Dashboard › institutional-transition-lab › Distillation
aa6df0b0-455d-424f-9976-15ba54753f2f["lore_tm_v1_MqALtcNdEfyeWYUt48DAVj6kop-RufEoqzS4Ldp3ijE","lore_tm_v1_UPKoKC2-BSmMzWo2HpUojl_y7kFOgZEcFYaN-mWPB7U","lore_tm_v1_LJPxEJW0w9lDR0uUftmT3tBWdWRFvtZxHdERhnYJQiQ","lore_tm_v1_Z-EfNTqNSiy6TjpGidX5B0Dm6OC0TXfeICqGf5Rs8Wg","lore_tm_v1_BxcgDoGIdaWNMgt_FLcZTIos6eH1DXWS9D3cMQO6VBY","lore_tm_v1_u789pWzGiaHFbAmC-A7o47byGyE-cPY4eOpRh8yQ8IQ","lore_tm_v1_fcYIOL_RrUxNWYKb3KrB91FNhNREHtlqIR6OnvfWbrA","lore_tm_v1_eXTdniTIJgk2hS2qhf_TVZHtK6pO9QjVXPGXRUXrUQM"]
error=artifact member count exceeds limit; ZipInfo_objects_constructed_before_rejection=129, showing rejection occurs after archive.infolist() constructs metadata for all 129 members.encrypted_flag= 1 accepted= True, indicating a ZIP member marked encrypted was accepted by the current verification path.src/institution_lab/governance_adjudication.py immutable-input controls include MAX_INPUT_BYTES = 16 * 1024 * 1024, MAX_ARTIFACT_BYTES = 32 * 1024 * 1024, MAX_ARCHIVE_MEMBERS = 128, MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024, and MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024 at lines 65-69._read_regular_file() in src/institution_lab/governance_adjudication.py:94-109 opens with os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0), verifies stat.S_ISREG(os.fstat(...).st_mode), checks metadata.st_size, reads at most max_bytes + 1, and rejects oversized input.file_sha256() in src/institution_lab/governance_adjudication.py:112-113 hashes bytes returned by _read_regular_file(path, max_bytes=MAX_ARTIFACT_BYTES).src/institution_lab/governance_adjudication.py:116-140 reject duplicate keys via _reject_duplicate_keys, reject NaN/Infinity-style constants via _reject_non_finite_number, convert Unicode/JSON decoding failures to ValueError, and require the top-level value to be an object._validate_manifest_identity() in src/institution_lab/governance_adjudication.py:143-154 requires the manifest key set to equal REQUIRED_INPUT_PINS, requires positive exact-int values for workflow_run_id and artifact_id, and compares every field against FROZEN_INPUT_PINS._verify_input_payloads() in src/institution_lab/governance_adjudication.py:157-217 first validates manifest identity, then computes byte hashes for the already-captured artifact, documents, coding_package, protocol, coding_schema, and adjudication_schema byte strings and checks each against its manifest pin.src/institution_lab/governance_adjudication.py:179-208 calls archive.infolist(), rejects more than 128 entries, counts duplicate info.filename values and requires each count to equal 1, rejects summed declared file_size above 64 MiB, requires documents.json and v1.2-adjudication-package.json, caps each required member at 16 MiB both by declared size and bounded read, and requires exact equality with the corresponding durable input bytes._verify_input_payloads() parses documents, verifies its canonical JSON SHA-256, and parses the coding package and adjudication schema from the same captured byte strings at src/institution_lab/governance_adjudication.py:209-216.verify_input_manifest() in src/institution_lab/governance_adjudication.py:220-239 validates manifest identity before reading the six input paths, then supplies each one-read byte capture to _verify_input_payloads().src/institution_lab/governance_adjudication.py:828-841 use Path.samefile() when possible and non-strict resolved-path equality otherwise; outputs are rejected when they alias any input or each other.main() in src/institution_lab/governance_adjudication.py:882-940 validates output aliases before its try block, captures and strictly parses adjudication and manifest bytes once, captures all pinned files once for _verify_input_payloads(), and then validates using the returned parsed bundle.tests/test_governance_adjudication.py:40-84 defines _write_pinned_cli_inputs(), which writes fixture inputs, creates an artifact containing documents.json and v1.2-adjudication-package.json, computes manifest hashes, writes inputs.json, and monkeypatches FROZEN_INPUT_PINS to the generated manifest.tests/test_governance_adjudication.py:87-103 defines _run_cli() with all 10 CLI path arguments in order: adjudication, input_manifest, documents, coding_package, artifact, protocol, coding_schema, adjudication_schema, summary_json, and summary_markdown.src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py.file:line evidence, classification as PASS, CONCERN, MUST-FIX, or BLOCKED, a deterministic regression for every defect, and a statement of tests/probes run.MERGE or DO-NOT-MERGE.