DONE: fail-closed selected-record source inventories

[petalas]

Status: DONE / released, 2026-10-16 13:47 UTC, priority revision 5. Author-checked; no independent human review claimed.

The selected-record checker can pass with an unreadable, unlisted supplier subtree. PR2947, exact head 41890b869ebbbab87262fc15d67fcad3202404a0, adds a source-authenticated opt-in successor that fails closed while preserving both manifest formats, contained regular-file aliases and proof guards. Public package.

All 59 groups pass without skips on Linux/WSL2 with Python 3.12.15 and 3.13.5, normally and with -O. Actual CLI permission fixtures reproduce the retained false success and successor rejection. Both engines pass all 1,579 selected source-file bindings. Production code and kappa remain unchanged.

Next: review default adoption and migrate the two byte-pinned selected-checker audits. The manual replay takes about five seconds locally. Stable inputs are required; atomic snapshots, hosted results and complete construction replay are outside scope. No active reservation remains.

Original claim, retained for history

Question: can selected-record source closure silently omit an unreadable unlisted subtree, and can a source-authenticated opt-in successor reject that condition while retaining both manifest layouts, contained-file aliases and existing proof guards?

Base: canonical main 95ff4e2dd396c505932a43ff7c1cdfdd94b8c867. Predecessors: Douglas Colkitt's scripts/verify_selected_result.py, Mihir Srivastava's primary-proof guards, yssite's inventory-link closure. Related but different: Nick Petalas/PR2921 addresses generated-payload comparison; Arham Tahir/PR2793 reuses selected-preflight paths.

Reproduced on Linux as an unprivileged user: both legacy and modern synthetic records return 1/1000 with an extra supplier/unlisted/extra.py beneath a mode-000 directory. Direct enumeration raises PermissionError. Restoring access makes the unchanged checker reject the extra source. This demonstrates an inventory-completeness gap, not an incorrect multiplication certificate.

Method/domain: one bounded iterative traversal, exact pinned predecessor loading, all inherited selected/proof/link suites, actual CLI permission fixtures and injected open/iteration/stat failures. Preserve the production checker and pinned consumers unchanged. Expected artifact: research/selected-inventory-fail-closed/, rerunnable tests and a focused PR. No new supplier or kappa claim.

Original stop rule: stop if the completeness failure does not reproduce or inherited source/proof coverage cannot be retained. Inputs must be stable during an invocation; concurrent-writer snapshots are outside scope. Original expiry was 2026-10-16 15:43 UTC; the claim is now released.

[petalas]

FINDING / DONE / released: PR2947, head 41890b869ebbbab87262fc15d67fcad3202404a0, contains the reproducer and opt-in repair.

The retained actual CLI passes both manifest layouts when an unlisted extra source is hidden in an unreadable directory. The successor rejects that access failure, rejects the visible extra source after permissions are restored, and passes after its removal. Complete selected source bindings, 26 unchanged test groups per engine and seven new groups pass. All 59 groups passed without skips on Python 3.12.15 and 3.13.5, normally and optimized. Source pins, exact publication bytes, Ruff and the historical #1042 CLI also pass.

Fresh main was 4bb3629e638edc9d70ea124eb50f80e71433be05; priority revision 5, selected record and pinned runtime sources were unchanged. The new archive-intake distinction was read. The result is author-checked, not independent review or supplier admission. Hosted checks are queued, not claimed successful.

HANDOFF: production adoption needs review of the traversal and explicit source-pin migration in selected-binding-coverage-seeda342 and selected-dependency-heads-audit. The default checker is deliberately untouched. Concurrent-writer snapshots and complete cold replay remain outside scope.

Credit Douglas Colkitt, Mihir Srivastava/PR841, yssite/PR959, Arham Tahir/PR2793 and the retained selected supplier lineage. PR2921 is the related generated-payload inventory repair, not this source-closure check.

[Arham-Tahir64]

CLAIM — current selected-preflight entry points for the retained fail-closed inventory guard.

Status: narrowed, 2026-10-18 19:24 UTC, priority revision 6; canonical main rechecked unchanged at 20ecf28. Claim expires 2026-10-18 21:15 UTC.

Taking PR2947's production-adoption handoff, now narrowed to its native replay blocker. The first unmodified CPython 3.12/macOS replay ran 59 groups; 58 passed, but test_complete_inventory_and_entry_budget errored because its TemporaryDirectory root uses /var while containment resolves /private/var. I will supply a source-authenticated one-statement fixture adapter and replay all original controls on a forced aliased temporary root. Production adoption remains open; every frozen package and production entry point stays unchanged.

Method: authenticate the exact archived code, establish the original failure on an explicitly aliased TMPDIR, change only root = Path(td) to root = Path(td).resolve() in that one fixture at execution, and rerun all 59 groups. Test rejection of source drift and broadened/ineffective adapters. Stop if any test is lost or the canonical-root fixture weakens containment. Expected artifact: research/selected-inventory-native-replay with a portable native replay, exact evidence and focused PR. No supplier or kappa claim; no construction replay.

Predecessors: Nick Petalas/PR2947; Douglas Colkitt's selected checker; Mihir Srivastava/PR841; yssite/PR959; Arham Tahir/PR2793; Aaron Wang and Wentao Li's frozen consumer audits. Arham Tahir with substantial OpenAI Codex assistance. LOCAL-ONLY while implementation is in progress.