6.0 KiB
Private actual-output acceptance — Windows evidence
Final source edf096cd33, branch
codex/analysis-mixed-acceptance-956atf-20260925, extends baseline
29417130c71f70c4eaefe8ed4c879efba78eb72c. Source and this packet remain
local-only: Gitea rejected Git publication for exhausted server storage and
subsequently rejected the checkpoint comment. No peer-accessible commit link is
claimed. The published Windows preview and its artifacts are unchanged; Linux
remains user-deferred.
The selected contract connects real emitted PendingRename ownership to both parser producer modes, actual complete resolution/admission and full Project equality. AcceptedRename owns the actual bundle, actual resolved model, mapped warnings, inherited policy and final O+W inventory. Equality reserves the actual parsed expression count; warning storage is counted once, and destination checks precede temporary-owner destruction. There is no borrowed desired model in the accepted result.
Observed gates
Windows Rust/Cargo 1.98.1 with LLVM-MinGW 20260908 gnullvm; one compiler job, incremental disabled, locked/offline commands. All final gates bind 559 unchanged declared inputs, clean source before/after and one captured launcher.
| Gate | Result |
|---|---|
| New acceptance tests | 11 passed, 281 filtered |
| Complete core library | 292 names: 276 passed, 16 inherited failures |
| Core all-target strict Clippy | Passed |
| Workspace format | Inherited exit 1; raw output byte-identical |
| Regression readback | All 281 prior outcomes and 16 failure bodies unchanged, normalizing numeric thread identifiers only |
The final executable is 43,066,880 bytes, SHA256
7bc17993f265bdf7dc79b7ea5191401dd853f1dd47517235663113e4571031bb.
Input-manifest SHA256 is
6be8ae8911bb3d0aee346b137930d2b27a7d0ed4e77c4c9502b60d07982bd028.
The executable is identified in the receipts, not embedded in this archive.
Full core and format are not all-green gates: public schema8 dispatch remains
unavailable, and the known failures remain obligations for later integration.
Actual tests establish the independently specified unchanged-profile boundaries: 152 bytes accepts the minimal complete rename and 151 refuses during output UUID decoding; 161 accepts the unnamed warning and 160 refuses its mapping at the full header span. Whole returned models/bytes, exact warning records, all policy fields, separate verification work, source/desired lifetime independence, admissible wrong output, malformed/model-invalid output, actual expression-bound provenance and signed-zero semantic equality are checked. Rich OA/SA Unicode/CRLF swaps and a four-file untouched-file case retain both real architecture warnings.
Initial source 4872141c036c16825f1c098bd7cf44709897e814 compiled but its focused
run had nine passes and two failed empty-warning assumptions. The repair changes
only new tests and the implementation note; production is byte-identical.
The independent correction derives both ordered warnings,
locations and final storage from source and authored literals. Initial logs,
artifact identity and review omissions are preserved rather than replaced.
Stack and evaluator scope
All ten exact inherited stack controls pass. The new scoped test performs actual verification and result destruction in five 128 KiB workers: deep/wide success, deep/wide mismatch and the genuine 151-byte late refusal. Prerequisites are built outside these workers. Deep name mismatch can short-circuit; deep success performs the expression comparison. Older separately unrerun full-pipeline setup limits remain distinct.
Stack observations bind raw initial/final prologues. The 17 selected old stack/active reservations are unchanged. New verification reserves 8,648 bytes in its prologue; the carried parser wrapper changes from 536 to 568. Parsing, resolution, equality and destination checks have distinct phases; these observations are not a whole-stack or headroom bound.
The first strict readback refused a raw CARGO_TARGET_DIR slash-spelling difference. The checker note preserves that refusal and original checker. The amended checker accepts only the exact recorded old/new spellings after both resolve to the same explicit workspace target. Every other environment field is exact; failure comparison and source/artifact checks are unchanged. Both raw environments are retained in the readback.
Evidence and reproduction
evidence.zip: 529,018 bytes, 67 members, SHA256
2f5e0c5257eba11908b60e02b76d529fcd53f11edd057c859d3cb1b34f41d7c4.
manifest.json pins every member. The archive includes initial
and final receipts/logs/manifests, captured launchers, actual Git diffs, baseline
records, both checker versions, selected prologues, contract/oracles and raw review
mirrors. Read the source, test and
runtime reviews with their exact source/hash bindings.
The separate package audit checks every member against
originals and Git blobs without executing archived code.
From the identified source on the documented Windows toolchain, use one compiler job and incremental disabled:
cargo test --locked --offline -p oa-core --lib acceptance -- --test-threads=1
cargo test --locked --offline -p oa-core --lib -- --test-threads=1
cargo test --locked --offline -p oa-core --lib -- --list
cargo clippy --locked --offline -p oa-core --all-targets -- -D warnings
cargo fmt --all -- --check
Private acceptance grants no public source8, installation/history, repeated carried editing or GUI integration. Independently bounded parser scratch, numeric/decoder internals, model/validator allocation, allocator overhead and native stack retain their explicit separate domains. In particular, source/file bounds do not tightly bound copied traversal-path bytes. No universal memory or before-every-allocation guarantee follows from this evidence.