From 29726577174bec4b885210a2a0cb509e8aa1947c Mon Sep 17 00:00:00 2001 From: Qwynn Marcelle Date: Tue, 11 Aug 2026 14:15:15 -0400 Subject: [PATCH 1/3] evidence: frozen driver for the canonical external co-change run (META-310) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The driver that produced canonical co-change artifacts for three external repositories, committed as the exact bytes that ran. Its sha256 is published in the evidence receipt, so these bytes are the reproduction claim rather than an approximation of it. It lives here rather than beside the artifacts in workspacejson/standard because it imports @workspacejson/cli, and standard sits at the top of the dependency graph — its architecture check correctly refused the file. The invariant is worth more than the convenience of a self-contained directory, and reproduction already requires both repositories pinned, so nothing is lost by the split. meta310-mine.mjs sha256 5be5c814caed895b30a26d6fee697e1b65bc01c95789235dc49ad2a3f805e83c runner-package.json sha256 fed868de3cce3c5e75010fa7062221fb53f155a20ca90c850c5ed47be5a59795 The driver passes no options to mine/score/select: the analysis contract is whatever the pinned source froze, not what the driver adds. It exercises two paths and cross-checks them pair-for-pair — the producer path through the copy of mining-core bundled into the cli tarball, and a receipt path through the separately installed mining-core that exposes basisWindow, exclusions and the selection receipt the artifact does not carry. A disagreement aborts rather than being reconciled. runner-package.json records the clean-install cache defense: cli declares spec and rules by version, and candidate and published packages carry identical version numbers, so overrides force file: resolution. Note for readers: the file contains three NUL bytes, used as separators in the cross-check comparison key. That is sound — a NUL cannot occur in a path — and both sides of every comparison use the same function, so results are unaffected. It was not edited after the run; correcting it cosmetically would change the digest and make this something other than the driver that produced the evidence. Gates: architecture, package-docs, tests, typecheck — all green. --- evidence/meta-310/meta310-mine.mjs | Bin 0 -> 8174 bytes evidence/meta-310/runner-package.json | 16 ++++++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 evidence/meta-310/meta310-mine.mjs create mode 100644 evidence/meta-310/runner-package.json diff --git a/evidence/meta-310/meta310-mine.mjs b/evidence/meta-310/meta310-mine.mjs new file mode 100644 index 0000000000000000000000000000000000000000..fb036e49d7592d263ce6ad90105385a8bce7e559 GIT binary patch literal 8174 zcmb_h>u%dt65ii_iU|-@R3XuqB5feYaTD9wwA;pp?X*9<#+o9JB*qkva1Lo%bp`B0 z>=W*j>^J8|Qn8D6+W@UaYG%%yxqNfc_LpC7(Up2jSGzluCZ#O%G$|;R!*rIE zQ$eaOV-PXjJ0*V+C1onV6Dp?DQczyr$uy~QS<*r%suDF76)CZhInTBPCT*YuH|-w;~&{GDN$vIr!}S^!Ve^$+_XB|Ni?wG!>;#Q0-@_ZuKHb#rIm4 zk&+TOd068=zTx{^vnNKCs>QlLup%LKIm^=-)od1f-^GgLq+`psA3q%baB>XAVJ$;c z*_dHuOV`KE1xfL3woeb3Ap)vqGzglQL0vpO7`{}N+eAB4p+KZmFWiUEHAQu0c=vCb(>{=o8^k>2e^HbdF}x%RbC1I z*cCSENcbf4vim(}FwSW7dNdmY&$mmTq@R$a+i8(^6okEiKAZ*kV{^cpVS^K<^( z=$T=oUw@@%p3^*7<~}`a5#y+qg@}bxQboP`{|uHMj-;RqBC#@Bto;q9h~xu`prr28 z!D~j<5F}9#-}VM{)f*n+k5_d-am=^U*FZ`VWhyfmc0|3pn!N1Mx*u06pGP=&Yugq| zRBiselQQFK`Uk7Cs@BC>MZq0|;Cl@R$Qu0P@p>fsFHs(`=F}Fng4N zNQXfq(z9gm#n;4w=;p!T*ttWJ0jzpt%Jce$mU%T}X>$CD6ZTfDQ1y^gIBUG3kC*R; zyI+GI$%(RxqfDtH)V91}1SrK4e??3`c?~O517RgwwCS6j-Mz0~?0voaO*VnW7^wgn zuHu+r1}>LbqB8oHUW%QU>C2R{VS8&*m#OIuKrlwa!k*oCZ*i|HUZyXi=i*YCw0_CIav187@?# z+#@hV*7ua`8_*?)x~s7zjS_lAV>+baE{y>7ugwF0-szjTCvTFQhvyGY0dv#n>NXsB z^Zeoai_;IW4radXuSd@xHmnid_18CTldO$N*3QhIo29JhW1)KV#TWGKgZT_EyyIXO z!3~`0gn(8kvxq1pKX8ZWsC?Q7G3qwO$^ZzX#phby+3(#+`Hzc zjx{L?xqOstIL!6X5wsd@aGIp+ackIPAqI`k(3O_ek*v$=O?8%+BeGtP8U+eiiO(Ox znZPer2rTwZ%8V`Lpxv4wbeo2M@?U6yoc*dDnC}=~jZ3*?oVI3FLSwSPSIIH~;5}NF zqoxR$M%l~)zEcJ`)&ic|--3r?Kf9b1$pT&aj|>IPp){mw#}c~GITsUXFawoU)a%9QuF6WYMFZ-_47(h(1*R>}f1WJCZberZoH($$-?e)m zluFy7^RXc*_P5q(aM9dRWD2&$LNA*uz3pfHt2h6%W$j>(pa!AY<6%Q&XxNi2~aUN4Y z0HWk32@^_5Z{A*A=6t+ro;sOU4i0{e-Ma%3G)UIx!e({jN2cLhKWssnC9W4 zoMN`&mc-20sVr=kSrOhNXUHVbk3!qiEv@#_AW$oVS|jTA3SLYfA?ZKIh4BhXEJvM{ z;PUh>U+BVgUl_p6zsBZW3wA0zXMh*qRnSQxobS%C^(A^jZqwiSu7O&LGMYZt68W?H z-3EpmLV>Xj`GvxKA*#p|+71GJ82V+`+%Rz@`mt$JT1|p)L)vK(BW@SsO`Vz6+hz#y z;9BKq`~G2%9nlqfMyJEIwKHI;TwS2ditHTd-MAIU&P9atS)(40{XIoe7yMk03P^y+{_EE|p> z4@2UG6?rnxE6f5dSuXMq=|{j>49W-|3U=iFdGj1ZR69?wcuDSmulVHtkBT=q-9_NI zl8ckjhzDKmG`cgO-5pa3P**&{qg~_)7>MZt|MB@a>c@^!1l%>EIM6#XY#po1oEnLV$0ubKAhy6+Ilff@JD2!N-l+jnOkSPj?z3%aZ!gEgp3q3OYOz^kFq!!fNypcwFdGgd$}T%1%L5Wzg>CP3fD~(a z&OdZJ$bJpGc$tXX=Cw7QL1?@2LrHZ9#jUq&@4&zDz9|N*5USH#E~PCw?bjPl4!gyX zQyF7n90v`W-J{QbIO_ve+gQ!f}^;tf45FwCOsGiyOG zI=q6ggrS%RZEPB`vO^ySNwPGnQ@hB+)L+_-ILmxY_esCZ@ za*xA!gUm;Ah|Rqh0g*OHFC})le^9IiE^EED{bRKs+y z3L73Z`*&lQF$Q>SPs8W|4`EO4mN(LkNBq#ko$fjj9(W1u^wr;jhi#) zZdV>gG~W0gi|w-FAGI1*Gxd5pZrhUB*8b>zK)JEcy`{Oz?R0JMmDdwbjYl4@P8hhM z{+}3){xpVT7l~aI?}_z%1H(1{9?&4T?~^*kF+jTe5$TE9*!xx`%ROB9_so`_C1Hlv zNXH^fyl@n>ln-HG)jqGw_jWz=NQ<8AH5qakQsj5`;caGHD*W_>pSfCsgWSjZa`Mf+ z)y^PsyKP#|um|Vg8op~H(i#u5uTLTj@gCXOQ@FC*CvXkoH&3k-n9Fod8#eUYhn7-w zV31>z@HdQXk|AOSuV+xB Date: Tue, 11 Aug 2026 14:24:13 -0400 Subject: [PATCH 2/3] fix(evidence): make the runner manifest portable, and say what stopped being frozen MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Review on #21 found that runner-package.json pinned every dependency and override to an absolute /private/tmp/... path from the originating machine. Installed anywhere else it fails before the driver can run, so the file documented the environment while preventing anyone from recreating it — the opposite of what an evidence manifest is for. Correct finding; fixed rather than argued with. Paths are now relative to a tarballs/ directory beside the manifest. Verified end to end rather than by inspection: a fresh directory, tarballs copied in, npm install, then the driver run against standard @ 8e08c8c reproduces history-block 7012352617df with 50 entries, valid, cross-check identical. The install audit still shows 0 registry URLs for @workspacejson/*, all four resolving file:, and exactly 1 copy of @workspacejson/spec. This makes the manifest deliberately NOT byte-frozen, which is a real change to what the receipt claims, so it is stated rather than absorbed: as-run fed868de3cce3c5e75010fa7062221fb53f155a20ca90c850c5ed47be5a59795 now no longer matches that digest The two differ only in the tarball directory prefix. The package set, versions and the overrides that force file: resolution are identical, and no result depends on the prefix — the run depended on the CONTENT of the four tarballs, whose digests are recorded in the evidence receipt and are unchanged. meta310-mine.mjs remains byte-frozen at 5be5c814 and is untouched. The driver's bytes are the reproduction claim; the manifest's absolute paths were machine noise. Freezing noise would have been cargo cult, and freezing it at the cost of reproducibility would have been worse. README.md added: what is frozen and what is not, the four tarball digests, the clean-install cache defense, and the calibration a rerun should confirm before any target is touched. Gates: architecture, tests, typecheck — green. --- evidence/meta-310/README.md | 88 +++++++++++++++++++++++++++ evidence/meta-310/runner-package.json | 12 ++-- 2 files changed, 94 insertions(+), 6 deletions(-) create mode 100644 evidence/meta-310/README.md diff --git a/evidence/meta-310/README.md b/evidence/meta-310/README.md new file mode 100644 index 0000000..85343d3 --- /dev/null +++ b/evidence/meta-310/README.md @@ -0,0 +1,88 @@ +# META-310 evidence driver + +The driver that produced canonical co-change artifacts for three external +repositories. The artifacts, run receipts and the full evidence receipt live in +`workspacejson/standard` at `docs/evidence/meta-310/`. + +This directory holds only the tooling, because the driver imports +`@workspacejson/cli` and `standard` sits at the top of the dependency graph — +its `check-architecture` refuses any file in that repository importing a sibling. + +## Files + +| File | What it is | +| -- | -- | +| `meta310-mine.mjs` | The driver, **as the exact bytes that ran**. `sha256 5be5c814caed895b30a26d6fee697e1b65bc01c95789235dc49ad2a3f805e83c` | +| `runner-package.json` | The runner manifest, **rewritten to be portable** — see below | + +### `meta310-mine.mjs` is byte-frozen; `runner-package.json` is not + +The driver's digest is published in the evidence receipt, so its bytes are the +reproduction claim rather than an approximation of it. It has not been edited +since the run — including three NUL bytes used as separators in the cross-check +comparison key, which make Git render it as binary. That is sound (a NUL cannot +occur in a path, so the key is unambiguous) and both sides of every comparison +used the same function, so the reported results are unaffected. + +The manifest is a different case and is **deliberately not byte-frozen**. As it +ran it carried machine-local absolute paths under `/private/tmp/...`, which +resolve on exactly one machine and fail to install anywhere else — so shipping +those bytes verbatim would have documented the environment while preventing +anyone from recreating it. Raised in review on PR #21 and fixed here. + +The as-run copy hashed +`fed868de3cce3c5e75010fa7062221fb53f155a20ca90c850c5ed47be5a59795`, and that +digest appears in the frozen-contract receipt. **It no longer matches this file.** +The two differ only in the tarball directory prefix; the package set, the +versions and the `overrides` that force `file:` resolution are identical. No +result depends on the prefix — what the run depended on is the *content* of the +four tarballs, and those digests are recorded in the evidence receipt and are +unchanged. + +## Reproducing + +1. Check out the two pinned revisions and build from **clean detached worktrees**, + not working trees: + + - `workspacejson/cli` @ `031c3504a0977b8d90ac518c82a39a2f4ec741a9` + - `workspacejson/standard` @ `f95c42f89c8fe39995c10918bea880729cf17bbd` + +2. `npm pack` these four into a `tarballs/` directory beside this manifest, and + verify the digests against the evidence receipt: + + | Tarball | `sha256` | + | -- | -- | + | `workspacejson-spec-0.4.4.tgz` | `2e0c326e7d8b50d3e3fa801944659803cd95d13dc253e65e1ace8dfccf949111` | + | `workspacejson-rules-0.4.4.tgz` | `548dd788725899ccaded6568121a271eeb593f143c581ec7e4714b50d9e5dbb7` | + | `workspacejson-cli-0.5.2.tgz` | `aa0ab7526a8f8fc6316f8b809d2ee5cdd04c80c5483a29d39e8dfbcc2e15ad18` | + | `workspacejson-mining-core-0.0.0.tgz` | `4f2a632d874dc862fc6425c81324378598c6183215aa80fe88465c3e0847577e` | + +3. Copy this manifest to `package.json` in a **fresh** directory — no reused + `node_modules`, no carried-over lockfile. `@workspacejson/cli` declares `spec` + and `rules` by *version*, and the candidate and published packages carry + identical version numbers, so nothing but `file:` resolution distinguishes + them. Then `npm install` and audit it: + + ``` + registry URLs for @workspacejson/* in the lockfile must be 0 + all four packages resolve file: + copies of @workspacejson/spec in the tree must be 1 + ``` + +4. Clone each target **full, not shallow**, check out the pinned revision from + the evidence receipt, and run: + + ``` + node meta310-mine.mjs