TheTree_mock/docs/plans/original-completion-2026-10-02/execution/p18-01-code/repair-ready-verifier-v2.md

P18-01-CODE recorded repair 2/2: collection / verification split

Resumes candidate f76ad96990a4d7371b6ab667df0a068cc06be798. No counter reset, game/test reconstruction, Runner change, commit or integration. Changes are confined to the narrow collector and this note. Existing game behavior evidence remains the retained Astra preflight; this worker did not rerun or reinterpret it as final proof.

Modes

• Default: python -B tools/run_p18_relationship_tests.py --output {build_dir}/p18-relationship-evidence. Read-only verification in the ordinary registered sandbox. No subprocess call, process discovery, native launch, or access to the external player/private profiles. Current checkout source/settings/support/marker bytes and the locally configured godot binary are read for pins. Receipt-provided paths never select an external file to open. Original absolute paths remain historical identity strings.
• --collect: Root orchestration only, outside Seatbelt. Uses the existing source_refs, private source copy, execute_phase, owned_outer, Guard, logger, diagnostic, marker and bounded cleanup contracts unchanged. Fresh output outside the checkout, with an existing parent, is required. Runs import, all 308 scripts, and exactly the seven fixed tests once. Owned profile bytes are archived after each phase. The final verifier runs after collection; no duplicate regression. “Root” identifies the authorized orchestrator, not a requirement to run as Unix uid 0.
• --prepare-only: reports source bytes, available capacity, 308 parse paths and the exact seven-test/nine-phase roster; creates no stage/profile and starts no engine.

Only --output, --collect, --prepare-only and help are accepted. Duplicate, abbreviated, unknown and malformed flags, combined modes, traversal, symlinks, nonregular evidence and hardlinked evidence reject. Verification never rewrites raw paths or files. The ordinary-owner pure proof reader maps only the original output prefix to the supplied output and checks confinement before opening files.

Receipt schema

receipt.json (guarded-p18-v2) is written last after successful collection. It contains the full relative source content map (bytes/SHA-256, no checkout-path dependency), its canonical JSON SHA-256, project and marker-contract SHA-256, engine SHA-256, and a complete relative file inventory with byte sizes/SHA-256. The inventory covers the retained private source, engine bytes, bootstraps, starters, raw stdout/stderr/native logger, phase receipts, START/END/process and both cleanup records, Guard reports, ordinary/audio ownership proofs, typed snapshots, and complete archived startup/runtime profiles. Only the enclosing receipt itself is outside its own inventory.

Verification checks the inventory and recomputes raw marker/diagnostic gates, source and helper pins, exact commands, START/END identity, all nine distinct PIDs and bounded cleanup, Guard conditions, proof gates, complete player before/after inventory equality, and seven test rows against nine phase receipts. It requires one exact FULL_DEPENDENCY_PARSE checks=308 failures=0 marker. Old v1, absent, incomplete, mismatched or altered evidence rejects. A source change, including this collector, requires fresh Root collection; no source exemptions exist.

Worker checks and environment observations

AST/in-memory compile and prepare-only passed. Prepare-only found 1311 source files, 308 parse scripts, seven tests and nine future phases, with sufficient reported capacity. Synthetic negative checks rejected missing receipts, changed hashes, symlinks, relative and absolute escapes, incomplete files and invalid or duplicate flags/mode combinations. Those checks replaced subprocess entry points and default-player access with fail-fast functions; neither was called. No native test, full regression, --collect, Runner operation or review was executed.

Environment evidence: a shell here-document failed with zsh:1: can't create temp file for here document: operation not permitted. The python alias was unavailable (zsh:1: command not found: python); worker checks used /usr/bin/python3 -B. Ordinary authorized file edits and temporary negative fixtures under the task allocation succeeded. No isolation or permission policy was changed. Root/Runner must provide the configured python command used by the fixed validator argv.

Root next steps

1. On the final unchanged source, run the native --collect exactly once outside Seatbelt into the allocation build directory's fresh p18-relationship-evidence. Do not reuse old v1 evidence or run collection from ordinary Runner validation.
2. Run ordinary Runner validation using the fixed default verify-only argv.
3. Obtain a separate Opus review, then perform the authorized integration and affected final validation. This worker submits implementation, not acceptance.

P18-01 remains incomplete: ordinary UI rendering/display equality, approved initial values, the full final roster and applicable Windows final acceptance remain unmet.