8.7 KiB
Repair6 source/local protocol — not acceptance
Scope is only M1 and M2 from actual f725571e5b46473ea04a90424a404bd5. Current worker HEAD is 78f7cba7a9fb5e5dcb144758e1a86fe63b3d7d08; edits are uncommitted. No real index is supplied or created. All eight groups remain unaccepted; original 30/88 and formal14 are unchanged. No Godot, native, OS, full-roster or Windows execution occurred. Synthetic TEST-ONLY fixtures never become evidence.
The repair5 composition.py is byte-identical (SHA256 b2fc058b1589310499917c8c5fad056fd8861ccf6bb32dd3ce205d367f493864). Its original root, S/M/Q/T, mode, deterministic composition, complete source map, helper pins and source/checkout guards still apply. No new composition implementation or alternate result flag exists. Main, world_preview, UI tests, marker and policy are unchanged in repair6. The optional defense-test positive control and unrelated low findings are deferred.
Preservation
All three source comparisons in PreservationTests use bd3a134051, as do the JSON comparisons. Reads use composition.git_bytes, which strips every inherited GIT_* variable. A negative-environment control supplies invalid GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE and still runs the entire preservation check. world_preview must match baseline bytes; main must contain exactly the existing callback delta; the UI test must contain exactly the existing added block. There is no moving HEAD baseline or trivial baseline==HEAD success path.
Local checks only describe these uncommitted worker bytes. Root must normally submit, then run test_repair5.py and test_repair6.py at the actual new S and actual prepared Q before heavier tests, followed by the actual independent limited Opus review. This worker does not claim post-submit reproducibility has been observed.
Stage applicability
Mode comes from the verified root-composition.json, never an index waiver. Both modes require all eight condition keys, every applicable runtime/OS meaning, static/import/local commands, full roster, source/config/engine bindings, original content guards, IME/save/restart and Windows classification.
In normal_validation HEAD must be S. The final_validation_review group has passed=false and status=prerequisites-only. Its static_import_local_affected and exact_final_full_roster coverage links remain mandatory. Its independent_claude_runtime_review and current_main_integration_final coverage values must each be exactly {"status":"not-yet-applicable"}. They are not satisfied or synthesized; later artifacts cannot be slipped into normal validation as fillers. Other groups retain their strict passed=true declaration plus substantive evidence. Successful normal verification reports only source/runtime/OS/roster prerequisites and explicitly P24-02 NOT complete, all eight unaccepted.
integration_final requires every original group and every meaning, including actual typed independent review and composition records. Every group retains passed=true plus actual evidence checks. A boolean never substitutes for a record. composition.py independently requires C=HEAD, clean checkout, exact parents and T. Successful machine verification still does not confer independent formal acceptance.
Stage reporting lists source/runtime prerequisites and later gates before checking. After composition it reports source verification; runtime failure remains NOT VERIFIED. If there is no index, no stage or prerequisites are established and completion is explicitly denied.
OS versus other producers
OS/runtime meanings retain /events/N, action==meaning, the existing in-window monotonic_ns, and exact root/S/T/source-map/pid/session/engine provenance. All bubble/cutin/restart/save/IME guards remain. The OS engine receipt and runtime trace also need genuine ended_unix_ns when a later independent review references them. This is their real artifact-end time, not a review event inserted into their monotonic window.
The six non-OS meanings use separate JSON artifacts, with kind, provenance, producer and records. Their provenance is exactly {root,S,T,source_map_sha256}; no OS pid/session/window/engine fields. Coverage points to /records/N. Each record carries its exact kind and meaning. Wrong-kind relabelling, OS action/time/provenance on a typed record and OS metadata on a typed artifact are rejected. Artifacts still require the outer index's file SHA verification, distinct bytes, meaningful coverage and no fillers. Existing legacy substantive content fields can coexist on the appropriate artifact; the typed coverage does not replace those checks.
Each producer receipt has exactly kind, identity, pid, run_id, started_unix_ns, ended_unix_ns, lifecycle and records_sha256. kind matches the artifact and record kind. Identity/run are nonempty, pid is a real producer process separate from the OS PID, and run_id must not borrow the OS session. lifecycle is ["started","ended"], times are positive increasing actual Unix nanoseconds, and records_sha256 binds the canonical records array. Canonical SHA means UTF-8 JSON, sorted keys, compact separators, ensure_ascii=false. Root must collect actual producer receipts; these fields do not authenticate themselves and require independent inspection of the real logs. Never invent identities or timestamps to populate this schema.
- static_import_local_affected → command_log. commands contains actual argv, absolute cwd, child pid, exit_code=0, stdout/stderr text and their UTF-8 SHAs, source_map_sha256 and start/end Unix nanoseconds within the command producer's lifecycle. results equals the command exit-code list. These are the actual completed commands, not OS events.
- exact_final_full_roster → roster_controller. The controller receipt binds results, source_hashes and inputs. The checker passes the exact row objects successfully validated by _validate_condition_artifact_content to correspondence. Coverage results must have equal unique suite-id sets, source hashes and complete row contents (order is immaterial), and each suite SHA must equal the source map. Receipt-only results, altered rows, duplicates or different suites fail. Every row additionally passes verify_engine and carries its own pid/run_id and start/end Unix times within the controller interval; process/run pairs cannot be reused. Row engine monotonic intervals are local to that engine, not the OS window.
- independent_claude_runtime_review → claude_review. reviewer and reviewer_run_id match the independent producer receipt; its identity/run differ from the other typed producers. review is the actual embedded review artifact with provider=Claude, nonempty text, decision=pass and runtime_artifact_sha256; review_sha256 binds its canonical content. Both the review and coverage record reference exactly the actual SHA set of all runtime artifacts (including OS receipt/trace) and the roster-controller artifact. Review producer start must follow their real artifact end times. No OS timestamp is needed.
- current_main_integration_final → composition_result. S/M/Q/T/mode match the verified roles, mode is integration_final, and result equals the actual dictionary returned by composition.verify_composition during this checker execution, including C and blob bindings. The producer receipt binds the archived result to the run. True/false cannot replace this result and no composition rules are duplicated.
- held_gestures_deferred → held_gestures_document. Retains remaining_scope and source_reference and binds source_map_sha256 plus the frozen spec_sha256. P23 held gestures remain deferred, not waived.
- macos_windows_classification → platform_document. Also binds source/spec; platform matches the actual OS environment and windows_status must stay NOTRUN. Same-release Windows device acceptance remains a later required platform gate.
Local proof and handoff
LOCAL_COMMAND_RESULTS.json and separate stdout/stderr files capture actual source-only worker checks; SOURCE_MANIFEST.json binds the authored files and preserved inputs. These are not a production acceptance index. Prior repair5 raw proofs and STATUS remain unchanged and historical. Tests include positive typed/stage controls, wrong-kind and producer/lifecycle negatives, command stream/source errors, exact validated roster row handoff, review SHA/time/reference errors, composition-result mismatch, document bindings, normal-stage exclusions and final whole-eight enforcement.
Root owns lease/process checks, normal submit, exact-S/Q reruns, independent limited review, all runtime/native/OS/full-roster collection, whole-eight runtime review and final integration validation. Natural invasion/duel/defense upstream triggers, actual bubble rendering, staff-panel OS click, IME/save/scales, Windows and all other gaps remain as listed in STATUS.json. There is no new acceptance credit or change to task registration, contract or denominator.