Repository navigation
Independent Git-native audit of PR1190’s complete PR279 source closure #1336
applebees2
started this conversation in
General
Replies: 1 comment
|
DONE — independent source-binding check; no discrepancy found in the pinned claim. PR1190 was merged while this session was paused. This is additional independent corroboration in response to Adam Gall's handoff, not a request to reopen PR279 or a new provenance/priority claim. No duplicate PR is being opened. The original claim has finished; its expired reservation is released. Pins. Session base Fresh evidence. Git's native
The independent harness imports neither predecessor checker nor collector. Its native parsing/diff/hash path differs from PR1190's Python Merkle-tree parser; Git object identities and the chosen source pins remain shared trust assumptions. This is finite source-provenance verification, not a signature/authorship proof, mathematical acceptance, or new kappa. No independent human review is claimed. Reproduce. Save the script below as git -C /path/to/repo fetch origin refs/pull/1190/head refs/pull/279/head
python -I -B audit_pr279.py /path/to/repoExpected Open next questions. No further source-closure task is identified for these fixed commits. Any changed source head requires a new comparison. The inherited construction, precision, routing and all-size mathematical obligations are outside this check; their review belongs to the existing mathematical work, rather than another provenance replay. Credit: Adam Gall (#1190), mihir-s-05 (#828), Rohan Arun (#279), eumemic (#268), DreamingOfClouds (#276), Douglas Colkitt and the retained source lineage. Prepared for @applebees2 with substantial OpenAI Codex assistance. New checker: Apache-2.0. Complete standalone independent checker"""Independent Git-native check of PR1190. Python 3.12 + Git; no network.
Run: python -I -B audit_pr279.py /path/to/integer-mult-bounds
Fetch refs/pull/1190/head and refs/pull/279/head first if their objects are absent.
Apache-2.0. Prepared for applebees2 with substantial OpenAI Codex assistance.
Credit: Adam Gall (1190), mihir-s-05 (828), Rohan Arun (279), eumemic (268),
DreamingOfClouds (276), Douglas Colkitt and the retained source lineage.
No predecessor checker or collector is imported or executed by this script.
"""
import base64
from collections import Counter
import copy
import hashlib
import io
import json
from pathlib import PurePosixPath
import subprocess
import sys
import tarfile
AUDITED = '24777831784d18896d74ea0c0ed12288d08c89b4'
OLD = '4d8c31eec7ae618645cb058101cb4e72a97268d3'
NEW = '913ccc48a0bc1173709ea92280b96252256b7754'
PACKAGE = 'research/five-stage-gen4-banks'
WORKFLOW = '.github/workflows/five-stage-gen4-banks.yml'
COMPANION = 'research/pr279-target-prefix-reconciliation'
def need(condition, message):
if not condition:
raise ValueError(message)
def audit(repo):
def git(*args, data=None):
return subprocess.check_output(
['git', '--no-replace-objects', '-C', str(repo), *args], input=data)
def read(path):
return git('show', AUDITED + ':' + path)
def inventory(commit):
rows = {}
for record in git('ls-tree', '-r', '-t', '-z', commit).split(b'\0')[:-1]:
fields, name = record.split(b'\t', 1)
mode, kind, oid = fields.decode('ascii').split()
path = name.decode('utf-8')
need(path not in rows, 'duplicate native tree path')
rows[path] = (mode, kind, oid)
return rows
def batch(ids):
ids = sorted(set(ids))
raw = io.BytesIO(git('cat-file', '--batch', data=('\n'.join(ids)+'\n').encode()))
result = {}
for expected in ids:
oid, kind, size = raw.readline().decode('ascii').split()
need(oid == expected, 'batch identity mismatch')
payload = raw.read(int(size))
need(len(payload) == int(size) and raw.read(1) == b'\n', 'truncated batch')
result[oid] = (kind, payload)
need(raw.read() == b'', 'unexpected batch tail')
return result
a, b, retained = map(inventory, (OLD, NEW, AUDITED))
files_a = {p: v for p, v in a.items() if v[1] != 'tree'}
files_b = {p: v for p, v in b.items() if v[1] != 'tree'}
delta = {p: (files_a.get(p), files_b.get(p)) for p in files_a.keys() | files_b.keys()
if files_a.get(p) != files_b.get(p)}
# A second native command checks the complete delta, with rename detection off.
records = git('diff-tree', '--no-commit-id', '--raw', '--no-abbrev',
'--no-renames', '-r', '-z', OLD, NEW).split(b'\0')[:-1]
native_delta = {}
for header, path in zip(records[::2], records[1::2], strict=True):
om, nm, ob, nb, status = header.decode('ascii').lstrip(':').split()
native_delta[path.decode('utf-8')] = (om, nm, ob, nb, status)
expected_delta = {p: (x[0] if x else '000000', y[0] if y else '000000',
x[2] if x else '0'*40, y[2] if y else '0'*40,
'M' if x and y else ('A' if y else 'D'))
for p, (x, y) in delta.items()}
need(native_delta == expected_delta, 'native full-tree/diff disagreement')
need(Counter(v[-1] for v in native_delta.values()) == {'M': 10, 'A': 2}, 'delta count')
need(git('rev-list', '--parents', '-n', '1', NEW).decode().split() == [NEW, OLD],
'candidate is not the direct child of reviewed head')
universe = {p: v for p, v in files_b.items() if p.startswith(PACKAGE+'/') or p == WORKFLOW}
old_package = {p: v for p, v in files_a.items() if p.startswith(PACKAGE+'/')}
need(len(old_package) == 113 and len(universe) == 116, 'package sizes')
proof_bytes = read('research/pr279-parent-closure/TREE-PROOF.json')
proof = json.loads(proof_bytes)
source = json.loads(read(COMPANION + '/SOURCE.json'))
comparison = json.loads(read('research/pr-reconciliation-20261012/content-comparison.json'))['279']
tree_ids = {git('rev-parse', c+'^{tree}').decode().strip() for c in (OLD, NEW)}
for rows in (a, b):
for p, (_, kind, oid) in rows.items():
if kind == 'tree' and (p == PACKAGE or p.startswith(PACKAGE+'/') or
any(q.startswith(p+'/') for q in [PACKAGE, WORKFLOW, *delta])):
tree_ids.add(oid)
needed = {OLD, NEW} | tree_ids | {v[2] for v in universe.values()}
needed |= {v[2] for v in old_package.values()}
needed |= {retained[p][2] for p in old_package}
needed.add(retained[WORKFLOW][2])
objects = batch(needed)
for oid in {OLD, NEW} | tree_ids:
kind, raw = objects[oid]
need(git('hash-object', '-t', kind, '--stdin', data=raw).decode().strip() == oid,
'native Git object hash mismatch')
payloads = {p: objects[retained[p][2]][1] for p in old_package}
need(all(payloads[p] == objects[v[2]][1] and retained[p][:2] == v[:2]
for p, v in old_package.items()), 'retained historical package differs')
archive = read(COMPANION + '/source-update.tar.gz')
need(hashlib.sha256(archive).hexdigest() == source['archive_sha256'], 'archive pin')
updates = {}
with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tf:
for member in tf:
name = member.name
need(member.isfile() and name not in updates and not PurePosixPath(name).is_absolute()
and '..' not in PurePosixPath(name).parts, 'invalid/duplicate archive member')
updates[name] = tf.extractfile(member).read()
need(set(PACKAGE+'/'+p for p in updates) == set(delta), 'archive/update domain')
payloads.update({PACKAGE+'/'+p: data for p, data in updates.items()})
payloads[WORKFLOW] = objects[retained[WORKFLOW][2]][1]
need(files_a[WORKFLOW] == files_b[WORKFLOW] == retained[WORKFLOW], 'workflow modes/blob')
def check(doc, data, comp, claims):
need(doc['schema'] == 'pr279-parent-git-proof/1', 'schema')
need(set(doc['commits']) == {OLD, NEW} and set(doc['trees']) == tree_ids, 'proof coverage')
for plural, kind in (('commits', 'commit'), ('trees', 'tree')):
for oid, encoded in doc[plural].items():
raw = base64.b64decode(encoded, validate=True)
need(objects[oid] == (kind, raw), 'proof object bytes')
need(set(data) == set(universe), 'payload coverage')
for p, entry in universe.items():
need(entry[:2] in [('100644', 'blob'), ('100755', 'blob')], 'file mode/type')
need(data[p] == objects[entry[2]][1], 'payload bytes')
rows = comp['matched'] + comp['unresolved']
need(comp['total'] == len(rows) == len({r['path'] for r in rows}) == 116, 'inventory cardinality')
need({r['path']: r['blob'] for r in rows} == {p: e[2] for p, e in universe.items()}, 'inventory binding')
need(len(comp['matched']) == 104 and len(comp['unresolved']) == 12, 'partition size')
need({r['path'] for r in comp['unresolved']} == set(delta), 'partition membership')
need(len(claims) == 12 and len({r['path'] for r in claims}) == 12, 'change cardinality')
named = {}
for r in claims:
p = PACKAGE+'/'+r['path']
need(p in delta, 'extra change')
x, y = delta[p]
need(y is not None and (x is None or x[0] == y[0]), 'unexpected mode/deletion')
named[p] = (r['old_git_blob'], r['new_git_blob'], r['status'])
need(named == {p: (x[2] if x else None, y[2], 'modified' if x else 'added')
for p, (x, y) in delta.items()}, 'change binding')
inputs = [proof, payloads, comparison, source['changes']]
check(*inputs)
controls = []
def reject(name, mutate):
bad = copy.deepcopy(inputs)
mutate(bad)
try:
check(*bad)
except ValueError:
controls.append(name)
else:
raise ValueError('negative control accepted: '+name)
reject('changed_commit_bytes', lambda x: x[0]['commits'].__setitem__(NEW, base64.b64encode(b'wrong').decode()))
reject('omitted_tree', lambda x: x[0]['trees'].pop(next(iter(tree_ids))))
reject('omitted_payload', lambda x: x[1].pop(WORKFLOW))
reject('changed_workflow', lambda x: x[1].__setitem__(WORKFLOW, b'wrong'))
reject('wrong_inventory_blob', lambda x: x[2]['matched'][0].__setitem__('blob', '0'*40))
def swap(x):
c = x[2]
c['matched'][0], c['unresolved'][0] = c['unresolved'][0], c['matched'][0]
reject('swapped_partition', swap)
reject('extra_repository_change', lambda x: x[3][0].__setitem__('path', 'unrelated.txt'))
def mode(x):
oid = next(k for k in tree_ids if b'100644 ' in objects[k][1])
raw = objects[oid][1].replace(b'100644 ', b'100755 ', 1)
x[0]['trees'][oid] = base64.b64encode(raw).decode()
reject('changed_tree_mode', mode)
return dict(status='PASS_INDEPENDENT_GIT_PR279_CLOSURE', audited_pr1190= AUDITED,
reviewed_pr279=OLD, candidate_pr279=NEW, parent_paths=len(universe),
partition=[104, 12], changes=dict(sorted(Counter(v[-1] for v in native_delta.values()).items())),
proof_objects={'commit': 2, 'tree': len(tree_ids)}, negative_controls=controls,
tree_proof_sha256=hashlib.sha256(proof_bytes).hexdigest(),
native_repository_leaf_counts=[len(files_a), len(files_b)],
git_version=git('--version').decode().strip(), python=sys.version.split()[0],
fresh_mathematical_replay=False)
if __name__ == '__main__':
print(json.dumps(audit(sys.argv[1]), indent=2, sort_keys=True)) |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
DONE (2026-10-14). The independent check passed. Completed evidence and standalone reproducer. PR1190 has since merged; no additional PR is proposed. Scope released.
Original claim (historical)
CLAIM — independent verification of PR1190’s PR279 source closure
Question: Do the two pinned PR279 commits, all 27 TREE-PROOF objects, the complete 104/12 partition of 116 parent paths, and the repository-wide 10-modified/2-added delta agree with Git’s native object/diff implementation?
Base: bce54fb. Predecessor: Adam Gall’s PR1190 at 2477783; responds to #1166 (comment). Chooser track independent-verification, OS nonce 05484e54bdb1f42deabd1bd08293fd64. Scope refined to one source-binding obligation requested in that handoff.
Method/domain: a separate standard-library harness around Git cat-file, ls-tree and diff-tree; byte-for-byte comparisons of the fixed commits/trees and retained/companion payloads; controls for missing paths, wrong modes, wrong blobs, partition substitutions and unrelated changes. No import of PR1190 or PR828 checker functions. Deliberately independent corroboration, not a new provenance claim or mathematical replay.
Expected artifact: reproducible checker and exact evidence, or a precise discrepancy report. Expected finish and claim expiry: 2026-10-13 23:57 UTC. No new kappa or acceptance/closure decision. Credit Adam Gall (1190), mihir-s-05 (828), Rohan Arun (279), eumemic (268), DreamingOfClouds (276), Douglas Colkitt and retained lineage. Prepared for @applebees2 with substantial OpenAI Codex assistance.
All reactions