Name a reason instead of crashing, and stop the verdict depending on the host

[GiulioDER]

Rebased onto main now that #1 is in. Single commit, no longer stacked.

Thank you for the revert note. You were right, and the reason is worse than a flaky test: my two deep-nesting tests built their fixture with json.loads('{"a":' * 3000), which raises inside the decoder at a depth that varies by interpreter. Green on my 3.14, red on your 3.11 leg. So the tests for a host-dependent defect were themselves host-dependent, and the window they probed had an interpreter-dependent width.

You offered two ways back. This takes the first one.

Both traversals over issuer data are now iterative

_todo_failures walks the whole manifest and _summary_outruns walks results.summary. Both were recursive; both are now explicit stacks. There is no depth window left to be host-dependent about, so there is nothing host-dependent left to test.

Order is preserved exactly: children are pushed in reverse so popping yields them in the original order, and a popped node's children are handled before its siblings, which is the depth-first order the recursive form gave. Your committed failure lists pin that, and they stay green.

The replacement tests build a 20000-deep structure in Python rather than through the decoder, so they exercise the traversal on every interpreter. The backstop's append-not-replace property is now tested by injecting a RecursionError rather than by inducing one.

The RecursionError backstop stays as defence in depth for traversals that are not iterative yet. It appends rather than replaces, because returning a fresh list would let an issuer delete every other reason, a smuggled unlisted-file included, just by padding a structure with depth.

Conflict resolutions worth naming

Crashkit severity: yours wins. You now refuse out-of-table labels instead of weighing them 0, which closes the hole properly rather than at the arithmetic. I kept your version and added one thing: x in {...} and a set comprehension both raise on a list, so an unhashable severity escaped as a TypeError rather than as your named refusal. Hashability is tested first, and your message shape, ordering key and repr of the original value are unchanged, so both of your pinning tests stay green.

verify_bundle: yours wins. The draft short-circuit stays ahead of the backstop, byte-identical in behaviour across four draft shapes including a real 21-reason draft.

Crashes that escaped verify_bundle

Every input is issuer-controlled JSON, so any assumption about a field's type was an assumption about the issuer's goodwill.

• non-dict elements in certlab verdicts, fleet rows, or a raw jsonl line
• a scalar evidence or results.checks, since 5 or [] is 5
• an unhashable value reaching a dict key or set element. dict.get() raises on an unhashable key rather than returning its default. The guard is hashability, not a string requirement: SPEC 3.2 and 3.3 type none of suite, member or operator_id, so a board keyed by integer ids is legal evidence, and two control tests hold that door open.
• a non-string modeldrift t, previously coerced to "" without a reason
• a non-list or mixed-type fails
• a deeply nested manifest, and a top-level JSON array artifact

The host-dependent verdict, which you called the most serious thing

read_text and write_text used the platform codec, so a manifest carrying a valid UTF-8 byte 0x81 failed as invalid-json on Windows and passed under PYTHONUTF8=1. Same bytes, opposite answers.

Three things that turned up while chasing it, none of which I expected:

1. The verifier's own verdict line carries an em dash and was printed raw, so on an ascii or cp437 console the CLI died after the FAIL reasons and before the verdict, which is the one line a reader needs. cp1252 masks it because cp1252 contains U+2014.
2. vac/registry.py re-reads the same vac.json with the locale codec. Once the verifier stopped refusing those bundles, a bundle that now PASSES reached registry.py:156 and crashed there, where before this branch it was refused with a named reason. That is a regression this branch would have introduced into the adjacent module, so all five sites there are pinned too. The structural guard now scans vac/*.py rather than verify.py alone.
3. tests/test_refusals_modeldrift_b.py reads RESULTS.md the same way, so it fails on a cp1252 host on main, before this branch touches anything. Pinned, with newline="" on the writes because those artifacts are sha256-pinned. That is the only file of yours this PR edits, and it is six I/O calls, encoding only, no assertion changed.

There are roughly 120 more bare text I/O sites across tests/. They are latent rather than red, so I left them alone rather than swamp this diff. Happy to send that list separately.

Also here

An unbounded scan on an issuer-controlled field. re.sub(r"<[^>]+>", "", narr["html"]) rescans to end-of-string from every start position when no > follows. A bundle that verifies completely clean cost 22.4s for 128k characters. The replacement is linear and reproduces the regex exactly, verified over 200,000 random strings from a <>-dense alphabet plus the edge cases, because SPEC 3.5 pins the committed narrative against this transform and redefining "tag-stripped" would flip verdicts on honest bundles. Same input now takes 0.004s.

Issuer text reaching the terminal. The replay block is echoed after the verdict line and was printed raw, so ANSI escapes could paint a forged PASS over a failing run. Exit codes were always honest, so a CI gate keyed on exit status was never fooled. Bidi overrides and the Unicode separators are escaped too, since U+202E reverses the displayed order of a replay command a reader is invited to copy. The test builds those with chr() rather than as literals, so the test file does not itself carry invisible reordering marks.

Verification

On this host, imports pinned to each tree so neither borrows the other's vac:

	main	this branch
pytest	2 failed, 236 passed	0 failed, 266 passed, 16 skipped, 4 xfailed

python -m vac.verify fixtures/valid exits 0, every tamper-* fixture still exits 1, the fixtures regenerate byte-identically, and ruff output is unchanged.

Every test was verified to fail against origin/main rather than merely to pass after it. The one exception is the _printable unit test, whose subject does not exist upstream, so it has no upstream red state; the CLI-level test covering the same defect does.

For refusal-coverage: the four refusals this branch adds are each pinned by their exact reason text, and I confirmed each one by mutating the f.append away and watching a test catch it. An assertion that only checks the failure list is non-empty survives that mutation through collateral damage, which is why they assert the full string.

One thing to pre-empt: test_the_narrative_strip_is_not_quadratic asserts wall-clock under 4.0s and runs in 0.05s, an 80x margin. Given the revert reason I would rather flag it than have you find it. If you would prefer no timing assertion at all, say so and I will swap it for an equivalence check plus an operation-count bound.

Known residuals, deliberately out of scope

• The per-point continue in the modeldrift coherence loop suppresses the remaining reasons for that one point. It cannot widen acceptance, since any appended failure aborts the check, but the report is less complete than the docstring promises.
• A RecursionError raised inside _coherence still loses that function's own partial reasons, because the result is only added on return. The phases before it survive.
• no verdicts[] array and no rows[] array now also fire when the array exists but holds a non-dict element, so the reason slightly misdescribes that input. I kept your wording verbatim rather than break the tests that pin it. Say the word and I will split it into two reasons.

[egnaro9]

#1 is merged, so this one is now conflicting exactly as you called it — it carries that commit too.

I want this half as much as the first. The three that matter most to me, in order:

• The verdict that depended on your host. Same bytes, same code, opposite verdicts depending on the platform codec. For a protocol whose entire premise is that a stranger gets the same answer offline, that is the most serious thing in either PR — a false PASS is a bug, but a verdict that varies by locale means the artifact was never the thing being checked. The structural test that reads the source and asserts no text read leaves its encoding to the host is the right shape, precisely because the behavioural one is green on this repo's own CI and would have protected nothing.
• The recursion backstop appending rather than replacing. An earlier version handing the issuer a switch that deletes every other named reason — including a smuggled unlisted-file — while still exiting 1 is the subtlest finding here, and it is a bug in a fix. That is the failure mode I most need tests for.
• ANSI and bidi in the replay block. The exit code stayed honest, so CI was never fooled, but the block exists to be read and copy-pasted by a human. U+202E reversing a command someone is invited to paste is a real attack on the one part of the output that asks for trust.

Rebase when you have time and I'll merge it. If you would rather hand it off, say the word and I'll rebase it myself with your authorship intact — it is your work either way.

On the residuals you named: vac/registry.py has the same two defect classes and is the CLI that consumes this verifier, so it should get the same treatment; I'll open an issue rather than let it sit in a PR comment.

[egnaro9]

Two updates you should probably know about, and one question.

First, your encoding finding sent me looking for the same class everywhere
else. I found four more, all in code your PR had already hardened. The cheapest
one is a single capital letter: re-casing critical to Critical on the
failing rows only drops their weight out of the numerator, and a security score
divides to a clean, false 0.0 through ordinary arithmetic. My own spec had
written that hole down as a decision.

Second, I stopped hand-hunting and measured. I disabled each of the verifier's
named refusals one at a time and asked whether anything noticed. 75 of 112 could
be deleted with the whole suite and all 16 tamper fixtures still green. The CI
job I wrote specifically to prove the verifier can refuse caught zero of them.
Fixing the four defects we found, each with its own regression fixture, moved
that number by -0.002. Testing every refusal moved it to 1.000.

Your PR #2 is rebased and verified locally but not landed: two of its new tests
build fixtures with json.loads('{"a":' * 3000), which RecursionErrors inside
the decoder on 3.11 before the verifier is called. Green on 3.14, red on the CI
leg. The tests need the manifest to parse while a later traversal blows the
stack, and that gap's width is interpreter-dependent, which is the same
host-dependence you were pointing at. I did not want to quietly rewrite your
tests, so it is sitting there.

The question. The registry has 11 entries and all 11 are mine. That makes it one
fixture, not a protocol, and it is the weakest thing about the whole project.
Would you be interested in issuing a bundle from cca-audit? Not as a favor to
make the registry look bigger. As the first real test of whether the spec is
writable-against by someone who did not write it. I would expect you to hit
something ambiguous, and that would be the useful part.

One thing changed since I last wrote, and it is the reason the ask is
reasonable now rather than presumptuous. Every profile in the spec used to
hard-code one of my own artifact shapes, so an outsider literally could not
issue: I walked the path with a fake repo and a plausible results file, filled
in every field honestly, and it died on "no per_kind object". There is now a
generic profile where you supply the rows and declare how each number is
recomputed from them, and a walkthrough with a worked example from a fictional
outside issuer. So cca-audit would not have to look like my repos.

Entirely optional and on no timeline. If you would rather just rebase #2 when
you are up to it, that is worth more than a bundle.