Distillation

Date: Sep 9, 2026

• 🔴 [requested-security-audit] (00:21) User requested a read-only adversarial security/provenance audit of ONLY the frozen-input trust boundary for issue #4 in /home/byk/Code/institutional-transition-lab.
• 🔴 (00:21) User scoped review to uncommitted code/tests in: src/institution_lab/governance_adjudication.py functions/constants concerning canonical_sha256, file_sha256, verify_input_manifest, FROZEN_INPUT_PINS, REQUIRED_INPUT_PINS, ZIP member verification, and CLI input-path trust; schema/governance-adjudication-v1.schema.json only where it governs input pins; tests/test_governance_adjudication.py only tests of those areas; and cases/review/oss-governance-adjudication-v1.inputs.json.
• 🔴 (00:21) User explicitly excluded governance source records, codings, performance outcomes, transition dates, detector outputs, reports, and active source-review scopes from inspection or adjudication.
• 🔴 [enforced-read-only-workflow] (00:21) User instructed that repository files must not be edited; narrow tests and deterministic in-memory/adversarial checks were allowed if they did not mutate repository files.
• 🔴 (00:21) User required a substantive report even if no defects, with findings first by severity, exact current file:line evidence, PASS/CONCERN/MUST-FIX classifications, deterministic regression proposals for every defect, commands run, and an ending of exactly MERGE or DO-NOT-MERGE; if blocked, the report had to begin BLOCKED with the exact tool/error.
• 🔴 (00:21) User stated this audit replaced a twice-empty broad validator audit and had to remain within the smaller scope.
• 🟡 (00:23) Scoped git status --short showed all four reviewed files as untracked: ?? cases/review/oss-governance-adjudication-v1.inputs.json, ?? schema/governance-adjudication-v1.schema.json, ?? src/institution_lab/governance_adjudication.py, and ?? tests/test_governance_adjudication.py; scoped git diff produced no output because there was no tracked diff.
• 🟡 (00:26) Narrow pytest run completed with exactly 16 passed, 28 deselected in 0.11s.
• 🟡 (00:26) Frozen artifact probe found artifact_hash_matches=true, member_count=19, duplicate_names=[], encrypted_member_count=0, and total_uncompressed_bytes=1993647; selected ZIP metadata was documents.json → [445940, 120892, 8, 3503999] and v1.2-adjudication-package.json → [156038, 14335, 8, 208541662].
• 🟡 (00:30) Deterministic adversarial checks found duplicate_manifest_key_accepted=true, duplicate_zip_member_accepted=true, preloaded_values_can_differ_from_verified_files=true, and malformed required-key-list input raised AttributeError.
• 🟡 (00:32) ZIP ambiguity/safety probe found zero absolute-path members, backslash members, case-fold collisions, normalization collisions, parent-component members, and symlink members; maximum compression ratio was 10.885106382978723.
• 🟡 (00:32) Current input path probe found all seven inspected files were regular, non-symlink files: adjudication schema size 9122, artifact 423046, coding package 156038, coding schema 2593, documents 445940, manifest 723, and protocol 1668 bytes.
• 🟡 (00:32) Initial isolated input-sub-schema validation harness failed with jsonschema.exceptions._WrappedReferencingError: PointerToNowhere: '/$defs/sha256' does not exist because the isolated schema omitted the root $defs; this was a harness error rather than a repository defect.
• 🟡 (00:35) Corrected root-schema input-pin probes produced error counts: valid input 0, boolean ID 1, extra property 1, missing property 1, and uppercase hash 1.
• 🟡 (00:39) Synthetic CLI substitution probe found cli_exited_successfully=true, summary_gate="open", and downstream validator spies received forged coding package, forged documents, and forged schema objects.
• 🟡 (00:40) Canonicalization probes found the standard-library parser accepted non-JSON NaN, canonical_sha256 accepted a non-finite number, and object-key ordering was stable.
• 🟡 (00:43) Assistant reported MUST-FIX finding 1: the CLI verifies different bytes from those it validates. main() parses documents, coding package, and adjudication schema at src/institution_lab/governance_adjudication.py:721-725; verify_input_manifest() reopens those paths for hashing/ZIP comparison at :93-118; downstream validation receives the earlier parsed objects at :735-740. A writable file, swapped symlink, or FIFO can supply forged bytes on the first read and pinned bytes during verification.
• 🟡 (00:43) Assistant explained finding 1’s trust-gap evidence: adjudication pin metadata is compared at governance_adjudication.py:404-410; the in-memory documents hash is compared only with the in-memory coding-package summary at :411-414, not verified_pins["documents_sha256"]; and the in-memory coding package and schema are never tied to their verified raw bytes.
• 🟡 (00:43) Assistant proposed deterministic regression test_cli_never_uses_preverification_bytes: make each path return forged bytes before verification and pinned bytes afterward, then require rejection or require downstream use only of objects parsed from pinned bytes. Recommended implementation: read each input once into immutable bytes, hash and parse those same bytes, open the artifact with ZipFile(BytesIO(artifact_bytes)), and return verified parsed values for downstream use.
• 🟡 (00:43) Assistant reported MUST-FIX finding 2: unrestricted CLI output paths can overwrite frozen inputs after successful verification. Inputs/outputs are accepted as unrestricted Path values at governance_adjudication.py:710-719, and outputs are written at :746-747 without path/inode alias checks; --summary-json can name or hard-link to documents, protocol, schema, manifest, or artifact, allowing successful validation followed by destruction of a frozen input.
• 🟡 (00:43) Assistant proposed finding 2 regression coverage parameterizing every input against both output arguments using direct paths, symlinks, and hard links; the CLI must reject before writing, preserve every input hash, and reject aliases between the two outputs.
• 🟡 (00:43) Assistant reported MUST-FIX finding 3: malformed and ambiguous manifests do not fail cleanly. governance_adjudication.py:722 uses default json.loads(), silently accepting duplicate object keys, while verify_input_manifest() assumes a dictionary at :84-89.
• 🟡 (00:43) Assistant’s deterministic finding 3 probes showed: (1) a JSON array containing exactly REQUIRED_INPUT_PINS reaches .get() and raises AttributeError; (2) a manifest with two artifact_sha256 keys—first forged and last pinned—is accepted because json.loads() keeps the final value. The malformed-shape crash can leave an earlier successful summary untouched, while duplicate keys create conflicting provenance across parsers.
• 🟡 (00:43) Assistant proposed finding 3 regressions for scalar, array, exact-required-key array, duplicate-key, and non-finite-number manifests; all must produce controlled validation failures and never leave an open output. Recommended parsing security-critical JSON with duplicate-key and non-finite-number rejection and checking isinstance(manifest, dict) before set().
• 🟡 (00:43) Assistant reported CONCERN finding 4: local pins do not independently authenticate the claimed GitHub origin. FROZEN_INPUT_PINS at governance_adjudication.py:35-49 and cases/review/oss-governance-adjudication-v1.inputs.json:2-10 repeat the same locally reviewed assertions; tests do not independently bind workflow run 33063470968 and artifact 9642983578 to the pinned artifact hash.
• 🟡 (00:43) Assistant clarified finding 4: a data-only substitute cannot pass with an immutable verifier, but a patch changing constants, manifest, and bundle together can pass local tests, making code review and the eventual Git commit the sole provenance root. Alternatives proposed if machine-verifiable GitHub origin is required: verify an externally signed attestation, or query the expected repository/workflow/run/artifact from protected CI and hash downloaded bytes; regressions should cover mismatched repository, workflow, run, artifact, and digest.
• 🟡 (00:43) Assistant reported CONCERN finding 5: duplicate ZIP members are accepted because archive.read(member_name) at governance_adjudication.py:104-115 is used without first enforcing unique names. A synthetic ZIP containing two different documents.json members passed when Python selected the member matching the durable file.
• 🟡 (00:43) Assistant noted finding 5 is mitigated for the current fixed artifact: it has 19 unique members, no normalization/case-fold collisions, no absolute/parent paths, no backslashes, no symlinks, no encrypted members, and a maximum compression ratio of 10.89; its fixed artifact hash prevents this ambiguity while paths remain stable.
• 🟡 (00:43) Assistant proposed finding 5 regression: construct duplicate required members with differing bytes and require ValueError; require every expected member exactly once and reject normalized-name collisions before reading member data.
• 🟡 (00:43) Assistant reported CONCERN finding 6: input reads have no type or resource bounds. file_sha256() reads until EOF at governance_adjudication.py:66-71, the CLI loads complete JSON files at :721-725, and archive.read() allocates complete ZIP members at :111; FIFOs can block indefinitely and oversized files can consume unbounded time/memory before hash rejection.
• 🟡 (00:43) Assistant proposed finding 6 regressions using a capped infinite stream, oversized regular file, and oversized ZIP member. Recommended rejecting non-regular files after opening and inspecting the file descriptor, deriving size limits, and comparing ZIP member sizes with already captured durable-byte lengths before decompression.
• 🟡 (00:43) Assistant reported CONCERN finding 7: canonical_sha256() at governance_adjudication.py:61-63 uses default json.dumps(), which accepts and emits NaN and infinities despite strict JSON forbidding them; the current documents’ pinned raw-file hash mitigates substitution.
• 🟡 (00:43) Assistant proposed finding 7 regression: set allow_nan=False, reject non-finite constants during parsing, preserve a key-order-stability test, and add rejection tests for NaN, positive infinity, and negative infinity.
• 🟡 (00:43) Assistant reported PASS 1: missing or extra manifest keys are rejected at governance_adjudication.py:84-85.
• 🟡 (00:43) Assistant reported PASS 2: every manifest value must equal the hard-coded frozen value before file access at governance_adjudication.py:90-92.
• 🟡 (00:43) Assistant reported PASS 3: every durable file receives a raw SHA-256 check at governance_adjudication.py:93-103.
• 🟡 (00:43) Assistant reported PASS 4: required artifact members are compared byte-for-byte at governance_adjudication.py:104-115; no ZIP extraction is performed, so traversal entries are not written.
• 🟡 (00:43) Assistant reported PASS 5: documents receive raw-file and parsed canonical hash checks at governance_adjudication.py:95 and :116-118, subject to the CLI race in MUST-FIX finding 1.
• 🟡 (00:43) Assistant reported PASS 6: schema/governance-adjudication-v1.schema.json:39-68 requires exactly nine input pins, positive integer IDs, lowercase 64-character hashes, and no additional properties; corrected schema probes rejected missing, extra, uppercase-hash, and boolean-ID inputs.
• 🟡 (00:43) Assistant reported PASS 7: tests/test_governance_adjudication.py:689-705 verifies the committed frozen bundle against the current artifact successfully.
• 🟡 (00:43) Assistant reported PASS 8: manifest-substitution parameterization covers every frozen field at tests/test_governance_adjudication.py:564-582.
• 🟡 (00:43) Assistant identified test gap 1: test_every_input_pin_is_reverified at tests/test_governance_adjudication.py:547-554 changes only artifact_sha256 despite its broad name.
• 🟡 (00:43) Assistant identified test gap 2: changed durable bytes are tested only for documents at tests/test_governance_adjudication.py:596-639.
• 🟡 (00:43) Assistant identified test gap 3: artifact-member mismatch is tested only for documents.json at tests/test_governance_adjudication.py:642-686.
• 🟡 (00:43) Assistant identified test gap 4: no CLI tests cover read ordering, mutable paths, path aliases, malformed manifest shapes, duplicate JSON keys, duplicate ZIP members, special files, or resource limits.
• 🟡 (00:43) Assistant stated commands/checks run: scoped git status --short and git diff; narrow pytest selection; artifact hash, ZIP metadata, path-type, compression, and ambiguity probes; synthetic duplicate-manifest, malformed-manifest, duplicate-ZIP, stale-preload, and direct CLI-substitution probes; input-pin schema probes; and canonicalization probes for key order and non-finite numbers.
• 🟡 (00:43) Assistant stated no repository files were edited; adversarial fixtures were placed under /tmp/opencode; excluded governance source records, codings, outcomes, dates, reports, detector output, and active review scopes were not inspected.
• 🟡 (00:43) Audited working-copy hashes were: src/institution_lab/governance_adjudication.py → 0c873db5c8a2394150fa35d96694317f6cb2e847bc41919e1ca82992b86e57c0; schema/governance-adjudication-v1.schema.json → 6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31; tests/test_governance_adjudication.py → 56e1c751ea148495f913995e01f77a2f98ef7cf0d4e86e35a0bae21586f87b1e; cases/review/oss-governance-adjudication-v1.inputs.json → ac47cff1f6a937f932d34f12e86e79d01dc79db21799ec20fa84a2db89454355.
• 🟡 (00:43) Assistant’s final audit disposition was DO-NOT-MERGE.