45 lines
5.3 KiB
Markdown
45 lines
5.3 KiB
Markdown
# S2c admission independent review and narrow r2 correction
|
|
|
|
2026-09-13, `/root/source8_lowering_plan`. Reviewed `.local/admit-analysis-s2c-gate.py` and its handoff against committed `f1d79df4979121335ed7b4ce4da84b2fca8a9ef4` and the original admitted a2 listing. No compiler/test/native/Gitea operation occurred; no active runner or source checkout was modified.
|
|
|
|
## Finding and authorized correction
|
|
|
|
The original helper, SHA256 `0202540eec8870f1fd0a03ad39d55653c18c9bb3c533e491d67234e040c42833`, relies on assert for acceptance checks. Optimized Python removes these checks. The documented `-B` does not prevent `-O`, `-OO`, or inherited PYTHONOPTIMIZE from enabling optimization. In that mode failed case/count/source/hash guards can disappear while the final admission writer remains. This is an actionable false-positive acceptance risk, not evidence that any historical gate ran optimized.
|
|
|
|
Parent authorized a new r2 copy only. `.local/admit-analysis-s2c-gate-r2.py` adds, immediately after imports and before paths/evidence handling:
|
|
|
|
```python
|
|
if not __debug__:
|
|
raise RuntimeError('S2c admission requires Python assertions; optimized Python is refused.')
|
|
```
|
|
|
|
The guard itself is not an assert. Original helper bytes remain unchanged. Revised helper is **10010 bytes**, SHA256 **`d2bd3c38feb77b8e916b3d413a278d4b0960baff8e14843aed4c2b20c26c90e1`**. No other admission rule was changed. New admissions must use r2 consistently for listing and focused helper-hash linkage.
|
|
|
|
One specifically authorized non-mutating invocation actually ran:
|
|
|
|
```text
|
|
C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe -B -O .local/admit-analysis-s2c-gate-r2.py
|
|
```
|
|
|
|
It exited **1**, at line16, with the exact RuntimeError above. It received no gate name and failed before argument parsing, BASE/ROOT setup, Git/evidence access or output creation. No normal-mode admission/helper execution, Cargo or Rust test occurred. This validates optimization refusal only; S2c runtime tests remain unrun.
|
|
|
|
## Independently checked membership and binding
|
|
|
|
Read-only Git enumeration at f1 produced **534** files in the helper's exact scopes. The a2-to-f1 source diff adds the three writer files; the oracle is a 100% rename, with no net input count change. The versioned guidance changes are outside harness/fixtures, so they do not add scoped gate inputs.
|
|
|
|
The actual a2 record contains **142** listing names, including **34** typed cases. Extracting the actual ten `#[test]` functions from committed writer/tests.rs gives exactly the helper's NEW_NAMES. Their union contains **152 unique** names, **44** matching language::analysis_source and **1** matching language::raw_tokens. Thus 108/151 filtered counts are correct expectations; they are not an executed f1 listing.
|
|
|
|
Direct hashes of the original a2 result, inputs, log, admission and S2b helper match every hardcoded baseline pin. Original a2 results and historical failures are not rewritten or reclassified.
|
|
|
|
With assertions enabled, the reviewed helper requires an exact source and closed integer-exit0 receipt, exact command, unique raw/recorded listing agreement, complete expected membership, exact focused ordered outcomes and summary, zero ignored/failed/measured cases, and the same admitted current executable identity. Full and unrelated commands are rejected. It compares every scoped committed blob with working-tree and manifest bytes and performs final watched readback. Existing admissions use exclusive creation. Typed mode explicitly includes all ten writer cases; raw-token mode cannot masquerade as running them. No further actionable finding arose within this bounded listing/focused admission contract.
|
|
|
|
This remains local evidence verification using the trusted runner receipts/Git environment, not proof against a party fabricating all raw evidence or changing Git resolution. Compiler/profile/full-suite/public8/native claims remain outside the helper's scope. Actual new listing and focused execution must exist before normal admission is attempted.
|
|
|
|
## Active runner assertion-risk inspection
|
|
|
|
A read-only process snapshot observed PID7504 running `run-navigation-service-gate.py ... core-full-44095f7 core-full` and PID7872 running `navigation-palette-native-session-command-r2.py launch ...`; both command lines use `-B` and no `-O` or `-OO`. The current tool process's PYTHONOPTIMIZE and User/Machine environment settings were all unset. This does **not** read or prove the already running Python processes' inherited environments; parent separately reports launching without -O.
|
|
|
|
`run-navigation-service-gate.py`, `run-navigation-palette-gate.py` and `run-analysis-source-gate.py` use asserts for admission/preflight checks without an optimization guard. Their actual subprocess return codes and final changed-input/head exit logic are ordinary executable code, but optimized execution could skip preflight source/freshness checks. Historical/assert-based admission helpers have the same general risk. Do not mutate active runners; for future launches use a reviewed new guarded copy or verify/record disabled optimization. Existing raw receipts may be independently audited without assuming that this risk occurred.
|
|
|
|
The active native runner uses an explicit `require` function rather than assert for its acceptance checks, so this specific optimization-elision finding does not apply to that script. No native process was controlled or altered by this review.
|