soft3/radio/audit/2026-10-13-audit-cargo-packaging/code-input/inputs/026.txt

# Independent PLAN Review v2 — `audit-cargo-packaging`

## Verdict: APPROVE

I re-derived the causal chain from the supplied bodies rather than trusting the narrative. Item 006 (`nostd-parent/Cargo.toml`, line 7) declares `cyber-bao = { path = "/tmp/radio-bao-proof-parent-b933/cyber-bao", default-features = false }`. Cargo's Git source enumerates every manifest in a checkout and recursively resolves their path dependencies; that absolute path resolves outside the checkout to a second on-disk `cyber-bao v0.1.0`, producing exactly the text in `records/consumer-ce0-lock.stderr` (038) and `-metadata.stderr` (041). The other six manifests use `../../../cyber-bao`, which resolves to the checkout's own `cyber-bao/Cargo.toml` (016) and dedupes silently against the same package — so the defect has a single origin and renaming all seven is a conservative over-fix, not a shotgun. The diagnosis stands.

All six v1 blockers are closed, and closed with measurement rather than prose:

**B1 (vacuous warning check).** Step 5 now requires the external probe manifest's existence/length/hash before, between and after both arms, an explicit "absence invalidates the witness" clause on the ce0 arm, and one private object store serving both arms through the same `file://` URL with only the Radio revision differing. This is the correct control: the differential now fails loudly if `/tmp/radio-bao-proof-parent-b933` has been reaped, instead of silently reporting a repair it never demonstrated. The explicit refusal to delete or alter that directory also prevents the measurement from destroying its own witness.

**B2 (no feasible invocation mechanism).** This is now *measured*, not proposed. `prepare-crate` in item 011 is a plain `def`, so it is not importable, and Nu requires `source` paths to be parse-time constants. The resolution — a child `nu -c` whose code string embeds a quoted literal path, making it constant at the child's parse time while exposing the private definition — is exactly right, and item 054 shows the literal code with item 048 showing exit 0 without Cargo. Items 034 and 032 confirm the six exported manifest/lock/probe copies match their inputs byte-for-byte, with 16/17 complete `cyber-bao` exports and only the function's own existing `path = "../../hemera/rs"` → `version = "=0.3.1"` substitution. The plan correctly marks this as mechanism-only and explicitly declines to rerun the codec matrix (which would be the broad gate this unit does not own). All five surrounding `$receipt` inputs I flagged are now enumerated in step 3 and frozen in item 032.

**B3 (impossible metadata equality).** Narrowed correctly. Byte-equality is now confined to reader stdout and production source/manifests/locks; the metadata comparison is an explicit enumerated substitution list (validated ce0/candidate revision tokens, two consumer IDs, consumer directories, admitted checkout-root prefixes, target/build/workspace directories) with path-boundary checks and no blanket regex. The clause requiring resolve-node IDs/edges to use *those same exact* substitutions is important and present — item 040 shows package ids and `deps[].pkg` strings carrying the full rev, so an inconsistent substitution would have silently broken the graph comparison. The admission that historical HTTPS vs. new local `file://` URLs are intentionally different and are not an equality claim is the honest framing.

**B4 (indices inconsistent with tree).** `historical-index-bindings.json` (033) resolves this well. I checked its internal coherence: the seven rename rows' hashes/lengths match items 004–010 exactly; the two wrapper rows (`/88` in research `files.json`, `/618` in execution `files.json`) match items 012 and 013 and the selected index rows in 024/025; the repeated input indices (`inputs.json`, `primary-inputs.json`, `seals-first.json`, `seals-final-inputs.json`, two `plan-input/manifest.json` sections) are covered; and the pre-CODE verifier row is labeled distinctly as `already_historical_variant_before_packaging` pointing at `review/code/verify-before-code.nu` (7381 bytes, a different hash) rather than being conflated with the new wrapper. The `planned_direct_check` field makes each deliberate physical mismatch machine-readable. Original indices stay untouched, which is right given both 2026-10-12 `files.json` self-hash their own verifier.

**B5 (contradictory default resolution).** The per-script table in the Result section is now unambiguous and matches the code: both verifiers derive `$own` from `FILE_PWD` grandparent (items 012, 013) and must receive explicitly resolved paths, while the reproducer's `~/cyber/radio` / `~/cyber/hemera` defaults (item 011) are retained verbatim even from another worktree. The `--live` semantics are stated accurately: research checks HEAD equality *and* a clean tracked diff, execution checks HEAD only, and no new cleanliness assertion is invented. The explicit note that these must still fail against a later merged HEAD is the correct disclosure.

**B6 (mislabeled snapshots).** Renamed to `historical-ce0-reader-before-runs.json` / `-after-runs.json` (029, 030) with bytes and timestamps preserved; I confirmed both carry identical ce0 source hashes and identical `kadek_parent`, differing only in `at` (01:20:13 vs 01:23:51), so the new labels describe what they actually are. V1's frozen copies retain their original labels, and future arms get arm-specific names.

Scope discipline is accurate throughout: no Rust/API/spec/version change, no release or tag, no Kadek dependency update, soft3 `part_of` and Kadek's direct-consumer status stated, prior broad reds explicitly unrefreshed and not relabeled, and the warning-free claim bounded to the enumerated invocations. The staging design — copy only the selected capsule to a fresh `/tmp` directory, *move* the restored `.txt` files so no duplicate archived names remain, treat the entry-wrapper replacement as the sole intentional collision after an identity check, fail before replay on a pre-existing logical Cargo path or missing archive, and never create a `Cargo.toml` inside the real repository — is the right shape, and the failure probe plus before/after repository identity check give it teeth.

## Advice (non-blocking, do not re-review)

- Still worth adopting the generalized invariant rather than only the basename inventory: assert that no tracked manifest anywhere declares a path dependency that is absolute or escapes the repository root. That is the actual defect class; the seven renames are one instance. It also covers `quinn` and `nettools`, which are workspace-`exclude`d in item 015 but still enumerated by Cargo's Git source and were not supplied to me. Declining a global source-manifest *cleanup* for lack of evidence is defensible; adding a cheap *guard* is not the same expansion.
- Pair that with the audit-basename guard the response already proposes, so the next capsule commits `Cargo.toml.txt` from the outset instead of reintroducing this.
- In the failure probe, assert the real repository's `audit/` tree hash is unchanged after the deliberate failure, not just that no `Cargo.toml` appeared — a staging bug that writes *outside* the disposable directory is the expensive one.
- Record `nostd-parent/Cargo.toml.txt`'s absolute path as nonportable-but-reconstructable, as the response states, so no future agent "repairs" the frozen bytes. The response's refusal to call it permanently unreplayable is correct and better than v1's framing.
- When normalizing metadata, apply substitutions to the parsed JSON rather than the raw stdout, so a path-boundary check cannot accidentally match inside an unrelated string field. Item 040 contains both `target_directory` and many `src_path` values sharing the same prefix; structural substitution makes the old/new mapping auditable per field.
- Keep step 2's "complete committed tree comparison outside the allowed paths must be empty" literal and machine-checked, including root `Cargo.toml`, `cyber-bao/Cargo.toml` and root `Cargo.lock` as already specified. It remains the strongest single control here.

One standing limitation, already disclosed and not a blocker: the observed warning depends on a machine-local directory, so this witness is local and not universal. The plan says so, claims no isolated ring-0 radius, and bounds its verification target to archive preservation plus clean Git dependency discovery and the unchanged reader. That is the honest scope. Proceed to CODE.