Dashboard › institutional-transition-lab › Session 0seXxhTpLwXa
0seXxhTpLwXa3dhZkPerform a fresh, read-only security review of ONLY the immutable frozen-input and ZIP/archive verification boundary for issue #4 in /home/byk/Code/institutional-transition-lab. This replaces a reviewer that returned empty twice. Do not edit files. Do not inspect or adjudicate governance source records, model codings, outcomes, transition dates, reports, detector output, or any active source-review scope.
Scope is strictly limited to:
Primary files: src/institution_lab/governance_adjudication.py and the provenance-focused tests in tests/test_governance_adjudication.py. You may inspect cases/review/oss-governance-adjudication-v1.inputs.json and ZIP metadata only as needed, but never inspect document bodies/codings.
Review the current working-copy implementation, not an older hash. Run narrow read-only tests/probes where useful. Check whether the earlier TOCTOU, malformed-manifest, duplicate ZIP, FIFO, and resource-exhaustion findings are fully fixed and identify any bypasses in this scope.
Return substantive evidence, never an empty result. Findings first, ordered by severity, each classified PASS, CONCERN, MUST-FIX, or BLOCKED with exact current file:line references. Every defect must include a deterministic regression. If no defect exists, state PASS explicitly and list the tests/probes you relied on plus residual risks. End the final line exactly MERGE or DO-NOT-MERGE. If tools prevent review, report BLOCKED first with the exact tool/error and end DO-NOT-MERGE.
I’ll inspect only the frozen-input/ZIP code and its provenance regressions, then run isolated tests and adversarial probes with repository writes disabled. I will not open frozen document or coding bodies.
<path>/home/byk/Code/institutional-transition-lab</path> <type>directory</type> <entries> .git/ .github/ .gitignore .lore.md .pytest_cache/ .ruff_cache/ .venv/ AGENTS.md cases/ data/ docs/ node_modules/ package-lock.json package.json PROTOCOL.md pyproject.toml README.md research/ schema/ scripts/ src/ tests/ uv.lock (23 entries) </entries>
Found 63 matches
/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py:
Line 10: import zipfile
Line 65: MAX_INPUT_BYTES = 16 * 1024 * 1024
Line 66: MAX_ARTIFACT_BYTES = 32 * 1024 * 1024
Line 67: MAX_ARCHIVE_MEMBERS = 128
Line 68: MAX_ARCHIVE_MEMBER_BYTES = 16 * 1024 * 1024
Line 69: MAX_ARCHIVE_EXPANDED_BYTES = 64 * 1024 * 1024
Line 73: class VerifiedInputBundle:
Line 94: def _read_regular_file(path: Path, *, max_bytes: int = MAX_INPUT_BYTES) -> bytes:
Line 113: return _bytes_sha256(_read_regular_file(path, max_bytes=MAX_ARTIFACT_BYTES))
Line 143: def _validate_manifest_identity(manifest: Any) -> None:
Line 144: if not isinstance(manifest, dict):
Line 145: raise ValueError("input manifest must be an object")
Line 146: if set(manifest) != REQUIRED_INPUT_PINS:
Line 147: raise ValueError("input manifest has missing or unexpected keys")
Line 148: if type(manifest.get("workflow_run_id")) is not int or ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
860: message = str(error)
861: summary = {
862: "schema_version": 1,
863: "canonicalization_gate": "closed",
864: "validation_errors": [message],
865: }
866: markdown = "\n".join(
867: [
868: "# OSS governance adjudication v1",
869: "",
870: "Canonicalization gate: **closed**",
871: "",
872: "## Validation errors",
873: "",
874: f"- {message}",
875: "",
876: ]
877: )
878: _atomic_write(summary_json, json.dumps(summary, indent=2, sort_keys=True) + "\n")
879: _atomic_write(summary_markdown, markdown)
880:
881:
882: def main() -> None:
883: parser = argparse.ArgumentParser(description="Validate frozen governance adjudication")
884: parser.add_argument("--adjudication", type=Path, required=True)
885: parser.add_argument("--input-manifest", type=Path, required=True)
886: parser.add_argument("--documents", ...
Found 67 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 8: import zipfile
Line 25: verify_input_manifest,
Line 49: "input_manifest": tmp_path / "inputs.json",
Line 65: with zipfile.ZipFile(paths["artifact"], "w") as archive:
Line 71: manifest = {
Line 82: paths["input_manifest"].write_text(json.dumps(manifest))
Line 83: monkeypatch.setattr(governance_adjudication, "FROZEN_INPUT_PINS", dict(manifest))
Line 84: return manifest, paths
Line 91: "input_manifest",
Line 652: def test_input_manifest_rejects_self_consistent_substitute(field: str) -> None:
Line 653: manifest = {
Line 657: value = manifest[field]
Line 658: manifest[field] = value + 1 if isinstance(value, int) else "f" * 64
Line 661: verify_input_manifest(
Line 662: manifest,
Line 683: def test_input_manifest_rejects_changed_file_bytes(
Line 703: with zipfile.ZipFile(artifact, "w") as archive:
Line 708: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert summary["canonicalization_gate"] == "closed"
642:
643:
644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31"
648: )
649:
650:
651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
652: def ...
<path>/home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json</path>
<type>file</type>
<content>
1: {
2: "adjudication_schema_sha256": "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31",
3: "artifact_id": 9642983578,
4: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
5: "coding_package_file_sha256": "14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769",
6: "coding_schema_sha256": "bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e",
7: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
8: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
9: "protocol_sha256": "06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933",
10: "workflow_run_id": 33063470968
11: }
(End of file - total 11 lines)
</content>
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
770: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
771: validator = Draft202012Validator(schema, format_checker=FormatChecker())
772: return [
773: f"schema {'.'.join(str(part) for part in error.absolute_path) or '<root>'}: "
774: f"{error.message}"
775: for error in sorted(validator.iter_errors(adjudication), key=lambda item: list(item.path))
776: ]
777:
778:
779: def render_markdown(adjudication: dict[str, Any], summary: dict[str, Any]) -> str:
780: lines = [
781: "# OSS governance adjudication v1",
782: "",
783: f"Canonicalization gate: **{summary['canonicalization_gate']}**",
784: "",
785: "## Decisions",
786: "",
787: ]
788: for decision, count in summary["decision_counts"].items():
789: lines.append(f"- `{decision}`: {count}")
790: lines.extend(["", "## Final classes", ...
Found 2 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31" Line 955: def test_canonical_sha256_rejects_non_finite_numbers(value: float) -> None:
artifact_bytes=423046 members=19 expanded=1993647 compressed=420552 'documents.json' file_size= 445940 compress_size= 120892 method= 8 flags= 8 mode= 0o100644 is_dir= False 'luna-a.json' file_size= 56076 compress_size= 7161 method= 8 flags= 8 mode= 0o100644 is_dir= False 'luna-b.json' file_size= 52967 compress_size= 6651 method= 8 flags= 8 mode= 0o100644 is_dir= False 'adjudication-package.json' file_size= 149490 compress_size= 13779 method= 8 flags= 8 mode= 0o100644 is_dir= False 'preliminary-package.json' file_size= 107543 compress_size= 10349 method= 8 flags= 8 mode= 0o100644 is_dir= False 'preliminary-summary.json' file_size= 707 compress_size= 353 method= 8 flags= 8 mode= 0o100644 is_dir= False 'preliminary-summary.md' file_size= 543 compress_size= 311 method= 8 flags= 8 mode= 0o100644 is_dir= False 'summary.json' file_size= 703 compress_size= 351 method= 8 flags= 8 mode= 0o100644 is_dir= False 'summary.md' file_size= 542 compress_size= 309 method= 8 flags= 8 mode= 0o100644 ...
.............................................. [100%] 46 passed in 0.38s
File "<string>", line 1
import math; from institution_lab.governance_adjudication import _parse_json_object; value = _parse_json_object(b"{\"value\":1e400}", "synthetic payload"); print(f"accepted={value!r} finite={math.isfinite(value[\"value\"])}")
^
SyntaxError: unexpected character after line continuation character
{'value': inf} False
accepted unsafe/colliding member names: True
accepted required member marked as symlink: True
drwxr-xr-x 3 byk byk 4096 Sep 9 02:45 /tmp/opencode
declared_extra_compressed_size= 33554433 physical_archive_size= 391 accepted= True
?? cases/review/oss-governance-adjudication-v1.inputs.json ?? cases/review/oss-governance-adjudication-v1/artifact-9642983578.zip ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
Found 8 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 661: verify_input_manifest( Line 726: verify_input_manifest(manifest, **paths) Line 773: verify_input_manifest(manifest, **paths) Line 872: verify_input_manifest( Line 897: verify_input_manifest( Line 920: verify_input_manifest( Line 966: verified = verify_input_manifest( /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 220: def verify_input_manifest(
Found 14 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None: Line 652: def test_input_manifest_rejects_self_consistent_substitute(field: str) -> None: Line 673: def test_frozen_input_identifiers_are_reverified(field: str) -> None: Line 683: def test_input_manifest_rejects_changed_file_bytes( Line 729: def test_input_manifest_rejects_files_not_from_pinned_artifact( Line 776: def test_cli_validates_the_same_bytes_it_verifies( Line 814: def test_cli_rejects_output_aliases_to_frozen_inputs( Line 836: def test_cli_rejects_aliased_outputs( Line 848: def test_cli_rejects_duplicate_manifest_keys( Line 870: def test_input_manifest_rejects_non_object() -> None: Line 883: def test_input_manifest_rejects_duplicate_artifact_members( Line 908: def test_input_manifest_rejects_excessive_artifact_member_count( Line 931: def ...
1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06 cases/review/oss-governance-adjudication-v1/artifact-9642983578.zip 2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce cases/review/oss-governance-adjudication-v1/documents.json 14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769 cases/review/oss-governance-adjudication-v1/v1.2-coding-package.json 06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933 research/oss-governance-coding-protocol-v1.2.md bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e schema/governance-coding-v1.schema.json 6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31 schema/governance-adjudication-v1.schema.json
error=artifact member count exceeds limit; ZipInfo_objects_constructed_before_rejection=129
encrypted_flag= 1 accepted= True
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
620: assert any("reviewer_ids must be unique" in error for error in errors)
621: assert summary["canonicalization_gate"] == "closed"
622:
623:
624: def test_malformed_reviewer_id_does_not_crash_manual_validation() -> None:
625: adjudication = _adjudication()
626: adjudication["records"][0]["reviewer_ids"] = [{"invalid": "reviewer"}]
627:
628: errors, summary = _validate(adjudication)
629:
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
810: lines.extend(["", "## Reviewer provenance", ""])
811: for reviewer in summary["reviewer_provenance"]:
812: model = reviewer.get("model") or "none"
813: lines.append(
814: f"- `{reviewer['reviewer_id']}`: {reviewer['reviewer_type']}, "
815: f"`{model}`, {reviewer['role']}; {reviewer['assistance']}"
816: )
817: lines.extend(["", "## Graph-edge revisions", ""])
818: for revision in summary["graph_edge_revisions"]:
819: added = len(revision.get("added", []))
820: removed = len(revision.get("removed", []))
821: if added or removed:
822: lines.append(f"- `{revision['record_id']}`: {added} added, {removed} removed")
823: if lines[-1] == "":
824: lines.append("- None")
825: return "\n".join(lines) + "\n"
826:
827:
828: def _paths_alias(first: Path, second: Path) -> bool:
829: try:
830: return first.samefile(second)
831: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
Your prior result was empty. Complete the same read-only immutable-input/archive security review now and return either substantive evidence or an explicit blocker. Do not edit files. Scope remains strictly limited to immutable one-read byte capture; same-byte hash/parse use; strict JSON manifest and payload parsing; manifest shape, duplicate keys, non-finite values, pin checks and ordering; regular-file/symlink/FIFO behavior and resource limits; ZIP uniqueness/name/path/count/size checks and exact member-byte comparison; and corresponding tests in src/institution_lab/governance_adjudication.py and tests/test_governance_adjudication.py. Do not inspect governance record bodies, codings, outcomes, reports, detector output, or active source-adjudication scopes. Review the current unchanged working copy. Findings first with exact current file:line evidence; classify PASS, CONCERN, MUST-FIX, or BLOCKED; include a deterministic regression for every defect; state tests/probes run. Never return empty. End exactly MERGE or DO-NOT-MERGE.
I’m rerunning the scoped provenance tests with cache and bytecode writes disabled, then I’ll report the confirmed bypasses and exact regressions.
============================= test session starts ============================== platform linux -- Python 3.13.11, pytest-8.4.2, pluggy-1.6.0 rootdir: /home/byk/Code/institutional-transition-lab configfile: pyproject.toml plugins: anyio-4.14.2 collected 78 items / 50 deselected / 28 selected tests/test_governance_adjudication.py ............................ [100%] ====================== 28 passed, 50 deselected in 0.39s =======================
The focused suite passes. I confirmed that passing coverage does not close three archive/JSON gaps, so I’m checking the exact branches and line ranges before assigning severity.
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
620: assert any("reviewer_ids must be unique" in error for error in errors)
621: assert summary["canonicalization_gate"] == "closed"
622:
623:
624: def test_malformed_reviewer_id_does_not_crash_manual_validation() -> None:
625: adjudication = _adjudication()
626: adjudication["records"][0]["reviewer_ids"] = [{"invalid": "reviewer"}]
627:
628: errors, summary = _validate(adjudication)
629:
630: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
631: assert summary["canonicalization_gate"] == "closed"
632:
633:
634: def test_every_input_pin_is_reverified() -> None:
635: adjudication = _adjudication()
636: adjudication["inputs"]["artifact_sha256"] = "wrong"
637:
638: errors, summary = _validate(adjudication)
639:
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert ...
* 🟡 (03:58) Focused pytest run used Python 3.13.11, pytest 8.4.2, pluggy 1.6.0, and anyio 4.14.2; collected 78 tests, deselected 50, selected 28, and finished with `28 passed, 50 deselected in 0.39s`. * 🟡 (03:58) Assistant stated that the passing focused suite did not close three archive/JSON security gaps and was checking exact branches and line ranges before assigning severity. * 🟡 (03:59) `…
* 🟡 (03:33) Security probe found an archive with 129 members was rejected with `error=artifact member count exceeds limit`; `ZipInfo_objects_constructed_before_rejection=129`, showing rejection occurs after `archive.infolist()` constructs metadata for all 129 members. * 🟡 (03:38) Security probe reported `encrypted_flag= 1 accepted= True`, indicating a ZIP member marked encrypted was accepted by…
* 🟡 (03:29) SHA-256 verification output reported `1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06` for `cases/review/oss-governance-adjudication-v1/artifact-9642983578.zip`. * 🟡 (03:29) SHA-256 verification output reported `2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce` for `cases/review/oss-governance-adjudication-v1/documents.json`. * 🟡 (03:29) SHA-256 ver…
Date: September 9, 2026 * 🟡 (03:28) Search found 14 test definitions in `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py`: line `644` `test_frozen_pins_include_the_versioned_adjudication_schema`; line `652` `test_input_manifest_rejects_self_consistent_substitute`; line `673` `test_frozen_input_identifiers_are_reverified`; line `683` `test_input_manifest_rejects_…
* 🟡 (03:26) Search found 8 references to `verify_input_manifest`: definition at `/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py:220`; calls/usages at `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` lines `661`, `726`, `773`, `872`, `897`, `920`, and `966`.
* 🟡 (03:21) Adversarial ZIP probe declared an extra member with `compressed_size=33554433` bytes while the physical archive was only `391` bytes; the verifier returned `accepted=True`, confirming declared compressed-size limits can be bypassed with forged ZIP metadata. * 🟡 (03:22) `git status` showed 4 untracked paths: `cases/review/oss-governance-adjudication-v1.inputs.json`, `cases/review/oss…
Date: Sep 9, 2026 * 🟡 (03:14) Search in `tests/test_governance_adjudication.py` found 2 matches: line 647 contains adjudication-schema hash `6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31`; line 955 defines `test_canonical_sha256_rejects_non_finite_numbers(value: float)`. * 🟡 (03:14) ZIP metadata probe of the committed artifact reported `artifact_bytes=423046`, `members=19`, `…
Date: Sep 9, 2026 * 🔴 [requested-review] (03:03) User requested a fresh, read-only security review of issue #4 in `/home/byk/Code/institutional-transition-lab`, strictly limited to the immutable frozen-input and ZIP/archive verification boundary; this replaces a reviewer that returned an empty result twice. * 🔴 (03:03) User directed that no files be edited and that the current working-copy impl…