Repository navigation
fix(verification): final pubbundle reviewed-sources re-pin at 8f65f3c5 (125-row disposition) - #191
Conversation
Recompute every derivation-claiming field in verification/publication-bundle/reviewed-sources.json against the git show HEAD:<path> blobs and fix all mismatches to true computed values; expectations were never adjusted to admit stale digests. - 78 files-map md5/sha256 mismatches re-pinned (incl internal/catalog/ types.go 6b84be97->418edc97 broken by 4878319, vocabulary_control.go 5d41b670->06d0597c), 10 stale pin attributions corrected to the first commit whose blob actually produced the claimed digest - 4 model fB22Tier1Md5s entries + reconcileDangleTrust.contentMD5 re-pinned; canonicalProbe/model canonical scalars verified MATCH - 15 A-class unresolvable keys dispositioned: 14 repointed across the 32e8ad3 internal/backends/arango relocation, aliases.go (deleted b2da41e) retired under retiredFilesKeys with reason - 3 B-class malformed keys retired under retiredFilesKeys with per-key reason and tracked-counterpart notes - 19 confirmed/prevented artifact sha256 claims adjudicated against snapshot blob, head blob, file history, and a full git rev-list --objects --all scan: 9 verified against real blobs (evidence attached), 10 matched no object ever committed and were replaced with true head values + untraceable-credential receipts - status_updates[F-B15-ledger-pin] re-pinned to head md5 with the prior value's verified-at commit recorded - scripts/recompute_reviewed_ledger.py: rerunnable row-by-row recompute + apply tool (scan classes gated; historical receipts never gated) - checker test inverted to assert zero unresolvable keys, plus a new test that every ledger files key resolves to a tracked HEAD path Validation: check_no_code_comments --all-tracked exit 0 (unresolvable-ledger-key=0, violations=0); unittest checker harness 50/50; go test -count=1 ./internal/... exit 0 (73 pkgs ok); conformance/compiler ok; gofmt/vet/build clean; canonical json.dumps(indent=2, ensure_ascii=False)+newline roundtrip holds.
… rows The re-pin tool attached repointFrom receipts only to dict rows; the five relocated rows whose ledger value was prose (manifest_lifecycle.go, selections.go, selections_cleanup_e2e_test.go, chartifact catalog.go, name_latest_binding_e2e_test.go) now carry the same repointFrom/viaCommit audit as the other nine, prose preserved verbatim under note. Regenerated from the 8f65f3c baseline with the updated tool; all 169 fixes otherwise byte-identical. Checker --all-tracked exit 0; checker harness 50/50.
…entory class The checker's unresolvable-ledger-key inventory reporting had lost its only live coverage when the pubbundle ledger's malformed keys were dispositioned: test_unresolvable_ledger_keys_are_inventory_not_red now asserts the repaired state (empty inventory), so the reporting branch could regress to always-empty without any test noticing. Add a synthetic-ledger test: stub ledger_bound_paths with one nonexistent path, scan a clean Go file, assert the inventory reports exactly that key with its ledger attribution and stays out of violations. Coordinator ruling 2026-11-13 (loom-experiment-2): push now, single append-only scripts/tests-only commit; reviewer auto-tracks, verifier 250 re-pins cheaply (ledger + tool blobs unchanged). Validation: unittest scripts.tests.test_no_code_comments 51/51 OK; check_no_code_comments --all-tracked exit 0 (violations=0, unresolvable-ledger-key=0).
matthewpeterkort
left a comment
matthewpeterkort
left a comment
There was a problem hiding this comment.
Reviewed both PR commits (a2e8776, 20194c9) against base 8f65f3c: scripts/recompute_reviewed_ledger.py (new), scripts/tests/test_no_code_comments.py, and the ledger.
Verdict: requesting changes (4 inline comments; each is a required change). Event is COMMENT because GitHub rejects APPROVE/REQUEST_CHANGES on your own PR.
What checks out (static review): all 14 repointed keys carry repointFrom/viaCommit receipts and resolve at HEAD (git show); the 4 retired keys sit under retiredFilesKeys with verbatim retained rows; 48 pinCorrection receipts, none null; the named scalar re-pins (types.go 6b84be97 to 418edc97, vocabulary_control.go 5d41b670 to 06d0597c, the 4 fB22Tier1Md5s entries, reconcileDangleTrust.contentMD5) are cross-consistent between files rows and model sections; receipts preserve pre values (expectations were not adjusted to admit stale digests); the only mechanical reader of this ledger, check_no_code_comments.ledger_bound_paths, consumes files only, so the status_updates str-to-dict change and artifact sha256Verification additions do not break tooling; the builder-interactions ledger is untouched; the 20194c9 tool change is a genuine fix (relocated prose rows previously got no repoint receipt).
Not verifiable in this review sandbox (read-only git/gh only): independent recomputation of the new digests against blobs, the checker/pytest suites, and the canonical roundtrip claim. Digest correctness therefore rests on the tool receipts plus CI; CI must stay green before merge.
Findings requiring changes (inline): (1) model scan/apply only checks fields named md5/sha256/contentMD5/expectedMD5, so the hex claim in model.nullPageCoverage.tla, the only credential for NullPageCoverage.tla, is invisible to the sweep and exits 0 regardless of drift; (2) the docstring promises confirmed/prevented artifact claims gate with MISMATCH but the code passes gated=False, so artifact sha256 drift never fails the gate; (3) the 931-line ledger-mutating tool ships with no tests despite the scripts/tests convention; (4) re-pinned rows keep rederived SELF-RUN prose that now contradicts the corrected values (repeated across the pinCorrected rows).
Optional suggestions (no change required): pass the old relocation path as extra_paths to first_moved_at in the files loop so a future rerun cannot attribute movedAt/pin to the 32e8ad3 move commit when the digest predates the move (trace_claim already does this); object-db-scan proves blob existence, not artifact provenance, so the headline wording could be sharper; sha256Verification.commit a2e8776 reflects regen-time HEAD during the second commit (blob-identical to 8f65f3c on pinned paths, so digests are unaffected); add a fixture test for the unresolvable-key-is-inventory-not-red mechanism since the inverted repo test no longer exercises it; the preventedArtifacts verification note says recorded sourceSnapshot although preventedArtifacts has no snapshot (baselineCommit is used).
…#191 r4565972024 The model scan and apply verified only fields NAMED md5/sha256/contentMD5/ expectedMD5, so a hex-valued claim under another name was invisible to the gate. model.nullPageCoverage.tla holds the md5 of NullPageCoverage.tla (1372a87cbf2ee82f8366df1d525b9f96) and that file is pinned nowhere else in the ledger - exactly the class the review comment identified. Extend both sides through one enumerator (model_section_claims): named claims now include digest (wiring the previously unused CLAIM_ALGO auto entry) and tla-when-bare-hex (md5/sha256 by length), with resolve_algo for auto-length dispatch; scan and apply can no longer diverge on the field list. Path-valued tla fields are untouched. Re-derivation: the nullPageCoverage.tla claim is TRUE against the HEAD blob (scan row: model/nullPageCoverage/tla MATCH, scanned 220->221), so no ledger value changed and the ledger blob stays byte-identical. Non-vacuity control: corrupting the field in place to 0*32 yields GATED-FAIL MISMATCH claimed=0000... computed=1372a87c... with tool exit 1; ledger restored byte-identical afterward. Validation: scan exit 0 with the new gated row; comment gate exit 0 on the tool; ledger git-clean.
…tes, add tool tests (review #191) Three findings from the adversarial pass on #191: 1. Gating contract (thread r4566...) — the docstring promised artifact claims gate, but both check_claim calls passed gated=False, so a digest mismatch could only surface as SNAPSHOT-DRIFT (never gated). _artifact_claim now gates the @Head row unless the claim verifies against its sourceSnapshot blob or a recorded sha256Verification blob (_artifact_backed: re-checks file-history-blob/sourceSnapshot-blob commits, or membership via object-db-scan). On the live ledger: the 10 head-repinned artifact digests now gate as MATCH and the 9 evidence-backed claims stay SNAPSHOT-* report-only; scan exit 0. 2. Superseded attestations (reviewer BBlU) — 48 files rows kept a rederived SELF-RUN quote asserting live == git show <old>:<path> == on-disk beside a corrected pin. Checker.stale_quotes re-derives every quoted blob and emits report-only SUPERSEDED-PROSE; --apply stamps pubbundleRepin.rederivedSuperseded (quotes, cited digests, pinned claims, note) so no false quote stands unqualified. Applied: exactly 48 stamp additions, zero digest-value changes, idempotent on rerun. 3. Test coverage (reviewer BBlI) — new scripts/tests/ test_recompute_reviewed_ledger.py builds a fixture git repo and covers MISMATCH re-pin receipt shape (pre/post/movedAt/ticket), SHAPE-ANOMALY and PROSE-VALUE gating, repoint-merge with both keys present, plain repoint receipt, prose-str-to-{md5,note} upgrade, model hex-tla gating, artifact head gating with and without evidence, superseded-quote report/stamp/idempotence, and the canonical JSON roundtrip through main() --apply. 9/9 pass. Also: the repoint-merge branch was silent (no FIX note) — now recorded; resolved_tracked moved from an id()-keyed global cache (id-reuse hazard) to a per-instance memo; docstring exit-gate paragraph matches behavior. Validation: scan exit 0 (221 rows, 0 gated failures, 0 SUPERSEDED-PROSE after stamping); checker --all-tracked exit 0 (unresolvable=0, violations=0); scripts/tests full discovery OK; comment gate exit 0 on both touched scripts; ledger canonical roundtrip byte-exact.
…ifier F-2, coordinator ruling) WAVE ADDENDUM verdict, option (i) chosen: adjudicate_artifact now skips re-derivation entirely when an artifact row's sha256 claim already matches the live head (or sourceSnapshot) blob AND its recorded sha256Verification block re-verifies against its cited blob (verification_reverifies: git show for sourceSnapshot-blob / file-history-blob / head-blob, object-index membership for object-db-scan). Evidence-gated, not unconditional: the stale-block control test proves an unverifiable block is still rewritten. The docstring --apply paragraph now states the contract. Chosen over option (ii) because skip-if-live-true+backed makes drift impossible to mask while giving strict byte stability; historical file-history/object-db rows stay on the active repair path and land on an identical fixed point (deterministic trace derivation). Proof at this head: python3 scripts/recompute_reviewed_ledger.py --apply run twice against the committed ledger -> cmp byte-identical both times (10 live-true rows skip with 'no rewrite', 9 historical rows re-derive identical traces). Scan unchanged: exit 0, 221 rows. Fixtures: test_apply_noop_on_converged_artifact_verifications (double --apply, byte-identical, no 'verified via' rewrite lines) and test_stale_artifact_verification_is_rewritten (unverifiable block -> rewritten to sourceSnapshot-blob trace). Tool suite 11/11; scripts/tests discovery 110 OK; checker --all-tracked exit 0; comment gate exit 0. Ledger untouched by this commit.
matthewpeterkort
left a comment
matthewpeterkort
left a comment
There was a problem hiding this comment.
Re-reviewed the full PR range 8f65f3c..ecd7af1 (6 commits; the queue snapshot named head 238df82, and the branch has since added ecd7af1, which I also reviewed in full).
Verdict: approved — ready to merge once CI is green at ecd7af1. No inline comments; nothing requires a change.
Disposition of the four findings from my previous review — all fixed in committed code:
- Hex-valued model fields now gate. model_section_claims adds digest (auto-resolved via resolve_algo) and tla-when-hex; scan_model and apply_fixes share the helper. NullPageCoverage.tla (the credential that was previously invisible) now scans via the _section_path fallback, its value matches the lane05Repin post-strip record, and the file is untouched since 8f65f3c; test_model_hex_tla_field_gates_and_repins covers MISMATCH plus re-pin with receipt.
- Artifact gating contract is honest now. _artifact_claim passes gated=not backed, where backed = sourceSnapshot blob match or sha256Verification re-verification (sourceSnapshot-blob/file-history-blob via git show, object-db-scan via object-index membership). Docstring matches code. Fixtures cover both directions: test_artifact_head_gates_without_evidence (ungrounded claim exits 1 with MISMATCH) and test_artifact_snapshot_and_evidence_stay_report_only.
- The tool has a test suite: scripts/tests/test_recompute_reviewed_ledger.py, 11 fixtures over synthetic git repos, covering all five scenarios I asked for (MISMATCH receipt shape with movedAt, SHAPE-ANOMALY plus PROSE-VALUE gating, repoint-merge branch, prose-string str-to-note path, canonical roundtrip) plus repoint-with-receipt, model hex tla, artifact gating, superseded-quote stamping, and ecd7af1 adds double-apply byte-noop plus stale-verification rewrite controls.
- Stale SELF-RUN quotes are now adjudicated, not left silently contradicting re-pinned values. stale_quotes emits SUPERSEDED-PROSE (report-only) and --apply stamps pubbundleRepin.rederivedSuperseded with quotes, citedDigests and pinnedClaims evidence; scan skips stamped fields so the sweep is idempotent. I spot-checked stamps: quote paths align with the row (or its pre-move path at the cited commit), and cited digests match the recorded pre values, so the note (predates the final re-pin, historical evidence only) is accurate.
ecd7af1 review: the convergence guard is evidence-gated, not unconditional — skip requires the claim to be live-true at head or sourceSnapshot AND the recorded sha256Verification to re-verify against its cited blob; a drifted file makes true_at_head false so drift cannot be masked. Historical file-history/object-db rows stay on the active repair path with deterministic trace derivation. The two fixtures prove both the no-op and the stale-block rewrite.
Verification basis and limits: read-only reviewer sandbox; I did not execute the tool or test suites. Static review of all changed code plus worker receipts (tool suite 11/11, discovery 110 OK, double-apply byte-identical, checker and comment gate exit 0) and CI: at 238df82 every completed check is green (Python tests green; the two cancels are supersessions by the newer push). At ecd7af1 checks are still running and Tests / Python tests is queued — require it green before merge, since it is the gate for scripts/tests.
Optional suggestions (no change required): (1) model apply re-pins any claim-named field including digest without a hex guard, unlike tla; the ledger currently uses digest only as a path pointer under operator (outside model), but a future path-valued digest in a model section would be silently overwritten on --apply — consider requiring hex for digest claims. (2) stale_quotes stamps any string field containing git show; a comparative quote about a different file would get a predates-the-re-pin note — the stamp preserves full quote evidence so it is auditable, but the note wording could hedge. (3) resolved_tracked re-copies the already-cached set from Git.tracked().
matthewpeterkort
left a comment
matthewpeterkort
left a comment
There was a problem hiding this comment.
Reviewed PR #191 at head ecd7af1 (queue snapshot head; full range 8f65f3c..ecd7af1, 6 commits, 4 files).
Verdict: approved. No inline comments; nothing requires a change.
All four findings from my prior review are resolved in committed code:
-
Hex-valued model fields now gate. model_section_claims covers digest (via resolve_algo) and tla-when-hex; scan_model and apply_fixes share the helper. NullPageCoverage.tla — the credential that was previously invisible to the sweep — is now scanned via _section_path fallback and its value matches the lane05Repin post-strip record (file untouched since 8f65f3c). Fixture: test_model_hex_tla_field_gates_and_repins asserts MISMATCH-then-re-pin-with-receipt.
-
Artifact gating contract matches the docstring. _artifact_claim passes gated=not backed, where backed = sourceSnapshot blob match OR sha256Verification re-verification against its cited blob (sourceSnapshot-blob/file-history-blob via git show, object-db-scan via object-index membership). Fixtures cover both directions: test_artifact_head_gates_without_evidence exits 1 with MISMATCH; test_artifact_snapshot_and_evidence_stay_report_only keeps evidenced rows report-only.
-
The tool has fixtures. scripts/tests/test_recompute_reviewed_ledger.py, 11 tests over synthetic git repos: MISMATCH receipt shape with movedAt, SHAPE-ANOMALY + PROSE-VALUE gating, repoint-merge branch, prose-string str-to-note path, canonical roundtrip, repoint-with-receipt, model hex tla, artifact gating, superseded-quote stamping, plus ecd7af1 adds double-apply byte-noop and stale-verification rewrite controls.
-
Superseded SELF-RUN quotes are now adjudicated, not silently contradictory. stale_quotes emits SUPERSEDED-PROSE (report-only) and --apply stamps pubbundleRepin.rederivedSuperseded with quotes, citedDigests, pinnedClaims evidence; scan skips stamped fields so the sweep is idempotent. Spot-checked stamps: quote paths align with the row (or its pre-move path at the cited commit) and cited digests match the recorded pre values, so the predates-the-re-pin note is accurate.
ecd7af1 (convergence guard) review: the skip is evidence-gated, not unconditional — adjudicate_artifact requires the claim to be live-true at head or sourceSnapshot AND the recorded sha256Verification to re-verify against its cited blob; a drifted file flips true_at_head false, so drift cannot be masked by a stale block. Historical file-history/object-db rows stay on the active repair path with deterministic trace derivation. The two new fixtures prove both the byte-noop and the stale-block rewrite.
CI status at ecd7af1: Tests / Python tests, Node unit tests, Go ClickHouse integration, Shell cleanup all completed success. The remaining checks (Go unit tests, Arango integration, UI checks/build, PostgreSQL spine, Compiled publication, Backend architecture conformance, Generated/OpenAPI contracts, PostgreSQL 18 fixture runner) are still in_progress. Since the tool changes and scripts/tests are gated specifically by Tests / Python tests, that gate is now green. Recommend waiting for the rest of the matrix to finish before merging, but nothing in the current evidence requires a code change.
Reviewer sandbox limits (unchanged): read-only git/gh; I did not execute the tool or pytest. Digest correctness rests on tool receipts + CI; my static review of the changed code plus prior-review disposition carries the verdict.
Optional suggestions (no change required): (1) model apply re-pins any claim-named field including digest without a hex guard, unlike tla; digest is currently a path pointer outside the model section but a future path-valued digest inside a model section would be silently overwritten on --apply — consider requiring hex. (2) stale_quotes stamps any string field containing git show; a comparative quote about a different file would still get a predates-the-re-pin note — the stamp preserves full quote evidence so it is auditable, but wording could hedge. (3) resolved_tracked still re-copies the already-cached set from Git.tracked().
What
Single authoritative re-pin of
verification/publication-bundle/reviewed-sources.jsonat repo tip8f65f3c5: every derivation-claiming field (md5/sha256/contentMD5/expectedMD5 + bare-hex rows + artifact sha256 credentials + pin attributions) recomputed against the actualgit show HEAD:<path>blobs. Every mismatch fixed to the true computed value — no expectation was ever adjusted to admit a stale digest (a stale-but-plausible digest is treated as the fatal class it is).Tool:
scripts/recompute_reviewed_ledger.py— rerunnable, row-by-row. Scan classes gated:MISMATCH,SHAPE-ANOMALY,PROSE-VALUE,UNRESOLVABLE-A/B,PATH-UNRESOLVED,BLOB-MISSINGfor head-blob attestation fields; historical receipt subtrees (repair_units, repin blocks) and verified snapshot-bound rows are reported but never gated.--applywrites only true values and stampspubbundleRepinreceipts (pre/post, movedAt, pinCorrection).Headline numbers (measured at 8f65f3c)
fB22Tier1Md5sx4,reconcileDangleTrust.contentMD5)status_updates[F-B15-ledger-pin]pinattributionsconfirmed+preventedArtifacts)aliases.go(deleted b2da41e) retired with reasoninternal/catalog/types.go:6b84be97…(stale-from-base, broken by merged 4878319) ->418edc97…(true HEAD md5).internal/backends/postgres/control/vocabulary_control.go:5d41b670…->06d0597c….Canonical form preserved:
json.dumps(indent=2, ensure_ascii=False)+"\n"roundtrip byte-identical (asserted by the tool after apply).Row-by-row recompute tables
files-map mismatches re-pinned to HEAD blob (72 rows)
internal/api/graphql/graph/query/input_resolution.godf658e046d1b5343dad874aeinternal/api/graphql/graph/query/read_scope_ingress_control_chars_e2e_test.goa4d48d8e743c62d7e7ca59a1internal/api/graphql/graph/resolver/recipe_execution_reader.goc9cfd2c27c03b00d64740dceinternal/api/graphql/graph/resolver/recipe_execution_reader_authz_e2e_test.go2ca07086a0af65d52b1fac00internal/authscope/auth_path_control_ingress_test.goe65c7bc98c336efb01fbd8b0internal/authscope/fence_resource_access.go2da4e1e7b0084191b0a3bf89internal/dataframe/publication/clickhouse/bundle_store.gob034db9a50f11dce5b82c34cinternal/dataframe/publication/clickhouse/orphaned_published_growth_e2e_test.go48796dc9301828be13895ce9internal/dataframe/publication/clickhouse/pointer_name_nul_ambiguity_e2e_test.go8f3d1c9ae8e9fd40143f0607internal/dataframe/publication/clickhouse/reconcile_toctou_e2e_test.go30e97601ec8fefae8c7847c6internal/dataframe/publication/clickhouse/release_dangle_reconcile_e2e_test.go770ada2b907b4c539989e614internal/dataset/release.go1118624d9f2d03ee181e34cfinternal/dataset/release_requirements_e2e_test.go1ef6caca96735d96cd4c619finternal/server/openapi_recipe_execution.go2fb6066b044105d8c4686c9binternal/server/options.go7754040c10914366f81c2270internal/server/recipe_execution_status_twin_e2e_test.go67bfaf5428238dc0c769b8dfinternal/server/recipe_execution_twin_authz_repair_test.gof629ff8e79b1f2efbe453a88internal/server/server.god99dcc0db26dd95a4e109e2einternal/server/server.god158ce26c9e122e979cc9198verification/publication-bundle/FINDINGS.mde10ca876747fd22a4774e180verification/publication-bundle/OPERATOR_REVIEW_DIGEST.md0b0bf2613fcdb11e28904f3finternal/explorer/lifecycle/publish_release_requirements_classification_test.go1a7ea43cdeb6be762a74427einternal/catalog/types.go6b84be9759db418edc971192internal/api/bulk/load/cross_project_dataset_authorization_e2e_test.go84b3aa8835124244ae518928internal/authscope/covers_execution_paths_control_test.go9bf8b1662ec531ddf950cdb1internal/authscope/all_generations_cache_key_test.goc70b83bb1c614e25d1598c49internal/authscope/auth_resource_path_options_conflict_test.go69bbbe193a472f8c235c065ainternal/authscope/scope_cache_key_namespace_test.godc7accfb0722106713913d34internal/explorer/lifecycle/unpivot_source.go08f57927476574b0ac608d5ainternal/explorer/lifecycle/unpivot_source_test.gofaa60db21136147de264f89ainternal/server/explorer_output_reconcile_unpivot_source_test.goe43cfee809df67f4bae95048internal/server/openapi_explorer_construction_unpivot_source_test.go42e4b2b945f65d6adc272b56internal/acceptance/runner.gob0c7aa89a3f09a8ce5413cfainternal/server/core_authoring_protocol_formal_replay_test.go17799abb830ef487d96be3fdinternal/explorer/lifecycle/fs1_reverse_order_collision_test.gof901042baf09e867768b5c3ascripts/verify-ui/workflows/verify-explorer-unpivot-row-source.mjs0110894b5ffe71e2422e444cinternal/api/graphql/graph/dataframe/aggregates_test.goa923f2afdf21919ebfe6cae8internal/explorer/lifecycle/construction_pivot_source.goe3539cf39477e131b755c163internal/explorer/lifecycle/construction_pivot_source_test.go3565e4a4a5ec94d3c015caaainternal/explorer/lifecycle/derive_source.go32da4974802eba8bca5ef252internal/explorer/lifecycle/derive_source_test.go9bd5cff74ce861caceb1bf0binternal/explorer/lifecycle/filter_source.go6e82dbdf593390e916b59048internal/explorer/lifecycle/filter_source_test.gob5dd9ad1ccaefba9bc4953fdinternal/server/openapi_explorer_construction_filter_source_test.go511f411c7ebe4b9a1228360fverification/publication-bundle/SKILL.md2ee4c56c2b7719f87af41e93scripts/verify-ui/registry.mjsbd8053144d124808335e5206docs/BUILDER_VERIFICATION.tsv761d3d6e95af7b99c073e805internal/server/openapi_explorer_authoring_write_fault_test.goe14f4f5db04f1719fb158062internal/server/openapi_explorer_authoring_direct.go9aaecd4e8835478fc4434d89internal/server/openapi_explorer_direct.gob57e753f82058076b17b8f7ainternal/explorer/lifecycle/filter_source_pivot_clear_test.go9b0c5ff56a88ad1d5d58eadcinternal/api/graphql/graph/resolver/recipe_execution_twin_wire_parity_test.go3505112d27b13e2d9bc6f29einternal/server/recipe_execution_etl_failure_fields_e2e_test.go244fdce8b0454e667613bb7binternal/explorer/authoringv2/construction_projection_replay_test.goc09486b4442cba945182535finternal/ci/vet_gate_test.go44b47d61f21767ae10603736internal/api/bulk/load/operations.go50a0768a5593dbf0581d9cfbinternal/api/bulk/load/form_spillover_test.gob66be235d05b12e0c661f6fdinternal/api/recipe/discovery.go03e1528ed6aa3f4ee1dac6aeinternal/api/recipe/discovery_auth_mode_test.go966446cd7ec5c66d29762272internal/ci/gofmt_gate_test.gocf758c1f7556bf14ea793ed1conformance/compiler/generated_semantics_coverage_test.go6d37b4dfe7d2e98efa2c1cc8generated/graphql/graph/executor/schema.generated.go7bb95f32c94fd266e30ed509internal/projectid/projectid.go107ca45ca51eade73438be11internal/catalog/semantic_inventory.go3cd3f6a3e001e40ea07e8757internal/store/clickhouse/client.go327b4d9f154eaa6e13e1e4f0internal/server/explorer_publication.go8aae339388a28232bed47679internal/server/options_schemas_test.go9182bbefccccabadedff88e4internal/server/runtime.go8b191a06092441a3d046d986internal/server/runtime_test.god72f4a626a1229ea8dd872c1internal/server/runtime_postgres_live_test.go36552734abd29346f2a0b3e9internal/backends/postgres/control/runtime.goc60c9ad2de1dd58b7bb400b4internal/backends/postgres/control/vocabulary_control.go5d41b67074db06d0597caee8model-section mismatches re-pinned (5 rows)
fB22Tier1Md5sdf658e046d1b5343dad874aefB22Tier1Md5sa4d48d8e743c62d7e7ca59a1fB22Tier1Md5se65c7bc98c336efb01fbd8b0fB22Tier1Md5s2da4e1e7b0084191b0a3bf89reconcileDangleTrust13b8bf3a27414c196436bd1dstatus_updates pin re-pinned (1 rows)
F-B15-ledger-pinab4cf9341193aaaa60f999a5stale pin attributions corrected (10 rows)
internal/api/graphql/graph/resolver/recipe_execution_reader.go87ee09c7-internal/dataframe/publication/clickhouse/bundle_store.goe68c7d6b-verification/publication-bundle/ConstructionPrepareLanes.tla49d6999e-verification/publication-bundle/ConstructionProjectionOwnership.tlacf0ca558-scripts/verify-ui/workflows/verify-explorer-row-source-four-state.mjs7fcb640f-scripts/verify-ui/helpers/tests/row96-row-source-four-state.test.mjs7fcb640f-scripts/lib/formal-projection-replay.mjs2f6e64ea-scripts/verify-ui/contracts/source-projection-contracts.mjs2f6e64ea-scripts/ci/vet.mjs661de7b3-conformance/compiler/benchmark_test.go4e15704f-Pin attribution corrections (48 rows)
The recorded pin commit did not contain a blob matching the row's claimed digest; re-attributed to the first commit whose blob actually produced it (full
--followhistory walk).internal/api/graphql/graph/resolver/recipe_execution_reader.go87ee09c748783199internal/server/openapi_recipe_execution.go87ee09c748783199verification/publication-bundle/FINDINGS.md4e15704f8f65f3c5internal/authscope/covers_execution_paths_control_test.go4e15704f48783199internal/explorer/lifecycle/unpivot_source.go8459f08048783199internal/explorer/lifecycle/unpivot_source_test.god3a1d12a48783199internal/acceptance/runner.gof177a9ed48783199internal/server/core_authoring_protocol_formal_replay_test.gofdf2969e48783199verification/publication-bundle/ConstructionPrepareLanes.tla49d6999e8f65f3c5internal/explorer/lifecycle/fs1_reverse_order_collision_test.go34e4741d48783199scripts/verify-ui/workflows/verify-explorer-unpivot-row-source.mjs29d2c5b02fbb0992internal/api/graphql/graph/dataframe/aggregates_test.go9d092c5b48783199verification/publication-bundle/ConstructionProjectionOwnership.tlacf0ca5588f65f3c5internal/explorer/lifecycle/construction_pivot_source.god3a1d12a48783199internal/explorer/lifecycle/construction_pivot_source_test.god3a1d12a48783199internal/explorer/lifecycle/derive_source.go8459f08048783199internal/explorer/lifecycle/derive_source_test.god3a1d12a48783199internal/explorer/lifecycle/filter_source.god3a1d12a48783199internal/explorer/lifecycle/filter_source_test.god3a1d12a48783199internal/server/openapi_explorer_construction_filter_source_test.go29d63f6f48783199verification/publication-bundle/SKILL.md49d6999e8f65f3c5scripts/verify-ui/workflows/verify-explorer-row-source-four-state.mjs7fcb640f2fbb0992scripts/verify-ui/helpers/tests/row96-row-source-four-state.test.mjs7fcb640f2fbb0992scripts/verify-ui/registry.mjs7fcb640fe5b5c27edocs/BUILDER_VERIFICATION.tsv7fcb640fe5b5c27einternal/server/openapi_explorer_authoring_write_fault_test.go3cfec1b748783199internal/server/openapi_explorer_authoring_direct.go3cfec1b748783199internal/server/openapi_explorer_direct.go3cfec1b748783199internal/explorer/lifecycle/filter_source_pivot_clear_test.go8459f08048783199internal/api/graphql/graph/resolver/recipe_execution_twin_wire_parity_test.go87ee09c748783199internal/server/recipe_execution_etl_failure_fields_e2e_test.go87ee09c748783199internal/explorer/authoringv2/construction_projection_replay_test.go2f6e64ea48783199scripts/lib/formal-projection-replay.mjs2f6e64ea8f65f3c5scripts/verify-ui/contracts/source-projection-contracts.mjs2f6e64ea8f65f3c5scripts/ci/vet.mjs661de7b38f65f3c5internal/ci/vet_gate_test.go661de7b348783199internal/api/bulk/load/operations.god2ff3d0348783199internal/api/bulk/load/form_spillover_test.god2ff3d0348783199internal/api/recipe/discovery.goadfff03048783199internal/api/recipe/discovery_auth_mode_test.goadfff03048783199internal/ci/gofmt_gate_test.go4e15704f48783199conformance/compiler/benchmark_test.go4e15704f8f65f3c5conformance/compiler/generated_semantics_coverage_test.go4e15704f2fbb0992generated/graphql/graph/executor/schema.generated.go4e15704ffaffab39internal/projectid/projectid.god5b5491b48783199internal/catalog/semantic_inventory.god5b5491b48783199internal/store/clickhouse/client.god5b5491b48783199internal/backends/arango/internal/catalog/all_generations_project_binding_integration_test.godc52ed0a80bca9a5Artifact sha256 adjudication (19 claims)
Each claim checked against:
git show <sourceSnapshot>:<path>, HEAD blob, file history (--follow), then a fullgit rev-list --objects --allsha256 scan of every object ever committed. Claims matching no object were replaced with the true HEAD value and stampedartifact-untraceable-repinned-to-head-blob.internal/dataframe/publication/clickhouse/reconcile_toctou_test.go38f8004da1db(wasaaa139ca86d1)a2e87763internal/dataframe/publication/clickhouse/reconcile_toctou_e2e_test.go0f9cbc65164e(wasb13b9f1ce8df)a2e87763internal/dataframe/publication/clickhouse/pinblock_reconcile_e2e_test.go9a74598f94e9313033284667internal/dataframe/publication/arango/name_latest_binding_e2e_test.goa3ca98434fb2e5b5c27einternal/dataframe/publication/arango/dangling_binding_e2e_test.go0c20e8e78ec6(was3dfeedf8e1e5)a2e87763internal/dataframe/publication/arango/release_dangle_reconcile_e2e_test.gob9286f56595c(wascce2c29d5bf6)a2e87763internal/dataframe/publication/arango/release_dangle_reconcile_e2e_test.gob9286f56595c(wascce2c29d5bf6)a2e87763internal/explorer/arango/cross_generation_publish_e2e_test.goc5846991e917ded623b2e8a5internal/dataset/release_requirements_e2e_test.goda4f7ae6ba9a(was645592cd4370)a2e87763internal/dataset/arango/revision_inflation_e2e_test.gob01ab91e9146052625a6e895internal/dataframe/publication/clickhouse/publish_partial_pointer_e2e_test.goa4e3dd51f360(wascf13d635dcd9)a2e87763internal/dataset/arango/generation_activation_cas_e2e_test.go613046287ad2(was70e9f8885b3a)a2e87763internal/dataframe/publication/clickhouse/orphaned_published_growth_e2e_test.go3fa599c69158(wasda5d26c54d3e)a2e87763internal/dataframe/publication/clickhouse/pointer_name_nul_ambiguity_e2e_test.go499574cb828c38a573ed46c0internal/dataframe/recipe/publication_identity_nul_http_test.go19d396a2ddeb228a6785bfc7internal/api/graphql/graph/resolver/recipe_execution_reader_authz_e2e_test.go1ecc2bd3cbcdc93d24539fbainternal/server/recipe_execution_status_twin_e2e_test.goe88e8c9ce01c8576b6d65581internal/dataframe/published/nullsort_page_cursor_e2e_test.go18a7e4772af1(wasa57fd172b8b6)a2e87763internal/dataframe/publication/clickhouse/unpinned_page_read_e2e_test.goc64b56677eede5b5c27eA-class unresolvable keys — repointed (14 rows)
All 14 via commit 32e8ad3 (arch-backend-07 PR-2: adapter trees moved under internal/backends/arango).
internal/dataframe/execution/chartifact/arango/catalog.gointernal/backends/arango/internal/chartifact/catalog.gointernal/dataframe/publication/arango/bundle_registry.gointernal/backends/arango/internal/publication/bundle_registry.gointernal/dataframe/publication/arango/dangling_binding_e2e_test.gointernal/backends/arango/internal/publication/dangling_binding_e2e_test.gointernal/dataframe/publication/arango/name_latest_binding_e2e_test.gointernal/backends/arango/internal/publication/name_latest_binding_e2e_test.gointernal/dataframe/publication/arango/release_dangle_reconcile_e2e_test.gointernal/backends/arango/internal/publication/release_dangle_reconcile_e2e_test.gointernal/dataset/arango/generation_activation_cas_e2e_test.gointernal/backends/arango/internal/dataset/generation_activation_cas_e2e_test.gointernal/dataset/arango/manifest_lifecycle.gointernal/backends/arango/internal/dataset/manifest_lifecycle.gointernal/dataset/arango/release_store.gointernal/backends/arango/internal/dataset/release_store.gointernal/dataset/arango/revision_inflation_e2e_test.gointernal/backends/arango/internal/dataset/revision_inflation_e2e_test.gointernal/explorer/arango/cross_generation_publish_e2e_test.gointernal/backends/arango/internal/explorer/cross_generation_publish_e2e_test.gointernal/explorer/arango/selections.gointernal/backends/arango/internal/explorer/selections.gointernal/explorer/arango/selections_cleanup_e2e_test.gointernal/backends/arango/internal/explorer/selections_cleanup_e2e_test.gointernal/catalog/arango/resources.gointernal/backends/arango/internal/catalog/resources.gointernal/catalog/arango/all_generations_project_binding_integration_test.gointernal/backends/arango/internal/catalog/all_generations_project_binding_integration_test.goA/B-class retired keys (4)
Preserved verbatim under
retiredFilesKeyswith per-key reason:cross_generation_publish_e2e_test.go.explorerrelease_dangle_reconcile_e2e_test.go [arango pkg]release_dangle_reconcile_e2e_test.go [clickhouse pkg]internal/backends/postgres/aliases.gostatus_updates
F-B15-ledger-pin:ab4cf9341193(md5 of the revision-inflation artifact ate5b5c27e; stale since the relocation + comment strip) -> head md5aaaa60f999a5, pinTargetinternal/backends/arango/internal/dataset/revision_inflation_e2e_test.go.On the "46-row out-of-scope stale inventory"
The acceptance note cites
c6LedgerHygienePending(lane-05 census,/home/node/.ao/data/artifacts/loom-experiment-213/lane05-final-audit-census.json) for 46 out-of-scope stale rows. That census section actually carries 18 keys (count: 18, subclasses A=15/B=3) — all dispositioned above. The census contains no 46-row list under any key; the closest prior inventory is lane-04'slane04-dual-ledger-273pin-recompute-v2.json(different base9534829d: 50 stale + 14 broken of 273), long since superseded. This PR therefore dispositions the complete stale population measured at the current tip (125 rows: 78 claim mismatches + 19 artifact credentials + 18 unresolvable keys + 10 stale pins, tabled above), which strictly covers any 46-row subset of the tip state.Safety / scope
scripts/recompute_reviewed_ledger.py(new tool), andscripts/tests/test_no_code_comments.py.internal/dataframe/compiler/render/postgres/) and feat(benchmark): Arango/Postgres matched dataframe benchmark with correctness gates and CH-disclosed publication chain #159 (benchmark) untouched — diff contains no product code.test_unresolvable_ledger_keys_are_inventory_not_redupdated: it had hardcoded the two B-class malformed keys as permanently-present inventory; now asserts the repaired state (inventory class present, zero unresolvable keys), plus a new test that every ledgerfileskey resolves to a tracked HEAD path.Validation (all at final source)
python3 scripts/check_no_code_comments.py --all-tracked-> exit 0,scanned=2971 violations=0 unresolvable-ledger-key=0 unsupported=0python3 -m unittest scripts.tests.test_no_code_comments-> 50/50 OKGOPROXY=off go test -count=1 ./internal/...-> exit 0, 73 packages ok, 0 FAILgo test -count=1 ./conformance/...-> okgofmt -lclean;go vet ./internal/...clean;go build ./...clean