ARCADIA-Studio/harness/reviews/prerelease37-human-kits-20260924.md

Prerelease 37 human companion kits: bounded static review

Independent review on 2026-09-24 through read-only Gitea MCP at the exact commits below. Scope: missing fixture files, relative include closure, README target names and model expectations, and provenance consistency. No blocking finding was confirmed in that scope. This is preparation review, not acceptance of any application behavior.

Allocation and Process kit

• Commit: 340a5c56b0783e22d7336a07ce96ddb7c2b79b0d
• Directory: harness/prerelease37-human-checks-20260924
• Archive: test-models.zip, 17,190 bytes
• Archive SHA-256: 17327e563af333fd9913f6d8b8a7e6ad0e095cea33393a5cad7a8b3397ffb185, matching the published checksum file
• README Git blob: 397bec67495ebacaae680ed6313578de6e958fbb

The ZIP has 28 unique members: README, provenance, 16 Allocation model files and 10 Process model files. Model membership exactly matches the provenance inventories. Every model file's byte length and SHA-256 matches its individual pin. The ZIP's parsed provenance equals the separately published provenance. Each project.arcadia reaches all files in its own model directory through relative includes; no missing include or unreachable model file was found. The archive was inspected in memory without extraction or execution.

README project/view/card names match the declarations: Allocation group native; 01 OA assign, 02 SA assign, 03 OA arrange, 04 SA arrange; X - receive, Y - assess, C - destination, P - team, U - contained work, V - independent work, A - origin team and B - other team. SA Y has the named input-port record needed for the typed-set refusal exercise. Initial responsibility records assign X to A, Y to B and U to P; V is independent. Those records support the distinction between reassignment and presentation-only Arrange in the instructions.

The Process folder declares Process group native and 01 OA group order, with Card A/B/C and Downstream U/V. Original steps are [A,U,B,V,C]; the stated group result [B,U,A,V,C] preserves downstream positions and A/C source order. Dragging C alone after B would leave that column unchanged, so the README's instruction to verify A moved is a useful discriminator. The README explicitly treats physical Shift and SA reopen as new human checks and records context-menu fallback separately, without converting fallback success into Shift acceptance.

Provenance attributes the fixtures to source 495464e84b5bae8ddad93e9fc69ef353e7f1c884 and b743a10d51032dc1655b94fed5e49fbbbcee83f4, with original archive hashes and member prefixes. This review verified the supplied file pins; it did not download/reverify the two large original native archives.

State and Traceability kit

• Commit: 1cd6e7d970f37e428165efaaf6900737ce03f636
• Directory: harness/prerelease-human-checks-20260924
• README Git blob: e9b1d06087eff74da6f5261f5d62c7a54a9ccd0f
• Provenance Git blob: 52baf34891378261ebc14fbe8c5945c973ccd1d3

All nine fixture files were retrieved at the exact kit commit. Every byte length and SHA-256 matches provenance. A second MCP read at each recorded original evidence commit/path confirmed identical base64 content and Git blob identity for all nine copies: State source/evidence b8685416f56e53e30bd11ecf93a54cea10ac8458; Traceability evidence 35b11eea34b1c7d0f3889648e5c01899e015ee70, attributed to production source 17f1f89fef4a6bf520f4b09a2116548b967d030e.

state/native-fixture.arcadia is self-contained. It declares 03 Readiness — edit attachments, 04 Readiness — untouched reference, and Activate: Ready → Active as instructed. View03 initially has one authored waypoint for Activate plus its endpoint attachments; view04 has an empty routes collection and distinct placements. The README distinguishes square authored bends, round endpoint handles, attachment adjustment and semantic reconnect. No missing model or wrong target was found in these steps.

traceability/traceability-trial.arcadia has a complete seven-file include closure. View01 places OA send, OA receive and SA send; existing Send refinement connects the two placed send subjects, while Receive refinement targets the initially unplaced SA receive. Thus the stated initial three-card/one-correspondence expectation and four-card/two-correspondence expectation after placing SA receive match the source structure. View02 independently places all four subjects. Entry, view, relation and counterpart names agree with the README.

The copy-before-edit and Save As guidance correctly notes that changing only an entry filename does not isolate shared includes. Scope limitations distinguish prior State attachment evidence from pending picker/focused-input acceptance and exclude broad UI/accessibility/platform acceptance.

Method and limits

No Git fetch, compilation, GUI operation, model execution, archived helper execution or Gitea write occurred. A small local helper decoded MCP-returned base64, inspected ZIP members, compared hashes and scanned literal includes. The first attempt exceeded Windows command-line length; a subsequent helper run exposed its own escaped-regex/output-encoding errors. Those local helper errors were corrected, and the successful final checks reported complete closures and matching byte pins. They are not kit defects. Local scratch input/helper files contain only retrieved public project data and no credentials.

The review did not validate the numerical warning counts by running the model compiler, verify GUI labels against a newly built executable, or execute the human workflows. Passing source inventory checks does not establish loadability or feature correctness on the eventual prerelease binary. The final packaged application must open the fixtures and undergo the stated human checks.

State and Traceability ZIP transport follow-up

• Published transport commit: 3005fccf23ab0433cbba6f76a0ad5d1ceca7fce4
• Archive: harness/prerelease-human-checks-20260924.zip, 9,691 bytes
• SHA-256: 6fda3606b4fe811906a60fbb8a3ba594f826d285dc2b4fc136ddccb64660d994
• Git blob: 9da4e87f6c3507a326a58541a623cd1772b4613e
• Manifest: harness/prerelease-human-checks-20260924-archive.json, Git blob 71a20d5b2062785fcacc17066e5374d281c7a072
• Compared source kit: 1cd6e7d970f37e428165efaaf6900737ce03f636, harness/prerelease-human-checks-20260924

Read-only MCP retrieval and in-memory decoding confirmed the archive's actual byte length, SHA-256 and recomputed Git blob identity above. Its 12 unique, safe member names exactly match the source kit, under the single prerelease-human-checks-20260924/ prefix: .gitattributes, README.md, provenance.json, state/native-fixture.arcadia, and the eight Traceability files listed below. Every member is byte-for-byte identical to its raw source-kit counterpart, including the nine previously reviewed model files; no member is missing, extra or reencoded.

The eight Traceability members, relative to traceability/, are traceability-trial.arcadia, traceability.arcadia, oa/activities/activity_oa_receive.arcadia, oa/activities/activity_oa_send.arcadia, sa/functions/function_sa_receive.arcadia, sa/functions/function_sa_send.arcadia, views/diagram_trace_view_100.arcadia, and views/diagram_trace_view_200.arcadia.

The sibling manifest identifies the same source commit. Its archive size/hash, exact member inventory, and all 12 individual size/hash pins match the downloaded ZIP. An initial supplemental manifest-check helper incorrectly duplicated the already-present root prefix; correcting that local path assumption produced a passing check. This was a helper error, not an archive defect.

The prior nine-file provenance, include-closure and README conclusions therefore apply unchanged to this transport. No blocking transport finding was found. This follow-up did not extract or execute archive content, repeat GUI/compiler checks, fetch Git objects, download original large evidence archives or write to Gitea. It establishes faithful delivery of the reviewed companion kit, not runtime or combined prerelease acceptance. Only this local review was appended; the previously published review at 0f5f8fb7 was not edited.