Distillation

Date: Sep 9, 2026

• 🔴 [requested-security-audit] (04:03) User requested a fresh, substantive, read-only security audit of only the JSON/pin/immutable-snapshot half of issue #4 input verification in /home/byk/Code/institutional-transition-lab; this replaces a reviewer that returned empty twice.
• 🔴 [enforced-read-only] (04:03) User directed that files must never be edited and that the current working copy must be reviewed read-only.
• 🔴 [restricted-inspection] (04:03) User directed never to inspect governance record bodies, coding decisions, outcomes, reports, dates, detector output, or source-adjudication scopes.
• 🔴 (04:03) User limited audit scope to: strict JSON parsing of manifest/documents/coding package/adjudication schema; duplicate keys and non-finite values; top-level object/type handling; immutable FROZEN_INPUT_PINS identity and pin-first rejection ordering; one-read byte snapshots and proof that the exact hashed bytes are the exact parsed/validated bytes; canonical documents hash relation; and narrowly corresponding tests/probes.
• 🔴 (04:03) User excluded regular-file/FIFO/symlink/resource-limit and ZIP/archive mechanics because another reviewer owns those areas.
• 🔴 (04:03) User identified primary audit files as src/institution_lab/governance_adjudication.py and only relevant tests in tests/test_governance_adjudication.py.
• 🔴 (04:03) User required findings first, severity ordering, exact current file:line references, and PASS/CONCERN/MUST-FIX/BLOCKED labels; every defect must include a deterministic regression. If no defects exist, the response must state PASS, identify tests/probes and residual risks, and end exactly MERGE or DO-NOT-MERGE.
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:30-55: REQUIRED_INPUT_PINS contains exactly workflow_run_id, artifact_id, artifact_sha256, documents_sha256, documents_file_sha256, coding_package_file_sha256, protocol_sha256, coding_schema_sha256, and adjudication_schema_sha256. FROZEN_INPUT_PINS fixes workflow_run_id=33063470968, artifact_id=9642983578, artifact_sha256=1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06, documents_sha256=d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9, documents_file_sha256=2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce, coding_package_file_sha256=14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769, protocol_sha256=06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933, coding_schema_sha256=bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e, and adjudication_schema_sha256=6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31.
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:80-87: canonical_sha256() serializes with json.dumps(value, sort_keys=True, separators=(",", ":"), allow_nan=False).encode() and hashes those bytes with SHA-256.
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:116-140: _reject_duplicate_keys() raises ValueError("duplicate JSON key: {key}"); _reject_non_finite_number() raises ValueError("non-finite JSON number: {value}"); _parse_json_object() supplies both as json.loads() hooks and rejects non-dict top-level values with "{label} must be an object".
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:143-154: _validate_manifest_identity() requires a dict, exact equality between the manifest key set and REQUIRED_INPUT_PINS, positive exact-int values for workflow_run_id and artifact_id, and equality of every field against FROZEN_INPUT_PINS.
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:157-217: _verify_input_payloads() calls _validate_manifest_identity() before computing payload hashes; hashes the supplied byte snapshots for artifact_sha256, documents_file_sha256, coding_package_file_sha256, protocol_sha256, coding_schema_sha256, and adjudication_schema_sha256; parses the same documents, coding_package, and adjudication_schema byte objects; and verifies documents_sha256 == canonical_sha256(documents_value).
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:220-239: verify_input_manifest() performs _validate_manifest_identity(manifest) before reading input paths, then reads each path into bytes once and passes those snapshots to _verify_input_payloads().
• 🟡 (04:05) Audit evidence from src/institution_lab/governance_adjudication.py:907-934: CLI main() parses the adjudication snapshot first at lines 908-911, parses the input-manifest snapshot at lines 912-915, reads the six pinned payloads once at lines 916-924, and validates using bundle.adjudication_schema, bundle.documents, bundle.coding_package, and bundle.pins at lines 925-931.
• 🟡 (04:05) Relevant tests identified in tests/test_governance_adjudication.py: test_input_manifest_rejects_self_consistent_substitute lines 651-669 checks every frozen field; test_input_manifest_rejects_changed_file_bytes lines 683-726 checks changed document bytes; test_cli_validates_the_same_bytes_it_verifies lines 776-797 probes a pre-verification document swap; test_cli_rejects_duplicate_manifest_keys lines 848-867 checks duplicate-key rejection and closed failure output; test_input_manifest_rejects_non_object lines 870-880 checks top-level manifest type; test_canonical_sha256_rejects_non_finite_numbers lines 954-957 checks NaN, positive infinity, and negative infinity; and test_committed_frozen_input_manifest_verifies lines 960-976 verifies the committed frozen inputs.
• 🟡 (04:07) Test helper evidence from tests/test_governance_adjudication.py:40-84: _write_pinned_cli_inputs() creates JSON documents, coding package, and adjudication schema values; writes their bytes; calculates file and canonical hashes; writes an input manifest; and monkeypatches governance_adjudication.FROZEN_INPUT_PINS to that generated manifest.
• 🟡 (04:07) No substantive final audit verdict or test-run result had yet been produced in the observed segment.