Dashboard › institutional-transition-lab › Session 0yGAnpNlrOvB
0yGAnpNlrOvBQqxq2Perform a read-only adversarial security/provenance audit of ONLY the frozen-input trust boundary for issue #4 in /home/byk/Code/institutional-transition-lab. Review current uncommitted code and tests in: src/institution_lab/governance_adjudication.py functions/constants concerned with canonical_sha256, file_sha256, verify_input_manifest, FROZEN_INPUT_PINS, REQUIRED_INPUT_PINS, ZIP member verification, and CLI input-path trust; schema/governance-adjudication-v1.schema.json only where it governs input pins; tests/test_governance_adjudication.py only tests of those areas; cases/review/oss-governance-adjudication-v1.inputs.json. Do NOT inspect or adjudicate governance source records, codings, performance outcomes, transition dates, detector outputs, reports, or active source-review scopes. Do NOT edit files. Look for substitution attacks, path/ZIP ambiguity, self-consistent forged bundles, canonicalization flaws, unsafe resource handling, missing fail-closed behavior, or untested trust assumptions. Run narrow tests or construct deterministic in-memory/adversarial checks if useful, but do not mutate repository files. Return a substantive report even if no defects: findings first by severity with exact current file:line evidence, classify each PASS/CONCERN/MUST-FIX, include a deterministic regression proposal for each defect, state commands run, and end exactly MERGE or DO-NOT-MERGE. If blocked, report BLOCKED first with exact tool/error. This replaces a twice-empty broad validator auditor and must remain within this smaller scope.
<path>/home/byk/Code/institutional-transition-lab</path> <type>directory</type> <entries> .git/ .github/ .gitignore .lore.md .pytest_cache/ .ruff_cache/ .venv/ AGENTS.md cases/ data/ docs/ node_modules/ package-lock.json package.json PROTOCOL.md pyproject.toml README.md research/ schema/ scripts/ src/ tests/ uv.lock (23 entries) </entries>
Found 31 matches
/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py:
Line 6: import zipfile
Line 24: REQUIRED_INPUT_PINS = {
Line 29: "documents_file_sha256",
Line 30: "coding_package_file_sha256",
Line 35: FROZEN_INPUT_PINS = {
Line 40: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
Line 41: "coding_package_file_sha256": (
Line 61: def canonical_sha256(value: Any) -> str:
Line 66: def file_sha256(path: Path) -> str:
Line 74: def verify_input_manifest(
Line 84: if set(manifest) != REQUIRED_INPUT_PINS:
Line 90: for field, value in FROZEN_INPUT_PINS.items():
Line 94: "artifact_sha256": file_sha256(artifact),
Line 95: "documents_file_sha256": file_sha256(documents),
Line 96: "coding_package_file_sha256": file_sha256(coding_package),
Line 97: "protocol_sha256": file_sha256(protocol),
Line 98: "coding_schema_sha256": ...
Found 63 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 5: import zipfile
Line 12: FROZEN_INPUT_PINS,
Line 13: REQUIRED_INPUT_PINS,
Line 19: verify_input_manifest,
Line 155: "inputs": {
Line 160: "documents_file_sha256": "1" * 64,
Line 161: "coding_package_file_sha256": "2" * 64,
Line 204: "documents_file_sha256": "1" * 64,
Line 205: "coding_package_file_sha256": "2" * 64,
Line 215: from institution_lab.governance_adjudication import canonical_sha256
Line 217: documents_hash = canonical_sha256(documents)
Line 219: adjudication["inputs"]["documents_sha256"] = documents_hash
Line 344: from institution_lab.governance_adjudication import canonical_sha256
Line 346: documents_hash = canonical_sha256(documents)
Line 348: adjudication["inputs"]["documents_sha256"] = documents_hash
Line 549: adjudication["inputs"]["artifact_sha256"] = "wrong"
Line 558: assert ...
Found 42 matches
/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json:
Line 6: "additionalProperties": false,
Line 7: "required": [
Line 13: "inputs",
Line 25: "inputs": {"$ref": "#/$defs/inputs"},
Line 39: "inputs": {
Line 41: "additionalProperties": false,
Line 42: "required": [
Line 45: "artifact_sha256",
Line 46: "documents_sha256",
Line 47: "documents_file_sha256",
Line 48: "coding_package_file_sha256",
Line 49: "protocol_sha256",
Line 50: "coding_schema_sha256",
Line 51: "adjudication_schema_sha256"
Line 56: "artifact_sha256": {"$ref": "#/$defs/sha256"},
Line 57: "documents_sha256": {"$ref": "#/$defs/sha256"},
Line 58: "documents_file_sha256": {"$ref": "#/$defs/sha256"},
Line 59: "coding_package_file_sha256": {"$ref": "#/$defs/sha256"},
Line 60: "protocol_sha256": ...
<path>/home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json</path>
<type>file</type>
<content>
1: {
2: "adjudication_schema_sha256": "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31",
3: "artifact_id": 9642983578,
4: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
5: "coding_package_file_sha256": "14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769",
6: "coding_schema_sha256": "bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e",
7: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
8: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
9: "protocol_sha256": "06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933",
10: "workflow_run_id": 33063470968
11: }
(End of file - total 11 lines)
</content>
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import json
6: import zipfile
7: from collections import Counter
8: from pathlib import Path
9: from typing import Any
10:
11: from jsonschema import Draft202012Validator, FormatChecker
12:
13: from institution_lab.governance_coding import validate_response
14:
15: DECISIONS = {"accept", "revise", "reject", "abstain"}
16: INSTITUTIONAL_CLASSES = {
17: "effective_institutional_change",
18: "announced_institutional_change",
19: "proposal_only",
20: }
21: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
22: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
23: RESPONSE_SOURCES = {"luna_a", "luna_b", "terra_advisory"}
24: REQUIRED_INPUT_PINS = {
25: "workflow_run_id",
26: "artifact_id",
27: "artifact_sha256",
28: "documents_sha256",
29: ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
388: errors.append(f"{prefix}: graph_edge_revision.removed is not derived")
389: return errors
390:
391:
392: def validate_adjudication(
393: adjudication: dict[str, Any],
394: documents: dict[str, Any],
395: coding_package: dict[str, Any],
396: *,
397: verified_pins: dict[str, str],
398: ) -> tuple[list[str], dict[str, Any]]:
399: errors: list[str] = []
400: if adjudication.get("transition_dates_excluded") is not True:
401: errors.append("transition_dates_excluded must be true")
402: if adjudication.get("outcome_data_used") is not False:
403: errors.append("outcome_data_used must be false")
404: inputs = adjudication.get("inputs")
405: if not isinstance(inputs, dict):
406: inputs = {}
407: errors.append("inputs must be an object")
408: for pin in sorted(REQUIRED_INPUT_PINS):
409: if inputs.get(pin) != ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
700: removed = len(revision.get("removed", []))
701: if added or removed:
702: lines.append(f"- `{revision['record_id']}`: {added} added, {removed} removed")
703: if lines[-1] == "":
704: lines.append("- None")
705: return "\n".join(lines) + "\n"
706:
707:
708: def main() -> None:
709: parser = argparse.ArgumentParser(description="Validate frozen governance adjudication")
710: parser.add_argument("--adjudication", type=Path, required=True)
711: parser.add_argument("--input-manifest", type=Path, required=True)
712: parser.add_argument("--documents", type=Path, required=True)
713: parser.add_argument("--coding-package", type=Path, required=True)
714: parser.add_argument("--artifact", type=Path, required=True)
715: parser.add_argument("--protocol", type=Path, required=True)
716: parser.add_argument("--coding-schema", type=Path, ...
<path>/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json-schema.org/draft/2020-12/schema",
3: "$id": "https://institutional-transition-lab.local/schema/governance-adjudication-v1.schema.json",
4: "title": "Performance-blinded governance adjudication v1",
5: "type": "object",
6: "additionalProperties": false,
7: "required": [
8: "schema_version",
9: "adjudication_id",
10: "design_status",
11: "transition_dates_excluded",
12: "outcome_data_used",
13: "inputs",
14: "reviewers",
15: "records"
16: ],
17: "properties": {
18: "schema_version": {"const": 1},
19: "adjudication_id": {"type": "string", "minLength": 1},
20: "design_status": {
21: "const": "performance_blinded_llm_assisted_source_adjudication"
22: },
23: "transition_dates_excluded": {"const": true},
24: "outcome_data_used": {"const": false},
25: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
530:
531: errors, summary = _validate(adjudication)
532:
533: assert any("reviewer_ids must be unique" in error for error in errors)
534: assert summary["canonicalization_gate"] == "closed"
535:
536:
537: def test_malformed_reviewer_id_does_not_crash_manual_validation() -> None:
538: adjudication = _adjudication()
539: adjudication["records"][0]["reviewer_ids"] = [{"invalid": "reviewer"}]
540:
541: errors, summary = _validate(adjudication)
542:
543: assert any("reviewer_ids must contain non-empty strings" in error for error in errors)
544: assert summary["canonicalization_gate"] == "closed"
545:
546:
547: def test_every_input_pin_is_reverified() -> None:
548: adjudication = _adjudication()
549: adjudication["inputs"]["artifact_sha256"] = "wrong"
550:
551: errors, summary = _validate(adjudication)
552:
553: assert "input pin mismatch: ...
?? cases/review/oss-governance-adjudication-v1.inputs.json ?? schema/governance-adjudication-v1.schema.json ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
(no output)
................ [100%] 16 passed, 28 deselected in 0.11s
{"artifact_hash_matches": true, "duplicate_names": [], "encrypted_member_count": 0, "member_count": 19, "selected_member_metadata": {"documents.json": [[445940, 120892, 8, 3503999]], "v1.2-adjudication-package.json": [[156038, 14335, 8, 208541662]]}, "total_uncompressed_bytes": 1993647}
drwxr-xr-x 3 byk byk 4096 Sep 8 23:57 /tmp/opencode
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import zipfile 6: from pathlib import Path 7: 8: import pytest 9: 10: from institution_lab.governance_adjudication import ( 11: DECISIONS, 12: FROZEN_INPUT_PINS, 13: REQUIRED_INPUT_PINS, 14: REVIEWER_ROLES, 15: REVIEWER_TYPES, 16: validate_adjudication, 17: validate_adjudication_fragment, 18: validate_against_schema, 19: verify_input_manifest, 20: ) 21: from institution_lab.governance_coding import ( 22: BODY_PATCH_RELATIONS, 23: CHANGE_STATUSES, 24: DIRECTIONS, 25: EVENT_KINDS, 26: RECORD_CLASSES, 27: RIGHT_KINDS, 28: ) 29: 30: ROOT = Path(__file__).parents[1] 31: 32: 33: def test_adjudication_schema_matches_validator_ontology() -> None: 34: schema = json.loads((ROOT / "schema/governance-adjudication-v1.schema.json").read_text()) 35: coding = ...
No files found
{"duplicate_manifest_key_accepted": true, "duplicate_zip_member_accepted": true, "preloaded_values_can_differ_from_verified_files": true, "required-key-list_exception": "AttributeError"}
Found 3 matches /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py: Line 11: from jsonschema import Draft202012Validator, FormatChecker Line 650: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]: Line 651: validator = Draft202012Validator(schema, format_checker=FormatChecker())
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
642: documents_by_id[record_id],
643: coding_by_id[record_id],
644: reviewer_ids,
645: )
646: )
647: return errors
648:
649:
650: def validate_against_schema(adjudication: dict[str, Any], schema: dict[str, Any]) -> list[str]:
651: validator = Draft202012Validator(schema, format_checker=FormatChecker())
652: return [
653: f"schema {'.'.join(str(part) for part in error.absolute_path) or '<root>'}: "
654: f"{error.message}"
655: for error in sorted(validator.iter_errors(adjudication), key=lambda item: list(item.path))
656: ]
657:
658:
659: def render_markdown(adjudication: dict[str, Any], summary: dict[str, Any]) -> str:
660: lines = [
661: "# OSS governance adjudication v1",
662: "",
663: f"Canonicalization gate: **{summary['canonicalization_gate']}**",
(Showing lines 642-663 of 753. Use offset=664 to ...
Found 1 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 212: def _validate(adjudication: dict[str, object]) -> tuple[list[str], dict[str, object]]:
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
148: def _adjudication() -> dict[str, object]:
149: return {
150: "schema_version": 1,
151: "adjudication_id": "oss-governance-adjudication-v1",
152: "design_status": "performance_blinded_llm_assisted_source_adjudication",
153: "transition_dates_excluded": True,
154: "outcome_data_used": False,
155: "inputs": {
156: "workflow_run_id": 33063470968,
157: "artifact_id": 9642983578,
158: "artifact_sha256": "0" * 64,
159: "documents_sha256": "0" * 64,
160: "documents_file_sha256": "1" * 64,
161: "coding_package_file_sha256": "2" * 64,
162: "protocol_sha256": "3" * 64,
163: "coding_schema_sha256": "4" * 64,
164: "adjudication_schema_sha256": "5" * 64,
165: },
166: "reviewers": [
167: {
168: "reviewer_id": "opencode-gpt-5.6-sol-primary",
169: "reviewer_type": "llm",
170: "model": "openai/gpt-5.6-sol",
171: ...
{"absolute_member_count": 0, "backslash_member_count": 0, "casefold_collision_count": 0, "max_compression_ratio": 10.885106382978723, "normalization_collision_count": 0, "parent_component_member_count": 0, "symlink_member_count": 0}
{"adjudication_schema": {"is_file": true, "is_symlink": false, "size": 9122}, "artifact": {"is_file": true, "is_symlink": false, "size": 423046}, "coding_package": {"is_file": true, "is_symlink": false, "size": 156038}, "coding_schema": {"is_file": true, "is_symlink": false, "size": 2593}, "documents": {"is_file": true, "is_symlink": false, "size": 445940}, "manifest": {"is_file": true, "is_symlink": false, "size": 723}, "protocol": {"is_file": true, "is_symlink": false, "size": 1668}}
Traceback (most recent call last):
File "/home/byk/Code/institutional-transition-lab/.venv/lib/python3.13/site-packages/referencing/_core.py", line 276, in pointer
contents = contents[segment] # type: ignore[reportUnknownArgumentType]
~~~~~~~~^^^^^^^^^
KeyError: '$defs'
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/home/byk/Code/institutional-transition-lab/.venv/lib/python3.13/site-packages/jsonschema/validators.py", line 462, in _validate_reference
resolved = self._resolver.lookup(ref)
File "/home/byk/Code/institutional-transition-lab/.venv/lib/python3.13/site-packages/referencing/_core.py", line 690, in lookup
return retrieved.value.pointer(pointer=fragment, resolver=resolver)
~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/byk/Code/institutional-transition-lab/.venv/lib/python3.13/site-packages/referencing/_core.py", line 279, in pointer
...
{"boolean_id": 1, "extra": 1, "missing": 1, "uppercase_hash": 1, "valid": 0}
{"cli_exited_successfully": true, "summary_gate": "open", "validator_received_forged_coding_package": true, "validator_received_forged_documents": true, "validator_received_forged_schema": true}
{'stdlib_parser_accepted_non_json_nan': True, 'canonical_sha256_accepted_non_finite_number': True, 'object_key_order_is_stable': True}
{
"cases/review/oss-governance-adjudication-v1.inputs.json": "ac47cff1f6a937f932d34f12e86e79d01dc79db21799ec20fa84a2db89454355",
"schema/governance-adjudication-v1.schema.json": "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31",
"src/institution_lab/governance_adjudication.py": "0c873db5c8a2394150fa35d96694317f6cb2e847bc41919e1ca82992b86e57c0",
"tests/test_governance_adjudication.py": "56e1c751ea148495f913995e01f77a2f98ef7cf0d4e86e35a0bae21586f87b1e"
}
main() parses the documents, coding package, and adjudication schema before verification at src/institution_lab/governance_adjudication.py:721-725. verify_input_manifest() then reopens those paths for hashing and ZIP comparison at :93-118. Validation later receives the earlier objects at :735-740.
A writable file, swapped symlink, or FIFO can therefore provide forged bytes during the first read and pinned bytes during verification. The pin checks do not repair this:
:404-410.:411-414, never with verified_pins["documents_sha256"].A deterministic synthetic CLI probe swapped the paths immediately before verification. The CLI exited successfully, the isolated downstream validators received forged documents, package, and schema, and an open summary was written. The downstream validators were replaced with spies to isolate this boundary; I did not inspect broader adjudication logic.
Regression proposal: Add test_cli_never_uses_preverification_bytes. Make each path return forged bytes before verification and pinned bytes afterward. The command must reject the bundle or pass only objects parsed from the pinned bytes. Read each input once into immutable bytes, hash and parse those same bytes, open the artifact through ZipFile(BytesIO(artifact_bytes)), and return the verified parsed values for downstream use.
The CLI accepts every input and output as an unrestricted Path at governance_adjudication.py:710-719. It writes outputs at :746-747 without checking path or inode aliases. ...
Re-review the CURRENT working-copy implementation after your prior frozen-input provenance/security audit. This is a read-only security/pentest review: do not edit files. Scope only these files and this trust boundary:
Verify whether the current code substantively fixes each prior item: same immutable bytes are hashed/ZIP-compared/parsed/validated; all direct/symlink/hardlink input-output and output-output aliases fail before writes; malformed/duplicate/non-finite JSON fails closed and stale open output is replaced where safe; duplicate ZIP entries and resource bounds (regular files, FIFO nonblocking, input sizes, member count/member size/expanded size) fail closed; canonical JSON rejects non-finite values. Try adversarial deterministic probes where useful. Also examine normalized ZIP-name ambiguity, TOCTOU around output checks/writes, partial/stale report behavior, and whether the tests genuinely prove the intended guards rather than passing incidentally. Do not inspect governance source records, codings, outcomes, transition dates, detector reports, or active source-adjudication scopes.
Report findings first, ordered by severity, with exact current file:line evidence and deterministic regression proposal for every defect. Classify each as PASS, CONCERN, or MUST-FIX. Include commands/tests run and current file hashes. If no defect remains, state PASS explicitly and note residual risks, including the local-origin attestation limitation if still applicable. End exactly MERGE or DO-NOT-MERGE.
I’ll inspect only the four named files, map each prior finding to its current guard and tests, then run narrow tests and isolated adversarial probes without writing to the repository.
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
882: def main() -> None:
883: parser = argparse.ArgumentParser(description="Validate frozen governance adjudication")
884: parser.add_argument("--adjudication", type=Path, required=True)
885: parser.add_argument("--input-manifest", type=Path, required=True)
886: parser.add_argument("--documents", type=Path, required=True)
887: parser.add_argument("--coding-package", type=Path, required=True)
888: parser.add_argument("--artifact", type=Path, required=True)
889: parser.add_argument("--protocol", type=Path, required=True)
890: parser.add_argument("--coding-schema", type=Path, required=True)
891: parser.add_argument("--adjudication-schema", type=Path, required=True)
892: parser.add_argument("--summary-json", type=Path, required=True)
893: parser.add_argument("--summary-markdown", type=Path, required=True)
894: args = parser.parse_args()
895: ...
No files found
Found 100 matches (more matches available)
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 8: import zipfile
Line 13: from institution_lab import governance_adjudication
Line 14: from institution_lab.governance_adjudication import (
Line 20: canonical_sha256,
Line 25: verify_input_manifest,
Line 27: from institution_lab.governance_coding import (
Line 37: MAX_TEST_ARCHIVE_MEMBERS = 256
Line 49: "input_manifest": tmp_path / "inputs.json",
Line 52: "artifact": tmp_path / "artifact.zip",
Line 65: with zipfile.ZipFile(paths["artifact"], "w") as archive:
Line 66: archive.writestr("documents.json", paths["documents"].read_bytes())
Line 67: archive.writestr(
Line 71: manifest = {
Line 75: "documents_sha256": canonical_sha256(documents_value),
Line 82: paths["input_manifest"].write_text(json.dumps(manifest))
Line 83: monkeypatch.setattr(governance_adjudication, "FROZEN_INPUT_PINS", ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
Your re-review completed with an empty result. Retry ONCE against the exact unchanged current-file scope. Read-only security/pentest review; never edit files and NEVER return empty. You MUST return either a substantive evidence-based verdict or BLOCKED followed by the exact tool/path/error.
Scope only:
Re-evaluate all prior trust-boundary findings against CURRENT bytes:
open reports must be replaced with closed reports where outputs are safe.Run deterministic adversarial probes where useful and report exact commands/results plus SHA-256 hashes of every scoped file. Findings first, ordered by severity, each classified PASS, CONCERN, or MUST-FIX with exact current file:line evidence. ...
Found 9 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 57: "summary_markdown": tmp_path / "summary.md",
Line 99: "summary_markdown",
Line 813: @pytest.mark.parametrize("alias_kind", ["direct", "symlink", "hardlink"])
Line 825: elif alias_kind == "symlink":
Line 826: paths["summary_json"].symlink_to(paths[input_name])
Line 828: paths["summary_json"].hardlink_to(paths[input_name])
Line 842: paths["summary_markdown"] = paths["summary_json"]
Line 864: with pytest.raises(ValueError, match="duplicate JSON key: artifact_sha256"):
Line 871: with pytest.raises(ValueError, match="input manifest must be an object"):
The first pass surfaced likely gaps in the new tests, so I’m now testing the guards directly—including output races and two-file write failures—against the unchanged files.
<path>/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json-schema.org/draft/2020-12/schema",
3: "$id": "https://institutional-transition-lab.local/schema/governance-adjudication-v1.schema.json",
4: "title": "Performance-blinded governance adjudication v1",
5: "type": "object",
6: "additionalProperties": false,
7: "required": [
8: "schema_version",
9: "adjudication_id",
10: "design_status",
11: "transition_dates_excluded",
12: "outcome_data_used",
13: "inputs",
14: "reviewers",
15: "records"
16: ],
17: "properties": {
18: "schema_version": {"const": 1},
19: "adjudication_id": {"type": "string", "minLength": 1},
20: "design_status": {
21: "const": "performance_blinded_llm_assisted_source_adjudication"
22: },
23: "transition_dates_excluded": {"const": true},
24: "outcome_data_used": {"const": false},
25: ...
<path>/home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json</path>
<type>file</type>
<content>
1: {
2: "adjudication_schema_sha256": "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31",
3: "artifact_id": 9642983578,
4: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
5: "coding_package_file_sha256": "14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769",
6: "coding_schema_sha256": "bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e",
7: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
8: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
9: "protocol_sha256": "06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933",
10: "workflow_run_id": 33063470968
11: }
(End of file - total 11 lines)
</content>
................................................ [100%] 48 passed, 30 deselected in 0.39s
Found 4 matches
/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json:
Line 54: "workflow_run_id": {"type": "integer", "minimum": 1},
Line 55: "artifact_id": {"type": "integer", "minimum": 1},
Line 180: "confidence": {"type": "number", "minimum": 0, "maximum": 1},
Line 211: "patch_unavailable_count": {"type": "integer", "minimum": 0}
No files found
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py /home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py
Found 16 matches
/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py:
Line 80: def canonical_sha256(value: Any) -> str:
Line 81: payload = json.dumps(
Line 94: def _read_regular_file(path: Path, *, max_bytes: int = MAX_INPUT_BYTES) -> bytes:
Line 97: descriptor = os.open(path, flags)
Line 100: with os.fdopen(descriptor, "rb") as source:
Line 201: with archive.open(info) as source:
Line 220: def verify_input_manifest(
Line 259: sources["record_metadata"] = json.dumps(metadata, sort_keys=True, separators=(",", ":"))
Line 299: return json.dumps(edge, sort_keys=True, separators=(",", ":"))
Line 512: def validate_adjudication(
Line 659: def validate_adjudication_fragment(
Line 848: with os.fdopen(descriptor, "w") as destination:
Line 852: os.replace(temporary_name, path)
Line 878: _atomic_write(summary_json, json.dumps(summary, indent=2, sort_keys=True) + "\n")
Line 882: def main() -> None:
...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
480: errors.extend(_evidence_errors(reference, sources, path, claim=True))
481: if isinstance(final_coding, dict) and final_coding.get("record_class") in INSTITUTIONAL_CLASSES:
482: grounded_fields = {
483: reference.get("field")
484: for reference in claim_refs
485: if isinstance(reference, dict)
486: }
487: for field in CLAIM_FIELDS:
488: if final_coding.get(field) is not None and field not in grounded_fields:
489: errors.append(f"{prefix}: {field} is not grounded")
490:
491: revision = record.get("graph_edge_revision")
492: if decision == "abstain":
493: if revision is not None:
494: errors.append(f"{prefix}: abstain requires null graph_edge_revision")
495: elif not isinstance(revision, dict):
496: errors.append(f"{prefix}: resolved decision requires graph_edge_revision")
497: else:
498: basis = ...
Found 100 matches (more matches available)
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 24: validate_against_schema,
Line 45: coding_package_value = {"records": [], "summary": {}}
Line 46: adjudication_schema_value = {"type": "object"}
Line 54: "coding_schema": tmp_path / "coding-schema.json",
Line 55: "adjudication_schema": tmp_path / "adjudication-schema.json",
Line 56: "summary_json": tmp_path / "summary.json",
Line 57: "summary_markdown": tmp_path / "summary.md",
Line 63: paths["coding_schema"].write_text("{}")
Line 64: paths["adjudication_schema"].write_text(json.dumps(adjudication_schema_value))
Line 79: "coding_schema_sha256": file_sha256(paths["coding_schema"]),
Line 80: "adjudication_schema_sha256": file_sha256(paths["adjudication_schema"]),
Line 96: "coding_schema",
Line 97: "adjudication_schema",
Line 98: "summary_json",
Line 99: "summary_markdown",
Line 107: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
780: _, paths = _write_pinned_cli_inputs(tmp_path, monkeypatch)
781: _stub_cli_validation(monkeypatch)
782: forged_documents = {"documents": [{"record_id": "forged"}]}
783: original_verify = governance_adjudication.verify_input_manifest
784:
785: def swap_before_verification(*args: object, **kwargs: object) -> dict[str, object]:
786: paths["documents"].write_text(json.dumps({"documents": []}))
787: return original_verify(*args, **kwargs)
788:
789: paths["documents"].write_text(json.dumps(forged_documents))
790: monkeypatch.setattr(
791: governance_adjudication,
792: "verify_input_manifest",
793: swap_before_verification,
794: )
795:
796: with pytest.raises(ValueError, match="input manifest mismatch: documents_file_sha256"):
797: _run_cli(monkeypatch, paths)
798:
799:
800: @pytest.mark.parametrize(
801: "input_name",
802: [
803: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
640: assert "input pin mismatch: artifact_sha256" in errors
641: assert summary["canonicalization_gate"] == "closed"
642:
643:
644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
645: assert set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS
646: assert FROZEN_INPUT_PINS["adjudication_schema_sha256"] == (
647: "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31"
648: )
649:
650:
651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
652: def test_input_manifest_rejects_self_consistent_substitute(field: str) -> None:
653: manifest = {
654: **FROZEN_INPUT_PINS,
655: "adjudication_schema_sha256": "5" * 64,
656: }
657: value = manifest[field]
658: manifest[field] = value + 1 if isinstance(value, int) else "f" * 64
659:
660: with pytest.raises(ValueError, match=f"frozen issue #4 input: {field}"):
661: ...
Found 24 matches
/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py:
Line 138: @pytest.mark.parametrize(
Line 331: @pytest.mark.parametrize("mutation", ["duplicate", "missing"])
Line 374: @pytest.mark.parametrize(
Line 392: @pytest.mark.parametrize(
Line 531: @pytest.mark.parametrize(
Line 644: def test_frozen_pins_include_the_versioned_adjudication_schema() -> None:
Line 651: @pytest.mark.parametrize("field", sorted(FROZEN_INPUT_PINS))
Line 652: def test_input_manifest_rejects_self_consistent_substitute(field: str) -> None:
Line 672: @pytest.mark.parametrize("field", ["workflow_run_id", "artifact_id"])
Line 673: def test_frozen_input_identifiers_are_reverified(field: str) -> None:
Line 683: def test_input_manifest_rejects_changed_file_bytes(
Line 729: def test_input_manifest_rejects_files_not_from_pinned_artifact(
Line 776: def test_cli_validates_the_same_bytes_it_verifies(
Line 800: @pytest.mark.parametrize(
...
<path>/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json</path>
<type>file</type>
<content>
1: {
2: "$schema": "https://json-schema.org/draft/2020-12/schema",
3: "$id": "https://institutional-transition-lab.local/schema/governance-adjudication-v1.schema.json",
4: "title": "Performance-blinded governance adjudication v1",
5: "type": "object",
6: "additionalProperties": false,
7: "required": [
8: "schema_version",
9: "adjudication_id",
10: "design_status",
11: "transition_dates_excluded",
12: "outcome_data_used",
13: "inputs",
14: "reviewers",
15: "records"
16: ],
17: "properties": {
18: "schema_version": {"const": 1},
19: "adjudication_id": {"type": "string", "minLength": 1},
20: "design_status": {
21: "const": "performance_blinded_llm_assisted_source_adjudication"
22: },
23: "transition_dates_excluded": {"const": true},
24: "outcome_data_used": {"const": false},
25: ...
?? cases/review/oss-governance-adjudication-v1.inputs.json ?? schema/governance-adjudication-v1.schema.json ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py 6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31 schema/governance-adjudication-v1.schema.json ac47cff1f6a937f932d34f12e86e79d01dc79db21799ec20fa84a2db89454355 cases/review/oss-governance-adjudication-v1.inputs.json
/usr/bin/bash: line 1: python: command not found
/home/byk/Code/institutional-transition-lab/uv.lock /home/byk/Code/institutional-transition-lab/pyproject.toml
........................................................ [100%] 56 passed, 22 deselected in 0.41s
drwxrwxrwt 57 root root 4096 Sep 9 02:15 /tmp
Success. Updated the following files: A ../../../../tmp/opencode/governance_security_probe.py
Success. Updated the following files: M ../../../../tmp/opencode/governance_security_probe.py
nan_json: rejected (ValueError: non-finite JSON number: NaN)
duplicate_json: rejected (ValueError: duplicate JSON key: x)
non_object_json: rejected (ValueError: non_object_json must be an object)
normalized_zip_collision: ACCEPTED
postcheck_hardlink_race: input='frozen', output='report'
failure_report_second_write: rejected (OSError: [Errno 5] synthetic second-write failure)
partial_failure_state: json='{\n "canonicalization_gate": "closed",\n "schema_version": 1,\n "validation_errors": [\n "bad input"\n ]\n}\n', markdown='STALE OPEN'
Success. Updated the following files: M ../../../../tmp/opencode/governance_security_probe.py
nan_json: rejected (ValueError: non-finite JSON number: NaN)
duplicate_json: rejected (ValueError: duplicate JSON key: x)
non_object_json: rejected (ValueError: non_object_json must be an object)
normalized_zip_collision: ACCEPTED
postcheck_hardlink_race: input='frozen', output='report'
postcheck_parent_redirect: input='report'
failure_report_second_write: rejected (OSError: [Errno 5] synthetic second-write failure)
partial_failure_state: json='{\n "canonicalization_gate": "closed",\n "schema_version": 1,\n "validation_errors": [\n "bad input"\n ]\n}\n', markdown='STALE OPEN'
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
1: from __future__ import annotations
2:
3: import argparse
4: import hashlib
5: import io
6: import json
7: import os
8: import stat
9: import tempfile
10: import zipfile
11: from collections import Counter
12: from contextlib import suppress
13: from dataclasses import dataclass
14: from pathlib import Path
15: from typing import Any
16:
17: from jsonschema import Draft202012Validator, FormatChecker
18:
19: from institution_lab.governance_coding import validate_response
20:
21: DECISIONS = {"accept", "revise", "reject", "abstain"}
22: INSTITUTIONAL_CLASSES = {
23: "effective_institutional_change",
24: "announced_institutional_change",
25: "proposal_only",
26: }
27: REVIEWER_TYPES = {"human", "llm", "human_llm_assisted"}
28: REVIEWER_ROLES = {"source_adjudicator", "evidence_auditor", "synthesizer"}
29: RESPONSE_SOURCES = {"luna_a", "luna_b", ...
Success. Updated the following files: M ../../../../tmp/opencode/governance_security_probe.py
nan_json: rejected (ValueError: non-finite JSON number: NaN)
overflowing_number_json: ACCEPTED
negative_overflowing_number_json: ACCEPTED
duplicate_json: rejected (ValueError: duplicate JSON key: x)
non_object_json: rejected (ValueError: non_object_json must be an object)
normalized_zip_collision: ACCEPTED
oversized_regular_file: rejected (ValueError: input file exceeds 3 bytes: /tmp/opencode/tmpxm2l7qyw/oversized)
directory_input: rejected (IsADirectoryError: [Errno 21] Is a directory: 4)
symlink_input: rejected (ValueError: cannot open input as a regular file: /tmp/opencode/tmpxm2l7qyw/symlink-input)
bounded_archive_member_count: rejected (ValueError: artifact member count exceeds limit)
bounded_archive_expanded_size: rejected (ValueError: artifact expanded size exceeds limit)
bounded_required_member_size: rejected (ValueError: artifact member exceeds size limit: documents.json)
same_byte_bundle: documents={'documents': []}, coding={'records': [], 'summary': ...
Success. Updated the following files: M ../../../../tmp/opencode/governance_security_probe.py
nan_json: rejected (ValueError: non-finite JSON number: NaN)
overflowing_number_json: ACCEPTED
negative_overflowing_number_json: ACCEPTED
duplicate_json: rejected (ValueError: duplicate JSON key: x)
non_object_json: rejected (ValueError: non_object_json must be an object)
normalized_zip_collision: ACCEPTED
oversized_unread_zip_member: ACCEPTED
oversized_regular_file: rejected (ValueError: input file exceeds 3 bytes: /tmp/opencode/tmpmcw_o24w/oversized)
directory_input: rejected (IsADirectoryError: [Errno 21] Is a directory: 4)
symlink_input: rejected (ValueError: cannot open input as a regular file: /tmp/opencode/tmpmcw_o24w/symlink-input)
bounded_archive_member_count: rejected (ValueError: artifact member count exceeds limit)
bounded_archive_expanded_size: rejected (ValueError: artifact expanded size exceeds limit)
bounded_required_member_size: rejected (ValueError: artifact member exceeds size limit: documents.json)
same_byte_bundle: documents={'documents': []}, coding={'records': ...
Success. Updated the following files: D ../../../../tmp/opencode/governance_security_probe.py
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
810: lines.extend(["", "## Reviewer provenance", ""])
811: for reviewer in summary["reviewer_provenance"]:
812: model = reviewer.get("model") or "none"
813: lines.append(
814: f"- `{reviewer['reviewer_id']}`: {reviewer['reviewer_type']}, "
815: f"`{model}`, {reviewer['role']}; {reviewer['assistance']}"
816: )
817: lines.extend(["", "## Graph-edge revisions", ""])
818: for revision in summary["graph_edge_revisions"]:
819: added = len(revision.get("added", []))
820: removed = len(revision.get("removed", []))
821: if added or removed:
822: lines.append(f"- `{revision['record_id']}`: {added} added, {removed} removed")
823: if lines[-1] == "":
824: lines.append("- None")
825: return "\n".join(lines) + "\n"
826:
827:
828: def _paths_alias(first: Path, second: Path) -> bool:
829: try:
830: return first.samefile(second)
831: ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
730: tmp_path: Path,
731: monkeypatch: pytest.MonkeyPatch,
732: ) -> None:
733: artifact = tmp_path / "artifact.zip"
734: documents = tmp_path / "documents.json"
735: coding_package = tmp_path / "coding-package.json"
736: protocol = tmp_path / "protocol.md"
737: coding_schema = tmp_path / "coding-schema.json"
738: adjudication_schema = tmp_path / "adjudication-schema.json"
739: documents.write_text("documents")
740: coding_package.write_text("coding package")
741: for path in (protocol, coding_schema, adjudication_schema):
742: path.write_text(path.name)
743: with zipfile.ZipFile(artifact, "w") as archive:
744: archive.writestr("documents.json", b"different documents")
745: archive.writestr("v1.2-adjudication-package.json", coding_package.read_bytes())
746: from institution_lab.governance_adjudication import file_sha256
747:
748: manifest = ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path> <type>file</type> <content> 1: from __future__ import annotations 2: 3: import copy 4: import json 5: import os 6: import subprocess 7: import sys 8: import zipfile 9: from pathlib import Path 10: 11: import pytest 12: 13: from institution_lab import governance_adjudication 14: from institution_lab.governance_adjudication import ( 15: DECISIONS, 16: FROZEN_INPUT_PINS, 17: REQUIRED_INPUT_PINS, 18: REVIEWER_ROLES, 19: REVIEWER_TYPES, 20: canonical_sha256, 21: file_sha256, 22: validate_adjudication, 23: validate_adjudication_fragment, 24: validate_against_schema, 25: verify_input_manifest, 26: ) 27: from institution_lab.governance_coding import ( 28: BODY_PATCH_RELATIONS, 29: CHANGE_STATUSES, 30: DIRECTIONS, 31: EVENT_KINDS, 32: RECORD_CLASSES, 33: RIGHT_KINDS, 34: ) 35: 36: ROOT = Path(__file__).parents[1] 37: MAX_TEST_ARCHIVE_MEMBERS = 256 38: 39: 40: def ...
<path>/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py</path>
<type>file</type>
<content>
530:
531: @pytest.mark.parametrize(
532: ("record_class", "change_status"),
533: [
534: ("effective_institutional_change", "proposed"),
535: ("announced_institutional_change", "effective"),
536: ("proposal_only", "effective"),
537: ],
538: )
539: def test_institutional_class_and_edge_status_must_agree(
540: record_class: str,
541: change_status: str,
542: ) -> None:
543: adjudication = _adjudication()
544: record = adjudication["records"][0]
545: record.update({
546: "decision": "revise",
547: "accepted_from": None,
548: "claim_evidence_refs": [
549: {"field": field, "source_id": "body", "quote": "council"}
550: for field in (
551: "record_class",
552: "event_kind",
553: "title",
554: "announced_on",
555: "effective_on",
556: "affected_scope",
557: "body_patch_relation",
558: )
559: ],
560: ...
Found 13 matches /home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py: Line 25: verify_input_manifest, Line 661: verify_input_manifest( Line 726: verify_input_manifest(manifest, **paths) Line 773: verify_input_manifest(manifest, **paths) Line 776: def test_cli_validates_the_same_bytes_it_verifies( Line 783: original_verify = governance_adjudication.verify_input_manifest Line 792: "verify_input_manifest", Line 872: verify_input_manifest( Line 897: verify_input_manifest( Line 920: verify_input_manifest( Line 955: def test_canonical_sha256_rejects_non_finite_numbers(value: float) -> None: Line 966: verified = verify_input_manifest( Line 979: def test_committed_partial_fragment_validates_but_cannot_be_the_full_envelope() -> None:
........................................................................ [ 92%] ...... [100%] 78 passed in 0.46s
Found 4 matches
/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json:
Line 54: "workflow_run_id": {"type": "integer", "minimum": 1},
Line 55: "artifact_id": {"type": "integer", "minimum": 1},
Line 180: "confidence": {"type": "number", "minimum": 0, "maximum": 1},
Line 211: "patch_unavailable_count": {"type": "integer", "minimum": 0}
c686c4878409e68b958dd61850a59e9234416d817fc2fa3246fc728d51ebe0a5 src/institution_lab/governance_adjudication.py abf64b5e78a616d53b703dee5291ce7bf23fa9156fe59263a702e01cb8667bc5 tests/test_governance_adjudication.py 6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31 schema/governance-adjudication-v1.schema.json ac47cff1f6a937f932d34f12e86e79d01dc79db21799ec20fa84a2db89454355 cases/review/oss-governance-adjudication-v1.inputs.json ?? cases/review/oss-governance-adjudication-v1.inputs.json ?? schema/governance-adjudication-v1.schema.json ?? src/institution_lab/governance_adjudication.py ?? tests/test_governance_adjudication.py
<path>/home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json</path>
<type>file</type>
<content>
1: {
2: "adjudication_schema_sha256": "6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31",
3: "artifact_id": 9642983578,
4: "artifact_sha256": "1f6be91fcd98e43e99d82d5f274536f6c23616e7e6c711e26324a2cc4b06ef06",
5: "coding_package_file_sha256": "14644759f53071adfe1173d4e25bb01931b8c1591fa8a48295dbd0556a754769",
6: "coding_schema_sha256": "bfc735a7d8602d1f236a88c2d23b195f0600a8bae86fb8c8936afe7883a41b8e",
7: "documents_file_sha256": "2a62ab05687982c112a29f6126227c26c3ff8defc89ca64662753aaf85c3c0ce",
8: "documents_sha256": "d70f7f795847968339a645b6dbd6d4428af6bd6044de44fa2602d4c4343b0ee9",
9: "protocol_sha256": "06d4b3407677fe7fb23046f70164a366db06638e8a29af3daf7661f00d565933",
10: "workflow_run_id": 33063470968
11: }
(End of file - total 11 lines)
</content>
<path>/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json</path>
<type>file</type>
<content>
35: "items": {"$ref": "#/$defs/record"}
36: }
37: },
38: "$defs": {
39: "inputs": {
40: "type": "object",
41: "additionalProperties": false,
42: "required": [
43: "workflow_run_id",
44: "artifact_id",
45: "artifact_sha256",
46: "documents_sha256",
47: "documents_file_sha256",
48: "coding_package_file_sha256",
49: "protocol_sha256",
50: "coding_schema_sha256",
51: "adjudication_schema_sha256"
52: ],
53: "properties": {
54: "workflow_run_id": {"type": "integer", "minimum": 1},
55: "artifact_id": {"type": "integer", "minimum": 1},
56: "artifact_sha256": {"$ref": "#/$defs/sha256"},
57: "documents_sha256": {"$ref": "#/$defs/sha256"},
58: "documents_file_sha256": {"$ref": "#/$defs/sha256"},
59: ...
<path>/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py</path>
<type>file</type>
<content>
72: @dataclass(frozen=True)
73: class VerifiedInputBundle:
74: pins: dict[str, Any]
75: documents: dict[str, Any]
76: coding_package: dict[str, Any]
77: adjudication_schema: dict[str, Any]
78:
79:
80: def canonical_sha256(value: Any) -> str:
81: payload = json.dumps(
82: value,
83: sort_keys=True,
84: separators=(",", ":"),
85: allow_nan=False,
86: ).encode()
87: return hashlib.sha256(payload).hexdigest()
88:
89:
90: def _bytes_sha256(payload: bytes) -> str:
91: return hashlib.sha256(payload).hexdigest()
92:
93:
94: def _read_regular_file(path: Path, *, max_bytes: int = MAX_INPUT_BYTES) -> bytes:
95: flags = os.O_RDONLY | os.O_NONBLOCK | getattr(os, "O_NOFOLLOW", 0)
96: try:
97: descriptor = os.open(path, flags)
98: except OSError as error:
99: raise ValueError(f"cannot open input as a regular file: {path}") from error
100: ...
Date: Sep 9, 2026 * 🟡 (02:50) Inspected `/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json` lines 35–79. `$defs.inputs` is an object with `additionalProperties: false` and exactly 9 required properties: `workflow_run_id`, `artifact_id`, `artifact_sha256`, `documents_sha256`, `documents_file_sha256`, `coding_package_file_sha256`, `protocol_sha256`, `coding_…
Date: Sep 9, 2026 * 🟡 (02:15) Targeted test run completed with 56 passed and 22 deselected in 0.41s. * 🟡 (02:16) Confirmed `/tmp` permissions as `drwxrwxrwt` (world-writable with sticky bit), owned by `root:root`. * 🟡 (02:17) Created and iteratively modified temporary security probe `/tmp/opencode/governance_security_probe.py`; the probe was deleted at 02:29. * 🟡 (02:19) Security probe confir…
* 🟡 (02:11) Search found 24 governance-adjudication test definitions/parametrizations in `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` at lines 138, 331, 374, 392, 531, 644, 651–652, 672–673, 683, 729, 776, 800, 813–814, 836, 848, 870, 883, 908, 931, and 954–955. * 🟡 (02:11) Later tests in `/home/byk/Code/institutional-transition-lab/tests/test_governance_a…
Date: Sep 9, 2026 * 🟡 (02:09) Inspected `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` lines 640–829 of 1,024. * 🟡 (02:09) `test_frozen_pins_include_the_versioned_adjudication_schema` requires `set(FROZEN_INPUT_PINS) == REQUIRED_INPUT_PINS` and pins `FROZEN_INPUT_PINS["adjudication_schema_sha256"]` to `6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8b…
* 🟡 (02:02) Searched `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` for schema/summary-related references; found 100 matches with additional matches available. * 🟡 (02:05) Inspected `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` lines 780–1024; the file has 1,024 total lines and covers manifest race protection, path-alias…
* 🟡 (02:01) Inspected `/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py` lines 487–946, covering adjudication derivation checks, summary construction, fragment validation, Markdown rendering, output-path validation, atomic writes, failure-output generation, and the CLI entry point. * 🟡 (02:01) The adjudication checks iterate over `CLAIM_FIELDS` and vali…
* 🟡 (02:00) Inspected `/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py` lines 1–280 of 946. The module imports `argparse`, `hashlib`, `io`, `json`, `os`, `stat`, `tempfile`, `zipfile`, `Counter`, `suppress`, `dataclass`, `Path`, `Any`, `Draft202012Validator`, `FormatChecker`, and `validate_response` from `institution_lab.governance_coding`. * 🟡 (02:00)…
* 🟡 (01:54) File search returned `No files found`; the search target/query was not shown. * 🟡 (01:55) File search found exactly 2 files: `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py` and `/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py`. * 🟡 (01:58) Search found exactly 16 matches in `/home/byk/Code/institutional-…
* 🟡 (01:44) Test run completed successfully: 48 passed, 30 deselected in 0.39s. * 🟡 (01:52) Search found exactly 4 matches in `/home/byk/Code/institutional-transition-lab/schema/governance-adjudication-v1.schema.json`: line 54 defines `"workflow_run_id"` as integer with minimum 1; line 55 defines `"artifact_id"` as integer with minimum 1; line 180 defines `"confidence"` as number with minimum 0…
Date: Sep 9, 2026 * 🟡 (01:40) Current file `/home/byk/Code/institutional-transition-lab/cases/review/oss-governance-adjudication-v1.inputs.json` is an 11-line JSON input manifest containing exactly 9 fields: `adjudication_schema_sha256` = `6181f5cb60a0462f83be00be301763daa89f11581e68ee1c46a84e8bf4e5be31`; `artifact_id` = `9642983578`; `artifact_sha256` = `1f6be91fcd98e43e99d82d5f274536f6c23616e7…
Date: Sep 9, 2026 * 🔴 [requested-security-rereview] (01:25) User stated the prior re-review returned an empty result and directed exactly one retry against the unchanged current-file scope. * 🔴 [enforced-read-only-workflow] (01:25) User instructed that files must never be edited during this read-only security/pentest review. * 🔴 [required-nonempty-response] (01:25) User instructed the assistan…
Date: Sep 9, 2026 * 🔴 [requested-security-rereview] (01:19) User requested a read-only adversarial re-review of the CURRENT working-copy implementation after the prior frozen-input provenance/security audit, limited to `/home/byk/Code/institutional-transition-lab/src/institution_lab/governance_adjudication.py`, `/home/byk/Code/institutional-transition-lab/tests/test_governance_adjudication.py`, …
Date: Sep 9, 2026 * 🔴 [requested-security-audit] (00:21) User requested a read-only adversarial security/provenance audit of ONLY the frozen-input trust boundary for issue #4 in `/home/byk/Code/institutional-transition-lab`. * 🔴 (00:21) User scoped review to uncommitted code/tests in: `src/institution_lab/governance_adjudication.py` functions/constants concerning `canonical_sha256`, `file_sha25…