CODE Review — bounded complete-buffer BAO proof (cyber_bao::proof)

Verdict: APPROVE

Reviewed only the supplied frozen packet: the three production sources (lib.rs, proof.rs, proof/output.rs), all four test files, the eight seal probes, the parent-absence/parent-control/fixture-freeze receipts, the interleaved oracle (manifest + assembler + hashes), review-gates.json/comparisons.json/gate-report.md, the source/epoch bridges, the approved PLAN + finite cases + PLAN review, and the owning geometry/reducer/kernel/consumer excerpts. I ran no tools, reran no tests, and did not read the hash-indexed omitted bodies (raw gate stdout/stderr, bulk locks, prior archives, compiled targets, tests-first source epochs other than their hashes).

What I verified independently

Admission order and the no-unchecked-root invariant. ProofVerifier::new calls RangeTraversal::new first, then size != 0 && request.is_empty(), then ascending-word noncanonical(&root); it reads no proof byte and runs no kernel. Because traversal already pins start <= end <= size, is_empty() can only mean start == end, so EmptyRequest is exact. The constructor's rejection of an empty request against a nonempty file is load-bearing, not decorative: it is the only thing that keeps assert_eq!(self.occupied, 0) at commit unreachable (an empty traversal would leave the seeded root expectation on the stack). geometry_precedes_empty_request_and_root_canonicality covers all 256 logs, both host widths, reversed/EOF+1 ranges and log-before-range precedence.

Frontier correspondence. The invariant occupied == traversal.pending holds after every action: the header seeds 1 against the single root frame; a parent pops one of each and pushes on the identical left/right flags; a leaf pops one against a frame that pushed nothing. Since RangeTraversal bounds pending <= 53, the 53-slot expected array cannot be indexed past 52, and the transient during a parent action is still <= pending'. maximum_frontier_prefix_uses_literal_small_missing_leaf is a real witness of the bound: 52 left descents build exactly 52 deferred siblings plus the current expectation.

Action arithmetic (2 + P + 2C, empty file 4). I recomputed every table row against the sources: hello 4; three-right 5; three-interior 6; three-boundary 8; grouped-left 7 (one parent + a 2-chunk group's 3 kernels); final-short 5; sole-group 6; full-three 10/9/8/8 at logs 0/1/2/4; five-right 5; five-interior 7; seven-right 6; seven-interior 7. All match support::cases() and the pre-implementation fixture-freeze.stdout. The deep prefix is exactly 8 + 52*64 + 4096 = 7432, succeeds through action 55 (H + 52P + S + K) and fails at action 56 with Truncated { offset: 7432, needed: 4096 } — the PLAN-review advice-5 conflation is correctly resolved in the disposition and in the test. The log-51 case fails at action 3 with needed: 1 << 63 from a 72-byte carrier, with no allocation and no overflowing end (traversal subtracts before clipping).

One bounded action per call. advance dispatches header → pending group kernel → synthetic empty leaf → one traversal item → commit, in that order. The pending-group branch precedes everything, so a multi-chunk group yields exactly one GroupHasher::step per call and compares the completing hash inside that same action. Parent processing takes 64 bytes, validates left words then right words with absolute proof offsets, pops, hashes once with that node's ROOT bit, then pushes right-then-left (LIFO ⇒ left consumed first, matching preorder). start_group takes its checked payload before popping, so Truncated precedes any state mutation.

Canonical rejection, not normalization. Both children and the supplied root are checked word-wise against exported hemera::field::P before any arithmetic; Hash::from_bytes is used only after that check. Since every expected hash is either the checked root or a checked wire child, and every computed hash is canonical by hash_to_bytes, the research aliasing path (same parent output, different raw bytes) cannot match. representation_aliases_are_not_normalized reproduces the exact synthetic fixture at offsets 40/48/56/64, and both_children_all_words_reject_noncanonical_before_hashing additionally asserts Truncated-before-canonical for a noncanonical left followed by a short right.

Strict EOF and stickiness. Commit requires cursor == proof.len(); TrailingBytes { offset: consumed length } is tested for both a one-byte suffix and a self-concatenated valid proof across empty/hello/three-boundary/sole-group. Completion sets complete before returning Some, so the view is emitted once; errors are Copy, stored, drop the reducer, and are returned identically on ten further polls without work.

Seal surface. VerifiedProof has private fields, pub(super) fn new, no From/Deserialize/raw constructor, and returns root/size/block by value plus a cloned range. step is &mut self -> VerifiedProof<'a>, so views and leaf slices legitimately outlive the verifier but not the proof — exercised by jobs_can_interleave_and_views_outlive_verifiers_and_cursors. The eight probes assert specific classes (E0451, E0624, E0277 ×3, E0505, E0502, E0594) with a passing runtime control, not generic compile_fail.

Replay equivalence. items() re-derives the admitted geometry (infallible by construction), starts at 8, advances 64 per parent and size per leaf, and so reproduces the verification cursor exactly; the slice indices are therefore in bounds and file_offset = start_chunk * 4096 is exact because group widths are multiples of 4096. FusedIterator, immediate is_complete after the final item, and zero items for a verified empty file are all tested, including two interleaved cursors and pointer-identity checks.

Independent witness. The interleaved four-leaf case is genuinely independent: fixture_oracle.rs uses only committed kernels (no encoder/traversal/verifier), was frozen at 00:41:40 ahead of source-complete at 00:46:59, and its root e621f66b…, offsets 136/4232/8392, parent offsets 8/72/8328 and 12488-byte wire match the test literally. P=3, C=3 ⇒ 11 actions and 6 items, matching both the manifest's derived_verification_actions: 11 and the honest reclassification of its 73 as adapter copy arithmetic rather than Radio items.

Internal consistency of the audit. The claimed 17 seed carriers summing to 107086 bytes reconciles byte-for-byte with fixture-freeze.stdout (99654 for the 16 .bin files plus the 7432 synthetic prefix). support/proof.rs — the file carrying every frozen literal — is hash-identical (a28d04…) from the tests-first freeze through source-complete, which independently corroborates "literal expected values unchanged" despite the two later test epochs. Test counts reconcile: 118 = 101 + 17, 121 = 104 + 17, 45 = 28 + 17, and I count exactly 18 #[test] items in the final sources (17 on 32-bit).

Blockers

None.

Advice (non-blocking)

1. owner-clippy-all-final is the one row whose parent comparison is incomplete. The candidate record adds error: this loop could be written as a 'while let' loop and could not compile cyber-bao (lib test) due to 14 previous errors, which the parent record lacks (it stopped at "build failed, waiting for other jobs"). By inspection no loop/bare-match-break exists in proof.rs, proof/output.rs, or the four new test files, and the label is lib test (i.e. src/** unit tests, unchanged here) rather than test "proof". Record that attribution explicitly, or rerun the parent row with --no-fail-fast-equivalent scheduling so the 14 are shown inherited. As a positive witness that the new sources are all-features lint-clean, run -p cyber-bao --all-features --all-targets -- -D warnings with -A for exactly the parent-present legacy lints and show zero remaining diagnostics; today the only all-targets green Clippy over the new code is the no-default row.

2. Reconcile the 3-byte delta between ready-format-lib-candidate (468) and ready-format-lib-parent (465). Both exit 1 on inherited re-export debt, and final-interleaved-format-new is green for all six new files, so I do not believe the added pub mod proof; is misformatted (it sorts correctly under reorder_modules). But the brief never asserts the two diffs are equal modulo line numbers, and the raw bodies are omitted; state that equality in the audit so the red workspace-format row stays provably unchanged by this unit.

3. Make release-mode underflow impossible in pop. self.occupied -= 1 wraps in release and then panics on expected[usize::MAX]. Use checked_sub(1).expect("expected hash follows geometry") so debug and release fail identically; likewise consider debug_assert!(self.cursor <= self.proof.len()) in ProofItems::next.

4. Pin the five/seven-group roots as literals. support::cases() asserts hex literals for empty/hello/D8192 ROOT/D12288/D8193/historical CV, but root5/root7 are only computed. fixture-freeze.stdout pins acf73af9… and 8bad63da…; add those two digest() assertions so a kernel regression fails in the test rather than only in a fixture comparison.

5. ProofItem is forgeable by construction. The Rustdoc correctly says its values are not sealed authority, but a future Kadek adapter signature taking ProofItem as a parameter would silently accept a caller-built Leaf. Either mark the enum #[non_exhaustive] now (it also preserves room for the declined Parent { node, proof_offset }) or state in the module docs that adapters must only consume items from a ProofItems they obtained themselves.

6. Two rows sit at older source epochs. nostd-library, owner-msrv and the owner test matrices predate the lib.rs module reorder and the 18th test. Neither can plausibly change them (reorder is semantics-free; production is byte-identical), and the gate report says so — but a single rerun of nostd-library and the no-default owner row at epoch a0624dd1… would close the last epoch gap cheaply.

7. Use OUTPUT_BYTES in output.rs. It hardcodes 32 while proof.rs guards widths with a const _: () = assert!(...). The guard covers the crate, so this is cosmetic, but importing the constant keeps both files uniform if Hemera's output width ever changes.

Scope held: one module declaration plus two new files; no kernel, legacy reader, producer, dependency, feature, lock, Kadek or canon change. No claim of release acceptance, row-4 closure, hosted CI success, 32-bit runtime, allocator-free final link, particle/root authority, or first-partial authentication appears in the packet.