Repair #322: authenticate three legacy JSON rejection contracts

.github/workflows/c6-cluster-law.yml

@@ -5,6 +5,9 @@ name: C6 cluster-law checks
     paths:
       - 'frontiers/c6_cluster_law_20260929/**'
       - '.github/workflows/c6-cluster-law.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'c6-cluster'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -47,24 +57,8 @@ jobs:
               blob = hashlib.sha1(b'blob %d\0' % len(data) + data).hexdigest()
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or blob != entry['git_blob']:
                   raise ValueError('consumed source identity mismatch on this tree: ' + entry['path'])
-          script = str(root / 'cluster_law_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          mutants = ['pins-not-critical', 'wrong-pin-hessian', 'drop-sigma-jacobian', 'three-extra-points', 'shear-drop-cubic', 's-bound-constant',
-                     'cross-term-not-small', 'window-closed', 'index-sign']
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script],
-                                   check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in mutants:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m],
-                                      capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'unknown'],
-                                  capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant not rejected with rc 2')
+          from tools.legacy_json_replay import replay
+          replay('c6-cluster', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/far-elder-rate.yml

@@ -5,6 +5,9 @@ name: Far elder rate exact controls
     paths:
       - 'frontiers/far_elder_rate_20260930/**'
       - '.github/workflows/far-elder-rate.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'far-elder'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -42,19 +52,8 @@ jobs:
               framed = b'blob ' + str(len(data)).encode() + b'\0' + data
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('merged source drifted: ' + entry['path'])
-          script = str(root / 'far_elder_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in ('M1', 'M2', 'M3', 'M4'):
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          from tools.legacy_json_replay import replay
+          replay('far-elder', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/local-pairing.yml

@@ -5,6 +5,9 @@ name: Local pairing exact controls
     paths:
       - 'frontiers/local_pairing_20260930/**'
       - '.github/workflows/local-pairing.yml'
+      - 'tools/legacy_json_replay.py'
+      - 'tools/legacy_json_contracts.json'
+      - 'tests/test_legacy_json_workflows.py'
   workflow_dispatch:
 
 permissions:
@@ -21,6 +24,13 @@ jobs:
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
         with:
           python-version: '3.11.16'
+      - name: Exercise the complete shell rejection contract in both modes
+        env:
+          LEGACY_TEST_FAMILY: 'local-pairing'
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          python -B -S tests/test_legacy_json_workflows.py
+          python -B -O -S tests/test_legacy_json_workflows.py
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -55,19 +65,8 @@ jobs:
               framed = b'blob ' + str(len(data)).encode() + b'\0' + data
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('merged source drifted: ' + entry['path'])
-          script = str(root / 'pairing_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in ('M1', 'M2', 'M3', 'M4'):
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          from tools.legacy_json_replay import replay
+          replay('local-pairing', root)
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

.github/workflows/qs-d3-soft-layer-chain.yml

@@ -0,0 +1,61 @@
+name: QS d = 3 soft-layer chain (A3-A3.6) replay
+
+'on':
+  pull_request:
+    paths:
+      - 'frontiers/qs_d3_soft_layer_chain_20261005/**'
+      - 'tests/test_qs_d3_replay_protocol.py'
+      - '.github/workflows/qs-d3-soft-layer-chain.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  replay:
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    strategy:
+      fail-fast: false
+      matrix:
+        mode: ['-B -S', '-B -O -S']
+    name: replay (python ${{ matrix.mode }})
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        with:
+          python-version: '3.11.16'
+      - name: Verify protocol, stored identities, extractions and all published controls
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        shell: bash
+        run: |
+          set -euo pipefail
+          out="$RUNNER_TEMP/qs-replay-evidence"
+          mkdir -p "$out/logs"
+          python ${{ matrix.mode }} -m unittest discover -s tests -p test_qs_d3_replay_protocol.py -v 2>&1 | tee "$out/logs/protocol.txt"
+          python ${{ matrix.mode }} frontiers/qs_d3_soft_layer_chain_20261005/replay.py 2>&1 | tee "$out/logs/replay.txt"
+          git diff --exit-code
+          test -z "$(git status --porcelain)"
+      - name: Preserve exact public sources and available execution logs
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          out="$RUNNER_TEMP/qs-replay-evidence"
+          mkdir -p "$out"
+          cp -a frontiers/qs_d3_soft_layer_chain_20261005 "$out/packet"
+          cp tests/test_qs_d3_replay_protocol.py "$out/"
+          cp .github/workflows/qs-d3-soft-layer-chain.yml "$out/"
+          git rev-parse HEAD > "$out/tested_commit.txt"
+          printf '%s\n' '${{ matrix.mode }}' > "$out/mode.txt"
+          printf '%s\n' "$GITHUB_RUN_ID/$GITHUB_RUN_ATTEMPT" > "$out/run.txt"
+      - name: Retain evidence on success or failure
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        with:
+          name: qs-replay-${{ strategy.job-index }}-${{ github.run_id }}-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/qs-replay-evidence/
+          if-no-files-found: error