Review round 2, items 1-10:
- 1: §11.3 rewritten in order. The verifier (Rust and Python) requires the receipt's
components to be the policy's by id, order and media (policy-component-mismatch,
so a zero-component receipt is refused); runs pack-id and §3.6's capability rules
under the effective policy; holds each index's timebase, media, string table,
class records, every entry's role/capability/layer, and every piece's rules,
moments and class plan to the policy (index-policy-mismatch). Seal and verify
refuse a receipt with no component (receipt-index-count).
- 2: verify reads objects by get(), skips the floor and catalogs once anything has
failed; the catalog renderers return Result (a start past 2^53 - 1 is
catalog-mismatch); the fragment time uses checked_mul; Python maps encoding,
overflow and value errors to refusals. New index rule window-start: an index with
no previous window starts at piece 0, entry 0 and time 0 (§4.5), in both.
- 3: each floor piece opens on a shown key frame, and holds no other unless
extra_keyframes; every sequence header is the first's bytes (both, §11.3).
- 4: both readers refuse a member named twice before reading the version; the
package's receipt file must be its canonical bytes; Python refuses -0.
- 5: a refinement track depends on the tracks carrying what its entries refine
(MSF's depends is all-of); never a track the catalog lacks. catalogs/ corpus.
- 6: Rust binds a supplied floor's renderer, settings, framing header and target
(floor-object-mismatch); SPEC §7.1 says a profile may fix those members.
- 7: verify reads the directory strictly (dot-names, *.sha256 included).
- 8: Python's manifest parse is the typed one; the object differential is 0.
- 9: Python refuses two components of one id (receipt-component).
- 10: v2 writes every member, energy_provenance null when unmetered, evidence
exactly as its class carries; v1 keeps reading an absent class.
Regression tests: tests/review.rs (the review's probes, re-sealed with the key, and a
seeded run of random alterations that never panics); mutation corpus receipt cases.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
6012a7c3cf