railiance-platform/docs/evidence/2026-10-11-infd-zlib-candidate-owner-review/final-order-source-review.json
codex 2fe072a866
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 1s
Record exact zlib candidate source review and refinements
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a126e1-76f8-7643-8cf3-e93336539ade
2026-10-11 11:36:02 +02:00

65 lines
4 KiB
JSON

{
"review_id": "RPF-REVIEW-20261011-INFD-ZLIB-CANDIDATE-R3",
"work_record": "RPF-IN-0008",
"role": "railiance-platform technical owner only",
"status": "technical-agreement-source-candidate-preparation-only",
"source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
"source_paths": 74,
"initial_conditional_review_manifest_sha256": "380c6172adc36b5907ba5384d14d799e49eda410732dfce1878fbe6db184ff0c",
"intermediate_source_manifest_sha256": "64509029b3de6d33e3675587663ccdae027d9ea18aba83750892480766dd03b8",
"history": "Exact previous16 review files plus original manifest/map archived at accepted-66-6af44c10. This includes original380c four-file snapshot and645 failed boundary evidence. Prior agreement preserved as intermediate, superseded for source-whiteout semantics. Same completed IN8 trial anchor updated before entry; no new privilege or success.",
"refinements_verified": [
"Optimization refused before artifact reads/output under -O and independently -OO.",
"Directory mode/UID/GID included; drift negatives pass.",
"Leading dot whiteout names preserved; root/nested deletion and opaque boundaries refuse fixture drift for correct effective paths.",
"Existing source/package provenance, exact763c base, four-file context and bounded existing owner publication/credential routes unchanged.",
"Markers apply only to previous-layer state; current-layer additions merged after masking. Eight independent full CLI cases verify replacement hashes survive root/nested regular/opaque markers in both stream orders."
],
"actual_local_candidate": {
"daemon_image_id": "sha256:78bfdcc00a62367ae6190f6569a02b18abf9a943f760e4ac8fb946703348af31",
"registry_digest": null,
"context_sha256": "c554e62a84af340cba15d469a4568f6d0c40923e580b08ed7565e22702b1207d",
"effective_changed_files": [
"lib/apk/db/installed",
"usr/lib/libz.so.1.3.2"
],
"directories": 313,
"directory_metadata_delta": {},
"nine_base_layers_preserved": true,
"runtime_policy_module_unchanged": true,
"fullscan_same_snapshot_baseline_findings": 1,
"fullscan_same_snapshot_local_candidate_findings": 0,
"raw_runtime_config_bytes_identical": false,
"closed_default_normalization_semantics_unchanged": true,
"initial_or_intermediate_candidate_failed": false
},
"validation": {
"source_manifest_sha256": "724aa4777eb1c8976d868e5f504473f4b6d58f13d750d87aefa5c8d5ca0747ec",
"all74_hashes_match": true,
"maker_test_methods_independently_passed": 9,
"independent_cli_order_cases_passed": 8,
"independent_prior_negative_cases_passed": 5,
"order_case_assertion": "Full CLI success plus emitted libz replacement file hash equals current-layer synthetic bytes for root/nested regular/opaque whiteouts before and after additions.",
"fixtures_only": true,
"native_actions": false,
"actual_candidate_image_unchanged": true
},
"remaining_gates": [
"Actual owner CI source-pinned publication and immutable registry descriptor/layer/config/source readback.",
"Actual published full unsuppressed pinned scan/SBOM/runtime/purpose proof; local artifact zero does not extend to a different artifact.",
"Concrete separately reviewed native target/data-retaining protocol and fresh founder disposition; old purpose R2 approval does not authorize zlib release."
],
"scope_limits": {
"owner_source_write": false,
"registry_publish": false,
"native_workload_changed": false,
"database_access": false,
"credentials_read": false,
"human_native_approval": false,
"T05_complete": false,
"other_owner_role": false
},
"checker_scope": "Agreement concerns this exact bounded candidate and challenged proof boundary; does not certify a general-purpose OCI extraction or signature verifier.",
"previous_agreement_manifest_sha256": "6af44c102084f7cdf09268264c5fd7bb0b0b354723edb10b7da2c1800ab726d4",
"previous_source_manifest_sha256": "3e41ab391cda26f09a556fecef8a17c2759ef2899e43eb136b25ef4b3fde23a0"
}