Distillation

Date: Sep 9, 2026

• 🔴 [requested-security-audit] (05:38) User requested a fresh, minimal, read-only security audit for issue #4 in /home/byk/Code/institutional-transition-lab, limited exclusively to declared ZIP-size limit arithmetic.
• 🔴 (05:38) User stated this audit replaces a resource-accounting reviewer that returned empty twice.
• 🔴 [enforced-read-only-scope] (05:38) User instructed never to edit files and never to inspect governance records, codings, outcomes, reports, dates, detectors, or source adjudication.
• 🔴 (05:38) Audit scope specified: how central-directory file_size declarations are checked against per-member and total expanded-byte constants; exact boundary behavior; integer, negative, overflow, and impossible values as exposed or byte-patchable; and whether malformed declarations bypass limits before decompression.
• 🔴 (05:38) User excluded inspection of actual member read loops, CRC/content comparison, archive names/path/mode/encryption/count, regular-file reads, JSON/pins/hashes, and CLI output.
• 🔴 (05:38) User allowed review only of relevant code/constants in src/institution_lab/governance_adjudication.py, narrow tests, and small read-only probes.
• 🔴 (05:38) User required substantive evidence with findings first, exact file:line references, PASS/CONCERN/MUST-FIX/BLOCKED labels, and a deterministic regression for every defect; the final audit must end exactly MERGE or DO-NOT-MERGE.
• 🟡 (05:39) Relevant constants found in src/institution_lab/governance_adjudication.py: line 67 MAX_ARCHIVE_MEMBERS = 128; line 68 MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024; line 69 MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024.
• 🟡 (05:39) Relevant ZIP declaration checks found in src/institution_lab/governance_adjudication.py: line 181 infos = archive.infolist(); lines 182–183 reject more than MAX_ARCHIVE_MEMBERS; line 188 uses sum(info.file_size for info in infos) > MAX_ARCHIVE_EXPANDED_BYTES; line 189 raises ValueError("artifact expanded size exceeds limit"); line 199 uses info.file_size > MAX_ARCHIVE_MEMBER_BYTES; line 200 raises ValueError(f"artifact member exceeds size limit: {member_name}").
• 🟡 (05:39) The implementation proceeds after the declaration checks to archive.open(info) at line 201, then reads MAX_ARCHIVE_MEMBER_BYTES + 1 at line 202 and rejects a returned length greater than MAX_ARCHIVE_MEMBER_BYTES at line 203; inspection of that actual read-loop behavior was outside the user’s requested scope.
• 🟡 (05:40) Narrow test file identified as /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py.
• 🟡 (05:40) Existing ZIP-related test construction references found in tests/test_governance_adjudication.py: lines 65–67, 703–705, 743–745, 890–892, and 913–915.
• 🟡 (05:41) Search in tests/test_governance_adjudication.py found an archive member-count assertion at line 919: pytest.raises(ValueError, match="artifact member count exceeds limit"); the reported search found no test match for declared member-byte or total expanded-byte limit errors.
• 🟡 (05:43) A small arithmetic probe reported member_exact [16777216, 0] member_reject False total_reject False, confirming the per-member boundary of exactly 16,777,216 bytes is accepted by the strict > comparison.
• 🟡 (05:43) The probe reported member_plus_one [16777217, 0] member_reject True total_reject False, confirming 16,777,217 bytes triggers the per-member declaration rejection.
• 🟡 (05:43) The probe reported total_exact [16777216, 50331648] member_reject True total_reject False, confirming an exact summed total of 67,108,864 bytes is accepted by the total’s strict > comparison; the second individual declaration, 50,331,648 bytes, independently exceeds the 16,777,216-byte member limit.
• 🟡 (05:43) The probe reported total_plus_one [16777216, 50331649] member_reject True total_reject True, confirming a summed total of 67,108,865 bytes triggers total rejection and the 50,331,649-byte member independently triggers per-member rejection.
• 🟡 (05:43) The probe reported underdeclared [0, 0] member_reject False total_reject False, showing zero-valued declarations do not trigger either arithmetic limit check.
• 🟡 (05:43) The probe reported u32_max_minus_sentinel [4294967294, 0] member_reject True total_reject True, showing a declaration of 4,294,967,294 is rejected by both arithmetic comparisons.
• 🟡 (05:43) The probe identified the ZIP32 sentinel as u32_sentinel 4294967295.
• 🟡 (05:43) The probe reported pack_u32 -1 error and pack_u32 4294967296 error, showing those values cannot be directly encoded through the probe’s unsigned 32-bit packing operation.
• 🟡 (05:43) Repository status showed src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py as untracked: ?? src/institution_lab/governance_adjudication.py and ?? tests/test_governance_adjudication.py.