Close identity-binding asymmetry in blind readsets

Scope

Mask the remaining selected identities in exported evidence while preserving measurements. The repair covers executable installation decisions, slot/correction/roadmap identities, pinned layer components, owner/default prose and alternatives assignments. An operator-only comparison now tests whether these contexts identify prior winners differently from adopted nonwinners in every actual packet build.

• Base: d6ee6e1d355728794e2e7bd08694c3598bd0499d.
• V9 repair head: 5743e085351c7b10a706626543274387d6b7b2b6 (tree 416ff648d26ee2e78eedf640255e0d57596f10e2).
• Head: 07b5969d27e852a6bfe1153be0aed888ff359ba8 (tree 28aada546310a2dde1d38cffbc9abd32da16d62a): the V9 repair plus one CI-fix commit, described under Validation.
• Lane: lane:shared.

The two local commits descend directly from the base without a merge: 9c8c0e1 implements the identity repair and 5743e08 appends the supported advisory observation. The lane prompt and example lane are byte-identical to dab1f38b6aaaef20afd5b949d24318cc954b677a. Existing measurement artifacts, installation sources, eligibility rules and .github files retain their bytes. Historical advisory snapshots and deltas remain unchanged. Shared-lane acknowledgement and the normal merge requirements remain applicable.

SOTA sources

The change extends existing NAS mechanisms at the exact reviewed base:

• Source-bound readset redaction: exact path/pointer/source-hash field masks, reviewed spans and keyed audit records.
• Independent content audit: structural and prose detection independent of the redaction registry, with exact non-selection dispositions.
• Native role and exposure accounting, packet builder and blind exporter.
• Frozen lane contract: tools/sota-convergence/lane-prompt.md and examples/claude-native/workflows/layer-verdict-lane.js.
• Supported append-only advisory observation contract: native committed GitTree derivation, immutable historical baselines and exact monitoring counters.

Changes

N5-R2. Add winner_asymmetry.py, which reads restored operator candidates and prior winners but never writes those roles to a blind file. It scans actual export bytes for slot/default/owner/interim/deciding assignments, alternatives, correction prose, pinned layer identities, shell functions, installation commands and dispatch. Name/repository/package/CLI/function/owner/pin tokens are matched inside those contexts. Measurement subjects alone are not selection records.

The audit compares adopted-role incidence and binding density. It rejects either role-only separation and any unequal rate, including equal presence with unequal binding density. Native and wider cited closures are separately measured; the wider closure includes every path-like packet string and one JSON/string/link level. A whole-export scan also catches choices outside a layer's cited closure. Unscored zero-winner rows are labelled separately.

The independent inventory reproduces 97 structures in each V8 export: 50 selection structures and 47 host-package measurements. V9 removes the 50 selection structures and preserves all 47 host measurements byte-for-byte. All 104 top-level definitive-manifest measurement objects also survive unchanged. This replaces the earlier five-file inventory's overly broad interpretation, not measured evidence.

Installer decision and M1-b. Withhold both install.sh and accept.sh from the new-WSL installation plan's blind export. Their selected-slot functions, command arguments, dispatch and acceptance lists encode the chosen stack; removing only individual commands leaves that decision readable. Each whole-file removal has a keyed audit record, while the original repository scripts are unchanged. Remove the promptfoo manifest-following clause and owner-default acknowledgement rather than allowing them under an execution-history disposition.

The two V8-view scripts total 346,085 bytes. Every export loses exactly those two files; total bytes fall 276,033 in ledger mode and 276,051 in manifest mode after accounting for other masks and larger keyed audit metadata. Direct role-specific evidence volumes and shared install-command signals are measured separately.

L-t2, L-r and L-f. Fast controls now kill AUDS4, EMPTY1 and REPLNAME. Every replacement is checked against independently reviewed exact bytes, so an identity-bearing replacement cannot pass merely by omitting a choice keyword. Add positive and negative controls for stays/remains/is the selection, selected numeric versions and installs ... by default. Preserve measurement and UI-selection negatives.

L-b4. Remove newly vacated list/object members and list elements while preserving original empties and measurement objects. Withholding the decision scripts also removes the comment-header gaps. The expanded whole-export predicate finds eleven newly empty members in five V8 files and one comment-gap path; both counts are zero after repair. Their exclusive per-role incidence was already zero because the relevant files are shared. That zero attribution is not used as evidence of whole-export absence.

N6 and earlier repairs. Every registered decision cell remains masked, including final body rows. The registry has 52 header entries, representing 53 actual tables, 503 body rows and 542 decision cells. Earlier measured-neighbor, pin-provenance, parser, lifecycle and eligibility controls remain active.

Evidence classes

The new 11-method V9 module includes per-form positive/negative and density controls, closure controls, actual residual-form checks, replacement integrity, keyed installer removal and vacated-container controls. The existing all-packet readset test now fails if any scored layer separates or correlates by identity context. The blind exporter does not import the operator auditor; no winner labels or private tokens are emitted into a lane-visible file.

Two-mode results

Five manifest dates, both modes and newcomers off/on produce 20 exports, 640 rows and 64 mode/layer groups. Each grouped row contains ten actual builds. Counts below are scored rows; correlation includes separation and unequal binding density.

Across both modes, whole-export correlated scored rows fall 520 to zero. Every after candidate binding count is zero, rather than merely having equal role rates. The independent content audit reports zero after findings in every export. The retained 47 host-package rows are measurements, not unresolved selection findings. Complete native/wider per-layer before/after tables appear in REPORT-v9.md and the machine-readable measurement artifacts.

Broad lexical exposure is separate: 0/320 native rows in each mode, 80/320 wider ledger rows and 90/320 wider manifest rows. The L-f word-order extension matches additional raw tool-response/regex payloads and procedural documents compared with V8's older 40/320 and 50/320 figures. The same expanded predicate is used before and after in V9; these lexical matches are not independent selection findings. Exact/near counts remain 20/320 and 30/320 for ledger mode, and 20/320 and 40/320 for manifest mode.

Primary scored denominators are 560 winners / 1,600 nonwinners over 270 ledger rows, and 660 / 1,520 over 300 manifest rows. All-row denominators remain separately labelled:

Other after families include whitespace, Markdown, real emptied dictionaries, newly vacated lists/objects, blank shell comments, broader text marks and all seven earlier fragment families. All are zero after, both as whole-export paths and exclusive role incidence. Binder target paths rise 47 to 51 in ledger mode and 51 to 59 in manifest mode as additional fields are masked; exclusive binder-role incidence remains unchanged from V8.

Install-command role incidence is a separate shared-export signal. In scored ledger rows it falls 280/560 winners versus 510/1600 nonwinners to zero for both roles; in manifest mode it falls 300/660 versus 480/1520 to zero. Full per-role file/byte totals appear in volumes.md. Unequal evidence volumes remain disclosed, not treated as eliminated by zero identity-binding counts.

Exact document-retrieval pilot

Each of the 20 foundation::document-retrieval builds has six adopted candidates: three prior winners (markitdown, poppler and qmd) and three nonwinners. The pool remains neither exact nor near under the unchanged eligibility rule. Native, wider and whole-export after identity bindings are zero.

The source-hash binder still marks qmd, one of three winners and none of three nonwinners in every build. Each mode therefore has 10/30 marked winner occurrences and 0/30 marked nonwinner occurrences. The scripts that previously named qmd and markitdown against context-hub are withheld, so their install-command marks fall 2/3 versus 1/3 to zero versus zero. Measured benchmark subjects are retained.

Direct pilot evidence remains 38 winner file occurrences and seven nonwinner file occurrences per build. Winner bytes fall 459,132 to 459,114 and nonwinner bytes remain 210,767; exclusive file totals remain 25 versus one. These binder and volume differences are why the overall assessment remains PARTLY, not unconditional blinding.

Corrections to v8

REPORT-v8 said: "The separate complete-export slot probe records tobi-qmd 1 before, zero after, and all installed-owner assignments are absent from every V8 export." It also said: "Thus the pilot cited closure cannot reveal that selected slot or its installed-owner row through the reviewed structural forms." PR-BODY-v8 said: "The pilot's tobi-qmd slot and installed-owner assignment are withheld rather than treated as ordinary repository provenance."

The exact corrected claim is narrower: V8 withheld the QMD slot and installed-owner assignment from its JSON decision indexes. It still exported tobi-qmd(), @tobilu/[email protected] and the selected-slot dispatch in install.sh in all 20 builds. That script was outside the pilot's cited closure, but visible in the whole export. Its commands named two of three pilot winners and one of three nonwinners. The old pilot 1-before/0-after structural count concerned the accepted memory record, not proof that the executable choice was absent. V9 removes that executable selection channel; the separately disclosed 1/3 versus 0/3 binder residual remains.

The V7-to-V8 binder delta was 48/52 to 47/51 target paths in ledger/manifest modes. The removed target was evidence/artifacts/harbor-0240-currency-20261009/receipt.json, which had marked the only quality-evaluation nonwinner. That layer's [marked W, all W, marked N, all N] tuple changed [0, 2, 1, 8] to [0, 2, 0, 8]. Across ten builds, every mode/scope lost ten nonwinner marks while winner marks stayed unchanged:

Ledger scored nonwinner incidence fell 4.38% to 3.75%, widening the role gap. V9 has the same exclusive role incidence as V8, while additional source-bound masks increase target-path counts as stated above. The prior 352-to-zero five-file inventory never established absence of all identity bindings from every exported file; the independent 97-per-export inventory corrects that interpretation.

These corrections are recorded in V9 only. The delivered V8 report and body retain their reviewed hashes 446eaaeae17d990a4ceffad05e791fb614b01c74efc4ea7dfb034f82429f666c and 91014510340ce651fa69a1962d5cd4bac19bb14853b68ad82769e375cb670cb4.

Validation and chronology

The first focused run at 9c8c0e1 ran 845 tests with two advisory-inventory failures, 30 skips and no errors. The immutable V8 parent passes both original tests with 357 advisory locations; V9 has 385, adding 23 reachable reads in codex_hook_trust.py, four in grand-dashboard/progress.py and one in omniroute-codex-sdk/worker.py. Commit 5743e08 appends the supported monitoring-only observation and index entry. No historical baseline, test assertion or execution authority is weakened.

Final-head focused suite at 5743e08: exit 0; Ran 845 tests in 2517.655s, OK (skipped=30). Log measurements-v9/final-focused-advisory.log, SHA256 22645912e0fdf81866494109ba475e7501b30abc09b94bfd8d193ba9161e0270; the run completed at 2026-10-21T14:19:54Z (recorded by the wave builder).

At final head 5743e085351c7b10a706626543274387d6b7b2b6, all three required validators exit 0: scripts/validate.py reports 71 components, 12,364 hashed files, four profiles and 243 receipts; scripts/evidence_manifest.py --check passes all 12,364 files; scripts/validate_convergence.py --all-recorded validates all 33 recorded results. Both contract files remain byte-identical to dab1f38, with SHA256 d3ef2cc0c06d33d6a4a058f5e74a1cf5be8a3760cc2b0b5572598f0e0e4288e4 and 09f03c824488ea37c4384c2d4bc867ecc2211d2fce4d50ba08c0dd8f91e7b289.

The operator snapshot was prepared before the commit; final proof asserts that every source/registry content hash equals this exact head. Earlier exploratory matrices and interrupted attempts are retained as history, not passing final-head evidence. V9 work is local, offline and model-free. No hosted V9 CI or external-review result is claimed, and predecessor successes are not transferred to this head.

Historical corrections remain scoped: the original failed GPT local run was 828 tests, 17 failures and six skips; the successful supplied V7/V8 snapshots concern only their own heads and supported scanner setup. Certifi attribution is limited to the historical 49f0d3a scan. REPORT-v3's correct SHA256 is 72874a473adc5d2c71ddaf1fba4cd9c5f9473309f30f674218c7ee23ee78be4b. V4 had 47 hash-bound targets plus one instruction replacement, and the unsupported 28-failures claim remains withdrawn. No OSV ignore or security-workflow change is introduced.

CI fix at 07b5969. Hosted CI at 5743e08 failed validate-shard-5 (and the aggregate validate): tests.test_us_equities_strategies.ContractTests.test_live_lazy_import_comment_locators_include_the_cited_blocks failed five subtests, because V9's blind_checkout.py edits moved its three lazy-import blocks and the comment locators in blueprints/runtime-workers/openhands/resolver/patch_policy.py and tests/test_runtime_worker_openhands_resolver.py still cited 439-440, 634-635 and 1059-1060. Commit 07b5969 re-points them to 443-444, 643-644 and 1068-1069 and updates the two files' sha256 values in manifests/evidence.json (byte counts unchanged); nothing else changes. Locally at 07b5969: tests.test_us_equities_strategies, tests.test_runtime_worker_openhands_resolver and tests.test_runtime_worker_openhands_push_gate ran 297 tests, OK (skipped=19); scripts/validate.py, scripts/evidence_manifest.py --check (12,364 files) and scripts/validate_convergence.py --all-recorded exit 0. The hosted required checks at 07b5969 are the authoritative CI result.

The repair closes the measured identity-binding and rewrite forms. It does not remove original-source hash binders, adopted roles, unequal evidence volume or arbitrary semantic inference.