clawlter/memory-symphony
Watch
1
0
Fork
You've already forked memory-symphony
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WIP: build: add reproducible artifact contract #9

Closed
clawlter wants to merge 13 commits from audit/reproducible-artifact-contract into main
pull from: audit/reproducible-artifact-contract
merge into: clawlter:main
Conversation 4 Commits 13 Files changed 27 +2174 -50
clawlter commented 2026-07-12 18:40:34 -04:00
Owner
Copy link

Scope

This PR remains Draft/WIP and must not be merged. It integrates the approved audit heads in serial order over main and preserves the reviewed final source and Git LFS artifact tree.

Clean history rewrite

The branch was force-rewritten at exact head 4747aadd4b453989c071e91d4dbe942d1d698790 to remove accidental operational backup paths from published PR history.

  • Exact approved R1 ancestor: a150e4db256fbdddcbe656f36674e434fadf7ee1
  • Exact approved R2 ancestor: 13a46f9461ca86d23051bdb5fc553501f93dd3f0
  • Exact approved R3 ancestor: b647dcaa46f20c37b753e62d1cbd6e137b454e55
  • New signed R2/R3 integration commits retain those approved heads as ordered merge ancestors; every newly authored logical commit is signed.
  • Every commit tree introduced by this PR was scanned for .ops-backup-* and operational temp/backup paths; none remain.
  • The rewritten final tree is byte-for-byte identical to the previously reviewed 8b5d5f9b3b63b8c48a625dee9566c8eccba860ef tree. The only removed historical content was the accidental operational backup directory.

Corrected R2 preview evidence

Direct inspection of exact approved R2 commit 13a46f9461ca86d23051bdb5fc553501f93dd3f0 proves build/audio/memory-symphony-preview.mp3 is an LFS pointer to:

sha256:ca16da1a2e43a393a01fd29fc464416e48b621e05344a6abcb5d8cf8444466bf

with size 32871644 bytes. The earlier ca16da1a2e43c152... claim is incorrect and is not a replacement object.

Artifact contract and verification

build/artifact-contract.json locks Git LFS object/content digests and semantic structure for all 35 deliverables (29 PDFs, 4 MIDI, 2 MP3). CI validates LFS integrity/contract behavior, generated source, strict vocabulary, project policy, and pinned LilyPond rendering without modifying tracked artifacts.

Completed locally on the rewritten exact head:

  • make test
  • python3 tools/verify_artifacts.py --require-hifi-input
  • git lfs fsck --objects
  • clean worktree, git fsck --strict, git diff --check, exact-ancestor and final-tree-equivalence checks

Forgejo CI on this rewritten exact head must reach terminal success before fresh independent review. No release asset was created or changed.

## Scope This PR remains Draft/WIP and must not be merged. It integrates the approved audit heads in serial order over `main` and preserves the reviewed final source and Git LFS artifact tree. ## Clean history rewrite The branch was force-rewritten at exact head `4747aadd4b453989c071e91d4dbe942d1d698790` to remove accidental operational backup paths from published PR history. - Exact approved R1 ancestor: `a150e4db256fbdddcbe656f36674e434fadf7ee1` - Exact approved R2 ancestor: `13a46f9461ca86d23051bdb5fc553501f93dd3f0` - Exact approved R3 ancestor: `b647dcaa46f20c37b753e62d1cbd6e137b454e55` - New signed R2/R3 integration commits retain those approved heads as ordered merge ancestors; every newly authored logical commit is signed. - Every commit tree introduced by this PR was scanned for `.ops-backup-*` and operational temp/backup paths; none remain. - The rewritten final tree is byte-for-byte identical to the previously reviewed `8b5d5f9b3b63b8c48a625dee9566c8eccba860ef` tree. The only removed historical content was the accidental operational backup directory. ## Corrected R2 preview evidence Direct inspection of exact approved R2 commit `13a46f9461ca86d23051bdb5fc553501f93dd3f0` proves `build/audio/memory-symphony-preview.mp3` is an LFS pointer to: `sha256:ca16da1a2e43a393a01fd29fc464416e48b621e05344a6abcb5d8cf8444466bf` with size `32871644` bytes. The earlier `ca16da1a2e43c152...` claim is incorrect and is not a replacement object. ## Artifact contract and verification `build/artifact-contract.json` locks Git LFS object/content digests and semantic structure for all 35 deliverables (29 PDFs, 4 MIDI, 2 MP3). CI validates LFS integrity/contract behavior, generated source, strict vocabulary, project policy, and pinned LilyPond rendering without modifying tracked artifacts. Completed locally on the rewritten exact head: - `make test` - `python3 tools/verify_artifacts.py --require-hifi-input` - `git lfs fsck --objects` - clean worktree, `git fsck --strict`, `git diff --check`, exact-ancestor and final-tree-equivalence checks Forgejo CI on this rewritten exact head must reach terminal success before fresh independent review. No release asset was created or changed.
build: add reproducible artifact contract
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 5m58s
Details
e107375095
clawlter force-pushed audit/reproducible-artifact-contract from e107375095
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 5m58s
Details
to 8575432cda
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 3m11s
Details
2026-07-12 21:16:34 -04:00 Compare
clawlter changed title from build: add reproducible artifact contract to WIP: build: add reproducible artifact contract 2026-07-12 21:17:33 -04:00
fix: remove ambient ffprobe CI dependency
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 22m28s
Details
ff9a694967
clawlter force-pushed audit/reproducible-artifact-contract from ff9a694967
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 22m28s
Details
to 4d98fe2774
Some checks failed
Score CI / Validate generated score artifacts (pull_request) Failing after 30m1s
Details
2026-07-13 10:55:09 -04:00 Compare
clawlter commented 2026-07-13 12:47:43 -04:00
Author
Owner
Copy link

Fresh R4 review requested for exact head 4d98fe2774d55c67474bbd5299a63166433ccc44 against base 12525be54d84c177128426a20d5c4f883c3402c7; no prior approval is being carried forward. Fresh-clone evidence: exact approved R1/R2/R3 heads were preserved in serial order, all 35 LFS objects fetched and passed git lfs fsck, make test and strict high-fidelity verification passed, and pinned LilyPond 2.26.0 rebuilt all 29 entrypoints with semantic comparison passing (1,102 s). All 12 branch-only commits verify signed, the scoped added-line secret scan found zero candidates, the tree is clean, and no release was created. Forgejo Score run 19 remains queued as Waiting to run; approval/integration must wait for terminal-green CI on this exact head. The supported title-prefix Draft state remains intact.

Fresh R4 review requested for exact head `4d98fe2774d55c67474bbd5299a63166433ccc44` against base `12525be54d84c177128426a20d5c4f883c3402c7`; no prior approval is being carried forward. Fresh-clone evidence: exact approved R1/R2/R3 heads were preserved in serial order, all 35 LFS objects fetched and passed `git lfs fsck`, `make test` and strict high-fidelity verification passed, and pinned LilyPond 2.26.0 rebuilt all 29 entrypoints with semantic comparison passing (1,102 s). All 12 branch-only commits verify signed, the scoped added-line secret scan found zero candidates, the tree is clean, and no release was created. Forgejo Score run 19 remains queued as `Waiting to run`; approval/integration must wait for terminal-green CI on this exact head. The supported title-prefix Draft state remains intact.
ci: allow full semantic validation to complete
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 34m22s
Details
8b5d5f9b3b
clawlter force-pushed audit/reproducible-artifact-contract from 8b5d5f9b3b
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 34m22s
Details
to 4747aadd4b
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 26m46s
Details
2026-07-13 16:13:31 -04:00 Compare
clawlter commented 2026-07-13 16:47:38 -04:00
Author
Owner
Copy link

History-remediation verification is complete for rewritten exact head 4747aadd4b453989c071e91d4dbe942d1d698790. Forgejo pull-request CI run 21 (https://code.mehalter.com/clawlter/memory-symphony/actions/runs/21) reached terminal success. The branch retains exact approved R1 a150e4db256fbdddcbe656f36674e434fadf7ee1, R2 13a46f9461ca86d23051bdb5fc553501f93dd3f0, and R3 b647dcaa46f20c37b753e62d1cbd6e137b454e55 as serialized ancestors; all newly authored commits are signed; every PR commit tree was scanned clean of operational backup/temp paths; and the final tree matches the prior reviewed head exactly. Correct R2 preview evidence is sha256:ca16da1a2e43a393a01fd29fc464416e48b621e05344a6abcb5d8cf8444466bf, size 32871644; do not use the earlier ca16da1a2e43c152... claim. Fresh independent review is now required; do not merge.

History-remediation verification is complete for rewritten exact head `4747aadd4b453989c071e91d4dbe942d1d698790`. Forgejo pull-request CI run 21 (`https://code.mehalter.com/clawlter/memory-symphony/actions/runs/21`) reached terminal `success`. The branch retains exact approved R1 `a150e4db256fbdddcbe656f36674e434fadf7ee1`, R2 `13a46f9461ca86d23051bdb5fc553501f93dd3f0`, and R3 `b647dcaa46f20c37b753e62d1cbd6e137b454e55` as serialized ancestors; all newly authored commits are signed; every PR commit tree was scanned clean of operational backup/temp paths; and the final tree matches the prior reviewed head exactly. Correct R2 preview evidence is `sha256:ca16da1a2e43a393a01fd29fc464416e48b621e05344a6abcb5d8cf8444466bf`, size `32871644`; do not use the earlier `ca16da1a2e43c152...` claim. Fresh independent review is now required; do not merge.
mehalter approved these changes 2026-07-13 22:03:34 -04:00
clawlter commented 2026-07-14 08:16:38 -04:00
Author
Owner
Copy link

Closing without merge because the owner cancelled the code-security-audit-2026-07 campaign. This does not revert previously merged work.

Closing without merge because the owner cancelled the `code-security-audit-2026-07` campaign. This does not revert previously merged work.
clawlter closed this pull request 2026-07-14 08:16:38 -04:00
All checks were successful
Score CI / Validate generated score artifacts (pull_request) Successful in 26m46s
Required
Details

Pull request closed

This pull request cannot be reopened because the branch was deleted.
Sign in to join this conversation.
Reviewers
No reviewers
mehalter
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
clawlter/memory-symphony!9
No description provided.