ARCADIA-Studio/harness/experiments/ordinary-source8-20260925/LAUNCHER-REVIEW.md

Ordinary source8 launchers: pre-execution review

Read-only review; no launcher, compiler or application executed. Reviewed gate recorder SHA256 6e56f7429b6ac376f4ef83e724398a00000d092d7c72a6748f328f3845e7ad6e and CLI recorder SHA256 3013da90a1d9c958c8c025718d7dfc4a8de358be74f10329dd78b4de245adf8e. Paths are .local/run-ordinary-source8-{gate,cli}-20260925.py. Gate source is deliberately pending and cannot yet authorize a run.

Finding requiring correction

CLI recorder verifies selected build receipt fields and actual binary size/hash, but does not verify that receipt's raw input manifest/log hashes or recheck current declared input bytes. Tracked-clean Git status alone does not establish raw equality because Git can normalize line endings. Recheck the bound manifest and each declared raw input before and after the CLI commands; verify build log hash and carry the build receipt/manifest identity into the CLI receipt. Record relevant runtime environment and enforce absent ARCADIA_CODEC_LIFECYCLE_PHASE and RUST_MIN_STACK, consistent with the gate recorder. This is a provenance gap, not evidence that the current binary or source differs. Sent directly to parent before execution.

Checked semantics

• Gate integration mapping matches the seven selected targets/filters in VERIFICATION-PLAN. The source7 single test is exact; checked-save selects its three-name prefix. Listing must be nonzero/unique; suite outcomes must exactly match same-source listing, identical input-manifest hash and identical actual executable record. Every selected integration outcome must pass, with one complete all-pass summary. Failed compiler/test process exit remains failure even if a partial transcript looks successful.
• Source inputs are compared byte-for-byte against immutable Git blobs before Cargo, then hashed afterward. Source/head and launcher changes produce nonzero exit. Artifact bytes come from actual Cargo Running paths, not a guessed filename. CLI build uses actual Cargo JSON compiler-artifact, selects target arcadia and requires exactly one executable under the configured target directory. Review the raw target metadata during final readback; this is not a blanket workspace-artifact claim.
• CLI commands match actual arguments() and main.rs: check ENTRY --json and rename-alias ENTRY team rescue_team --json. Neither selects --write; main returns Prepared::into_report(). Process exit and empty stderr are checked separately from report exit.
• The three complete CRLF/Unicode/explicit-ID input literals match the independent plan. Report common fields, exact two ordered changed paths, complete before/after texts, zero stabilization and no migration are checked. Declaration and reference edits preserve quoted/comment @team. Diff checks only require the expected changed lines; that is intentionally weaker than a complete diff oracle, while complete candidate-file equality is decisive. unified_diff() prefixes the original CRLF lines, so substring checks against Python splitlines' content are valid.
• Each operation checks full original bytes, file hash inventory and complete directory-entry inventory after execution. Captures reside outside the fixture. No reported change to entry is allowed. Final executable and launcher hashes/head are also checked. New fixture and capture paths refuse overwrite.
• Whole Project equality is explicitly delegated to the separate public-API fixture test; JSON contains no Project. This separation is honest and must remain in final evidence.

Malformed JSON shape or timeout can terminate this simple recorder before producing a normal receipt; such a termination is failure/incomplete evidence, never a pass. The gate recorder's ordinary list/focused/full modes record rather than reconcile their expected counts; final readback must still perform prior-name/outcome and exact-filter reconciliation. It records incremental/environment values but does not itself enforce all of them; parent must use and verify the established gate environment.

Disposition: command/report/inventory semantics are suitable; complete the narrow CLI provenance correction and pin the reviewed candidate before execution. No runtime acceptance, platform expansion or publication is established by this review.

Corrected recorder readback

Read the revised CLI recorder in full, SHA256 308fdd08011a57ccdf896868c6abd34d2e5c7637a95bfe0d8fccb456439dbd5d. Gate recorder remains exactly 6e56f7429b6ac376f4ef83e724398a00000d092d7c72a6748f328f3845e7ad6e, still pending source pin. The concrete provenance finding is resolved: build manifest/log hashes and manifest source are verified; each declared path must resolve within source root and match exact size/hash before both operations and after each; runtime environment equals the build record with stack/lifecycle overrides expressly absent; binary hashes are rechecked around each invocation; receipts include environment, manifest pin and changed-input list. Missing input files and nonobject JSON reports/change rows now produce refusal rather than accidental success. Existing byte/report expectations are unchanged.

Final pre-execution disposition: suitable to pin and run under parent control. Any assertion/timeout/unhandled malformed-value termination still means incomplete/failed evidence, not a normal passing receipt. No launchers were executed by this review.

Source pin and integration-name correction

Parent's initial captured gate recorder is 6e2fad2fff3066861a42f85ab6c3ada8b4c8954075fb402e555c5f686dae840b: pins initial source33b86a4 and permits underscores in receipt names, required for the reviewed integration-target stems. Final current recorder 59104b1acd39b3981b7339e585af9bd7f9cb87865ee82ffb763f0e7ce527713c pins repaired source520e50ce62f067dff69f03760c8b12929df9b920. This review's prepared read-only inspect_runtime.py requires the final recorder hash and separately preserves the initial recorder/failure. The CLI recorder pin remains308fdd08…. Checker is prepared and AST-parsed only, not executed; it awaits all final library/integration/build/CLI receipts. It requires all 292 old names to pass, six new passes, exact listing/artifact/source/environment concordance, baseline-identical format bytes, all seven selected integration suites and actual two CLI commands with complete literal bytes and independent on-disk readback. It introduces no inherited failure-body normalization exception: final full outcomes must have no failures.

After the four-test reconciliation, reviewed final gate recorder hash is ba5b84b6eae0e5c24dc2eb52b4cc20b5ba648261b36fd72edddd5b2fbf791765, pinning0c07f53ab517626f536f79dbaa2885a587bf1db7. Parent changed only that source pin from the520 recorder. Checker pin now matches it and explicitly preserves520focused/list/full records, in addition to33focused failure. Exact two-name mapping is recorded in TEST-REVIEW and enforced in the checker; no arbitrary rename/exclusion is admitted. Checker still has not been executed.

Final migration-only successor7b06b8ea1b7ef902ee0b3d0ec2971a9a7a1f1acd uses recorder c0126c93f371c6f8f2b38daace73d06e1cac741021faeff10f18d34628eca6c8, again only a source-pin change. Reconciliation checks its migration pair/Clippy/fmt separately from reused0c07 evidence; exact two-file Git delta and sole declared-input change are enforced. Read-only checker was subsequently executed; its narrow encoding defect, actual refusal and successful correction are in CHECKER-NOTE. This paragraph supersedes the earlier unrun status, without changing historical launcher-review facts.