Distillation

Date: Sep 9, 2026

• 🔴 [requested-security-rereview] (01:19) User requested a read-only adversarial re-review of the CURRENT working-copy implementation after the prior frozen-input provenance/security audit, limited to /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py, /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py, /home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json, and /home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json.
• 🔴 [enforced-read-only-workflow] (01:19) User prohibited file edits and allowed deterministic adversarial probes where useful.
• 🔴 (01:19) User asked to verify substantive fixes for: using the same immutable bytes for hashing, ZIP comparison, parsing, and validation; rejecting direct/symlink/hardlink input-output and output-output aliases before writes; failing closed for malformed, duplicate-key, and non-finite JSON while replacing stale open output where safe; rejecting duplicate ZIP entries; enforcing regular-file, FIFO-nonblocking, input-size, member-count, member-size, and expanded-size bounds; and rejecting non-finite values during canonical JSON hashing.
• 🔴 (01:19) User additionally requested examination of normalized ZIP-name ambiguity, TOCTOU around output checks and writes, partial/stale report behavior, and whether tests genuinely prove guards rather than pass incidentally.
• 🔴 (01:19) User excluded governance source records, codings, outcomes, transition dates, detector reports, and active source-adjudication scopes from review.
• 🔴 (01:19) User required findings first in severity order, exact current file:line evidence, PASS/CONCERN/MUST-FIX classifications, deterministic regression proposals for every defect, commands/tests run, current file hashes, explicit PASS and residual-risk discussion if no defects remain, inclusion of the local-origin attestation limitation if still applicable, and an ending of exactly MERGE or DO-NOT-MERGE.
• 🟡 (01:19) Assistant stated the review plan: inspect only the four named files, map every prior finding to current guards and tests, and run narrow tests plus isolated adversarial probes without writing to the repository.
• 🟡 (01:20) Current governance_adjudication.py defines resource limits: MAX_INPUT_BYTES = 16 * 1024 * 1024, MAX_ARTIFACT_BYTES = 32 * 1024 * 1024, MAX_ARCHIVE_MEMBERS = 128, MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024, and MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024 at lines 65-69.
• 🟡 (01:20) Current canonical_sha256() at governance_adjudication.py:80-87 calls json.dumps(..., sort_keys=True, separators=(",", ":"), allow_nan=False), making non-finite canonical values fail rather than serialize.
• 🟡 (01:20) Current _read_regular_file() at governance_adjudication.py:94-109 opens with os.O_RDONLY | os.O_NONBLOCK | O_NOFOLLOW where supported, validates the opened descriptor with os.fstat()/stat.S_ISREG, checks st_size, and reads at most max_bytes + 1; file_sha256() at lines 112-113 hashes bytes returned by that bounded reader.
• 🟡 (01:20) Current security-critical JSON parsing uses _reject_duplicate_keys() at governance_adjudication.py:116-122, _reject_non_finite_number() at lines 125-126, and _parse_json_object() at lines 129-140 with object_pairs_hook, parse_constant, and a root-object type check.
• 🟡 (01:20) Current _verify_input_payloads() at governance_adjudication.py:157-217 accepts already-read immutable byte strings, hashes those bytes, opens the artifact using zipfile.ZipFile(io.BytesIO(artifact)), compares required ZIP members against the same durable document/coding-package bytes, parses those same document/coding-package/schema bytes, and returns them in frozen VerifiedInputBundle.
• 🟡 (01:20) Current ZIP checks at governance_adjudication.py:180-208 enforce at most 128 members, exact raw-filename uniqueness using Counter(info.filename for info in infos), total declared expanded size at most 64 MiB, required member size at most 16 MiB, bounded reads of required members, and byte equality for documents.json and v1.2-adjudication-package.json; the inspected code does not show a normalized-name collision check in this block.
• 🟡 (01:20) Current verify_input_manifest() at governance_adjudication.py:220-239 reads artifact, documents, coding package, protocol, coding schema, and adjudication schema through _read_regular_file() before delegating to _verify_input_payloads().
• 🟡 (01:20) Current path-alias logic at governance_adjudication.py:828-841 uses Path.samefile() when paths exist and resolve(strict=False) otherwise; _validate_output_paths() checks every output against every input and checks the two outputs against each other.
• 🟡 (01:20) Current _atomic_write() at governance_adjudication.py:844-856 creates a temporary file in the destination directory using tempfile.mkstemp(), writes and fsync()s it, then publishes with os.replace(); cleanup removes the temporary file on failure.
• 🟡 (01:20) Current _write_failure_reports() at governance_adjudication.py:859-879 creates closed-gate JSON and Markdown reports containing the exception message and writes the JSON first, then Markdown, through separate _atomic_write() calls.
• 🟡 (01:20) Current CLI flow at governance_adjudication.py:882-942 validates output aliases at line 906 before entering the try block; inside the try, it reads/parses adjudication and manifest, reads all frozen inputs once, verifies and parses via _verify_input_payloads(), and validates using bundle.adjudication_schema, bundle.documents, bundle.coding_package, and bundle.pins. Exceptions inside that block trigger closed failure reports at lines 932-934.
• 🟡 (01:20) Current successful/ordinary-validation output flow at governance_adjudication.py:935-942 marks the gate closed when validation errors exist, atomically writes summary JSON first and Markdown second, then raises ValueError if validation failed.
• 🟡 (01:20) Current test helper _write_pinned_cli_inputs() in tests/test_governance_adjudication.py:40-84 builds isolated pinned files and a ZIP, computes all hashes, writes a manifest, and monkeypatches FROZEN_INPUT_PINS; _run_cli() at lines 87-103 supplies all ten CLI paths.
• 🟡 (01:20) Search results in tests/test_governance_adjudication.py showed dedicated tests for direct/symlink/hardlink output aliases to frozen inputs at lines 813-830, aliased outputs at lines 836-844, and duplicate manifest keys beginning at line 848; the file currently contains 1024 lines.