ARCADIA-Studio/harness/experiments/save-diagnostics-package-20261001/raw/artifact-precheck.md

Package46 artifact precheck — 2026-10-01

Result: no material artifact-integrity or metadata finding in this bounded read-only review. This reviewer authored the preparation helper and therefore is not the sole independent final reviewer. Parent executed packaging; reviewer did not run preparation, packaging, extraction, applications, Cargo, Gitea or any archived code. Native/extracted-runtime acceptance remains separate.

Exact artifact and identities

Archive: ArcadiaStudio-0.2.0-preview.save-diagnostics.20261001-x86_64-pc-windows-gnullvm.zip

• Bytes: 34,191,561.
• SHA256: 8b4e353e075f22350a07794ee47a02cf85725501223299cf367134aa1f5b63b7.
• Stage/archive: 565 files; checksum manifest: 564 entries plus itself.
• Desktop SHA256: e9cce9355525ecdc59bfae12608b1e0272167acef5a86b25368ef547e08886ff.
• Server SHA256: 6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237.
• Runtime SHA256: f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4.
• package.json SHA256: 96b3e6c3783ecc1c9ab75a45410f27df2966b3a4bb9790c451835aa857c22b21.
• dependency-notices.json SHA256: f7049361b62fcafc8bc63ed1bffc030cf9067dd37f386d238b81db86b4a72163.
• Full LLVM-MinGW distribution license SHA256: 8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee, matching installed distribution bytes.

Metadata preserves desktop source 0e83157e09d52e6152df91208e41693b62da2d46, server source 715036e132677dd2bc2fb37ed316d93dc9987aec, and documentation checkpoint ef28f1784efe6717b0ca72c0eb3c97bc30ebfe47 separately. The packaged build evidence structurally equals the complete prepared JSON, including deeply nested recovered assertions; no PowerShell JSON depth truncation was found. Historical path availability remains false while portable recovered originals are identified separately. Original donor claims were not rewritten.

The donor server used LLVM-MinGW 20260908 and historically recorded runtime aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a (190,464 bytes). This package selects the independently frozen 20260826 runtime f456… (190,976 bytes). The metadata distinguishes them; recovered original build evidence does not establish fresh runtime compatibility.

Checks actually performed

Used bundled Python C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe with read-only inline scripts, plus the repository's read-only documentation helper. Commands and assertions executed in the review tool transcript:

1. Get-Content .local/extract-package46.py and relevant packaging/helper source. The parent extraction helper checks checksum filename/hash, exact manifest coverage, exact stage/archive sets, case-insensitive duplicate ZIP paths, traversal/absolute paths, symlinks, all member hashes/CRC, empty extraction destination, and post-extraction equality. No finding for these controlled inputs. This reviewer did not execute it or claim its extraction result.
2. Inline Python independently hashed stage files and ZIP bytes; parsed every checksum line; checked exact 565-member set, safe unique relative paths, symlink/directory exclusion, all uncompressed member hashes and testzip(). ZIP checksum sidecar matched the archive name and bytes exactly.
3. Inline Python compared all 559 package.json input hashes to stage bytes and complete packaged build evidence to .local/package46/build-evidence.json.
4. Inline Python verified all 524 source-file hashes across four local packages, Cargo.lock and recorded shared build inputs, and all 489 notice references across 268 packages, two embedded fonts, Rust notices and runtime notices. Inventory records 58 Rust target-library identities. This review verified the notice files, not another compiler/sysroot build or registry resolution.
5. python scripts/package-artifacts.py docs --repository C:/ar-save-01a0d717 --platform windows captured through subprocess.check_output, then checked all 66 resulting documentation input bytes against package input hashes.
6. python scripts/package-artifacts.py check-docs --stage .local/package46/dist/ArcadiaStudio-0.2.0-preview.save-diagnostics.20261001-x86_64-pc-windows-gnullvm returned checked_local_document_links: 18.
7. git diff --stat 0e83157e09d52e6152df91208e41693b62da2d46 HEAD -- build and the same comparison from 715036e132677dd2bc2fb37ed316d93dc9987aec produced no changes. These supplement the preparation helper's recorded unchanged-input comparisons without proving reproducible compilation.
8. Independently parsed PE32+ headers, sections, import descriptors and delay import data directories from all three frozen binaries using struct. Ordinary unique imports: desktop 27, server 15, runtime 11. All delay-import directory RVAs and sizes were zero. The only ordinary non-system import was bundled libunwind.dll; its own ordinary imports were Windows components.

An initial notice-check inline script assumed every package's source hashes had a local repository path and stopped with TypeError on a registry package's null local_path. Corrected review checks repository source hashes only when local_path is present, and checks all notice references for all packages. The corrected invocation passed; this was a reviewer-script assumption, not a package defect. No inputs were modified by either invocation.

Scope and remaining gates

Package metadata accurately limits itself to packaging/input integrity and explicitly separates old build/native evidence from new acceptance. No summed full-suite totals, peer integration, platform expansion, or complete OA/SA claim was introduced. Dynamic DLL loading and graphics/runtime behavior cannot be established from import tables. Parent still owns extracted desktop/server smoke, model/source oracles, final independent claims review and publication. This report adds no GUI, clean-machine, graceful-shutdown, or new-build claim.