93 lines
5.9 KiB
Markdown
93 lines
5.9 KiB
Markdown
# Package46 artifact precheck — 2026-10-01
|
|
|
|
Result: no material artifact-integrity or metadata finding in this bounded
|
|
read-only review. This reviewer authored the preparation helper and therefore
|
|
is not the sole independent final reviewer. Parent executed packaging; reviewer
|
|
did not run preparation, packaging, extraction, applications, Cargo, Gitea or
|
|
any archived code. Native/extracted-runtime acceptance remains separate.
|
|
|
|
## Exact artifact and identities
|
|
|
|
Archive: `ArcadiaStudio-0.2.0-preview.save-diagnostics.20261001-x86_64-pc-windows-gnullvm.zip`
|
|
|
|
- Bytes: 34,191,561.
|
|
- SHA256: `8b4e353e075f22350a07794ee47a02cf85725501223299cf367134aa1f5b63b7`.
|
|
- Stage/archive: 565 files; checksum manifest: 564 entries plus itself.
|
|
- Desktop SHA256: `e9cce9355525ecdc59bfae12608b1e0272167acef5a86b25368ef547e08886ff`.
|
|
- Server SHA256: `6cebacc117e46fdab023c6402a5cebd6929fb55993ae8ff6b89cd1c6c1170237`.
|
|
- Runtime SHA256: `f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4`.
|
|
- `package.json` SHA256: `96b3e6c3783ecc1c9ab75a45410f27df2966b3a4bb9790c451835aa857c22b21`.
|
|
- `dependency-notices.json` SHA256: `f7049361b62fcafc8bc63ed1bffc030cf9067dd37f386d238b81db86b4a72163`.
|
|
- Full LLVM-MinGW distribution license SHA256: `8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee`, matching installed distribution bytes.
|
|
|
|
Metadata preserves desktop source
|
|
`0e83157e09d52e6152df91208e41693b62da2d46`, server source
|
|
`715036e132677dd2bc2fb37ed316d93dc9987aec`, and documentation checkpoint
|
|
`ef28f1784efe6717b0ca72c0eb3c97bc30ebfe47` separately. The packaged build
|
|
evidence structurally equals the complete prepared JSON, including deeply
|
|
nested recovered assertions; no PowerShell JSON depth truncation was found.
|
|
Historical path availability remains false while portable recovered originals
|
|
are identified separately. Original donor claims were not rewritten.
|
|
|
|
The donor server used LLVM-MinGW 20260908 and historically recorded runtime
|
|
`aa282fa47bb2c4e210cea5e470cdbdca58568f0be0bc73e404d86ab9cd95ef6a`
|
|
(190,464 bytes). This package selects the independently frozen 20260826 runtime
|
|
`f456…` (190,976 bytes). The metadata distinguishes them; recovered original
|
|
build evidence does not establish fresh runtime compatibility.
|
|
|
|
## Checks actually performed
|
|
|
|
Used bundled Python
|
|
`C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe`
|
|
with read-only inline scripts, plus the repository's read-only documentation
|
|
helper. Commands and assertions executed in the review tool transcript:
|
|
|
|
1. `Get-Content .local/extract-package46.py` and relevant packaging/helper source.
|
|
The parent extraction helper checks checksum filename/hash, exact manifest
|
|
coverage, exact stage/archive sets, case-insensitive duplicate ZIP paths,
|
|
traversal/absolute paths, symlinks, all member hashes/CRC, empty extraction
|
|
destination, and post-extraction equality. No finding for these controlled
|
|
inputs. This reviewer did not execute it or claim its extraction result.
|
|
2. Inline Python independently hashed stage files and ZIP bytes; parsed every
|
|
checksum line; checked exact 565-member set, safe unique relative paths,
|
|
symlink/directory exclusion, all uncompressed member hashes and `testzip()`.
|
|
ZIP checksum sidecar matched the archive name and bytes exactly.
|
|
3. Inline Python compared all 559 `package.json` input hashes to stage bytes and
|
|
complete packaged build evidence to `.local/package46/build-evidence.json`.
|
|
4. Inline Python verified all 524 source-file hashes across four local packages,
|
|
Cargo.lock and recorded shared build inputs, and all 489 notice references
|
|
across 268 packages, two embedded fonts, Rust notices and runtime notices.
|
|
Inventory records 58 Rust target-library identities. This review verified
|
|
the notice files, not another compiler/sysroot build or registry resolution.
|
|
5. `python scripts/package-artifacts.py docs --repository C:/ar-save-01a0d717 --platform windows`
|
|
captured through `subprocess.check_output`, then checked all 66 resulting
|
|
documentation input bytes against package input hashes.
|
|
6. `python scripts/package-artifacts.py check-docs --stage .local/package46/dist/ArcadiaStudio-0.2.0-preview.save-diagnostics.20261001-x86_64-pc-windows-gnullvm`
|
|
returned `checked_local_document_links: 18`.
|
|
7. `git diff --stat 0e83157e09d52e6152df91208e41693b62da2d46 HEAD -- build`
|
|
and the same comparison from `715036e132677dd2bc2fb37ed316d93dc9987aec`
|
|
produced no changes. These supplement the preparation helper's recorded
|
|
unchanged-input comparisons without proving reproducible compilation.
|
|
8. Independently parsed PE32+ headers, sections, import descriptors and delay
|
|
import data directories from all three frozen binaries using `struct`.
|
|
Ordinary unique imports: desktop 27, server 15, runtime 11. All delay-import
|
|
directory RVAs and sizes were zero. The only ordinary non-system import was
|
|
bundled `libunwind.dll`; its own ordinary imports were Windows components.
|
|
|
|
An initial notice-check inline script assumed every package's source hashes
|
|
had a local repository path and stopped with TypeError on a registry package's
|
|
null `local_path`. Corrected review checks repository source hashes only when
|
|
`local_path` is present, and checks all notice references for all packages.
|
|
The corrected invocation passed; this was a reviewer-script assumption, not
|
|
a package defect. No inputs were modified by either invocation.
|
|
|
|
## Scope and remaining gates
|
|
|
|
Package metadata accurately limits itself to packaging/input integrity and
|
|
explicitly separates old build/native evidence from new acceptance. No summed
|
|
full-suite totals, peer integration, platform expansion, or complete OA/SA
|
|
claim was introduced. Dynamic DLL loading and graphics/runtime behavior cannot
|
|
be established from import tables. Parent still owns extracted desktop/server
|
|
smoke, model/source oracles, final independent claims review and publication.
|
|
This report adds no GUI, clean-machine, graceful-shutdown, or new-build claim.
|