Distillation

Date: Sep 9, 2026

• 🔴 (05:22) Terraform early-PR adjudication produced /tmp/opencode/terraform-prs-23-24.json with SHA-256 686498d196b306ce492b48f79a785aef5b6ecaa3b303a44e574885191ab5315a; repository files changed: none.
• 🔴 (05:22) terraform-github-pr-21345 was adjudicated accept from terra_advisory, classified effective_institutional_change / license. Evidence included the body statement: “Going forward Habitat installation will require users to accept Chef EULA.”, patch:2 requiring accept_license, and pr_metadata showing merge on 2019-08-05. Scope is limited to Terraform Habitat provisioner installations.
• 🔴 (05:22) terraform-github-pr-22332 was adjudicated accept from terra_advisory, classified control_event / license, with no power changes. Patches revert Terraform’s license-acceptance enforcement and documentation. The evidence never establishes a change to Chef’s underlying EULA rights or terms.
• 🔴 (05:22) Both early-PR graph-edge revisions were exact empty diffs against their accepted Terra responses.
• 🔴 (05:22) Early-PR validation reported all frozen hashes matched; only the two assigned complete source envelopes were inspected, in required order and before coding rows; no outcomes, transition dates, other records, or runtime validator were inspected. Draft 2020-12 validation with FormatChecker, record order, frozen-response identity, source IDs, evidence bounds, quote grounding, and graph-edge diffs all passed, yielding EVIDENCE-COMPLETE.
• 🟡 (05:22) Assistant began verifying the early-PR fragment’s exact bytes, accepted-response identity, and frozen-row contract while leaving the module under audit untouched.
• 🔴 (05:23) The isolated readjudication of terraform-github-pr-34103 stopped as BLOCKED after an unrelated-record memory summary surfaced while resolving fragment format, violating the strict one-record isolation rule. No performance or aggregate field was exposed; no fragment was written; /tmp/opencode/terraform-pr-34103-clean.json does not exist; no artifact hash or schema-validation result exists; repository files were not edited.
• 🔴 (05:23) PR 34103 frozen hashes matched: documents 2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce; coding package 14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769; protocol v1.2 06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933; coding schema bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e.
• 🔴 (05:23) PR 34103’s source-only provisional interpretation, recorded before opening the coding package, was control_event / product, with no institutional power edge. Evidence: body “Backport of update hcl v2.19.0 into v1.6”; body “dynblock.Expand now supports an optional hook for calling applications to check and potentially veto (by returning error diagnostics) particular for_each values.”; pr_metadata showed "merged": true, "merged_at": "2023-10-17T14:19:12Z", and "changed_files": 2.
• 🔴 (05:23) PR 34103 source bounds were preserved exactly: source text untruncated, file listing complete, patch selection untruncated, and zero unavailable patches. No implementing patch was supplied, limiting implementation-content verification.
• 🔴 (05:23) PR 34103’s coding projection exposed only record_id, model_responses[].response_name, record_class, event_kind, title, announced_on, effective_on, affected_scope, body_patch_relation, power_changes, confidence, and ambiguity; it exposed no package metadata or prohibited performance/aggregate field.
• 🟡 (05:23) Assistant determined the early-PR content was uncontaminated and replaced only the completed blocked PR 34103 review with a fresh single-record reviewer instructed to receive the fragment contract directly and never consult memory or other records.
• 🔴 (05:23) Repository fragment-contract validation of /tmp/opencode/terraform-prs-23-24.json confirmed IDs terraform-github-pr-21345 and terraform-github-pr-22332, both decisions accept, but failed because root properties adjudication_id, inputs, outcome_data_used, and transition_dates_excluded were forbidden additional properties.
• 🔴 (05:23) The invalid early-PR artifact declared schema_version: 1, design_status: performance_blinded_llm_assisted_source_adjudication, transition_dates_excluded: true, and outcome_data_used: false; its reviewer was opencode-gpt-5.6-sol-terraform-prs-23-24, model openai/gpt-5.6-sol, role source_adjudicator.
• 🔴 (05:23) The early-PR artifact’s recorded inputs included workflow_run_id: 33063470968, artifact_id: 9642983578, artifact SHA-256 1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06, documents SHA-256 d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9, documents-file SHA-256 2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce, coding-package SHA-256 14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769, protocol SHA-256 06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933, coding-schema SHA-256 bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e, and adjudication-schema SHA-256 6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31.
• 🟡 (05:23) Assistant returned the early-PR artifact to the same reviewer for a schema-only correction with record decisions and evidence frozen, and stated the invalid artifact would not enter the durable corpus.
• 🟡 (05:24) Background tasks ses_f7b8bff3effe3RoRLvPwOLRrkL and ses_f7b602677ffejQ4v0eLq6FrjNx were running with instructions not to poll, request status, duplicate their work, or overlap their files/topics.
• 🔴 (05:25) ZIP metadata audit found a raw-member-identity blocker in src/institution_lab/governance_adjudication.py:184-187: the code counts Python-decoded/sanitized info.filename and never checks the central-directory filename bytes; required members are resolved through the same sanitized names at :190-198.
• 🔴 (05:25) Raw-name probes reached the end of ZIP validation with: two entries having identical raw filename bytes but different UTF-8 flags; required member documents.json\x00x sanitized to documents.json; a different raw name mapped to documents.json through a Unicode-path extra field; and duplicate Unicode-path extra fields.
• 🔴 (05:25) Recommended raw-name regressions: construct archives byte-for-byte and require stable ValueError rejection for duplicate raw names, NUL-containing names, alternate required-member identities, and duplicate path extra fields.
• 🔴 (05:25) ZIP path validation at src/institution_lab/governance_adjudication.py:184 performs no slash normalization, Unicode normalization, case folding, or path validation. Accepted probes included ./documents.json beside documents.json; DOCUMENTS.JSON beside documents.json; a/b with a\b, a//b, or Unicode-equivalent names; empty names; /absolute; \absolute; C:/drive; a/../../escape; and directory/.
• 🔴 (05:25) Recommended ZIP path regressions: parameterized rejection tests for empty, absolute, UNC/backslash-rooted, drive-relative, drive-absolute, dot-segment, parent-traversal, and directory names, plus collision pairs covering separators, case folding, and Unicode normalization.
• 🔴 (05:25) ZIP metadata handling after infolist() at src/institution_lab/governance_adjudication.py:181 inspects only names, counts, and sizes through :200; it never checks create_system, external_attr, Unix file types, or DOS attributes.
• 🔴 (05:25) ZIP probes accepted entries marked as Unix symlink, character device, block device, FIFO, socket, and directory; DOS volume label, directory, and device; and unknown creator system.
• 🔴 (05:25) Recommended metadata regressions: parameterize every Unix file-type bit and DOS special attribute across creator-system values; only unambiguous regular-file metadata should pass, while directory names and directory mode bits must always fail.
• 🔴 (05:25) The full ZIP-entry scan at src/institution_lab/governance_adjudication.py:181-189 never checks flag_bits or compress_type. Because only the two required entries are opened at :194-202, malformed extra entries remain unchecked.
• 🔴 (05:25) ZIP probes accepted extra members with the traditional-encryption flag, strong-encryption flags, and unsupported compression method 99.
• 🔴 (05:25) Recommended encryption/compression regressions: patch central and local metadata for extra members and reject every encryption-related flag and every compression method outside the declared archive-format allowlist.
• 🔴 (05:25) ZIP validation accepts malformed archive structure because no code validates central-directory structural fields before accepting the ZIP block. Accepted probes included: a member claiming a nonzero starting disk; EOCD records claiming nonzero disk numbers; EOCD claiming one entry while the central directory contained three; a nonzero reserved extractor-system byte; an impossible local-header offset; an unopened entry whose local and central names differed; and trailing malformed extra-field bytes.
• 🔴 (05:25) Recommended structural regressions: byte-patch each field independently and require deterministic rejection, including inconsistent EOCD counts, disk fields, offsets, duplicate/overlapping offsets, malformed extra fields, and local/central name disagreement.
• 🔴 (05:25) Existing ZIP tests cover only one plain-ASCII duplicate at tests/test_governance_adjudication.py:883-905 and excessive count at :908-928; they contain no ZipInfo, mode, path, flag, compression, raw-name, or central-structure cases.
• 🔴 (05:25) The ZIP count test hardcodes 256 at tests/test_governance_adjudication.py:37, while production uses 128 at src/institution_lab/governance_adjudication.py:67. Recommended regression: derive boundaries from MAX_ARCHIVE_MEMBERS and assert exactly 128 entries pass while 129 fail.
• 🔴 (05:25) Confirmed ZIP controls: src/institution_lab/governance_adjudication.py:182-183 rejects more than 128 parsed central-directory entries, with 128 accepted and 129 rejected; :184-187 rejects ordinary exact duplicate decoded names; both focused existing tests passed under Python 3.13.11 (2 passed).
• 🔴 (05:25) ZIP audit generated all archives in memory and edited no repository files. Audited snapshot hashes: source c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5; tests abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5. Overall verdict: DO-NOT-MERGE.
• 🟡 (05:25) Assistant grouped the ZIP metadata audit into five blockers: 1. raw-name identity, 2. unsafe path collisions, 3. special-file metadata, 4. encryption/compression flags, and 5. malformed central-directory structure. Fixes remained deferred pending active JSON/pin and ZIP stream audits; the existing single follow-up remained scheduled.