P18-01-CODE: 原本関係モデル・旧値保全・Runtime保存と読取経路

2026-10-13 14:40:02 +09:00
parent f76ad96990
commit 0084760ee0
2 changed files with 544 additions and 48 deletions
@@ -0,0 +1,80 @@
+# P18-01-CODE recorded repair 2/2: collection / verification split
+
+Resumes candidate `f76ad96990a4d7371b6ab667df0a068cc06be798`. No counter reset,
+game/test reconstruction, Runner change, commit or integration. Changes are confined
+to the narrow collector and this note. Existing game behavior evidence remains the
+retained Astra preflight; this worker did not rerun or reinterpret it as final proof.
+
+## Modes
+
+- Default: `python -B tools/run_p18_relationship_tests.py --output {build_dir}/p18-relationship-evidence`.
+  Read-only verification in the ordinary registered sandbox. No subprocess call,
+  process discovery, native launch, or access to the external player/private profiles.
+  Current checkout source/settings/support/marker bytes and the locally configured
+  `godot` binary are read for pins. Receipt-provided paths never select an external
+  file to open. Original absolute paths remain historical identity strings.
+- `--collect`: Root orchestration only, outside Seatbelt. Uses the existing
+  `source_refs`, private source copy, `execute_phase`, owned_outer, Guard, logger,
+  diagnostic, marker and bounded cleanup contracts unchanged. Fresh output outside
+  the checkout, with an existing parent, is required. Runs import, all 308 scripts,
+  and exactly the seven fixed tests once. Owned profile bytes are archived after
+  each phase. The final verifier runs after collection; no duplicate regression.
+  “Root” identifies the authorized orchestrator, not a requirement to run as Unix uid 0.
+- `--prepare-only`: reports source bytes, available capacity, 308 parse paths and
+  the exact seven-test/nine-phase roster; creates no stage/profile and starts no engine.
+
+Only `--output`, `--collect`, `--prepare-only` and help are accepted. Duplicate,
+abbreviated, unknown and malformed flags, combined modes, traversal, symlinks,
+nonregular evidence and hardlinked evidence reject. Verification never rewrites
+raw paths or files. The ordinary-owner pure proof reader maps only the original
+output prefix to the supplied output and checks confinement before opening files.
+
+## Receipt schema
+
+`receipt.json` (`guarded-p18-v2`) is written last after successful collection.
+It contains the full relative source content map (bytes/SHA-256, no checkout-path
+dependency), its canonical JSON SHA-256, project and marker-contract SHA-256,
+engine SHA-256, and a complete relative file inventory with byte sizes/SHA-256.
+The inventory covers the retained private source, engine bytes, bootstraps,
+starters, raw stdout/stderr/native logger, phase receipts, START/END/process and
+both cleanup records, Guard reports, ordinary/audio ownership proofs, typed
+snapshots, and complete archived startup/runtime profiles. Only the enclosing
+receipt itself is outside its own inventory.
+
+Verification checks the inventory and recomputes raw marker/diagnostic gates,
+source and helper pins, exact commands, START/END identity, all nine distinct PIDs
+and bounded cleanup, Guard conditions, proof gates, complete player before/after
+inventory equality, and seven test rows against nine phase receipts. It requires
+one exact `FULL_DEPENDENCY_PARSE checks=308 failures=0` marker. Old v1, absent,
+incomplete, mismatched or altered evidence rejects. A source change, including
+this collector, requires fresh Root collection; no source exemptions exist.
+
+## Worker checks and environment observations
+
+AST/in-memory compile and prepare-only passed. Prepare-only found 1311 source
+files, 308 parse scripts, seven tests and nine future phases, with sufficient
+reported capacity. Synthetic negative checks rejected missing receipts, changed
+hashes, symlinks, relative and absolute escapes, incomplete files and invalid or
+duplicate flags/mode combinations. Those checks replaced subprocess entry points
+and default-player access with fail-fast functions; neither was called. No native
+test, full regression, `--collect`, Runner operation or review was executed.
+
+Environment evidence: a shell here-document failed with
+`zsh:1: can't create temp file for here document: operation not permitted`.
+The `python` alias was unavailable (`zsh:1: command not found: python`);
+worker checks used `/usr/bin/python3 -B`. Ordinary authorized file edits and
+temporary negative fixtures under the task allocation succeeded. No isolation
+or permission policy was changed. Root/Runner must provide the configured
+`python` command used by the fixed validator argv.
+
+## Root next steps
+
+1. On the final unchanged source, run the native `--collect` exactly once outside
+   Seatbelt into the allocation build directory's fresh `p18-relationship-evidence`.
+   Do not reuse old v1 evidence or run collection from ordinary Runner validation.
+2. Run ordinary Runner validation using the fixed default verify-only argv.
+3. Obtain a separate Opus review, then perform the authorized integration and
+   affected final validation. This worker submits implementation, not acceptance.
+
+P18-01 remains incomplete: ordinary UI rendering/display equality, approved initial
+values, the full final roster and applicable Windows final acceptance remain unmet.