[commdata2338]

Change and mathematical scope

Adds research/mixed-native-normalization-audit/, an independent audit of the native-output commitment in PR #4180 (native_outputs.authenticate_native) on both retained PR #4085 THREE providers, gauge44 and extra. A separately implemented normalizer and structural JSON encoder reconstruct all 22 committed product digests. The unchanged gate is then challenged with 408 cases: 374 rejections and 34 permitted changes.

• Root-field partition. Each provider's eleven products have 117 root fields: 109 ordinary scientific-product fields, six serialized references and two product timing fields. Every ordinary field receives a deterministic leaf edit, with all dependent raw references coherently rebound. All 218 such edits are rejected at the final commitment check (native scientific output commitment), not at a stale-reference or parsing check.
• Reference graph. The six reference edges point at three targets (CANONICAL-WORD.json.gz, CLIFFORD-RECIPES.json, LOCAL-PROGRAMS.json.gz). The oracle checks that every target is a leaf of the graph, so a change to a target's content stays committed even when every reference to it is updated. The argument keeps the ordinary SHA-256 integrity assumption.
• Permitted changes. Re-serialization and gzip recompression with correctly rebound references, valid product timing values and a combined JSON/gzip/timing change all keep the exact scientific commitments.

The audit also records where the commitment's scope ends. STEPS.json contributes only the ordered five stage names and strict integer-zero exit codes. Other stage metadata is outside the commitment, so the gate accepts a minimal stage list, negative or nonfinite stage times and an added executor annotation (eight accepted fixtures over the two providers). That is a description of what this gate binds, in line with the module's stated purpose of authenticating scientific products. It is not a defect in #4180, in a native operator or in the selected construction. In the real caller, replay.py checks further source/result bindings and assigns execution labels from its own control flow; that caller is not replayed here.

The full case receipt is in RESULT.json, and the argument and coverage map in README.md. This is a finite boundary audit. No supplier, profile, cost, κ or selected-frontier change is proposed.

Remaining obligations: the actual FOUR product trees, fresh native semantics, compiler/word/owner correctness, full ordinary/outer admission, a replay of the selected #5413 record and the all-size framework assumptions are outside this audit.

Task and overlap

The claim is in discussion #5511. The full original card and the scoped task are in TASK.json.

• Task: supplier-boundary-audit, priority revision 7; scope key dcdb0fa8e49b08a958d0/PR4180/native-normalization/THREE-base-extra/root-fields-reference-graph.
• Selection: handoff-first, exact-card retrieval with choose_current_research_task.py --task supplier-boundary-audit, nonce b9537c078a2693526c616800a721753a, adversarial-audit track. Takes PR Complete source-bound four-provider finite admission for PR4088 #4180's Open next questions item 1, narrowed to one native-closure implication.
• Scope: refined. The catalogue card still names four-provider integration as missing; PR Complete source-bound four-provider finite admission for PR4088 #4180 already implements it. Recreating that adapter or repeating its owner-ledger audit would add no coverage.
• Head 96a3088d56ad9d73e4fe59f6320c8125c4b9a319 on base main 32890bc5de034ab8fc93ac88ead7279a6a416d04. Canonical main was fetched again at 2026-10-25T05:37:01Z and at 2026-10-25T05:49:15Z and was unchanged, so no guidance, selected-record or consumed-source migration was needed.
• Selected record: certificates/selected-result.json on this base selects Complete coupled-output caller: conditional κ = 0.003027288235 (+5e-12 over #5400) #5413 (κ = 0.003027288235, promoted 23 October); the priority page's 23 October selection refresh still names Conditional κ = 0.0030217758: joint helper interfaces and Lean compiler tightening #4610 (audited in Independently verify #4610’s conditional κ gain over selected #4470 #5241). This audit neither replays nor depends on either record.
• Exact audited dependency: PR Complete source-bound four-provider finite admission for PR4088 #4180 15a4153e734a8d1d485c6d3bea9b1a8201328a4c; actual retained native inputs: PR Conditional κ = 0.001730970419199163702738 (+1.614e-7 over #4076): receiver sharing on the staged T360 supplier #4085 c5854c77620723aae6914c32122870519a6f820d. Anonymous Git fetches confirmed both heads, and every consumed path is byte-identical between those heads and this base.
• Contextual predecessors: PR Improve conditional κ with a mixed fourth staged entry (+8.696e-9) #4088 72d7efc181edb21806a878f174847c96dd410ab0 and PR Record the idle cost blocking the mixed staged544 endpoint. #4165 430072ee4130b58c1dd952cb37fd81759675a118. Exact Git blobs and SHA-256 values for the 34 live inputs are in SOURCES.json.
• Method and domain: the two actual retained product trees, eleven products each, all root fields, six reference edges, two timing exceptions, all five stage positions and the file/provider/word boundaries. No search over new constructions.
• Milestone and budget: bounded audit with a 60-minute budget; stop after the normalization contract and a reproducible case receipt. No family expansion. No changed paid bill or restoration saving is claimed; downstream costs and all-size obligations remain inherited or unexamined.
• Success/falsification test: the independent oracle must reproduce the fixed commitments and agree with the gate's actual acceptance or rejection on the declared matrix. An accepted scientific edit, a rejected equivalent representation, a missing dependency or a receipt mismatch fails the replay.

Nearest prior coverage is PR #4180's own phase/endpoint/stage/serialization controls and James Reed's owner-ledger check and source/binding check. This package adds the complete root-field partition, an independent reference-graph normalization, systematic challenges of the real gate and an explicit statement of the stage-metadata boundary. This account's PR #2040 audited PR #1824's separate payload comparator. PR #5432 concerns the selected #5413 record's stock coefficients.

The final targeted overlap search covered all 7,404 committed README, TASK and ledger notes on the branch, 371 open and draft PRs fetched at 05:43:08Z and 4,779 Discussion records fetched at 05:44:30Z, both with complete pagination. The exact terms were NATIVE-OUTPUTS.json, native-output normalization and scientific_products; only the predecessor and this claim matched. Arbitrary diffs and unpublished work are outside that coverage, so this is not a novelty guarantee.

Validation

Standard-library CPython 3.12.3 on Linux. Reproduce:

python3 -B scripts/research_package.py --package research/mixed-native-normalization-audit --check-only
python3 -B scripts/research_package.py --package research/mixed-native-normalization-audit

The registered replay uses python3 -I -O -B and expects:

PASS_MIXED_NATIVE_NORMALIZATION_AUDIT providers=2 products=22 cases=408 accepted=34 rejected=374 no_new_kappa
PASS_REGISTERED_RESEARCH_PACKAGE research/mixed-native-normalization-audit outcome=completed

Source-bound receipt generation passed all 408 cases in 314.59 seconds (peak process RSS 119,388 KiB). Package metadata and pins pass. The optimized registered replay passed in 319.30 seconds (peak process RSS 202,876 KiB). The exact committed 40-file export passed its integrity checks, and its Git-free optimized replay passed in 317.31 seconds with all 40 exported payloads and modes unchanged and no extra files. Committed-byte, source-history and whitespace checks pass, and the working tree stays clean.

Coverage includes all 218 ordinary-field edits, all 12 stale references, missing products and added fields, invalid timing, a nested seconds field, every stage position, wrong provider and word commitments and a same-byte product symlink. The audited source bytes are compiled directly rather than loaded from cached bytecode, and all live input digests are checked again after the audit. The replay requires equality of the full receipt, not only the headline counts.

Not run: fresh FOUR generation, native computation, ordinary/outer release, the selected #5413 replay, Lean, Docker, Windows or hosted CI. No dependency installation. A first, slower development encoder was stopped before it produced a receipt and is not reported as a passing run; the final encoder changed no fixture or comparison.

Credit

Credit yssite / PR #4180 for the integration, normalization implementation, fixed commitments and original controls; zxv / PR #4085 for the retained THREE products and repaired operator release; Cinna Davis / PR #4088 for the mixed construction; unpaidmoon / PR #4165 for the mixed-idle handoff; and Rohan Arun / PR #4076, David Ganz (Dugongue) / PR #3945, Tekalign and the retained native, Clifford and geometry lineage. (PR #4180's README writes "David Ganz (zxv)" for PR #4085; on main, PR #4085's commits are by zxv, and CONTRIBUTORS.md lists David Ganz as @Dugongue, the author of PR #3945.) James Reed (rcfc-jreed) supplied the separate bounded independent reviews linked above. Original source packages, notices and licenses are unchanged. New work is Apache-2.0.

Prepared for commdata2338 (@commdata2338), with substantial OpenAI Codex assistance.

AI assistance: submitted by @commdata2338 with substantial AI assistance. OpenAI Codex (GPT-6 Astra) did the derivation, the implementation, the checking and the writing; it was packaged and submitted with Claude Code. No independent human review is claimed.

Open next questions

See the README and the structured TASK.json questions. The smallest direct extension is to apply the same graph and mutation families to both actual FOUR native output trees, obtained from an authenticated PR #4180 replay or export; their fixed commitments alone do not supply those outputs. This can be done separately from the expensive ordinary/outer engine.

A separate execution-history audit is worth doing only if a concrete downstream claim needs it. Trace that consuming claim through replay.bind_cache and its caller before proposing a stronger metadata seal.

Workflow feedback (optional)

Update the supplier-boundary card's current existing_checks to include PR #4180 and the later independent owner/pin reviews, keeping the frozen historical card bytes through the existing current-entry-point mechanism. As written, its next decision sends new sessions toward an adapter that is already implemented.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Jur4aiU6BBSmBiaRjkbECf