ARCADIA-Studio/harness/reviews/peer-evidence-audit-20260923.md

# September 23 peer evidence verification

Disposition: the inspected portable packages pass integrity/consistency verification within their stated scopes. No new package defect found. This is a fresh offline verification of peer receipts and committed bytes, **not** new compilation, application execution, model-checker execution, native interaction, or release acceptance.

Reviewer: delegated Codex-956atf review, 2026-09-23. Parent owns integration/publication. Only scratch evidence/report files were written; no worktree, source edits, compiler, GUI, runtime executable, Gitea write, or remote mutation.

## Extracted commits and scope

| Scratch directory | Fetched commit | Repository evidence prefix | Files / bytes |
|---|---|---|---:|
| state | `d6aabb5dec82900ebfac1183abb4036ca06cc0e5` | `harness/experiments/state-bends-b868541-20260923` | 346 / 43,573,465 |
| attachments | `bb7edfbf01b43577b01d4dc7f6b8dd9240145759` | `harness/experiments/edge-attachments-53d01a3-20260923` | 523 / 28,265,440 |
| inspector | `3a5fd8e648797837bbfcd8ede1edab96216d7ab0` | `harness/experiments/scenario-inspector-actions-14e7e6a-20260922` | 867 / 8,654,498 |
| transition | `55198ee5112aa67e063436e4c6a253368e420689` | `harness/experiments/transition-native-lifecycle-20260913` | 18 / 21,375,088 |

Size estimate preceded extraction: 101,868,491 bytes against 1,432,682,496 available bytes. `git ls-tree -r -l <commit> -- <prefix>` enumerated scope; `git cat-file --batch` extracted its blob objects unchanged into `.local/peer-evidence-verify-20260923/<directory>`. No EXE/DLL/PDB files. `extraction.json` records every path, Git object, byte count and SHA-256. Independent readback verified exact membership and all 1,754 files against that inventory.

## Commands and fresh results

Run from repository root, where `$py` is `C:/Users/User/.cache/codex-runtimes/codex-primary-runtime/dependencies/python/python.exe`, `$ev` is the absolute `.local/peer-evidence-verify-20260923` directory and `$repo` the absolute repository root:

```powershell
& $py -B "$ev/state/verify-build.py" verify --archive "$ev/state" --repo $repo
& $py -B "$ev/attachments/original/verify-build.py" verify --archive "$ev/attachments/original" --repo $repo
& $py -B "$ev/attachments/corrected/verify-build.py" verify --archive "$ev/attachments/corrected" --repo $repo --related-archive "$ev/attachments/original"
& $py -B "$ev/transition/checks/verify.py"
& $py -B "$ev/transition/native/verify.py"
& $py -B "$ev/independent-check.py"
```

All six finished exit 0. Sources were inspected before execution. The first three scripts' `verify` branches read files/Git only; their unused `build` branches were not invoked. Corrected attachments and State share identical verifier bytes. Transition uses read-only standard-library verification, without opening historical absolute paths. Inspector's `original/native-recipe/verify.ps1` is a function library, not a standalone portable verifier; it was inspected and **not** misrepresented as a verification run. `independent-check.py` performs the missing inspector checks plus cross-package checks and writes only its result JSON.

Exact executable arguments, exits and stdout/stderr filenames are in `verifier-results.json`; complete outputs are `verifier-1` through `verifier-5` `.stdout.txt`/`.stderr.txt`. Additional results: `independent-results.json`, `independent-check.stdout.txt`, and `evaluator-source-diffs.json`, all under `$ev`.

| Supplied verifier | Originals / source records checked | Other verified relationships |
|---|---:|---|
| State | 340 / 8,259 | 110,713 available of 110,805 receipt references; 92 explicitly external |
| Attachments original | 340 / 5,496 | 14,066 of 14,117 references available; 51 external |
| Attachments corrected | 132 / 2,750 | Exact prerequisite original archive; 30,392 of 30,422 references available; 30 external |
| Transition checks | 253 stored members / 265 logical files | Ten closed Cargo receipts, five source-capsule pairs, 40 recorded checker trials including expected rejection exits |
| Transition native | Pinned sibling checks ZIP | Four closed trials, 12 full-model receipts, 88 capture records, 92 images, three linked source capsules |

## Independent claim and source checks

- **State:** raw rows and 61 suite summaries agree: 1,835 passed, zero failed, seven ignored (1,842 actual rows). Three launch/close chains have exit 0 and empty archived streams; 17 full-Project receipts report exact equality. Source map records match Git at `53d01a3d4451b94792986f2dfac56f6f04e111a4`, `26979c109384add3e2a4bfd0092b8da1464e37a2`, and final `b8685416f56e53e30bd11ecf93a54cea10ac8458`. Historical failed-targeted/final evidence remains failed. Two unavailable historical dirty `state_bend_tests.rs` files remain acknowledged gaps, not recovered source proof. Run 3's moved-bend N2 reopening is supported by the supplemental plan/copied checkpoint and explicit actual-path oracle; its frozen default launch/capture source still identifies N3. No continuous drag/camera proof is inferred.
- **Attachments:** raw original final workspace membership is 1,819 passed/zero failed/seven ignored across 61 summaries. Corrected desktop is 1,194/zero/six, plus exactly two focused passes. Original source-map has 5,458 exact Git records and 38 preserved overrides; all overrides equal their pinned Git blobs after CRLF-to-LF normalization (one includes mixed endings). Corrected map's 2,750 records match `53d01a3` Git exactly although original command receipts retain their then-dirty `3aa80de` HEAD. Three original closed runs contain **25 exact and four false** full-Project receipts; two corrected runs contain five exact receipts. All five launch/closure chains have exit 0/empty streams. Original overwritten shared-target preflight failure and later restoration do not establish continuous binary immutability. Corrected evaluator reuse is supported by Git diff: only four desktop files changed from `3aa80de89c5b79200286926781e8f3a192bc61f4` to `53d01a3`; core/Cargo are unchanged.
- **Inspector:** exact inventory verifies 863 originals totaling 8,285,235 bytes plus the declared metadata. All ten published prerequisite blobs match recorded pins. Before/after input manifests agree: 2,596 repository files match `14e7e6aa46f59346c7a9a478fc9498fd0b496aaf` Git byte for byte; remaining 23 entries are outside that checkout. Eighteen Cargo configuration search slots remain receipt data. Fifteen successful step receipts match their archived logs. Exactly 18 selected passing names match selection and are present in the 1,095-name candidate listing. Eight comparisons verify all 80 artifact pins and actual/expected/input Project JSON equality; the saved-source pins match. Native exit 0/empty streams/launch identity checked; 17 images retained. Source diff from evaluator `b10b28cefd1d0794073ba241a0c8de9a83e85f68` changes only `views.rs`. This establishes neither a full desktop suite run nor fresh reopening or keyboard activation of action buttons.
- **Transition:** final 715 captured inputs match **all 715 Git blobs** at `55198ee` exactly, beyond the supplied verifier's self-consistency check. Earlier capsules differ in `workflow.rs` and, for old producer build 1, producer README/checker source. The supplied verifier establishes the exact final footer-literal-only delta from corrected producer build 2. Recorded HEAD `d0b7c28` alone never identified those dirty bytes. Final GUI build and two format receipts share the final manifest; earlier strict lint is scoped to its original wording. Forty synthetic checker outcomes are bound to corrected producer build 2; accepted first-relink identities and saved bytes match later reopen/no-op receipts in each direction. Interrupted native trial 1 stays excluded. Launch-pinned capture helpers differ from separately serialized session functions; snapshots lack completion timestamps. No authenticated complete UI action history is claimed.

The State/attachment inventory verifiers check available receipt hashes, not runtime semantics or exhaustive receipt coverage. Additional raw membership/closure checks above are therefore material. Excluded binaries/toolchains are historical hash observations, not freshly rehashed artifacts. Reused Cargo caches and fingerprints do not establish clean/hermetic rebuilds. This review deliberately reuses prior native criticism rather than repeating exhaustive image review, and does not transfer these peer results to the parent's integrated source or another platform.