Skip to content

Research audit handoffs of 2026-09-20 to 2026-09-25 have no record here: catalogue, what #31 repairs, what remains #35

Open
Open
Research audit handoffs of 2026-09-20 to 2026-09-25 have no record here: catalogue, what #31 repairs, what remains#35

Description

@drevendev
drevendev
opened on Sep 25, 2026

Found by the review of 2026-09-25.

The finding

Since 2026-09-20 the research process has been running bounded static audits of this repository at master a8726f5, about one per hour, and recording each with a verdict and a named regression boundary. Between 2026-09-20 and today it produced roughly fifty of them, some forty with the verdict REPAIR REQUIRED. By its own rules it records them on Drive (the handoff document ANSWERS_TO_IMPLEMENTER and the owner's mirror folder) and does not open issues for members of a family it considers already tracked, which for most of them is #12. The result is that the repository had no record of them: no issue names them, the roadmap's standing obligation ("research finding: adopt it, or record why not, before continuing queued work") could not fire, and PR #31 claimed to adopt every delivered judgement while about forty findings sat next to it unread.

This issue is the catalogue, so the obligation can be worked from here. PR #31 repairs the first group; the rest are open.

Repaired in #31

Unit Repair
PV-AUDIT-GITHUB-REPO-PAYLOAD-001, -COMMITS-, -CR-, -ISSUES-, -BRANCH-, -RELEASE-, -CI-PAYLOAD-001 every consumed field of a successful payload is typed evidence; a malformed row is ERROR / UNEXPECTED_PAYLOAD for that inventory alone; a probe reproduced 26 escaping shapes before, none after
PV-AUDIT-REGISTER-STATE-001 (narrowing PV-AUDIT-REGISTER-SHAPE-001's state field) a register state outside the vocabulary is INVALID_REGISTER, never an open item
PV-AUDIT-GITHUB-RETRY-HEADER-001 an unreadable wait hint is no hint; bounded backoff, then the answer's own classification
PV-AUDIT-GITHUB-REDIRECT-AUTH-001 redirects are followed only to the configured API origin; the bearer token never leaves it
PV-AUDIT-GITHUB-CACHE-INTEGRITY-001 devostasis.http-cache.v2 with a body digest per entry; a bad entry is a miss and one refetch
PV-AUDIT-CANONICAL-NONFINITE-001, -DECIMAL-001, -UNICODE-001, PV-AUDIT-CANONICAL-JSON-PARSER-001 one strict decoder behind every canonical read
PV-AUDIT-HISTORYSTORE-001 an unreadable index elsewhere fails the identity lookup instead of passing for absence
PV-AUDIT-FLEET-INDEX-001, PV-AUDIT-FLEET-COVERAGE-001 an unreadable index, an unfollowable tail or a present but unreadable demand member stops the fleet surfaces
PV-AUDIT-HISTORYSTORE-ATOMIC-PUBLICATION-001 atomic index replacement, index before copy, a stale copy is recovered rather than a gap
PV-AUDIT-STORE-PATH-001 a locator derives a store path only as a name triple strictly beneath projects/; the configuration admits only names
PV-AUDIT-STORE-BUNDLE-PATH-BINDING-001, PV-AUDIT-STORE-PROJECT-BINDING-001 a wrapper whose bundle_id or project_key disagrees with its manifest is refused before any write; the index tail is bound to its canonical path and to this project's identity
PV-AUDIT-PROJECT-LOCATOR-ALIAS-001 case variants are one configured project; two locators the provider resolves to one repository are observed once per run
PV-AUDIT-CONFIG-SHAPE-001 (the two concrete mismatches) activity.enabled must be a boolean, store an object

Open, with the boundary each names

Timestamp and chronology family (runs 382 to 395). The researcher's cross-run conclusion is that timestamp authority is fragmented across parser, formatter, adapter, normalization and classifier, and that one strict instant-admission layer should replace independent checks. That is the right shape for the repair and it is not a one-evening change, so it is its own PR:

Unit Finding
PV-AUDIT-TIMESTAMP-TIMEZONE-001 a timezone-naive timestamp is silently read as UTC; it must fail closed (TIME-TZ-01..08)
PV-AUDIT-TIMESTAMP-GRAMMAR-001 parse_ts and exact_epoch_seconds do not share one lexical language (TIME-GRAMMAR-01..08)
PV-AUDIT-TIMESTAMP-LEAPSECOND-001 v1 narrows to seconds 00..59; :60 fails closed; schema and runtime must agree (TIME-LEAP-01..08)
PV-AUDIT-TIMESTAMP-NAIVE-DATETIME-001 formatting helpers accept naive datetime objects and depend on the host zone
PV-AUDIT-TIMESTAMP-FRACTIONAL-ORDER-001 fractional seconds are truncated before ordering and window checks (FRACTIONAL-TIME-01..08)
PV-AUDIT-MERGE-DURATION-ORDER-001 an inverted created_at -> merged_at is clamped to zero and can lower the Flow median (MERGE-ORDER-01..08)
PV-AUDIT-OPEN-AGE-ORDER-001 a future-created open change request becomes age 0 (OPEN-AGE-ORDER-01..08)
PV-AUDIT-COMMIT-WINDOW-UPPER-BOUND-001 commits after observed_at inflate Pulse; no committed_at <= observed_at guard (COMMIT-WINDOW-01..08)
PV-AUDIT-FORGE-WINDOW-UPPER-BOUND-001 the same for merges, updates, issue and debt events (FORGE-WINDOW-01..08)
PV-AUDIT-STALE-UPDATE-ORDER-001 updated_at < created_at inflates stale counts (STALE-UPDATE-ORDER-01..08)
PV-AUDIT-BRANCH-HEAD-FUTURE-001 a branch head after observed_at is exact non-stale evidence (BRANCH-TIME-01..08)
PV-AUDIT-OPEN-SNAPSHOT-ORDER-001 state=OPEN is trusted without created_at <= observed_at; can dilute Clutter and contaminate Debt (OPEN-SNAPSHOT-01..08)
PV-AUDIT-CR-MERGE-STATE-CONSISTENCY-001 OPEN plus merged_at counts as both open and merged (CR-MERGE-STATE-01..08)
PV-AUDIT-DEBT-LIFECYCLE-ORDER-001 a closed debt item whose closed_at is after observed_at or before opened_at leaves the open count (DEBT-LIFECYCLE-01..08)

Verifier and lineage family (runs 337 to 348). These ask verification to dispatch on the exact stored lineage before interpreting a member, and to validate each member structurally under that lineage: PV-AUDIT-BUNDLE-LINEAGE-001, PV-AUDIT-MANIFEST-SHAPE-001, PV-AUDIT-MANIFEST-PREIMAGE-BINDING-001 (the renderer_version replay-skip bypass is concrete), PV-AUDIT-OBSERVATION-LINEAGE-001 (saved observations are not dispatched on schema / observation_contract_version), PV-AUDIT-VECTOR-LINEAGE-001, PV-AUDIT-SNAPSHOT-LINEAGE-001 (Vital order and uniqueness not enforced), PV-AUDIT-DEMAND-LINEAGE-001, PV-AUDIT-OBSERVATIONS-MEMBER-LINEAGE-001, PV-AUDIT-SEMANTIC-CONFIG-BINDING-001, PV-AUDIT-RECEIPT-DIGEST-BINDING-001, PV-AUDIT-SNAPSHOT-MANIFEST-BINDING-001, PV-AUDIT-GAUGE-SNAPSHOT-BINDING-001. Several overlap #12 finding 4, which 0.1.9 repaired in part (the metadata binding); the lineage dispatch itself is the accepted compatibility policy's job (PV-COMPAT-002, see the Phase B/C issue), so this family is best done together with that adoption rather than piecemeal.

Store and transport, remaining: PV-AUDIT-HISTORYSTORE-CONCURRENCY-001 (no same-project writer serialization; concurrent commits can race on latest.staging), PV-AUDIT-HISTORYSTORE-RENAME-RECOVERY-001 (relocation happens before the new bundle, copy and index are complete; a failure mid-way leaves a moved directory), PV-AUDIT-GITHUB-PAGINATION-LINK-001 (an exact-cap full final page is reported PARTIAL although the absence of rel="next" proves completeness; GH-PAGINATION-LINK-01..06), PV-AUDIT-RENDER-OBSERVABILITY-TRUTHFULNESS-001 (the observability section of the report), PV-AUDIT-REGISTER-SHAPE-001 beyond the state field (target-id pattern, duplicate members in register JSON, full schema validation), PV-AUDIT-CONFIG-SHAPE-001 beyond the two concrete mismatches (complete schema validation before defaults).

Produced today (runs 397 to 403), read only through their one-line handoffs, so each needs reading in full against the new head before it is worked: PV-AUDIT-GITHUB-RESPONSE-SIZE-001 (the transport must bound raw response bytes from the stream before parsing, on 2xx and error paths alike, and surface overflow as ERROR / RESPONSE_TOO_LARGE; GH-RESPONSE-SIZE-01..08), PV-AUDIT-CLI-PROVIDER-ENDPOINT-001 (ENDPOINT-BINDING-01..08), PV-AUDIT-GITHUB-CACHE-CONTEXT-001 (cache entries must be namespaced by the normalized API base and representation context before configurable endpoints exist; GH-CACHE-CONTEXT-01..08), PV-AUDIT-GITHUB-BASE-TLS-001 (fail-closed validation of a configured provider base before transport dispatch; GH-BASE-TLS-01..08), PV-AUDIT-GITHUB-CHECK-SUITES-PAYLOAD-001 and PV-AUDIT-GITHUB-PAGINATED-ROW-SHAPE-001 (the check-suite and per-row shapes #31 now validates; to be checked case by case against GH-CHECK-SUITES-PAYLOAD-01..08), and PV-AUDIT-TARGET-MARKER-SYNTAX-001 (the Target: marker must be parsed as a standalone configured syntax, not as text embedded in a larger token such as SubTarget: B1; LINK-MARKER-01..08; it also assumes the state-neutral linkage of the Direction repair tracked in #33).

Verified non-findings, for the record: PV-AUDIT-STORE-IMMUTABLE-COLLISION-001, PV-AUDIT-GITHUB-PAGINATION-STOP-001, PV-AUDIT-CANONICAL-NUMBERS-001, PV-AUDIT-REPORT-RENDER-BINDING-001.

Two process observations

  1. The research side's deduplication rule ("same family as Review of 0.1.7: Integrity accuracy, bundle verification, and history reliability #12, no new issue") makes Review of 0.1.7: Integrity accuracy, bundle verification, and history reliability #12 the nominal home of some thirty findings that nobody reading Review of 0.1.7: Integrity accuracy, bundle verification, and history reliability #12 can see. The obligation in the roadmap is only workable if every REPAIR REQUIRED unit has a line somewhere in this repository. Proposal: this issue is that place until each family has its own PR, and the implementation side (not the researcher) keeps it current when it reads the handoff document; a session that starts here reads ANSWERS_TO_IMPLEMENTER first, as the memory of this project already says it should.
  2. The owner's Drive mirror has one copy error: the document titled PV-AUDIT-FORGE-WINDOW-UPPER-BOUND-001 holds the text of PV-AUDIT-CANONICAL-DECIMAL-001. The research status report for runs 385 to 396 already notes "an accidentally copied 03 - Work document remains non-authoritative"; the mirror copy should be replaced from the canonical one before anyone implements FORGE-WINDOW-01..08 from it.

Activity

  1. drevendev
    added a commit that references this issue on Sep 25, 2026

    Reconcile the roadmap with what the research process delivered

    8dbf5b9

  2. drevendev commented on Sep 30, 2026

    @drevendev
    drevendev
    on Sep 30, 2026
    OwnerAuthor

    Catalogue update from the review of 2026-09-30 (#48): what the research process handed off since this issue was written (runs 404 to 410), read in full from the handoff document and the registry, and two units of the payload family that #31 had only started.

    Unit Verdict What it says Where it went
    PV-AUDIT-RECEIPT-OBS-CONSISTENCY-001 (run 404) REPAIR REQUIRED a saved observation set is evaluated and built without proving that its receipt and its observations agree; RCPT-OBS-01..08 open, in #38, with a caveat: as stated the invariant rejects every set this implementation writes, because derivation adds 27 of 36 envelopes after the receipt is finalized
    PV-REV-PR-037 (run 405) verified non-finding the concurrency block of #37 nothing to do here; see #37 for why it is still not merged
    PV-REV-PR-029-003 (run 406) repair verified the /actions/workflows payload repair on #29 done
    PV-REV-PR-031-003 (run 408) CHANGES REQUIRED clutter.bands.v1 promoted any fresh PARTIAL count to a floor without subset proof; CLU-PARTIAL-TRUST-01..08 repaired on #31 and merged; it was recorded only on Drive, never on the pull request
    PV-REV-PR-036 (run 409) CHANGES REQUIRED the attribution carrier of #36 states the MIT obligation without the notice on #36; the same carrier is in #37
    PV-RELEASE-020-001 (run 410) produced, not accepted the 0.2.0 candidate specification, the owner's request of 2026-09-30 #47
    PV-AUDIT-GITHUB-REGISTER-PAYLOAD-001 (run 368) REPAIR REQUIRED register file payloads: non-string content raised TypeError, a missing size defaulted to 0 and passed the byte bound, base64 was permissive #31 only typed size; #49 repairs the rest (required size, string content, strict base64, decoded-length bound, depth)
    PV-AUDIT-GITHUB-MILESTONE-PAYLOAD-001 (run 369) REPAIR REQUIRED a null milestone state reads as open, missing counts become 0, a pull request's embedded milestone of the wrong type becomes a target id still open, and github-adapter.md now documents the defaulting as behaviour

    The re-review of PV-AUDIT-MANIFEST-PREIMAGE-BINDING-001 that andy-zen-dev posted on #31 on 2026-09-26 (the renderer_version deletion bypass named in the verifier family above) is repaired on #31, and #49 extends it to the exact preimage field set of each lineage and to every member the preimage hashes.

    Also open from the same review, in the spirit of this catalogue (no value is coerced, defaulted or skipped): the issue and pull-request state read as OPEN when null or missing, pull_request: {} or 0 keeps a row as an issue, missing draft and protected become false, and an enumeration the budget refused on its first page is PARTIAL with an empty list (and derives a PARTIAL "SUPPORTED" planning capability) where observations.md says an inventory never started is UNKNOWN.

    The rest of this catalogue stands as written: the timestamp and chronology family, the remaining verifier and lineage family, store concurrency and rename recovery, and the transport units of runs 397 to 403 are open, and the 0.2.0 candidate files them under wave A (#47).

    🤖 Generated with Claude Code

  3. drevendev commented on Sep 30, 2026

    @drevendev
    drevendev
    on Sep 30, 2026
    OwnerAuthor

    PV-AUDIT-TARGET-MARKER-SYNTAX-001 is repaired in #53 (0.2.0): the configured marker is a standalone token, so SubTarget: B1, NotTarget: B1 and PreTarget:B1 link nothing, and a marker ending in a letter needs a boundary after it too.

    Its regressions LINK-MARKER-01..08 reached this repository only as the categories of the handoff (exact marker, embedded-prefix negatives, custom markers, multiple markers, prose without the marker, end-to-end file planning). tests/test_linkage_markers.py covers each category and says it does not claim the individual case texts; if the research side publishes the eight texts, they can be cited case by case.

    🤖 Generated with Claude Code

  4. drevendev commented on Oct 16, 2026

    @drevendev
    drevendev
    on Oct 16, 2026 – with ChatGPT Codex Connector
    OwnerAuthor

    Catalogue delivery update — 2026-10-16

    Three later independent reviews are now publicly delivered in the pinned PR #75 handoff, not merely referenced as private backlog:

    • PV-REV-CI-ATTEMPT-STATE-ADMISSION-001: legitimate UNKNOWN attempt outcomes and unrecognized state strings can be reduced to apparently complete non-failing history. Six isolated admission/reduction checks, including three controls, were executed. Keep same-attempt unresolved-to-pass transitions and sticky failures valid.
    • PV-REV-CI-TIMESTAMP-PARSE-001: malformed current timestamps can contaminate the durable carrier; rejecting that carrier on a later read can lose failure evidence. The four-bundle persistence/recovery regression is specified, not executed end to end.
    • PV-REV-OFFLINE-UNAVAILABLE-REASON-001: recognized exclusion labels do not substantiate their cause. PARTIAL remains PARTIAL, but an unjustified omission can hide a finding. Tree-backed predicates and unproved blob-size metadata must be treated separately.

    All were reread against 09d497f16520b6dc20f5dd42077ff76774e1f5e1. Verdicts are source-level CHANGES_REQUIRED; implementation and package-level verification remain outstanding. The PR handoff contains examples, repair boundaries and the proposed regression families. No accepted historical identifier or normative contract was changed by publication.

    For implementation triage: keep the two CI-history repairs with the existing admission/history family (#38 and this catalogue), and the source-exclusion repair with #75. Do not fold source-exclusion authenticity into #73 as though independent ancestry proof fixed it. #73 concerns another evidence boundary. The earlier extra-attempt/duplicate-current-inventory review remains a separate, already public input.

    The next useful output is a finite repair plus regression evidence and an adoption receipt naming the final release head, not another duplicate issue or repeated unchanged audit. This catalogue entry does not claim merge/release authority or completion of those repairs.

    Publication receipt: DV-MANUAL-20261016-I35-63b9d42a.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions