Let the CC's adjudication decide a P2-only "patch is incorrect" local review; port SQUASH_BODY_FILE - #1075

Scope

• What this PR changes, in one or two sentences: changes to tools/landing. (1) LOCAL_REVIEW_ADJUDICATION=<file>: a local codex-review that says "patch is incorrect" with only P2 and P3 findings lands only on the CC's adjudication record, bound to the review file's sha256, the pull request and the read head, with every finding listed with a disposition; the squash body records it (the CC's ruling of 2026-10-13). (2) SQUASH_BODY_FILE, ported from the CC's live nas_land.sh (the Land on the organization's repository as the merging account; stale-review rule and local reviews for the Codex gate #1061 follow-up), with a defined combination with the waiver and adjudication lines. (3) The second commit, on the CC's read: uet_land.sh refuses both variables when they are set, so a uet landing never inherits them. (4) The third commit, for the three reads at ca6f880 (the Claude read, the co-op's local codex review and Astra's read): the record's rules tightened, the gate bound to the digest the squash body records, and the body file's content checked three times. (5) The fourth commit, for the co-op's re-review at f3f1cab (the CC's adjudication: fix in this landing): the body reader writes the file's bytes, whatever the locale.
• Base commit: 993cc890b3ff3fc95fa7cdba51edd726565f9ace
• Lane: lane:foundation
• Owned paths touched: tools/landing/nas_land.sh, tools/landing/uet_land.sh, tools/landing/codex_gate.py, tools/landing/README.md, tests/test_landing_scripts.py, manifests/evidence.json (the changed files re-registered with scripts/host_receipts.py register_file)

The adjudication. The record, as README.md "Local reviews" shows (placeholders, not values):

Adjudication: local review <sha256 of the normalized review file> for #<pr> at <the read head's first 8 hex digits>
Finding: P<priority> at <location>: <title> (fixed|follow-ups|rejected)

• codex_gate.py (:412-435; the record is read and matched by adjudication, :281-337) turns the 4 into 0 only when all of these hold:
  • no codex-review has a P0 or P1 finding, and exactly one says "patch is incorrect" and has at least one finding (one with none has nothing to dispose of);
  • the record holds no NUL byte, and its last Adjudication: line names that file's sha256 (of the bytes the gate parsed), the pull request and the read head;
  • that sha256 is the one nas_land.sh recorded at the record's first read (LG_ADJUDICATION_SHA256);
  • the Finding: lines after that line are exactly that review's findings, one line for each (an identical finding twice needs two), one disposition each.
• The gate renders each finding's three possible lines and compares whole lines, so it parses none of the free text. Two findings that would render alike stop it.
• Anything else stays 4, with a reason in fixed words and nothing of the record printed. A record set where no review says "patch is incorrect" gives 4 too, so no squash body records a record that no gate checked.
• nas_land.sh (adjudication_check, :415-450) reads the record as it reads the waiver: once at each check, after the lock and before update-branch and ready, when the squash body is built, and again at the final gate.
  • It checks the binding line for the pull request and the read head, a sha256 of a listed review file, and after the first read the same sha256, which it gives the gate; a record holding a NUL byte stops it.
  • Otherwise it stops with exit 2 and names the record by file name only. With no local review set (the waiver path), a set LOCAL_REVIEW_ADJUDICATION stops with exit 2 before any call.
• The squash body is the offered body, a blank line and Adjudication: local review <sha256> for #<pr> at <head8> (LOCAL_REVIEW_ADJUDICATION).

SQUASH_BODY_FILE.

• The CC's copy has five references: the usage line, the header at :18-20, the check at :38-41 and the merge call. All five are ported. The check line ported, as the live copy has it (no host path in it): [ -z "${SQUASH_BODY_FILE:-}" ] || { [ "$SQUASH_BODY_FILE" != - ] && [ -f "$SQUASH_BODY_FILE" ] && [ -r "$SQUASH_BODY_FILE" ] && [ -s "$SQUASH_BODY_FILE" ]; }; here ${SQUASH_BODY_FILE+x} replaces ${SQUASH_BODY_FILE:-}.
• -, a value that is not a readable, non-empty regular file, and a set but empty value stop with exit 2 before the lock and any call. The empty value is a change from the CC's copy, which took it for unset and fell back to the default body (the same fallback as Land on the organization's repository as the merging account; stale-review rule and local reviews for the Codex gate #1061 P1).
• Since the third commit, the content is checked, not only the metadata: one bounded reader refuses a NUL byte, more than 64 KiB, anything but strict UTF-8 and a file that holds no text. It reads the file before any call (exit 2), when the squash body is built (exit 7) and at the final gate (exit 7, also when the text changed after the body was built).
• The merge takes the text of the second read as --body, alone or before a waiver's or an adjudication's line, since --body-file would read the file again when the merge call starts. The live copy passes --body-file; the README records the difference.

uet_land.sh (the second commit, on the CC's read).

• The first commit made codex_gate.py decide with LOCAL_REVIEW_ADJUDICATION wherever it is set. uet_land.sh runs that gate too, but would neither bind the record to the pull request and the head nor record it in a squash body. Either variable can be inherited, for example from a nas landing in the same shell.
• uet_land.sh (:34-40) stops with exit 2 when either variable is set, an empty value included (${VAR+x}, the Land on the organization's repository as the merging account; stale-review rule and local reviews for the Codex gate #1061 P1 test). It prints one line naming the variable as nas-only, before the lock and any call.

The third commit, for the three reads at ca6f880.

• The Claude read (CHANGES_REQUESTED, no P0 or P1):
  • P2-1, the sha256 forms: cited in the README ("The sha256 forms") and at codex_gate.py:391-395 and nas_land.sh adjudication_check: Python's hexdigest is lowercase through _Py_strhex and Py_hexdigits, and uutils coreutils 0.10.0's sha256sum writes the digest through hex::encode, lowercase in hex 0.4.3, then a space, the Text mode's space and the name (measured too);
  • P3-1: a record holding a NUL byte stops in both layers (nas_read in nas_land.sh, exit 2; the gate, 4);
  • P3-2: only the Finding: lines after the last Adjudication: line count;
  • P3-3: identical findings need a line each, a line beyond the review's count of its finding is refused, and the printed dispositions are counted a line each;
  • P3-4: nas_land.sh refuses LOCAL_REVIEW_ADJUDICATION on the waiver path, exit 2 before any call;
  • P3-5 (the CC's ruling): a "patch is incorrect" review with no finding is not adjudicable, so the gate stays 4;
  • the coverage asked for: a record bound from the start to another listed file (it kills a mutant of the gate's binding check, measured), an adjudicated landing through CODEX_LOCAL_REVIEW, a title holding ( and ), and a record and a body file of mode 000.
• The co-op's local codex review (pr1075-ca6f880b, "patch is incorrect", two P2s): the gate adjudicates only the file whose sha256 nas_land.sh recorded (LG_ADJUDICATION_SHA256), and the body's parts are read and checked again when the body is built, the merge taking that snapshot.
• Astra's first read (CHANGES_REQUESTED, two P2s): P2-1, the body file's content (the bounded reader above, again at the final gate); P2-2, the digest the body records bound to the one the final gate accepts. Its P3s: the duplicates are P3-3 above; "rejected with evidence" is the CC's to review in the record (README, Known gaps), since the gate checks no evidence text; the cited captures' sha256 are in the README's tables, and the installed bash manual is cited as UNMIRRORED; the host names in older registry entries are left as they are, as that read rules.

The fourth commit, for the co-op's re-review at f3f1cab (the CC's adjudication: fix in this landing).

• The P2 at nas_land.sh:95 (the CC's reader found it too): the body reader wrote the decoded text through sys.stdout, whose encoding is the locale's, so under an ISO-8859-1 locale "é" came out as the one byte e9, and "€" ended the reader with nothing written (UnicodeEncodeError, exit 1), while every check passed. It now writes the validated bytes through sys.stdout.buffer, their trailing CR and LF bytes dropped as before.
• The test compiles an ISO-8859-1 locale with localedef into a scratch LOCPATH. LC_ALL=C does not show the defect: Python 3.13 turns on its UTF-8 Mode for the C or POSIX locale (measured: utf8_mode 1, stdout utf-8), and no ISO-8859-1 locale is installed here. Under the compiled locale (measured: stdout iso8859-1, utf8_mode 0), the reader's output must be the file's bytes for "é" and "€". A C.UTF-8 control and a landing under that locale are included. Where no such locale can be compiled, the test is skipped and says why.
• The doc-only P3-2: nas_land.sh's header now matches the code. It has the exit 2 and exit 7 lists with the content checks, the body passed as --body (not --body-file), and the reason "-" is refused: to gh --body-file it means standard input, while this reader would open a file called "-" in the working directory.

SOTA sources

• cli/cli at v2.102.0 (https://github.com/cli/cli/tree/v2.102.0; installed gh 2.102.0; the local mirror at fc4b137c and a raw fetch on 2026-10-13 hold the same bytes):
  • pkg/cmd/pr/merge/merge.go (sha256 ca3849b4…): :177 --body-file "Read body text from file (use "-" to read from standard input)"; :138-143 "specify only one of --body or --body-file"; :146-153 a body file is read when the command runs and its bytes are the body.
  • pkg/cmdutil/file_input.go (sha256 94076f6234180f85f2a555a5733e024146ea2c0cac54af19c86c72b015252828): :8-15 ReadFile reads standard input for -.
  • pkg/cmd/pr/merge/http.go (sha256 17eb5418…): :72-75 a set body becomes CommitBody.
• openai/codex at rust-v0.162.1 (https://github.com/openai/codex/tree/rust-v0.162.1; installed codex-cli 0.162.1):
  • codex-rs/prompts/templates/review/rubric.md:85: the verdict, "patch is correct" | "patch is incorrect".
  • codex-rs/protocol/src/protocol.rs:3503-3545: a finding's title, priority and code_location, the triple the record lists, as review_normalize.py carries it.
• python/cpython at v3.13.16 (https://github.com/python/cpython/tree/v3.13.16; installed Python 3.13.16; the local mirror at cbc944f4 and raw fetches on 2026-10-13 hold the same bytes): Doc/library/hashlib.rst:217-220 (sha256 bf23b9b1…), Modules/_hashopenssl.c:652 (3805805c…), Python/pystrhex.c:145-148, :88-89 (7842f6d7…), Python/codecs.c:20 (244f9beb…): hexdigest is lowercase. And Doc/library/sys.rst:1838-1839 (91825c95…), the standard streams' encoding from PyConfig.stdio_encoding, with Doc/library/os.rst:142-144 (1d54f83b…), the UTF-8 Mode "enabled if the LC_CTYPE locale is C or POSIX at Python startup": why the reader writes bytes, and why the test needs an ISO-8859-1 locale rather than LC_ALL=C.
• glibc's LOCPATH (installed locale(7), Ubuntu's manpages 6.17-1, UNMIRRORED): "A list of pathnames, separated by colons (':'), that should be used to find locale data"; the test's scratch locale is built with the installed localedef (glibc 2.43) from the installed en_US source and ISO-8859-1 charmap.
• uutils/coreutils at 0.10.0 (https://github.com/uutils/coreutils/tree/0.10.0; installed sha256sum (uutils coreutils) 0.10.0; raw fetches on 2026-10-13): src/uu/sha256sum/src/sha256sum.rs:6 (48254a0a…), src/uu/checksum_common/src/lib.rs:39-43, :91-93 (ad05144f…), src/uucore/src/lib/features/checksum/compute.rs:119-131, :203-220, :294-299 (077a6b11…), checksum/mod.rs:509-512 (362f62dd…), src/uucore/src/lib/features/sum.rs:46-48 (f03de154…), Cargo.lock:1295-1298 (0833b527…): the line and the hex digest.
• KokaKiwi/rust-hex at v0.4.3 (https://github.com/KokaKiwi/rust-hex/tree/v0.4.3), src/lib.rs:83, :137-140, :244, :259-261 (bc16c851…, the same bytes as the published hex-0.4.3.crate, whose sha256 7f24254a… is the lock file's checksum): encode is lowercase.
• torvalds/linux at v6.18 (https://github.com/torvalds/linux/tree/v6.18), include/uapi/linux/binfmts.h:15 (6f435af0…): MAX_ARG_STRLEN (PAGE_SIZE * 32), the body's ceiling (measured: 131071 bytes passed, 131072 did not).
• bash 5.3 bash(1) (installed: Ubuntu's bash 5.3-2ubuntu1, UNMIRRORED): Parameter Expansion, "Omitting the colon tests only for a parameter that is unset" (the ${VAR+x} tests), and read, "If delim is the empty string, read will terminate a line when it reads a NUL character" (nas_read).
• The CC's ruling of 2026-10-13 is the decision input (in the CC's coordination tree: research-cc-role-20261008/ruling-local-review-p2-only-adjudication-20261013.md).

Evidence-class table

Local commands run

At the fourth commit (the heavy runs idle-class, as below):

$ set -a; . <the CC's landing-prohibited-names.env>; set +a      # never printed
$ LANDING_PR_BODY=<this body> python3 -m unittest -v tests.test_landing_scripts      # at this head
Ran 176 tests in 148.585s
OK      # exit 0; the new locale test ran (an ISO-8859-1 locale compiled), and the body check too, so nothing was skipped
$ git archive f3f1cabe -- tests/__init__.py tests/fixtures/landing tools/landing | tar -x -C <scratch>      # the third commit
$ cp tests/test_landing_scripts.py <scratch>/tests/ && cd <scratch> && python3 -m unittest -v tests.test_landing_scripts.EndToEndTests.test_the_body_reader_writes_the_files_bytes_under_a_non_utf8_locale
FAILED (failures=3)      # exit 1: "é" under ISO-8859-1 gave (0, b'Caf\xe9 claim.'), "€" gave (1, b''), the landing stopped with 2; the C.UTF-8 controls passed
$ LC_ALL=C python3 -I -c 'import sys; print(sys.stdout.encoding, sys.flags.utf8_mode)'
utf-8 1      # why LC_ALL=C cannot show it
$ localedef -i en_US -f ISO-8859-1 <scratch>/en_US.ISO-8859-1; LOCPATH=<scratch> LC_ALL=en_US.ISO-8859-1 python3 -I -c '…'
iso8859-1 0      # the compiled locale the test uses
$ python3 -E -s -B scripts/validate.py      # after register_file for the changed files
{"components": 71, "hashed_files": 11884, "profiles": 4, "receipts": 240, "status": "passed"}      # exit 0
$ gitleaks git --pre-commit --staged --redact --no-banner --config .gitleaks.toml .      # the staged diff
no leaks found      # exit 0
$ python3 -E -s -B scripts/validate.py --scan-file <each of the 4 staged files> --scan-file <this body>
{"matching_locations": 0, "scanned_files": 5, "source": "host", "status": "passed"}      # exit 0
$ python3 -E -s -B scripts/validate.py --scan-history f3f1cabe <the fourth commit>
{"matching_locations": 0, "scanned_files": 0, "source": "host", "status": "passed"}      # exit 0

At the third commit (the heavy runs idle-class: systemd-run --user --scope -p CPUWeight=idle --quiet -- nice -n 19 …):

$ set -a; . <the CC's landing-prohibited-names.env>; set +a      # the explicit-name scan's names; never printed
$ LANDING_PR_BODY=<this body> python3 -m unittest -v tests.test_landing_scripts      # at this head
Ran 175 tests in 123.583s
OK      # exit 0; the body check ran too (LANDING_PR_BODY), so nothing was skipped
$ git archive ca6f880b -- tests/__init__.py tests/fixtures/landing tools/landing | tar -x -C <scratch>      # the second commit
$ cp tests/test_landing_scripts.py <scratch>/tests/ && cd <scratch> && python3 -m unittest -v tests.test_landing_scripts
Ran 175 tests in 121.949s
FAILED (failures=30, errors=1, skipped=1)      # exit 1; all 31 in the 13 new or changed tests, no other test fails there
$ <a scratch copy of this tree with the gate's binding-check return replaced by pass>; python3 -m unittest <the two coverage tests>
FAILED (failures=2)      # exit 1: the mutant is killed (the gate's case gave 0; end to end the recorded-digest check stopped it with another reason)
$ python3 -E -s -B scripts/validate.py      # after register_file for the changed files
{"components": 71, "hashed_files": 11884, "profiles": 4, "receipts": 240, "status": "passed"}      # exit 0
$ gitleaks git --pre-commit --staged --redact --no-banner --config .gitleaks.toml .      # the staged diff
no leaks found      # exit 0
$ python3 -E -s -B scripts/validate.py --scan-file <each of the 5 staged files> --scan-file <this body>
{"matching_locations": 0, "scanned_files": 6, "source": "host", "status": "passed"}      # exit 0
$ python3 -E -s -B scripts/validate.py --scan-history ca6f880b <the third commit>
{"matching_locations": 0, "scanned_files": 0, "source": "host", "status": "passed"}      # exit 0

Fail-before against after, for the third commit's tests (ca6f880's tools/landing with this PR's test module, against this head):

At the second commit's head (ca6f880):

$ LANDING_PR_BODY=<this body> python3 -m unittest -v tests.test_landing_scripts      # at ca6f880b
Ran 166 tests in 116.679s
OK      # exit 0
$ git archive 25a9b48e …; the same module there
Ran 166 tests in 127.712s
FAILED (failures=7, skipped=1)      # exit 1; all 7 in the 2 tests of the second commit

At the first commit's head (25a9b48):

$ LANDING_PR_BODY=<this body> nice -n 19 python3 -m unittest -v tests.test_landing_scripts      # at 25a9b48e
Ran 165 tests in 99.147s
OK      # exit 0
$ git archive 993cc890 …; the same module there
Ran 165 tests in 101.309s
FAILED (failures=51, errors=1, skipped=1)      # exit 1; all 52 in the 9 new tests

Decision record

The CC's ruling of 2026-10-13 (path above). These alternatives were considered and set aside:

• The gate ignores a record when the review already passes. Set aside: nas_land.sh would then record a record whose findings no gate checked.
• JSON Finding: lines. Set aside: rendering each finding's line and comparing whole lines parses no free text, and the README's jq line writes the record (a test runs it).
• An empty SQUASH_BODY_FILE taken for unset, as the CC's copy does. Set aside: it fails open, as Land on the organization's repository as the merging account; stale-review rule and local reviews for the Codex gate #1061 P1 did.
• (Third commit) A NUL byte dropped, as lg_text drops it. Set aside: the two layers would read different lines (P3-1), so both refuse it.
• (Third commit) The standalone body as --body-file. Set aside: gh reads that file when the merge call starts, after the final gate; the merge takes the validated snapshot as --body (the co-op's codex review, Astra's P2-1).
• (Third commit) The pinned digest passed in lg_gate's arguments. Set aside: lg_gate is in the shared block that uet_land.sh carries too; nas_land.sh exports LG_ADJUDICATION_SHA256 instead, which it clears at the start.
• (Third commit) iconv as the UTF-8 check. Set aside: glibc 2.43's iconv took code points above U+10FFFF (measured), while Python's strict decoder, the one the gate decodes a record with, refuses them.

Overturned by: a measured landing where the binding or the rendering refuses a record the CC wrote from the README's commands.

The CC's read of the first commit (2026-10-13) accepted five choices: the registry file, 4 for an adjudication on a passing review, an empty SQUASH_BODY_FILE refused, the sha256 binding to a listed review, and the Finding: line format. It did not leave the uet gap as a follow-up, since this PR creates it, and the second commit closes it.

Follow-ups

• "Rejected with evidence" is the CC's to review in the record: the gate checks no evidence text, and no evidence field is defined (Astra's P3; README, Known gaps).
• The read packet's custody (Astra's P3): the cited captures' sha256 are in the README's tables; attaching the captures themselves is the read packet's to do.
• SQUASH_BODY_FILE carries no pull request or head binding (the co-op's re-review at f3f1cab, P3-3; the CC: a Follow-up): the file names neither, so a body written for one pull request would be taken for another. A binding line, as the waiver's and the adjudication's, would need a format and a check of its own.

Checklist

• New/changed GitHub Actions are pinned to a full commit SHA with a
  version comment (no floating tags). (none changed)
• New/changed workflows declare top-level permissions: {} and grant each job
  only what it needs (contents: read, or an explicitly justified addition). (none changed)
• No secrets are printed, logged or committed; no new required secret was
  added without a documented owner.
• No new paid hosting, subscription or billing surface was introduced.
• Peer-owned untracked files and worktrees were preserved (not deleted,
  moved or overwritten).

Co-Authored-By: Claude Opus 5.5 [email protected]

🤖 Generated with Claude Code