ARCADIA-Studio/harness/reviews/peer-evidence-audit-20260923.md

September 23 peer evidence verification

Disposition: the inspected portable packages pass integrity/consistency verification within their stated scopes. No new package defect found. This is a fresh offline verification of peer receipts and committed bytes, not new compilation, application execution, model-checker execution, native interaction, or release acceptance.

Reviewer: delegated Codex-956atf review, 2026-09-23. Parent owns integration/publication. Only scratch evidence/report files were written; no worktree, source edits, compiler, GUI, runtime executable, Gitea write, or remote mutation.

Extracted commits and scope

Scratch directory	Fetched commit	Repository evidence prefix	Files / bytes
state	d6aabb5dec82900ebfac1183abb4036ca06cc0e5	harness/experiments/state-bends-b868541-20260923	346 / 43,573,465
attachments	bb7edfbf01b43577b01d4dc7f6b8dd9240145759	harness/experiments/edge-attachments-53d01a3-20260923	523 / 28,265,440
inspector	3a5fd8e648797837bbfcd8ede1edab96216d7ab0	harness/experiments/scenario-inspector-actions-14e7e6a-20260922	867 / 8,654,498
transition	55198ee5112aa67e063436e4c6a253368e420689	harness/experiments/transition-native-lifecycle-20260913	18 / 21,375,088

Size estimate preceded extraction: 101,868,491 bytes against 1,432,682,496 available bytes. git ls-tree -r -l <commit> -- <prefix> enumerated scope; git cat-file --batch extracted its blob objects unchanged into .local/peer-evidence-verify-20260923/<directory>. No EXE/DLL/PDB files. extraction.json records every path, Git object, byte count and SHA-256. Independent readback verified exact membership and all 1,754 files against that inventory.

Commands and fresh results

Run from repository root, where $py is C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe, $ev is the absolute .local/peer-evidence-verify-20260923 directory and $repo the absolute repository root:

& $py -B "$ev/state/verify-build.py" verify --archive "$ev/state" --repo $repo
& $py -B "$ev/attachments/original/verify-build.py" verify --archive "$ev/attachments/original" --repo $repo
& $py -B "$ev/attachments/corrected/verify-build.py" verify --archive "$ev/attachments/corrected" --repo $repo --related-archive "$ev/attachments/original"
& $py -B "$ev/transition/checks/verify.py"
& $py -B "$ev/transition/native/verify.py"
& $py -B "$ev/independent-check.py"

All six finished exit 0. Sources were inspected before execution. The first three scripts' verify branches read files/Git only; their unused build branches were not invoked. Corrected attachments and State share identical verifier bytes. Transition uses read-only standard-library verification, without opening historical absolute paths. Inspector's original/native-recipe/verify.ps1 is a function library, not a standalone portable verifier; it was inspected and not misrepresented as a verification run. independent-check.py performs the missing inspector checks plus cross-package checks and writes only its result JSON.

Exact executable arguments, exits and stdout/stderr filenames are in verifier-results.json; complete outputs are verifier-1 through verifier-5 .stdout.txt/.stderr.txt. Additional results: independent-results.json, independent-check.stdout.txt, and evaluator-source-diffs.json, all under $ev.

Supplied verifier	Originals / source records checked	Other verified relationships
State	340 / 8,259	110,713 available of 110,805 receipt references; 92 explicitly external
Attachments original	340 / 5,496	14,066 of 14,117 references available; 51 external
Attachments corrected	132 / 2,750	Exact prerequisite original archive; 30,392 of 30,422 references available; 30 external
Transition checks	253 stored members / 265 logical files	Ten closed Cargo receipts, five source-capsule pairs, 40 recorded checker trials including expected rejection exits
Transition native	Pinned sibling checks ZIP	Four closed trials, 12 full-model receipts, 88 capture records, 92 images, three linked source capsules

Independent claim and source checks

• State: raw rows and 61 suite summaries agree: 1,835 passed, zero failed, seven ignored (1,842 actual rows). Three launch/close chains have exit 0 and empty archived streams; 17 full-Project receipts report exact equality. Source map records match Git at 53d01a3d4451b94792986f2dfac56f6f04e111a4, 26979c109384add3e2a4bfd0092b8da1464e37a2, and final b8685416f56e53e30bd11ecf93a54cea10ac8458. Historical failed-targeted/final evidence remains failed. Two unavailable historical dirty state_bend_tests.rs files remain acknowledged gaps, not recovered source proof. Run 3's moved-bend N2 reopening is supported by the supplemental plan/copied checkpoint and explicit actual-path oracle; its frozen default launch/capture source still identifies N3. No continuous drag/camera proof is inferred.
• Attachments: raw original final workspace membership is 1,819 passed/zero failed/seven ignored across 61 summaries. Corrected desktop is 1,194/zero/six, plus exactly two focused passes. Original source-map has 5,458 exact Git records and 38 preserved overrides; all overrides equal their pinned Git blobs after CRLF-to-LF normalization (one includes mixed endings). Corrected map's 2,750 records match 53d01a3 Git exactly although original command receipts retain their then-dirty 3aa80de HEAD. Three original closed runs contain 25 exact and four false full-Project receipts; two corrected runs contain five exact receipts. All five launch/closure chains have exit 0/empty streams. Original overwritten shared-target preflight failure and later restoration do not establish continuous binary immutability. Corrected evaluator reuse is supported by Git diff: only four desktop files changed from 3aa80de89c5b79200286926781e8f3a192bc61f4 to 53d01a3; core/Cargo are unchanged.
• Inspector: exact inventory verifies 863 originals totaling 8,285,235 bytes plus the declared metadata. All ten published prerequisite blobs match recorded pins. Before/after input manifests agree: 2,596 repository files match 14e7e6aa46f59346c7a9a478fc9498fd0b496aaf Git byte for byte; remaining 23 entries are outside that checkout. Eighteen Cargo configuration search slots remain receipt data. Fifteen successful step receipts match their archived logs. Exactly 18 selected passing names match selection and are present in the 1,095-name candidate listing. Eight comparisons verify all 80 artifact pins and actual/expected/input Project JSON equality; the saved-source pins match. Native exit 0/empty streams/launch identity checked; 17 images retained. Source diff from evaluator b10b28cefd1d0794073ba241a0c8de9a83e85f68 changes only views.rs. This establishes neither a full desktop suite run nor fresh reopening or keyboard activation of action buttons.
• Transition: final 715 captured inputs match all 715 Git blobs at 55198ee exactly, beyond the supplied verifier's self-consistency check. Earlier capsules differ in workflow.rs and, for old producer build 1, producer README/checker source. The supplied verifier establishes the exact final footer-literal-only delta from corrected producer build 2. Recorded HEAD d0b7c28 alone never identified those dirty bytes. Final GUI build and two format receipts share the final manifest; earlier strict lint is scoped to its original wording. Forty synthetic checker outcomes are bound to corrected producer build 2; accepted first-relink identities and saved bytes match later reopen/no-op receipts in each direction. Interrupted native trial 1 stays excluded. Launch-pinned capture helpers differ from separately serialized session functions; snapshots lack completion timestamps. No authenticated complete UI action history is claimed.

The State/attachment inventory verifiers check available receipt hashes, not runtime semantics or exhaustive receipt coverage. Additional raw membership/closure checks above are therefore material. Excluded binaries/toolchains are historical hash observations, not freshly rehashed artifacts. Reused Cargo caches and fingerprints do not establish clean/hermetic rebuilds. This review deliberately reuses prior native criticism rather than repeating exhaustive image review, and does not transfer these peer results to the parent's integrated source or another platform.