53 lines
2.7 KiB
Markdown
53 lines
2.7 KiB
Markdown
# Captured inputs and committed source identity
|
|
|
|
This directory preserves exact historical `committed-desktop-4.json` and
|
|
`committed-desktop-5.json` receipts plus `verify-committed-inputs.py` as data.
|
|
The original helper contains its historical absolute checkout path; do not run
|
|
it for portable verification. The receipts do not themselves pin that helper;
|
|
`files.json` pins the copies distributed here and the new verifier/README.
|
|
The local `.gitattributes` preserves those pinned bytes through Git round trips;
|
|
retain it with this directory rather than normalizing the historical text.
|
|
|
|
With Python 3.10+, Git, a repository containing both commits, and the completed
|
|
sibling checks package, run:
|
|
|
|
```text
|
|
python -B SOURCE_DIRECTORY/verify.py --repo REPOSITORY --checks CHECKS_PACKAGE_DIRECTORY
|
|
```
|
|
|
|
Before that package exists, an explicitly optional raw-input mode is available:
|
|
|
|
```text
|
|
python -B harness/experiments/multiselect-20260923/source/verify.py --repo . --raw-gates .local/group-movement-gates
|
|
```
|
|
|
|
The verifier checks source-evidence pins, captured map byte hashes, recorded gate
|
|
success/unchanged flags, counts and 71 vendored iced_widget inputs. It compares the
|
|
complete relevant Git tree inventory and every blob's size/SHA-256 at these
|
|
commits with their corresponding captured input maps:
|
|
|
|
- `desktop-4`: `12a7352ddef5f69a144ead8219a50916233d63a9`
|
|
- `desktop-5`: `f6a6010baed9e6164a1fcc7ecd58256a562827d7`
|
|
|
|
The scope matches the historical helper: Cargo manifests/lock/toolchain file,
|
|
`crates/`, `build/`, `.cargo/`, `scripts/`, `docs/`, `examples/`,
|
|
`harness/fixtures/`, and `harness/prototypes/`. This is the complete inventory
|
|
within that scope, not a whole-repository identity claim. Worktree contents,
|
|
current HEAD, line-ending checkout conversion and original machine paths do not
|
|
participate. Git objects are read by object ID; no checkout, build or archived
|
|
helper runs. Both commits must already be available; lazy object fetching is
|
|
disabled for these reads.
|
|
|
|
In package mode, outer checks-package pins and selected member/run relationships
|
|
are also checked. Run the checks package's own verifier for its full source ZIP,
|
|
logs, helpers and all other gate relationships. Raw mode reads the named local
|
|
maps/receipts directly and is not a substitute for packaged-evidence verification.
|
|
No source maps or ZIPs are duplicated in this directory.
|
|
|
|
Historical receipts report an earlier comparison. A successful run of this new
|
|
verifier performs a fresh Git-object comparison against the pinned maps. A gate's
|
|
recorded HEAD can predate its later source-identical commit; that difference is
|
|
why blob comparison is necessary. This evidence identifies tested source bytes;
|
|
it does not rerun tests or establish native usability, release integration or
|
|
full #29 acceptance.
|