5.3 KiB
S2c admission independent review and narrow r2 correction
2026-09-13, /root/source8_lowering_plan. Reviewed .local/admit-analysis-s2c-gate.py and its handoff against committed f1d79df4979121335ed7b4ce4da84b2fca8a9ef4 and the original admitted a2 listing. No compiler/test/native/Gitea operation occurred; no active runner or source checkout was modified.
Finding and authorized correction
The original helper, SHA256 0202540eec8870f1fd0a03ad39d55653c18c9bb3c533e491d67234e040c42833, relies on assert for acceptance checks. Optimized Python removes these checks. The documented -B does not prevent -O, -OO, or inherited PYTHONOPTIMIZE from enabling optimization. In that mode failed case/count/source/hash guards can disappear while the final admission writer remains. This is an actionable false-positive acceptance risk, not evidence that any historical gate ran optimized.
Parent authorized a new r2 copy only. .local/admit-analysis-s2c-gate-r2.py adds, immediately after imports and before paths/evidence handling:
if not __debug__:
raise RuntimeError('S2c admission requires Python assertions; optimized Python is refused.')
The guard itself is not an assert. Original helper bytes remain unchanged. Revised helper is 10010 bytes, SHA256 d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1. No other admission rule was changed. New admissions must use r2 consistently for listing and focused helper-hash linkage.
One specifically authorized non-mutating invocation actually ran:
C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe -B -O .local/admit-analysis-s2c-gate-r2.py
It exited 1, at line16, with the exact RuntimeError above. It received no gate name and failed before argument parsing, BASE/ROOT setup, Git/evidence access or output creation. No normal-mode admission/helper execution, Cargo or Rust test occurred. This validates optimization refusal only; S2c runtime tests remain unrun.
Independently checked membership and binding
Read-only Git enumeration at f1 produced 534 files in the helper's exact scopes. The a2-to-f1 source diff adds the three writer files; the oracle is a 100% rename, with no net input count change. The versioned guidance changes are outside harness/fixtures, so they do not add scoped gate inputs.
The actual a2 record contains 142 listing names, including 34 typed cases. Extracting the actual ten #[test] functions from committed writer/tests.rs gives exactly the helper's NEW_NAMES. Their union contains 152 unique names, 44 matching language::analysis_source and 1 matching language::raw_tokens. Thus 108/151 filtered counts are correct expectations; they are not an executed f1 listing.
Direct hashes of the original a2 result, inputs, log, admission and S2b helper match every hardcoded baseline pin. Original a2 results and historical failures are not rewritten or reclassified.
With assertions enabled, the reviewed helper requires an exact source and closed integer-exit0 receipt, exact command, unique raw/recorded listing agreement, complete expected membership, exact focused ordered outcomes and summary, zero ignored/failed/measured cases, and the same admitted current executable identity. Full and unrelated commands are rejected. It compares every scoped committed blob with working-tree and manifest bytes and performs final watched readback. Existing admissions use exclusive creation. Typed mode explicitly includes all ten writer cases; raw-token mode cannot masquerade as running them. No further actionable finding arose within this bounded listing/focused admission contract.
This remains local evidence verification using the trusted runner receipts/Git environment, not proof against a party fabricating all raw evidence or changing Git resolution. Compiler/profile/full-suite/public8/native claims remain outside the helper's scope. Actual new listing and focused execution must exist before normal admission is attempted.
Active runner assertion-risk inspection
A read-only process snapshot observed PID7504 running run-navigation-service-gate.py ... core-full-44095f7 core-full and PID7872 running navigation-palette-native-session-command-r2.py launch ...; both command lines use -B and no -O or -OO. The current tool process's PYTHONOPTIMIZE and User/Machine environment settings were all unset. This does not read or prove the already running Python processes' inherited environments; parent separately reports launching without -O.
run-navigation-service-gate.py, run-navigation-palette-gate.py and run-analysis-source-gate.py use asserts for admission/preflight checks without an optimization guard. Their actual subprocess return codes and final changed-input/head exit logic are ordinary executable code, but optimized execution could skip preflight source/freshness checks. Historical/assert-based admission helpers have the same general risk. Do not mutate active runners; for future launches use a reviewed new guarded copy or verify/record disabled optimization. Existing raw receipts may be independently audited without assuming that this risk occurred.
The active native runner uses an explicit require function rather than assert for its acceptance checks, so this specific optimization-elision finding does not apply to that script. No native process was controlled or altered by this review.