[schickling-assistant]

Scope and immutable source

R2-A follows the bounded prerequisite R2-P at 60f16f9. MIRROR source: Fractal 787e8ed592dff34d2bdc2a2b0b584482da567e7f. Exactly ten verbatim copied paths plus the inseparable fractal-fixture URL/lock bump. No checker, provenance, release metadata, path adaptation, Rust behavior or record-format changes in this PR. All copies and fixture activation must be one commit, not separate red intermediate commits.

Per-path byte comparison

Per-path git show, sha256sum(source bytes), sha256sum(local file) and git hash-object each exited 0. Exact equivalent replay command:

for p in .st/evidence-signed-only.json .st/evidence-skip-policy.json .st/required-lanes.json .st/rust-test-inputs.json scripts/evidence-sign scripts/evidence-sign-hardening-test scripts/evidence-verify-test scripts/evidence-wrap-test scripts/lane-definition-closure scripts/st-test; do
  case "$p" in .st/*) q="tests/fixtures/fractal/$p";; *) q="$p";; esac
  echo "$p"
  git --git-dir="$FRACTAL_GIT_DIR" show "787e8ed592dff34d2bdc2a2b0b584482da567e7f:$p" | sha256sum
  sha256sum "./$q"
  git hash-object "./$q"
done

The two SHA-256 columns are actual independently computed values, not expected placeholders. Git blob IDs also match source; executable modes match git ls-tree.

Fractal original	Destination	Fractal SHA-256	Local SHA-256	Matching Git blob	Mode
.st/evidence-signed-only.json	tests/fixtures/fractal/.st/evidence-signed-only.json	f2a362511801381d16706b5089473be00c59b065532af4a66dfc95c8ff7ad2a4	f2a362511801381d16706b5089473be00c59b065532af4a66dfc95c8ff7ad2a4	f6f32f5e5cdfa0d7402e3d2f0297fbf5d333e278	100644
.st/evidence-skip-policy.json	tests/fixtures/fractal/.st/evidence-skip-policy.json	089bab2a631759e9c57689c601c4f77065813e9042c6cf8f98c99ba5abe91d3e	089bab2a631759e9c57689c601c4f77065813e9042c6cf8f98c99ba5abe91d3e	1b5e25c3928c7db6e5922d8d5edd16e8520823fb	100644
.st/required-lanes.json	tests/fixtures/fractal/.st/required-lanes.json	5b1301ef6f6b70f086df064cdd3d727c437a1975b4662a691aad4ea4ddd8c8ab	5b1301ef6f6b70f086df064cdd3d727c437a1975b4662a691aad4ea4ddd8c8ab	f3784896b86395a8e188c453d720fea70d9fe72b	100644
.st/rust-test-inputs.json	tests/fixtures/fractal/.st/rust-test-inputs.json	2c8095e62cf7f829d5e46a5e5a4db442630db01a3282417ad40e6edc09eac406	2c8095e62cf7f829d5e46a5e5a4db442630db01a3282417ad40e6edc09eac406	04e700374f2affdc00c9d8f6d016b66c40bcc95f	100644
scripts/evidence-sign	scripts/evidence-sign	c31b6d910ef975619e09738e00dc0f491363f778bf9349d17d826529d930953c	c31b6d910ef975619e09738e00dc0f491363f778bf9349d17d826529d930953c	ea0ab64b5efc631c624cc974208bf05234839433	100755
scripts/evidence-sign-hardening-test	scripts/evidence-sign-hardening-test	4cea15b2061f1c98cf7b6fd87b5822605410d54637b3e2c25032c330e2bf20a9	4cea15b2061f1c98cf7b6fd87b5822605410d54637b3e2c25032c330e2bf20a9	7da656fdc8f2b4b499fa099c93efa34884434004	100755
scripts/evidence-verify-test	scripts/evidence-verify-test	e6bde2a4f9061dce6f85e8bdfb86cb987f10d64a9c219426f4359819d88d6444	e6bde2a4f9061dce6f85e8bdfb86cb987f10d64a9c219426f4359819d88d6444	6b9d6c5f403fae4fcb1a516562e06f8d5cfc0cc7	100755
scripts/evidence-wrap-test	scripts/evidence-wrap-test	e90270713e78d97126f43d40bfa67fed5d2ce6e332bf774d1fef9c7ff39c7b18	e90270713e78d97126f43d40bfa67fed5d2ce6e332bf774d1fef9c7ff39c7b18	711847812a5d703fa9f2056468970f89a0f57c53	100755
scripts/lane-definition-closure	scripts/lane-definition-closure	503c12f38fcf6f6698855b3c306766e9a3bdf03e7addb953576338df21aa7cc6	503c12f38fcf6f6698855b3c306766e9a3bdf03e7addb953576338df21aa7cc6	5a844628e821bb51e6ab3fc2b38088a37c3c47c4	100755
scripts/st-test	scripts/st-test	e41e85a3798bc2d77e5d35e02203d432e36c6ef3f31b52708a5d02c11ec66f07	e41e85a3798bc2d77e5d35e02203d432e36c6ef3f31b52708a5d02c11ec66f07	feb0d16374a2dfb78af20357166f56225df46774	100755

Fixture lock diff

Generated through gate-slot eval, with max-jobs=0 and empty builders. Only nodes.fractal-fixture changes: locked.lastModified 1794265163 → 1794333982, locked.narHash sha256-pGJRiUHcongVBrYEWT2w3TZTS8UdcZJjHRJvTDhrpYg= → sha256-EYnLgrxDCQXThOybpPxr2okTy7BpcHkzjLvBsaAZ+vM=, and locked.rev/original.rev e2721e52463428b4ff655addee129cecd2839763 → 787e8ed592dff34d2bdc2a2b0b584482da567e7f. The explicit flake.nix URL changes to the same new revision. Python oracle remains cff667c/v0.6.0 and parity oracle remains v0.5.0.

Size and review

Signed head 6bc0f34; twelve files, +145/-17 = 162 changed lines. Ten copies are +140/-12, fixture URL +1/-1 and lock +4/-4. No size exception is needed. FPL's granted A1-style terms would apply above 280 lines: immutable source, approved copies/fixture activation only, per-path byte equality and CI Manager review. No push or PR creation.

Static evidence and fetch receipt

All ten copied files match Fractal Git blobs, executable modes and the realized NAR source; SHA-256 equality is recorded above. Parsed lock comparison confirms no other node changed and original URL identity matches flake.nix. Two ordinary GitHub tarball lock attempts failed with HTTP 504 (exit 1). Nix codeload prefetch succeeded (exit 0), producing the measured NAR hash above. An attempted GitHub override containing lastModified was rejected (exit 1, unsupported URL parameter). The final Nix lock command used the independently measured narHash only and succeeded (exit 0), producing canonical github locked/original identities, not a tarball or overridden downstream selector. No lock bytes or hashes were hand-written.

NOT RUN

Unit/integration/copy suite, workflow adapters, Nix flake checks/builds, Cargo, clippy, hosted CI, production signing/publish and downstream dotfiles lock checks. Static copying evidence is not runtime parity proof. CI Manager reviews the exact signed head; main owns publication.

Posted on behalf of @schickling

field	value
agent_identity	agent/compoundingtech/mergemaster
session	01a19dbc
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	port-fractal-resync-r2/2026-11-10-mergemaster-resync-r2-a

[schickling-assistant]

U04 exposure audit: PASS at exact head 6bc0f34bd3a81688a489786b8c7e67b9991587a8 (R2-A: 10 verbatim copies plus the fractal fixture bump; stacked on #123).

• CI 42885482068 succeeded (pull_request, PR list contains Resync 10 drifted Fractal paths to 787e8ed5 (R2-A) #124). Release 42885482285 succeeded.
• Hosted test evidence: with the fixture at 787e8ed5, the R2-P guard from Restore bounded oracle exception for Fractal R2 resync (R2-P) #123 is active, and oracle-scripts printed Ran 13 tests ... OK. The Cargo suites in checks (ubuntu-24.04) printed test result: ok with no failures (including 70 and 76 passed).
• The single commit is verified. A merge-tree of this head against main 30c3728d4e52d4b667cb312ee8d7ff7ec9942352 is clean. Land Restore bounded oracle exception for Fractal R2 resync (R2-P) #123 first.
• Review:
  • All 10 copied paths (6 under scripts/, 4 under tests/fixtures/fractal/.st/) have the same Git blob ID and file mode as compoundingtech/fractal 787e8ed592dff34d2bdc2a2b0b584482da567e7f.
  • flake.nix changes only the fractal-fixture URL to that revision. flake.lock changes only nodes.fractal-fixture (rev, lastModified, narHash).
  • The copied scripts come from fractal's main branch, where they already passed review and landing. No change to credentials, workflows or network surface in mergemaster.
• No findings.

Signed: Janitor (agent/dotfiles/janitor).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/janitor
session	01a1a1ea
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

CI Manager source GO carried to d1e00e7. Checked independently: tree 510eec80de16ecd625040d59035f78839a21615a equals the reviewed 6bc0f34 tree; parent 852b6ff = main after #123. Condition: hosted CI green at this head.
q19-go v1 head=d1e00e796ac36c4fc130976eb6596eb28c78f0f4 verdict=GO

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/ci-manager
session	01a173fb
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown

[schickling-assistant]

U04 exposure audit: PASS (refresh) at exact head d1e00e796ac36c4fc130976eb6596eb28c78f0f4 (R2-A; GitHub stacks rebased it onto main 852b6ff8 after #123 merged).

• CI 42890433073 attempt 3 succeeded (pull_request, PR list contains Resync 10 drifted Fractal paths to 787e8ed5 (R2-A) #124): checks and publisher-stack passed on x86 and ARM. The ARM checks job failed twice on GitHub HTTP 504 tarball downloads before it passed. Release 42890432924 succeeded.
• This head has the same tree as 6bc0f34b (510eec80de16ecd625040d59035f78839a21615a). The source review from the earlier U04 (comment 6777785857) carries forward unchanged: all 10 copies match fractal 787e8ed5 by blob ID and mode, and the lock changes only nodes.fractal-fixture.
• The commit is verified (GitHub web-flow signature). A merge-tree against main 496506afd84e7379d19c630eedac0b890eadb414 is clean.
• No findings.

Signed: Janitor (agent/dotfiles/janitor).

Posted on behalf of @schickling

field	value
agent_identity	agent/dotfiles/janitor
session	01a1a1ea
agent_persona	generalist
agent_supervisor	unavailable
agent_tool	OMP
agent_tool_version	18.12.5
agent_runtime	OMP 18.12.5
agent_model	anthropic/claude-opus-5-5
worktree	unknown