# Process multiselect closed gate evidence

These tools adapt the State multiselect checks packager/verifier. They copy
explicitly named **closed** runs from `.local/process-group-gates`, preserve
their exact seven raw files, retain nonzero exit codes and both streams, and
verify all source-map/archive bytes before writing and again after ZIP readback.
They never run Cargo, execute archived code, extract inputs, or publish evidence.

Check-only example:

```text
python -B prepare.py --root CHECKOUT --runs core-1 desktop-1 desktop-2 lint-1 full-desktop-1 lint-2 format-2 --check-only
```

After all desired runs close, supply a fresh, nonexistent output directory:

```text
python -B prepare.py --root CHECKOUT --runs core-1 desktop-1 desktop-2 lint-1 full-desktop-1 desktop-3 feedback-1 lint-2 format-2 native-build-1 windows-build-1 --output FRESH_DIRECTORY
python -B verify.py FRESH_DIRECTORY
```

Run names in the second example are a proposed final inventory, not an existence,
completion, pass, or source-equivalence claim. The parent chooses the final list.
Preserve failed desktop-1, desktop-2, and lint-1 alongside subsequent receipts;
their successful packaging means only byte/receipt consistency. No run is inferred
from directory scanning. Open/incomplete runs, changed-input receipts, missing
historical helpers, unsafe/duplicate archive members, and mismatched input
maps/bytes are refused. An existing output directory is refused even if empty.
Use repeatable `--helper PATH` to provide an exact historical capture helper when
the current two helpers no longer match a selected receipt.

`manifest.json` maps each logical raw path to its stored ZIP member. Input maps
and input ZIPs deduplicate independently by their exact SHA-256 bytes, including
ZIP metadata; equal source contents need not imply byte-identical ZIPs.
`captureHelpers` names both gate.py and gate-feedback.py and points to their
hash-addressed archived bytes. Each run separately references the helper matching
its receipt. Current reviewed helper SHA-256 values are:

```text
gate.py          1368375b1fba0dfc50b77ea4f406dba71960a78317ce8f259d4c4a0254863a20
gate-feedback.py 230f1222f133edef76ffb9c09ed6eecf952fc326b04a0bbccb3f3f49df4c0c29
```

Both current named helpers are included even when no selected run uses one yet.
The manifest is authoritative for helper pins at packaging time; this README's
values document this tooling review, not a substitute for receipt matching.
`files.json` pins the archive, manifest, tools and this README. Keep that pin file
under the parent's source/evidence record; self-consistency is not authentication.

The verifier retains the existing 71-file vendored-input invariant and requires
`inputsUnchanged` to be exactly true. Source coverage is whatever each original
input map and receipt actually captured; recorded HEAD alone does not identify
uncommitted tested bytes. Executable readback pins are receipts only: no executable
or toolchain is packaged or independently reconstructed. Rendered feedback images,
native screenshots/saves and source-to-commit receipts are separate parent-owned
packages. Offline validation is not test execution, native acceptance or usability
evidence. `selfcheck.py` checks these tools against explicitly selected closed runs
and includes in-memory corruption rejection checks.