Remainder-rate replay: authenticate nested mutant reports and unknown-label failures

.github/workflows/remainder-rate.yml

@@ -5,6 +5,8 @@ name: Remainder rate exact controls
     paths:
       - 'frontiers/remainder_rate_20260930/**'
       - '.github/workflows/remainder-rate.yml'
+      - 'tools/remainder_rate_replay.py'
+      - 'tests/test_remainder_rate_workflow.py'
       # bound merged sources (consumed in SOURCES.json) and the pinned unmerged dependency (#191; verified by blob)
       - 'frontiers/remainder_vanishing_20260930/PROOF.md'
       - 'frontiers/three_fronts_20260924/LIFETIME_REMAINDER.md'
@@ -31,6 +33,13 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.11.16'
+      - name: Exercise full-shell rejection contracts in both modes
+        env:
+          PYTHONDONTWRITEBYTECODE: '1'
+        run: |
+          set -euo pipefail
+          python -B -S -m unittest discover -s tests -p test_remainder_rate_workflow.py -v
+          python -B -O -S -m unittest discover -s tests -p test_remainder_rate_workflow.py -v
       - name: Verify sources, replay both modes, reject mutants
         env:
           PYTHONDONTWRITEBYTECODE: '1'
@@ -80,19 +89,9 @@ jobs:
               if len(data) != entry['bytes'] or hashlib.sha256(data).hexdigest() != entry['sha256'] or hashlib.sha1(framed).hexdigest() != entry['git_blob']:
                   raise ValueError('consumed unmerged dependency differs from the pinned blob (rebind required): ' + entry['path'] + ' via ' + where)
               print(json.dumps({'consumed_unmerged_verified': entry['path'], 'git_blob': entry['git_blob'], 'via': where}))
-          script = str(root / 'rate_ledger_check.py')
-          expected = (root / 'RESULTS.json').read_bytes()
-          for flags in (['-B', '-S'], ['-B', '-O', '-S']):
-              out = subprocess.run([sys.executable, *flags, script], check=True, capture_output=True, timeout=600).stdout
-              if out != expected:
-                  raise RuntimeError('output differs from RESULTS.json under ' + ' '.join(flags))
-              for m in manifest['mutants']:
-                  rc = subprocess.run([sys.executable, *flags, script, '--mutant', m], capture_output=True, timeout=600).returncode
-                  if rc != 1:
-                      raise RuntimeError('mutant ' + m + ' not rejected')
-              rc = subprocess.run([sys.executable, *flags, script, '--mutant', 'M9'], capture_output=True, timeout=600).returncode
-              if rc != 2:
-                  raise RuntimeError('unknown mutant label not rejected with exit 2')
+          sys.path.insert(0, str(pathlib.Path('tools').resolve()))
+          from remainder_rate_replay import replay
+          replay(root, manifest['mutants'])
           print(json.dumps({'scientific_effect': 'NONE', 'mathematical_acceptance': False}))
           PY
           git diff --exit-code

reviews/remainder_rate_protocol_20261006/SCOPE.md

@@ -0,0 +1,108 @@
+# Remainder-rate execution protocol repair
+
+Dylan Roy — delegated AI engineering. Actual author OpenAI / GPT-6 Astra Pro,
+`remainder-protocol-followthrough-20261006`; pickup Math-#322/6009571878.
+Scientific effect NONE; organizational-independence credit 0. No author self-merge.
+This is one workflow repair, not acceptance of the remainder theorem or closure
+of the repository-wide legacy-wrapper issue.
+
+## Exact original sources
+
+Original source cut: `91821f9262b30ce7684b8ec5f1b4742893dac3d7`.
+
+| Source | Bytes | Git blob | SHA256 |
+|---|---:|---|---|
+| .github/workflows/remainder-rate.yml | 5703 | d32aa63cb0733e879e9d8ca3c362ea6fa5520e5b | fa18af037d9131fd8faae40e76bd4f8e6709e26184ac92a40d82f2f140b7d044 |
+| frontiers/remainder_rate_20260930/rate_ledger_check.py | 18229 | 3293ca22ab89bd650f361832c62b03724a976f03 | 5ad2b0ca9e7a131040252db5f23a3dc6444c3b0120912fbede4a593fbe7cb5d2 |
+| frontiers/remainder_rate_20260930/RESULTS.json | 1074 | 88d97cc6a45d2213399cf87260a3a358d73d9df7 | c2c8ed1ccf0e15c992d88aff04caae1a99291f6d71b75f59db943cadbf5dc7e0 |
+
+The complete checker, RESULTS and workflow were authenticated before execution.
+An initial manually transcribed comprehension failed the source hash; native
+base64 recovery corrected that local copy before any checker execution. Original
+scientific packet and dependency files are not edited by this proposal.
+
+## Measured contract
+
+Actual local CPython 3.13.5: baseline, M1-M4 and M9 in each normal/optimized child
+mode, twelve completed native processes. All six stdout/stderr pairs match.
+Baseline is the byte-exact 1074-byte RESULTS report, exit 0, empty stderr.
+Each named mutant exits 1 with empty stderr and its entire nested report:
+M1 changes E1's claimed exponent; M2 changes E2's cubic-barrier diagnostic;
+M3 changes E3's determinant diagnostic; M4 changes E5's sign-window diagnostic.
+The helper stores the exact independently measured baseline and four changes.
+All other nested fields, including the still-passing checks' integer counts,
+must match. M9 exits 2 with empty stdout and exactly `unknown mutant label\n`.
+
+Baseline byte equality is retained. Mutants permit harmless JSON whitespace,
+key order and equivalent string escapes, but not duplicate keys, wrong types,
+floats/nonfinite values, wrong labels/reasons, missing/extra fields, altered
+positive-check details, silence, crashes or unexpected stderr. Recursive typed
+equality does not equate bool/int or int/float. Full ordered M1-M4 inventory is
+required before any child; expectations never come from the invocation under test.
+Children inherit the original working directory. Timeout/launch exceptions
+propagate unchanged. The helper retains the original 600-second child budget.
+
+## Test-first execution
+
+Ten published unittest methods contain 120 distinct complete-shell fixtures.
+They use real committed temporary Git repositories, real Bash/Python children,
+nonempty consumed/cited/unmerged tree pins and external ordered call traces.
+No subprocess is mocked in the full-shell tests. Synthetic checker outputs are
+specified in the test source, never imported from production validation.
+
+The full ORIGINAL normal-mode coverage yields 84 intended assertion failures,
+zero errors: 82 invalid-output admissions, one truncated-inventory admission,
+and one missing workflow-wiring assertion. Nine genuine/formatting fixtures
+are admitted and 28 other controls correctly rejected; 1234 children execute.
+The repaired source has 120/120 expected outcomes in each normal and optimized
+outer mode: nine valid/formatting admissions and 111 rejections, 752 children
+per mode. Same 120 scenario keys and identical test source in all three phases.
+These are not 360 distinct scenario types or mathematical proof obligations.
+Every rejection is checked against its exact ordered target prefix; seven
+source guards stop before children. The dirty-tree case reaches all twelve
+children before the final Git check rejects the changed tracked file.
+
+Completed local coverage is partitioned into explicit disjoint subcase groups
+because the execution envelope interrupted two original group attempts and one
+full optimized discovery attempt. Nonselected subcases are explicitly skipped
+in the local-only partition runner; complete coverage is checked independently
+from the 120 unique saved records per phase. Interrupted records remain separate
+and excluded. No uninterrupted full-suite result or full repository checkout is
+claimed. The unchanged published test source has no partition filtering; hosted
+CI runs the two complete discovery commands.
+
+Twelve further genuine invocations through the repaired helper match every
+native-characterization exit and stream hash; sources remain unchanged.
+Twenty-nine additional local-only injected process-boundary cases per mode
+verify twelve stopping positions for each of TimeoutExpired/OSError and five
+bad inventories; exact exception objects and 600-second/capture/command contracts
+are preserved. Those are transparently synthetic injections, not native runs.
+The first optimized probe used bare assertions and is not credited; corrected
+explicit-raise probes passed in both modes. A test-generator quoting error was
+corrected before test execution. All these development records are retained.
+
+## Preserved boundaries and release conditions
+
+The original 3099-byte source preflight, including the #191 pinned GitHub-blob
+fallback, is byte-identical (SHA256
+f94b86d9e9fdfade99335aba3193862246114181f4fcd768b5bb8f9eb1ac1dd4).
+The final 137-byte JSON/Git postflight is byte-identical (SHA256
+752aa03685dbbe54ec40c3e91b8709eb6453c41c146e9636b295b2129c586cdc).
+These sizes include workflow indentation. Only the intervening process loop,
+helper/test triggers and a two-mode focused regression step change. Action pins,
+Python 3.11.16, read-only permissions and ten-minute job budget stay unchanged.
+All packet, proof, result, manifest, cited and consumed dependency bytes remain.
+The synthetic unmerged-pin controls exercise the existing tree route; no local
+live GitHub API-fallback execution is claimed. Actual full-tree pinned-runtime
+execution must be established by the dedicated workflow. No unmerged-source
+rebind, scientific tolerance change, no-argument generation, Lean execution,
+new proof/statement alignment, or whole-program acceptance is supplied.
+
+A separate nonauthor engineering source review and actual applicable dedicated,
+general and required checks on the real candidate remain necessary. An eligible
+separate nonauthor/nonreader integrator must reconcile current refs, ownership,
+reviewed blobs, dependencies and threads before guarded ordinary merge and
+verify landing afterwards. A base change does not transfer an old receipt.
+#322 and unrelated wrapper repairs retain their scopes. This helper is not a
+hostile-source sandbox, a bounded-output-memory service or durable raw-output
+archive. Source authentication and historical mathematical qualifications remain.