Distillation

Date: Sep 9, 2026

• 🔴 [requested-review] (09:48) User requested a read-only review limited to src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py; explicitly instructed not to edit files.
• 🟡 (09:48) User asked for the smallest robust defensive ZIP-validation design addressing completed audit findings: raw central-directory member identity; NUL and Unicode-extra-field ambiguity; unsafe or colliding paths; non-regular/special metadata; encryption and unsupported compression; malformed EOCD, central-directory, or local-header structure; declared-size underreporting; true decompressed-byte resource limits for stored/deflate/bzip2/lzma without trusting ZipExtFile clipping; truncated streams whose decoded payload and CRC still match; and normalized decompressor exceptions.
• 🔴 (09:48) User stated the implementation must continue accepting the current pinned artifact with exactly 19 members, Unix regular mode 100644, DEFLATE compression, and data descriptors.
• 🟡 (09:48) User requested concrete helper signatures, exact parsing fields/offsets, a safe codec strategy, resource limits, and focused fail-first tests.
• 🔴 (09:48) User required proposed Python indentation to use tabs and requested concise implementation guidance only.
• 🟡 (09:50) src/institution_lab/governance_adjudication.py currently imports io, stat, and zipfile; archive limits are MAX_ARTIFACT_BYTES = 32 * 1024 * 1024, MAX_ARCHIVE_MEMBERS = 128, MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024, and MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024.
• 🟡 (09:50) Current ZIP verification is in _verify_input_payloads() at src/institution_lab/governance_adjudication.py:157-217, particularly lines 179-208: it opens zipfile.ZipFile(io.BytesIO(artifact)), gets archive.infolist(), limits member count, detects duplicates using decoded info.filename, trusts the sum of declared info.file_size, retrieves documents.json and v1.2-adjudication-package.json with archive.getinfo(), trusts declared per-member info.file_size, reads each through archive.open(info).read(MAX_ARCHIVE_MEMBER_BYTES + 1), compares bytes with durable files, and normalizes only zipfile.BadZipFile to ValueError("artifact is not a valid ZIP archive").
• 🟡 (09:50) The two artifact members whose contents are checked against durable inputs are exactly documents.json → documents and v1.2-adjudication-package.json → coding_package.
• 🟡 (09:50) Existing ZIP errors include: artifact member count exceeds limit, artifact member is not unique: {member_name}, artifact expanded size exceeds limit, artifact member missing: {member_name}, artifact member exceeds size limit: {member_name}, artifact member mismatch: {member_name}, and artifact is not a valid ZIP archive.
• 🟡 (09:50) Artifact bytes enter _verify_input_payloads() through both verify_input_manifest() at lines 220-239 and main() at lines 916-924, with _read_regular_file(..., max_bytes=MAX_ARTIFACT_BYTES) enforcing the 32 MiB raw artifact cap before ZIP validation.
• 🟡 (09:50) _read_regular_file() at src/institution_lab/governance_adjudication.py:94-109 opens with os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0), verifies stat.S_ISREG, checks declared size, and performs a max_bytes + 1 read.
• 🟡 (09:50) The supplied tool output contained src/institution_lab/governance_adjudication.py in full (946 lines); no content from tests/test_governance_adjudication.py was included in the observed material.