Distillation

Date: Sep 9, 2026

• 🔴 [requested-review] (03:03) User requested a fresh, read-only security review of issue #4 in /home/byk/Code/institutional-transition-lab, strictly limited to the immutable frozen-input and ZIP/archive verification boundary; this replaces a reviewer that returned an empty result twice.
• 🔴 (03:03) User directed that no files be edited and that the current working-copy implementation be reviewed rather than an older hash.
• 🔴 (03:03) User prohibited inspection or adjudication of governance source records, model codings, outcomes, transition dates, reports, detector output, and all active source-review scope.
• 🔴 (03:03) User stated to never inspect document bodies or codings; cases/review/oss-governance-adjudication-v1.inputs.json and ZIP metadata may be inspected only as needed.
• 🔴 (03:03) User limited review scope to: immutable one-read byte capture and same-byte hash/parse use; strict JSON parsing for the input manifest and verified JSON payloads; manifest shape, duplicate keys, non-finite values, immutable pin checks and ordering; regular-file/symlink/FIFO handling and input byte/resource limits; ZIP member uniqueness, path/name normalization, entry count, compressed/expanded size checks, exact required-member byte comparison; and corresponding security regressions.
• 🔴 (03:03) User identified primary files as src/institution_lab/governance_adjudication.py and provenance-focused tests in tests/test_governance_adjudication.py.
• 🔴 (03:03) User requested narrow read-only tests/probes where useful and asked whether earlier TOCTOU, malformed-manifest, duplicate-ZIP, FIFO, and resource-exhaustion findings are fully fixed, including identification of any remaining bypasses within scope.
• 🔴 (03:03) User required a substantive result—never an empty result—with findings first, ordered by severity, each classified PASS, CONCERN, MUST-FIX, or BLOCKED, and with exact current file:line references.
• 🔴 [requested-tests] (03:03) User required every identified defect to include a deterministic regression.
• 🔴 (03:03) User required that if no defect exists, the review explicitly state PASS, list the tests/probes relied upon, and identify residual risks.
• 🔴 (03:03) User required tool failures to be reported first as BLOCKED with the exact tool/error and a final verdict of DO-NOT-MERGE.
• 🔴 (03:03) User required the review’s final line to be exactly MERGE or DO-NOT-MERGE.
• 🟡 (03:03) Assistant committed to inspect only frozen-input/ZIP code and provenance regressions, run isolated tests and adversarial probes with repository writes disabled, and not open frozen document or coding bodies.
• 🟡 (03:04) Repository inspection confirmed /home/byk/Code/institutional-transition-lab contains .git/, .github/, .pytest_cache/, .ruff_cache/, .venv/, cases/, data/, docs/, research/, schema/, scripts/, src/, tests/, AGENTS.md, PROTOCOL.md, README.md, pyproject.toml, package.json, package-lock.json, and uv.lock.
• 🟡 (03:04) Search found frozen-input/ZIP boundary constants in src/institution_lab/governance_adjudication.py: MAX_INPUT_BYTES = 16 * 1024 * 1024 at line 65, MAX_ARTIFACT_BYTES = 32 * 1024 * 1024 at line 66, MAX_ARCHIVE_MEMBERS = 128 at line 67, MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024 at line 68, and MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024 at line 69.
• 🟡 (03:05) Inspection found VerifiedInputBundle is a frozen dataclass at src/institution_lab/governance_adjudication.py:72-77, holding pins, documents, coding_package, and adjudication_schema.
• 🟡 (03:05) Inspection found _read_regular_file() at src/institution_lab/governance_adjudication.py:94-109 opens with os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0), uses os.fstat() to require stat.S_ISREG, rejects st_size > max_bytes, reads at most max_bytes + 1, and rejects an over-limit read.
• 🟡 (03:05) Inspection found file_sha256() at src/institution_lab/governance_adjudication.py:112-113 hashes bytes returned by _read_regular_file(path, max_bytes=MAX_ARTIFACT_BYTES).
• 🟡 (03:05) Inspection found strict JSON helpers in src/institution_lab/governance_adjudication.py: _reject_duplicate_keys() at lines 116-122 rejects repeated keys; _reject_non_finite_number() at lines 125-126 rejects non-finite constants; _parse_json_object() at lines 129-140 uses json.loads(..., object_pairs_hook=_reject_duplicate_keys, parse_constant=_reject_non_finite_number) and requires a top-level object.
• 🟡 (03:05) Inspection found _parse_json_object() catches only UnicodeDecodeError and json.JSONDecodeError at src/institution_lab/governance_adjudication.py:136-137; ValueError raised by duplicate-key and non-finite-number hooks propagates directly.
• 🟡 (03:05) Inspection found _validate_manifest_identity() at src/institution_lab/governance_adjudication.py:143-154 requires a dict with keys exactly equal to REQUIRED_INPUT_PINS, requires positive exact-int values for workflow_run_id and artifact_id, and compares every field against FROZEN_INPUT_PINS.
• 🟡 (03:05) Inspection found REQUIRED_INPUT_PINS at src/institution_lab/governance_adjudication.py:30-40 contains exactly 9 fields: workflow_run_id, artifact_id, artifact_sha256, documents_sha256, documents_file_sha256, coding_package_file_sha256, protocol_sha256, coding_schema_sha256, and adjudication_schema_sha256.
• 🟡 (03:05) Inspection found _verify_input_payloads() at src/institution_lab/governance_adjudication.py:157-217 first validates immutable manifest identity, then hashes already-supplied byte payloads for the artifact, documents, coding package, protocol, coding schema, and adjudication schema and compares them to manifest values before opening/parsing payloads.
• 🟡 (03:05) Inspection found ZIP verification at src/institution_lab/governance_adjudication.py:179-208 uses zipfile.ZipFile(io.BytesIO(artifact)), rejects more than MAX_ARCHIVE_MEMBERS, counts exact info.filename strings to reject duplicates, rejects total declared expanded size above MAX_ARCHIVE_EXPANDED_BYTES, locates exact required names documents.json and v1.2-adjudication-package.json, rejects required members whose declared or read size exceeds MAX_ARCHIVE_MEMBER_BYTES, and byte-compares each required member against the separately captured durable bytes.
• 🟡 (03:05) Inspection showed the ZIP code at src/institution_lab/governance_adjudication.py:180-206 performs uniqueness using raw info.filename values and exact required-name lookups; no explicit ZIP member path/name normalization or compressed-size limit was visible in the inspected section.
• 🟡 (03:05) Inspection found documents bytes are strictly parsed and canonically hashed at src/institution_lab/governance_adjudication.py:209-211; coding-package and adjudication-schema bytes are strictly parsed for the returned bundle at lines 212-217.
• 🟡 (03:05) Inspection found verify_input_manifest() at src/institution_lab/governance_adjudication.py:220-239 validates manifest identity before reading inputs, captures each input through _read_regular_file(), and passes captured bytes into _verify_input_payloads().
• 🟡 (03:05) Inspection found CLI main() at src/institution_lab/governance_adjudication.py:882-934 reads and strictly parses the adjudication and input manifest once, reads artifact/documents/coding package/protocol/coding schema/adjudication schema once into bytes, verifies through _verify_input_payloads(), then validates using the verified bundle.
• 🟡 (03:05) Inspection found provenance tests in tests/test_governance_adjudication.py covering immutable-pin substitutions, changed file bytes, files not from the pinned artifact, a verification-time mutation/TOCTOU case, input/output aliasing via direct path/symlink/hardlink, duplicate manifest keys, non-object manifests, duplicate ZIP members, excessive ZIP member count, FIFO rejection without blocking, non-finite JSON values, and committed frozen-input-manifest verification.
• 🟡 (03:05) Test helper _write_pinned_cli_inputs() at tests/test_governance_adjudication.py:40-84 creates synthetic documents.json, coding package, protocol, schemas, and an artifact containing documents.json plus v1.2-adjudication-package.json; it calculates hashes and monkeypatches governance_adjudication.FROZEN_INPUT_PINS.
• 🟡 (03:05) Test constant MAX_TEST_ARCHIVE_MEMBERS = 256 is defined at tests/test_governance_adjudication.py:37.
• 🟡 (03:12) The committed manifest cases/review/oss-governance-adjudication-v1.inputs.json:1-11 contains exactly 9 immutable pins: workflow_run_id=33063470968, artifact_id=9642983578, artifact_sha256=1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06, documents_sha256=d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9, documents_file_sha256=2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce, coding_package_file_sha256=14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769, protocol_sha256=06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933, coding_schema_sha256=bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e, and adjudication_schema_sha256=6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31.
• 🟡 (03:13) Inspection found _paths_alias() and _validate_output_paths() at src/institution_lab/governance_adjudication.py:828-841 use Path.samefile() where possible and resolved paths otherwise to reject outputs aliasing any input or each other.
• 🟡 (03:13) Inspection found _atomic_write() at src/institution_lab/governance_adjudication.py:844-856 creates a temporary file in the destination directory with tempfile.mkstemp(), writes and flushes, calls os.fsync(), and replaces the destination with os.replace(), cleaning up the temporary file on failure.
• 🟡 (03:13) No final security classification, executed test/probe results, deterministic new regression, or MERGE/DO-NOT-MERGE verdict had yet been produced in the observed segment.