research/complex-sw4-frame8/vendor/main/research/complex-k492-owner-repair/vendor/multicold/engines/outer.py"
+  ],
+  "commands": [
+    {
+      "argv": [
+        "{python}",
+        "-I",
+        "-B",
+        "{package}/verify.py"
+      ],
+      "timeout_seconds": 120,
+      "checks": "Original PR589 source bytes and T16 copy equal the pinned Git blob; production loader returns the selected bit_lower; one distinct valid 40-hex digest mutant is rejected."
+    }
+  ]
+}