ARCADIA-Studio/harness/release-packaging-independent-review-20260910.md

Independent packaging review — 2026-09-10

Codex-9e8r6t /root/behavior_audit. This is the same local host as /root/release_audit, and a separate session from Codex-956atf. Root assigned a bounded independent review while cross-host scenario work remains pending. Reviewed current scripts, their delta/tests, deployment files, the implementation report, issue #1 and the release-readiness Wiki. Production files were read-only; findings were sent directly to the owner. No Cargo, Docker, application build or native application execution occurred. All probes used inert files under .local/packaging-independent-review-20260910/ or the standalone synthetic notice test's reported temporary directory.

Final result: four concrete defects reproduced, corrected by /root/release_audit, and independently reverified. No remaining actionable defect was established within this bounded review. This closes the findings below, not the separate native Linux/container release gates.

Ranked verified findings

P2 — Docker notice verification omitted shared build inputs and newly added crate files

Locations: scripts/package-artifacts.py::verify_notices, scripts/windows-notices.ps1::Get-ArcadiaNotices, deployment/Dockerfile COPY/build steps. Real consumers are crates/oa-server/build.rs:1 (../../build/windows_manifest.rs) and crates/oa-server/src/routes.rs:110 (embedded docs/openapi.json).

Before: a valid notice fixture still passed after changing root Cargo.toml, shared build script, embedded OpenAPI, or adding crates/oa-server/src/bin/new_tool.rs. The control mutation of an already listed src/main.rs correctly failed. Verification compared only listed local crate hashes, although Docker consumed additional files. This contradicted the stated refusal of stale source inventories; it was not a runtime or license-interpretation finding.

Owner's correction: inventory root Cargo.toml/Cargo.lock/LICENSE, build/** and embedded OpenAPI, then compare the complete shared and local-crate file sets and hashes using the same exclusions as collection. Independently reverified: unchanged fixture passes; all five source mutations/additions refuse. Evidence: probe.py records the original hole; probe_after.py uses the expanded inventory and confirms refusal.

Acceptance: the prepared notice bundle must cease to validate whenever a shared consumed file changes, a local source is added/removed, or an existing recorded file changes. A regenerated matching inventory must validate.

P2 — Documentation root inputs could follow an ancestor junction outside the checkout

Locations: scripts/package-artifacts.py::ordinary and document_inputs; scripts/package-common.ps1::Copy-PackageInputs. Initial README/root collection applied a leaf symlink check but skipped the resolved repository-containment check used for recursively linked files. A leaf inside a Windows directory junction is not itself a symlink/reparse point.

Before: an actual Windows junction from an inert fixture's repository/examples to sibling external-sentinel caused the mocked tracked examples/sentinel.txt to be returned as a package input even though its resolved path was outside that fixture repository. This is a concrete unintended-file inclusion boundary; no real private file was opened or included. The real repository documentation closure did not contain an escaping input in this review.

Owner added ancestor reparse checks plus uniform root/README/linked-file containment, including both PowerShell copy paths. Independently reverified with the actual Windows junction: the input now refuses at repository/examples; the ordinary actual product closure still passes unchanged.

Acceptance: the same tracked-path/junction fixture must refuse before copying; ordinary in-repository README, example and linked-document files must retain their current closure. Windows and Linux entry points must share the ordinary-input rule.

P2 — Valid HTML attributes bypassed the documentation link check

Location: scripts/package-artifacts.py::local_links.

Before: <a href = "missing.html">Missing</a> produced checked_local_document_links: 0 and passed. The original regex required exact lowercase, adjacent, quoted attribute syntax. This was a parser-contract defect demonstrated synthetically, not an observed broken link in today's bundle.

Owner replaced HTML parsing with stdlib HTMLParser, including inline HTML in Markdown, and added attribute-variant coverage; unsupported HTML base URLs now refuse explicitly. Independently reverified: the same missing-file input now refuses. Current real documentation closures still pass.

Acceptance: equivalent whitespace/case/quoting forms must resolve the same local target; a missing target must fail regardless of its valid HTML attribute spelling.

P3 — Tar readback could report unchanged staging after a file addition

Location: scripts/package-artifacts.py::make_archive, final stage verification.

Before: an isolated hook added late-file.txt to staging at archive readback. The helper returned one archived file and claimed stage unchanged, although the stage now held two files. Existing file hashes were rechecked, but the file set was not enumerated again. The archive's existing bytes/modes were correct; the specific unchanged-stage assertion was too strong.

Owner added a final file-set comparison. Independently reverified: the same late-addition hook now refuses with Stage changed while archiving or archive incomplete; unchanged archive/determinism tests pass.

Acceptance: an added or removed file during archiving/readback must fail unchanged-stage verification; unchanged inputs must keep deterministic bytes and refusal to overwrite existing archives.

Independent evidence and limits

• Final standalone Python suite passed 11/11 (0.586 s); the PowerShell notice contract script passed all normal/build and server-only selection, runtime, archive, embedded-font, actual-source, unsupported-source, traversal and supplement checks again. Its final inert fixture was retained at C:/Temp/arcadia-notices-1257d0d322b54d3e8431544c9267acc9. The shell lacked a python PATH alias, so Python was explicitly selected from the bundled workspace runtime; this was an environment selection issue, not a packaging failure.
• Final independent refusal outputs are retained in .local/packaging-independent-review-20260910/final-probes.json; actual documentation results are in final-closure.json. Baseline notices pass; changed root manifest, shared build script, OpenAPI, recorded source, added source, missing HTML target, escaping junction and late archive addition all refuse as intended.
• closure.py independently copied and checked the actual product documentation. Windows: 63 files, 15 local file links. Linux: 62 files, 13 local file links. Both include all 49 example files, including 37 teaching files, with zero harness files and zero input paths resolving outside this repository. Their stages remain under the review's .local directory. This establishes the current reachable file closure; fragment anchors and third-party license source-tree links remain outside the stated check.
• Independently ran the helper's ELF inspection on the preserved historical GUI at .local/cross-linux-qa/gui-runs/20260907T1025486926611Z/package/arcadia-studio: 72,953,296 bytes, SHA256 330a3872d48ebf24ad21e6d4fa13cb6098bebb3cb7ff82a2e082925ccf3dd346, expected x86-64 glibc interpreter, five allowed direct imports, no RPATH/RUNPATH. Observed GLIBC strings agree with the old report's 2.28 maximum. No additional concrete ELF defect was established within the helper's explicitly static scope.
• Reviewed fresh-output checks, exclusive claim creation, CreateNew/xb archive creation, input hash checks, deterministic tar metadata and archive readback. Existing-path refusal is tested without changing the existing archive. Partial outputs/claims intentionally remain, as the platform guides state.
• BuildEvidence checks actual binary hashes and target and explicitly labels source/profile/compiler as caller assertions. Package metadata and guides do not turn an old/development binary, a notice inventory, static ELF inspection, or successful archiving into current optimized/native release acceptance. These qualifications are material and should remain.
• Docker's ordinary context is substantially narrowed and excludes root .local and unrelated directories; the named context is explicitly prepared notices. A real Docker build/runtime and current full Linux desktop/server package remain unexecuted release gates, as the implementation report states. This review did not invent native evidence from source inspection.

No scenario, palette, root ledger, README or guide changes were made by this reviewer. The packaging owner owns the corrections and their implementation report; root owns native acceptance and integration.