6.5 KiB
Repair5 source/local handoff (not acceptance)
The existing collector_protocol.json and operations_os_observer.gd remain authoritative about scope: the observer's local_unit_fixture_only_not_native_os_input_evidence summaries are never OS acceptance. No actual index is included. No engine executable path has been invented. TEST-ONLY fixtures exercise validators, not the game.
Composition and paths
Run the checker from ROOT or a directory within the same checkout. ROOT is obtained with scrubbed Git from the checker location. Relative sources, suite roster and artifacts never use cwd. The temporary tested view is materialized from verified T blobs within the existing task TMPDIR. The source map is exactly run_all_tests.source_refs' filter on T, including fixed settings and every source/asset/test/tool. The marker JSON (outside that filter) is mandatory in inputs. The checker helpers themselves must also be in inputs, as must the frozen spec, project.godot and suite-policy.json. Root can add other actual Git-file inputs; blob_bindings must equal the union of source_hashes and inputs, without omissions or extras. Bindings are SHA1 blob IDs, and source_hashes/inputs are SHA256 of the bytes.
The regular, non-symlink evidence-dir/root-composition.json is SHA256-bound by index.root_composition_sha256. Its S, M, Q and T are actual Git object IDs; mode is normal_validation or integration_final. Q parents must be exactly [M,S]. Normal validation runs at HEAD=S; integration_final additionally binds C=HEAD, its exact [M,S] parents, a clean checkout and C tree=T. CANDIDATE_COMMIT/TARGET_HEAD only detect mismatches.
Composition runs merge-tree M S in a private object directory and index, with repository objects as alternates. It accepts exactly the four content conflicts, replaces precisely those entries with S modes/blobs and compares write-tree with Q/T. Every M-only and nonconflicting merged entry survives. Private objects/index are deleted even on failure. The actual Main54 four input blobs are pinned in composition.py; changing any requires new reconciliation and a reviewed source-pin update. A docs-only M requires fresh Q parents and the actual new deterministic tree, never relabelling an old Q.
The generic functions re-express P23 reference blob 8a62d1e107. P23 identities and runtime receipts are not reused as P24 evidence. No P23 module is imported.
External engine and record correspondence
index.engine is {path, sha256, version}, separate from Git bindings. The actual regular external file is hashed without executing it. The OS receipt must carry the identical engine object, engine_started=true, engine_ended=true and strictly increasing started_monotonic_ns/ended_monotonic_ns. Root supplies the genuine path/version and runner receipt. All artifact/record provenance has root, S, T, source_map_sha256, pid, session_id and engine. source_map_sha256 hashes canonical UTF-8 JSON with sorted keys, compact separators and ensure_ascii=false. The OS receipt and os_environment share pid/session. Cross-process records additionally contain actual producer/consumer runtime receipts with different PIDs and identical manifest/world/source/engine bindings.
Each condition retains its prior passed/details/artifact_ids and content guards, and adds coverage. The exact meaning vocabulary is MEANINGS in correspondence.py, derived clause by clause from the frozen eight groups. Each coverage value is {artifact_id, pointer}, where pointer is a canonical /events/N JSON pointer into the existing OS format {action, monotonic_ns, ...observations}. The action names identify the individual meaning, never PASS. Observed fields listed in MEANINGS are supplementary collector data; they are not emitted by the old local observer and must be genuinely collected by Root. A flag cannot replace them. Multiple conditions may reference distinct records in one genuine OS trace. All listed artifacts must participate, except the required runtime receipt which is intrinsically used. Same bytes under alias IDs, reused records, relabelled actions, missing meanings, mismatched provenance, out-of-runtime events and fixture/template payloads fail.
Bubble records carry the actual observer shape {actor_id, kind, source_state, recorded_at}, plus OS render observations bound to the same actor/kind. Cutin records carry {kind, heading, message, recorded_at}, plus a production trigger and domain-event trace. These extra OS observations do not turn local record_bubble/record_cutin calls into production evidence. Final full-roster records retain the exact suite-set/source/results checks and require the same started/ended engine identity on all rows. Existing Japanese/IME, owned save path, pause/restart and Windows-not-accepted guards remain in place.
The unit-level test_only adapter is inaccessible from the CLI. It requires explicit TEST-ONLY fixture_scope and is used solely for synthetic validator controls. Actual verification rejects those controls. Static validity of the correspondence structure is not authentication of a human review or proof of gameplay: Root's independent review must inspect the actual raw receipts and observations.
UI and remaining scope
DefenseManager now connects visibility_changed before add_child, matching the existing dialogs. The added ordinary-cleanup test opens _show_defense_manager, attempts behind-dialog build/drop input on the real model, compares complete snapshots (including economy ledger) and selections, then closes and checks unblocking. It has not run in Godot.
The direct assign_staff_by_click test is not OS map-click evidence. Later OS collection must exercise the staff panel facility_option/apply_button route. No new map interaction or signal wiring was added. Bubble render/state transitions remain native/collector work. First-relationship order, the inherited heart rule and the O(N²) relationship scan are pending whole-eight review candidates, not new gameplay values or mandated optimizations.
The existing repair4 preservation helper now permits exactly the current P24 test SHA rebind. All other marker/policy values/order are preserved. It writes its historical result only with --write-evidence. Its historical set-based body comparison remains limited; optional full sequence hardening was not undertaken. Repair5 tests separately compare the entire main.gd delta to exactly the single callback line, world_preview byte-for-byte, the entire test outside the enumerated inserted block, and both JSON structures after undoing only the P24 pin. This does not re-prove P23.