Independent CODE Review — audit-cargo-packaging (parent ce0fb312)

Verdict: APPROVE

I re-derived the mechanism from the supplied bodies rather than the narrative, and checked the code against the raw receipts.

What actually holds up

The rename is lossless and the replay is byte-exact. execution/source-freeze.json (007) lengths and the seven archived bodies (008–014) agree on 454/375/246/222/250/377/217 = 2141, matching renames.json (031) and verify.nu's math sum assertion. More importantly, the staged replay reproduces the original result streams: research-after-v2.stdout (072) is d9a4f1b0… and proof-after-v2.stdout (075) is 756a8291…, identical to records/research-before.stdout / proof-before.stdout as frozen in the snapshot (042), with the same counts (89/98/9; 619/2777/115). That is the central claim of the unit and it is measured, not asserted.

The staging helper (021) cannot write into the repository. Every write target is under a fresh mktemp -d; the only repository reads are hashes. The missing-archive case fails in let hashes = … before mktemp, so nothing is even created; the collision case fails on the explicit Logical Cargo path already exists assert. controls/staging-v2/results.json (040) shows both deliberate failures at status 1 with an identical 1259-file/56,517,912-byte/7616f616… audit-tree hash before and after, and historical_invoked: false. Index alignment between $originals` and `$archives is correct (both append the entry last, each preserves order), and the entry overwrite is the sole collision, gated by a prior wrapper-hash check.

The staged layout equals the historical layout exactly, not approximately. staging-tests-v2.rb (035) compares the capsule's full file set against git ls-tree -r --name-only ce0 -- audit/<capsule> and then every path's bytes against git show ce0:…. 13/90/620 with set equality simultaneously proves (a) the .txt files were moved, not duplicated, (b) *.original.nu.txt no longer exists in the stage, and (c) cp --recursive introduced nothing extra.

The nonzero-child gap is genuinely closed, and the receipts come from the final code. The wrappers use complete + print --no-newline on both streams + finish $staged $result.exit_code. child-exit-v1.rb (036) asserts exact stdout equality, status 77, and a stderr matching \Astderr-no-newlineFailed historical replay retained at (…)\n\z with capsule/verify.nu present (041). Crucially, the wrapper hashes in the frozen witness tree (042: 794bbec4…, fd64cf8a…, ad4154da…) equal the reviewed wrappers (015/017/019), and the --live receipts at 02:16:37 (082, 085) already carry the Failed historical replay retained at … notice — i.e. the success and failure paths of the final implementation are both witnessed. Historical --live HEAD failures (ce0fb312 vs b933829c) remain required failures, exit 1, retained directory.

CLI/default semantics are preserved explicitly, not by luck. Both verifiers always pass resolved --repo/--siblings so the staged child never resolves its own grandparent to /tmp; the reproducer retains ~/cyber/radio / ~/cyber/hemera. The three recorded default_cli cases (040) confirm literal-revision, expanded home paths, fetch/full = true, and repo=<base>, siblings=<OUT> for the fake roots. prepare-crate is exercised on both historical revisions with exported Cargo.toml/Cargo.lock/src/main.rs compared to git show, and every cyber-bao file compared allowing only the function's own path = "../../hemera/rs" → version = "=0.3.1" substitution.

The Git-consumer differential is causally controlled. One --shared bare clone serves both arms through one file:// URL; the candidate commit is built in a separate GIT_INDEX_FILE (so the real index/refs are untouched) from read-tree ce0 plus an allowlist that is asserted equal to git status --porcelain --untracked-files=all — a stray edit anywhere raises. diff-tree ce0..candidate equals that allowlist, and the ls-tree -r lines outside audit/ and .claude/tasks/ are byte-identical (4419 paths), which is a stronger statement than "manifests and locks unchanged". Parent reproduces the duplicate warning in all four commands (049, 052, 055, 058); candidate emits none (061, 064, 067, 070). The external witness manifest is identical at all three observation points (044). Reader stdout is ccb67963… in all four runs and equals the frozen historical control (054/057/066/069). 63 source tuples equal; three-node graph with features: [].

Metadata normalization is structural and auditable. metadata-v1.rb (038) walks parsed JSON, gates exact-ID substitution on an allowed key set (correctly propagating key through arrays so resolve.nodes[].dependencies[0] and packages[].dependencies[].source both land in-policy), raises on ambiguous prefixes and on any unexpected unnormalized path except the shared frozen reader_probe.rs. 34 substitutions per arm (045/096), then full structural equality — covering features, versions, rust_version, dependency requirements and deps[].pkg. verify.nu (098) re-derives each substitution from the raw stdout rather than trusting the report.

Scope discipline is honest. -Dwarnings, jobs=2, incremental=0, isolated Cargo homes/targets, local-only acquisition with the recorded Hemera insteadOf rewrite; no production Rust, lock, version, license, BAO API or Kadek pin change; prior broad gates explicitly unrefreshed; no release/tag/publication claim.

Blockers

None that I can substantiate from the supplied material.

Advice (non-blocking)

• Tie the metadata maps to validated identities. verify.nu checks exact_map/path_prefix_map only for self-consistency; metadata-v1.rb is the only place asserting that the checkout prefix ends with the arm's 7-char rev and that the IDs carry the pinned rev. Add to verify.nu: each exact_map key must contain the independently verified arm revision ($base` / `$snap.candidate), and each path_prefix_map key must start with the recorded arm directory. Otherwise a mistaken map could collapse two genuinely different paths to one token. Source-tuple and ls-tree equality already cover real drift, so this is defence-in-depth.
• Make stage complete by construction. It verifies the declared manifests exist as .txt but never that the capsule contains no undeclared Cargo.toml.txt. A future capsule gaining an eighth archived manifest would stage silently incomplete; today only the external 13/90/620 set-equality control catches that. Assert inside stage that the capsule's **/Cargo.toml.txt set equals $manifests mapped.
• Handle a signalled child. finish [staged: record, status: int] will type-error if $result.exit_code` is null (your own v2 attempt recorded exactly that null signal exit). It fails safe — non-zero exit, directory retained, no `rm` — but the retention notice is lost. `$result.exit_code | default 1 restores the diagnostic.
• Document the buffering regression. complete suppresses live output; the slice reproducer prints progress and runs for minutes, so it now appears silent and loses stdout/stderr interleaving. Harmless for the two JSON-emitting verifiers; worth a line in the README for reproduce.nu.
• Flag the new inversion of dependency direction. Three historical capsules now use ../2026-10-13-audit-cargo-packaging/replay.nu, i.e. older evidence depends on a newer capsule. Moving, renaming or compressing the 2026-10-13 directory silently breaks all three historical entry points. State that constraint in each affected capsule or in README.md under a "do not relocate" note.
• The measured witness is not the merge tree. e22c5b47 predates verify.nu, pair/, controls/, files.json, raw-records.json, final-paths.json and candidate.bundle; the zero-warning result therefore attaches to that commit, not to what will be merged. The --live basename guard plus final-paths.json equality is the right mitigation — please run it against the actual merge commit (the brief already assigns final merge to the parent), since none of the added evidence files were supplied to me for a basename check.
• Minor epoch hygiene. controls/staging-v2 was captured at 02:15:52, ~33 s before the frozen snapshot; its conclusions transfer (they depend only on the entry file's presence and the .original.nu.txt restoration), but binding each control record to the frozen wrapper SHA would remove the inference.
• Keep the warning claim worded as it is. With RUSTFLAGS=-Dwarnings, "zero compiler warnings" is partly tautological; the substantive, defensible claim is zero Cargo warnings across the four enumerated commands, which is how results.json and the README already phrase it.
• The deferred general guard remains the real defect class. audit/-only basename guarding will not catch a future absolute or repo-escaping path = dependency in a sibling manifest. Declining the cleanup is defensible; a cheap tracked-manifest guard still looks cheaper than rediscovering this from a downstream consumer.

Not verified here (indexed omissions, not read): the new capsule's files.json / raw-records.json / final-paths.json, pair/candidate.bundle, binary carriers, whole historical capsule bodies. verify.nu reads all of them, so its end-to-end execution is asserted by its recorded receipts, not independently reproduced in this review. No release, rung, last-tag or broad-gate conclusion follows from this approval.