Distillation

2026-09-09 🔴 (05:03) [enforced-read-only] User directed that files must never be edited during work in /home/byk/Code/institutional-transition-lab. 🔴 (05:03) User directed never to inspect governance bodies, codings, outcomes, reports, dates, detector output, or source-adjudication scopes. 🔴 (05:03) User limited issue #4 review scope to ZIP metadata and archive-structure validation: archive entry-count enforcement; duplicate raw names; normalized/path/case/backslash collisions; empty names; absolute paths; drive prefixes; parent traversal; directory entries; Unix/DOS mode metadata for symlink/device/FIFO/socket/special entries; encryption flags; unsupported compression methods; duplicate uniqueness of required member names; and inconsistencies visible from central-directory metadata. 🔴 (05:03) User explicitly excluded _read_regular_file, JSON, pins/hashes, decompression/read loops, required-member content equality, and CLI outputs from the audit scope. 🔴 (05:03) User identified only src/institution_lab/governance_adjudication.py ZIP metadata helpers/constants and narrowly related tests in tests/test_governance_adjudication.py as primary files. 🔴 (05:03) User requested review of the current unchanged working copy using narrow read-only tests/probes, with substantive nonempty evidence. 🔴 (05:03) User required findings first, severity ordering, exact current file:line references, and PASS/CONCERN/MUST-FIX/BLOCKED labels. 🔴 (05:03) [requested-tests] User required a deterministic regression for every defect; if clean, the report had to state PASS with tests/probes and residual risks. 🔴 (05:03) User required the audit response to end exactly MERGE or DO-NOT-MERGE. 🟡 (05:04) Initial search found ZIP limits in src/institution_lab/governance_adjudication.py: MAX_ARCHIVE_MEMBERS = 128 at line 67, MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024 at line 68, and MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024 at line 69. 🟡 (05:04) Initial source inspection found _verify_input_payloads() at src/institution_lab/governance_adjudication.py:157-208: it opens the artifact with zipfile.ZipFile(io.BytesIO(artifact)), obtains archive.infolist(), rejects len(infos) > MAX_ARCHIVE_MEMBERS, counts Counter(info.filename for info in infos), rejects counts other than 1, checks summed info.file_size, resolves required members documents.json and v1.2-adjudication-package.json through archive.getinfo(), checks each required member’s declared/read size and byte equality, and maps zipfile.BadZipFile to ValueError("artifact is not a valid ZIP archive"). 🟡 (05:04) Existing ZIP-related tests found in tests/test_governance_adjudication.py: test_input_manifest_rejects_duplicate_artifact_members() at lines 883-905 and test_input_manifest_rejects_excessive_artifact_member_count() at lines 908-928; test helper constant MAX_TEST_ARCHIVE_MEMBERS = 256 is at line 37. 🟡 (05:08) Direct pytest invocation was unavailable under Python 3.12.3: /usr/bin/bash: line 1: pytest: command not found. 🟡 (05:08) Located uv at /home/byk/.local/bin/uv; /tmp/opencode existed with mode drwxr-xr-x. 🟡 (05:09) A temporary virtual environment was created at /tmp/opencode/itl-zip-audit-venv using CPython 3.13.11; institutional-transition-lab was built from file:///home/byk/Code/institutional-transition-lab, and 12 packages were installed, including pytest-8.4.2, pluggy-1.6.0, ruff, and pygments. 🟡 (05:09) Focused test run collected 2 tests from tests/test_governance_adjudication.py; both passed in 0.17s. 🔴 (05:09) User requires forward slashes (/) to always be used as the directory separator. 🟡 (05:09) Python ZipInfo investigation showed both orig_filename and sanitized filename; _sanitize_filename() truncates at the first NUL and only converts platform separators to / when applicable. ZipInfo.is_dir() primarily recognizes trailing /, with platform-alt-separator compatibility. 🟡 (05:12) Direct ZipInfo probes showed names '', '/', '../x', '/x', 'C:/x', and 'x\\y' were accepted by construction; only '/' was identified as a directory by is_dir() on the tested Linux environment. 🟡 (05:15) zipfile.ZipFile.open() investigation showed local/central filename agreement, overlap, compressed-patch flag, strong-encryption flag, and encryption/password checks occur only when an entry is opened; _verify_input_payloads() opens only the two required members, leaving extra members unvalidated by those checks. 🟡 (05:15) Read-only boundary probe result: exactly 128 entries were accepted; 129 entries were rejected with ValueError: artifact member count exceeds limit. 🟡 (05:15) Read-only duplicate probe result: an exact duplicate required name was rejected with ValueError: artifact member is not unique: documents.json. 🟡 (05:15) Read-only collision probes were accepted for dot-segment collision, case collision, backslash collision, repeated-separator collision, and Unicode-normalization collision. 🟡 (05:15) Read-only path probes were accepted for an empty name, absolute POSIX name, absolute backslash name, drive-prefixed name, parent traversal, and a directory indicated by trailing slash. 🟡 (05:15) Read-only Unix metadata probes were accepted for symlink mode, character-device mode, block-device mode, FIFO mode, socket mode, and directory mode. 🟡 (05:15) Read-only DOS metadata probes were accepted for volume-label, directory, and device attributes. 🟡 (05:15) Read-only flag/compression probes were accepted for the traditional-encryption flag, strong-encryption flag, and unsupported compression method 99. 🟡 (05:15) Read-only central-metadata probes were accepted for a nonzero starting disk, unknown creator system, nonzero reserved extractor-system byte, and impossible extra-member local-header offset. 🟡 (05:15) Read-only identity/structure probes were accepted for local/central extra-member name mismatch, duplicate raw bytes with differing UTF-8 flags, and a NUL-suffixed required-member alias. 🟡 (05:16) Repository status output showed ?? src/institution_lab/governance_adjudication.py and ?? tests/test_governance_adjudication.py; no file edits were made by the audit. 🟡 (05:17) Search confirmed only four directly related test assertions: required-member byte mismatch at line 772, duplicate-name warning at line 889, duplicate-member rejection at line 896, and excessive-member-count rejection at line 919 of tests/test_governance_adjudication.py. 🟡 (05:19) Audited snapshot hashes were recorded: c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 for src/institution_lab/governance_adjudication.py, and abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 for tests/test_governance_adjudication.py. 🟡 (05:20) Recomputed hashes remained identical: source c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5; tests abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5. 🟡 (05:21) Python zipfile._RealGetContents() investigation showed central-directory names are decoded and placed into ZipInfo; ZipInfo sanitization occurs before filelist and NameToInfo storage, central fields such as create_system, reserved, flag_bits, compress_type, volume, external_attr, and header_offset are populated, but Python does not inherently reject every semantically inconsistent field. 🟡 (05:22) Python ZipInfo._decodeExtra() investigation showed Unicode Path Extra Field 0x7075 may replace self.filename with a sanitized UTF-8 alternate name when its CRC matches; malformed declared extra-field lengths are rejected, but trailing bytes shorter than a complete 4-byte extra-field header are ignored. 🟡 (05:23) Additional probes were accepted for a Unicode-path-extra required-name alias, duplicate Unicode-path extra fields, and trailing malformed central extra-field bytes. 🟡 (05:24) Additional EOCD probes were accepted when EOCD claimed one entry while the central directory contained three and when EOCD claimed nonzero disk numbers. 🟡 (05:24) Final audit finding 1 was labeled MUST-FIX — Raw member identity can be bypassed: src/institution_lab/governance_adjudication.py:184-187 counts Python-decoded/sanitized info.filename rather than raw central-directory filename bytes, while required members are resolved through the same sanitized identity at lines 190-198. 🟡 (05:24) Evidence for raw-identity bypass included acceptance of two entries with identical raw filename bytes but differing UTF-8 flags, documents.json\x00x sanitized to documents.json, a different raw name mapped to documents.json through a Unicode-path extra field, and duplicate Unicode-path extra fields. 🟡 (05:24) Recommended deterministic regressions for raw identity: construct byte-level archives and require stable ValueError rejection for duplicate raw names, NUL-containing names, alternate required-member identities, and duplicate path extra fields. 🟡 (05:24) Final audit finding 2 was labeled MUST-FIX — Unsafe paths and canonical collisions pass: the exact-string counter at src/institution_lab/governance_adjudication.py:184 performs no slash normalization, Unicode normalization, case folding, or path validation. 🟡 (05:24) Evidence for unsafe paths/collisions included accepted ./documents.json beside documents.json; DOCUMENTS.JSON beside documents.json; a/b with a\b, a//b, or Unicode-equivalent names; empty names; /absolute; \absolute; C:/drive; a/../../escape; and directory/. 🟡 (05:24) Recommended deterministic regressions for unsafe paths/collisions: parameterized rejection tests for empty, absolute, UNC/backslash-rooted, drive-relative, drive-absolute, dot-segment, parent-traversal, and directory names, plus collision pairs covering separators, case folding, and Unicode normalization. 🟡 (05:24) Final audit finding 3 was labeled MUST-FIX — Directory and special-file metadata is ignored: after infolist() at src/institution_lab/governance_adjudication.py:181, validation through line 200 checks names, counts, and sizes but not create_system, external_attr, Unix file types, or DOS attributes. 🟡 (05:24) Evidence for ignored file-type metadata included accepted entries marked as Unix symlink, character device, block device, FIFO, socket, and directory; DOS volume label, directory, and device; and unknown creator system. 🟡 (05:24) Recommended deterministic regressions for file-type metadata: parameterize every Unix file-type bit and DOS special attribute across creator-system values; allow only unambiguous regular-file metadata, and always reject directory names and directory mode bits. 🟡 (05:24) Final audit finding 4 was labeled MUST-FIX — Encrypted and unsupported entries pass: the full-entry scan at src/institution_lab/governance_adjudication.py:181-189 does not inspect flag_bits or compress_type, and only the two required members are opened at lines 194-202. 🟡 (05:24) Evidence for flag/compression gaps included accepted extra members carrying the traditional-encryption flag, strong-encryption flags, and unsupported compression method 99. 🟡 (05:24) Recommended deterministic regressions for flags/compression: patch central and local metadata for extra members and require rejection of every encryption-related flag and every compression method outside the declared archive-format allowlist. 🟡 (05:24) Final audit finding 5 was labeled MUST-FIX — Malformed archive structure is certified: code trusts archive.infolist() at src/institution_lab/governance_adjudication.py:181 and opens only required entries at lines 194-202, leaving central-directory structural inconsistencies unchecked. 🟡 (05:24) Evidence for malformed structure included acceptance of a member claiming a nonzero starting disk, EOCD records claiming nonzero disk numbers, EOCD claiming one entry while the central directory contained three, a nonzero reserved extractor-system byte, an impossible local-header offset, an unopened entry whose local and central names differed, and trailing malformed extra-field bytes. 🟡 (05:24) Recommended deterministic regressions for malformed structure: independently byte-patch inconsistent EOCD counts, disk fields, offsets, duplicate/overlapping offsets, malformed extra fields, and local/central name disagreement, requiring deterministic rejection for each. 🟡 (05:24) Final audit finding 6 was labeled CONCERN — Tests cover only coarse controls: tests cover one plain ASCII duplicate at tests/test_governance_adjudication.py:883-905 and excessive count at lines 908-928, but no ZipInfo, mode, path, flag, compression, raw-name, or central-structure cases. 🟡 (05:24) Test-boundary concern: MAX_TEST_ARCHIVE_MEMBERS = 256 at tests/test_governance_adjudication.py:37 differs from production MAX_ARCHIVE_MEMBERS = 128 at src/institution_lab/governance_adjudication.py:67, so the existing count test does not lock the exact boundary. 🟡 (05:24) Recommended count regression: derive cases from MAX_ARCHIVE_MEMBERS, asserting exactly 128 entries pass and 129 fail. 🟡 (05:24) Final audit confirmed PASS for more-than-128 entry rejection at src/institution_lab/governance_adjudication.py:182-183, with 128 accepted and 129 rejected. 🟡 (05:24) Final audit confirmed PASS for ordinary exact duplicate decoded-name rejection at src/institution_lab/governance_adjudication.py:184-187. 🟡 (05:24) Final audit confirmed both focused existing tests passed under Python 3.13.11: 2 passed. 🟡 (05:24) Final audit stated all generated archives remained in memory and no repository files were edited. 🟡 (05:24) Final merge recommendation was DO-NOT-MERGE.