[wlad232]

The existing comparison reader did not appraise the retained 24 October Proofable fetch route. This adds a bounded offline adapter in integrations/alakris-authority-comparison/ for proofable/docs@e6eb5b9307be24a5d82cc7490f647f0c98e2d24a: ten fixed artifact pins, strict nested JSON/SSE parsing, the existing envelope verifier, exact request projection and explicit unsigned decision/job correlations. Generated-key counterexamples exercise request, signature and correlation failures independently of the fixed file hashes.

This implements Carlos’s first-slice scope decision. The positive dispatch appraisal is separate from the four comparison scenarios, which remain UNMET. Service-key attribution and grant/identity validation remain unmeasured; no independent hosted execution, target witness/commit, EO01 authority outage, protected effect or revocation latency is established. TRACE 0.11.0, the 14-field contract, community tier and external-evidence-source/reference shape are unchanged. The historical failing packet and all four historical author reports retain their bytes.

Validation on Python 3.12.4 with the unchanged hash-required lock:

• python check_package.py --fetch: 54 tests normally and 54 under -O, zero skips; 30 immutable source references; ten fetch artifact hashes and 18 semantic checks pass. The four scenarios stay UNMET, and the original known checksum FAIL remains visible.
• 60 repository validator tests, 50 manifest validations, compatibility and generated index/catalog checks pass; the existing confidential-workflow suite’s 27 tests pass.
• Local repository-wide Ruff checks using CI’s E4/E7/E9/F selection and whitespace checks pass.
• Exact source hashes are retained in results/proofable-fetch-author.json, with the test transcript in results/tests.txt. Atomic output replacement and its hard-link/failure regressions preserve all ten input files.

Reproduce from the PR head:

cd integrations/alakris-authority-comparison
python3.12 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.lock
.venv/bin/python check_package.py --fetch

Refs #333. Issue #333 remains open for the composed runtime/target scenario; #199 remains the reusable acceptance tracker and #352 the EO01–EO08 checklist. No tier promotion or broader acceptance is requested.

@imran-siddique @carloshvp — this is the bounded offline dispatch slice for review. The later effect-observation slice still needs a named operator-owned disposable target, independent observer, a same-pipeline valid control with exactly one durable effect and negative-case readback with zero effects.

Prepared with OpenAI Codex at Vladislav Kostitsyn’s request.

30 October mainline refresh

Adopted Dina’s prepared mainline-sync companion unchanged at 4663734cc5b8fd58c43d69fc6b24aa76a70f5a81, preserving its authorship and DCO trailers. Its second parent is upstream/main 7c01ee37b1714708e368f1fe74fe4072eec62fd1, which contains the merged link correction in PR357. The original ten Alakris file blobs, package subtree and all historical reports remain byte-identical.

Local validation on this refreshed commit passes: 54 normal +54 optimized package tests, zero skips; 30 references; ten pinned artifacts/18 semantic checks; 60 validator tests, 50 manifests, 27 harness tests, generated-file checks and repository-wide CI Ruff selection. An independent review reproduced the package tests and unchanged source/output identities. Local Python 3.12.4 environments were reused with the unchanged hash-required lock and successful pip check; this is not a claim of a fresh local installation.

All 28 fresh hosted checks pass on this exact head, including links, evidence checks, validation, Ruff and CodeQL. Carlos’s approval of the previous head 7d3960d4 is historical; current-head maintainer review is requested. The four scenarios remain UNMET, and the identity/grant/service-key and independent-effect limitations above are unchanged.

[carloshvp]

Reviewed current head 7d3960d4debf73c300aaee0aa5d5d12502c00ffb.

This implements the bounded offline slice agreed in #333. I fetched the immutable public artifacts and reproduced all 54 tests normally and under -O, the pinned fetch appraisal, preservation of the historical checksum failure, and all 30 reference shapes. All 50 manifests, compatibility and generated index/catalog checks pass. The positive dispatch appraisal passes while all four comparison scenarios remain UNMET; packet-declared signatures, unsigned joins, service-key attribution, grant/identity validation and target-effect evidence keep their declared limits. No hosted job or target was invoked. The older-head Nobulex link failure needs a branch refresh after merged #357. #333 and #199 remain open; this approval does not establish their composed acceptance or promote a tier.

Prepared with OpenAI Codex.

[dinakarjs]

Independent current-head follow-up at 7d3960d. After completing the declared hash-locked environment and fetching the 30 immutable public artifacts, I ran check_package.py offline against the retained bytes. Its 54 tests pass normally and under -O; all 30 reference shapes validate. The known historical publisher checksum failure stays FAIL, the pinned positive dispatch appraisal is PASS, and all four comparison scenarios remain UNMET with independent_comparison_completed=false. No hosted job, vendor execution or protected target was invoked. Initial runs before environment/fixture preparation completed are not product failures and are superseded by this completed replay.

No additional blocking source defect found in this bounded offline slice. The current hosted links check still fails on this head, as Carlos previously noted; @wlad232 please synchronize the existing branch with the merged mainline link correction and rerun the exact-head checks. Please preserve the original publisher bytes and acceptance limits. This COMMENT does not supply live/target-effect evidence or change #333/#199 scope. Prepared with OpenAI Codex.

[dinakarjs]

@wlad232 I have also prepared the requested mainline synchronization as a signed adoption companion: dinakarjs#7, merge commit 4663734. It retains your original head and appraisal bytes. The merged tree passes 60 root tests, the 54 normal/-O offline cases, all 30 reference shapes and manifest/compatibility/generated checks. Please adopt it into this existing PR and run its hosted links/normal checks; I have not pushed to your branch or treated the local sync as a successful hosted crawl. The original four UNMET scenarios and #333/#199 scope remain. Prepared with OpenAI Codex.

[wlad232]

@dinakarjs @carloshvp @imran-siddique — adopted Dina’s mainline-sync companion unchanged into this PR at 4663734, preserving its authorship/DCO and all ten Alakris file blobs. Thank you for preparing and reviewing the refresh.

All 28 hosted checks pass on this exact head, including links, evidence checks, validation, Ruff and CodeQL; the earlier link failure is cleared. Local checks also pass (54 normal +54 optimized package tests, 30 references, 60 validator tests/50 manifests and 27 harness tests), with an independent rerun of the package checks and byte-identity verification.

The four scenarios remain UNMET, and the historical failing report plus the identity/grant/service-key and independent-effect limitations are unchanged. Carlos’s 29 October review describes the prior 7d3960d4 head; could you take a current-head look and confirm the next maintainer step for this bounded offline slice?

[dinakarjs]

Current-head follow-up: I reran check_package.py --fetch in a fresh Python 3.12 environment installed from the package hash-locked requirements. It fetched 30 immutable public artifacts and validated all 30 reference shapes. Package checks, MintID author bytes, October 8 Proofable bytes/envelopes and fetch-positive-dispatch pass. The historical Proofable author-byte FAIL is preserved, all four fetch scenarios remain UNMET, and independent_comparison_completed remains false. This is package/reproduction evidence, not signature or hosted-effect attestation. I contributed the adopted mainline synchronization, so independent review remains required.

[drk-ram]

Technical Review (integrations/alakris-authority-comparison/proofable_fetch.py & RESULTS.md):

1. Offline byte-pinned verification & atomic output safety: Pinning all ten artifacts from proofable/docs@e6eb5b9307be24a5d82cc7490f647f0c98e2d24a by SHA-256 (including SHA256SUMS and retaining downloaded scripts strictly as inert bytes without execution) and writing outputs via atomic temp-file replacement outside the input packet prevents hard-link inode overwrite and remote execution risks.
2. Fail-closed parser & envelope invariants: Rejecting duplicate JSON keys (including inside nested signed content), non-finite constants, ambiguous SSE messages, and verifying both EIP-191/qHash/DID-chain envelopes alongside generated-key negative controls ensures the appraiser cannot trivially pass on outer file hashes alone.
3. Clear boundary reporting: Explicitly separating integrity: PASS and positive_dispatch_appraisal: PASS from scenario conformance (UNMET / not_measured on EO01 and unattested wallet-to-publisher binding) maintains strict evidentiary accuracy in RESULTS.md.