5.7 KiB
Real mixed-syntax archive controls
Scope: independently exercise the separately reviewed receipt/Git verifier against copies of the actual emitted archive. No subject executable, compiler, GUI, archived helper or publication is run by these controls. Original package, harness copy, raw gate directory and external verifier remain read-only.
Verifier SHA256: 2902f0c5e4922b942b3e8b9d0b288810ef6ad8dc71444d28ef8bfa756c4c5338.
Initial run and preserved interruption
Driver: .local/analysis-mixed-syntax-package-controls-20260923.py; output: .local/analysis-mixed-syntax-package-negative-controls-20260923/.
The unchanged real archive was accepted. Removing a new outcome was refused for Missing/extra runtime outcomes; changing a new passing outcome was refused for Runtime status mismatch. Each closed case retains exact command, exit, monotonic duration, package/log hashes and observed result in its control-result.json.
The fourth case, changed-known-failure-cause, hit the driver's 180-second subprocess timeout during independently observed host degradation. Its package and stdout/stderr remain in place. This interruption is neither an expected semantic refusal nor acceptance. No final aggregate controls.json was emitted by the initial run.
The successor driver .local/analysis-mixed-syntax-package-controls-successor-20260923.py preserves the initial driver and changes only the per-process timeout to 900 seconds and the selected cases to the remaining thirteen (cases[3:]). The three valid initial controls are reused. It was prepared while execution was paused and was run only after parent host/build clearance.
Closed results and publication disposition
All 16 planned controls have their expected results: one unchanged archive accepted, fifteen corrupted copies refused. No further concrete blocker found for publication within the package's documented receipt/Git-consistency scope. Initial three results plus the successor thirteen are indexed, with exact receipt pins, in .local/analysis-mixed-syntax-package-controls-summary-20260923.json. The interruption remains separately preserved and is not counted as a successful control.
| Corruption | Actual refusal |
|---|---|
| Remove a new test outcome | Missing/extra runtime outcomes |
| Change a new passing outcome to FAILED | Runtime status mismatch |
| Change one inherited failure diagnostic | Failure cause changed, naming the affected cross-file reparent test |
| Forge language.rs input hashes consistently across a578 maps/receipts | Git input bytes mismatch: crates/oa-core/src/language.rs |
| Duplicate ZIP member | Duplicate ZIP members |
| Remove intermediate eeb strict gate | Required checkpoint gates missing/ambiguous |
| Change final formatting diff location | Final formatting failure scope changed |
| Change exact reversed-clock receipt bytes | Direct historical binding differs |
| Add byte-identical reversed-clock receipt under another name | Gate not closed |
| Add a filter to direct full argv | Unexpected direct executable argv |
| Substitute old listing artifact as direct before artifact | Direct artifact changed or differs from focused binary |
| Omit one direct bound-file postcheck | Direct bound-file postcheck coverage differs |
| Prepend fabricated Cargo invocation to direct stdout | Direct output contains a fabricated Cargo invocation line |
| Record direct launch/verification failure | Direct invocation did not close cleanly |
| Remove actual new direct listing | Missing bound gates/mixed-direct-list-a578-1.result.json |
The forged a578 input reached immutable Git verification before direct descriptor checks; it was not merely rejected for an out-of-date wrapper binding. The changed clock bytes were rejected by the fixed historical binding before the timestamp predicate; the independent aliased-byte control reached Gate not closed. The missing direct listing was rejected when full-run binding resolved its missing record, before the later checkpoint inventory check. These are the observed refusal points, not relabeled predictions.
After closure, independently re-read all 16 per-case receipt/file hashes and all 49 watched original files, including the local package, harness package, raw gate directory and verifier. Every hash still matches. Verified that the successor driver differs from the preserved initial driver only in the two stated changes. Per-case durations are monotonic; no cross-run wall-clock duration is inferred.
| Artifact | SHA256 |
|---|---|
| Initial driver | 421f8109d583640df9c499878dba89bf12b81054b10e17b3a5b6440a188cc411 |
| Successor driver | c68437c5aa807c305215c0bae31c7ec77e216e266a7f48972572bdc6fda518e0 |
| Successor controls.json | 87b29589b97a44527722feb385c2707c5fb3c7b1d8705568abdbbebf6add88d8 |
| Combined summary JSON | fea9d77fe491d6c281cd056e055e8917e363ff31db5e3b1cdd8f3312549aca35 |
Interpretation boundaries
Corrupted payload manifest hashes and relevant inner receipt hashes are refreshed so semantic/Git controls can reach substantive checks. The final verifier's immutable direct historical binding can reject a changed clock receipt before the timestamp predicate; that is the actual refusal expected from the changed-byte control. A separate byte-identical aliased receipt retains the original for direct bindings and tests that another name cannot inherit the clock exception.
These controls test consistency of recorded evidence with immutable Git and the reviewed protocol. They do not reproduce subject execution or establish protection against fabricated attestation. Existing source/runtime limitations, retained failed gates, separate old/new executable identities and the inherited formatter failure remain part of the package's meaning.