===== 001 BEGIN CODE review scope and indexed omissions | 3115 bytes | SHA256 82bee6c203fc0c0f1602f09feba59ba4dde958a4baa80fa4d76c655c8fd19eb5 =====
Fresh CODE review of an approved packaging-only fix at exact Radio parent ce0fb312faa8770e80efe9afa864106ae6b51552.
PLAN v2 APPROVE raw and full result are supplied. Seven archived Cargo.toml bodies are renamed losslessly;
three replay entries become thin wrappers around preserved exact originals. One shared Nu staging helper
reconstructs historical logical names only in unique disposable directories. No production Rust, normal
manifest/lock, version, specification, license, BAO API or Kadek pin change. Parent owns final merge.
Review failure/collision handling, byte/hash preservation, original CLI/default semantics, explicit nonzero
child handling, complete-tree source allowlist and the causally controlled Git-consumer differential.
A wrapper-v1 error path omitted the retained-stage notice because Nu terminated at child nonzero; final
wrappers use complete plus print --no-newline for both streams and exact exit_code. A status-77 literal
control verifies this. Earlier passing/failing epochs remain separate. Temporary pair setup v1 failed at
bare-index deletion; v2 was deliberately interrupted on wrapper change; v3 completed both arms. No green
assertion is made from either earlier attempt. Historical --live HEAD failures remain required failures.
Fresh isolated local-Git ce0/candidate lock, metadata, debug and release controls reproduce four duplicate
warnings in the parent and zero candidate warnings. External historical manifest unchanged at three
points. Reader stdout identical across all four runs and earlier frozen HTTPS control. 63 exact crate
source tuples and normalized three-node graph match; 34 explicit parsed-JSON substitutions per arm.
The incremental temporary candidate e22c5b47 is a local measured witness, never an origin/release input.
Later final audit/report additions are outside its tree; its 14 final packaging files are separately
frozen and match the reviewed live files. No new Cargo.toml basename may exist under audit.
Supplied in full: all changed executable packaging scripts, seven archived manifest bodies, all three
original replay contracts, approved PLAN and response, raw approval, execution report, exact independent
reader, final control orchestrators, raw paired command receipts/streams, explicit identity maps and
replay code. The current BAO kernels and unrelated runtime Rust are unchanged and omitted. Also omitted:
binary carrier bodies (exact manifest/hash-retained support), whole historical capsules, complete source
snapshots/caches/build output, old full vendor contexts, large lock/metadata snapshots beyond the two
exact current metadata outputs, and final noncritical evidence-copy bookkeeping. Their identities remain
indexed in capsule files.json; the reviewer has not been supplied those omitted bodies. Neither this
review nor the focused controls refresh previous broad red gates, rung or last-tag acceptance. Review
only this packaging change; no release claim. The codepack verifier and outer evidence verifier require
exact historical Git objects; neither claims cache-free Cargo reproduction or archive-only source replay.
===== 001 END CODE review scope and indexed omissions =====
===== 002 BEGIN .claude/tasks/audit-cargo-packaging/plan.md | 11425 bytes | SHA256 86d9ede9c35d7650a1093e0438d35c6a93f8a60d0b69d148dafa431c7976f620 =====
# Lossless archival Cargo manifests
Status: draft; fresh different-vendor PLAN approval required before edits to
existing artifacts. Serves Kadek foundation row 4 through Radio; discovered from
PR40's committed Git consumer. Parent: `ce0fb312faa8770e80efe9afa864106ae6b51552`.
## Result
Rename exactly seven archived harness manifests from `Cargo.toml` to
`Cargo.toml.txt`, preserving every byte. Keep source/workspace manifests and all
dependency pins, locks, Rust sources, tests and specifications unchanged. Cargo
must discover only the actual package when a fresh consumer pins an independent
committed candidate snapshot. The candidate is a local packaging witness, never
an origin release input.
Preserve the three original replay scripts under `verify.original.nu.txt` or
`reproduce.original.nu.txt` beside their existing names. Replace only those entry
scripts with thin Nu wrappers. Add one small shared staging helper in this task's
new audit directory. Preserve each CLI and its defaults explicitly:
| Entry | Default resolution before staging | Forwarded unchanged |
|---|---|---|
| Research `verify.nu` | `--repo`: original capsule's grandparent; `--siblings`: resolved repo's parent | Explicit resolved repo/siblings and optional `--live` |
| Execution `verify.nu` | `--repo`: original capsule's grandparent | Explicit resolved repo and optional `--live` |
| Slice `reproduce.nu` | `--radio-repo ~/cyber/radio`, `--hemera-repo ~/cyber/hemera`; retain these canonical defaults even from another worktree | Implementation revision, expanded selected repo paths, `--fetch`, `--full-workspace` |
Preserve original `--live` checks, including their historical HEAD equality. They
must still fail against a later merged HEAD. Research additionally checks a clean
tracked diff; execution does not. Do not add or infer another cleanliness check.
The helper copies only its selected capsule to a newly created disposable `/tmp`
directory, restores the explicitly listed Cargo logical names, and restores the
original replay script at its historical filename by moving the copied `.txt`
files, so the staged layout does not retain duplicate archived names. Replacing
the copied entry wrapper is the sole intentional collision, after checking its
identity; an existing logical Cargo path or missing archive fails before replay.
It must never create a Cargo.toml inside the real repository.
The original script then executes unchanged. All historical `files.json`, source
indices, contexts, reviews, fixture bytes, raw manifests and command receipts
remain unchanged. The wrapper is new packaging code, not the historically reviewed
verifier. Its own bytes and the original-to-archive mappings are bound by the new
capsule's manifest. `historical-index-bindings.json` records every affected index
entry: index path and JSON pointer, historical logical path/hash/length, satisfying
archived path, and deliberate direct-worktree outcome (missing logical Cargo path
or wrapper replacing original script). An already historical pre-CODE verifier
row is labeled separately and points to its existing preserved original. Physical
indices are deliberately historical; a direct unstaged check is not the replay.
Successful disposable replays are cleaned; failed ones retain
their isolated directory and propagate the original nonzero status.
## Steps and decisive checks
1. Freeze the seven manifest blobs, three original scripts, consuming paths and
ce0 warning receipts. → Verify: every byte equals the exact committed object;
discoverable audit manifest inventory is exactly the seven listed below;
both original 2026-10-12 replay commands pass before mutation. These baseline
checks are already measured; preserve them unchanged.
2. Rename the seven manifests losslessly and install only the replay wrappers,
their archived originals and the small staging helper. → Verify: no audit
`Cargo.toml` remains; the seven `.txt` contents match the original hashes;
all real source manifests retain their paths and bytes. A complete committed
tree comparison outside the explicit allowed audit/task paths must be empty,
including root and cyber-bao manifests and root Cargo.lock.
3. Check the replay boundary. → Verify: research and execution wrappers reproduce
the original successful JSON results with the same counts; their staging restores
the complete original indexed file hashes including the original verifier itself.
Run the unchanged proof CODE input verifier. Exercise 2026-10-09 staging and the
original `prepare-crate` function for its historical parent/implementation.
A child `nu -c` receives generated code with a quoted literal `source` path:
`source "<stage>/reproduce.nu"; prepare-crate "<repo>" "<rev>" "<export>" "<stage>"`.
This makes the source path constant at the child's parse time and exposes the
private definition; it does not call `main`. Revisions are `db1d62e2…` and
`590e69ea…`, fully pinned in evidence. Compare exported Cargo.toml, Cargo.lock,
src/main.rs and the precise existing Hemera-dependency rewrite against inputs.
Stage every capsule file, including Cargo.lock, probe.rs, SOURCE-FREEZE.json,
FIXTURE-SHA256SUMS and expected-probe.stdout; preserve their exact hashes.
The private-function mechanism already passes on both original revisions.
Do not rerun the reproducer's codec matrix.
A deliberate missing archived input/collision in a disposable copy must fail
before running the historical script, leaving the real repository unchanged.
4. Freeze an independent committed temporary candidate snapshot containing the
exact candidate tree: committed ce0 blobs plus an explicit allowlist of owned
candidate changes, never another dirty worktree's inputs. → Verify: it is derived
from ce0 with only the explicit archive changes, and all production source,
normal manifest and lock blobs are equal. One private local Git object store
contains both original ce0 and that candidate commit. Two independent fresh
consumers use the same `file://` Git URL and differ only in Radio revision and
explicitly recorded consumer/cache/target paths. Each has a fresh private Cargo
checkout/cache; neither uses a path dependency. Keep Hemera d5 pinned and acquire
it through the same bounded cached-object mechanism; no new network claim.
5. Run a same-session differential. → Verify: before, between and after the two
arms, `/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml` exists with the same
length/hash. Do not delete or alter it. The fresh ce0 arm must reproduce the
duplicate warning; absence invalidates the witness. Lock generation, metadata
(`--locked --offline`) and eight-case reader debug/release run in both arms with
matched Rust 1.95, jobs=2, incremental=0 and isolated targets. Candidate commands
must emit zero Cargo/compiler warnings and resolve cyber-bao from the exact
candidate Git checkout. This warning-free claim covers only those invocations.
Require byte-equal reader stdout across both arms/profiles and the frozen
historical control, and equal `(source path, bytes, SHA256)` tuples for all
selected cyber-bao/Hemera source files. Within each arm freeze inputs before/after.
Compare metadata after only the explicit normalization below; do not require
equality of changed Git pins or physical paths. This is not a broad codec gate.
6. Freeze compact new audit and fresh CODE input. → Verify: lossless historical
replay, exact raw receipts, input mappings and source equality independently
replay; different-vendor CODE approval precedes root's final commit/PR/merge.
Preserve all historical red outcomes without claiming a new full-gate pass.
## Comparison boundary
The historical snapshots are labeled `historical-ce0-reader-before-runs.json` and
`historical-ce0-reader-after-runs.json`; their original timestamps/bytes remain
unchanged, and v1's frozen packet stays intact. They span the old reader runs,
not a repair. New paired measurements have separate ce0/candidate arm labels.
Within the new pair the local Radio Git URL is identical. Normalize only its
validated ce0/candidate revision tokens in package/source IDs, the two consumer
IDs and their exact consumer directories, the admitted checkout-root prefixes
in manifest/target paths, and recorded target/build/workspace directories. Every
replacement has an explicit old/new mapping and path-boundary check; no blanket
regex stripping. Resolve-node IDs/edges use those same exact ID substitutions.
Everything else must match, including features, dependency graph, package versions,
rust-version, target lists and dependency requirements. Historical HTTPS and new
local file URLs are intentionally different and are not a metadata equality claim.
Snapshot/receipt timestamps and Radio commit identities are retained as distinct
measurements, never edited to force equality. Consumer manifests/locks contain
their explicit arm pins; only production source/manifests/locks and reader stdout
have cross-arm byte-equality requirements.
## File scope
Seven manifest renames, each adding only `.txt`:
```text
audit/2026-10-09-kadek-slice-traversal/Cargo.toml
audit/2026-10-12-bao-proof-research/probe/Cargo.toml
audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml
audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml
audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml
audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml
audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml
Three entry wrappers replace their names while preserving exact original bytes:
audit/2026-10-09-kadek-slice-traversal/reproduce.nu,
audit/2026-10-12-bao-proof-research/verify.nu, and
audit/2026-10-12-bao-bounded-proof/verify.nu.
New helper, mappings, documentation, review inputs and raw evidence live only in
audit/2026-10-13-audit-cargo-packaging/; task artifacts live only in
.claude/tasks/audit-cargo-packaging/. No nested historical audit archive is copied.
Five likely failures
- A forgotten archived Cargo manifest still participates in discovery: exhaustive tracked basename inventory and a fresh committed-snapshot Git consumer.
- Renaming silently changes historical bytes or hashes: compare all seven blobs, keep every historical index/receipt unchanged, replay the original scripts.
- A wrapper reads temporary paths as the real source repository: resolve/pass explicit repo and sibling paths, including original CLI defaults.
- Staging overwrites evidence or leaves an executable manifest in the repository: unique external destination, explicit mappings/collision checks, failure probe in a disposable copy, and before/after repository identity verification.
- Packaging masks production/dependency drift: exact tree comparison, Git-pinned consumer identity, two unchanged literal result streams and honest warning counts.
Radio's cached registry part_of = soft3 and Kadek's direct dependency remain
explicit. This is a packaging repair with no API/version floor change. There is
no release, tag, registry publication or Kadek dependency update in this unit.
The caller owns subsequent adoption of the actual merged Radio revision.
Previous broad workspace/rung and last-tag gate results remain unrefreshed; no
broader warning-free compiler, source, product or release claim follows.
===== 002 END .claude/tasks/audit-cargo-packaging/plan.md =====
===== 003 BEGIN .claude/tasks/audit-cargo-packaging/response-v1.md | 2722 bytes | SHA256 d832af26441f2a76493b54cb1f901cabf4fc49e311fb3f859c7e089041afd1fc =====
PLAN v1 response
The fresh Opus review requested changes at 2026-10-13 01:41:16 UTC, raw SHA256
c253af5655b79f1fbdfa4fae0cd4baf6cd2ae42d741b63e178be6aa496bd3b94.
The complete v1 packet and review remain unchanged. No existing audit artifact or
production file has been edited. PLAN v2 addresses all six blockers:
- Measure both ce0 and candidate in one session through the same local Git URL, with separate fresh caches/consumers. Check the external nostd-parent manifest before, between and after; require the ce0 warning and candidate absence.
- Specify a child
nu -cwhose code contains a quoted literalsourcepath, then calls the original privateprepare-crate. That mechanism has now run on both historical revisions: all 16/17 exported cyber-bao files and three copied harness inputs match, allowing only the original function's exact Hemera substitution. Retain the full child code, raw receipt and all five surrounding capsule inputs. - Limit byte equality to reader stdout and unchanged production source/manifests/ locks. Enumerate the exact Radio revision, consumer ID and physical-path metadata substitutions; preserve every other field. Historical HTTPS metadata is evidence, not the new local-Git pair's equality baseline.
- Add 19 machine-readable historical index bindings, including repeated input indices, two old PLAN context bindings and the already historical pre-CODE verifier variant. They identify each satisfying archive and intentional physical mismatch. Original indices and historical hashes remain untouched.
- State defaults per script. The two verifiers resolve from the original capsule;
the reproducer preserves
~/cyber/radioand~/cyber/hemera, even when invoked from another worktree. Both historical HEAD assertions remain; only research's existing verifier checks tracked cleanliness. No new clean-tree assertion is added. - Rename the outer copies to
historical-ce0-reader-before-runs.jsonandhistorical-ce0-reader-after-runs.json, preserving bytes and timestamps. They bracket the historical reader runs, not the packaging change. V1's own frozen copies retain their original labels and bytes; future runs get arm-specific names.
Optional advice: adopt an audit-basename guard and document moving, rather than
duplicating, restored .txt files inside temporary layouts. Keep the literal
production-tree equality check. Decline global source-manifest cleanup: it expands
this task without evidence of another consumer defect. The historical nostd-parent
absolute path is nonportable but reconstructable; calling it permanently
unreplayable would overstate the limitation. Its bytes remain unchanged.
===== 003 END .claude/tasks/audit-cargo-packaging/response-v1.md =====
===== 004 BEGIN .claude/tasks/audit-cargo-packaging/execution.md | 3660 bytes | SHA256 d09975acf4aee60fdc358d204817c3d2a74f9706f482e60d99389fe107b8e84d =====
Packaging execution
Stage: active. Fresh Opus PLAN v2 approved at 2026-10-13 01:58:51 UTC;
raw SHA256 27a51f83e0ea67a2fbd7951f8bf83a2572ea4fe859a95d99a33d90f233a7dec4.
Root read the verdict and independently replayed the frozen input. V1/v2 packets,
both raw reviews and exact launchers are retained without modification.
Adopted advice: normalize only allowed parsed-JSON fields, measure the real audit tree before/after deliberate staging failures, compare the complete candidate tree against ce0 using an explicit path allowlist, and enforce the audit manifest basename guard. The historical external parent directory remains intact. Global source-manifest escape checks are deferred: legitimate sibling manifests make that a broader policy change with possible false positives. No such cleanup or new production guard belongs to this approved packaging unit.
The review's claim that all six other manifests share one relative path is not
used as an oracle; their exact seven bodies and individual mappings are the input.
The slice harness, for example, uses path = "cyber-bao". The demonstrated defect
and approved lossless inventory do not depend on that optional causal shorthand.
Implementation and new paired measurements are pending below; the original ce0 control remains historical. No full-workspace/rung/last-tag gate refresh or release is implied by the forthcoming focused consumer results.
Final measured candidate
The approved seven lossless renames and three preserved-original wrappers are
implemented. The final child invocation uses complete, prints each captured
stream with --no-newline, then passes the exact exit code to cleanup/retention.
Nu otherwise aborted before the retention notice on a nonzero child. The initial
wrapper's successful replays remain valid, but its failure-path epoch is not the
final implementation. A separate status-77/no-newline witness closes this gap.
Same-session local Git controls at ce0 and temporary candidate
e22c5b472a0979ad382d241b9706de5b82fed9a9 pass: parent duplicate warnings 4/4,
candidate warnings 0/4, eight identical literal cases in both debug/release
profiles, 63 exact crate source tuples, three dependency nodes, 34 allowlisted
parsed-JSON substitutions per arm. This uses Rust 1.95, jobs 2, incremental 0,
RUSTFLAGS=-Dwarnings, independent Cargo homes/targets and only local Git
acquisition (exact Hemera d5 URL rewrite recorded). The external warning-causing
manifest is unchanged across all three observations. No broad-gate conclusion.
The first private snapshot attempt failed at bare-index deletion before Cargo;
--index-info corrected it. The second was deliberately interrupted as wrapper
handling changed, preserving its null signal exit in raw evidence; it did not
complete a control arm. The third completes both arms. The temporary committed
snapshot contains the final packaging code and then-current owned task/audit
inputs; later additions are evidence/report files only. Its incremental bundle
and full explicit path list remain replayable against ce0. Final packaging bytes
are frozen separately, so subsequent receipts do not masquerade as the measured
snapshot tree.
Exact historical reconstruction passes 13/90/620 files, two old prepare calls,
two pre-execution failure controls, three default CLI controls and unchanged
research/proof/CODE input replays. --live intentionally retains original b933
HEAD failures after ce0, with no new clean-tree policy. The global manifest-escape
guard remains deferred: valid source manifests may intentionally use sibling
paths. The exact audit Cargo.toml basename guard is part of final replay.
===== 004 END .claude/tasks/audit-cargo-packaging/execution.md =====
===== 005 BEGIN .claude/tasks/audit-cargo-packaging/research.md | 5509 bytes | SHA256 f93288d7ff45295f0d89dbb70bfd346706d3180be6d837938c1654cd58789c7b =====
Archived Cargo manifest discovery
Status: measured; packaging repair remains proposed. Serves Kadek foundation row 4
through Radio; discovered from the committed strict-proof consumer. Exact Radio
parent is ce0fb312faa8770e80efe9afa864106ae6b51552 (PR40). This worktree is clean
at that parent before adding these task and research artifacts.
Observed defect
A separate consumer pins cyber-bao to that Git revision, disables default
features, and uses a private Cargo home with Rust 1.95.0. Lock generation,
metadata, debug and release all emit:
warning: skipping duplicate package `cyber-bao v0.1.0 (...#ce0fb312)`:
/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml
in favor of .../git/checkouts/radio-1a8d5f25084d9866/ce0fb31/cyber-bao/Cargo.toml
The exact full text/argv/times are retained in
audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-*.
The committed audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml
contains that absolute path at line 7. This is a dependency-discovery packaging
defect: Cargo inspects a historical harness manifest when consuming the Git
repository. The observed warning depends on this machine's existing external
probe directory; no universal failure or forged-hash result is claimed.
The effective metadata still selects the pinned cyber-bao and Git Hemera
d5f0a09539360934fb32db9b2e15a91995607db6, with no features or registry
dependencies. Both profiles pass all eight independent reader controls. Their
source/manifest, literal, tool and resolution snapshots match before/after.
This verifies the selected source for these runs; it does not make acquisition
warning-free. Production Rust and normal manifests need no change.
Exact inventory and replay implications
git ls-files -z audit filtered by the exact basename Cargo.toml, cross-checked
with rg --files audit -g Cargo.toml, identifies seven manifests (2,141 bytes):
| Capsule | Logical Cargo paths |
|---|---|
2026-10-09-kadek-slice-traversal |
Cargo.toml |
2026-10-12-bao-proof-research |
probe/Cargo.toml, primary-probe/Cargo.toml |
2026-10-12-bao-bounded-proof |
fixture-probe/Cargo.toml, nostd/Cargo.toml, nostd-parent/Cargo.toml, seals/Cargo.toml |
The seven exact bytes and Git identities are frozen in inputs/renames.json.
All other Cargo.toml files are source manifests, outside the rename scope.
Already compressed evidence archives and context text are not discoverable
manifests and need no repackaging.
Both 2026-10-12 capsules' files.json include their own verifier's original
hash. Rewriting those verifiers and recalculating the historical indices would
erase an original evidence identity. Keep the indices, receipts, reviews and
context packages byte-for-byte. Preserve each original verifier/reproducer under
an archive filename; a thin entry wrapper can reconstruct its historical logical
layout in a disposable directory and execute those exact original bytes.
The 2026-10-09 reproducer copies its own Cargo manifest into exported workspaces.
It therefore needs the same logical-layout staging. Its broad codec matrix need
not run again: the packaging check can invoke its unchanged prepare-crate
function and compare the exported manifest/lock/probe bytes. The separate bounded
proof code-input/verify.nu refers to unchanged evidence and requires no edit.
Historical capture helpers in records/ are receipts, not new replay entrypoints.
Fresh baseline replays on ce0 pass: research has 89 files / 98 Git inputs / 9 raw
records; bounded-proof execution has 619 files / 2,777 original Git input records /
115 raw records. Exact commands and full output are in research-before and
proof-before records. These are evidence replays, not Cargo or codec reruns.
Scope and limits
The cached registry at soft3 18fd6b22ec45725aa776e37d377c5a75aeeaf553 places
Radio in soft3. Kadek is an actual direct Git consumer; its eventual adapter
reaches Cyb separately. This task cannot claim an isolated ring-0 product radius.
Its verification target is archive preservation plus clean Git dependency
discovery and the unchanged reader consumer. No Rust/API/specification/version
or release change is proposed. Previous broad red gates remain historical and
are neither rerun nor relabeled green by this packaging repair.
PLAN v1 follow-up evidence
The fresh review exposed missing verification precision, not a different repair.
Outer snapshots now explicitly say historical-ce0-reader-before-runs.json and
historical-ce0-reader-after-runs.json; original bytes/timestamps and v1's frozen
copies are preserved. A future differential must reproduce the warning on ce0
through the same fresh local-Git mechanism as its candidate and keep the external
nostd-parent manifest unchanged throughout. That paired measurement is pending.
records/original-prepare-v2.json invokes a child nu -c with a literal quoted
source path and calls the private prepare-crate on db1d62e2… and 590e69ea….
It exits 0 without Cargo. The six exported manifest/lock/probe copies and complete
16/17-file cyber-bao exports match their original inputs, with only the function's
existing exact Hemera path-to-registry substitution. Full revision IDs, child
code, input hashes and comparisons are in inputs/prepare-measurement.json and
inputs/v2-additional-source.json. This demonstrates the invocation mechanism;
it does not yet exercise a packaging wrapper or rerun the surrounding matrix.
===== 005 END .claude/tasks/audit-cargo-packaging/research.md =====
===== 006 BEGIN audit/2026-10-13-audit-cargo-packaging/README.md | 3362 bytes | SHA256 66a9b8d1abbb7591d18399570029ae450a3fd32f4dc720bb91b81a979f70c858 =====
Archived Cargo manifest packaging
The seven archived harness Cargo.toml files are renamed losslessly to
Cargo.toml.txt. Three historical replay entries now stage their original layout
outside the repository and execute the exact preserved scripts. Production Rust,
normal manifests, locks, versions and specifications are unchanged.
Fresh same-session Rust 1.95 controls used one local Git URL and independent
consumer/cache/target directories. Parent ce0fb312… reproduced the duplicate
package warning in lock generation, metadata and both reader profiles. Temporary
committed candidate e22c5b47… emitted zero warnings in those four commands.
Eight literal reader cases produce byte-identical debug/release output in both
arms and the historical control. All 63 selected crate files and three-node
metadata agree after 34 explicit identifier/path substitutions per arm. The
external historical manifest causing the warning stayed identical before,
between and after the runs. See pair/ for exact revisions, argv and raw streams.
This is a local packaging witness, not an origin or release input.
The original research, proof and CODE-input replays pass. Staging reproduces
exactly 13/90/620 original capsule files and both historical prepare-crate
exports. Missing/collision controls fail before execution and leave the actual
audit tree unchanged. Default CLI resolution is preserved. Historical --live
checks correctly fail because ce0 differs from their original b933 parent;
these failures are retained, not waived. A child status-77 witness verifies
stream forwarding without inserted newlines, status propagation and retained
failure staging. Successful staging is removed.
inputs/historical-index-bindings.json maps 19 historical index entries to their
preserved archives. Historical indices and raw receipts are unchanged; their
physical paths deliberately differ until staging. One pre-CODE verifier variant
already had a distinct retained body before this repair. No nested historical
audit archive is duplicated here.
Replay (requires the original Radio Git objects, including ce0; Nu and Git):
The verifier checks retained hashes, exact historical Git inputs, the incremental
local candidate bundle, full tree allowlist, archived index bindings, raw record
streams, metadata substitutions and reader/source equality. It does not rebuild
or re-run Cargo. --live additionally compares the reviewed packaging files and
final explicit path set with the supplied repository. Original executable replay
commands remain at their historical paths. The external absolute parent harness
path remains a historical reference; its bytes are retained, but its existence
is not a requirement for this replay.
PLAN v2 was independently approved; CODE review is pending. The initial missing retained-path notice, bare-index setup failure and deliberately interrupted first pair setup are preserved as earlier execution epochs. The completed pair and final wrapper controls are separate. Previous broad Radio gates, rung and last-tag results remain unrefreshed; the warning-free claim is limited to the four final candidate consumer commands. No API or semver change, release, tag, registry publication or Kadek dependency update occurs in this unit.
===== 006 END audit/2026-10-13-audit-cargo-packaging/README.md =====
===== 007 BEGIN audit/2026-10-13-audit-cargo-packaging/execution/source-freeze.json | 2520 bytes | SHA256 e1bfd8f595385152fd08a23ab5edf46d683689e7ccb81639bd6e63082d0a07fa ===== [ { "path": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "path": "audit/2026-10-09-kadek-slice-traversal/reproduce.nu", "bytes": 916, "sha256": "794bbec41c38771fe666ebc40d5b8bbe8cf844632000654289fcc5ed65c7533e" }, { "path": "audit/2026-10-09-kadek-slice-traversal/reproduce.original.nu.txt", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "path": "audit/2026-10-12-bao-proof-research/verify.nu", "bytes": 719, "sha256": "fd64cf8a7aed61ce88c336497c05f805a885c9ef3325ea38f09f0ed1cffcc30f" }, { "path": "audit/2026-10-12-bao-proof-research/verify.original.nu.txt", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "path": "audit/2026-10-12-bao-bounded-proof/verify.nu", "bytes": 628, "sha256": "ad4154daeb25c641ccd571905edf4870899e160f7b7d4e0cb3fe6231684f54d2" }, { "path": "audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/replay.nu", "bytes": 1795, "sha256": "a8f26e4ce221fa18ddd99eb622015e6327e8df2f480386c747ab163619f3b151" } ]
===== 007 END audit/2026-10-13-audit-cargo-packaging/execution/source-freeze.json =====
===== 008 BEGIN audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt | 454 bytes | SHA256 209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605 ===== [package] name = "kadek-bao-source-repro" version = "0.0.0" edition = "2024" publish = false
[workspace] members = ["cyber-bao"] resolver = "2"
[workspace.lints.rust] missing_debug_implementations = "warn" unexpected_cfgs = { level = "warn", check-cfg = ["cfg(iroh_docsrs)", "cfg(iroh_loom)"] }
[workspace.lints.clippy] unused-async = "warn"
[dependencies] cyber-bao = { path = "cyber-bao" } hemera = { package = "cyber-hemera", version = "=0.3.1" }
===== 008 END audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt =====
===== 009 BEGIN audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt | 375 bytes | SHA256 981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570 ===== [package] name = "bao-proof-fixture-freeze" version = "0.0.0" edition = "2024" publish = false [workspace] [dependencies] cyber-bao = { path = "../../../cyber-bao" } hemera = { package = "cyber-hemera", git = "https://github.com/cyberia-to/hemera", rev = "d5f0a09539360934fb32db9b2e15a91995607db6", default-features = false } [profile.dev.package.cyber-hemera] opt-level = 3
===== 009 END audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt =====
===== 010 BEGIN audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt | 246 bytes | SHA256 80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36 ===== [package] name = "bao-proof-nostd-probe" version = "0.0.0" edition = "2024" [workspace] [dependencies] cyber-bao = { path = "/tmp/radio-bao-proof-parent-b933/cyber-bao", default-features = false } bin name = "link-probe" path = "src/main.rs"
===== 010 END audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt =====
===== 011 BEGIN audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt | 222 bytes | SHA256 06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d ===== [package] name = "bao-proof-nostd-probe" version = "0.0.0" edition = "2024" [workspace] [dependencies] cyber-bao = { path = "../../../cyber-bao", default-features = false } bin name = "link-probe" path = "src/main.rs"
===== 011 END audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt =====
===== 012 BEGIN audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt | 250 bytes | SHA256 c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f ===== [package] name = "bao-proof-seal-probes" version = "0.0.0" edition = "2024" publish = false [workspace] [dependencies] cyber-bao = { path = "../../../cyber-bao", default-features = false } serde = "1" [profile.dev.package.cyber-hemera] opt-level = 3
===== 012 END audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt =====
===== 013 BEGIN audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt | 377 bytes | SHA256 eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd ===== [package] name = "bao-proof-primary-probe" version = "0.0.0" edition = "2024" publish = false
[workspace]
[dependencies] cyber-bao = { path = "../../../cyber-bao" } hemera = { package = "cyber-hemera", git = "https://github.com/cyberia-to/hemera", rev = "d5f0a09539360934fb32db9b2e15a91995607db6", default-features = false }
[profile.dev.package.cyber-hemera] opt-level = 3
===== 013 END audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt =====
===== 014 BEGIN audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt | 217 bytes | SHA256 26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038 ===== [package] name = "bao-proof-carrier-probe" version = "0.0.0" edition = "2024" publish = false
[workspace]
[dependencies] cyber-bao = { path = "../../../cyber-bao" }
[profile.dev.package.cyber-hemera] opt-level = 3
===== 014 END audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt =====
===== 015 BEGIN audit/2026-10-09-kadek-slice-traversal/reproduce.nu | 916 bytes | SHA256 794bbec41c38771fe666ebc40d5b8bbe8cf844632000654289fcc5ed65c7533e ===== use ../2026-10-13-audit-cargo-packaging/replay.nu [stage finish]
def main [
--implementation-revision: string
--radio-repo: path = "/cyber/radio"
--hemera-repo: path = "/cyber/hemera"
--fetch
--full-workspace
] {
if $implementation_revision == null {
error make {msg: '--implementation-revision must name the actual committed implementation'}
}
let staged = (stage $env.FILE_PWD reproduce.nu [Cargo.toml])
mut args = [--implementation-revision $implementation_revision --radio-repo ($radio_repo | path expand) --hemera-repo ($hemera_repo | path expand)]
if $fetch { $args = ($args | append '--fetch') }
if $full_workspace { $args = ($args | append '--full-workspace') }
let result = (^($nu.current-exe) ($staged.capsule | path join reproduce.nu) ...$args | complete)
print --no-newline $result.stdout
print --stderr --no-newline $result.stderr
finish $staged $result.exit_code
}
===== 015 END audit/2026-10-09-kadek-slice-traversal/reproduce.nu =====
===== 016 BEGIN audit/2026-10-09-kadek-slice-traversal/reproduce.original.nu.txt | 11037 bytes | SHA256 2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50 =====
Replays immutable source inputs into fresh temporary workspaces; no repo writes.
def checked [action: closure] { let r = (do $action | complete) if $r.exit_code != 0 { error make {msg: $"exit ($r.exit_code)\n($r.stderr)\n($r.stdout)"} } $r }
def record [run: path, name: string, command: string, action: closure] { let started = (date now) let r = (do $action | complete) let stem = ($run | path join logs $name) $r.stdout | save $"($stem).stdout" $r.stderr | save $"($stem).stderr" {command: $command, cwd: $env.PWD, started: $started, ended: (date now), exit: $r.exit_code} | to json | save $"($stem).json" print $"($name): exit ($r.exit_code)" $r }
def prepare-crate [repo: path, revision: string, dir: path, receipt: path] { mkdir $dir let archive = $"($dir).tar" checked { ^git -C $repo archive --format=tar --output $archive $revision cyber-bao } | ignore checked { ^tar -xf $archive -C $dir } | ignore cp ($receipt | path join Cargo.toml) ($dir | path join Cargo.toml) cp ($receipt | path join Cargo.lock) ($dir | path join Cargo.lock) mkdir ($dir | path join src) cp ($receipt | path join probe.rs) ($dir | path join src main.rs) let manifest = ($dir | path join cyber-bao Cargo.toml) let original = (open --raw $manifest) if not ($original | str contains 'path = "../../hemera/rs"') { error make {msg: 'unexpected cyber-bao Hemera declaration'} } $original | str replace 'path = "../../hemera/rs"' 'version = "=0.3.1"' | save --force $manifest }
def main [
--implementation-revision: string # Required: actual committed source revision.
--radio-repo: path = "/cyber/radio"
--hemera-repo: path = "/cyber/hemera"
--fetch # Fetch pinned dependencies when caches are incomplete; never regenerate locks.
--full-workspace # Also export exact-source Hemera and run the broader native gates.
] {
if $implementation_revision == null {
error make {msg: '--implementation-revision must name the actual committed implementation'}
}
let receipt = $env.FILE_PWD
let repo = ($radio_repo | path expand)
let hemera = ($hemera_repo | path expand)
let base = 'db1d62e2cd1e4b2f309fa19bcc158bd29b44753d'
let hemera_rev = '23f3bbcff910ea6d504ceb505680a539260869da'
let implementation = ((checked { ^git -C $repo rev-parse $"($implementation_revision)^{commit}" }).stdout | str trim)
let run = ((checked { ^mktemp -d /tmp/radio-slice-replay.XXXXXX }).stdout | str trim)
mkdir ($run | path join logs)
print $"logs and exported inputs: ($run)"
checked { ^git -C $repo merge-base --is-ancestor $base $implementation } | ignore
{radio_base: $base, implementation: $implementation, hemera_source: $hemera_rev,
hemera_registry: '=0.3.1', checksum: 'ebcf7ffcd69170adde7e792826d7cececda962ea220b9834c6535bbc71e5a6df'}
| to json | save ($run | path join sources.json)
(checked { ^rustc -Vv }).stdout | save ($run | path join rustc.txt)
(checked { ^cargo -Vv }).stdout | save ($run | path join cargo.txt)
let baseline = ($run | path join baseline)
let candidate = ($run | path join candidate)
prepare-crate $repo $base $baseline $receipt
prepare-crate $repo $implementation $candidate $receipt
for source in (open ($receipt | path join SOURCE-FREEZE.json)) {
let actual = ((checked { ^git hash-object ($candidate | path join $source.path) }).stdout | str trim)
if $actual != $source.blob { error make {msg: $"reviewed source mismatch: ($source.path)"} }
}
let original = ((checked { ^git -C $repo ls-tree -r $base cyber-bao }).stdout
| lines | parse -r '^(?P
===== 016 END audit/2026-10-09-kadek-slice-traversal/reproduce.original.nu.txt =====
===== 017 BEGIN audit/2026-10-12-bao-proof-research/verify.nu | 719 bytes | SHA256 fd64cf8a7aed61ce88c336497c05f805a885c9ef3325ea38f09f0ed1cffcc30f ===== use ../2026-10-13-audit-cargo-packaging/replay.nu [stage finish]
def main [--repo: string, --siblings: string, --live] { let own = if $repo == null { $env.FILE_PWD | path dirname | path dirname } else { $repo | path expand } let parent = if $siblings == null { $own | path dirname } else { $siblings | path expand } let staged = (stage $env.FILE_PWD verify.nu [probe/Cargo.toml primary-probe/Cargo.toml]) let args = ([--repo $own --siblings $parent] | append (if $live { [--live] } else { [] })) let result = (^($nu.current-exe) ($staged.capsule | path join verify.nu) ...$args | complete) print --no-newline $result.stdout print --stderr --no-newline $result.stderr finish $staged $result.exit_code }
===== 017 END audit/2026-10-12-bao-proof-research/verify.nu =====
===== 018 BEGIN audit/2026-10-12-bao-proof-research/verify.original.nu.txt | 4241 bytes | SHA256 70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78 ===== use std/assert
def check-file [root: string, row: record] { let path = ($root | path join $row.path) assert equal (open --raw $path | hash sha256) $row.sha256 assert equal (ls $path | get size | first | into int) $row.bytes }
def git-bytes [repo: string, revision: string, path: string, temp: string] { ^git -C $repo cat-file blob $'($revision):($path)' out> $temp assert equal $env.LAST_EXIT_CODE 0 open --raw $temp | into binary }
def main [--repo: string, --siblings: string, --live] { let root = $env.FILE_PWD let own = if $repo == null { $root | path dirname | path dirname } else { $repo } let parent = if $siblings == null { $own | path dirname } else { $siblings } let repos = {radio: $own, hemera: ($parent | path join hemera), kadek: ($parent | path join kadek), soft3: ($parent | path join soft3)} let files = (open ($root | path join files.json)) for f in $files { check-file $root $f } let initial = (open ($root | path join inputs.json)) for f in $initial.probe_inputs { check-file $root $f } for f in (open ($root | path join primary-inputs.json) | get files) { check-file $root $f } let support = (open ($root | path join support-inputs.json)) let bridge = (open ($root | path join merged-bridge.json)) let temp = (^mktemp /tmp/radio-proof-replay.XXXXXX | str trim) let git_inputs = ($initial.git_inputs | append $support | append $bridge.merged_inputs) for f in $git_inputs { let bytes = (git-bytes ($repos | get $f.repository) $f.revision $f.path $temp) assert equal ($bytes | hash sha256) $f.sha256 assert equal ($bytes | bytes length) $f.bytes if $f.local? != null { assert equal (open --raw ($root | path join $f.local) | into binary) $bytes } } for f in $bridge.comparison { let old = (git-bytes $own $bridge.parent $f.path $temp) let new = (git-bytes $own $bridge.current $f.path $temp) assert equal ($old | hash sha256) $f.parent_sha256 assert equal ($new | hash sha256) $f.sha256 assert equal (($old | hash sha256) == ($new | hash sha256)) $f.unchanged } assert equal (open --raw ($root | path join prerequisite/traversal.rs)) (open --raw ($root | path join merged-prerequisite/traversal.rs)) for e in (open ($root | path join excerpts.json)) { let bytes = (git-bytes ($repos | get $e.repository) $e.revision $e.source $temp) assert equal ($bytes | hash sha256) $e.source_sha256 let lines = ($bytes | decode utf-8 | split row "\n") let text = (($lines | skip ($e.first - 1) | take ($e.last - $e.first + 1) | str join "\n") + "\n") assert equal ($text | hash sha256) $e.sha256 } let runner = (open --raw ($root | path join records/capture.rb) | hash sha256) let raw = (glob ($root | path join 'records/*.json')) for path in $raw { let record = (open $path) assert equal $record.runner_sha256 $runner let base = ($path | str replace --regex '\.json$' '') for stream in [stdout stderr] { let body = (open --raw $'($base).($stream)' | into binary) assert equal ($body | hash sha256) ($record | get $stream | get sha256) assert equal ($body | bytes length) ($record | get $stream | get bytes) } } assert equal (open --raw ($root | path join records/initial-debug.stdout)) (open --raw ($root | path join records/legacy-release.stdout)) assert equal (open --raw ($root | path join records/primary-debug.stdout)) (open --raw ($root | path join records/primary-release.stdout)) let fixtures = (open ($root | path join fixtures.json)) for f in $fixtures { check-file $root $f } for f in (open ($root | path join task-inputs.json)) { check-file $root {path: $f.local, sha256: $f.sha256, bytes: $f.bytes} if $live { check-file $own $f } } if $live { assert equal (^git -C $own rev-parse HEAD | str trim) $bridge.current assert equal (^git -C $own diff --name-only | str trim) '' } rm $temp {status: pass, files: ($files | length), git_input_records: ($git_inputs | length), bridge_comparisons: ($bridge.comparison | length), primary_excerpts: 13, raw_receipts: ($raw | length), fixtures: ($fixtures | length), production_implemented: false, cargo_rerun: false, historical_inventory_archive_replayed: false} | to json }
===== 018 END audit/2026-10-12-bao-proof-research/verify.original.nu.txt =====
===== 019 BEGIN audit/2026-10-12-bao-bounded-proof/verify.nu | 628 bytes | SHA256 ad4154daeb25c641ccd571905edf4870899e160f7b7d4e0cb3fe6231684f54d2 ===== use ../2026-10-13-audit-cargo-packaging/replay.nu [stage finish]
def main [--repo: string, --live] { let own = if $repo == null { $env.FILE_PWD | path dirname | path dirname } else { $repo | path expand } let staged = (stage $env.FILE_PWD verify.nu [fixture-probe/Cargo.toml nostd/Cargo.toml nostd-parent/Cargo.toml seals/Cargo.toml]) let args = ([--repo $own] | append (if $live { [--live] } else { [] })) let result = (^($nu.current-exe) ($staged.capsule | path join verify.nu) ...$args | complete) print --no-newline $result.stdout print --stderr --no-newline $result.stderr finish $staged $result.exit_code }
===== 019 END audit/2026-10-12-bao-bounded-proof/verify.nu =====
===== 020 BEGIN audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt | 10975 bytes | SHA256 dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a ===== use std/assert
def check [root: string, path: string, bytes: int, digest: string] { let data = (open --raw ($root | path join $path) | into binary) assert equal ($data | bytes length) $bytes assert equal ($data | hash sha256) $digest }
def main [--repo: string, --live] {
let root = $env.FILE_PWD
let own = if $repo == null { $root | path dirname | path dirname } else { $repo }
let all = (open ($root | path join files.json))
for f in $all { check $root $f.path $f.bytes $f.sha256 }
let ready = (open ($root | path join source-complete.json))
let freezes = [tests-first.json source-freeze.json source-final.json source-ready.json source-complete.json]
mut candidates = []
for p in $freezes {
let freeze = (open ($root | path join $p))
for f in $freeze.files {
check $root $f.local $f.bytes $f.sha256
$candidates = ($candidates | append $f)
}
}
for f in (open ($root | path join fixtures-first.json) | get files) {
check $root $f.path $f.bytes $f.sha256
}
for p in [seals-first.json seals-final-inputs.json] {
for f in (open ($root | path join $p)) { check $root $f.path $f.bytes $f.sha256 }
}
let temp = (^mktemp /tmp/radio-proof-execution-replay.XXXXXX | str trim)
mut original_count = 0
mut candidate_count = 0
let epochs = (glob ($root | path join 'epochs/.json'))
for p in $epochs {
let epoch = (open $p)
assert equal $epoch.head $ready.parent
assert equal ($epoch.files | to json --raw | hash sha256) ($p | path parse | get stem)
for row in $epoch.files {
let path = ($row | get 0)
let size = ($row | get 1)
let digest = ($row | get 2)
let local = ($candidates | where {|f| $f.path == $path and $f.sha256 == $digest })
if ($local | is-not-empty) {
assert equal ($local | first | get bytes) $size
$candidate_count += 1
} else {
^git -C $own cat-file blob $'($epoch.head):($path)' out> $temp
assert equal $env.LAST_EXIT_CODE 0
let data = (open --raw $temp | into binary)
assert equal ($data | bytes length) $size
assert equal ($data | hash sha256) $digest
$original_count += 1
}
}
}
let runner = (open --raw ($root | path join records/capture.rb) | hash sha256)
let raw = (glob ($root | path join 'records/.json'))
for p in $raw {
let r = (open $p)
assert equal $r.runner_sha256 $runner
let stem = ($p | str replace --regex '\.json$' '')
for stream in [stdout stderr] {
let data = (open --raw $'($stem).($stream)' | into binary)
assert equal ($data | bytes length) ($r | get $stream | get bytes)
assert equal ($data | hash sha256) ($r | get $stream | get sha256)
}
}
let bindings = (glob ($root | path join 'bindings/*.json'))
let gate_runners = ([records/final-gates.rb records/radio-bao-proof-final-gates-v2.rb] | each {|p| open --raw ($root | path join $p) | hash sha256 })
for p in $bindings {
let b = (open $p)
assert equal $b.source_before $b.source_after
assert ($b.runner_sha256 in $gate_runners)
assert equal (open --raw ($root | path join records $'($b.name).json') | hash sha256) $b.record_sha256
assert ( ($root | path join epochs $'($b.source_before).json') | path exists )
}
let ledger = (open ($root | path join gate-ledger.json))
for row in $ledger {
let record = (open ($root | path join $row.record))
assert equal (open --raw ($root | path join $row.record) | hash sha256) $row.record_sha256
assert equal $record.exit_code $row.exit
assert equal $record.argv $row.argv
assert equal $record.revision $row.revision
assert equal $record.stdout $row.stdout
assert equal $record.stderr $row.stderr
if $row.epoch != null {
assert equal (open ($root | path join bindings $'($row.name).json') | get source_before) $row.epoch
}
}
for row in (open ($root | path join review-gates.json)) {
assert equal $row ($ledger | where name == $row.name | first)
}
let pairs = ((open ($root | path join comparisons.json)) | append (open ($root | path join additional-comparisons.json)))
for pair in $pairs {
assert ($pair.candidate in ($ledger | get name))
assert ($pair.parent in ($ledger | get name))
}
let previous = (open ($root | path join source-ready.json))
let changed = ($ready.files | where {|f| $f.sha256 != ($previous.files | where path == $f.path | first | get sha256) } | get path)
assert equal $changed ['cyber-bao/tests/proof.rs']
for row in (open ($root | path join seals-final-results.json)) {
let record = (open ($root | path join records $'seal-($row.bin)-final.json'))
assert equal $record.exit_code 101
assert equal $row.actual [$row.expected]
let stderr = (open --raw ($root | path join records $'seal-($row.bin)-final.stderr'))
let codes = ($stderr | parse --regex 'error[(E\d+)]' | get capture0 | uniq)
assert equal $codes [$row.expected]
}
assert equal (open ($root | path join records/seal-control-final.json) | get exit_code) 0
for f in (open ($root | path join interleaved-oracle.json) | get files) {
check $root $f.path $f.bytes $f.sha256
}
let review = (open ($root | path join plan-review/invocation.json))
let completion = (open ($root | path join plan-review/completion.json))
assert equal (open --raw ($root | path join plan-review/launcher.rb) | hash sha256) $review.launcher_sha256
assert equal (open --raw ($root | path join plan-input/context.txt) | hash sha256) $review.input_sha256
assert equal (open --raw ($root | path join plan-review/stdout.json) | hash sha256) $completion.stdout_sha256
assert equal (open --raw ($root | path join plan-review/stderr.txt) | hash sha256) $completion.stderr_sha256
assert equal (open ($root | path join plan-review/stdout.json) | get result) (open --raw ($root | path join plan-review/result.md))
for pack in [plan-input code-input] {
let manifest = (open ($root | path join $pack manifest.json))
check $root ($pack | path join context.txt) $manifest.context_bytes $manifest.context_sha256
}
let final_review = (open ($root | path join review/code/invocation.json))
let final_completion = (open ($root | path join review/code/completion.json))
assert equal (open --raw ($root | path join review/code/launcher.rb) | hash sha256) $final_review.launcher_sha256
assert equal (open --raw ($root | path join code-input/context.txt) | hash sha256) $final_review.input_sha256
assert equal (open --raw ($root | path join review/code/stdout.json) | hash sha256) $final_completion.stdout_sha256
assert equal (open --raw ($root | path join review/code/stderr.txt) | hash sha256) $final_completion.stderr_sha256
assert equal $final_completion.exit_code 0
assert equal (open ($root | path join review/code/stdout.json) | get result) (open --raw ($root | path join review/code/result.md))
let analysis = (open ($root | path join review/code/analysis.json))
for name in [owner-clippy-all-final parent-owner-clippy-all-final] {
let text = (open --raw ($root | path join records $'($name).stderr'))
let parsed = ($text | parse --regex '(?s)error: (?P
===== 020 END audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt =====
===== 021 BEGIN audit/2026-10-13-audit-cargo-packaging/replay.nu | 1795 bytes | SHA256 a8f26e4ce221fa18ddd99eb622015e6327e8df2f480386c747ab163619f3b151 ===== use std/assert
Historical names exist only in this disposable copy, never in the Git source.
export def stage [root: path, entry: string, manifests: list
export def finish [staged: record, status: int] { if $status == 0 { rm --recursive $staged.directory } else { print --stderr $'Failed historical replay retained at ($staged.directory)' } exit $status }
===== 021 END audit/2026-10-13-audit-cargo-packaging/replay.nu =====
===== 022 BEGIN Cargo.toml | 2085 bytes | SHA256 3f8d71aa50c829445d66c981166e22f9b64fbd1f91bdddf4ecb422cf4ebd39f2 ===== [workspace] members = [ "iroh-base", "iroh-dns-server", "iroh", "iroh/bench", "iroh-relay",
"cyber-bao", "particle", "iroh-blobs", "iroh-gossip", "iroh-docs", "iroh-car", "iroh-willow", "tests/integration", "radio-cli", ] resolver = "2" exclude = ["quinn", "nettools"]
[workspace.dependencies] hemera = { package = "cyber-hemera", git = "https://github.com/cyberia-to/hemera", rev = "d5f0a09539360934fb32db9b2e15a91995607db6", default-features = false }
[profile.release] debug = true
Hemera is the hash under every blob, BAO tree and ticket. Unoptimized it makes the
two-node tests (8 MB blobs) take minutes and starve their QUIC paths into idle
timeouts; optimizing just the hash keeps debug builds debuggable everywhere else.
[profile.dev.package.cyber-hemera] opt-level = 3
[profile.dev-ci] inherits = 'dev' opt-level = 1
[profile.optimized-release] inherits = 'release' debug = false lto = true debug-assertions = false opt-level = 3 panic = 'abort' incremental = false
[workspace.lints.rust] missing_debug_implementations = "warn"
We use this --cfg for documenting the cargo features on which an API
is available. To preview this locally use: RUSTDOCFLAGS="--cfg
iroh_docsrs" cargo +nightly doc --all-features. We use our own
iroh_docsrs instead of the common docsrs to avoid also enabling this
feature in any dependencies, because some indirect dependencies
require a feature enabled when using --cfg docsrs which we can not
do. To enable for a crate set `#![cfg_attr(iroh_docsrs,
feature(doc_cfg))]` in the crate.
We also have our own iroh_loom cfg to enable tokio-rs/loom testing.
unexpected_cfgs = { level = "warn", check-cfg = ["cfg(iroh_docsrs)", "cfg(iroh_loom)"] }
[workspace.lints.clippy] unused-async = "warn"
[patch.crates-io] willow-data-model = { git = "https://github.com/n0-computer/willow-rs.git", branch = "main" } willow-encoding = { git = "https://github.com/n0-computer/willow-rs.git", branch = "main" } meadowcap = { git = "https://github.com/n0-computer/willow-rs.git", branch = "main" }
===== 022 END Cargo.toml =====
===== 023 BEGIN cyber-bao/Cargo.toml | 1078 bytes | SHA256 95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365 ===== [package] name = "cyber-bao" version = "0.1.0" edition = "2024" description = "Poseidon2-BAO: verified streaming with Poseidon2 hash over Goldilocks" license = "MIT OR Apache-2.0" rust-version = "1.89"
[lints] workspace = true
[dependencies] hemera = { workspace = true } bytes = { version = "1", optional = true } smallvec = { version = "1", features = ["const_new"], optional = true } range-collections = { version = "0.4", features = ["serde", "new_unchecked"], optional = true } iroh-io = { version = "0.6.1", optional = true } genawaiter = { version = "0.99.1", features = ["futures03"], optional = true } tokio = { version = "1", features = ["io-util"], optional = true } serde = { version = "1", features = ["derive"], optional = true }
[dev-dependencies] proptest = "1" tokio = { version = "1", features = ["macros", "rt", "io-util"] }
[features] default = ["std"] std = ["hemera/std", "dep:bytes", "dep:smallvec", "dep:range-collections", "dep:iroh-io", "dep:genawaiter"] tokio_fsm = ["std", "dep:tokio"] serde = ["std", "dep:serde", "hemera/serde", "bytes/serde"]
===== 023 END cyber-bao/Cargo.toml =====
===== 024 BEGIN LICENSE-MIT | 1048 bytes | SHA256 f169adb8124d3b005416d8485d00777c9a7bdd9099982c52a4493f9732e6d050 ===== Copyright 2025 N0, INC.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
===== 024 END LICENSE-MIT =====
===== 025 BEGIN LICENSE-APACHE | 10831 bytes | SHA256 903131e2786f073a942fbf8fae122d9e576e4dad758c6da7f9f2ba58fd8611ab ===== Apache License Version 2.0, January 2004 http://www.apache.org/licenses/
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
Definitions.
"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
-
Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
-
Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
-
Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
(a) You must give any other recipients of the Work or Derivative Works a copy of this License; and
(b) You must cause any modified files to carry prominent notices stating that You changed the files; and
(c) You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
(d) If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License.
You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
-
Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
-
Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
-
Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
-
Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
-
Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
END OF TERMS AND CONDITIONS
APPENDIX: How to apply the Apache License to your work.
To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives.
Copyright [2025] [N0, INC]
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
===== 025 END LICENSE-APACHE =====
===== 026 BEGIN audit/2026-10-13-audit-cargo-packaging/review/plan-v2/result.md | 8517 bytes | SHA256 9397ff948d59b5736c6fce0322913a71dd4aea3b7364934f9a30eeb767205544 =====
Independent PLAN Review v2 — audit-cargo-packaging
Verdict: APPROVE
I re-derived the causal chain from the supplied bodies rather than trusting the narrative. Item 006 (nostd-parent/Cargo.toml, line 7) declares cyber-bao = { path = "/tmp/radio-bao-proof-parent-b933/cyber-bao", default-features = false }. Cargo's Git source enumerates every manifest in a checkout and recursively resolves their path dependencies; that absolute path resolves outside the checkout to a second on-disk cyber-bao v0.1.0, producing exactly the text in records/consumer-ce0-lock.stderr (038) and -metadata.stderr (041). The other six manifests use ../../../cyber-bao, which resolves to the checkout's own cyber-bao/Cargo.toml (016) and dedupes silently against the same package — so the defect has a single origin and renaming all seven is a conservative over-fix, not a shotgun. The diagnosis stands.
All six v1 blockers are closed, and closed with measurement rather than prose:
B1 (vacuous warning check). Step 5 now requires the external probe manifest's existence/length/hash before, between and after both arms, an explicit "absence invalidates the witness" clause on the ce0 arm, and one private object store serving both arms through the same file:// URL with only the Radio revision differing. This is the correct control: the differential now fails loudly if /tmp/radio-bao-proof-parent-b933 has been reaped, instead of silently reporting a repair it never demonstrated. The explicit refusal to delete or alter that directory also prevents the measurement from destroying its own witness.
B2 (no feasible invocation mechanism). This is now measured, not proposed. prepare-crate in item 011 is a plain def, so it is not importable, and Nu requires source paths to be parse-time constants. The resolution — a child nu -c whose code string embeds a quoted literal path, making it constant at the child's parse time while exposing the private definition — is exactly right, and item 054 shows the literal code with item 048 showing exit 0 without Cargo. Items 034 and 032 confirm the six exported manifest/lock/probe copies match their inputs byte-for-byte, with 16/17 complete cyber-bao exports and only the function's own existing path = "../../hemera/rs" → version = "=0.3.1" substitution. The plan correctly marks this as mechanism-only and explicitly declines to rerun the codec matrix (which would be the broad gate this unit does not own). All five surrounding $receipt inputs I flagged are now enumerated in step 3 and frozen in item 032.
B3 (impossible metadata equality). Narrowed correctly. Byte-equality is now confined to reader stdout and production source/manifests/locks; the metadata comparison is an explicit enumerated substitution list (validated ce0/candidate revision tokens, two consumer IDs, consumer directories, admitted checkout-root prefixes, target/build/workspace directories) with path-boundary checks and no blanket regex. The clause requiring resolve-node IDs/edges to use those same exact substitutions is important and present — item 040 shows package ids and deps[].pkg strings carrying the full rev, so an inconsistent substitution would have silently broken the graph comparison. The admission that historical HTTPS vs. new local file:// URLs are intentionally different and are not an equality claim is the honest framing.
B4 (indices inconsistent with tree). historical-index-bindings.json (033) resolves this well. I checked its internal coherence: the seven rename rows' hashes/lengths match items 004–010 exactly; the two wrapper rows (/88 in research files.json, /618 in execution files.json) match items 012 and 013 and the selected index rows in 024/025; the repeated input indices (inputs.json, primary-inputs.json, seals-first.json, seals-final-inputs.json, two plan-input/manifest.json sections) are covered; and the pre-CODE verifier row is labeled distinctly as already_historical_variant_before_packaging pointing at review/code/verify-before-code.nu (7381 bytes, a different hash) rather than being conflated with the new wrapper. The planned_direct_check field makes each deliberate physical mismatch machine-readable. Original indices stay untouched, which is right given both 2026-10-12 files.json self-hash their own verifier.
B5 (contradictory default resolution). The per-script table in the Result section is now unambiguous and matches the code: both verifiers derive $own from FILE_PWD grandparent (items 012, 013) and must receive explicitly resolved paths, while the reproducer's ~/cyber/radio / ~/cyber/hemera defaults (item 011) are retained verbatim even from another worktree. The --live semantics are stated accurately: research checks HEAD equality and a clean tracked diff, execution checks HEAD only, and no new cleanliness assertion is invented. The explicit note that these must still fail against a later merged HEAD is the correct disclosure.
B6 (mislabeled snapshots). Renamed to historical-ce0-reader-before-runs.json / -after-runs.json (029, 030) with bytes and timestamps preserved; I confirmed both carry identical ce0 source hashes and identical kadek_parent, differing only in at (01:20:13 vs 01:23:51), so the new labels describe what they actually are. V1's frozen copies retain their original labels, and future arms get arm-specific names.
Scope discipline is accurate throughout: no Rust/API/spec/version change, no release or tag, no Kadek dependency update, soft3 part_of and Kadek's direct-consumer status stated, prior broad reds explicitly unrefreshed and not relabeled, and the warning-free claim bounded to the enumerated invocations. The staging design — copy only the selected capsule to a fresh /tmp directory, move the restored .txt files so no duplicate archived names remain, treat the entry-wrapper replacement as the sole intentional collision after an identity check, fail before replay on a pre-existing logical Cargo path or missing archive, and never create a Cargo.toml inside the real repository — is the right shape, and the failure probe plus before/after repository identity check give it teeth.
Advice (non-blocking, do not re-review)
- Still worth adopting the generalized invariant rather than only the basename inventory: assert that no tracked manifest anywhere declares a path dependency that is absolute or escapes the repository root. That is the actual defect class; the seven renames are one instance. It also covers
quinnandnettools, which are workspace-excluded in item 015 but still enumerated by Cargo's Git source and were not supplied to me. Declining a global source-manifest cleanup for lack of evidence is defensible; adding a cheap guard is not the same expansion. - Pair that with the audit-basename guard the response already proposes, so the next capsule commits
Cargo.toml.txtfrom the outset instead of reintroducing this. - In the failure probe, assert the real repository's
audit/tree hash is unchanged after the deliberate failure, not just that noCargo.tomlappeared — a staging bug that writes outside the disposable directory is the expensive one. - Record
nostd-parent/Cargo.toml.txt's absolute path as nonportable-but-reconstructable, as the response states, so no future agent "repairs" the frozen bytes. The response's refusal to call it permanently unreplayable is correct and better than v1's framing. - When normalizing metadata, apply substitutions to the parsed JSON rather than the raw stdout, so a path-boundary check cannot accidentally match inside an unrelated string field. Item 040 contains both
target_directoryand manysrc_pathvalues sharing the same prefix; structural substitution makes the old/new mapping auditable per field. - Keep step 2's "complete committed tree comparison outside the allowed paths must be empty" literal and machine-checked, including root
Cargo.toml,cyber-bao/Cargo.tomland rootCargo.lockas already specified. It remains the strongest single control here.
One standing limitation, already disclosed and not a blocker: the observed warning depends on a machine-local directory, so this witness is local and not universal. The plan says so, claims no isolated ring-0 radius, and bounds its verification target to archive preservation plus clean Git dependency discovery and the unchanged reader. That is the honest scope. Proceed to CODE. ===== 026 END audit/2026-10-13-audit-cargo-packaging/review/plan-v2/result.md =====
===== 027 BEGIN audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stdout.json | 10552 bytes | SHA256 27a51f83e0ea67a2fbd7951f8bf83a2572ea4fe859a95d99a33d90f233a7dec4 =====
{"duration_api_ms":49311,"stop_reason":"end_turn","session_id":"ab5b435e-d19a-4390-a572-144bc3b7f1e3","total_cost_usd":1.2297200000000001,"usage":{"input_tokens":2,"cache_creation_input_tokens":106895,"cache_read_input_tokens":0,"output_tokens":2974,"output_tokens_details":{"thinking_tokens":0},"server_tool_use":{"web_search_requests":0,"web_fetch_requests":0},"service_tier":"standard","cache_creation":{"ephemeral_1h_input_tokens":106895,"ephemeral_5m_input_tokens":0},"inference_geo":"global","iterations":[{"input_tokens":2,"output_tokens":2974,"cache_read_input_tokens":0,"cache_creation_input_tokens":106895,"cache_creation":{"ephemeral_5m_input_tokens":0,"ephemeral_1h_input_tokens":106895},"type":"message"}],"speed":"standard"},"modelUsage":{"claude-haiku-4-5-20251001":{"inputTokens":86350,"outputTokens":12,"cacheReadInputTokens":0,"cacheCreationInputTokens":0,"webSearchRequests":0,"costUSD":0.08641,"contextWindow":200000,"maxOutputTokens":32000,"canonicalModel":"claude-haiku-4-5","provider":"firstParty","costBasis":"list"},"claude-opus-5":{"inputTokens":2,"outputTokens":2974,"cacheReadInputTokens":0,"cacheCreationInputTokens":106895,"webSearchRequests":0,"costUSD":1.14331,"contextWindow":1000000,"maxOutputTokens":64000,"canonicalModel":"claude-opus-5","provider":"firstParty","costBasis":"list"}},"permission_denials":[],"terminal_reason":"completed","fast_mode_state":"off","fast_mode_disabled_reason":"sdk_opt_in_required","subagent_stats":{"spawned":0,"requested":{"background":0,"foreground":0,"unset":0},"started_in_background":0,"max_depth":0,"spawned_by_subagents":0,"completed":0,"failed":0,"killed":{"parent":0,"user":0,"system":0},"refused":{"depth_limit":0,"concurrency_limit":0,"budget":0},"by_type":{}},"is_error":false,"num_turns":1,"subtype":"success","api_error_status":null,"result":"# Independent PLAN Review v2 — audit-cargo-packaging\n\n## Verdict: APPROVE\n\nI re-derived the causal chain from the supplied bodies rather than trusting the narrative. Item 006 (nostd-parent/Cargo.toml, line 7) declares cyber-bao = { path = \"/tmp/radio-bao-proof-parent-b933/cyber-bao\", default-features = false }. Cargo's Git source enumerates every manifest in a checkout and recursively resolves their path dependencies; that absolute path resolves outside the checkout to a second on-disk cyber-bao v0.1.0, producing exactly the text in records/consumer-ce0-lock.stderr (038) and -metadata.stderr (041). The other six manifests use ../../../cyber-bao, which resolves to the checkout's own cyber-bao/Cargo.toml (016) and dedupes silently against the same package — so the defect has a single origin and renaming all seven is a conservative over-fix, not a shotgun. The diagnosis stands.\n\nAll six v1 blockers are closed, and closed with measurement rather than prose:\n\nB1 (vacuous warning check). Step 5 now requires the external probe manifest's existence/length/hash before, between and after both arms, an explicit "absence invalidates the witness" clause on the ce0 arm, and one private object store serving both arms through the same file:// URL with only the Radio revision differing. This is the correct control: the differential now fails loudly if /tmp/radio-bao-proof-parent-b933 has been reaped, instead of silently reporting a repair it never demonstrated. The explicit refusal to delete or alter that directory also prevents the measurement from destroying its own witness.\n\nB2 (no feasible invocation mechanism). This is now measured, not proposed. prepare-crate in item 011 is a plain def, so it is not importable, and Nu requires source paths to be parse-time constants. The resolution — a child nu -c whose code string embeds a quoted literal path, making it constant at the child's parse time while exposing the private definition — is exactly right, and item 054 shows the literal code with item 048 showing exit 0 without Cargo. Items 034 and 032 confirm the six exported manifest/lock/probe copies match their inputs byte-for-byte, with 16/17 complete cyber-bao exports and only the function's own existing path = \"../../hemera/rs\" → version = \"=0.3.1\" substitution. The plan correctly marks this as mechanism-only and explicitly declines to rerun the codec matrix (which would be the broad gate this unit does not own). All five surrounding $receipt` inputs I flagged are now enumerated in step 3 and frozen in item 032.\n\n**B3 (impossible metadata equality).** Narrowed correctly. Byte-equality is now confined to reader stdout and production source/manifests/locks; the metadata comparison is an explicit enumerated substitution list (validated ce0/candidate revision tokens, two consumer IDs, consumer directories, admitted checkout-root prefixes, target/build/workspace directories) with path-boundary checks and no blanket regex. The clause requiring resolve-node IDs/edges to use *those same exact* substitutions is important and present — item 040 shows package ids and `deps[].pkg` strings carrying the full rev, so an inconsistent substitution would have silently broken the graph comparison. The admission that historical HTTPS vs. new local `file://` URLs are intentionally different and are not an equality claim is the honest framing.\n\n**B4 (indices inconsistent with tree).** `historical-index-bindings.json` (033) resolves this well. I checked its internal coherence: the seven rename rows' hashes/lengths match items 004–010 exactly; the two wrapper rows (`/88` in research `files.json`, `/618` in execution `files.json`) match items 012 and 013 and the selected index rows in 024/025; the repeated input indices (`inputs.json`, `primary-inputs.json`, `seals-first.json`, `seals-final-inputs.json`, two `plan-input/manifest.json` sections) are covered; and the pre-CODE verifier row is labeled distinctly as `already_historical_variant_before_packaging` pointing at `review/code/verify-before-code.nu` (7381 bytes, a different hash) rather than being conflated with the new wrapper. The `planned_direct_check` field makes each deliberate physical mismatch machine-readable. Original indices stay untouched, which is right given both 2026-10-12 `files.json` self-hash their own verifier.\n\n**B5 (contradictory default resolution).** The per-script table in the Result section is now unambiguous and matches the code: both verifiers derive `$own from FILE_PWD grandparent (items 012, 013) and must receive explicitly resolved paths, while the reproducer's ~/cyber/radio / ~/cyber/hemera defaults (item 011) are retained verbatim even from another worktree. The --live semantics are stated accurately: research checks HEAD equality and a clean tracked diff, execution checks HEAD only, and no new cleanliness assertion is invented. The explicit note that these must still fail against a later merged HEAD is the correct disclosure.\n\nB6 (mislabeled snapshots). Renamed to historical-ce0-reader-before-runs.json / -after-runs.json (029, 030) with bytes and timestamps preserved; I confirmed both carry identical ce0 source hashes and identical kadek_parent, differing only in at (01:20:13 vs 01:23:51), so the new labels describe what they actually are. V1's frozen copies retain their original labels, and future arms get arm-specific names.\n\nScope discipline is accurate throughout: no Rust/API/spec/version change, no release or tag, no Kadek dependency update, soft3 part_of and Kadek's direct-consumer status stated, prior broad reds explicitly unrefreshed and not relabeled, and the warning-free claim bounded to the enumerated invocations. The staging design — copy only the selected capsule to a fresh /tmp directory, move the restored .txt files so no duplicate archived names remain, treat the entry-wrapper replacement as the sole intentional collision after an identity check, fail before replay on a pre-existing logical Cargo path or missing archive, and never create a Cargo.toml inside the real repository — is the right shape, and the failure probe plus before/after repository identity check give it teeth.\n\n## Advice (non-blocking, do not re-review)\n\n- Still worth adopting the generalized invariant rather than only the basename inventory: assert that no tracked manifest anywhere declares a path dependency that is absolute or escapes the repository root. That is the actual defect class; the seven renames are one instance. It also covers quinn and nettools, which are workspace-excluded in item 015 but still enumerated by Cargo's Git source and were not supplied to me. Declining a global source-manifest cleanup for lack of evidence is defensible; adding a cheap guard is not the same expansion.\n- Pair that with the audit-basename guard the response already proposes, so the next capsule commits Cargo.toml.txt from the outset instead of reintroducing this.\n- In the failure probe, assert the real repository's audit/ tree hash is unchanged after the deliberate failure, not just that no Cargo.toml appeared — a staging bug that writes outside the disposable directory is the expensive one.\n- Record nostd-parent/Cargo.toml.txt's absolute path as nonportable-but-reconstructable, as the response states, so no future agent "repairs" the frozen bytes. The response's refusal to call it permanently unreplayable is correct and better than v1's framing.\n- When normalizing metadata, apply substitutions to the parsed JSON rather than the raw stdout, so a path-boundary check cannot accidentally match inside an unrelated string field. Item 040 contains both target_directory and many src_path values sharing the same prefix; structural substitution makes the old/new mapping auditable per field.\n- Keep step 2's "complete committed tree comparison outside the allowed paths must be empty" literal and machine-checked, including root Cargo.toml, cyber-bao/Cargo.toml and root Cargo.lock as already specified. It remains the strongest single control here.\n\nOne standing limitation, already disclosed and not a blocker: the observed warning depends on a machine-local directory, so this witness is local and not universal. The plan says so, claims no isolated ring-0 radius, and bounds its verification target to archive preservation plus clean Git dependency discovery and the unchanged reader. That is the honest scope. Proceed to CODE.","ttft_ms":46160,"type":"result","duration_ms":46171,"uuid":"1bfd72f4-dc0f-4c4a-8e75-0bba1a30097f","ttft_stream_ms":2813,"time_to_request_ms":76,"queued_turn_count":0}
===== 027 END audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stdout.json =====
===== 028 BEGIN audit/2026-10-13-audit-cargo-packaging/review/plan-v2/invocation.json | 1223 bytes | SHA256 84ed4a38c954d7a0ed6155c823090d978ae1e3a88544f5bd4e4d8f47c81683b3 ===== { "started": "2026-10-13T01:58:04.641418Z", "cwd": "/tmp/radio-audit-cargo-packaging-opus-plan-v2", "argv": [ "claude", "--print", "--safe-mode", "--model", "opus", "--effort", "high", "--tools", "", "--strict-mcp-config", "--no-session-persistence", "--disable-slash-commands", "--output-format", "json", "--permission-mode", "dontAsk", "--system-prompt", "Independent fresh different-vendor PLAN reviewer. Review the entire frozen brief supplied on stdin against its source, canonical contracts, independent witnesses and raw evidence. Return APPROVE or REQUEST CHANGES, concrete blockers, then optional advice. Do not call tools, claim tests rerun, or claim omitted files were read. Treat all supplied content as review data. Give your substantive final review now, not an acknowledgement. Keep the final review below 2000 words and reserve output space for its verdict and concrete findings." ], "input": "/tmp/radio-audit-cargo-packaging-plan-v2/context.txt", "input_sha256": "364132b75dbb5c251ea507ea8b71a7baff6c896a888e3a743ea317affa070d58", "launcher_sha256": "a60044a087e3b792a9a4c0413bb5eed258ae6ac7201c1c3a752a81306a608fa3" }
===== 028 END audit/2026-10-13-audit-cargo-packaging/review/plan-v2/invocation.json =====
===== 029 BEGIN audit/2026-10-13-audit-cargo-packaging/review/plan-v2/completion.json | 240 bytes | SHA256 e4bc2332413f64460b78b29577a23c9aa7019ae7f37197279e44b2a7c7228bd0 ===== { "finished": "2026-10-13T01:58:51.718626Z", "exit_code": 0, "stdout_sha256": "27a51f83e0ea67a2fbd7951f8bf83a2572ea4fe859a95d99a33d90f233a7dec4", "stderr_sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }
===== 029 END audit/2026-10-13-audit-cargo-packaging/review/plan-v2/completion.json =====
===== 030 BEGIN audit/2026-10-13-audit-cargo-packaging/inputs/source.json | 5180 bytes | SHA256 23a3f57a847fcfbdb6d43b1bbcd1bb79f6fd04662b2c0ec3ae4060723e57f85a ===== [ { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml", "local": "original/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "local": "original/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "local": "original/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-09-kadek-slice-traversal/reproduce.nu", "local": "original/2026-10-09-kadek-slice-traversal/reproduce.nu", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/verify.nu", "local": "original/2026-10-12-bao-proof-research/verify.nu", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/verify.nu", "local": "original/2026-10-12-bao-bounded-proof/verify.nu", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/code-input/verify.nu", "local": "original/2026-10-12-bao-bounded-proof/code-input/verify.nu", "bytes": 2833, "sha256": "20cb9d43e1e178a7a150f239d6da949a3d60937c94aa8929582ff0ff73cf3587" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/files.json", "local": "original/2026-10-12-bao-proof-research/files.json", "bytes": 13350, "sha256": "1773cdccfac8d4c95cc86659aabf22f218de8e33c07235c63d7aeb2da60e1a94" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/files.json", "local": "original/2026-10-12-bao-bounded-proof/files.json", "bytes": 98759, "sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "Cargo.toml", "local": "original/Cargo.toml.txt", "bytes": 2085, "sha256": "3f8d71aa50c829445d66c981166e22f9b64fbd1f91bdddf4ecb422cf4ebd39f2" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "cyber-bao/Cargo.toml", "local": "original/cyber-bao/Cargo.toml.txt", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "Cargo.lock", "local": "original/Cargo.lock", "bytes": 186712, "sha256": "90d5aa88f4fb507434036ad5ec0ca7a3897741fe810fdf16a080bff006130d65" } ]
===== 030 END audit/2026-10-13-audit-cargo-packaging/inputs/source.json =====
===== 031 BEGIN audit/2026-10-13-audit-cargo-packaging/inputs/renames.json | 3469 bytes | SHA256 887a035861b42d9ebb70b1ca495283cda2dfa1da614bd5aafb276a8fc892bfbb ===== [ { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml", "local": "original/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605", "logical": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml", "archived": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570", "logical": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "archived": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36", "logical": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "archived": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d", "logical": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "archived": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "local": "original/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f", "logical": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "archived": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "local": "original/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd", "logical": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "archived": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt" }, { "repository": "radio", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "local": "original/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038", "logical": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "archived": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt" } ]
===== 031 END audit/2026-10-13-audit-cargo-packaging/inputs/renames.json =====
===== 032 BEGIN audit/2026-10-13-audit-cargo-packaging/inputs/historical-index-bindings.json | 9834 bytes | SHA256 4a2b126ec58f132f3591038887b7e2378bf47840eb995d2cc04389fd4919ce94 ===== [ { "index": "audit/2026-10-12-bao-proof-research/files.json", "index_sha256": "1773cdccfac8d4c95cc86659aabf22f218de8e33c07235c63d7aeb2da60e1a94", "pointer": "/36", "logical_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-proof-research/files.json", "index_sha256": "1773cdccfac8d4c95cc86659aabf22f218de8e33c07235c63d7aeb2da60e1a94", "pointer": "/52", "logical_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-proof-research/files.json", "index_sha256": "1773cdccfac8d4c95cc86659aabf22f218de8e33c07235c63d7aeb2da60e1a94", "pointer": "/88", "logical_path": "audit/2026-10-12-bao-proof-research/verify.nu", "archived_path": "audit/2026-10-12-bao-proof-research/verify.original.nu.txt", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78", "planned_direct_check": "wrapper_differs_deliberately" }, { "index": "audit/2026-10-12-bao-proof-research/inputs.json", "index_sha256": "4995cc059ec39e366af5086da72b6a2f30881414b177972e969c5c018829ffe6", "pointer": "/probe_inputs/1", "logical_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-proof-research/primary-inputs.json", "index_sha256": "902b084cb6ec74fe81964d0921f65653e0672d739cb60f3033c4eb512d964de2", "pointer": "/files/1", "logical_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/files.json", "index_sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102", "pointer": "/105", "logical_path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/files.json", "index_sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102", "pointer": "/138", "logical_path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/files.json", "index_sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102", "pointer": "/142", "logical_path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/files.json", "index_sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102", "pointer": "/557", "logical_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/files.json", "index_sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102", "pointer": "/618", "logical_path": "audit/2026-10-12-bao-bounded-proof/verify.nu", "archived_path": "audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a", "planned_direct_check": "wrapper_differs_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/seals-first.json", "index_sha256": "92b2ed0b9e6e76af96eb5430be22f723db143d974f282433bdaa72bb3c12d074", "pointer": "/1", "logical_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/seals-final-inputs.json", "index_sha256": "1cba283247dd2f5ed2b56b1f2624506b61debf6f56610d56c3af34f7cf089f49", "pointer": "/1", "logical_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/review/code/files-before-code.json", "index_sha256": "84e0ce036b269180f151c7c7bf26ccdc7b6becfb2d49851f98dde334bd3edea6", "pointer": "/105", "logical_path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/review/code/files-before-code.json", "index_sha256": "84e0ce036b269180f151c7c7bf26ccdc7b6becfb2d49851f98dde334bd3edea6", "pointer": "/138", "logical_path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/review/code/files-before-code.json", "index_sha256": "84e0ce036b269180f151c7c7bf26ccdc7b6becfb2d49851f98dde334bd3edea6", "pointer": "/142", "logical_path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/review/code/files-before-code.json", "index_sha256": "84e0ce036b269180f151c7c7bf26ccdc7b6becfb2d49851f98dde334bd3edea6", "pointer": "/539", "logical_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "archived_path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/review/code/files-before-code.json", "index_sha256": "84e0ce036b269180f151c7c7bf26ccdc7b6becfb2d49851f98dde334bd3edea6", "pointer": "/600", "logical_path": "audit/2026-10-12-bao-bounded-proof/verify.nu", "archived_path": "audit/2026-10-12-bao-bounded-proof/review/code/verify-before-code.nu", "bytes": 7381, "sha256": "d77a7df5d0040d204006e141dfdc9b326a42a68dd27f33ad4d85c2e34c45b1d0", "planned_direct_check": "already_historical_variant_before_packaging" }, { "index": "audit/2026-10-12-bao-bounded-proof/plan-input/manifest.json", "index_sha256": "05517e88017ad6f948c4fd64c176d3c119bb16df0f96fd56b703024bf2cad52b", "pointer": "/sections/14", "logical_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038", "planned_direct_check": "logical_path_absent_deliberately" }, { "index": "audit/2026-10-12-bao-bounded-proof/plan-input/manifest.json", "index_sha256": "05517e88017ad6f948c4fd64c176d3c119bb16df0f96fd56b703024bf2cad52b", "pointer": "/sections/15", "logical_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "archived_path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd", "planned_direct_check": "logical_path_absent_deliberately" } ]
===== 032 END audit/2026-10-13-audit-cargo-packaging/inputs/historical-index-bindings.json =====
===== 033 BEGIN audit/2026-10-13-audit-cargo-packaging/inputs/registry.json | 364 bytes | SHA256 161c57e4dc5a81ae3a20256aa6643826214dfb358bb23db46dcdd5f12c0a617c ===== { "repository": "soft3", "revision": "18fd6b22ec45725aa776e37d377c5a75aeeaf553", "path": "release/components.toml", "bytes": 16783, "sha256": "02aae8e6f2def3e23c124c76be6cc52b01cc54e86ab514c0a519dcbaf7c21e8e", "first": 250, "last": 260, "excerpt_sha256": "c8981791a8d1a7860703afece8f14943f7e2f2629d297415392fa15db72db984", "excerpt_bytes": 149 }
===== 033 END audit/2026-10-13-audit-cargo-packaging/inputs/registry.json =====
===== 034 BEGIN audit/2026-10-13-audit-cargo-packaging/inputs/registry-radio.txt | 149 bytes | SHA256 c8981791a8d1a7860703afece8f14943f7e2f2629d297415392fa15db72db984 ===== component name = "radio" kind = "crate" repo = "radio" verb = "transmit" facet = "space" layer = 7 part_of = "soft3" phase = "1" state = "live"
===== 034 END audit/2026-10-13-audit-cargo-packaging/inputs/registry-radio.txt =====
===== 035 BEGIN audit/2026-10-13-audit-cargo-packaging/execution/staging-tests-v2.rb | 6123 bytes | SHA256 a7ec49f602321063728d1c640eeec274a5684735fadea386918eee3ab3364dbe ===== require 'json';require 'digest';require 'open3';require 'fileutils' ROOT='/Users/master/cyber/radio-bao-bounded-proof';BASE='ce0fb312faa8770e80efe9afa864106ae6b51552';OUT='/tmp/radio-audit-packaging-staging-tests-v2' raise 'exists' if File.exist?(OUT);FileUtils.mkdir_p(OUT) def run(name,*argv) o,e,s=Open3.capture3(*argv,binmode:true);File.binwrite(OUT+'/'+name+'.stdout',o);File.binwrite(OUT+'/'+name+'.stderr',e) File.write(OUT+'/'+name+'.json',JSON.pretty_generate(argv:argv,exit:s.exitstatus,stdout_sha256:Digest::SHA256.hexdigest(o),stderr_sha256:Digest::SHA256.hexdigest(e))+"\n") [o,e,s] end def git(argv) o,e,s=Open3.capture3('git','-C',ROOT,argv,binmode:true);raise e unless s.success?;o end def tree rows=Dir.glob(ROOT+'/audit/**/',File::FNM_DOTMATCH).select{|p|File.file?(p)}.sort.map{|p|[p.delete_prefix(ROOT+'/'),File.stat(p).mode&0777,File.size(p),Digest::SHA256.file(p).hexdigest]} {files:rows.length,bytes:rows.sum{|x|x[2]},sha256:Digest::SHA256.hexdigest(JSON.generate(rows))} end helper=ROOT+'/audit/2026-10-13-audit-cargo-packaging/replay.nu' specs='2026-10-09-kadek-slice-traversal','reproduce.nu',['Cargo.toml',['2026-10-12-bao-proof-research','verify.nu',['probe/Cargo.toml','primary-probe/Cargo.toml']],['2026-10-12-bao-bounded-proof','verify.nu',['fixture-probe/Cargo.toml','nostd/Cargo.toml','nostd-parent/Cargo.toml','seals/Cargo.toml']]] stages=[] specs.each_with_index do |(name,entry,paths),i| root=ROOT+'/audit/'+name;code='use '+helper.to_json+' stage; stage '+[root,entry].map(&:to_json).join(' ')+' '+paths.to_json+' | to json' o,e,s=run('stage-'+i.to_s,'nu','-c',code);raise e unless s.success?;stage=JSON.parse(o);copy=stage['capsule'] tracked=git('ls-tree','-r','--name-only',BASE,'--','audit/'+name).lines.map(&:strip) actual=Dir.glob(copy+'/**/',File::FNM_DOTMATCH).select{|p|File.file?(p)}.map{|p|p.delete_prefix(copy+'/')}.sort raise 'stage path set mismatch' unless actual==tracked.map{|p|p.delete_prefix('audit/'+name+'/')}.sort tracked.each{|p|raise 'staged bytes differ '+p unless File.binread(copy+'/'+p.delete_prefix('audit/'+name+'/'))==git('show',BASE+':'+p)} stages<<stage.merge('capsule_name'=>name,'files_equal'=>tracked.length) if i==0 [['db1d62e2cd1e4b2f309fa19bcc158bd29b44753d','parent'],['590e69ea0eebcea4c21320a88eed214dc5459de1','implementation']].each do |rev,arm| target=OUT+'/export-'+arm;code='source '+(copy+'/'+entry).to_json+'; prepare-crate '+[ROOT,rev,target,copy].map(&:to_json).join(' ') o,e,s=run('prepare-'+arm,'nu','-c',code);raise e unless s.success? {'Cargo.toml'=>'Cargo.toml','Cargo.lock'=>'Cargo.lock','src/main.rs'=>'probe.rs'}.each{|p,q|raise 'copy mismatch' unless File.binread(target+'/'+p)==git('show',BASE+':audit/'+name+'/'+q)} git('ls-tree','-r','--name-only',rev,'--','cyber-bao').lines.map(&:strip).each do |p| expected=git('show',rev+':'+p);expected=expected.sub('path = "../../hemera/rs"','version = "=0.3.1"') if p=='cyber-bao/Cargo.toml';raise 'export mismatch' unless File.binread(target+'/'+p)==expected end end end FileUtils.rm_rf(stage['directory']) end failures=[] %w[missing collision].each do |kind| base=OUT+'/'+kind;root=base+'/audit/2026-10-12-bao-proof-research';h=base+'/audit/2026-10-13-audit-cargo-packaging';FileUtils.mkdir_p([root+'/probe',root+'/primary-probe',h]) FileUtils.cp(helper,h+'/replay.nu');FileUtils.cp(ROOT+'/audit/2026-10-12-bao-proof-research/verify.nu',root+'/verify.nu') %w[probe primary-probe].each{|p|FileUtils.cp(ROOT+'/audit/2026-10-12-bao-proof-research/'+p+'/Cargo.toml.txt',root+'/'+p+'/Cargo.toml.txt')} marker=base+'/historical-ran';File.write(root+'/verify.original.nu.txt','"ran" | save '+marker.to_json+"\nexit 77\n") kind=='missing' ? FileUtils.rm(root+'/probe/Cargo.toml.txt') : File.write(root+'/probe/Cargo.toml','collision') before=tree;o,e,s=run('failure-'+kind,'nu',root+'/verify.nu','--repo',ROOT,'--siblings','/Users/master/cyber');after=tree raise 'failure leaked' if s.success?||File.exist?(marker)||before!=after raise 'wrong failure' unless kind=='missing' ? e.include?('Cargo.toml.txt') : e.include?('Logical Cargo path already exists') failures<<{case:kind,status:s.exitstatus,before:before,after:after,historical_invoked:false} end
Exact wrapper option forwarding measured with a temporary child argument recorder.
cli=[]
specs.each_with_index do |(name,entry,paths),i|
base=OUT+'/cli-'+i.to_s;root=base+'/audit/'+name;h=base+'/audit/2026-10-13-audit-cargo-packaging';FileUtils.mkdir_p([root,h]);FileUtils.cp(helper,h+'/replay.nu');FileUtils.cp(ROOT+'/audit/'+name+'/'+entry,root+'/'+entry)
paths.each{|p|FileUtils.mkdir_p(File.dirname(root+'/'+p));FileUtils.cp(ROOT+'/audit/'+name+'/'+p+'.txt',root+'/'+p+'.txt')}
script=if i==0;'def main [--implementation-revision: string, --radio-repo: path, --hemera-repo: path, --fetch, --full-workspace] { {implementation: $implementation_revision, radio: $radio_repo, hemera: $hemera_repo, fetch: $fetch, full: $full_workspace} | to json }';elsif i==1;'def main [--repo: string, --siblings: string, --live] { {repo: $repo, siblings: $siblings, live: $live} | to json }';else;'def main [--repo: string, --live] { {repo: $repo, live: $live} | to json }';end
File.write(root+'/'+entry.sub('.nu','.original.nu.txt'),script)
argv=['nu',root+'/'+entry];argv+=['--implementation-revision','literal-revision','--fetch','--full-workspace'] if i==0
o,e,s=run('cli-'+i.to_s,*argv);raise e unless s.success?;value=JSON.parse(o)
expected=i==0 ? {implementation:'literal-revision',radio:File.expand_path('/cyber/radio'),hemera:File.expand_path('/cyber/hemera'),fetch:true,full:true} : i==1 ? {repo:base,siblings:OUT,live:false} : {repo:base,live:false}
raise 'default CLI mismatch' unless value==JSON.parse(JSON.generate(expected))
cli<<value
end
File.write(OUT+'/results.json',JSON.pretty_generate(stages:stages,failures:failures,default_cli:cli)+"\n")
puts JSON.generate(status:'pass',original_capsules:stages.map{|x|[x['capsule_name'],x['files_equal']]},original_prepare_calls:2,deliberate_failures:failures.length,audit_tree_unchanged:true,default_cli_cases:cli.length)
===== 035 END audit/2026-10-13-audit-cargo-packaging/execution/staging-tests-v2.rb =====
===== 036 BEGIN audit/2026-10-13-audit-cargo-packaging/execution/child-exit-v1.rb | 1319 bytes | SHA256 76b62594c68978eab961f5aedc7d5df3f83b91e21b08bed10349428420f2ee63 ===== require 'fileutils'; require 'json'; require 'open3'; require 'digest' base='/tmp/radio-audit-packaging-child-exit-v1'; raise 'exists' if File.exist?(base) FileUtils.cp_r('/tmp/radio-audit-packaging-staging-tests-v2/cli-2',base) p=base+'/audit/2026-10-12-bao-bounded-proof' File.write(p+'/verify.original.nu.txt',"def main [--repo: string, --live] { print --no-newline 'stdout-no-newline'; print --stderr --no-newline 'stderr-no-newline'; exit 77 }\n") av=['nu',p+'/verify.nu','--repo','/Users/master/cyber/radio-bao-bounded-proof','--live'] o,e,s=Open3.capture3(*av,binmode:true) File.binwrite(base+'/stdout',o);File.binwrite(base+'/stderr',e) raise 'stdout altered' unless o=='stdout-no-newline' raise 'status masked' unless s.exitstatus==77 m=/\Astderr-no-newlineFailed historical replay retained at (/tmp/radio-audit-replay.[^\n]+)\n\z/.match(e); raise e unless m raise 'failure stage missing' unless File.file?(m[1]+'/capsule/verify.nu') File.write(base+'/result.json',JSON.pretty_generate(argv:av,status:s.exitstatus,stdout_sha256:Digest::SHA256.hexdigest(o),stderr_sha256:Digest::SHA256.hexdigest(e),retained:m[1],scope:'Exact child streams, status77, retained directory; no added stream newline before explicit helper notice.')+"\n") puts JSON.generate(status:'pass',child_status:s.exitstatus,retained:m[1])
===== 036 END audit/2026-10-13-audit-cargo-packaging/execution/child-exit-v1.rb =====
===== 037 BEGIN audit/2026-10-13-audit-cargo-packaging/execution/pair-v3.rb | 10288 bytes | SHA256 d1c2b15bec7b24c5cc90dda14b01de9ddb3f2fe40a72f9326b77105e518487c0 ===== require 'json' require 'digest' require 'fileutils' require 'open3' require 'time' require 'timeout' ROOT='/Users/master/cyber/radio-bao-bounded-proof' BASE='ce0fb312faa8770e80efe9afa864106ae6b51552' HEMERA='d5f0a09539360934fb32db9b2e15a91995607db6' OUT='/tmp/radio-audit-packaging-pair-v3' AUDIT='audit/2026-10-13-audit-cargo-packaging' READER='/Users/master/cyber/kadek-bao-range-publication/audit/2026-10-13-bao-range-research/reader-control' TC='/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin' EXTERNAL='/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml' raise 'output exists' if File.exist?(OUT) FileUtils.mkdir_p(OUT) def sha(s) Digest::SHA256.hexdigest(s) end def ident(p) b=File.binread(p); {path:p,bytes:b.bytesize,sha256:sha(b)} end def save(p,v) File.binwrite(p,JSON.pretty_generate(v)+"\n") end def run(name,argv,env={},cwd:ROOT,ok:true) start=Time.now.utc.iso8601(6) o,e,s=Open3.capture3(env,*argv,chdir:cwd) p=File.join(OUT,name); FileUtils.mkdir_p(File.dirname(p)) File.binwrite(p+'.stdout',o); File.binwrite(p+'.stderr',e) r={started:start,finished:Time.now.utc.iso8601(6),cwd:cwd,argv:argv,env:env,exit_code:s.exitstatus,stdout:ident(p+'.stdout'),stderr:ident(p+'.stderr')} save(p+'.json',r) raise "#{name} failed: #{s.exitstatus}: #{e}" if ok && !s.success? [o,e,r] end def git(*args,env:{},input:nil) o,e,s=Open3.capture3(env,'git',args,stdin_data:input||'',chdir:ROOT) raise "git failed #{args.inspect}: #{e}" unless s.success? o end run('source-acquire',['git','clone','--bare','--shared',ROOT,OUT+'/source.git']) repo=OUT+'/source.git'; url='file://'+repo renames=JSON.parse(File.read(ROOT+'/'+AUDIT+'/inputs/renames.json')) entries=['audit/2026-10-09-kadek-slice-traversal/reproduce.nu','audit/2026-10-12-bao-proof-research/verify.nu','audit/2026-10-12-bao-bounded-proof/verify.nu'] allowed=renames.flat_map{|r| [r['logical'],r['archived']]}+entries.flat_map{|p| [p,p.sub(/.nu$/,'.original.nu.txt')]} ['.claude/tasks/audit-cargo-packaging',AUDIT].each{|d| allowed.concat(Dir.glob(ROOT+'/'+d+'/**/',File::FNM_DOTMATCH).select{|p|File.file?(p)}.map{|p|p.delete_prefix(ROOT+'/')})} allowed=allowed.uniq.sort actual=git('status','--porcelain=v1','--untracked-files=all','-z').split("\0").map{|x|x[3..]}.sort raise 'unexpected dirty paths' unless actual==allowed idx={'GIT_INDEX_FILE'=>OUT+'/candidate.index'} git('--git-dir',repo,'read-tree',BASE,env:idx) rows=allowed.map do |p| f=ROOT+'/'+p if File.exist?(f) b=File.binread(f); oid=git('--git-dir',repo,'hash-object','-w','--stdin',input:b).strip mode=File.executable?(f) ? '100755':'100644' git('--git-dir',repo,'update-index','--add','--cacheinfo',mode,oid,p,env:idx) {path:p,mode:mode,blob:oid,bytes:b.bytesize,sha256:sha(b)} else git('--git-dir',repo,'update-index','--index-info',env:idx,input:"0 #{'0'40}\t#{p}\n") {path:p,deleted:true} end end tree=git('--git-dir',repo,'write-tree',env:idx).strip who={'GIT_AUTHOR_NAME'=>'Local audit witness','GIT_AUTHOR_EMAIL'=>'audit@localhost','GIT_COMMITTER_NAME'=>'Local audit witness','GIT_COMMITTER_EMAIL'=>'audit@localhost'} candidate=git('--git-dir',repo,'commit-tree',tree,'-p',BASE,env:who,input:"Local packaging witness only; not an origin release input\n").strip git('--git-dir',repo,'update-ref','refs/heads/packaging-witness',candidate) diff=git('--git-dir',repo,'diff-tree','--no-commit-id','--name-only','-r',BASE,candidate).lines.map(&:strip).sort raise 'complete tree diff differs from explicit allowlist' unless diff==allowed normal=git('--git-dir',repo,'ls-tree','-r',BASE).lines.reject{|l| p=l.split("\t",2)[1].strip; p.start_with?('audit/','.claude/tasks/')} candidate_normal=git('--git-dir',repo,'ls-tree','-r',candidate).lines.reject{|l| p=l.split("\t",2)[1].strip; p.start_with?('audit/','.claude/tasks/')} raise 'normal sources changed' unless normal==candidate_normal archived=git('--git-dir',repo,'ls-tree','-r','--name-only',candidate,'audit').lines.map(&:strip).select{|p|File.basename(p)=='Cargo.toml'} raise "archive manifest escaped #{archived}" unless archived.empty? save(OUT+'/snapshot.json',{parent:BASE,candidate:candidate,tree:tree,url:url,explicit_paths:rows,changed_paths:diff,unchanged_normal_paths:normal.length,archive_manifest_count:archived.length,scope:'Independent local committed witness; real index and branch untouched.'}) FileUtils.mkdir_p(OUT+'/frozen') FileUtils.cp(READER+'/reader_probe.rs',OUT+'/frozen/reader_probe.rs') FileUtils.cp_r(READER+'/literal',OUT+'/frozen/literal') frozen=Dir.glob(OUT+'/frozen/**/').select{|p|File.file?(p)}.sort.map{|p|ident(p)} save(OUT+'/frozen-inputs.json',frozen) raise 'reader identity mismatch' unless ident(OUT+'/frozen/reader_probe.rs')[:sha256]=='c591a5f63d2a8079ed757fbcdf4a00d9f4b281f2ffe0abff657ebf7731058b15' run('hemera-acquire',['git','clone','--bare','--shared','/tmp/kadek-bao-reader-cargo-home/git/db/hemera-63696198fb70e01e',OUT+'/hemera.git']) git('--git-dir',OUT+'/hemera.git','update-ref','refs/heads/pinned',HEMERA) File.write(OUT+'/gitconfig',"[url "file://#{OUT}/hemera.git"]\n\tinsteadOf = https://github.com/cyberia-to/hemera\n") tools={}; %w[cargo rustc rustdoc].each{|n|tools[n]={identity:ident(TC+'/'+n),version:run('tool-'+n,[TC+'/'+n,'-Vv'])[0]}} save(OUT+'/tools.json',tools) external=[]; arms=[] [['parent',BASE],['candidate',candidate]].each do |label,rev| external<<ident(EXTERNAL).merge(point:label+'-before',captured:Time.now.utc.iso8601(6)) arm=OUT+'/'+label; FileUtils.mkdir_p(arm+'/cargo-home') File.write(arm+'/cargo-home/config.toml',"[net]\ngit-fetch-with-cli = true\n[source.crates-io]\nreplace-with = "cached-registry"\n[source.cached-registry]\ndirectory = "/tmp/kadek-bao-anchor-registry"\n") FileUtils.mkdir_p(arm+'/consumer') File.write(arm+'/consumer/Cargo.toml',"[package]\nname = "kadek-bao-reader-control"\nversion = "0.0.0"\nedition = "2024"\npublish = false\n[workspace]\nbin\nname = "reader-control"\npath = "#{OUT}/frozen/reader_probe.rs"\n[dependencies]\ncyber-bao = { git = "#{url}", rev = "#{rev}", default-features = false }\n") env={'CARGO_HOME'=>arm+'/cargo-home','CARGO_TARGET_DIR'=>arm+'/target','CARGO_BUILD_JOBS'=>'2','CARGO_INCREMENTAL'=>'0','RUSTC'=>TC+'/rustc','RUSTDOC'=>TC+'/rustdoc','RUSTFLAGS'=>'-Dwarnings','GIT_CONFIG_GLOBAL'=>OUT+'/gitconfig','GIT_CONFIG_NOSYSTEM'=>'1','GIT_ALLOW_PROTOCOL'=>'file','CARGO_HTTP_TIMEOUT'=>'15','CARGO_NET_RETRY'=>'0'} cargo=[TC+'/cargo']; manifest=['--manifest-path',arm+'/consumer/Cargo.toml'] run(label+'/lock',cargo+['generate-lockfile']+manifest,env) metadata=JSON.parse(run(label+'/metadata',cargo+['metadata']+manifest+['--locked','--offline','--format-version','1'],env)[0]) package=metadata['packages'].find{|p|p['name']=='cyber-bao'} raise 'wrong selected package/revision' unless package['source']=="git+#{url}?rev=#{rev}##{rev}" && package['manifest_path'].start_with?(arm+'/cargo-home/git/checkouts/') && package['manifest_path'].end_with?('/cyber-bao/Cargo.toml') raise 'unexpected dependency closure' unless metadata['packages'].map{|p|p['name']}.sort==%w[cyber-bao cyber-hemera kadek-bao-reader-control] raise 'features unexpectedly enabled' unless metadata['resolve']['nodes'].all?{|p|p['features']==[]} src=metadata['packages'].reject{|p|p['name']=='kadek-bao-reader-control'}.flat_map do |p| r=File.dirname(p['manifest_path']); rev2=p['name']=='cyber-bao' ? BASE : HEMERA source_repo=p['name']=='cyber-bao' ? repo : OUT+'/hemera.git' prefix=p['name']=='cyber-bao' ? 'cyber-bao/' : 'rs/' files=git('--git-dir',source_repo,'ls-tree','-r','--name-only',rev2,'--',prefix).lines.map(&:strip).reject{|x| x.start_with?(prefix+'target/')} files.map do |q| f=r+'/'+q.delete_prefix(prefix); b=File.binread(f); expected=git('--git-dir',source_repo,'show',rev2+':'+q) raise "source bytes mismatch #{q}" unless b==expected.b ident(f).merge(package:p['name'],relative:q) end end stable=(src.map{|x|x[:path]}+[arm+'/consumer/Cargo.toml',arm+'/consumer/Cargo.lock',arm+'/cargo-home/config.toml']+frozen.map{|x|x[:path]}+tools.values.map{|x|x[:identity][:path]}).sort before=stable.map{|p|ident(p)}; save(arm+'/before.json',before) run(label+'/debug',cargo+['run']+manifest+['--locked','--offline','--bin','reader-control','--',OUT+'/frozen/literal'],env) run(label+'/release',cargo+['run']+manifest+['--locked','--offline','--release','--bin','reader-control','--',OUT+'/frozen/literal'],env) after=stable.map{|p|ident(p)}; save(arm+'/after.json',after); raise 'arm inputs changed' unless before==after warnings=%w[lock metadata debug release].to_h{|n|[n,File.read(arm+'/'+n+'.stderr').lines.select{|l|l.start_with?('warning:')} ]} if label=='parent' raise 'parent did not reproduce duplicate warning' unless warnings.values.all?{|w|w.any?{|l|l.include?('skipping duplicate package')}} else raise "candidate warnings #{warnings.inspect}" unless warnings.values.flatten.empty? end save(arm+'/sources.json',src) arms<<{label:label,revision:rev,source_count:src.length,stable_inputs:stable.length,warnings:warnings,source_manifest:package['manifest_path']} puts "#{label} reader control passed; warnings=#{warnings.values.map(&:length).sum}"; STDOUT.flush end external<<ident(EXTERNAL).merge(point:'candidate-after',captured:Time.now.utc.iso8601(6)); save(OUT+'/external-manifest.json',external) raise 'external warning witness changed' unless external.map{|x|x.values_at(:path,:bytes,:sha256)}.uniq.length==1 stdout=arms.flat_map{|a|%w[debug release].map{|p|File.binread(OUT+'/'+a[:label]+'/'+p+'.stdout')}} stdout<<File.binread('/tmp/kadek-bao-reader-debug-v1.stdout') raise 'literal reader result changed' unless stdout.uniq.length==1 source_tuples=arms.map{|a|JSON.parse(File.read(OUT+'/'+a[:label]+'/sources.json')).map{|x|x.values_at('package','relative','bytes','sha256')}} raise 'production source tuples differ' unless source_tuples.uniq.length==1 save(OUT+'/results.json',{status:'pass',snapshot:candidate,arms:arms,external_stable:true,stdout_sha256:sha(stdout.first),source_tuples_equal:source_tuples.first.length,scope:'Only eight-case consumer commands; metadata normalization checked separately.'}) puts JSON.generate({status:'pass',snapshot:candidate,source_files:source_tuples.first.length,reader_stdout_sha256:sha(stdout.first)})
===== 037 END audit/2026-10-13-audit-cargo-packaging/execution/pair-v3.rb =====
===== 038 BEGIN audit/2026-10-13-audit-cargo-packaging/execution/metadata-v1.rb | 3114 bytes | SHA256 5709a5fa44890fe124f97847c6327955a9428abae288219d7e67d94ab4bec894 ===== require 'json';require 'digest' r='/tmp/radio-audit-packaging-pair-v3' snapshot=JSON.parse(File.read(r+'/snapshot.json'));normalized=[];reports=[] %w[parent candidate].each do |arm| rev=arm=='parent' ? snapshot['parent'] : snapshot['candidate'];url=snapshot['url'];dir=r+'/'+arm data=JSON.parse(File.binread(dir+'/metadata.stdout'));bao=data['packages'].find{|p|p['name']=='cyber-bao'};hemera=data['packages'].find{|p|p['name']=='cyber-hemera'};consumer=data['packages'].find{|p|p['name']=='kadek-bao-reader-control'} expect_source="git+#{url}?rev=#{rev}##{rev}";expect_id="git+#{url}?rev=#{rev}#cyber-bao@0.1.0";expect_consumer='path+file://'+dir+'/consumer#kadek-bao-reader-control@0.0.0' raise 'source pin mismatch' unless bao['source']==expect_source && bao['id']==expect_id && consumer['id']==expect_consumer exact={expect_source=>'RADIO-SOURCE',expect_id=>'RADIO-ID',"git+#{url}?rev=#{rev}"=>'RADIO-DEPENDENCY',expect_consumer=>'CONSUMER-ID'} paths={File.dirname(bao['manifest_path'])=>'RADIO-CHECKOUT/cyber-bao',File.dirname(hemera['manifest_path'])=>'HEMERA-CHECKOUT/rs',dir+'/consumer'=>'CONSUMER',dir+'/target'=>'TARGET'} raise 'wrong bao checkout' unless paths.keys[0].start_with?(dir+'/cargo-home/git/checkouts/') && paths.keys[0].end_with?('/'+rev[0,7]+'/cyber-bao') raise 'wrong hemera checkout' unless paths.keys[1].start_with?(dir+'/cargo-home/git/checkouts/') && paths.keys[1].end_with?('/d5f0a09/rs') substitutions=[] walk=->(v,pointer,key) do case v when Hash;v.to_h{|k,x|[k,walk.call(x,pointer+'/'+k,k)]} when Array;v.each_with_index.map{|x,i|walk.call(x,pointer+'/'+i.to_s,key)} when String if exact.key?(v) raise 'unexpected ID position' unless %w[id source dependencies pkg workspace_members workspace_default_members root].include?(key) z=exact.fetch(v);substitutions<<{pointer:pointer,old:v,new:z,kind:'exact-identifier'};z elsif %w[manifest_path src_path target_directory build_directory workspace_root].include?(key) matches=paths.select{|old,_|v==old||v.start_with?(old+'/')} raise 'ambiguous prefix' if matches.length>1 if matches.length==1 old,new=matches.first;z=new+v.delete_prefix(old);substitutions<<{pointer:pointer,old:v,new:z,kind:'validated-path-boundary'};z else raise 'unexpected unnormalized path' unless key=='src_path' && v==r+'/frozen/reader_probe.rs' v end else;v end else;v end end norm=walk.call(data,'',nil);normalized<<norm;reports<<{arm:arm,exact_map:exact,path_prefix_map:paths,substitutions:substitutions} File.write(r+'/'+arm+'/metadata-normalized.json',JSON.pretty_generate(norm)+"\n") end raise 'metadata differs outside explicit allowlist' unless normalized[0]==normalized[1] File.write(r+'/metadata-comparison.json',JSON.pretty_generate(status:'pass',scope:'Parsed JSON only; exact identifiers and path-boundary substitutions. All other values and array order equal.',arms:reports,normalized_sha256:Digest::SHA256.hexdigest(JSON.generate(normalized[0])))+"\n") puts JSON.generate(status:'pass',packages:3,resolve_nodes:3,substitutions:reports.map{|x|x[:substitutions].length})
===== 038 END audit/2026-10-13-audit-cargo-packaging/execution/metadata-v1.rb =====
===== 039 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/frozen/reader_probe.rs | 9574 bytes | SHA256 c591a5f63d2a8079ed757fbcdf4a00d9f4b281f2ffe0abff657ebf7731058b15 ===== //! Literal consumer of the committed strict reader: no hash/encoder/traversal oracle. use std::{fs, iter::FusedIterator, ops::Range, path::Path};
use cyber_bao::{ BlockSize, proof::{ProofItem, ProofVerifier, VerifiedProof}, };
#[derive(Clone, Copy)]
enum Event {
Parent,
Leaf {
proof: usize,
file: u64,
bytes: usize,
},
}
struct Case {
name: &'static str,
directory: &'static str,
proof_file: &'static str,
root: &'static str,
size: u64,
log: u8,
request: Range
===== 039 END audit/2026-10-13-audit-cargo-packaging/pair/frozen/reader_probe.rs =====
===== 040 BEGIN audit/2026-10-13-audit-cargo-packaging/controls/staging-v2/results.json | 1961 bytes | SHA256 b43ea385f101466313a219b85c507307c8293f5cf37a906be8cb7b65830cfa2e ===== { "stages": [ { "directory": "/tmp/radio-audit-replay.jFiR42", "capsule": "/tmp/radio-audit-replay.jFiR42/capsule", "capsule_name": "2026-10-09-kadek-slice-traversal", "files_equal": 13 }, { "directory": "/tmp/radio-audit-replay.pdHBFA", "capsule": "/tmp/radio-audit-replay.pdHBFA/capsule", "capsule_name": "2026-10-12-bao-proof-research", "files_equal": 90 }, { "directory": "/tmp/radio-audit-replay.snGjzx", "capsule": "/tmp/radio-audit-replay.snGjzx/capsule", "capsule_name": "2026-10-12-bao-bounded-proof", "files_equal": 620 } ], "failures": [ { "case": "missing", "status": 1, "before": { "files": 1259, "bytes": 56517912, "sha256": "7616f6164644df4f36432fdf81fd437a67ebcf9d79def72472be0677e302e8bb" }, "after": { "files": 1259, "bytes": 56517912, "sha256": "7616f6164644df4f36432fdf81fd437a67ebcf9d79def72472be0677e302e8bb" }, "historical_invoked": false }, { "case": "collision", "status": 1, "before": { "files": 1259, "bytes": 56517912, "sha256": "7616f6164644df4f36432fdf81fd437a67ebcf9d79def72472be0677e302e8bb" }, "after": { "files": 1259, "bytes": 56517912, "sha256": "7616f6164644df4f36432fdf81fd437a67ebcf9d79def72472be0677e302e8bb" }, "historical_invoked": false } ], "default_cli": [ { "implementation": "literal-revision", "radio": "/Users/master/cyber/radio", "hemera": "/Users/master/cyber/hemera", "fetch": true, "full": true }, { "repo": "/tmp/radio-audit-packaging-staging-tests-v2/cli-1", "siblings": "/tmp/radio-audit-packaging-staging-tests-v2", "live": false }, { "repo": "/tmp/radio-audit-packaging-staging-tests-v2/cli-2", "live": false } ] }
===== 040 END audit/2026-10-13-audit-cargo-packaging/controls/staging-v2/results.json =====
===== 041 BEGIN audit/2026-10-13-audit-cargo-packaging/controls/child-exit-v1/result.json | 559 bytes | SHA256 255d8f904c3569600c89a94658c4b9f18b3b804eec3b0776c1ae5254b2fb4c94 ===== { "argv": [ "nu", "/tmp/radio-audit-packaging-child-exit-v1/audit/2026-10-12-bao-bounded-proof/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof", "--live" ], "status": 77, "stdout_sha256": "68962ba002f01ca8e6cb99c902d0b1717698df866ef144a4d51cc8292583defb", "stderr_sha256": "0e1c5f283ebf77e94b747b6b4ec20e947c9e3112591ffc9a1ad02980051e2e5e", "retained": "/tmp/radio-audit-replay.F2s4TY", "scope": "Exact child streams, status77, retained directory; no added stream newline before explicit helper notice." }
===== 041 END audit/2026-10-13-audit-cargo-packaging/controls/child-exit-v1/result.json =====
===== 042 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/snapshot.json | 74032 bytes | SHA256 3dcc049831099401f6d7e77bf8748529f7dc9dd8ee5f958c48d4600c5c3a2bad ===== { "parent": "ce0fb312faa8770e80efe9afa864106ae6b51552", "candidate": "e22c5b472a0979ad382d241b9706de5b82fed9a9", "tree": "ac8fe6203580ac4135723126eb68ad32f7ecb33b", "url": "file:///tmp/radio-audit-packaging-pair-v3/source.git", "explicit_paths": [ { "path": ".claude/tasks/audit-cargo-packaging/execution.md", "mode": "100644", "blob": "32bbcbb061317d1e66fd5ef8162d8ae2ce74ff41", "bytes": 1416, "sha256": "faabc22a749c11e183f3bc63aea1d04e18f3dfc95a9d942f2f0b9c840befe72a" }, { "path": ".claude/tasks/audit-cargo-packaging/plan.md", "mode": "100644", "blob": "3c991c837c171368f206f8793dbcbca2da5f778a", "bytes": 11425, "sha256": "86d9ede9c35d7650a1093e0438d35c6a93f8a60d0b69d148dafa431c7976f620" }, { "path": ".claude/tasks/audit-cargo-packaging/research.md", "mode": "100644", "blob": "cfd096aa74d166753a6234b1a5a9269acdffaeef", "bytes": 5509, "sha256": "f93288d7ff45295f0d89dbb70bfd346706d3180be6d837938c1654cd58789c7b" }, { "path": ".claude/tasks/audit-cargo-packaging/response-v1.md", "mode": "100644", "blob": "cd352f1f60b6e24e3e0d5eb14aff5099a1d70809", "bytes": 2722, "sha256": "d832af26441f2a76493b54cb1f901cabf4fc49e311fb3f859c7e089041afd1fc" }, { "path": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "mode": "100644", "blob": "4d1c5cd6535b401778401041fd0efaa524a870ca", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "path": "audit/2026-10-09-kadek-slice-traversal/reproduce.nu", "mode": "100644", "blob": "795aa4023a337aeb455562da82c5ad537aa235b9", "bytes": 916, "sha256": "794bbec41c38771fe666ebc40d5b8bbe8cf844632000654289fcc5ed65c7533e" }, { "path": "audit/2026-10-09-kadek-slice-traversal/reproduce.original.nu.txt", "mode": "100644", "blob": "31585cbaf9aa815cef0fbbdfc434d721d5387df1", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "mode": "100644", "blob": "a6a0ac066c2b42fca01f4470e06920dfc5fda804", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "mode": "100644", "blob": "085a827f3df192f9acda9fd945b602bf82141930", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "mode": "100644", "blob": "3029e4216aeac2d746afd71a26c531eff5a60c28", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "mode": "100644", "blob": "35e6fe4630633080ee9b00f5cd8d24fe3c0093c5", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "path": "audit/2026-10-12-bao-bounded-proof/verify.nu", "mode": "100644", "blob": "a56fb2a514cf034c1aead6c4b962968c3aa3ca6c", "bytes": 628, "sha256": "ad4154daeb25c641ccd571905edf4870899e160f7b7d4e0cb3fe6231684f54d2" }, { "path": "audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt", "mode": "100644", "blob": "ca3f0a1b554a46cbca7c31b692cb20201c3de279", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "mode": "100644", "blob": "fc72a33f07ca11352c4a0308e4ca17e23ba5a8d3", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "deleted": true }, { "path": "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "mode": "100644", "blob": "beeb272e00bc24f0c15ce96e3f01e2a942cdfa22", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "path": "audit/2026-10-12-bao-proof-research/verify.nu", "mode": "100644", "blob": "cccae561695d385568a3e5bebdd4d6aed63ee2ae", "bytes": 719, "sha256": "fd64cf8a7aed61ce88c336497c05f805a885c9ef3325ea38f09f0ed1cffcc30f" }, { "path": "audit/2026-10-12-bao-proof-research/verify.original.nu.txt", "mode": "100644", "blob": "2405d5ba053a3afb95c0e16593ea30897fd5b90c", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/historical-ce0-reader-after-runs.json", "mode": "100644", "blob": "5ff290c66138e625510a7cd39962d9d3e5b3ba2a", "bytes": 32027, "sha256": "5451033572e43aef4c467b61963a41a79250f81025846f51779fb47900ac6bd1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/historical-ce0-reader-before-runs.json", "mode": "100644", "blob": "6be715018591b1e53f949355ad5f21d876827639", "bytes": 32027, "sha256": "fc853a924b7ded1effe7f1d839fb6bc908999e395abc297d2b9e1b9d2904e8f1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/historical-index-bindings.json", "mode": "100644", "blob": "58c9787c97b2bb3d2b46db55dbc9c8533d4ff46c", "bytes": 9834, "sha256": "4a2b126ec58f132f3591038887b7e2378bf47840eb995d2cc04389fd4919ce94" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/observation.json", "mode": "100644", "blob": "592b0aa9106ef7482738a7cae39ef5ada2b04f95", "bytes": 704, "sha256": "fcc5784b19fef093b12276568b3e392f2930504183a2b9bf4276610c878c330c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/prepare-child-code.nu.txt", "mode": "100644", "blob": "ea5fe817b76028f7f1db5e0c955a034dd5522e07", "bytes": 666, "sha256": "a32f6f23ba0ac47ac73dee6d04a0cc6c4fdb54bf7095a970ee41813b1d8fb3b4" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/prepare-measurement.json", "mode": "100644", "blob": "4815d6c8446130e159a2ced2b333cd53998f71a8", "bytes": 2782, "sha256": "28daa5cdb02010d3613da34cf92a0740daf8b8b90b64fc4db966c8f76e5de0c9" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/registry-radio.txt", "mode": "100644", "blob": "79d3b7844ba32c144522c1a44d23b8c9d5dff829", "bytes": 149, "sha256": "c8981791a8d1a7860703afece8f14943f7e2f2629d297415392fa15db72db984" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/registry.json", "mode": "100644", "blob": "66dca08e5423d419c9d76ae5840fe495f3f25dac", "bytes": 364, "sha256": "161c57e4dc5a81ae3a20256aa6643826214dfb358bb23db46dcdd5f12c0a617c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/renames.json", "mode": "100644", "blob": "cfd513d344bece417f2560c35752bc0f086a18ee", "bytes": 3469, "sha256": "887a035861b42d9ebb70b1ca495283cda2dfa1da614bd5aafb276a8fc892bfbb" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/source.json", "mode": "100644", "blob": "ddf83924c5f0932dc33de5f3d73d7d741f062cd2", "bytes": 5180, "sha256": "23a3f57a847fcfbdb6d43b1bbcd1bb79f6fd04662b2c0ec3ae4060723e57f85a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inputs/v2-additional-source.json", "mode": "100644", "blob": "b843160ecc5e8f526826821799275c0259114e1a", "bytes": 1703, "sha256": "855cc9a34bac26628a31790d826acd30370bd2fe7a4d899300874bef1ecd7c93" }, { "path": "audit/2026-10-13-audit-cargo-packaging/inventory.rb", "mode": "100644", "blob": "7db217039a25e1cb3fb73339df63427fb5b56722", "bytes": 2751, "sha256": "8689fb2fa53870627d00ffb4aa8c76561c83ea8a59865c2343078e18d8e7c5fd" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/Cargo.lock", "mode": "100644", "blob": "b43a31e515e5cf92be0c2205eca23ffb348fd86d", "bytes": 15956, "sha256": "470c17ba895e574e71aa98211febdf29853ec6b80f205ce301e36cb5777603c8" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "mode": "100644", "blob": "4d1c5cd6535b401778401041fd0efaa524a870ca", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/FIXTURE-SHA256SUMS", "mode": "100644", "blob": "ad2a0193dada9cabb7c16af48011fa98e154fa45", "bytes": 275, "sha256": "ddd0192c1e67305c760278ff3d8e782d9738e6f3c605810940375944e6545823" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/SOURCE-FREEZE.json", "mode": "100644", "blob": "b621c5d5348adf1e7217036b60239df3961de235", "bytes": 1038, "sha256": "5726e6ece1488a7635a6d0a3d32444e8858437ca1aec943b5da5cb3bb03c3065" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/expected-probe.stdout", "mode": "100644", "blob": "8ad5cb666c5a070c868a44b9c7d514d6c0e5f870", "bytes": 1106, "sha256": "b282ba959f50ebabe9249cf9215631ff55d09f71052b56b68fd9809e70b071cb" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/probe.rs", "mode": "100644", "blob": "adfb121382733693a3ae0091f35215f88b2c1a63", "bytes": 5265, "sha256": "f9d267e16e9cdd4aab64b5d13cddd3f59415c0b0cee15ec4e134e05ff8e91927" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/reproduce.nu", "mode": "100644", "blob": "31585cbaf9aa815cef0fbbdfc434d721d5387df1", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/code-input/verify.nu", "mode": "100644", "blob": "c32192bf0501babe16a2a4a9b8df152bd90f732a", "bytes": 2833, "sha256": "20cb9d43e1e178a7a150f239d6da949a3d60937c94aa8929582ff0ff73cf3587" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/files.json", "mode": "100644", "blob": "13c5d110975647b73831810c11a0c4b9b09bcbec", "bytes": 98759, "sha256": "543ae474daaf3628c322ab5993340a1a211be17cf3fdc5e5be33bb6f8cf4d102" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "mode": "100644", "blob": "a6a0ac066c2b42fca01f4470e06920dfc5fda804", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "mode": "100644", "blob": "085a827f3df192f9acda9fd945b602bf82141930", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "mode": "100644", "blob": "3029e4216aeac2d746afd71a26c531eff5a60c28", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "mode": "100644", "blob": "35e6fe4630633080ee9b00f5cd8d24fe3c0093c5", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/verify.nu", "mode": "100644", "blob": "ca3f0a1b554a46cbca7c31b692cb20201c3de279", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/files.json", "mode": "100644", "blob": "e4cced8ebd7ced3cf19db65bd38ac2b5ed474ce9", "bytes": 13350, "sha256": "1773cdccfac8d4c95cc86659aabf22f218de8e33c07235c63d7aeb2da60e1a94" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "mode": "100644", "blob": "fc72a33f07ca11352c4a0308e4ca17e23ba5a8d3", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "mode": "100644", "blob": "beeb272e00bc24f0c15ce96e3f01e2a942cdfa22", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/verify.nu", "mode": "100644", "blob": "2405d5ba053a3afb95c0e16593ea30897fd5b90c", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/Cargo.lock", "mode": "100644", "blob": "6109397327ed10573758d9e1aa4c6d22ee98532a", "bytes": 186712, "sha256": "90d5aa88f4fb507434036ad5ec0ca7a3897741fe810fdf16a080bff006130d65" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/Cargo.toml.txt", "mode": "100644", "blob": "256cddb6f22fef290df3536dd2eb1ede2f1f6035", "bytes": 2085, "sha256": "3f8d71aa50c829445d66c981166e22f9b64fbd1f91bdddf4ecb422cf4ebd39f2" }, { "path": "audit/2026-10-13-audit-cargo-packaging/original/cyber-bao/Cargo.toml.txt", "mode": "100644", "blob": "d7980bede3f5e0d38f267ef889e8d183b8ee6de2", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/context.txt", "mode": "100644", "blob": "6638b27ecf01f54a79b773970252b5aba3ea3f0a", "bytes": 223056, "sha256": "364132b75dbb5c251ea507ea8b71a7baff6c896a888e3a743ea317affa070d58" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/files.json", "mode": "100644", "blob": "72e2a4b290fc7e742a8fd17e5e94dfa4b3381995", "bytes": 8467, "sha256": "99bdaae8dd3da0cb4bab5ca1b4b65b2d011ddcf5b2b54c0291fa112174b5af62" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/001.txt", "mode": "100644", "blob": "cfd096aa74d166753a6234b1a5a9269acdffaeef", "bytes": 5509, "sha256": "f93288d7ff45295f0d89dbb70bfd346706d3180be6d837938c1654cd58789c7b" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/002.txt", "mode": "100644", "blob": "3c991c837c171368f206f8793dbcbca2da5f778a", "bytes": 11425, "sha256": "86d9ede9c35d7650a1093e0438d35c6a93f8a60d0b69d148dafa431c7976f620" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/003.txt", "mode": "100644", "blob": "cd352f1f60b6e24e3e0d5eb14aff5099a1d70809", "bytes": 2722, "sha256": "d832af26441f2a76493b54cb1f901cabf4fc49e311fb3f859c7e089041afd1fc" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/004.txt", "mode": "100644", "blob": "4d1c5cd6535b401778401041fd0efaa524a870ca", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/005.txt", "mode": "100644", "blob": "a6a0ac066c2b42fca01f4470e06920dfc5fda804", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/006.txt", "mode": "100644", "blob": "085a827f3df192f9acda9fd945b602bf82141930", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/007.txt", "mode": "100644", "blob": "3029e4216aeac2d746afd71a26c531eff5a60c28", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/008.txt", "mode": "100644", "blob": "35e6fe4630633080ee9b00f5cd8d24fe3c0093c5", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/009.txt", "mode": "100644", "blob": "fc72a33f07ca11352c4a0308e4ca17e23ba5a8d3", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/010.txt", "mode": "100644", "blob": "beeb272e00bc24f0c15ce96e3f01e2a942cdfa22", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/011.txt", "mode": "100644", "blob": "31585cbaf9aa815cef0fbbdfc434d721d5387df1", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/012.txt", "mode": "100644", "blob": "2405d5ba053a3afb95c0e16593ea30897fd5b90c", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/013.txt", "mode": "100644", "blob": "ca3f0a1b554a46cbca7c31b692cb20201c3de279", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/014.txt", "mode": "100644", "blob": "c32192bf0501babe16a2a4a9b8df152bd90f732a", "bytes": 2833, "sha256": "20cb9d43e1e178a7a150f239d6da949a3d60937c94aa8929582ff0ff73cf3587" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/015.txt", "mode": "100644", "blob": "256cddb6f22fef290df3536dd2eb1ede2f1f6035", "bytes": 2085, "sha256": "3f8d71aa50c829445d66c981166e22f9b64fbd1f91bdddf4ecb422cf4ebd39f2" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/016.txt", "mode": "100644", "blob": "d7980bede3f5e0d38f267ef889e8d183b8ee6de2", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/017.txt", "mode": "100644", "blob": "b43a31e515e5cf92be0c2205eca23ffb348fd86d", "bytes": 15956, "sha256": "470c17ba895e574e71aa98211febdf29853ec6b80f205ce301e36cb5777603c8" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/018.txt", "mode": "100644", "blob": "adfb121382733693a3ae0091f35215f88b2c1a63", "bytes": 5265, "sha256": "f9d267e16e9cdd4aab64b5d13cddd3f59415c0b0cee15ec4e134e05ff8e91927" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/019.txt", "mode": "100644", "blob": "b621c5d5348adf1e7217036b60239df3961de235", "bytes": 1038, "sha256": "5726e6ece1488a7635a6d0a3d32444e8858437ca1aec943b5da5cb3bb03c3065" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/020.txt", "mode": "100644", "blob": "ad2a0193dada9cabb7c16af48011fa98e154fa45", "bytes": 275, "sha256": "ddd0192c1e67305c760278ff3d8e782d9738e6f3c605810940375944e6545823" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/021.txt", "mode": "100644", "blob": "8ad5cb666c5a070c868a44b9c7d514d6c0e5f870", "bytes": 1106, "sha256": "b282ba959f50ebabe9249cf9215631ff55d09f71052b56b68fd9809e70b071cb" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/022.txt", "mode": "100644", "blob": "c7edc9fff2baf277d2f796df3a9fc85dbf90d69b", "bytes": 1048, "sha256": "f169adb8124d3b005416d8485d00777c9a7bdd9099982c52a4493f9732e6d050" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/023.txt", "mode": "100644", "blob": "885ed2846ee03e243cbdd6769336769fbfb4be7e", "bytes": 10831, "sha256": "903131e2786f073a942fbf8fae122d9e576e4dad758c6da7f9f2ba58fd8611ab" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/024.txt", "mode": "100644", "blob": "0b1f60fec599bdcd49d9454edac1b0960d1a2930", "bytes": 425, "sha256": "cd473d3bfc4802a305204d101e7802974526392dafdb74391ca690cf4c954562" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/025.txt", "mode": "100644", "blob": "d5dcdc4bec0bb6aaa4a5c204c6147e1c7eae04bf", "bytes": 858, "sha256": "1d4e7da4914f54110878d8260170cb42e154560c99dd9026d6cdacbbff79cbc0" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/026.txt", "mode": "100644", "blob": "ddf83924c5f0932dc33de5f3d73d7d741f062cd2", "bytes": 5180, "sha256": "23a3f57a847fcfbdb6d43b1bbcd1bb79f6fd04662b2c0ec3ae4060723e57f85a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/027.txt", "mode": "100644", "blob": "cfd513d344bece417f2560c35752bc0f086a18ee", "bytes": 3469, "sha256": "887a035861b42d9ebb70b1ca495283cda2dfa1da614bd5aafb276a8fc892bfbb" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/028.txt", "mode": "100644", "blob": "592b0aa9106ef7482738a7cae39ef5ada2b04f95", "bytes": 704, "sha256": "fcc5784b19fef093b12276568b3e392f2930504183a2b9bf4276610c878c330c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/029.txt", "mode": "100644", "blob": "6be715018591b1e53f949355ad5f21d876827639", "bytes": 32027, "sha256": "fc853a924b7ded1effe7f1d839fb6bc908999e395abc297d2b9e1b9d2904e8f1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/030.txt", "mode": "100644", "blob": "5ff290c66138e625510a7cd39962d9d3e5b3ba2a", "bytes": 32027, "sha256": "5451033572e43aef4c467b61963a41a79250f81025846f51779fb47900ac6bd1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/031.txt", "mode": "100644", "blob": "66dca08e5423d419c9d76ae5840fe495f3f25dac", "bytes": 364, "sha256": "161c57e4dc5a81ae3a20256aa6643826214dfb358bb23db46dcdd5f12c0a617c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/032.txt", "mode": "100644", "blob": "b843160ecc5e8f526826821799275c0259114e1a", "bytes": 1703, "sha256": "855cc9a34bac26628a31790d826acd30370bd2fe7a4d899300874bef1ecd7c93" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/033.txt", "mode": "100644", "blob": "58c9787c97b2bb3d2b46db55dbc9c8533d4ff46c", "bytes": 9834, "sha256": "4a2b126ec58f132f3591038887b7e2378bf47840eb995d2cc04389fd4919ce94" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/034.txt", "mode": "100644", "blob": "4815d6c8446130e159a2ced2b333cd53998f71a8", "bytes": 2782, "sha256": "28daa5cdb02010d3613da34cf92a0740daf8b8b90b64fc4db966c8f76e5de0c9" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/035.txt", "mode": "100644", "blob": "79d3b7844ba32c144522c1a44d23b8c9d5dff829", "bytes": 149, "sha256": "c8981791a8d1a7860703afece8f14943f7e2f2629d297415392fa15db72db984" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/036.txt", "mode": "100644", "blob": "85f79b1543c87eb24eb367580323154b5af2edb5", "bytes": 1231, "sha256": "7bae398813416deb30860425fe81910f88543a6c432d3ed3d1ca021f2962931a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/037.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/038.txt", "mode": "100644", "blob": "241cd78364eec83d73fd1d16bf4715e55283d942", "bytes": 382, "sha256": "69528359025d2f3b1a3c01b1467936af11a4548419aea2b7098d793df03a7173" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/039.txt", "mode": "100644", "blob": "68e686dcf8bc2ce651c8771e1a2ece83b716994c", "bytes": 1255, "sha256": "65d4733ac8f24c1398e19d1cd0b24bb9f7bdac4e58d87b8389f32676a1738b3f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/040.txt", "mode": "100644", "blob": "d17a5082bd10b338fe21c3c6a51f9d301753d689", "bytes": 11661, "sha256": "d3c9306e6f1834a5a984c9f5c2e7147f9e5f65076614d912d6985bd0f62ad92e" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/041.txt", "mode": "100644", "blob": "db8627445f9e5c6fb7fa9df1a63e4d4bd39e542a", "bytes": 316, "sha256": "fdedc38caebc5e2d3485e65da74d909408c324ff325a015b8cc1315e5d5e8f6c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/042.txt", "mode": "100644", "blob": "33131638ecd9e7d464e15314be17a392186a9007", "bytes": 870, "sha256": "997212d2bfa8aa7f3c939d661d7a9c709d14dde2fba451317d02383cecca2c07" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/043.txt", "mode": "100644", "blob": "b67cf06efe930b7a78ec1c29aa60019867aaacae", "bytes": 267, "sha256": "d9a4f1b0acf77a8beac40a1c3e01d258b50265d5e59c37dae14e8970873e8640" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/044.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/045.txt", "mode": "100644", "blob": "768317fe10e0df4bea74a3dbf734899d81f16a9c", "bytes": 818, "sha256": "d06549ac9223df84d22e4e8c25f7b8372b8e8e173a264c96437feb4390172c4a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/046.txt", "mode": "100644", "blob": "5a46722fbf427d93485ffcc90b0f7e9ac1f29c07", "bytes": 496, "sha256": "756a8291737f092cbbe7b4c17a411b9bc21c89afbbb12dc5681fc6f17ab43059" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/047.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/048.txt", "mode": "100644", "blob": "93cae9c2034210f2257d4c05e7a933e457e1a71c", "bytes": 1411, "sha256": "f6f82cad75670edffdb046e4b01b1c934b7ad7f4fba740ab1dd7cf437f3ebb6f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/049.txt", "mode": "100644", "blob": "9eb0045f832b95f86200669f43949983de01112b", "bytes": 72, "sha256": "22c3676876af3c07a6921ad725e6f8d4781c4087e79eefed29825a2dd77fe31c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/050.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/051.txt", "mode": "100644", "blob": "f44d7ec28cf4809e47f5ee8f06ac11ed93f811d1", "bytes": 8924, "sha256": "4f9bbdf74f2b8a94ac410c4a097415a63d5e17173499ac11475025ad405630c1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/052.txt", "mode": "100644", "blob": "dcb912a060bcf7a397ed1835c6b4cb60c627bce1", "bytes": 1223, "sha256": "b76f9e1bf74867d0ee9bd508a9273d1ad33fbfa2de6c6b24548fdbc85a99946f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/053.txt", "mode": "100644", "blob": "277dc704bcd630ae7c45ef644737b0affd0f350b", "bytes": 240, "sha256": "0e36b4447e9cdbf6c2a1787a2e32bd66d0e4d6c6bb755cfe43782ed0bea4cf6b" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/054.txt", "mode": "100644", "blob": "ea5fe817b76028f7f1db5e0c955a034dd5522e07", "bytes": 666, "sha256": "a32f6f23ba0ac47ac73dee6d04a0cc6c4fdb54bf7095a970ee41813b1d8fb3b4" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/055.txt", "mode": "100644", "blob": "6d3faa3ba801313f0f830ac0808b104d7a095996", "bytes": 872, "sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/056.txt", "mode": "100644", "blob": "144accbd61c11185c9c139041fc4119fe904e527", "bytes": 1499, "sha256": "39f471e0454a6275130141a3dd823bdb45120b609b665c7be9cf595ad0479ca3" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/manifest.json", "mode": "100644", "blob": "0c8bc3f3d243d4e217331e9045dbb63c0668ba3d", "bytes": 37274, "sha256": "bc7e3192a232cb0000e8a5df16f5bf29dfe17ee395aaf7d1f783e3e1157845f7" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/previous-review-raw.json", "mode": "100644", "blob": "2638fc723e94dbd3aa40f01bc67135e12c7ccf06", "bytes": 10983, "sha256": "c253af5655b79f1fbdfa4fae0cd4baf6cd2ae42d741b63e178be6aa496bd3b94" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/source-identities.json", "mode": "100644", "blob": "ced14490cc33a01fcdd1035bb72dcaa5d2b866d6", "bytes": 6880, "sha256": "3286a4205aa9d311ed2f3009eb673733d9cf6b2a2d4c12973933a892235afb7e" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/verify.nu", "mode": "100644", "blob": "e2c89dbab83b88306434a63707e2452df27b9dbc", "bytes": 7883, "sha256": "36a69e0a8ac19edcfcff856def7f9e4b2759eecb8653a744d8e1208b7b2bf697" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/context.txt", "mode": "100644", "blob": "d6d31db1f41e219006a5f1079db9aa3da13ca4db", "bytes": 161217, "sha256": "6a686de7be0829a0aec37baaf33cf4f40b12ca5b919a39786399c9bcff616869" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/files.json", "mode": "100644", "blob": "379ecb567f43ba45b87752fccaab30ce8bcf7433", "bytes": 6099, "sha256": "53a4e981eb62b0e8f720a9ecde4e8188d439fe2b3c68375b0bccdd8f533fcc2a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/001.txt", "mode": "100644", "blob": "93ea189f9447987dcc545199d57e1704e706603a", "bytes": 4343, "sha256": "f6d8324b791bca2d30875be3221cafa927ce983478344d167acc8f50dc8dc313" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/002.txt", "mode": "100644", "blob": "e9ab8db82bd6f4cf873be718ff2d39e6f5cd839a", "bytes": 7574, "sha256": "1314b721a7cb24ad42b5d95c163a8b59c4d19c57aec753380bcd6233ec2a1f71" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/003.txt", "mode": "100644", "blob": "4d1c5cd6535b401778401041fd0efaa524a870ca", "bytes": 454, "sha256": "209a572a11fa9eebac43f8d4f20d98630a30c18b4d191667aac6c1143d300605" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/004.txt", "mode": "100644", "blob": "a6a0ac066c2b42fca01f4470e06920dfc5fda804", "bytes": 375, "sha256": "981f1301d8eeb4bebe1ca398763edd631e349fac8c472a0c4a8fd948aba03570" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/005.txt", "mode": "100644", "blob": "085a827f3df192f9acda9fd945b602bf82141930", "bytes": 246, "sha256": "80c90d0fc41d73464e1822e41732716a77f265356163c631468d2d1ebf22ef36" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/006.txt", "mode": "100644", "blob": "3029e4216aeac2d746afd71a26c531eff5a60c28", "bytes": 222, "sha256": "06a48e732670b8e220fb3cb342271372bc1ca5bba75f77278dd7c2f83fa43b0d" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/007.txt", "mode": "100644", "blob": "35e6fe4630633080ee9b00f5cd8d24fe3c0093c5", "bytes": 250, "sha256": "c7e24e2b1b47380009cd84b67820df749ae27a457a71b2a16f7f62db39ef258f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/008.txt", "mode": "100644", "blob": "fc72a33f07ca11352c4a0308e4ca17e23ba5a8d3", "bytes": 377, "sha256": "eb9de62bfb997f05ffd0c06ef0069e1708d6ff24d5ca277fc25f3c6beef894fd" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/009.txt", "mode": "100644", "blob": "beeb272e00bc24f0c15ce96e3f01e2a942cdfa22", "bytes": 217, "sha256": "26df88edd220a39b6d5c7964a5dc8767acd2712349ed27b28904cf0e2bc0c038" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/010.txt", "mode": "100644", "blob": "31585cbaf9aa815cef0fbbdfc434d721d5387df1", "bytes": 11037, "sha256": "2429703bbea959fa84bbb6ee650f377bb8c93163009941fbddbfa055ca5a5e50" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/011.txt", "mode": "100644", "blob": "2405d5ba053a3afb95c0e16593ea30897fd5b90c", "bytes": 4241, "sha256": "70ccf93dd5c30e9fd1eea057190655f886b6919b1365fb481f60e8bc433e6f78" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/012.txt", "mode": "100644", "blob": "ca3f0a1b554a46cbca7c31b692cb20201c3de279", "bytes": 10975, "sha256": "dd3c97295aac25f832c4b39c1a8f654e478212cefa790ecd29e6285ac63ae63a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/013.txt", "mode": "100644", "blob": "c32192bf0501babe16a2a4a9b8df152bd90f732a", "bytes": 2833, "sha256": "20cb9d43e1e178a7a150f239d6da949a3d60937c94aa8929582ff0ff73cf3587" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/014.txt", "mode": "100644", "blob": "256cddb6f22fef290df3536dd2eb1ede2f1f6035", "bytes": 2085, "sha256": "3f8d71aa50c829445d66c981166e22f9b64fbd1f91bdddf4ecb422cf4ebd39f2" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/015.txt", "mode": "100644", "blob": "d7980bede3f5e0d38f267ef889e8d183b8ee6de2", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/016.txt", "mode": "100644", "blob": "c7edc9fff2baf277d2f796df3a9fc85dbf90d69b", "bytes": 1048, "sha256": "f169adb8124d3b005416d8485d00777c9a7bdd9099982c52a4493f9732e6d050" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/017.txt", "mode": "100644", "blob": "885ed2846ee03e243cbdd6769336769fbfb4be7e", "bytes": 10831, "sha256": "903131e2786f073a942fbf8fae122d9e576e4dad758c6da7f9f2ba58fd8611ab" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/018.txt", "mode": "100644", "blob": "0b1f60fec599bdcd49d9454edac1b0960d1a2930", "bytes": 425, "sha256": "cd473d3bfc4802a305204d101e7802974526392dafdb74391ca690cf4c954562" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/019.txt", "mode": "100644", "blob": "d5dcdc4bec0bb6aaa4a5c204c6147e1c7eae04bf", "bytes": 858, "sha256": "1d4e7da4914f54110878d8260170cb42e154560c99dd9026d6cdacbbff79cbc0" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/020.txt", "mode": "100644", "blob": "ddf83924c5f0932dc33de5f3d73d7d741f062cd2", "bytes": 5180, "sha256": "23a3f57a847fcfbdb6d43b1bbcd1bb79f6fd04662b2c0ec3ae4060723e57f85a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/021.txt", "mode": "100644", "blob": "cfd513d344bece417f2560c35752bc0f086a18ee", "bytes": 3469, "sha256": "887a035861b42d9ebb70b1ca495283cda2dfa1da614bd5aafb276a8fc892bfbb" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/022.txt", "mode": "100644", "blob": "592b0aa9106ef7482738a7cae39ef5ada2b04f95", "bytes": 704, "sha256": "fcc5784b19fef093b12276568b3e392f2930504183a2b9bf4276610c878c330c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/023.txt", "mode": "100644", "blob": "6be715018591b1e53f949355ad5f21d876827639", "bytes": 32027, "sha256": "fc853a924b7ded1effe7f1d839fb6bc908999e395abc297d2b9e1b9d2904e8f1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/024.txt", "mode": "100644", "blob": "5ff290c66138e625510a7cd39962d9d3e5b3ba2a", "bytes": 32027, "sha256": "5451033572e43aef4c467b61963a41a79250f81025846f51779fb47900ac6bd1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/025.txt", "mode": "100644", "blob": "66dca08e5423d419c9d76ae5840fe495f3f25dac", "bytes": 364, "sha256": "161c57e4dc5a81ae3a20256aa6643826214dfb358bb23db46dcdd5f12c0a617c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/026.txt", "mode": "100644", "blob": "79d3b7844ba32c144522c1a44d23b8c9d5dff829", "bytes": 149, "sha256": "c8981791a8d1a7860703afece8f14943f7e2f2629d297415392fa15db72db984" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/027.txt", "mode": "100644", "blob": "85f79b1543c87eb24eb367580323154b5af2edb5", "bytes": 1231, "sha256": "7bae398813416deb30860425fe81910f88543a6c432d3ed3d1ca021f2962931a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/028.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/029.txt", "mode": "100644", "blob": "241cd78364eec83d73fd1d16bf4715e55283d942", "bytes": 382, "sha256": "69528359025d2f3b1a3c01b1467936af11a4548419aea2b7098d793df03a7173" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/030.txt", "mode": "100644", "blob": "68e686dcf8bc2ce651c8771e1a2ece83b716994c", "bytes": 1255, "sha256": "65d4733ac8f24c1398e19d1cd0b24bb9f7bdac4e58d87b8389f32676a1738b3f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/031.txt", "mode": "100644", "blob": "d17a5082bd10b338fe21c3c6a51f9d301753d689", "bytes": 11661, "sha256": "d3c9306e6f1834a5a984c9f5c2e7147f9e5f65076614d912d6985bd0f62ad92e" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/032.txt", "mode": "100644", "blob": "db8627445f9e5c6fb7fa9df1a63e4d4bd39e542a", "bytes": 316, "sha256": "fdedc38caebc5e2d3485e65da74d909408c324ff325a015b8cc1315e5d5e8f6c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/033.txt", "mode": "100644", "blob": "33131638ecd9e7d464e15314be17a392186a9007", "bytes": 870, "sha256": "997212d2bfa8aa7f3c939d661d7a9c709d14dde2fba451317d02383cecca2c07" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/034.txt", "mode": "100644", "blob": "b67cf06efe930b7a78ec1c29aa60019867aaacae", "bytes": 267, "sha256": "d9a4f1b0acf77a8beac40a1c3e01d258b50265d5e59c37dae14e8970873e8640" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/035.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/036.txt", "mode": "100644", "blob": "768317fe10e0df4bea74a3dbf734899d81f16a9c", "bytes": 818, "sha256": "d06549ac9223df84d22e4e8c25f7b8372b8e8e173a264c96437feb4390172c4a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/037.txt", "mode": "100644", "blob": "5a46722fbf427d93485ffcc90b0f7e9ac1f29c07", "bytes": 496, "sha256": "756a8291737f092cbbe7b4c17a411b9bc21c89afbbb12dc5681fc6f17ab43059" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/038.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/039.txt", "mode": "100644", "blob": "6d3faa3ba801313f0f830ac0808b104d7a095996", "bytes": 872, "sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/040.txt", "mode": "100644", "blob": "0fc954fc6ed1d74607e41ad8096d9196f20a037c", "bytes": 1374, "sha256": "d86062e753ba6fca94573eff8ad11d05e1d9cf99fec52e673d54717f1064c52b" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/manifest.json", "mode": "100644", "blob": "2c7138389c79cfe9f15514843096b899d2c19645", "bytes": 26623, "sha256": "d1a3bb112f3049cb9b67960640011d9f3d68b9ba7753dbb2e06a6fced8c17b2d" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/source-identities.json", "mode": "100644", "blob": "ddf83924c5f0932dc33de5f3d73d7d741f062cd2", "bytes": 5180, "sha256": "23a3f57a847fcfbdb6d43b1bbcd1bb79f6fd04662b2c0ec3ae4060723e57f85a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-input/verify.nu", "mode": "100644", "blob": "fc3e7e2b9e9ce3e7ee0d0b96149789f44f346ddb", "bytes": 5198, "sha256": "f05df7ffc78e84905079547ed581d2bcbeb90da1a1a6cc63e870fb5622a2a1b4" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-pack-v2.rb", "mode": "100644", "blob": "a6e385bcfbb951e89f089e24be2f726361c70658", "bytes": 5389, "sha256": "422f7d82c1ddf7a4ebbde214e072de29d4e33bc2b7973dc83af2bfb3db72ce8a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/plan-pack.rb", "mode": "100644", "blob": "99be5cf8d63b6f4367d2e46b04f06a62f2d2c100", "bytes": 4583, "sha256": "bb1c3f19fd08e5eda0d49f823061ab42f899bd41f70f91f6f5997649ebf6cddd" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/capture.rb", "mode": "100644", "blob": "6d3faa3ba801313f0f830ac0808b104d7a095996", "bytes": 872, "sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.json", "mode": "100644", "blob": "4161dba2e4c5e651069c49b9e56d3f516c784d66", "bytes": 1397, "sha256": "ab10fb7c19f08c03ff4e5d4f03ef9f328a0b12351fe7a34bd2309998399cb1b8" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.stderr", "mode": "100644", "blob": "6d30f4e28f8cc054308e781198ef0b52cd06fb93", "bytes": 888, "sha256": "cc41d04be3ee732368d8a6b1d7e7cf026bdd545d1c0d515d4509c54a0df1ecc3" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.stdout", "mode": "100644", "blob": "d6f28acc2a85cc9669ffaa58e930a7d8ef01ca16", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.json", "mode": "100644", "blob": "85f79b1543c87eb24eb367580323154b5af2edb5", "bytes": 1231, "sha256": "7bae398813416deb30860425fe81910f88543a6c432d3ed3d1ca021f2962931a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.stderr", "mode": "100644", "blob": "241cd78364eec83d73fd1d16bf4715e55283d942", "bytes": 382, "sha256": "69528359025d2f3b1a3c01b1467936af11a4548419aea2b7098d793df03a7173" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.stdout", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.json", "mode": "100644", "blob": "68e686dcf8bc2ce651c8771e1a2ece83b716994c", "bytes": 1255, "sha256": "65d4733ac8f24c1398e19d1cd0b24bb9f7bdac4e58d87b8389f32676a1738b3f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.stderr", "mode": "100644", "blob": "db8627445f9e5c6fb7fa9df1a63e4d4bd39e542a", "bytes": 316, "sha256": "fdedc38caebc5e2d3485e65da74d909408c324ff325a015b8cc1315e5d5e8f6c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.stdout", "mode": "100644", "blob": "d17a5082bd10b338fe21c3c6a51f9d301753d689", "bytes": 11661, "sha256": "d3c9306e6f1834a5a984c9f5c2e7147f9e5f65076614d912d6985bd0f62ad92e" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.json", "mode": "100644", "blob": "95a93f6094467317ff76106eda3b78acddb24b4b", "bytes": 1418, "sha256": "a4f83cad9fbd0fe05b5a2298025a48ab5b00345481d563d00a90e33e1700ed23" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.stderr", "mode": "100644", "blob": "a7c43a7fd8257c191cebb1bd9b8a746029a853a9", "bytes": 880, "sha256": "cfed4936eb359ec52d37bfcae564e43a485a5547751c841b94b42e4380c5a36c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.stdout", "mode": "100644", "blob": "d6f28acc2a85cc9669ffaa58e930a7d8ef01ca16", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.json", "mode": "100644", "blob": "93cae9c2034210f2257d4c05e7a933e457e1a71c", "bytes": 1411, "sha256": "f6f82cad75670edffdb046e4b01b1c934b7ad7f4fba740ab1dd7cf437f3ebb6f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.stderr", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.stdout", "mode": "100644", "blob": "9eb0045f832b95f86200669f43949983de01112b", "bytes": 72, "sha256": "22c3676876af3c07a6921ad725e6f8d4781c4087e79eefed29825a2dd77fe31c" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.json", "mode": "100644", "blob": "290d4ee5abb57606482836c8ccd0131db4cc6ce9", "bytes": 896, "sha256": "2cee21d3aaaa26ac5cf27b2789b92d60a99f6dc2ecf17f70ba717b55e8e1165e" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.stderr", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.stdout", "mode": "100644", "blob": "28955b0a1e19072004546475834e30ce1b6d2af5", "bytes": 428, "sha256": "cca14b47f51c945ada6cc9d18013bfacad8aa8c146aac5431b7b3f537654c061" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.json", "mode": "100644", "blob": "65252988584736aaf777d525662ffa46d5c1486b", "bytes": 896, "sha256": "5291f50bdb00569cc123232ff83952b9a6f950937dbbb0e3207c17c79f5bcbaf" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.stderr", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.stdout", "mode": "100644", "blob": "1be1b81c3f4c370f1a2f360a0684a36c13e4bda0", "bytes": 362, "sha256": "75e7ef849be52b5f6ed47761ad0a486dfa49e4717745ab9cafd78e43f4872370" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/proof-before.json", "mode": "100644", "blob": "768317fe10e0df4bea74a3dbf734899d81f16a9c", "bytes": 818, "sha256": "d06549ac9223df84d22e4e8c25f7b8372b8e8e173a264c96437feb4390172c4a" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/proof-before.stderr", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/proof-before.stdout", "mode": "100644", "blob": "5a46722fbf427d93485ffcc90b0f7e9ac1f29c07", "bytes": 496, "sha256": "756a8291737f092cbbe7b4c17a411b9bc21c89afbbb12dc5681fc6f17ab43059" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/research-before.json", "mode": "100644", "blob": "33131638ecd9e7d464e15314be17a392186a9007", "bytes": 870, "sha256": "997212d2bfa8aa7f3c939d661d7a9c709d14dde2fba451317d02383cecca2c07" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/research-before.stderr", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/records/research-before.stdout", "mode": "100644", "blob": "b67cf06efe930b7a78ec1c29aa60019867aaacae", "bytes": 267, "sha256": "d9a4f1b0acf77a8beac40a1c3e01d258b50265d5e59c37dae14e8970873e8640" }, { "path": "audit/2026-10-13-audit-cargo-packaging/replay.nu", "mode": "100644", "blob": "fd666f6d39fee23308cbb6214662a52c30c27d7d", "bytes": 1795, "sha256": "a8f26e4ce221fa18ddd99eb622015e6327e8df2f480386c747ab163619f3b151" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/completion.json", "mode": "100644", "blob": "277dc704bcd630ae7c45ef644737b0affd0f350b", "bytes": 240, "sha256": "0e36b4447e9cdbf6c2a1787a2e32bd66d0e4d6c6bb755cfe43782ed0bea4cf6b" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/invocation.json", "mode": "100644", "blob": "dcb912a060bcf7a397ed1835c6b4cb60c627bce1", "bytes": 1223, "sha256": "b76f9e1bf74867d0ee9bd508a9273d1ad33fbfa2de6c6b24548fdbc85a99946f" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/launcher.rb", "mode": "100644", "blob": "2619fe55e82d53efec69c4affa26b6c6dec56983", "bytes": 1736, "sha256": "a60044a087e3b792a9a4c0413bb5eed258ae6ac7201c1c3a752a81306a608fa3" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/result.md", "mode": "100644", "blob": "f44d7ec28cf4809e47f5ee8f06ac11ed93f811d1", "bytes": 8924, "sha256": "4f9bbdf74f2b8a94ac410c4a097415a63d5e17173499ac11475025ad405630c1" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/stderr.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/stdout.json", "mode": "100644", "blob": "2638fc723e94dbd3aa40f01bc67135e12c7ccf06", "bytes": 10983, "sha256": "c253af5655b79f1fbdfa4fae0cd4baf6cd2ae42d741b63e178be6aa496bd3b94" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/completion.json", "mode": "100644", "blob": "16eed545d554daf464ef364157d8606725303f89", "bytes": 240, "sha256": "e4bc2332413f64460b78b29577a23c9aa7019ae7f37197279e44b2a7c7228bd0" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/invocation.json", "mode": "100644", "blob": "7f5742e64d44d5d3d01ba10eb9bbec6bfbac3c83", "bytes": 1223, "sha256": "84ed4a38c954d7a0ed6155c823090d978ae1e3a88544f5bd4e4d8f47c81683b3" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/launcher.rb", "mode": "100644", "blob": "2619fe55e82d53efec69c4affa26b6c6dec56983", "bytes": 1736, "sha256": "a60044a087e3b792a9a4c0413bb5eed258ae6ac7201c1c3a752a81306a608fa3" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/result.md", "mode": "100644", "blob": "6299f4bf57800dccde93bc3f686cec39c3374aa8", "bytes": 8517, "sha256": "9397ff948d59b5736c6fce0322913a71dd4aea3b7364934f9a30eeb767205544" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stderr.txt", "mode": "100644", "blob": "e69de29bb2d1d6434b8b29ae775ad8c2e48c5391", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, { "path": "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stdout.json", "mode": "100644", "blob": "ddd54d575f85285fd5e40d412a4730f0f41fa8b3", "bytes": 10552, "sha256": "27a51f83e0ea67a2fbd7951f8bf83a2572ea4fe859a95d99a33d90f233a7dec4" }, { "path": "audit/2026-10-13-audit-cargo-packaging/v2-evidence.rb", "mode": "100644", "blob": "0ea01a909aaf2e52686c60023be044afb71714d9", "bytes": 5041, "sha256": "a9107bd1e7fedb6ea24286f653a5ba4134de85f835ca7f36c8a099d0a682acb3" } ], "changed_paths": [ ".claude/tasks/audit-cargo-packaging/execution.md", ".claude/tasks/audit-cargo-packaging/plan.md", ".claude/tasks/audit-cargo-packaging/research.md", ".claude/tasks/audit-cargo-packaging/response-v1.md", "audit/2026-10-09-kadek-slice-traversal/Cargo.toml", "audit/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "audit/2026-10-09-kadek-slice-traversal/reproduce.nu", "audit/2026-10-09-kadek-slice-traversal/reproduce.original.nu.txt", "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml", "audit/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml", "audit/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml", "audit/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml", "audit/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "audit/2026-10-12-bao-bounded-proof/verify.nu", "audit/2026-10-12-bao-bounded-proof/verify.original.nu.txt", "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml", "audit/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "audit/2026-10-12-bao-proof-research/probe/Cargo.toml", "audit/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "audit/2026-10-12-bao-proof-research/verify.nu", "audit/2026-10-12-bao-proof-research/verify.original.nu.txt", "audit/2026-10-13-audit-cargo-packaging/inputs/historical-ce0-reader-after-runs.json", "audit/2026-10-13-audit-cargo-packaging/inputs/historical-ce0-reader-before-runs.json", "audit/2026-10-13-audit-cargo-packaging/inputs/historical-index-bindings.json", "audit/2026-10-13-audit-cargo-packaging/inputs/observation.json", "audit/2026-10-13-audit-cargo-packaging/inputs/prepare-child-code.nu.txt", "audit/2026-10-13-audit-cargo-packaging/inputs/prepare-measurement.json", "audit/2026-10-13-audit-cargo-packaging/inputs/registry-radio.txt", "audit/2026-10-13-audit-cargo-packaging/inputs/registry.json", "audit/2026-10-13-audit-cargo-packaging/inputs/renames.json", "audit/2026-10-13-audit-cargo-packaging/inputs/source.json", "audit/2026-10-13-audit-cargo-packaging/inputs/v2-additional-source.json", "audit/2026-10-13-audit-cargo-packaging/inventory.rb", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/Cargo.lock", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/FIXTURE-SHA256SUMS", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/SOURCE-FREEZE.json", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/expected-probe.stdout", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/probe.rs", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-09-kadek-slice-traversal/reproduce.nu", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/code-input/verify.nu", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/files.json", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/fixture-probe/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/nostd-parent/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/nostd/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/seals/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-bounded-proof/verify.nu", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/files.json", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/primary-probe/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/probe/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/2026-10-12-bao-proof-research/verify.nu", "audit/2026-10-13-audit-cargo-packaging/original/Cargo.lock", "audit/2026-10-13-audit-cargo-packaging/original/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/original/cyber-bao/Cargo.toml.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/context.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/files.json", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/001.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/002.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/003.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/004.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/005.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/006.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/007.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/008.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/009.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/010.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/011.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/012.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/013.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/014.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/015.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/016.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/017.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/018.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/019.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/020.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/021.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/022.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/023.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/024.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/025.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/026.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/027.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/028.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/029.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/030.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/031.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/032.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/033.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/034.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/035.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/036.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/037.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/038.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/039.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/040.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/041.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/042.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/043.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/044.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/045.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/046.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/047.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/048.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/049.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/050.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/051.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/052.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/053.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/054.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/055.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/inputs/056.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/manifest.json", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/previous-review-raw.json", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/source-identities.json", "audit/2026-10-13-audit-cargo-packaging/plan-input-v2/verify.nu", "audit/2026-10-13-audit-cargo-packaging/plan-input/context.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/files.json", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/001.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/002.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/003.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/004.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/005.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/006.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/007.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/008.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/009.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/010.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/011.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/012.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/013.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/014.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/015.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/016.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/017.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/018.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/019.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/020.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/021.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/022.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/023.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/024.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/025.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/026.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/027.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/028.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/029.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/030.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/031.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/032.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/033.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/034.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/035.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/036.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/037.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/038.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/039.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/inputs/040.txt", "audit/2026-10-13-audit-cargo-packaging/plan-input/manifest.json", "audit/2026-10-13-audit-cargo-packaging/plan-input/source-identities.json", "audit/2026-10-13-audit-cargo-packaging/plan-input/verify.nu", "audit/2026-10-13-audit-cargo-packaging/plan-pack-v2.rb", "audit/2026-10-13-audit-cargo-packaging/plan-pack.rb", "audit/2026-10-13-audit-cargo-packaging/records/capture.rb", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.json", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.stderr", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-debug.stdout", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.json", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.stderr", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-lock.stdout", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.json", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.stderr", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-metadata.stdout", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.json", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.stderr", "audit/2026-10-13-audit-cargo-packaging/records/consumer-ce0-release.stdout", "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.json", "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.stderr", "audit/2026-10-13-audit-cargo-packaging/records/original-prepare-v2.stdout", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.json", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.stderr", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification-v2.stdout", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.json", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.stderr", "audit/2026-10-13-audit-cargo-packaging/records/plan-verification.stdout", "audit/2026-10-13-audit-cargo-packaging/records/proof-before.json", "audit/2026-10-13-audit-cargo-packaging/records/proof-before.stderr", "audit/2026-10-13-audit-cargo-packaging/records/proof-before.stdout", "audit/2026-10-13-audit-cargo-packaging/records/research-before.json", "audit/2026-10-13-audit-cargo-packaging/records/research-before.stderr", "audit/2026-10-13-audit-cargo-packaging/records/research-before.stdout", "audit/2026-10-13-audit-cargo-packaging/replay.nu", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/completion.json", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/invocation.json", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/launcher.rb", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/result.md", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/stderr.txt", "audit/2026-10-13-audit-cargo-packaging/review/plan-v1/stdout.json", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/completion.json", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/invocation.json", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/launcher.rb", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/result.md", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stderr.txt", "audit/2026-10-13-audit-cargo-packaging/review/plan-v2/stdout.json", "audit/2026-10-13-audit-cargo-packaging/v2-evidence.rb" ], "unchanged_normal_paths": 4419, "archive_manifest_count": 0, "scope": "Independent local committed witness; real index and branch untouched." }
===== 042 END audit/2026-10-13-audit-cargo-packaging/pair/snapshot.json =====
===== 043 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/results.json | 1924 bytes | SHA256 574cecd2073ace5b095c9398891b9731f20b76ae7731c244cd48749aabf6d5d6 =====
{
"status": "pass",
"snapshot": "e22c5b472a0979ad382d241b9706de5b82fed9a9",
"arms": [
{
"label": "parent",
"revision": "ce0fb312faa8770e80efe9afa864106ae6b51552",
"source_count": 63,
"stable_inputs": 102,
"warnings": {
"lock": [
"warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):\n"
],
"metadata": [
"warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):\n"
],
"debug": [
"warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):\n"
],
"release": [
"warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):\n"
]
},
"source_manifest": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml"
},
{
"label": "candidate",
"revision": "e22c5b472a0979ad382d241b9706de5b82fed9a9",
"source_count": 63,
"stable_inputs": 102,
"warnings": {
"lock": [],
"metadata": [],
"debug": [],
"release": []
},
"source_manifest": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/Cargo.toml"
}
],
"external_stable": true,
"stdout_sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99",
"source_tuples_equal": 63,
"scope": "Only eight-case consumer commands; metadata normalization checked separately."
}
===== 043 END audit/2026-10-13-audit-cargo-packaging/pair/results.json =====
===== 044 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/external-manifest.json | 773 bytes | SHA256 408ccb298b6a638a76ce44053064ff0c7fc77fdd87cea890a7b03492bad89a58 ===== [ { "path": "/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365", "point": "parent-before", "captured": "2026-10-13T02:16:32.423537Z" }, { "path": "/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365", "point": "candidate-before", "captured": "2026-10-13T02:17:05.615796Z" }, { "path": "/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml", "bytes": 1078, "sha256": "95e58b3d1e130d6a579b361111e848b9aa907f66eee0e2acb7ab5449c9f9e365", "point": "candidate-after", "captured": "2026-10-13T02:17:29.275029Z" } ]
===== 044 END audit/2026-10-13-audit-cargo-packaging/pair/external-manifest.json =====
===== 045 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/metadata-comparison.json | 22547 bytes | SHA256 61b54d100b6474c69ee73eaba9c9d3012e63f61ba462b28afa1ef7f157d17f8a ===== { "status": "pass", "scope": "Parsed JSON only; exact identifiers and path-boundary substitutions. All other values and array order equal.", "arms": [ { "arm": "parent", "exact_map": { "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312faa8770e80efe9afa864106ae6b51552": "RADIO-SOURCE", "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0": "RADIO-ID", "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552": "RADIO-DEPENDENCY", "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0": "CONSUMER-ID" }, "path_prefix_map": { "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao": "RADIO-CHECKOUT/cyber-bao", "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs": "HEMERA-CHECKOUT/rs", "/tmp/radio-audit-packaging-pair-v3/parent/consumer": "CONSUMER", "/tmp/radio-audit-packaging-pair-v3/parent/target": "TARGET" }, "substitutions": [ { "pointer": "/packages/0/id", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/packages/0/source", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312faa8770e80efe9afa864106ae6b51552", "new": "RADIO-SOURCE", "kind": "exact-identifier" }, { "pointer": "/packages/0/targets/0/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/src/lib.rs", "new": "RADIO-CHECKOUT/cyber-bao/src/lib.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/1/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/group.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/group.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/2/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/group_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/group_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/3/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/4/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/5/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof_failures.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof_failures.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/6/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/range_traversal.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/range_traversal.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/7/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/range_traversal_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/range_traversal_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/8/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/root_policy.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/root_policy.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/9/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/slice_traversal.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/slice_traversal.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml", "new": "RADIO-CHECKOUT/cyber-bao/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/0/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/src/lib.rs", "new": "HEMERA-CHECKOUT/rs/src/lib.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/1/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/bench.rs", "new": "HEMERA-CHECKOUT/rs/examples/bench.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/2/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/neon_mul.rs", "new": "HEMERA-CHECKOUT/rs/examples/neon_mul.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/3/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/split.rs", "new": "HEMERA-CHECKOUT/rs/examples/split.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/4/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/constant_time.rs", "new": "HEMERA-CHECKOUT/rs/tests/constant_time.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/5/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/differential.rs", "new": "HEMERA-CHECKOUT/rs/tests/differential.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/6/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/vectors.rs", "new": "HEMERA-CHECKOUT/rs/tests/vectors.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/Cargo.toml", "new": "HEMERA-CHECKOUT/rs/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/packages/2/id", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/packages/2/dependencies/0/source", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552", "new": "RADIO-DEPENDENCY", "kind": "exact-identifier" }, { "pointer": "/packages/2/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml", "new": "CONSUMER/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/workspace_members/0", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/workspace_default_members/0", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/0/id", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/id", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/dependencies/0", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/deps/0/pkg", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/root", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/target_directory", "old": "/tmp/radio-audit-packaging-pair-v3/parent/target", "new": "TARGET", "kind": "validated-path-boundary" }, { "pointer": "/build_directory", "old": "/tmp/radio-audit-packaging-pair-v3/parent/target", "new": "TARGET", "kind": "validated-path-boundary" }, { "pointer": "/workspace_root", "old": "/tmp/radio-audit-packaging-pair-v3/parent/consumer", "new": "CONSUMER", "kind": "validated-path-boundary" } ] }, { "arm": "candidate", "exact_map": { "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#e22c5b472a0979ad382d241b9706de5b82fed9a9": "RADIO-SOURCE", "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0": "RADIO-ID", "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9": "RADIO-DEPENDENCY", "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0": "CONSUMER-ID" }, "path_prefix_map": { "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao": "RADIO-CHECKOUT/cyber-bao", "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs": "HEMERA-CHECKOUT/rs", "/tmp/radio-audit-packaging-pair-v3/candidate/consumer": "CONSUMER", "/tmp/radio-audit-packaging-pair-v3/candidate/target": "TARGET" }, "substitutions": [ { "pointer": "/packages/0/id", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/packages/0/source", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#e22c5b472a0979ad382d241b9706de5b82fed9a9", "new": "RADIO-SOURCE", "kind": "exact-identifier" }, { "pointer": "/packages/0/targets/0/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/src/lib.rs", "new": "RADIO-CHECKOUT/cyber-bao/src/lib.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/1/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/group.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/group.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/2/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/group_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/group_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/3/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/4/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/5/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof_failures.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/proof_failures.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/6/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/range_traversal.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/range_traversal.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/7/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/range_traversal_allocation.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/range_traversal_allocation.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/8/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/root_policy.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/root_policy.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/targets/9/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/slice_traversal.rs", "new": "RADIO-CHECKOUT/cyber-bao/tests/slice_traversal.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/0/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/Cargo.toml", "new": "RADIO-CHECKOUT/cyber-bao/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/0/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/src/lib.rs", "new": "HEMERA-CHECKOUT/rs/src/lib.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/1/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/bench.rs", "new": "HEMERA-CHECKOUT/rs/examples/bench.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/2/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/neon_mul.rs", "new": "HEMERA-CHECKOUT/rs/examples/neon_mul.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/3/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/split.rs", "new": "HEMERA-CHECKOUT/rs/examples/split.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/4/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/constant_time.rs", "new": "HEMERA-CHECKOUT/rs/tests/constant_time.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/5/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/differential.rs", "new": "HEMERA-CHECKOUT/rs/tests/differential.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/targets/6/src_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/vectors.rs", "new": "HEMERA-CHECKOUT/rs/tests/vectors.rs", "kind": "validated-path-boundary" }, { "pointer": "/packages/1/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/Cargo.toml", "new": "HEMERA-CHECKOUT/rs/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/packages/2/id", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/packages/2/dependencies/0/source", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9", "new": "RADIO-DEPENDENCY", "kind": "exact-identifier" }, { "pointer": "/packages/2/manifest_path", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml", "new": "CONSUMER/Cargo.toml", "kind": "validated-path-boundary" }, { "pointer": "/workspace_members/0", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/workspace_default_members/0", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/0/id", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/id", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/dependencies/0", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/nodes/2/deps/0/pkg", "old": "git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0", "new": "RADIO-ID", "kind": "exact-identifier" }, { "pointer": "/resolve/root", "old": "path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0", "new": "CONSUMER-ID", "kind": "exact-identifier" }, { "pointer": "/target_directory", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "new": "TARGET", "kind": "validated-path-boundary" }, { "pointer": "/build_directory", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "new": "TARGET", "kind": "validated-path-boundary" }, { "pointer": "/workspace_root", "old": "/tmp/radio-audit-packaging-pair-v3/candidate/consumer", "new": "CONSUMER", "kind": "validated-path-boundary" } ] } ], "normalized_sha256": "6cc33ab97bb478ab222ed92f893740e8a8f6279f35635f937f4200944e6e03cd" }
===== 045 END audit/2026-10-13-audit-cargo-packaging/pair/metadata-comparison.json =====
===== 046 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/tools.json | 1523 bytes | SHA256 ad32f03d58356f8abc0a969571b42dfc7c188668d54dc59e006bb2e800c7809c ===== { "cargo": { "identity": { "path": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "bytes": 31232696, "sha256": "c512bff73c86143b557463f021d0c3d5b0490d97d65040ba59ea2b3427784758" }, "version": "cargo 1.95.0 (f2d3ce0bd 2026-03-21)\nrelease: 1.95.0\ncommit-hash: f2d3ce0bd7f24a49f8f72d9000448f8838c4e850\ncommit-date: 2026-03-21\nhost: aarch64-apple-darwin\nlibgit2: 1.9.2 (sys:0.20.4 vendored)\nlibcurl: 8.7.1 (sys:0.4.83+curl-8.15.0 system ssl:(SecureTransport) LibreSSL/3.3.6)\nssl: OpenSSL 3.5.4 30 Sep 2025\nos: Mac OS 26.4.1 [64-bit]\n" }, "rustc": { "identity": { "path": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "bytes": 412504, "sha256": "b829b733131d4e1673eeebd1f34d06ae1e9ff4977b051313cf42e2a9e79ecf1c" }, "version": "rustc 1.95.0 (59807616e 2026-04-14)\nbinary: rustc\ncommit-hash: 59807616e1fa2540724bfbac14d7976d7e4a3860\ncommit-date: 2026-04-14\nhost: aarch64-apple-darwin\nrelease: 1.95.0\nLLVM version: 22.1.2\n" }, "rustdoc": { "identity": { "path": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "bytes": 11710264, "sha256": "59bc6a1caf617032284a2edc2aa03916396e70589c435a8b51e3957887f90ce5" }, "version": "rustdoc 1.95.0 (59807616e 2026-04-14)\nbinary: rustdoc\ncommit-hash: 59807616e1fa2540724bfbac14d7976d7e4a3860\ncommit-date: 2026-04-14\nhost: aarch64-apple-darwin\nrelease: 1.95.0\nLLVM version: 22.1.2\n" } }
===== 046 END audit/2026-10-13-audit-cargo-packaging/pair/tools.json =====
===== 047 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.json | 1382 bytes | SHA256 1b45192e4a20ce32bcc31c2f2b393bd661fbf9c41b5174b144ae70b2a7372082 ===== { "started": "2026-10-13T02:16:32.423933Z", "finished": "2026-10-13T02:16:57.592891Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "generate-lockfile", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/parent/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/lock.stdout", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/lock.stderr", "bytes": 3907, "sha256": "121497c8acb0d780d8c3930a0081c9e81524501895c242a90ab9a819ae7448c2" } }
===== 047 END audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.json =====
===== 048 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.stdout | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 048 END audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.stdout =====
===== 049 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.stderr | 3907 bytes | SHA256 121497c8acb0d780d8c3930a0081c9e81524501895c242a90ab9a819ae7448c2 =====
Updating git repository file:///tmp/radio-audit-packaging-pair-v3/source.git
From file:///tmp/radio-audit-packaging-pair-v3/source
-
[new branch] feat/bao-bounded-reducer -> origin/feat/bao-bounded-reducer
-
[new branch] feat/bao-hemera-pin -> origin/feat/bao-hemera-pin
-
[new branch] feat/bbg-content -> origin/feat/bbg-content
-
[new branch] fix/audit-cargo-packaging -> origin/fix/audit-cargo-packaging
-
[new branch] fix/bao-empty-root -> origin/fix/bao-empty-root
-
[new branch] fix/bao-empty-status -> origin/fix/bao-empty-status
-
[new branch] fix/bao-root-policy -> origin/fix/bao-root-policy
-
[new branch] fix/kadek-export-pairs -> origin/fix/kadek-export-pairs
-
[new branch] fix/kadek-memstore-pairs -> origin/fix/kadek-memstore-pairs
-
[new branch] fix/kadek-slice-traversal -> origin/fix/kadek-slice-traversal
-
[new branch] launch/100-bao-decode-size-dos -> origin/launch/100-bao-decode-size-dos
-
[new branch] launch/101-bao-slice-decode-size-dos -> origin/launch/101-bao-slice-decode-size-dos
-
[new branch] launch/176-bao-mixed-coverage -> origin/launch/176-bao-mixed-coverage
-
[new branch] launch/205-outboard-release-invariant -> origin/launch/205-outboard-release-invariant
-
[new branch] launch/21-3-claim-announce-envelope -> origin/launch/21-3-claim-announce-envelope
-
[new branch] launch/21-4-cluster-acc-envelope -> origin/launch/21-4-cluster-acc-envelope
-
[new branch] launch/21-gossip-multihop-relay -> origin/launch/21-gossip-multihop-relay
-
[new branch] launch/21-signal-envelope -> origin/launch/21-signal-envelope
-
[new branch] launch/22-blob-get-tag -> origin/launch/22-blob-get-tag
-
[new branch] launch/22-cli-lib-target -> origin/launch/22-cli-lib-target
-
[new branch] launch/22-node-persistent-store -> origin/launch/22-node-persistent-store
-
[new branch] launch/22-particle-cli-verified-streaming-tests -> origin/launch/22-particle-cli-verified-streaming-tests
-
[new branch] launch/22-particle-index -> origin/launch/22-particle-index
-
[new branch] launch/225-util-fold-invariant-release -> origin/launch/225-util-fold-invariant-release
-
[new branch] launch/55-bench-radio-name -> origin/launch/55-bench-radio-name
-
[new branch] launch/59-particle-hex-panic -> origin/launch/59-particle-hex-panic
-
[new branch] launch/60-radio-cli-hex-panic -> origin/launch/60-radio-cli-hex-panic
-
[new branch] launch/73-blob-cli-persist -> origin/launch/73-blob-cli-persist
-
[new branch] main -> origin/main
-
[new branch] packaging-witness -> origin/packaging-witness
-
[new branch] refactor/transmit-only -> origin/refactor/transmit-only
-
[new branch] research/bao-bounded-proof -> origin/research/bao-bounded-proof
-
[new branch] research/bao-bounded-traversal -> origin/research/bao-bounded-traversal
-
[new branch] roadmap/soft3-radio -> origin/roadmap/soft3-radio
-
[new ref] HEAD -> origin/HEAD
-
[new tag] v0.1.0 -> v0.1.0 warning: skipping duplicate package
cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312): /tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml in favor of /tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.tomlUpdating git repository
https://github.com/cyberia-to/hemeraFrom file:///tmp/radio-audit-packaging-pair-v3/hemera -
[new ref] d5f0a09539360934fb32db9b2e15a91995607db6 -> refs/commit/d5f0a09539360934fb32db9b2e15a91995607db6 Locking 2 packages to latest Rust 1.95.0 compatible versions
===== 049 END audit/2026-10-13-audit-cargo-packaging/pair/parent/lock.stderr =====
===== 050 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.json | 1450 bytes | SHA256 0bb48b527459f33b688f8d598eeedbe5568c955bb4af2ebef5f526a5b4ab5576 ===== { "started": "2026-10-13T02:16:57.593074Z", "finished": "2026-10-13T02:16:57.673818Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "metadata", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml", "--locked", "--offline", "--format-version", "1" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/parent/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/metadata.stdout", "bytes": 12278, "sha256": "47376714385cb98a34ea24d49464d005e2cd20dc6a2bb5fab9f2a0b68138dbed" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/metadata.stderr", "bytes": 354, "sha256": "9d636fead80a7e4b3dd6950fc477980d250438ea237573f98d523ae0e2fee5ca" } }
===== 050 END audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.json =====
===== 051 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.stdout | 12278 bytes | SHA256 47376714385cb98a34ea24d49464d005e2cd20dc6a2bb5fab9f2a0b68138dbed ===== {"packages":[{"name":"cyber-bao","version":"0.1.0","id":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0","license":"MIT OR Apache-2.0","license_file":null,"description":"Poseidon2-BAO: verified streaming with Poseidon2 hash over Goldilocks","source":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312faa8770e80efe9afa864106ae6b51552","dependencies":[{"name":"bytes","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"genawaiter","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.99.1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["futures03"],"target":null,"registry":null},{"name":"cyber-hemera","source":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6","req":"","kind":null,"rename":"hemera","optional":false,"uses_default_features":false,"features":[],"target":null,"registry":null},{"name":"iroh-io","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.6.1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"range-collections","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.4","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["serde","new_unchecked"],"target":null,"registry":null},{"name":"serde","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["derive"],"target":null,"registry":null},{"name":"smallvec","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["const_new"],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["io-util"],"target":null,"registry":null},{"name":"proptest","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":["macros","rt","io-util"],"target":null,"registry":null}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"cyber_bao","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"group","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/group.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"group_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/group_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof_failures","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/proof_failures.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"range_traversal","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/range_traversal.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"range_traversal_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/range_traversal_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"root_policy","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/root_policy.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"slice_traversal","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/tests/slice_traversal.rs","edition":"2024","doc":false,"doctest":false,"test":true}],"features":{"default":["std"],"serde":["std","dep:serde","hemera/serde","bytes/serde"],"std":["hemera/std","dep:bytes","dep:smallvec","dep:range-collections","dep:iroh-io","dep:genawaiter"],"tokio_fsm":["std","dep:tokio"]},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":"1.89"},{"name":"cyber-hemera","version":"0.3.1","id":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","license":null,"license_file":"../LICENSE","description":"Hemera — Poseidon2 hash over Goldilocks field","source":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a09539360934fb32db9b2e15a91995607db6","dependencies":[{"name":"serde","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["derive"],"target":null,"registry":null},{"name":"proptest","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"serde_json","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":["macros","rt"],"target":null,"registry":null}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"cyber_hemera","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},{"kind":["example"],"crate_types":["bin"],"name":"bench","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/bench.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["example"],"crate_types":["bin"],"name":"neon_mul","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/neon_mul.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["example"],"crate_types":["bin"],"name":"split","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/split.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["test"],"crate_types":["bin"],"name":"constant_time","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/constant_time.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"differential","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/differential.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"vectors","src_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/vectors.rs","edition":"2024","doc":false,"doctest":false,"test":true}],"features":{"async":["std"],"default":["std"],"serde":["dep:serde"],"std":[]},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":["cryptography","no-std"],"keywords":["poseidon2","goldilocks","hash","zk","crypto"],"readme":"../README.md","repository":"https://github.com/cyberia-to/hemera","homepage":"https://github.com/cyberia-to/hemera","documentation":"https://docs.rs/cyber-hemera","edition":"2024","links":null,"default_run":null,"rust_version":"1.89"},{"name":"kadek-bao-reader-control","version":"0.0.0","id":"path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"cyber-bao","source":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552","req":"","kind":null,"rename":null,"optional":false,"uses_default_features":false,"features":[],"target":null,"registry":null}],"targets":[{"kind":["bin"],"crate_types":["bin"],"name":"reader-control","src_path":"/tmp/radio-audit-packaging-pair-v3/frozen/reader_probe.rs","edition":"2024","doc":true,"doctest":false,"test":true}],"features":{},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml","metadata":null,"publish":[],"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null}],"workspace_members":["path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0"],"workspace_default_members":["path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0"],"resolve":{"nodes":[{"id":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0","dependencies":["git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1"],"deps":[{"name":"hemera","pkg":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","dep_kinds":[{"kind":null,"target":null}]}],"features":[]},{"id":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","dependencies":[],"deps":[],"features":[]},{"id":"path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0","dependencies":["git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0"],"deps":[{"name":"cyber_bao","pkg":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#cyber-bao@0.1.0","dep_kinds":[{"kind":null,"target":null}]}],"features":[]}],"root":"path+file:///tmp/radio-audit-packaging-pair-v3/parent/consumer#kadek-bao-reader-control@0.0.0"},"target_directory":"/tmp/radio-audit-packaging-pair-v3/parent/target","build_directory":"/tmp/radio-audit-packaging-pair-v3/parent/target","version":1,"workspace_root":"/tmp/radio-audit-packaging-pair-v3/parent/consumer","metadata":null}
===== 051 END audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.stdout =====
===== 052 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.stderr | 354 bytes | SHA256 9d636fead80a7e4b3dd6950fc477980d250438ea237573f98d523ae0e2fee5ca =====
warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):
/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml
in favor of /tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml
===== 052 END audit/2026-10-13-audit-cargo-packaging/pair/parent/metadata.stderr =====
===== 053 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.json | 1507 bytes | SHA256 95fc04f75a41a9683922fa77a9425b25067f000eb673ef0ca2ce4b8998dead41 ===== { "started": "2026-10-13T02:16:58.631119Z", "finished": "2026-10-13T02:17:00.288340Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "run", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml", "--locked", "--offline", "--bin", "reader-control", "--", "/tmp/radio-audit-packaging-pair-v3/frozen/literal" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/parent/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/debug.stdout", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/debug.stderr", "bytes": 924, "sha256": "8c4338bb58bf85d480f9578193a26079bda087304a4542710783b927777056a5" } }
===== 053 END audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.json =====
===== 054 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.stdout | 2413 bytes | SHA256 ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99 ===== {"case":"interleaved","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"interleaved","leaf":2,"proof_offset":4232,"file_offset":4096,"bytes":4096} {"case":"interleaved","leaf":3,"proof_offset":8392,"file_offset":8192,"bytes":4096} {"case":"interleaved","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":6,"leaves":3,"selected_bytes":4098,"status":"pass"} {"case":"left","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"left","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":2,"status":"pass"} {"case":"right","leaf":1,"proof_offset":136,"file_offset":12288,"bytes":4096} {"case":"right","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":3,"status":"pass"} {"case":"grouped","leaf":1,"proof_offset":72,"file_offset":0,"bytes":8192} {"case":"grouped","leaf":2,"proof_offset":8264,"file_offset":8192,"bytes":8192} {"case":"grouped","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":3,"leaves":2,"selected_bytes":2,"status":"pass"} {"case":"short","leaf":1,"proof_offset":72,"file_offset":0,"bytes":4096} {"case":"short","leaf":2,"proof_offset":4168,"file_offset":4096,"bytes":3} {"case":"short","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":7,"output_items":3,"leaves":2,"selected_bytes":4,"status":"pass"} {"case":"short-grouped","leaf":1,"proof_offset":8,"file_offset":0,"bytes":4099} {"case":"short-grouped","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":6,"output_items":1,"leaves":1,"selected_bytes":4,"status":"pass"} {"case":"empty","root":"ea57b2e6b1ec7d2de11b15cb6d7060dd61d247fe0fbf5f7d3fb97a7be9328552","verification_actions":4,"output_items":0,"leaves":0,"selected_bytes":0,"status":"pass"} {"case":"pcm","leaf":1,"proof_offset":8,"file_offset":0,"bytes":14} {"case":"pcm","root":"da570b332b3f2eac27cdaa83f58bd498ab7fc7736732ab9c1b8d4838c9e307a3","verification_actions":4,"output_items":1,"leaves":1,"selected_bytes":8,"status":"pass"} Eight committed-reader cases PASS; no encoder, traversal or root recomputation oracle; no Kadek adapter executed
===== 054 END audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.stdout =====
===== 055 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.stderr | 924 bytes | SHA256 8c4338bb58bf85d480f9578193a26079bda087304a4542710783b927777056a5 =====
warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):
/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml
in favor of /tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml
Compiling cyber-hemera v0.3.1 (https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a095)
Compiling cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312)
Compiling kadek-bao-reader-control v0.0.0 (/tmp/radio-audit-packaging-pair-v3/parent/consumer)
Finished dev profile [unoptimized + debuginfo] target(s) in 1.07s
Running /tmp/radio-audit-packaging-pair-v3/parent/target/debug/reader-control /tmp/radio-audit-packaging-pair-v3/frozen/literal
===== 055 END audit/2026-10-13-audit-cargo-packaging/pair/parent/debug.stderr =====
===== 056 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/release.json | 1528 bytes | SHA256 78f21d31a4b348f2dae37c0ab9d1d1aa3b021a28bcd8455f2db7db8bf2774138 ===== { "started": "2026-10-13T02:17:00.288560Z", "finished": "2026-10-13T02:17:05.577942Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "run", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/parent/consumer/Cargo.toml", "--locked", "--offline", "--release", "--bin", "reader-control", "--", "/tmp/radio-audit-packaging-pair-v3/frozen/literal" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/parent/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/parent/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/release.stdout", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/parent/release.stderr", "bytes": 916, "sha256": "5f50359e10521948ae9439dc771bfbfb57fc7b163aff0404e6e859c435815bd5" } }
===== 056 END audit/2026-10-13-audit-cargo-packaging/pair/parent/release.json =====
===== 057 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/release.stdout | 2413 bytes | SHA256 ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99 ===== {"case":"interleaved","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"interleaved","leaf":2,"proof_offset":4232,"file_offset":4096,"bytes":4096} {"case":"interleaved","leaf":3,"proof_offset":8392,"file_offset":8192,"bytes":4096} {"case":"interleaved","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":6,"leaves":3,"selected_bytes":4098,"status":"pass"} {"case":"left","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"left","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":2,"status":"pass"} {"case":"right","leaf":1,"proof_offset":136,"file_offset":12288,"bytes":4096} {"case":"right","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":3,"status":"pass"} {"case":"grouped","leaf":1,"proof_offset":72,"file_offset":0,"bytes":8192} {"case":"grouped","leaf":2,"proof_offset":8264,"file_offset":8192,"bytes":8192} {"case":"grouped","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":3,"leaves":2,"selected_bytes":2,"status":"pass"} {"case":"short","leaf":1,"proof_offset":72,"file_offset":0,"bytes":4096} {"case":"short","leaf":2,"proof_offset":4168,"file_offset":4096,"bytes":3} {"case":"short","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":7,"output_items":3,"leaves":2,"selected_bytes":4,"status":"pass"} {"case":"short-grouped","leaf":1,"proof_offset":8,"file_offset":0,"bytes":4099} {"case":"short-grouped","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":6,"output_items":1,"leaves":1,"selected_bytes":4,"status":"pass"} {"case":"empty","root":"ea57b2e6b1ec7d2de11b15cb6d7060dd61d247fe0fbf5f7d3fb97a7be9328552","verification_actions":4,"output_items":0,"leaves":0,"selected_bytes":0,"status":"pass"} {"case":"pcm","leaf":1,"proof_offset":8,"file_offset":0,"bytes":14} {"case":"pcm","root":"da570b332b3f2eac27cdaa83f58bd498ab7fc7736732ab9c1b8d4838c9e307a3","verification_actions":4,"output_items":1,"leaves":1,"selected_bytes":8,"status":"pass"} Eight committed-reader cases PASS; no encoder, traversal or root recomputation oracle; no Kadek adapter executed
===== 057 END audit/2026-10-13-audit-cargo-packaging/pair/parent/release.stdout =====
===== 058 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/parent/release.stderr | 916 bytes | SHA256 5f50359e10521948ae9439dc771bfbfb57fc7b163aff0404e6e859c435815bd5 =====
warning: skipping duplicate package cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312):
/tmp/radio-bao-proof-parent-b933/cyber-bao/Cargo.toml
in favor of /tmp/radio-audit-packaging-pair-v3/parent/cargo-home/git/checkouts/source-029023e212e163c1/ce0fb31/cyber-bao/Cargo.toml
Compiling cyber-hemera v0.3.1 (https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a095)
Compiling cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=ce0fb312faa8770e80efe9afa864106ae6b51552#ce0fb312)
Compiling kadek-bao-reader-control v0.0.0 (/tmp/radio-audit-packaging-pair-v3/parent/consumer)
Finished release profile [optimized] target(s) in 4.88s
Running /tmp/radio-audit-packaging-pair-v3/parent/target/release/reader-control /tmp/radio-audit-packaging-pair-v3/frozen/literal
===== 058 END audit/2026-10-13-audit-cargo-packaging/pair/parent/release.stderr =====
===== 059 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.json | 1397 bytes | SHA256 7758b95e8ce8da3a306ce770b525637c55204ddef02d4d4a413ca5cd9d1bd7b4 ===== { "started": "2026-10-13T02:17:05.616204Z", "finished": "2026-10-13T02:17:24.157968Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "generate-lockfile", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/lock.stdout", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/lock.stderr", "bytes": 3553, "sha256": "2f61656eab86ba9c7aa6f4575f23e16ba0f8c14b912409c7a2acf1a000c5fc92" } }
===== 059 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.json =====
===== 060 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.stdout | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 060 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.stdout =====
===== 061 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.stderr | 3553 bytes | SHA256 2f61656eab86ba9c7aa6f4575f23e16ba0f8c14b912409c7a2acf1a000c5fc92 =====
Updating git repository file:///tmp/radio-audit-packaging-pair-v3/source.git
From file:///tmp/radio-audit-packaging-pair-v3/source
- [new branch] feat/bao-bounded-reducer -> origin/feat/bao-bounded-reducer
- [new branch] feat/bao-hemera-pin -> origin/feat/bao-hemera-pin
- [new branch] feat/bbg-content -> origin/feat/bbg-content
- [new branch] fix/audit-cargo-packaging -> origin/fix/audit-cargo-packaging
- [new branch] fix/bao-empty-root -> origin/fix/bao-empty-root
- [new branch] fix/bao-empty-status -> origin/fix/bao-empty-status
- [new branch] fix/bao-root-policy -> origin/fix/bao-root-policy
- [new branch] fix/kadek-export-pairs -> origin/fix/kadek-export-pairs
- [new branch] fix/kadek-memstore-pairs -> origin/fix/kadek-memstore-pairs
- [new branch] fix/kadek-slice-traversal -> origin/fix/kadek-slice-traversal
- [new branch] launch/100-bao-decode-size-dos -> origin/launch/100-bao-decode-size-dos
- [new branch] launch/101-bao-slice-decode-size-dos -> origin/launch/101-bao-slice-decode-size-dos
- [new branch] launch/176-bao-mixed-coverage -> origin/launch/176-bao-mixed-coverage
- [new branch] launch/205-outboard-release-invariant -> origin/launch/205-outboard-release-invariant
- [new branch] launch/21-3-claim-announce-envelope -> origin/launch/21-3-claim-announce-envelope
- [new branch] launch/21-4-cluster-acc-envelope -> origin/launch/21-4-cluster-acc-envelope
- [new branch] launch/21-gossip-multihop-relay -> origin/launch/21-gossip-multihop-relay
- [new branch] launch/21-signal-envelope -> origin/launch/21-signal-envelope
- [new branch] launch/22-blob-get-tag -> origin/launch/22-blob-get-tag
- [new branch] launch/22-cli-lib-target -> origin/launch/22-cli-lib-target
- [new branch] launch/22-node-persistent-store -> origin/launch/22-node-persistent-store
- [new branch] launch/22-particle-cli-verified-streaming-tests -> origin/launch/22-particle-cli-verified-streaming-tests
- [new branch] launch/22-particle-index -> origin/launch/22-particle-index
- [new branch] launch/225-util-fold-invariant-release -> origin/launch/225-util-fold-invariant-release
- [new branch] launch/55-bench-radio-name -> origin/launch/55-bench-radio-name
- [new branch] launch/59-particle-hex-panic -> origin/launch/59-particle-hex-panic
- [new branch] launch/60-radio-cli-hex-panic -> origin/launch/60-radio-cli-hex-panic
- [new branch] launch/73-blob-cli-persist -> origin/launch/73-blob-cli-persist
- [new branch] main -> origin/main
- [new branch] packaging-witness -> origin/packaging-witness
- [new branch] refactor/transmit-only -> origin/refactor/transmit-only
- [new branch] research/bao-bounded-proof -> origin/research/bao-bounded-proof
- [new branch] research/bao-bounded-traversal -> origin/research/bao-bounded-traversal
- [new branch] roadmap/soft3-radio -> origin/roadmap/soft3-radio
- [new ref] HEAD -> origin/HEAD
- [new tag] v0.1.0 -> v0.1.0
Updating git repository
https://github.com/cyberia-to/hemeraFrom file:///tmp/radio-audit-packaging-pair-v3/hemera - [new ref] d5f0a09539360934fb32db9b2e15a91995607db6 -> refs/commit/d5f0a09539360934fb32db9b2e15a91995607db6 Locking 2 packages to latest Rust 1.95.0 compatible versions
===== 061 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/lock.stderr =====
===== 062 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.json | 1463 bytes | SHA256 fad52db03f796e7139293d8a315a2d03cdc984a7d4cd9ca70f18dcdb0c3a1ca9 ===== { "started": "2026-10-13T02:17:24.158118Z", "finished": "2026-10-13T02:17:24.224758Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "metadata", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml", "--locked", "--offline", "--format-version", "1" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/metadata.stdout", "bytes": 12362, "sha256": "92580476b44fd4dc6a8c4e2295a63e829905492620234e0c3bc8d47edd688002" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/metadata.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 062 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.json =====
===== 063 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.stdout | 12362 bytes | SHA256 92580476b44fd4dc6a8c4e2295a63e829905492620234e0c3bc8d47edd688002 ===== {"packages":[{"name":"cyber-bao","version":"0.1.0","id":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0","license":"MIT OR Apache-2.0","license_file":null,"description":"Poseidon2-BAO: verified streaming with Poseidon2 hash over Goldilocks","source":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#e22c5b472a0979ad382d241b9706de5b82fed9a9","dependencies":[{"name":"bytes","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"genawaiter","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.99.1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["futures03"],"target":null,"registry":null},{"name":"cyber-hemera","source":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6","req":"","kind":null,"rename":"hemera","optional":false,"uses_default_features":false,"features":[],"target":null,"registry":null},{"name":"iroh-io","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.6.1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"range-collections","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^0.4","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["serde","new_unchecked"],"target":null,"registry":null},{"name":"serde","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["derive"],"target":null,"registry":null},{"name":"smallvec","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["const_new"],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["io-util"],"target":null,"registry":null},{"name":"proptest","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":["macros","rt","io-util"],"target":null,"registry":null}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"cyber_bao","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"group","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/group.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"group_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/group_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"proof_failures","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/proof_failures.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"range_traversal","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/range_traversal.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"range_traversal_allocation","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/range_traversal_allocation.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"root_policy","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/root_policy.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"slice_traversal","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/tests/slice_traversal.rs","edition":"2024","doc":false,"doctest":false,"test":true}],"features":{"default":["std"],"serde":["std","dep:serde","hemera/serde","bytes/serde"],"std":["hemera/std","dep:bytes","dep:smallvec","dep:range-collections","dep:iroh-io","dep:genawaiter"],"tokio_fsm":["std","dep:tokio"]},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/source-029023e212e163c1/e22c5b4/cyber-bao/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":"1.89"},{"name":"cyber-hemera","version":"0.3.1","id":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","license":null,"license_file":"../LICENSE","description":"Hemera — Poseidon2 hash over Goldilocks field","source":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a09539360934fb32db9b2e15a91995607db6","dependencies":[{"name":"serde","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":null,"rename":null,"optional":true,"uses_default_features":true,"features":["derive"],"target":null,"registry":null},{"name":"proptest","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"serde_json","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":[],"target":null,"registry":null},{"name":"tokio","source":"registry+https://github.com/rust-lang/crates.io-index","req":"^1","kind":"dev","rename":null,"optional":false,"uses_default_features":true,"features":["macros","rt"],"target":null,"registry":null}],"targets":[{"kind":["lib"],"crate_types":["lib"],"name":"cyber_hemera","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/src/lib.rs","edition":"2024","doc":true,"doctest":true,"test":true},{"kind":["example"],"crate_types":["bin"],"name":"bench","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/bench.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["example"],"crate_types":["bin"],"name":"neon_mul","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/neon_mul.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["example"],"crate_types":["bin"],"name":"split","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/examples/split.rs","edition":"2024","doc":false,"doctest":false,"test":false},{"kind":["test"],"crate_types":["bin"],"name":"constant_time","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/constant_time.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"differential","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/differential.rs","edition":"2024","doc":false,"doctest":false,"test":true},{"kind":["test"],"crate_types":["bin"],"name":"vectors","src_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/tests/vectors.rs","edition":"2024","doc":false,"doctest":false,"test":true}],"features":{"async":["std"],"default":["std"],"serde":["dep:serde"],"std":[]},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home/git/checkouts/hemera-63696198fb70e01e/d5f0a09/rs/Cargo.toml","metadata":null,"publish":null,"authors":[],"categories":["cryptography","no-std"],"keywords":["poseidon2","goldilocks","hash","zk","crypto"],"readme":"../README.md","repository":"https://github.com/cyberia-to/hemera","homepage":"https://github.com/cyberia-to/hemera","documentation":"https://docs.rs/cyber-hemera","edition":"2024","links":null,"default_run":null,"rust_version":"1.89"},{"name":"kadek-bao-reader-control","version":"0.0.0","id":"path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0","license":null,"license_file":null,"description":null,"source":null,"dependencies":[{"name":"cyber-bao","source":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9","req":"","kind":null,"rename":null,"optional":false,"uses_default_features":false,"features":[],"target":null,"registry":null}],"targets":[{"kind":["bin"],"crate_types":["bin"],"name":"reader-control","src_path":"/tmp/radio-audit-packaging-pair-v3/frozen/reader_probe.rs","edition":"2024","doc":true,"doctest":false,"test":true}],"features":{},"manifest_path":"/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml","metadata":null,"publish":[],"authors":[],"categories":[],"keywords":[],"readme":null,"repository":null,"homepage":null,"documentation":null,"edition":"2024","links":null,"default_run":null,"rust_version":null}],"workspace_members":["path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0"],"workspace_default_members":["path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0"],"resolve":{"nodes":[{"id":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0","dependencies":["git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1"],"deps":[{"name":"hemera","pkg":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","dep_kinds":[{"kind":null,"target":null}]}],"features":[]},{"id":"git+https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#cyber-hemera@0.3.1","dependencies":[],"deps":[],"features":[]},{"id":"path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0","dependencies":["git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0"],"deps":[{"name":"cyber_bao","pkg":"git+file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#cyber-bao@0.1.0","dep_kinds":[{"kind":null,"target":null}]}],"features":[]}],"root":"path+file:///tmp/radio-audit-packaging-pair-v3/candidate/consumer#kadek-bao-reader-control@0.0.0"},"target_directory":"/tmp/radio-audit-packaging-pair-v3/candidate/target","build_directory":"/tmp/radio-audit-packaging-pair-v3/candidate/target","version":1,"workspace_root":"/tmp/radio-audit-packaging-pair-v3/candidate/consumer","metadata":null}
===== 063 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.stdout =====
===== 064 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 064 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/metadata.stderr =====
===== 065 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.json | 1522 bytes | SHA256 88731d609ebba4b16a4a49975c55571a790f50b2cf479b4a4eb36cd84ef52a03 ===== { "started": "2026-10-13T02:17:25.056265Z", "finished": "2026-10-13T02:17:26.421010Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "run", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml", "--locked", "--offline", "--bin", "reader-control", "--", "/tmp/radio-audit-packaging-pair-v3/frozen/literal" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/debug.stdout", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/debug.stderr", "bytes": 576, "sha256": "75005803413265952fa612eef3f44a9ed3a2990ad3c88082b7aa1c4664b52f7b" } }
===== 065 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.json =====
===== 066 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.stdout | 2413 bytes | SHA256 ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99 ===== {"case":"interleaved","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"interleaved","leaf":2,"proof_offset":4232,"file_offset":4096,"bytes":4096} {"case":"interleaved","leaf":3,"proof_offset":8392,"file_offset":8192,"bytes":4096} {"case":"interleaved","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":6,"leaves":3,"selected_bytes":4098,"status":"pass"} {"case":"left","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"left","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":2,"status":"pass"} {"case":"right","leaf":1,"proof_offset":136,"file_offset":12288,"bytes":4096} {"case":"right","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":3,"status":"pass"} {"case":"grouped","leaf":1,"proof_offset":72,"file_offset":0,"bytes":8192} {"case":"grouped","leaf":2,"proof_offset":8264,"file_offset":8192,"bytes":8192} {"case":"grouped","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":3,"leaves":2,"selected_bytes":2,"status":"pass"} {"case":"short","leaf":1,"proof_offset":72,"file_offset":0,"bytes":4096} {"case":"short","leaf":2,"proof_offset":4168,"file_offset":4096,"bytes":3} {"case":"short","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":7,"output_items":3,"leaves":2,"selected_bytes":4,"status":"pass"} {"case":"short-grouped","leaf":1,"proof_offset":8,"file_offset":0,"bytes":4099} {"case":"short-grouped","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":6,"output_items":1,"leaves":1,"selected_bytes":4,"status":"pass"} {"case":"empty","root":"ea57b2e6b1ec7d2de11b15cb6d7060dd61d247fe0fbf5f7d3fb97a7be9328552","verification_actions":4,"output_items":0,"leaves":0,"selected_bytes":0,"status":"pass"} {"case":"pcm","leaf":1,"proof_offset":8,"file_offset":0,"bytes":14} {"case":"pcm","root":"da570b332b3f2eac27cdaa83f58bd498ab7fc7736732ab9c1b8d4838c9e307a3","verification_actions":4,"output_items":1,"leaves":1,"selected_bytes":8,"status":"pass"} Eight committed-reader cases PASS; no encoder, traversal or root recomputation oracle; no Kadek adapter executed
===== 066 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.stdout =====
===== 067 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.stderr | 576 bytes | SHA256 75005803413265952fa612eef3f44a9ed3a2990ad3c88082b7aa1c4664b52f7b =====
Compiling cyber-hemera v0.3.1 (https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a095)
Compiling cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#e22c5b47)
Compiling kadek-bao-reader-control v0.0.0 (/tmp/radio-audit-packaging-pair-v3/candidate/consumer)
Finished dev profile [unoptimized + debuginfo] target(s) in 0.82s
Running /tmp/radio-audit-packaging-pair-v3/candidate/target/debug/reader-control /tmp/radio-audit-packaging-pair-v3/frozen/literal
===== 067 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/debug.stderr =====
===== 068 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.json | 1543 bytes | SHA256 f3eac31ccdffb3188bedc6079bc2cbe8d98c9b9cccc0af603fda14f3f2c009bf ===== { "started": "2026-10-13T02:17:26.421201Z", "finished": "2026-10-13T02:17:29.245547Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "argv": [ "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/cargo", "run", "--manifest-path", "/tmp/radio-audit-packaging-pair-v3/candidate/consumer/Cargo.toml", "--locked", "--offline", "--release", "--bin", "reader-control", "--", "/tmp/radio-audit-packaging-pair-v3/frozen/literal" ], "env": { "CARGO_HOME": "/tmp/radio-audit-packaging-pair-v3/candidate/cargo-home", "CARGO_TARGET_DIR": "/tmp/radio-audit-packaging-pair-v3/candidate/target", "CARGO_BUILD_JOBS": "2", "CARGO_INCREMENTAL": "0", "RUSTC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustc", "RUSTDOC": "/Users/master/.rustup/toolchains/1.95.0-aarch64-apple-darwin/bin/rustdoc", "RUSTFLAGS": "-Dwarnings", "GIT_CONFIG_GLOBAL": "/tmp/radio-audit-packaging-pair-v3/gitconfig", "GIT_CONFIG_NOSYSTEM": "1", "GIT_ALLOW_PROTOCOL": "file", "CARGO_HTTP_TIMEOUT": "15", "CARGO_NET_RETRY": "0" }, "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/release.stdout", "bytes": 2413, "sha256": "ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-v3/candidate/release.stderr", "bytes": 568, "sha256": "99c4a127e48eb0143a7282a8086692658c952138571e2ec75b6cc96e85460215" } }
===== 068 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.json =====
===== 069 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.stdout | 2413 bytes | SHA256 ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99 ===== {"case":"interleaved","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"interleaved","leaf":2,"proof_offset":4232,"file_offset":4096,"bytes":4096} {"case":"interleaved","leaf":3,"proof_offset":8392,"file_offset":8192,"bytes":4096} {"case":"interleaved","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":6,"leaves":3,"selected_bytes":4098,"status":"pass"} {"case":"left","leaf":1,"proof_offset":136,"file_offset":0,"bytes":4096} {"case":"left","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":2,"status":"pass"} {"case":"right","leaf":1,"proof_offset":136,"file_offset":12288,"bytes":4096} {"case":"right","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":6,"output_items":3,"leaves":1,"selected_bytes":3,"status":"pass"} {"case":"grouped","leaf":1,"proof_offset":72,"file_offset":0,"bytes":8192} {"case":"grouped","leaf":2,"proof_offset":8264,"file_offset":8192,"bytes":8192} {"case":"grouped","root":"e621f66b42fb61b260200dfa649d3f16d35cde5af2e8c04cc2551c109f00c6f6","verification_actions":11,"output_items":3,"leaves":2,"selected_bytes":2,"status":"pass"} {"case":"short","leaf":1,"proof_offset":72,"file_offset":0,"bytes":4096} {"case":"short","leaf":2,"proof_offset":4168,"file_offset":4096,"bytes":3} {"case":"short","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":7,"output_items":3,"leaves":2,"selected_bytes":4,"status":"pass"} {"case":"short-grouped","leaf":1,"proof_offset":8,"file_offset":0,"bytes":4099} {"case":"short-grouped","root":"06001dbd4d71e5149839bed85cbe3fc979fcfc45ef711a6d9ad2fdc1499da3e3","verification_actions":6,"output_items":1,"leaves":1,"selected_bytes":4,"status":"pass"} {"case":"empty","root":"ea57b2e6b1ec7d2de11b15cb6d7060dd61d247fe0fbf5f7d3fb97a7be9328552","verification_actions":4,"output_items":0,"leaves":0,"selected_bytes":0,"status":"pass"} {"case":"pcm","leaf":1,"proof_offset":8,"file_offset":0,"bytes":14} {"case":"pcm","root":"da570b332b3f2eac27cdaa83f58bd498ab7fc7736732ab9c1b8d4838c9e307a3","verification_actions":4,"output_items":1,"leaves":1,"selected_bytes":8,"status":"pass"} Eight committed-reader cases PASS; no encoder, traversal or root recomputation oracle; no Kadek adapter executed
===== 069 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.stdout =====
===== 070 BEGIN audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.stderr | 568 bytes | SHA256 99c4a127e48eb0143a7282a8086692658c952138571e2ec75b6cc96e85460215 =====
Compiling cyber-hemera v0.3.1 (https://github.com/cyberia-to/hemera?rev=d5f0a09539360934fb32db9b2e15a91995607db6#d5f0a095)
Compiling cyber-bao v0.1.0 (file:///tmp/radio-audit-packaging-pair-v3/source.git?rev=e22c5b472a0979ad382d241b9706de5b82fed9a9#e22c5b47)
Compiling kadek-bao-reader-control v0.0.0 (/tmp/radio-audit-packaging-pair-v3/candidate/consumer)
Finished release profile [optimized] target(s) in 2.53s
Running /tmp/radio-audit-packaging-pair-v3/candidate/target/release/reader-control /tmp/radio-audit-packaging-pair-v3/frozen/literal
===== 070 END audit/2026-10-13-audit-cargo-packaging/pair/candidate/release.stderr =====
===== 071 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.json | 868 bytes | SHA256 13b07784eda84e2e564ce4f384cc4ff121b493f24283f1f82f2cdc94cba1ade9 ===== { "started": "2026-10-13T02:16:25.416026Z", "finished": "2026-10-13T02:16:27.948080Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "nu", "audit/2026-10-12-bao-proof-research/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof", "--siblings", "/Users/master/cyber" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-research-after-v2.stdout", "bytes": 267, "sha256": "d9a4f1b0acf77a8beac40a1c3e01d258b50265d5e59c37dae14e8970873e8640" }, "stderr": { "path": "/tmp/radio-audit-packaging-research-after-v2.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 071 END audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.json =====
===== 072 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.stdout | 267 bytes | SHA256 d9a4f1b0acf77a8beac40a1c3e01d258b50265d5e59c37dae14e8970873e8640 ===== { "status": "pass", "files": 89, "git_input_records": 98, "bridge_comparisons": 39, "primary_excerpts": 13, "raw_receipts": 9, "fixtures": 13, "production_implemented": false, "cargo_rerun": false, "historical_inventory_archive_replayed": false }
===== 072 END audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.stdout =====
===== 073 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 073 END audit/2026-10-13-audit-cargo-packaging/records/research-after-v2.stderr =====
===== 074 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.json | 816 bytes | SHA256 ca3dcf7d96ff818fcd0ad3456f09d759f42d72fd061be543d679e996e1136e06 ===== { "started": "2026-10-13T02:16:25.416083Z", "finished": "2026-10-13T02:17:16.963000Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "nu", "audit/2026-10-12-bao-bounded-proof/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-proof-after-v2.stdout", "bytes": 496, "sha256": "756a8291737f092cbbe7b4c17a411b9bc21c89afbbb12dc5681fc6f17ab43059" }, "stderr": { "path": "/tmp/radio-audit-packaging-proof-after-v2.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 074 END audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.json =====
===== 075 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.stdout | 496 bytes | SHA256 756a8291737f092cbbe7b4c17a411b9bc21c89afbbb12dc5681fc6f17ab43059 ===== { "status": "pass", "files": 619, "source_epochs": 4, "original_git_source_records": 2777, "candidate_source_records": 21, "raw_records": 115, "gate_bindings": 85, "counterpart_mappings": 20, "initial_seed_fixtures": 17, "supplemental_interleaved_carriers": 1, "code_review_exit": 0, "clippy_matched_diagnostics": 11, "extra_candidate_diagnostics_source_attributed": 3, "cargo_rerun": false, "hemera_recomputed": false, "requires_exact_parent_git_objects": true }
===== 075 END audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.stdout =====
===== 076 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 076 END audit/2026-10-13-audit-cargo-packaging/records/proof-after-v2.stderr =====
===== 077 BEGIN audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.json | 882 bytes | SHA256 df2079dcad12a5aa55601f6c7d72d819a3cbcbd226c34c4d39d807687a8e1058 ===== { "started": "2026-10-13T02:05:29.559081Z", "finished": "2026-10-13T02:05:29.981304Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "nu", "audit/2026-10-12-bao-bounded-proof/code-input/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof", "--siblings", "/Users/master/cyber" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-code-input-after-v1.stdout", "bytes": 243, "sha256": "2ebdd7dc83f67023e207081ca20a6f303017daa5a8fb2fd69847895781cc01b2" }, "stderr": { "path": "/tmp/radio-audit-packaging-code-input-after-v1.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 077 END audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.json =====
===== 078 BEGIN audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.stdout | 243 bytes | SHA256 2ebdd7dc83f67023e207081ca20a6f303017daa5a8fb2fd69847895781cc01b2 ===== { "status": "pass", "sections": 84, "bytes": 434422, "sha256": "48567e078407c1a5b554143fb712ac548132f5c7037d34a7dfbfb0361c2ff600", "full_git_sources": 23, "primary_excerpts": 14, "candidate_sources": 7, "evidence_inputs": 40 }
===== 078 END audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.stdout =====
===== 079 BEGIN audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 079 END audit/2026-10-13-audit-cargo-packaging/records/code-input-after-v1.stderr =====
===== 080 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.json | 892 bytes | SHA256 f7d11abb13eb67dfd9d9fd0cf2772d478e2686cd54e95ac64942f009d82e5894 ===== { "started": "2026-10-13T02:16:37.089354Z", "finished": "2026-10-13T02:16:41.921895Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "nu", "audit/2026-10-12-bao-proof-research/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof", "--siblings", "/Users/master/cyber", "--live" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 1, "stdout": { "path": "/tmp/radio-audit-packaging-research-live-after-v2.stdout", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, "stderr": { "path": "/tmp/radio-audit-packaging-research-live-after-v2.stderr", "bytes": 661, "sha256": "0adef1143bce6e3f032afb7305d97390b151da9d0d0c2a1dacf10358ef14d3fa" } }
===== 080 END audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.json =====
===== 081 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.stdout | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 081 END audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.stdout =====
===== 082 BEGIN audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.stderr | 661 bytes | SHA256 0adef1143bce6e3f032afb7305d97390b151da9d0d0c2a1dacf10358ef14d3fa ===== Error: nu::shell::error
x These are not equal.
,-[/tmp/radio-audit-replay.tW9I9s/capsule/verify.nu:72:18]
71 | if $live {
72 | assert equal (^git -C $own rev-parse HEAD | str trim) $bridge.current
: ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^ ^^^^^^^|^^^^^^^
: | -- right: "b933829cbe273d2f31fe75ca83125f3ddd8917a2" : -- left: "ce0fb312faa8770e80efe9afa864106ae6b51552"
73 | assert equal (^git -C $own diff --name-only | str trim) ''
`----
Failed historical replay retained at /tmp/radio-audit-replay.tW9I9s
===== 082 END audit/2026-10-13-audit-cargo-packaging/records/research-live-after-v2.stderr =====
===== 083 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.json | 840 bytes | SHA256 6a68a9e697097c930ae7fc1f01dd4e40f87e3f650c21f0509909f08a84449fc9 ===== { "started": "2026-10-13T02:16:37.092550Z", "finished": "2026-10-13T02:17:25.021180Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "nu", "audit/2026-10-12-bao-bounded-proof/verify.nu", "--repo", "/Users/master/cyber/radio-bao-bounded-proof", "--live" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 1, "stdout": { "path": "/tmp/radio-audit-packaging-proof-live-after-v2.stdout", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" }, "stderr": { "path": "/tmp/radio-audit-packaging-proof-live-after-v2.stderr", "bytes": 642, "sha256": "bd23ac9036992d463898b0e8ad784709a3f497182e1454a99f1e7c46e0f4cc77" } }
===== 083 END audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.json =====
===== 084 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.stdout | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 084 END audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.stdout =====
===== 085 BEGIN audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.stderr | 642 bytes | SHA256 bd23ac9036992d463898b0e8ad784709a3f497182e1454a99f1e7c46e0f4cc77 ===== Error: nu::shell::error
x These are not equal.
,-[/tmp/radio-audit-replay.O4ICSR/capsule/verify.nu:185:27]
184 | }
185 | if $live { assert equal (^git -C $own rev-parse HEAD | str trim) $ready.parent }
: ^^^^^^^^^^^^^^^^^^^^|^^^^^^^^^^^^^^^^^^^ ^^^^^^|^^^^^^
: | -- right: "b933829cbe273d2f31fe75ca83125f3ddd8917a2" : -- left: "ce0fb312faa8770e80efe9afa864106ae6b51552"
186 | rm $temp
`----
Failed historical replay retained at /tmp/radio-audit-replay.O4ICSR
===== 085 END audit/2026-10-13-audit-cargo-packaging/records/proof-live-after-v2.stderr =====
===== 086 BEGIN audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.json | 759 bytes | SHA256 a91440888697c7971295761d12e0abd373b76677620178857391c511d5788a03 ===== { "started": "2026-10-13T02:15:52.538884Z", "finished": "2026-10-13T02:16:03.766423Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "ruby", "/tmp/radio-audit-packaging-staging-tests-v2.rb" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-staging-tests-v2.stdout", "bytes": 255, "sha256": "a1d346595dfa0fc13fe7e5f67a05aa5b695913c8f3de6ce301cea27c99655f49" }, "stderr": { "path": "/tmp/radio-audit-packaging-staging-tests-v2.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 086 END audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.json =====
===== 087 BEGIN audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.stdout | 255 bytes | SHA256 a1d346595dfa0fc13fe7e5f67a05aa5b695913c8f3de6ce301cea27c99655f49 ===== {"status":"pass","original_capsules":[["2026-10-09-kadek-slice-traversal",13],["2026-10-12-bao-proof-research",90],["2026-10-12-bao-bounded-proof",620]],"original_prepare_calls":2,"deliberate_failures":2,"audit_tree_unchanged":true,"default_cli_cases":3}
===== 087 END audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.stdout =====
===== 088 BEGIN audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 088 END audit/2026-10-13-audit-cargo-packaging/records/staging-tests-v2.stderr =====
===== 089 BEGIN audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.json | 749 bytes | SHA256 16bdec98c561defe202c166e0b9ea9a4ef1af7e500089f3d8aa8f6310a066703 ===== { "started": "2026-10-13T02:16:58.622837Z", "finished": "2026-10-13T02:16:58.779996Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "ruby", "/tmp/radio-audit-packaging-child-exit-v1.rb" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-child-exit-v1.stdout", "bytes": 80, "sha256": "aea7269c7ba8d95f11e1c80c1b8a7d4374dffdcade3ca442f15dfa39334a2fb0" }, "stderr": { "path": "/tmp/radio-audit-packaging-child-exit-v1.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 089 END audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.json =====
===== 090 BEGIN audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.stdout | 80 bytes | SHA256 aea7269c7ba8d95f11e1c80c1b8a7d4374dffdcade3ca442f15dfa39334a2fb0 ===== {"status":"pass","child_status":77,"retained":"/tmp/radio-audit-replay.F2s4TY"}
===== 090 END audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.stdout =====
===== 091 BEGIN audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 091 END audit/2026-10-13-audit-cargo-packaging/records/child-exit-v1.stderr =====
===== 092 BEGIN audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.json | 740 bytes | SHA256 98e6254143908eb8aed1a454eea1d8e64c75ab2de65785647efa226110d9831a ===== { "started": "2026-10-13T02:16:25.416090Z", "finished": "2026-10-13T02:17:29.280508Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "ruby", "/tmp/radio-audit-packaging-pair-v3.rb" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-pair-run-v3.stdout", "bytes": 265, "sha256": "50510d56fa676d7e70edffd84505333eabde9fc198498a237c699ac876b8a4b2" }, "stderr": { "path": "/tmp/radio-audit-packaging-pair-run-v3.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 092 END audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.json =====
===== 093 BEGIN audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.stdout | 265 bytes | SHA256 50510d56fa676d7e70edffd84505333eabde9fc198498a237c699ac876b8a4b2 ===== parent reader control passed; warnings=4 candidate reader control passed; warnings=0 {"status":"pass","snapshot":"e22c5b472a0979ad382d241b9706de5b82fed9a9","source_files":63,"reader_stdout_sha256":"ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99"}
===== 093 END audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.stdout =====
===== 094 BEGIN audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 094 END audit/2026-10-13-audit-cargo-packaging/records/pair-run-v3.stderr =====
===== 095 BEGIN audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.json | 743 bytes | SHA256 589d07d003160257eedba908d1da99a40e31826942892bd497ff6e5206b6deb8 ===== { "started": "2026-10-13T02:18:06.821471Z", "finished": "2026-10-13T02:18:06.861667Z", "cwd": "/Users/master/cyber/radio-bao-bounded-proof", "revision": "ce0fb312faa8770e80efe9afa864106ae6b51552", "argv": [ "ruby", "/tmp/radio-audit-packaging-metadata-v1.rb" ], "runner_sha256": "10fc0f8210a06cd42e2cc85d0f2b328da05a5e09e01c8feb75651b31fdb0d5d6", "exit_code": 0, "stdout": { "path": "/tmp/radio-audit-packaging-metadata-v1.stdout", "bytes": 73, "sha256": "921712e27231ad4080e6555251fbb0c787f917ca74e224105809198c8251eb46" }, "stderr": { "path": "/tmp/radio-audit-packaging-metadata-v1.stderr", "bytes": 0, "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" } }
===== 095 END audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.json =====
===== 096 BEGIN audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.stdout | 73 bytes | SHA256 921712e27231ad4080e6555251fbb0c787f917ca74e224105809198c8251eb46 ===== {"status":"pass","packages":3,"resolve_nodes":3,"substitutions":[34,34]}
===== 096 END audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.stdout =====
===== 097 BEGIN audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.stderr | 0 bytes | SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 =====
===== 097 END audit/2026-10-13-audit-cargo-packaging/records/metadata-v1.stderr =====
===== 098 BEGIN audit/2026-10-13-audit-cargo-packaging/verify.nu | 8799 bytes | SHA256 e208a0859470dd834c5986cbbb6b40585681693feacb5fb16719e3c97a1234fa ===== use std/assert
def check [root: string, f: record] { let b = (open --raw ($root | path join $f.path) | into binary) assert equal ($b | bytes length) $f.bytes assert equal ($b | hash sha256) $f.sha256 } def pointer [p: string] { $p | split row '/' | skip 1 | each {|x| if ($x =~ '^[0-9]+$') { $x | into int } else { $x } } | into cell-path } def main [--repo: string, --live] { assert ($repo != null) 'Pass --repo containing the exact historical Radio Git objects' let root = $env.FILE_PWD let files = (open ($root | path join files.json)) for f in $files { check $root $f } let base = 'ce0fb312faa8770e80efe9afa864106ae6b51552' let tmp = (^mktemp -d /tmp/radio-packaging-verify.XXXXXX | str trim) let blob = ($tmp | path join blob) let sources = (open ($root | path join inputs/source.json) | append (open ($root | path join inputs/v2-additional-source.json))) for f in $sources { ^git -C $repo cat-file blob $'($f.revision):($f.path)' out> $blob assert equal $env.LAST_EXIT_CODE 0 let bytes = (open --raw $blob | into binary) assert equal ($bytes | bytes length) $f.bytes assert equal ($bytes | hash sha256) $f.sha256 assert equal (open --raw ($root | path join $f.local) | into binary) $bytes } let renames = (open ($root | path join inputs/renames.json)) assert equal ($renames | length) 7 assert equal ($renames | get bytes | math sum) 2141 let bindings = (open ($root | path join inputs/historical-index-bindings.json)) for f in $bindings { ^git -C $repo cat-file blob $'($base):($f.index)' out> $blob assert equal $env.LAST_EXIT_CODE 0 let text = (open --raw $blob) assert equal ($text | hash sha256) $f.index_sha256 let entry = ($text | from json | get (pointer $f.pointer)) assert equal $entry.bytes $f.bytes assert equal $entry.sha256 $f.sha256 if $live { check $repo {path: $f.archived_path, bytes: $f.bytes, sha256: $f.sha256} } }
Bundle is an incremental local witness, not a release or default-branch commit.
let bare = ($tmp | path join witness.git) ^git clone --bare --shared $repo $bare out+err> ($tmp | path join clone.log) assert equal $env.LAST_EXIT_CODE 0 ^git --git-dir $bare fetch ($root | path join pair/candidate.bundle) refs/heads/packaging-witness out+err> ($tmp | path join fetch.log) assert equal $env.LAST_EXIT_CODE 0 let snap = (open ($root | path join pair/snapshot.json)) assert equal $snap.parent $base assert equal (^git --git-dir $bare rev-parse FETCH_HEAD | str trim) $snap.candidate assert equal (^git --git-dir $bare rev-parse $'($snap.candidate)^{tree}' | str trim) $snap.tree let delta = (^git --git-dir $bare diff-tree --no-commit-id --no-renames --name-only -r $base $snap.candidate | lines | sort) assert equal $delta ($snap.explicit_paths | get path | sort) assert equal $delta ($snap.changed_paths | sort) for f in ($snap.explicit_paths | where {|x| not ($x | get -o deleted | default false) }) { ^git --git-dir $bare cat-file blob $'($snap.candidate):($f.path)' out> $blob assert equal $env.LAST_EXIT_CODE 0 let b = (open --raw $blob | into binary) assert equal ($b | bytes length) $f.bytes assert equal ($b | hash sha256) $f.sha256 } let normal = {|rev| ^git --git-dir $bare ls-tree -r $rev | lines | where {|s| let p = ($s | split row "\t" | last); not (($p | str starts-with audit/) or ($p | str starts-with .claude/tasks/)) } } assert equal (do $normal $base) (do $normal $snap.candidate) assert equal (do $normal $base | length) $snap.unchanged_normal_paths let names = (^git --git-dir $bare ls-tree -r --name-only $snap.candidate audit | lines) assert ($names | where {|p| ($p | path basename) == Cargo.toml } | is-empty) let freeze = (open ($root | path join execution/source-freeze.json)) for f in $freeze { ^git --git-dir $bare cat-file blob $'($snap.candidate):($f.path)' out> $blob assert equal $env.LAST_EXIT_CODE 0 assert equal (open --raw $blob | hash sha256) $f.sha256 if $live { check $repo $f } }
Raw stream hashes and actual statuses, including deliberate failures.
let raw = (open ($root | path join raw-records.json)) for f in $raw { let r = (open ($root | path join $f.path)) assert equal $r.exit_code $f.exit_code for stream in [stdout stderr] { let s = ($r | get $stream) let b = (open --raw ($root | path join ($f.path | str replace '.json' $'.($stream)')) | into binary) assert equal ($b | bytes length) $s.bytes assert equal ($b | hash sha256) $s.sha256 } } for arm in [parent candidate] { let before = (open ($root | path join pair $arm before.json)) assert equal $before (open ($root | path join pair $arm after.json)) for cmd in [lock metadata debug release] { let r = (open ($root | path join pair $arm $'($cmd).json')) assert equal $r.exit_code 0 let err = (open --raw ($root | path join pair $arm $'($cmd).stderr')) if $arm == parent { assert ($err | str contains 'warning: skipping duplicate package') } else { assert (not ($err | str contains 'warning:')) } } } let result = (open ($root | path join pair/results.json)) for arm in [parent candidate] { for mode in [debug release] { assert equal (open --raw ($root | path join pair $arm $'($mode).stdout') | hash sha256) $result.stdout_sha256 } } assert equal $result.stdout_sha256 'ccb679634c8a07dc76b75445b6ac9f8372602e46bb4d85217a7634db6956ab99' let tuples = {|arm| open ($root | path join pair $arm sources.json) | select package relative bytes sha256 } assert equal (do $tuples parent) (do $tuples candidate) assert equal (do $tuples parent | length) 63 let external = (open ($root | path join pair/external-manifest.json)) assert equal ($external | select path bytes sha256 | uniq | length) 1 check $root {path: pair/external.Cargo.toml.txt, bytes: ($external | first | get bytes), sha256: ($external | first | get sha256)} let comparison = (open ($root | path join pair/metadata-comparison.json)) mut normalized = [] for row in $comparison.arms { mut data = (open --raw ($root | path join pair $row.arm metadata.stdout) | from json) for s in $row.substitutions { let p = (pointer $s.pointer) assert equal ($data | get $p) $s.old if $s.kind == exact-identifier { assert equal ($row.exact_map | get $s.old) $s.new } else { assert equal $s.kind validated-path-boundary let admitted = ($row.path_prefix_map | transpose old new | where {|m| ($s.old == $m.old) or ($s.old | str starts-with ($m.old + '/')) }) assert equal ($admitted | length) 1 let m = ($admitted | first) assert equal $s.new ($m.new + ($s.old | str substring ($m.old | str length)..)) } $data = ($data | update $p $s.new) } assert equal $data (open ($root | path join pair $row.arm metadata-normalized.json)) $normalized = ($normalized | append [$data]) } assert equal ($normalized | get 0) ($normalized | get 1) for name in [research proof] { assert equal (open --raw ($root | path join records $'($name)-before.stdout')) (open --raw ($root | path join records $'($name)-after-v2.stdout')) let live = (open ($root | path join records $'($name)-live-after-v2.json')) assert equal $live.exit_code 1 let error = (open --raw ($root | path join records $'($name)-live-after-v2.stderr')) assert ($error | str contains 'Failed historical replay retained at /tmp/radio-audit-replay.') assert ($error | str contains $base) assert ($error | str contains b933829cbe273d2f31fe75ca83125f3ddd8917a2) } let controls = (open ($root | path join controls/staging-v2/results.json)) assert equal ($controls.stages | get files_equal) [13 90 620] for x in $controls.failures { assert equal $x.before $x.after; assert equal $x.historical_invoked false; assert equal $x.status 1 } assert equal ($controls.default_cli | length) 3 assert equal (open ($root | path join controls/child-exit-v1/result.json) | get status) 77 if $live { let actual = (^git -C $repo diff --no-renames --name-only $base | lines | append (^git -C $repo ls-files --others --exclude-standard | lines) | uniq | sort) assert equal $actual (open ($root | path join final-paths.json) | sort) assert (glob ($repo | path join audit '**' Cargo.toml) | is-empty) } rm --recursive $tmp {status: pass, files: ($files | length), historical_git_inputs: ($sources | length), index_bindings: ($bindings | length), packaging_files: ($freeze | length), snapshot_paths: ($delta | length), raw_records: ($raw | length), source_tuples: 63, consumer_cases: 8, consumer_commands_per_arm: 4, requires_exact_git_objects: true, cargo_rerun: false, broader_gates_refreshed: false} | to json }
===== 098 END audit/2026-10-13-audit-cargo-packaging/verify.nu =====