[Matarener]

Requested by Mark

Change and mathematical scope

Replay repair only. No scientific change and no new κ. Before this change, research/physical-ordinary-interchange (jmbarrancoml, #2899) failed its registered replay on main with working source drift: certificates/selected-result.json. jwr404 flagged this in #5417. The frozen PR2809 loader inside inputs/pr2809.tar accepts only the two exact selected records that existed when the package was written, so every frontier promotion broke the replay.

After this change the replay passes again with identical receipts. The package now carries the exact record pinned at its base:

• That record (Git blob b1fea0c9…, sha256 bb2eaa58…) is vendored as inputs/selected-result-pinned.json.
• source.py serves it to the loader from a private temporary repository view. Every other declared input is copied unchanged from the working tree, and the loader and the PR2753 verifier still authenticate all of them.
• SOURCES.json now marks the record as provenance, and VERIFY.json drops it from the live inputs.

The archives, all checkers and RESULT.json are unchanged.

Task and overlap

This is maintenance following #5410/#5417 (jwr404). #5417 fixes jwr404's own packages and names this one as blocked; it also blocks three of jwr404's packages that run this loader. Base is 1a3ced60b2f7a46bc70280a04f2eeb8ca027c700. No other open PR touches this package.

Validation

python3 -B scripts/research_package.py --package research/physical-ordinary-interchange was run locally. All eight registered commands pass and reproduce the stored RESULT.json digests:

• setup, root and controls, each in normal and -O mode;
• binary;
• engine.

The run used Windows 10 and Python 3.12. For that local run only, I used a small wrapper that makes relative Path strings use /. The frozen PR2753 verifier compares str(path.relative_to(...)) with POSIX names, so it fails on Windows independently of this change. The wrapper is not part of the PR.

On this slow laptop CPU the engine suite takes 650–700 s, which is above its 600 s allowance. VALIDATION.md records 165.53 s on the author's machine, so hosted CI is the decisive timing check. Hosted run 40094446546 passed plan and this package's registered replay (engine 241.2 s). Five dependent packages that this change re-triggers fail with their own pre-existing working source drift: certificates/selected-result.json; they fail identically on main and are not touched here: encoded-body-depth-borrowing, high-cube-b1-fit-bridge, ordinary-one-factor-stock, sealed-strict-root, unconditional-batched-crt.

check_research_commit.py passes. The second commit reuses, byte for byte, the docs/ci-verification.md navigation repair from #5420, because main still fails that shared onboarding test.

Credit

The package is by jmbarrancoml (#2899) and its PR2809/PR2753 predecessors. jwr404 identified the drift in #5417. Mark (Matarener) with substantial Claude Code (Claude) assistance. Apache-2.0.

Open next questions

None justified. Any future selected-record change no longer affects this replay.

🤖 Generated with Claude Code

[antunishdPursuit]

FINDING — complementary independent repository-view/source-bridge check at exact PR head 1a61b69b87e8e1269446f0a874c08503bde9339a, canonical base 1a3ced60b2f7a46bc70280a04f2eeb8ca027c700. This follows jwr404's #5417 handoff and checks Mark/Matarener's existing repair rather than duplicating it. No review comment or central ledger entry for this PR was present at entry; no novelty claim.

Native Windows Python 3.12.15 ran the standalone script below successfully (PASS_PR5434_VIEW_AUDIT):

• Vendored record bytes equal the exact SOURCES.base_commit blob and retained SHA256; current canonical selected bytes differ, so the drift control is nonvacuous.
• Only the selected-record usage/input declaration changes; all eight registered commands remain identical. Other package files, including archived loaders and RESULT.json, are unchanged by Git object comparison.
• The exact repository_view AST function produces the pinned record plus all eleven live inputs, byte for byte, with no extra files.
• Four controls: changing the live selected record leaves the historical view unchanged; deliberately corrupting another live input is forwarded unmasked; corrupting the pinned record rejects before writing output; a missing live input raises rather than being skipped.

Scope limit: this executes only the exact view function with source-bound inputs. It does NOT execute the frozen loader or eight registered commands, assess engine timing, certify arbitrary/malicious path manifests, approve the PR, or verify any theorem. In particular the nonselected-corruption control shows forwarding, not downstream rejection; the frozen loader remains responsible for authentication. Hosted selected-package success and the five dependent-package failures remain separate evidence.

Credit: jmbarrancoml's #2899 package, Nick Petalas #2808, PR2809/PR2753 and retained authors; jwr404's drift finding; Mark/Matarener's repair and Claude attribution. This independent check used substantial OpenAI Codex assistance; Apache-2.0. No repository files changed.

Reproduce from a clone with both pinned commits available: save the following as view-audit.py, then run python -X utf8 -B view-audit.py PATH_TO_REPOSITORY. The source is extracted by Git object; no full worktree is needed.

"""Independent bounded PR5434 repository-view check; no full loader/engine replay.
Run: python -X utf8 -B view-audit-20261024.py PATH_TO_REPOSITORY
Prepared with substantial OpenAI Codex assistance; Apache-2.0.
"""
import ast
from hashlib import sha256
import json
from pathlib import Path
import subprocess
import sys
import tempfile
BASE='1a3ced60b2f7a46bc70280a04f2eeb8ca027c700'
HEAD='1a61b69b87e8e1269446f0a874c08503bde9339a'
PACKAGE='research/physical-ordinary-interchange/'
REPO=Path(sys.argv[1])
def blob(head,path):
 return subprocess.check_output(['git','-C',str(REPO),'show',head+':'+path])
def require(ok,message):
 if not ok:raise ValueError(message)
old=json.loads(blob(BASE,PACKAGE+'VERIFY.json'));new=json.loads(blob(HEAD,PACKAGE+'VERIFY.json'))
require(new==dict(old,inputs=[p for p in old['inputs'] if p!='certificates/selected-result.json']), 'unexpected manifest change')
os=json.loads(blob(BASE,PACKAGE+'SOURCES.json'));ns=json.loads(blob(HEAD,PACKAGE+'SOURCES.json'))
expected=json.loads(json.dumps(os));row=next(x for x in expected['files'] if x['path']=='certificates/selected-result.json');row['usage']='provenance'
require(ns==expected,'unexpected provenance change')
pinned=blob(HEAD,PACKAGE+'inputs/selected-result-pinned.json')
require(sha256(pinned).hexdigest()==row['sha256'],'pinned SHA mismatch')
require(blob(ns['base_commit'],row['path'])==pinned,'base bytes mismatch')
require(subprocess.check_output(['git','-C',str(REPO),'rev-parse',ns['base_commit']+':'+row['path']],text=True).strip()==row['git_blob'],'base blob mismatch')
require(blob(BASE,row['path'])!=pinned,'drift control is vacuous')
changed=subprocess.check_output(['git','-C',str(REPO),'diff','--name-only',BASE,HEAD,'--',PACKAGE],text=True).splitlines()
require(set(changed)=={PACKAGE+p for p in ['SOURCES.json','VERIFY.json','source.py','inputs/selected-result-pinned.json']},'other package bytes changed')
code=blob(HEAD,PACKAGE+'source.py').decode('utf-8');tree=ast.parse(code)
functions=[n for n in tree.body if isinstance(n,ast.FunctionDef) and n.name=='repository_view'];require(len(functions)==1,'missing view')
with tempfile.TemporaryDirectory() as temporary:
 root=Path(temporary);here=root/'package';repo=root/'repo';here.mkdir();repo.mkdir()
 (here/'inputs').mkdir();(here/'inputs/selected-result-pinned.json').write_bytes(pinned)
 (here/'VERIFY.json').write_bytes(blob(HEAD,PACKAGE+'VERIFY.json'))
 for name in new['inputs']:
  require(not Path(name).is_absolute() and '..' not in Path(name).parts,'unsafe input path')
  target=repo/name;target.parent.mkdir(parents=True,exist_ok=True);target.write_bytes(blob(HEAD,name))
 live=repo/'certificates/selected-result.json';live.parent.mkdir(parents=True,exist_ok=True);live.write_bytes(blob(BASE,row['path']))
 namespace=dict(HERE=here,ROOT=repo,PINNED_SELECTED=('inputs/selected-result-pinned.json',row['sha256']),sha256=sha256,json=json)
 exec(compile(ast.Module(body=functions,type_ignores=[]),'exact-PR5434-repository_view','exec'),namespace)
 view=namespace['repository_view'](root/'positive')
 require((view/row['path']).read_bytes()==pinned,'wrong selected view')
 require(all((view/n).read_bytes()==(repo/n).read_bytes() for n in new['inputs']),'input masking')
 require({p.relative_to(view).as_posix() for p in view.rglob('*') if p.is_file()}==set(new['inputs'])|{row['path']},'view inventory mismatch')
 original_live=live.read_bytes();live.write_bytes(b'changed live selection')
 require((namespace['repository_view'](root/'changed-live')/row['path']).read_bytes()==pinned,'live selection leaked')
 live.write_bytes(original_live)
 test=repo/new['inputs'][0];original=test.read_bytes();test.write_bytes(original+b'\nCORRUPTED\n')
 require((namespace['repository_view'](root/'corrupted-input')/new['inputs'][0]).read_bytes()==test.read_bytes(),'live drift was silently masked')
 test.write_bytes(original)
 (here/'inputs/selected-result-pinned.json').write_bytes(pinned+b'!')
 try:namespace['repository_view'](root/'bad-pin')
 except ValueError as error:require(str(error)=='pinned selected record changed','wrong pin rejection')
 else:raise ValueError('corrupt pinned record accepted')
 require(not (root/'bad-pin').exists(),'pin failure wrote output')
 (here/'inputs/selected-result-pinned.json').write_bytes(pinned);test.unlink()
 try:namespace['repository_view'](root/'missing-input')
 except FileNotFoundError:pass
 else:raise ValueError('missing live input accepted')
print(json.dumps(dict(status='PASS_PR5434_VIEW_AUDIT',head=HEAD,declared_live_inputs=len(new['inputs']),controls=['changed-live-selection','unmasked-nonselected-corruption','pinned-corruption-before-write','missing-input'],scope='Exact repository_view function and Git source bridge only; no frozen loader, eight-command replay, engine, theorem, or PR approval'),sort_keys=True))