L01-02 — Define complete inspection receipt #16

Activity

1. mberrys

   added this to the L01 - Evidence Core milestone on Sep 24, 2026
2. mberrys

   added a parent issue on Sep 24, 2026

   • L01 — Evidence Core module gate #2
3. github-actions

   set

   Promotion stage

   to

   Dev present

   on Sep 25, 2026
4. mberrys

   marked this as blocking on Sep 28, 2026

   • X00-06 — Verifiable receipts and content credentials for published artifacts #145
5. github-actions

   changed

   Promotion stage

   to

   Unstable present

   on Sep 30, 2026
6. mberrys commented on Oct 1, 2026

   

   mberrys

   on Oct 1, 2026

   ContributorAuthor

   More actions

   Acceptance evidence

   • Source SHA: 4388ca36db44cc187ba22031ef5e5aed8e3e2477 on unstable, in PR [0.3.0 first half] L01 Evidence Core train — unstable → stable #155 (unstable -> stable). The hosted PR runs checked out merge commit 2fa707a47677e56ca825ed9e28460d6edc3e138c; git rev-parse shows its tree (f4a0696645f24cf9fdecf87c7da7bb6a9748519f) is identical to the tree of 4388ca36.
   • Implementing commits: b9caa53e (receipt), 2bd7d2a9 (mapped CTest runs with the Release configuration), 874c953b (evidence manifest binding). Merged earlier to dev as PR L01-02: define complete Core inspection receipt #101.

   Criteria to test to hosted run

   Test executable: UnitTestsPreflightVerdict (UnitTests/tst_preflightverdicttest.cpp; it is in the mapped CTest regex printed by the agent_contract job). Hosted run: Release Gate 36782669896. In the full CTest pass, Test #44: UnitTestsPreflightVerdict ... Passed appeared on both platforms:

   • linux / build, job 110116570084: 100% tests passed, 0 tests failed out of 91; 44/91 Test #44: UnitTestsPreflightVerdict ... Passed 0.12 sec.
   • windows / build, job 110116569911: 100% tests passed, 0 tests failed out of 91; 44/91 Test #44: UnitTestsPreflightVerdict ... Passed 1.55 sec.
   • No Skipped/Not Run lines appeared in the CTest output of either job, and tst_preflightverdicttest.cpp contains no QSKIP.

   Criterion	Test (at 4388ca36)	Result
   Same input and policy produce stable identity	PreflightVerdictTest::receiptIdentity_matchesGoldenVector (line 1004). It asserts golden identity 8e94a7fe...933a8b, that a later document revision with the same bytes and policy yields the same identity, and a different golden identity 931952b4...da11f8 once the effective profile digest changes.	Passed on Linux and Windows (run above)
   Zero findings with missing required coverage is Incomplete	receiptTerminalStates, row missing-required (line 1142 data, 1155 body): check statuses cleared, no findings, expects Incomplete.	Passed
   Unsupported, budget-limited, cancelled, or parser-error paths cannot coerce to PASS	Rows unsupported, budget-limited, cancelled expect Incomplete and !allowsCertificateIssuance(). Row parser-error expects Error. Each row also asserts isPass() == (expected == Pass).	Passed
   All terminal states	Rows pass, fail, missing-required, unsupported, budget-limited, cancelled, parser-error cover Pass, Fail, Incomplete and Error.	Passed
   Mismatched provenance is rejected before publication	receiptRejectsMismatchedProvenance (line 1198): wrong artifact digest and wrong revision both fail with an empty identity.	Passed

   Fixture and artifact identity

   The vectors are in-source (golden identities above); no fixture or sealed output was added. Contract text: docs/PREFLIGHT_VERDICT.md, section "Typed inspection receipt".

   Check-change and architecture gates

   • Hosted agent_contract (job 110116496019) concluded success. It runs check-change.py --dry-run, so it plans the mapped proof and does not execute it; the execution evidence is the CTest runs above.
   • Local read-only run at 4388ca36: python scripts/agent/check-change.py --base origin/stable --head 4388ca36db44cc187ba22031ef5e5aed8e3e2477 --head-branch unstable --dry-run --skip-changelog exited 0 (plan only), and python scripts/agent/check-architecture.py printed architecture contracts ok.

   Skipped or unavailable lanes

   • On the push CI run for unstable (36782282330), the linux, windows and agent-fast jobs were skipped. The Linux and Windows build-and-CTest lanes ran in the PR's Release Gate run instead (above).
   • changes/codex-issue-16-inspection-receipt.evidence.yaml lists unresolved: core:scripts/ci/check_independent_validation_gate.py. It is carried in the other L01 manifests too and belongs to L01-04 — Prove independent standards and rendering claims #18.

   Changed files (implementation)

   LoopLibCore/sources/pdfpreflightverdict.cpp, LoopLibCore/sources/pdfpreflightverdict.h, UnitTests/tst_preflightverdicttest.cpp, docs/PREFLIGHT_VERDICT.md, scripts/agent/check-change.py, changes/codex-issue-16-inspection-receipt.md, changes/codex-issue-16-inspection-receipt.evidence.yaml. Later commit 4bcd75de (#20) extended the receipt (pdfpreflightreceipt.cpp) and the same test file; the run above covers that state.

   Observed result

   All Core receipt tests passed in a full 91-test CTest run on hosted Linux and Windows; all CI checks on PR #155 are green.

   Remaining risk

   • CTest reports per executable, so the per-function results are not individually visible in the logs. The cases above are read from the test source at 4388ca36.
   • The receipt is an in-memory Core contract; the report and bundle schemas are unchanged. Cross-process admission of receipts belongs to L01-06 — Audit untrusted PDF process isolation #20 and the module gate to L01-07 — Admit exact-SHA Core qualification #21.

   Quality review

   The change adds one typed receipt builder with explicit rejection of mismatched provenance, and the tests assert exact golden identities rather than only non-emptiness. I found no silent coercion paths: each non-pass state is covered by a named test row.

   Closes on merge of #155 into stable.
7. mberrys

   closed this as completedin #155on Oct 1, 2026
8. github-actions

   changed

   Promotion stage

   to

   Stable present

   on Oct 1, 2026