Repository navigation
Decouple native source identity from independent review (#109) - #110
Merged
Merged
Conversation
Address independent review blockers F1 and F2 for #109 in PR #110. Check covered entries and tree parents without following links, propagate metadata/traversal failures, and refuse untraversed directories. Both wheel validators reject explicit nonregular source-manifest ZIP metadata while accepting ordinary POSIX, untyped, and DOS file representations. Add real CLI and metadata-only archive regressions; explicitly refresh the implementer-owned canonical source manifest. Preserve qualification v2/p2 and all native build, provenance, route, payload, anchor, and FP gates.
Windows Python 3.14 calls lstat directly, bypassing the legacy stat-only error fixture. Inject the failure at both filesystem metadata calls while preserving the refusal assertions. Explicitly refresh the mechanical source manifest.
Member
Author
|
FINAL REVIEW: ACCEPT Independent return-to-closure review accepts the complete PR #110 candidate at:
Both prior blocking findings are closed. Acceptance covers issue #109 implementation, the complete exact PR candidate, and exact-head qualification/build/distribution evidence sufficient for this gate. No additional blocking or nonblocking findings were identified outside the issue/PR scope. This acceptance does not accept WP11, Checkpoint C, or a v0.9.0 release/tag. |
IvanChernyshov
marked this pull request as ready for review
October 5, 2026 02:29
This was referenced Oct 5, 2026
8 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #109 after accepted WP10 and before WP11: source identity is mechanical, controlled qualification verifies technical evidence, and independent review governs final acceptance.
The canonical implementer-owned
native_source_manifest.jsonreplaces the retired procedural approval object. Qualification record v2 / policyissue88-p2binds exact manifest bytes while preserving effective-build, provider/CRT/TU/dependency, fixed-route, payload/consumer, anchor-last, runtime immutability and current-thread FP requirements.Return-to-closure remediation fixes both independent-review blockers:
Final head:
66e45c2680d85bffd5b718543b23b96ba7a45368Final tree:
ebbfd7509cd4d741f2bbbd525e1d6608433a6a7cBase dev:
0cf97de42065b35be914190a071967948fc90837Source-manifest SHA-256:
7d1e40f2692eceb6b24b5c269158f394c9a472152332daeba777682fd1cde6d3— 402 measured files, 80 Python consumers.Validation: 514 focused tests pass; lint, generated checks and strict docs pass. Actual final FULL CI: https://github.com/DeloneCommons/pyvoro2/actions/runs/37245748098 — attempt 1, completed/success, all eight required families and green CI gate. Forty-four jobs succeeded; only the optional test-linux-runtime/test-linux-compat alternatives skipped. Every successful job's checkout log names the final head. The final CI developer-tooling job passed 880 tests (7 skips), including notebook validation. Ordinary GNU evidence retains 5672 installed-suite passes (13 skips) and 865 fixed-route passes (4 skips). Sanitizer evidence remains safety-only: 1936 passes (4 skips), no record, empty anchors and all six ordinary refusals before/after.
Final release artifact: https://github.com/DeloneCommons/pyvoro2/actions/runs/37245748098/artifacts/11320471710
ZIP SHA-256:
4cda967fbfebba865eca318f4ddf3f677bb698a2f33db6dd6b67af984d2d34eb.All 20 wheels, one sdist, 20 distinct installation IDs, identical canonical manifests, records, consumer/native/dependency bytes, component boundaries and installation anchors were inspected. A direct four-byte ZIP metadata mutation of the actual final GNU cp313 wheel preserves every payload/CRC and refuses six explicit special types in both validators.
Representative ordinary GNU artifact
native-linux-py3.12: ID 11319725963, ZIP SHA-2567a8d44e32ab950126e4d184271c99634780a6230b0fbb111f153150bb63546d2.Historical reviewed head
1547c1135527c90418edd3f8cd8f66024545dfeeand run 37221927361 remain historical only. Two ordinary remediation commits continue this branch without rewriting history. Seven notebook-kernel failures in an earlier local tooling run were container networking restrictions; local native attempts refused incomplete assembly/changed loader evidence. No test or qualification checks were weakened.This PR remains draft/open for a fresh independent return-to-closure review of the complete final head and exact-head evidence. #109 remains open and #47's infrastructure gate remains unchecked. WP11 has not begun; Checkpoint C has not been accepted. No merge, tag or release action was performed; no source-approval mechanism was restored. This implementation handoff does not claim independent acceptance.