[EmergentMonk]

Scope

Harden the existing legacy observation lane while both private-observation gates remain pending. This does not expand the held Phase 6C ladder or begin Phase 7.

• Bind every retained MIDI per-stem receipt by artifact-relative path and SHA-256, then cross-check its input, revision, status and bounded execution fields against the donor summary.
• Require each candidate representative to match one donor corpus member by ID, name, hash and size.
• Apply the existing raw IT/audio rejection at the MIDI pre-upload boundary, including renamed WAV/IT payloads; reuse the same guard during closeout.
• Check historical donor source_revision and retained itmodule2.c against the committed workflow-head blob. Retain probe hash/file-type checks without claiming independent rebuild provenance.

Verification

Passed locally using ordinary Python tests and project-owned inert metadata/header markers:

• tests/phase6c_legacy_module_import.py
• tests/phase6c_historical_it.py
• tests/phase6c_midi_corpus.py
• tests/phase6c_legacy_closeout.py
• tests/phase6d_parity_report.py (23 tests)
• scripts/phase6c-validate-matrix.py
• scripts/phase6c-legacy-closeout.py
• git diff --check

Independent prepublication review found no blocking issues. Existing CI path filters cover all changed files. Hosted checks and exact-final-head review remain required before merge.

Preserved boundaries

ROADMAP, parity classifications, closeout ledger, frozen manifests/fixtures/evidence, and both native source trees are unchanged. Both observation gates remain PENDING_PRIVATE_DISPATCH, the hold remains AWAITING_OBSERVATION_REVIEW, and parity remains UNKNOWN. No private corpus was processed and no historical evidence was backfilled. Older MIDI artifacts without the new bindings fail closed and require a fresh workflow run.

Historical donor probe hashes and ELF magic establish retained-artifact consistency only. A self-consistent substituted ELF is still outside the proof supplied here; independent donor rebuild provenance remains unresolved. The new tests do not claim native execution, compatibility, or private-observation completion.

Summary by Sourcery

Strengthen legacy Phase 6C evidence validation without advancing the observation gates or claiming private-observation completion.

Bug Fixes:

• Reject raw IT and audio payloads at both MIDI pre-upload and legacy closeout boundaries, including files with renamed extensions or recognized headers.
• Fail closed when retained MIDI observations are missing, tampered with, unbound, or inconsistent with their donor summaries.
• Reject candidate representatives that do not exactly match a member of the donor corpus.

Enhancements:

• Bind retained MIDI per-stem observations to artifact-relative paths and SHA-256 hashes while validating their identity and bounded execution fields.
• Validate historical donor source revision and committed source bytes, while preserving the distinction between artifact consistency and independent rebuild provenance.

Documentation:

• Document the strengthened MIDI evidence bindings, raw-payload rejection rules, and remaining donor build-provenance limitation.

Tests:

• Expand legacy closeout and MIDI corpus tests to cover renamed raw payloads, retained observation integrity, path traversal and symlink defenses, representative matching, and historical source identity checks.

[sourcery-ai]

Reviewer's Guide

The PR hardens Phase 6C legacy evidence validation by cryptographically binding retained MIDI receipts and representatives, sharing raw IT/audio rejection across upload and closeout, and tying historical donor source metadata to the committed workflow head while explicitly leaving independent donor rebuild provenance unresolved.

Sequence diagram for Phase 6C evidence validation

sequenceDiagram
    participant Workflow as MIDI workflow
    participant Corpus as phase6c-midi-corpus.py
    participant Summary as Donor summary
    participant Receipt as Retained observation
    participant Candidate as Candidate representative
    participant Git as Committed workflow head

    Workflow->>Corpus: audit_public_tree
    Corpus-->>Workflow: Reject raw IT/audio or structural MIDI payloads
    Workflow->>Summary: donor_summary
    Summary->>Receipt: sha256_file
    Receipt-->>Summary: Relative path and SHA-256 binding
    Summary->>Git: validate_donor_source_identity
    Git-->>Summary: source_revision and committed itmodule2.c bytes
    Summary->>Receipt: require_support
    Receipt-->>Summary: Recheck identity and execution fields
    Summary->>Candidate: Match ID, name, hash, and size
    Candidate-->>Summary: Exactly one donor corpus member
    Summary-->>Workflow: Validated evidence or fail closed

Loading

File-Level Changes

Change	Details	Files
Bind retained MIDI observations to summaries and donor corpus members before revalidation succeeds.	Record each observation’s artifact-relative path and SHA-256 in donor summaries. Validate retained observation schema, identity, source, execution, projection, and render fields against the summary. Require candidate representative identity to match exactly one donor stem by ID, name, hash, and size. Reject missing, altered, path-escaping, or symlinked observation support files.	scripts/phase6c-midi-corpus.py tests/phase6c_midi_corpus.py
Strengthen raw payload filtering and reuse the pre-upload audit during legacy closeout.	Reject IT and WAV extensions plus recognized IT, RIFF/WAVE, RIFX/WAVE, and RF64/WAVE headers, including renamed payloads. Replace closeout’s duplicate raw-payload scan with the shared MIDI corpus audit. Add regression coverage for renamed and header-marked raw payloads.	scripts/phase6c-midi-corpus.py scripts/phase6c-legacy-closeout.py tests/phase6c_midi_corpus.py tests/phase6c_legacy_closeout.py phase6c/LEGACY_CLOSEOUT.md
Bind historical donor source metadata to the committed workflow-head source while preserving the build-provenance limitation.	Require donor source_revision to equal the checked-out repository HEAD. Hash the committed itmodule2.c blob at that revision and compare it with the retained source hash. Retain the probe hash and ELF magic check as consistency checks only, without asserting rebuild provenance. Test revision mismatch, substituted source, and non-ELF probe failures.	scripts/phase6c-historical-it.py tests/phase6c_legacy_closeout.py phase6c/LEGACY_CLOSEOUT.md
Update inert fixtures and test data to exercise the strengthened contracts.	Add retained observation receipts and their summary projections to canonical MIDI fixtures. Use donor corpus members as candidate representatives. Add negative cases covering receipt mutations, invalid paths, linked files, and representative mismatches.	tests/phase6c_midi_corpus.py tests/phase6c_legacy_closeout.py

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[EmergentMonk]

@codex Please Review this exact SHA de22ace against the existing contract. Report only actionable correctness defects, with a minimal reproduction, expected versus actual behavior, and affected lines. State whether each reproduction was executed or statically inferred. Don’t repeat fixed findings without a new failing case. Keep architectural suggestions separate and non-blocking.

[EmergentMonk]

@sourcery-ai review

Please assess exact head de22ace for actionable correctness defects in the current evidence-integrity contract. Keep the documented private-observation holds and unresolved donor rebuild-provenance boundary intact.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T18:13:06.523826Z	de22ace	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-13T18:14:00.510685Z	de22ace	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep it up!

Reviewed commit: de22ace3bf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sourcery-ai]

Sorry @EmergentMonk, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 8 hours and 50 minutes by commenting @sourcery-ai review. Upgrade to get a review now.