Receipt repairs for the GPT-6 findings on #277/#281: upstream suites for FastAPI, pandera, DuckDB; 12 independent vetoes - #331

Summary

This PR repairs every supported GPT-6 cross-family finding on the merged PRs #277 and #281. Those findings covered 11 receipts. Receipts are immutable, so each defect is fixed by a superseding receipt, and every defective receipt that still carried an independent agree gets an independent needs_changes. The derived status of each winner is unchanged; it now rests on the corrected evidence.

New receipts (generated from the receipt JSON):

Merged receipts that received an independent review in this PR (only reviews appended; contents unchanged):

What was wrong, and the fix (GPT-6 findings, all verified before repair)

• 277-1 mcporter: configuration isolation was assumed, but an inherited MCPORTER_CONFIG overrides the temporary HOME. The fix neutralizes it, uses an explicit empty config, and adds a configuration-isolation control.
• 277-2 socraticode install: a trailing || echo made the command exit 0 with socraticode absent. Now it fails closed, with an absent-command control.
• 277-3: "starts" is now metadata-only wording, since nothing started the tools.
• 281-1 lean: the primary run failed open through ! grep on a missing log. Now it fails closed, and the control run is separate with its own log, exit code and empty-order hash.
• 281-2 fastapi: cleanup is now scoped to the owned process group via a trap.
• FastAPI qualification: it now runs FastAPI's unchanged upstream scripts/test.sh at tag 0.141.1, set up with upstream CI's uv sync --locked --no-dev --group tests --extra all: 3,347 passed, 17 skipped, 5 xfailed. A fault control (422 → 400) fails with 519 failures, and the upstream first-steps example passes 7 of 7 checks under fastapi run. The earlier hand-written blueprint oracle is kept, labelled local_integration.
• 281-3 pandera / duckdb: the use--20260925 receipts ran repository fixtures, which is local_integration, not native_proven. They are replaced by the projects' own upstream test suites at the pinned tags, each with a control that must fail. The old receipts carry needs_changes.
  • pandera use--20260926-2: upstream tests/pandas (except 4 files that fail to collect for missing optional modules), 2,170 passed, 10 skipped, 4 xfailed. The control replaces ErrorHandler.collect_error with a no-op and pytest exits 1.
  • duckdb use--20260926-2: duckdb-python v1.5.5 tests, 205 passed, 13 skipped. The control truncates the 11 data files to 0 bytes and gives 34 failed, exit 1.
• 281-4 promptfoo / inspect-ai: the native reports are retained and sanitized under evidence/artifacts/eval-native-reports-20260926/, with hashes. Re-running a command now writes to a temporary directory and compares hashes, so it never overwrites the tracked files.
• 281-5: poppler's GOODSIG/VALIDSIG lines and systemd's result/status lines are now printed first, so they sit inside the retained excerpt.
• 281-6 / 281-7: install-source and uvicorn-pin wording now matches each component's evidenced install source.
• Controls: evidence/artifacts/receipt-repairs-20260926/ retains 8 receipt-derived fault-injection controls plus 1 standalone reproduction, with the harness source as it ran.

Review

1. GPT-6 review: found the defects on Token-profile install receipts and a MCPorter use receipt on the workstation (MCPorter host_verified) #277 and Grand-catalog evidence bank on the workstation: 7 WSL winner rows to accepted, local-model eval E2E (promptfoo, Inspect) #281 (posted on those PRs).
2. Opus repair: fixed them; an independent Opus review followed, then an Opus finisher and an Opus verification.
3. GPT-6 verification pass: confirmed 277-1 to 277-3 and 281-1 to 281-7 resolved, and found three more problems, all now handled:
   • defective receipts still counting;
   • FastAPI's hand-written check labelled native_proven;
   • a stale matrix.
4. Independent headless reviews: claude -p, claude-opus-5-5, recorded 12 needs_changes and the agrees shown above. They re-ran the new commands in throwaway copies and re-checked the FastAPI upstream facts in a separate clone.

The #277 description is corrected in a comment on #277.

Residuals

• The first generations recorded on 2026-09-26 stay in the tree with their independent needs_changes. The systemd one kept its failing run (result fail).
• Layer-scoped host-receipt verification; version-aware supersession (GPT-6 + Opus verified) #321's same-date, same-version supersession retires FastAPI's 20260926 first generation. It does not retire the dated 25-September receipts, which is why they carry independent needs_changes instead.
• The retained controls harness assumes the session's scratch layout and does not run from the artifacts directory as-is.

Verification

• scripts/validate.py, host_receipts.py validate, component_matrix.py --check, new_host_grand_list.py --check, evidence_manifest.py --check and validate_catalogs.py: all pass.
• verdict_review_gate.py: passed (0 changed rows).
• Status delta generated from the matrices: 0 winner cells and 0 alternatives changed.
• Full python -m unittest on this tree: Ran 5987 tests, OK (skipped=615).

SOTA sources

• FastAPI test procedure at the pinned release: https://github.com/fastapi/fastapi/blob/0.141.1/scripts/test.sh and https://github.com/fastapi/fastapi/blob/0.141.1/.github/workflows/test.yml
• pandera tests at the pinned tag: https://github.com/unionai-oss/pandera/tree/v0.33.1/tests
• DuckDB Python tests at the pinned tag: https://github.com/duckdb/duckdb-python
• MCPorter configuration resolution: https://github.com/steipete/mcporter
• GnuPG status lines (GOODSIG/VALIDSIG): https://github.com/gpg/gnupg/blob/master/doc/DETAILS

🤖 Generated with Claude Code