[amaybaum]

Status: independent review ACCEPT WITH CHANGES; README correction applied at 8c2bf6c4775f2b80f133935ba932ebd5378d3b73; review of final combined diff pending; merge not authorized; no dispatch authorized.

Authorization: owner ruling #1031 c.6666613671 (amaybaum, 2026-11-05), item B: "Prepare a narrow workflow PR replacing the fragile staging-commit dependency with 2714278a and the corresponding verified path. Before changing the pin, require proof that the replacement reads the same expected evidence bytes and preserves the full 28-module comparison. The 28-module result remains not independently verified; evidence preservation must not become scientific acceptance." The README correction is included under owner ruling #1152 c.6666823484: "limited to accurately describing the evidence location and verification status". Accountable Issue: #941 (the EXPECTED_28 obligation). Related: #918, whose closure waits for this to land and pass its checks.

Branched from main f051916a113c9412b3efbb1ff813ec57c2ed265d; main has not been merged in. Head: 8c2bf6c4775f2b80f133935ba932ebd5378d3b73 (two commits: 20aea1e9 re-pin, 8c2bf6c4 README correction and header wording, a fast-forward on 20aea1e9). Writer: writer-941.

Why

EXPECTED_28 was e73f7be3c343ce12c5f64b9dc1485a5a7ba5498c, which is not an ancestor of main; its only ref is the unprotected branch staging/introduction-repro-ext-20261027 (head 0a8f4930). If that branch went away, the lean-fresh-build activity's step "Worktree at the pinned commit…" would fail at the git fetch of e73f7be3 under set -euo pipefail, and the whole activity, including the 14-module comparison that rests on main, would fail (#941 c.6665390344 §2). §A.42 item 2.

Byte-identity proof (object reads in a fresh worktree of origin/main)

Object	Blob id	sha256 of git cat-file -p
2714278a:verification/audits/manuscript/intro-corpus-audit-20261026/introduction-repro-ext/results-121598983127-28.json	97a2377dbfc30987887dffea2b72e423feed079d	da95b823988f4b19d9944079bff147288540a06611adbe1270ab88ebd5d70d62
e73f7be3:papers/introduction_repro/results-121598983127.json	97a2377dbfc30987887dffea2b72e423feed079d	da95b823988f4b19d9944079bff147288540a06611adbe1270ab88ebd5d70d62
EXPECTED_28_BLOB = 97a2377d… read directly	—	da95b823988f4b19d9944079bff147288540a06611adbe1270ab88ebd5d70d62

cmp of the two path reads: byte-identical (114,828 bytes). The same blob is at that path on main HEAD f051916a.

Reachability. 2714278a7dd9057a73610658478661065152ca97 is an ancestor of main (git merge-base --is-ancestor 2714278a origin/main succeeds; it is reached through 6e72df0c, second parent of the #1132 merge b28888ff, which is also an ancestor of main). Per the ruling, 2714278a is used. actions/checkout with fetch-depth: 0 fetches main's history, so git cat-file -e "$EXPECTED_28^{commit}" succeeds without the fallback fetch.

What the workflow reads at EXPECTED_28 (enumerated from the steps)

The pinned worktree is created at LEAN_COMMIT (17b830bc), not at EXPECTED_28; that is unchanged. At EXPECTED_28 the workflow reads exactly one object, in step "Worktree at the pinned commit, tools and expected results from history":

1. git rev-parse "$EXPECTED_28:<path>", compared with EXPECTED_28_BLOB (the edited line). At e73f7be3 the path was papers/introduction_repro/results-121598983127.json; at 2714278a it is verification/audits/manuscript/intro-corpus-audit-20261026/introduction-repro-ext/results-121598983127-28.json. Both resolve to 97a2377d.

Everything after that reads the blob by id, not through the commit: git show "$EXPECTED_28_BLOB" > expected-28.json. The commit id also appears in run.json's expected.28 entry (provenance only). No other file is read through EXPECTED_28.

The 28-module comparison is unchanged

• expected-28.json is the same bytes (above), so the comparator's input is identical.
• The governed-module set in step "Every OIBridge source module built in this job, none replayed" is read from expected-28.json["expected"]["modules"]: 28 entries, unchanged.
• The comparator and extractor are read from ARCHIVE_COMMIT 48b18ac5 (unchanged); the for e in 14 28 comparison loop is unchanged.
• EXPECTED_28_BLOB, EXPECTED_14, EXPECTED_14_BLOB, LEAN_COMMIT, BH_COMMIT, ARCHIVE_COMMIT and both black-hole jobs are unchanged.

Local check of the edited assertion: test "$(git rev-parse "2714278a…:verification/…/results-121598983127-28.json")" = "97a2377d…" passes.

Files (combined diff against f051916a: +14 −7)

• .github/workflows/evidence-replay.yml:
  • EXPECTED_28: e73f7be3c343ce12c5f64b9dc1485a5a7ba5498c → 2714278a7dd9057a73610658478661065152ca97;
  • the path in the EXPECTED_28 blob check (line 98, was 92);
  • the header comment: names the retained path (on one line) and 2714278a, keeps e73f7be3 as provenance, and states that the 28-module result has no independent review recorded on main and is not independently verified there, and that the re-pin preserves evidence and is not its acceptance.
• verification/audits/manuscript/intro-corpus-audit-20261026/introduction-repro-ext/README.md: the paragraph under "Relation to .github/workflows/evidence-replay.yml" (old ll.57–60), which said the e73f7be3 pin was unchanged and the dependency unresolved, now states the pin 2714278a, the blob check, that the replay does not depend on the staging branch, and that the pin verifies nothing. The heading and the provenance lines 16 and 49 are unchanged. The file is not listed in verification/infrastructure/legacy-records.json, so it is a mutable record.

Trigger analysis

• evidence-replay.yml has only workflow_dispatch. Editing it triggers no run of it on push or pull request. Nothing has been or will be dispatched by this work.
• Pushes of fix/expected28-repin-20261105: verify.yml runs on push to main only; bridge-compatibility-research.yml and bg2-orientation-design.yml are path-filtered to verification/programmes/oi-qm/…, OIBridge/BridgeFiniteProtocol.lean and their own workflow files, and hidden-sector-replay.yml to main and verification/programmes/physical-realization/…; neither changed path matches. oret-phasea.yml, pe01-bounded-tests.yml and project-board.yml are dispatch-only. So neither push started a workflow.
• This PR: verify.yml runs through its ordinary pull_request trigger (a synthetic-merge run). No other workflow matches.

Local checks (§A.40), at 8c2bf6c4

• YAML parse (PyYAML): ok; actionlint 1.7.12: clean.
• tools/legacy_records_check.py 8c2bf6c4…: self-test OK; 303 records in 75 closed namespaces intact.
• tools/v3_verifier.py --receipts 8c2bf6c4…: 53 receipts, all hold.
• tools/artifact_placement_check.py, tools/duplicate_check.py, tools/staleness_check.py: OK.

Scope limits

• Evidence preservation only. The 28-module result remains not independently verified on main and supports no manuscript claim (§A.42 item 6; §A.46 items 1, 3, 7).
• The replay is not demonstrated by this PR: no dispatch is authorized.
• No branch is deleted or changed: staging/introduction-repro-ext-20261027 stays at 0a8f4930, draft/oi-introductory-paper-20261025 at 44236326.

🤖 Generated with Claude Code

https://claude.ai/code/session_011zDyUSyEszk3JJx83uXKKq

[amaybaum]

Owner ruling on scope and merge requirements. amaybaum, Claude Code session chat, 2026-11-05 (after 19:30Z):

For #1152, I agree with the review's additional scope check: if the re-pin makes the intro-repro README inaccurate, the correction should be included in the same PR, provided it is limited to accurately describing the evidence location and verification status. Require independent review of the final combined diff.
The merge requirements remain:

• Exact evidence-byte identity, with the 28-module comparison unchanged.
• The new pin 2714278a must remain reachable from main.
• No upgrade of the 28-module evidence's scientific status.
• Green exact-head CI and a separate merge approval.
• No manual replay dispatch without separate authorization.

After #1152 lands and post-merge main CI passes, the existing conditional authorization permits closing #918 without merging, preserving both branches and their recorded heads.

The owner also confirmed that #918's paperwork requirement (A) is complete. SC17, SC31 and SC33 remain open under #941 and do not block #918's retirement. Their evidence and accountable homes are preserved.

---

Generated by Claude Code

[amaybaum]

Independent review of 20aea1e9: ACCEPT WITH CHANGES (one required change)

1. The diff changes only the pin. It touches the header comment, EXPECTED_28 (l.61) and the blob-check path (l.97).

   • EXPECTED_28 is used at three lines:
     • l.84 fetch loop: fetch-depth: 0 already brings 2714278a in through main;
     • l.97 blob check;
     • l.106 run.json: provenance only.
   • l.98–99 read expected-28.json by EXPECTED_28_BLOB, which is unchanged. So do the governed-module set (l.157) and the comparator (l.173–175).
   • These are unchanged: the worktree at LEAN_COMMIT 17b830bc, job conditions, the guard, env, and the two black-hole jobs.
   • No other step reads the e73f7be3 tree, and no tool or gate reads this workflow.

2. Blob identity, recomputed. Both paths resolve to blob 97a2377dbfc30987887dffea2b72e423feed079d:

   • 2714278a:…/introduction-repro-ext/results-121598983127-28.json;
   • e73f7be3:papers/introduction_repro/results-121598983127.json.

   git hash-object agrees. sha256 is da95b823988f4b19d9944079bff147288540a06611adbe1270ab88ebd5d70d62, size 114,828 bytes, and cmp reports them identical. The same blob is on main at f051916a and c86de537.

3. Reachability and preservation.

   • Reachable from main and from the head: 2714278a (via 6e72df0c, second parent of the Retain the 28-module Introduction axiom-report extension (blob 97a2377d) as unreviewed evidence (#941) #1132 merge b28888ff), 48b18ac5, f5efa7a0, 17b830bc and eae01647.
   • e73f7be3 is not reachable; it is on the staging branch only.
   • The 28-module comparison is unchanged:
     • expected file: the same blob, 28 entries;
     • comparator: the same one, from 48b18ac5, which reads JSON content and --tree only;
     • governed set: drawn from the same blob.

4. The header is accurate, with no overclaim. It says the result is "unreviewed and not independently verified on main" and that the re-pin "preserves evidence and is not its acceptance".

   • Optional: "has no independent review recorded on main" would be exact.
   • Cosmetic: the path is split across ll.19–20.

5. Required change. verification/audits/manuscript/intro-corpus-audit-20261026/introduction-repro-ext/README.md ll.57–60 says the e73f7be3 pin is unchanged and the dependency unresolved. That becomes false on landing.

   • The README is mutable: it is not in legacy-records.json and is not in a native round.
   • Replace ll.57–60, keeping the heading, with:

     The workflow's EXPECTED_28 pin is 2714278a7dd9057a73610658478661065152ca97, the commit that adds this directory, reachable from main. The workflow checks that results-121598983127-28.json there is blob 97a2377d… and reads the expected result by that id, so the replay does not depend on the staging branch. The pin preserves the evidence and verifies nothing (see Status). The staging branch is kept unchanged, and none of its history is merged into main.

   • ll.16 and 49 stay as they are; they record where the blob came from.

6. No other file needs to change.

   • papers/introduction_repro/README.md l.6 is still correct.
   • The candidate-inputs.json workflow sha256 is a 2026-10-28 snapshot that already differs from main, so this PR does not make it stale.

7. CI. Run 42090743464 at 20aea1e9 was still in progress. There is no evidence-replay run, because that workflow is workflow_dispatch-only. All jobs must be green at the head that carries the README fix.

8. main has moved to c86de537 (docs: distinguish bounded observer access from finite total substratum #1036, README only). There is no overlap.

Next. Under the owner ruling c.6666823484:

• apply finding 5 in this PR, limited to the evidence location and verification status;
• run an independent review of the final combined diff;
• run exact-head CI.

Merge remains a separate owner approval. No dispatch.

---

Generated by Claude Code

[amaybaum]

Independent review of the final combined diff at 8c2bf6c4: ACCEPT on content

Ruling c.6666823484 requires a review of the final combined diff; this is it.

1. Scope. 8c2bf6c4 has a single parent, 20aea1e9. Against f051916a the diff is 2 files, +14 −7:
   • the workflow: header comment, EXPECTED_28 at l.62, blob-check path at l.98;
   • the README: the body of "Relation to .github/workflows/evidence-replay.yml" only, 4 lines replaced by 5.
2. README.
   • It is the reviewer's sentence verbatim, re-wrapped. It describes only the pin, reachability, the blob check and read-by-id, independence from the staging branch, "preserves the evidence and verifies nothing", and that the staging branch is kept.
   • The scientific status is not upgraded. The Status section is untouched.
   • The only new identifier, 2714278a, is on main, so §A.42 item 8 adds no gap.
3. Workflow logic is byte-identical to 20aea1e9 once comments are stripped.
   • The pins are unchanged: LEAN_COMMIT 17b830bc, ARCHIVE_COMMIT 48b18ac5, EXPECTED_14/_BLOB f5efa7a0/61cfd6ea, EXPECTED_28_BLOB 97a2377d.
   • The YAML parses.
   • The header is accurate, with no overclaim.
4. Byte identity and reachability hold.
   • The 28-module file at 8c2bf6c4, the same file at 2714278a, and e73f7be3:papers/introduction_repro/results-121598983127.json are all blob 97a2377dbfc30987887dffea2b72e423feed079d. That blob has sha256 da95b823…d62 and is 114,828 bytes.
   • 2714278a, 48b18ac5, 17b830bc and f5efa7a0 are ancestors of main (c86de537) and of the head.
   • The 28-module comparison is preserved.
5. CI at 8c2bf6c4 has not started. Run 42091639519 (verify.yml, pull_request) is queued. No evidence-replay run exists, because that workflow is dispatch-only.

No content changes are required. Before merge, three things are still needed:

• integration with current main;
• green CI at the exact head;
• the owner's separate merge approval.

No dispatch is authorized. After landing and green post-merge main CI, #918 closes without merge under the existing conditional authorization.

---

Generated by Claude Code