ARCADIA-Studio/harness/release-contextual-source-prerelease-review-20260911.md

Independent Windows contextual prerelease review — 2026-09-11

Reviewer: Codex-9e8r6t /root/behavior_audit. Artifact and packaged-server gates PASS; no material finding remains in this review's scope. Root separately owns native GUI acceptance and publication. No GUI, Cargo/compiler, Linux, production or Git/index operation was performed by this reviewer.

Frozen package and actual gates

Version 0.2.0-preview.contextual.20260911, target x86_64-pc-windows-gnullvm. Producer input:

.local/contextual-prerelease-20260911/packages/ArcadiaStudio-0.2.0-preview.contextual.20260911-x86_64-pc-windows-gnullvm.zip

Independent extraction:

.local/contextual-prerelease-review-20260911/extracted/ArcadiaStudio-0.2.0-preview.contextual.20260911-x86_64-pc-windows-gnullvm

Exact artifact	Bytes	SHA256
ZIP	32775691	9186d4fc9a7b52fb195c183c4847c8e3419ea6da8b3f907e0c06f9ceec58dee0
arcadia-studio.exe	112239104	5657bab5c841939b66f901efe6c0ffb2d7cbbe8cc5f111a0ca3de8073d3846ce
arcadia-server.exe	39743488	efeeb89c0d2e0f93df4472cb3e9f48b2b722a37ae1043c90a5a56f2e845fe665
libunwind.dll	190976	f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4

The first independent artifact invocation exited 0, PASS, at 16:20:00–16:21:22 UTC, with 5,231 assertions including per-file checks. The first server invocation exited 0, PASS, at 16:21:55–16:22:12 UTC, with 1,800 assertions including full package readbacks. Counts below were measured in this extraction, not inherited from the prior authoring package.

All 559 ZIP members are safe ordinary files beneath one root, with unique case-folded names, fixed timestamps, no encryption and valid CRCs. All extracted bytes and the complete file set equal the ZIP. SHA256SUMS.txt covers precisely the other 558 files. The 553 input hashes match; exactly six additional generated metadata/instruction/checksum files remain. PE headers and exact executable/runtime hashes match the designated inputs.

Directory payloads are exactly deployment, docs, examples and licenses. Every shipped public source document/example/deployment file and LICENSE matches the isolated source; the packaged README matches scripts/package-readme.md. No harness, user profile, server store, credential directory or source checkout was included. Cargo package identifiers and development-binary provenance may contain build paths; this is not a universal secret scan of binary strings.

Source reconstruction and distinct binary histories

All 238 unique GUI5657 input hashes match both reconstructed Git blobs and the isolated checkout at d5650309a9. Base b2c3e54001 differs at precisely eleven newline-only inputs plus preservation attributes. Ten reproduce by uniform LF→CRLF restoration; behavior/creation.rs retains its exact mixed line endings, and uniform conversion demonstrably does not reproduce its recorded hash. Ignoring line-ending differences leaves only .gitattributes.

The eleven inputs are behavior/creation.rs, behavior/scenario/workspace.rs, behavior/topology/contextual.rs, guide.rs, six semantic_review modules (artifacts_view, attachments_view, keyed_rows, keyed_tests, keyed, ordered), all beneath crates/oa-desktop/src, and docs/openapi.json. Original input manifest SHA256: 669724858967d83ab7da5f78bfafb6065e2bcab3bad0e68d0a74feb86c7195e7. This reconstructs the current GUI's recorded inputs; it does not assert that the auxiliary commit was the original build commit.

The server is the unchanged EFEE September 7 artifact, with separate original build/hash/source records. All 120 recorded core/server files, and both complete ordinary crate file sets, match its preserved source tar, the base Git blobs and the isolated package source. Tar SHA256: cbb371a93a562e1e641d7629fe351e016d63e66fc9112499b3fed6d5cd171f78. Shared build resources and raw OpenAPI bytes match their original records.

Whole old/new Cargo manifest equality is deliberately not claimed. Parsed comparison finds 463 unchanged original lock package records, with only the local oa-cli 0.2.0 entry added; its three dependency requests already exist. Workspace resolver, dependencies and development profile are unchanged, apart from the explicit CLI workspace member. Original server lock SHA256 is a6e070ed59b0ba19f18d60e8104494b777b470bd0268ae348cbe2b229790449f; current GUI/notice lock is 2b960242c33eb839ff008d01731f6d5cdb4e047ca8cd6e13151cbf9c09913510. CLI is not included in this Studio/server ZIP.

Packaged build evidence binds both exact executables and clearly separates original histories from reconstruction. Its seven per-binary evidence references were checked against the original retained bytes. Those paths are expressly external preparation records, not nonexistent files advertised inside the ZIP. The development profile and absence of a new server/reproducible build claim are explicit. This review ran no metadata, compiler or binary rebuild.

Notice inventory

Measured 266 unique notice packages, roots exactly oa-desktop and oa-server. Their identities equal the earlier accepted desktop/server graph. Registry package features, source inventories/checksums and notices match that record; each identity/checksum occurs in the current lock. All three local crates' complete ordinary file sets/hashes and shared build inputs match the isolated source. Top-level target/ and .cargo-ok exclusions retain their documented scope.

All 484 distinct referenced notice files match their inventory hashes. Fira Sans, Iced Icons, Rust and shipped libunwind references are present. The one additional LLVM-MinGW distribution license matches the previous accepted bytes, SHA256 8d85c1057d742e597985c7d4e6320b015a9139385cff4cbae06ffc0ebe89afee. Rust/runtime inventory and provenance match the earlier record, and all 58 recorded target-library hashes were freshly checked against the retained toolchain files.

The producer's fresh locked/offline dependency-graph operation remains separately attributed. This reviewer compared the recorded registry graph/source hashes, not every registry-cache file afresh. No universal license audit, link-time coverage proof or reproducible-build claim follows from packaging.

Packaged server execution

The executable ran only from the fresh extraction. Child environment contained SystemRoot, WINDIR, PATH=C:\Windows\System32;C:\Windows, and private TEMP/TMP. No toolchain, token or proxy environment was inherited. HTTP used a proxy-free loopback client. The explicit store lived outside the package under .local/contextual-prerelease-review-20260911/server-run/data.

1. --version and --help exited successfully with empty stderr. The underlying application version is arcadia-server 0.2.0.
2. /health and /health/ready returned their exact success objects. /api/v1/openapi.json equalled every packaged OpenAPI byte.
3. One POST created Independent contextual package persistence — 救助 20260911. The full response summary, distinct fresh resource/model IDs, Location and ETag matched the prewritten contract. GET and the complete persisted envelope matched the independently predicted empty Project and one-file SourceBundle, allowing only the two generated UUIDs.
4. After acknowledged durable creation, the owned process was explicitly terminated and awaited. A second process reused the same store on a new private port. Readiness, complete GET, revision, ETag and every persisted envelope byte were unchanged. The second process was terminated and awaited. This proves process-stop/restart persistence, not graceful-drain acceptance.
5. The complete 559-file package map and original ZIP remained unchanged.

Listeners were 127.0.0.1:51373 (PID 4784) and 127.0.0.1:51382 (PID 7392). Both explicit Windows termination results were 1; the checker itself passed with exit 0. Resource 3ab1f047-86a8-435e-8519-c372ddcd87ca retained revision 1 and ETag "p-3ab1f047-86a8-435e-8519-c372ddcd87ca-r1". Durable envelope SHA256: b9763c66414711a92089fe0e44749d1eb19fe4487be3defa890b899fa11da15e.

Evidence, preparation history and limits

Private evidence root: .local/contextual-prerelease-review-20260911/. server-run/ preserves seven complete HTTP body/header records, process stdout/stderr, version/help output, the exact expected envelope and private store. The previous authoring reviewer and its evidence remain unchanged.

Independent evidence	SHA256
review.py	b2a5eb1e5b01dfacb85a2ab5b5b8516c02a84424a2fb49156d0d7df7634226bc
frozen-inputs.json	e5aadf382b62863a875c08707173dee50423e0d35bb3209642035f8936aa7af2
artifact-result.json	3a6bf2580b25dad696d635dcbbde88522a065f83698229c2a22dda92f2ab6ee8
server-result.json	37fec9e1a1bcaa8a208233fc56fb78a1e607df32271097ab1a946037f04de3af

No independent artifact or server gate failed or required a retry. Preparation readback corrected a draft metadata-field assumption before execution. One ancillary read-only inventory inspection mistook a list for a dictionary and raised AttributeError; the corrected inspection measured 14 producer evidence records. A report-writing orchestration syntax error executed no tool or filesystem action. These changed no artifact and ran no application.

The producer separately preserved its first wrapper failure: an uninitialized script-scope metadata counter stopped before Cargo, with zero metadata calls. Corrected package2 passed at 16:18:45 UTC after one successful metadata call; package2-result.json SHA256 is aaf0c838ea8335c40f7b5d20f48e6c4c2eb282aa338e0ffac350dab229ebbb91. That preparation history is distinct from these two first-pass reviewer gates.

This is a scoped Windows development-prerelease artifact/server acceptance. Root's native GUI trial remains separate. Complete OA/SA parity, newer peer features, optimized/reproducible builds and Linux acceptance are not established by this report.