6.0 KiB
Downloaded prerelease package provenance review
2026-09-24. Bounded independent static audit of draft release 7, Studio asset 25 and checksum asset 26, downloaded into download-1. No material package-integrity, build-linkage, or static portability defect found. Both packaged executables match the preserved individual Cargo-identified build receipts for exact source 715036e; this review does not establish native acceptance.
Reproduction and exact package
Run python -B .local/package-qa/package-audit/audit.py from this worktree. The stdlib audit reuses only the read-only document checker from scripts/package-artifacts.py; it does not launch shipped executables, invoke Cargo, or contact a network. Machine-readable results are in package-audit/result.json. Initial read-only Git checks reported clean tracked work and HEAD 715036e132677dd2bc2fb37ed316d93dc9987aec.
The Studio ZIP is 34,168,661 bytes, SHA256 5554e32533e3cb2c33fb4143a5a0902733d5a8d47577303cb2842d268e7bc76d, matching the downloaded checksum and download receipt. All 565 archived files equal their extracted bytes and recorded pins. Names have no traversal, absolute paths, backslash ambiguity, or case-insensitive duplicates; extraction has no extra files. All 564 SHA256SUMS.txt entries pass, covering every file except that checksum inventory itself. All 559 package.json input hashes pass.
The supplied BuildEvidence and release snapshot identify source 715036e132677dd2bc2fb37ed316d93dc9987aec, development profile, Rust 1.98.1, and x86_64-pc-windows-gnullvm. Both executable hashes match the actual archive bytes:
- Studio:
2c03bd6cc3f1110c219e4f57ab94874a121590f83779239a93289b7170664399. - Server:
6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237.
The four BuildEvidence references (mandatory gate, source manifest, environment, artifact relocation) retain producer-local path labels. Their bytes are independently available in versioned gate evidence linked by the downloaded release snapshot: 206f3b969482241e01e2dfc6be955caf31747b89:harness/prerelease37-windows-gates-20260924/final04-complete. After the parent fetched those objects, this reviewer read them without checkout or mutation. package-audit/build-link.py verifies the complete 6,588,421-byte evidence ZIP (SHA256 7cead0b6aa36a6af8fc9f8987186bfe0decd8fa2ebab094fc45387ae9daea632), all 462 member hashes, and exact agreement with all four BuildEvidence pins. Results and pertinent original receipt records are retained in package-audit/build-link-records.json.
Both individual builds have exit 0 and unchanged input captures identical to the final04 source manifest. Their source, target, and profile agree with the package; the preserved output size/hash equals each actual downloaded executable. The relocation records' Cargo compiler-artifact objects exactly occur in the corresponding pinned raw Cargo JSON logs, identify the appropriate non-test binary target and output path, and both streams record successful build completion. The aggregate summary records a passed gate at the same source. This bridges the package to the owner's already admitted source/build evidence; it does not rerun the broader 3,709-input source audit. Supplemental combined-build output hashes differ and are correctly excluded from the package identity claim. Keep the versioned evidence link in the final release so recipients can resolve the historical local labels.
Runtime and offline content
An independent PE32+ parser confirmed x86-64 architecture and reproduced every recorded import for Studio, Server, and libunwind.dll. The only ordinary non-system dependency is the shipped libunwind.dll, whose own imports resolve to Windows components/API sets. All three delay-import directories are empty. The runtime hash matches package inputs and notice inventory: aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a. Dynamic graphics loading, driver compatibility, and execution without development PATH remain runtime checks owned by the parent; static imports cannot establish them.
All 18 checked local Markdown/reST/HTML file links resolve. The two HTML specifications load no external script/style/image resources and contain inline styling. All 66 shipped documentation/example/deployment/license source files checked match this exact clean source checkout (README maps to scripts/package-readme.md). This includes the complete tracked examples/release1 content. Built-in Help behavior and actual example opening require the parent's separate native exercise.
The notice inventory contains 268 dependency packages. All 489 referenced notice paths/hashes match shipped bytes; Cargo.lock and 529 recorded local source/build-input hashes match the exact checkout with no mismatch. Rust and libunwind notices are present and pinned. This verifies the recorded notice closure, not an independent universal license audit, registry recompilation, or proof of embedded asset completeness.
Launch guidance and scope
Read START-HERE, package README, Windows packaging guide, server launch/configuration guidance, and preview human checks. They consistently require keeping the bundle together and the runtime DLL beside both executables; local modeling needs no Rust installation or server. They distinguish packaged executable launch from Cargo/Docker recipes requiring a separate source checkout, and recommend keeping server data outside the application folder. The Windows guide explicitly requires fresh extraction, unrelated working directory, restricted process PATH, actual workflows, logs/exit checks, and acknowledges a second machine as stronger portability evidence.
The human checklist presents expected exercises rather than claiming those exercises passed. It preserves aggregate deletion and broader acceptance limitations. The downloaded release snapshot remains draft/prerelease with packaged runtime acceptance pending; this audit does not upgrade that state. No GUI/server execution, Cargo, Linux checks, product/source changes, Git mutation, or network activity occurred. Only the requested local review/audit artifacts were written.