[drevendev]

Explicit false-like values in carried-history arrays were silently converted to empty history by record.get(...) or []. This change preserves omitted/empty-array compatibility while rejecting malformed persisted evidence, so a passing current sample cannot hide a malformed carrier behind a CLEAN Integrity result.

Target: B1
Target: B3

Related to #83. Partial repair only; keep #83 open.

Base and dependency

• Target branch: release/0.6.0, as required by CONTRIBUTING.md.
• Depends on 0.6: independently verified Git history and executable assurance #81, whose current head is a4761daa9fa87026ea106a3d722e7299b3de3b8b.
• Fix and independently tested head: 9cf0c0cf678aeef620b5f6d6a1662533894c10b2.
• Review only this repair: 4 files, 105 insertions, 3 deletions.
• At creation the release branch is 22a2894057d9b1bc003efe4ef932ed4de601e26b, so GitHub's full PR comparison also includes the 21 prerequisite commits from 0.6: independently verified Git history and executable assurance #81 (22 commits / 68 files in total). Those prerequisite changes are not new work or independently accepted release scope in this repair. Draft until that dependency is reconciled; no merge requested.

Bounded change

• v2 parent_groups and unresolved: default only an omitted key to [], then validate the supplied value.
• Replayable v1 parents: default omission to [] and require a list before iteration.
• Add 38 regression instances: 15 parser rejection cases, 15 public evaluator cases, 6 omitted/empty compatibility controls, and 2 valid carried-failure controls.
• Document the admission rule and implementation-local conformance mapping.
• No change to Vital thresholds, policy, history lineage, runtime dependencies or historical example bytes.

Explicit null, false, 0, "" and {} now raise HistoryShapeError; the public evaluator returns UNKNOWN, no band, and REVISION_HISTORY_CARRY_MALFORMED. Valid carried failures remain absorbing.

Executed validation at the fixing head

Windows build 26200, Python 3.14.7, pytest 9.1.1; local runs dated 2026-10-24. Imports were confirmed from this fixing source checkout.

Check	Result
New regression module against the real unpatched base package	30 failed / 8 passed, expected red control
python -B -m pytest -p no:cacheprovider tests/test_carried_array_admission.py tests/test_revision_history.py	63 passed
Independent complete python -B -m pytest -p no:cacheprovider --basetemp=<dedicated scratch directory>, outside sandbox	2578 passed in 91.34s, exit 0; no failures, errors or skips
python -B -m devostasis vectors	148 passed
python -B scripts/check_conformance_surface.py	63 passed
Offline core, code v1/v2, packet and work verify/replay examples	Passed
Additional real-package type rejection and v1/v2 passing/failing evidence probes	22 passed
git diff --check a4761daa9fa87026ea106a3d722e7299b3de3b8b..HEAD; final worktree check	PASS; clean

The first independent sandbox full run had 2577 passes and one Git sh.exe launch denial (NtCreateDirectoryObject ... 0xC0000022) in the unrelated shallow-clone test. That test passed outside sandbox, followed by the single fully green independent full run above. The conformance script also passed after relocating TEMP from the restricted sandbox directory. No tests were weakened.

Independent review

A separate review chat recovered the task scope and artifact references from durable state, inspected the exact base-to-head diff, confirmed source import paths and SHA-256 matches for evidence, patch, source files, logs and JUnit, and executed the checks above.

No actionable P0-P3 findings within the three-reader scope. This is a separately executed review in the same owner/host environment, not a separate credential identity or release approval. Private local state, absolute workspace paths and chat transcripts are not published here.

Remaining #83 scope and limits

This PR does not complete #83:

• Legacy carried_observation() conversion can still coerce malformed predecessor values to [] before admission.
• v1 parent-kind conflict propagation for one parent_id with different kind remains unresolved.
• Reconciliation can clear a preserved conflict after later passing evidence; conflict persistence must be addressed together with propagation.
• Broader correct PARTIAL-history uncertainty and multi-bundle behavior remain separate compatibility work, informed by Research: legacy Integrity predecessor UNKNOWN/UNAVAILABLE becomes AVAILABLE empty carrier #87.
• Propagation through the other prepared release candidates remains unverified.

Linux, Python 3.12/3.13 and hosted CI were not run by this review. The inherited release/conformance acceptance gates of #81 remain separate. No automatic issue closure, merge or release is requested.

[andy-zen-dev]

Independent exact-head review — scoped to the single repair commit a4761daa9fa87026ea106a3d722e7299b3de3b8b..9cf0c0cf678aeef620b5f6d6a1662533894c10b2 (not to the inherited 21 commits from #81).

Reviewed all four changed files: src/devostasis/revision_history.py, tests/test_carried_array_admission.py, docs/spec/integrity-ci.md, and docs/spec/conformance.md. The three replacements correctly distinguish missing keys from explicit malformed values; the v1 reader now rejects a non-list before iteration. The 38 parameterized instances cover each reader's five false-like values, public evaluator fail-closed behavior with a favorable current control, omitted/empty compatibility, and preserved v1/v2 recorded failures. The docs mark implementation-local cases rather than claiming new research-case acceptance. No merge-blocking defect found in this bounded three-reader change.

Exact-head hosted evidence: GitHub Actions run 40095515641 is completed/success; the Python 3.12, 3.13, and 3.14 jobs and their listed test, vector, conformance, sample-bundle, code and work-replay steps succeeded. I did not independently execute a local full checkout/test suite in this review; the runner result is hosted evidence, not my own test run.

This is COMMENT, not release approval. #88 remains draft and stacked on unmerged #81 (same unchanged head a4761daa...); the GitHub PR comparison therefore includes 68 files outside this repair. Do not merge #88 on the basis of this scoped review alone. Keep #83 open: legacy carried_observation() coercion, v1 parent-kind conflicts and their persistence across reconciliation, and four-generation historical acceptance remain unresolved, as acknowledged in the PR. #87 separately requires an accepted research decision for unsupported predecessor statuses. Re-check exact base/head, full-stack review findings and release checks after dependency integration.