Independent PLAN Review v2 — audit-cargo-packaging

Verdict: APPROVE

I re-derived the causal chain from the supplied bodies rather than trusting the narrative. Item 006 (nostd-parent/Cargo.toml, line 7) declares cyber-bao = { path = "/tmp/radio-bao-proof-parent-b933/cyber-bao", default-features = false }. Cargo's Git source enumerates every manifest in a checkout and recursively resolves their path dependencies; that absolute path resolves outside the checkout to a second on-disk cyber-bao v0.1.0, producing exactly the text in records/consumer-ce0-lock.stderr (038) and -metadata.stderr (041). The other six manifests use ../../../cyber-bao, which resolves to the checkout's own cyber-bao/Cargo.toml (016) and dedupes silently against the same package — so the defect has a single origin and renaming all seven is a conservative over-fix, not a shotgun. The diagnosis stands.

All six v1 blockers are closed, and closed with measurement rather than prose:

B1 (vacuous warning check). Step 5 now requires the external probe manifest's existence/length/hash before, between and after both arms, an explicit "absence invalidates the witness" clause on the ce0 arm, and one private object store serving both arms through the same file:// URL with only the Radio revision differing. This is the correct control: the differential now fails loudly if /tmp/radio-bao-proof-parent-b933 has been reaped, instead of silently reporting a repair it never demonstrated. The explicit refusal to delete or alter that directory also prevents the measurement from destroying its own witness.

B2 (no feasible invocation mechanism). This is now measured, not proposed. prepare-crate in item 011 is a plain def, so it is not importable, and Nu requires source paths to be parse-time constants. The resolution — a child nu -c whose code string embeds a quoted literal path, making it constant at the child's parse time while exposing the private definition — is exactly right, and item 054 shows the literal code with item 048 showing exit 0 without Cargo. Items 034 and 032 confirm the six exported manifest/lock/probe copies match their inputs byte-for-byte, with 16/17 complete cyber-bao exports and only the function's own existing path = "../../hemera/rs" → version = "=0.3.1" substitution. The plan correctly marks this as mechanism-only and explicitly declines to rerun the codec matrix (which would be the broad gate this unit does not own). All five surrounding $receipt inputs I flagged are now enumerated in step 3 and frozen in item 032.

B3 (impossible metadata equality). Narrowed correctly. Byte-equality is now confined to reader stdout and production source/manifests/locks; the metadata comparison is an explicit enumerated substitution list (validated ce0/candidate revision tokens, two consumer IDs, consumer directories, admitted checkout-root prefixes, target/build/workspace directories) with path-boundary checks and no blanket regex. The clause requiring resolve-node IDs/edges to use those same exact substitutions is important and present — item 040 shows package ids and deps[].pkg strings carrying the full rev, so an inconsistent substitution would have silently broken the graph comparison. The admission that historical HTTPS vs. new local file:// URLs are intentionally different and are not an equality claim is the honest framing.

B4 (indices inconsistent with tree). historical-index-bindings.json (033) resolves this well. I checked its internal coherence: the seven rename rows' hashes/lengths match items 004–010 exactly; the two wrapper rows (/88 in research files.json, /618 in execution files.json) match items 012 and 013 and the selected index rows in 024/025; the repeated input indices (inputs.json, primary-inputs.json, seals-first.json, seals-final-inputs.json, two plan-input/manifest.json sections) are covered; and the pre-CODE verifier row is labeled distinctly as already_historical_variant_before_packaging pointing at review/code/verify-before-code.nu (7381 bytes, a different hash) rather than being conflated with the new wrapper. The planned_direct_check field makes each deliberate physical mismatch machine-readable. Original indices stay untouched, which is right given both 2026-10-12 files.json self-hash their own verifier.

B5 (contradictory default resolution). The per-script table in the Result section is now unambiguous and matches the code: both verifiers derive $own from FILE_PWD grandparent (items 012, 013) and must receive explicitly resolved paths, while the reproducer's ~/cyber/radio / ~/cyber/hemera defaults (item 011) are retained verbatim even from another worktree. The --live semantics are stated accurately: research checks HEAD equality and a clean tracked diff, execution checks HEAD only, and no new cleanliness assertion is invented. The explicit note that these must still fail against a later merged HEAD is the correct disclosure.

B6 (mislabeled snapshots). Renamed to historical-ce0-reader-before-runs.json / -after-runs.json (029, 030) with bytes and timestamps preserved; I confirmed both carry identical ce0 source hashes and identical kadek_parent, differing only in at (01:20:13 vs 01:23:51), so the new labels describe what they actually are. V1's frozen copies retain their original labels, and future arms get arm-specific names.

Scope discipline is accurate throughout: no Rust/API/spec/version change, no release or tag, no Kadek dependency update, soft3 part_of and Kadek's direct-consumer status stated, prior broad reds explicitly unrefreshed and not relabeled, and the warning-free claim bounded to the enumerated invocations. The staging design — copy only the selected capsule to a fresh /tmp directory, move the restored .txt files so no duplicate archived names remain, treat the entry-wrapper replacement as the sole intentional collision after an identity check, fail before replay on a pre-existing logical Cargo path or missing archive, and never create a Cargo.toml inside the real repository — is the right shape, and the failure probe plus before/after repository identity check give it teeth.

Advice (non-blocking, do not re-review)

• Still worth adopting the generalized invariant rather than only the basename inventory: assert that no tracked manifest anywhere declares a path dependency that is absolute or escapes the repository root. That is the actual defect class; the seven renames are one instance. It also covers quinn and nettools, which are workspace-excluded in item 015 but still enumerated by Cargo's Git source and were not supplied to me. Declining a global source-manifest cleanup for lack of evidence is defensible; adding a cheap guard is not the same expansion.
• Pair that with the audit-basename guard the response already proposes, so the next capsule commits Cargo.toml.txt from the outset instead of reintroducing this.
• In the failure probe, assert the real repository's audit/ tree hash is unchanged after the deliberate failure, not just that no Cargo.toml appeared — a staging bug that writes outside the disposable directory is the expensive one.
• Record nostd-parent/Cargo.toml.txt's absolute path as nonportable-but-reconstructable, as the response states, so no future agent "repairs" the frozen bytes. The response's refusal to call it permanently unreplayable is correct and better than v1's framing.
• When normalizing metadata, apply substitutions to the parsed JSON rather than the raw stdout, so a path-boundary check cannot accidentally match inside an unrelated string field. Item 040 contains both target_directory and many src_path values sharing the same prefix; structural substitution makes the old/new mapping auditable per field.
• Keep step 2's "complete committed tree comparison outside the allowed paths must be empty" literal and machine-checked, including root Cargo.toml, cyber-bao/Cargo.toml and root Cargo.lock as already specified. It remains the strongest single control here.

One standing limitation, already disclosed and not a blocker: the observed warning depends on a machine-local directory, so this witness is local and not universal. The plan says so, claims no isolated ring-0 radius, and bounds its verification target to archive preservation plus clean Git dependency discovery and the unchanged reader. That is the honest scope. Proceed to CODE.