Set 10 Live Source Drift Bundle

Live-source drift is recomputed across copied inputs

copies of four internal control source files are checked against the source they were copied from. This component checks whether a small set of copies of internal control source files still match the current source they were copied from. The copies are exact Python bodies for four files: the option-surface router, the mission-transaction landing preflight, the work landing controller, and the work log controller.

Three engines separate source, projection, and ceiling

Three questions at once: do the bytes still match the current digest, do the copies still compile, and do they still carry their named surfaces. It answers three questions about those copies at once. Do their bytes still match the current source digest? Do they still compile as Python without being imported or run? Do they still contain the named command and contract surfaces they are supposed to carry? It emits a result record with the digest rows, compile status, anchor checks, and the scope limit, and no copied source body.

A green result remains fixture-bound

It is built to go red: when the source moves ahead of the copies, the failed digest check is the signal to refresh them. The component is built to go red. When the current source moves ahead of the copies, the digest check fails on purpose, and that red result is the signal to refresh the copies through the exact-copy source lane. It is a drift sentinel, not a one-off snapshot.

Purpose

Why a stale copy looks fine

A copy can compile and match one recorded digest while being weeks behind the file it mirrors, so weak checks pass it. Copied source drifts silently. A public copy of a control file can look fine, compile fine, and still be weeks behind the file it claims to mirror. A loose check that only asks "is this valid Python?" passes a stale copy. A check that only compares one recorded digest can pass a copy whose recorded digest was itself never refreshed.

Current and stale digests in one row

Each row holds the current and the earlier stale digest side by side, so proof of freshness and evidence of past drift cannot be erased. This component makes drift visible instead of hiding it. Each digest row keeps two fingerprints side by side: the current source digest, and the stale digest that was recorded earlier. The row passes only when the copied body matches the current digest, and it separately asserts that the stale digest differs from the current one. The proof of freshness and the evidence of the earlier drift sit in the same row, so a refresh cannot quietly erase the fact that the copy was once behind.

How it works

Two entry points into _evaluate

Both entry points forward to run_crown_jewel_organ, and _evaluate loads the manifest and copied texts, then runs four engines in order. run and run_batch10_live_source_drift_bundle are the two entry points. Both forward to run_crown_jewel_organ with the shared SPEC, an _evaluate function, and evaluate_negative_case. _evaluate loads the probe manifest and the copied source texts, then runs four engines in order and collects their findings.

Per-row digest agreement in _digest_refresh_matrix

A row passes only when copied, target, and current digests all agree and the stale digest differs from the current one. _digest_refresh_matrix builds one row per copied file. For each row it reads the current source digest and the stale recorded digest from the probe manifest, and the copied and target digests from the source manifest. A row's current_matches_copy is true only when the current digest is non-empty and the copied digest, the target digest, and the current digest all agree and the manifest marks the target as matching. Its stale_differs_from_current is true when a stale digest exists and differs from the current one. The engine rejects a copy whose body no longer matches the current digest, a row whose stale digest was allowed to equal the current one, duplicate rows, missing rows, unexpected rows, and a row count that does not match the four expected files.

Compile without import in _compile_gate

Each copied file is compiled with py_compile into a throwaway directory but never imported, so malformed bodies are caught without running any code. _compile_gate compiles each copied file with py_compile.compile into a throwaway temporary directory with doraise=True. It never imports the module, so a malformed body is caught without executing any copied code. import_executed stays false in the result. It rejects a missing target, a non-.py target, and any body that fails to compile.

Named surfaces checked by substring

Substring checks confirm each copy still carries its named command and contract surfaces, so a compiling body that quietly dropped one still fails. _control_surface_anchor_matrix runs substring checks over each copied body. It confirms that each file still exposes the command and contract surfaces it is supposed to carry, for example def build_option_surface and option_surface_lens_packet_v0 in the option-surface router, or def cmd_session_finalize and read_receipt_id in the work log controller. A copy that compiles but has quietly lost a command or contract surface still fails here.

Authority flags held false by _claim_ceiling_gate

Eleven authority flags must be false and body_in_receipt false, keeping every copied body a validator input and nothing more. _claim_ceiling_gate reads the scope limit policy from the probe manifest and checks that eleven authority flags are all false, that body_in_receipt is false, and that body_import_authority is copied_source_body_only. This is the gate that keeps a copied body a validator input and nothing more.

Aggregation and the compact result card

_evaluate blocks the whole result if any engine or structural check fails, and result_card projects the status plus four counts into a card. _evaluate then confirms all four engine ids are present and that the source manifest declares exactly four modules. If any engine is blocked or any structural check fails, the whole result is blocked. result_card projects the pass or blocked status plus engine_count, copied_macro_source_module_count, stale_digest_count, and compiled_module_count into a compact card.

flowchart TD A["Probe manifest current + stale digests, authority policy"] --> C B["Copied bodies and source manifest"] --> C C["_digest_refresh_matrix copied = target = current, stale differs from current"] --> F B --> D["_compile_gate py_compile, no import"] B --> E["_control_surface_anchor_matrix named surfaces present"] A --> G["_claim_ceiling_gate authority flags false"] D --> F E --> F G --> F F["_evaluate all engines pass, four modules present"] --> H["metadata-only result and card"] C -. mismatch .-> I["Blocked: refresh copies via exact-copy source lane"]

Negative cases

Perturbing a copy, never the fixtures

The bundle is copied into a temporary workspace and perturbed there, so the on-disk fixtures stay untouched while four cases must be rejected. evaluate_negative_case copies the bundle into a temporary workspace and perturbs it, so the fixtures on disk are never mutated. Four cases must all be rejected.

stale_digest_replay collapses the two digests

Setting a row's stale digest equal to its current one must make all_stale_digests_differ report false. stale_digest_replay sets a row's stale digest equal to its current digest. The digest engine must then report all_stale_digests_differ as false. Expected code BATCH10_LIVE_SOURCE_DRIFT_STALE_DIGEST_REPLAY_REFUSED.

compile_bypass hides invalid Python behind anchors

A body with the right anchors but invalid Python, digest refreshed, must be caught only by the compile engine counting fewer modules. compile_bypass overwrites one copied body with text that carries the right anchor comments but is invalid Python, and refreshes its digest so only the compile check can catch it. The compile engine must then compile fewer modules than it counted. Expected code BATCH10_LIVE_SOURCE_DRIFT_COMPILE_BYPASS_REFUSED.

private_runtime_state_export flips an authority flag

Turning on the runtime-state-export authorization flag in the policy must be rejected by the scope limit gate. private_runtime_state_export sets private_runtime_state_export_authorized to true in the policy. The scope limit gate must reject it. Expected code BATCH10_LIVE_SOURCE_DRIFT_PRIVATE_RUNTIME_EXPORT_REFUSED.

live_mutation_authority_claim raises three mutation flags

Setting the work log mutation, source-file changes, and mission execution flags true must all be rejected by the scope limit gate. live_mutation_authority_claim sets the work log mutation, source-file changes, and mission execution flags to true. The scope limit gate must reject all three. Expected code BATCH10_LIVE_SOURCE_DRIFT_MUTATION_AUTHORITY_REFUSED.

Prior Art Grounding

Reproducible-build and supply-chain provenance practice

The discipline comes from reproducible builds and supply-chain provenance: declare inputs, fingerprint them, check artifacts against the fingerprints, and keep the stale digest visible as a fixture. The pattern comes from reproducible-build and supply-chain provenance practice: declare the source inputs, fingerprint them, check copied or generated artifacts against those fingerprints, and keep private state out of the result record. Two useful anchors are Bazel hermeticity, for its emphasis on declared inputs and repeatable outputs, and SLSA provenance, for recording how an artifact relates to its build inputs. This component applies that discipline to live source-copy drift, and keeps the stale digest visible as a regression fixture rather than overwriting it.

Validation Result record Path

Run from the microcosm-substrate/ public root.

What a pass and a blocked result mean

A pass writes four record types and rejects the negatives, while a blocked result is the valid drift signal to refresh the copies and rerun. A pass writes digest-refresh, compile-gate, anchor-matrix, and scope limit records and confirms the four negative cases are rejected. A blocked result is a valid outcome when the copies have fallen behind the current source: it is the signal to refresh the copied bodies and manifest digests through the exact-copy source lane and rerun, not a defect in this page. When the sentinel is blocked, the focused test is expected to fail on pass-status or exact-body equality and should be reported with the same refresh residual.