kanaria007 PRO

That exact shape is already one of the reasons Profile A sanitizes the Git subprocess environment.

The answer to your last question is: neither.

Profile A does not build a minimal environment from scratch, but it also does not inherit the caller environment and assume the Git variables are clean. It copies the inherited environment and explicitly removes the Git Authority/config override surfaces before the Git subprocesses that establish or consume local Authority.

That includes:

GIT_DIR
GIT_WORK_TREE
GIT_INDEX_FILE
GIT_COMMON_DIR
GIT_OBJECT_DIRECTORY
GIT_ALTERNATE_OBJECT_DIRECTORIES

plus GIT_CONFIG_COUNT and indexed GIT_CONFIG_KEY_n / GIT_CONFIG_VALUE_n.

GIT_INDEX_FILE specifically is there because I reproduced the same property earlier: explicit --git-dir and --work-tree do not override it, so a foreign index can otherwise substitute the tracked-path set after the nominal git-dir has already been qualified.

In the current Profile A implementation, both Git subprocess call paths use the same _git_authority_subprocess_env() helper: the final git ls-files --sparse -z call and the git config --local calls used during Authority qualification. So qualification and consumption use the same environment-isolation policy.

There is also a regression test for the GIT_INDEX_FILE case, and I kept it after switching the final query to --sparse, specifically to make sure this hardening did not regress.

Your witness does add a useful general point, though:

clean rc + clean stderr + supported output representation
!=
consumer used the qualified Authority

In this case there is nothing in the consumer's result channels that can tell us afterward which index Git actually read. The foreign one-entry index produces a perfectly plausible successful answer.

So this is another case where trying to infer Authority from the consumer's output is too late. The Authority-selection surface has to be constrained before the consumer runs.

That is also why I treat environment sanitization as part of Authority binding rather than as output validation.

Only on the sparse representation it knows about. Profile A does not currently fail merely because the Authority query wrote something to stderr.

I do not think non-empty stderr is the right semantic boundary.

The sparse-index bug showed:

rc == 0
!=
Authority observation completed

but I do not think the replacement rules are:

stderr empty
=>
Authority observation completed

or:

stderr non-empty
=>
Authority observation incomplete

In other words:

diagnostic channel state
!=
Observation status

stderr is a diagnostic channel whose semantics are specific to the operation and diagnostic being emitted. Promoting the channel itself into an Observation-status signal would just replace one coarse proxy with another.

So the sparse fix deliberately uses evidence about the representation rather than stderr:

git ls-files --sparse -z
→ sparse-directory entry observed
→ completing the pathname set would require object-store expansion outside Profile A's qualification closure
→ reject the representation before accepting any returned path

That gives Profile A a semantic reason for rejecting the result that is tied to the Authority dependency itself, rather than to the channel Git happened to use to report a problem.

I think the more general lesson from the exit-0 case is therefore:

process status
!=
Observation status

What Profile A really needs is a semantic distinction closer to COMPLETE / INCOMPLETE / UNSUPPORTED / UNAVAILABLE. The subprocess interface does not provide that distinction directly, so treating stderr non-empty as INCOMPLETE would still be an inference unless that contract can be established for the specific Git operation.

That is why I would not add a blanket stderr rejection here without a reproduced case showing that Profile A currently accepts an incomplete Authority result that its existing representation boundary does not catch.

The broader reason I care about this distinction is that conventional computing interfaces expose coarse machine-facing signals and representations — exit codes, stderr, exceptions, byte streams — while the semantic distinctions a reasoning layer actually needs often have to be reconstructed above them. If those reconstructions are allowed to harden into facts without an explicit evidence boundary, the next inference can build on a state that was never actually observed.

That concern is also part of why the wider SI work keeps separating Authority, Observation status, provenance, and claim boundaries, and why some of it reaches below the model/runtime layer: not to make lower layers “understand meaning,” but to preserve more of the distinctions that higher layers would otherwise have to infer back into existence.

So for now, stderr is evidence worth investigating, but not itself the Authority verdict.

Profile A does not qualify repository-local objects/info/alternates today. The claim stops before that object-store edge.

It does strip GIT_ALTERNATE_OBJECT_DIRECTORIES from the inherited environment, but that is invocation hardening against an ambient override, not qualification of .git/objects/info/alternates itself.

Your question did expose one place where I had accidentally crossed that boundary, though.

For a non-sparse index representation, ls-files does not need sparse-directory tree expansion to materialize the tracked pathnames. A genuine sparse index is different: a sparse-directory entry can require Git to read a tree object from the object store in order to expand it into the contained paths.

I reproduced a bad consequence of that distinction with real Git. With the tree object needed to expand a sparse-directory entry removed, plain:

git ls-files -z

reported errors on stderr but still exited 0, with the paths beneath that directory silently absent from stdout.

So my previous Profile A path observation had a hidden object-store dependency in the sparse-index case. Exit 0 was not proof that the tracked-path observation was complete:

Git subprocess succeeded
!=
Authority observation completed

I changed the final Authority query to:

git ls-files --sparse -z

so Git reports a sparse-directory entry directly rather than expanding it through the object store. Profile A now rejects any such entry as an unsupported Authority representation before accepting any part of the returned path set.

Importantly, it rejects a healthy sparse index too. This is not a missing-object detector. The representation itself is outside Profile A because accepting it would make the tracked-path set depend on object-store state that Profile A does not qualify.

An ordinary non-sparse index produces the same path set through --sparse, and a real split-index repository remains accepted, so the restriction is specific to the representation that introduced the reproduced hidden dependency.

So the boundary I would state now is:

qualified git-dir + qualified supported index representation
!=
qualified Git object store

Profile A does not currently inspect objects/info/alternates, and I do not think it should merely because that edge exists. For the path-Authority operation Profile A accepts, the goal is instead to avoid requiring sparse-tree object-store traversal at all.

If a future accepted representation or consumer makes the Authority result depend on objects or alternates, then that dependency would need either its own qualification closure or an explicit unsupported-representation boundary. The sparse-index case turned out to be the latter.

Your re-parenting result also sharpened the descriptor-mode point for me: resolving a dependency once and giving the consumer the resolved objects is stronger than trying to classify every path spelling through which it might later be re-resolved. But that remains a separate stronger local mode, not a change to Profile A.

Yes, that correction is important. relative was too coarse a candidate admission condition.

Your row 4 makes the distinction clear:

same anchored starting object
+
same destination inode
!=
same resolution semantics

../.. preserves the anchor because it is a pure ancestor walk from the already-open directory. ../../../../main/.git is also relative, but once it introduces a forward name component it re-enters mutable name lookup, so the descriptor anchor no longer carries through that edge.

So the relevant property is not relative. For the concrete shape you measured, it is closer to:

pure ancestor traversal only

or, at the more general assurance level:

anchor preserved across this metadata-defined edge

That is a better predicate than the one I sketched.

On your last question: Profile A does observe the raw commondir value while processing the relationship. The commondir file itself is qualified first, then its contents are read. A relative relationship is joined onto the already-qualified private gitdir without normalizing first, and that still-lexical path is walked component by component before normalization is used for the binding comparisons.

But Profile A does not retain the shape of that relationship as a downstream assurance fact.

After the walk succeeds, the path is normalized for the existing binding comparisons, and linked-worktree qualification ultimately returns the qualified private gitdir rather than something like:

commondir_edge = PURE_ANCESTOR_WALK

So rows 1 and 4 are distinguishable while the current relationship is being processed, but that distinction is not preserved as reusable evidence for a hypothetical stronger mode.

I think that reinforces the decision not to add a new admission rule to Profile A now.

If I had added commondir must be relative after the previous round, it would have done two bad things at once: reject otherwise-supported layouts and still fail to establish the temporal property it appeared to promise. A missing stronger-mode condition is better than a plausible-looking but insufficient one.

So I am leaving the current implementation and documentation unchanged. Profile A still makes only its existing point-in-time pathname claim.

If a descriptor-bound mode is ever implemented, I would treat this as a separate edge-semantics classification problem: observe the raw relationship, classify whether traversal preserves the anchor without fresh name lookup, retain that classification as evidence, and admit the stronger mode only on the edge shapes it actually knows how to bind.

Your row 4 is the useful counterexample here because it separates endpoint identity from transition semantics. The destination can be identical while the assurance property changes entirely with how the path gets there.

Yes, Profile A already reads commondir as metadata rather than treating it as an opaque locator.

The file itself is qualified first, then its contents are read. A relative value is joined onto the already-qualified private gitdir without normalizing first, the resulting lexical path is walked component by component, and only afterward normalized for the binding comparisons. An absolute commondir is also supported, but is treated as an independent metadata-derived locator and walked from the filesystem root.

So technically I could add something like commondir must be relative, or even require the canonical linked-worktree ../.. relationship.

I do not think I should add that to Profile A, though.

Your latest witness exposes a more important distinction:

descriptor-anchored private gitdir
!=
descriptor-anchored Authority chain

Whether the anchor propagates across the commondir edge depends on that edge's resolution semantics. With Git's normal relative ../.., the relationship happens to preserve the anchored ancestry. With an absolute value, resolution leaves that anchored chain and returns to pathname lookup.

That makes the strengthening more interesting, but also makes me less inclined to fold it into Profile A.

Requiring relative or canonical commondir today would narrow the set of otherwise-valid Git layouts Profile A accepts, not because the current pathname-based guarantee needs that restriction, but because a possible future descriptor-bound implementation would benefit from it. I would rather not let requirements from an unimplemented stronger mode leak backward into the baseline profile.

More generally, I think your experiment identifies the actual boundary more cleanly than the Linux portability discussion did:

anchor at one node
!=
anchor preserved across every metadata-defined edge

A stronger profile would therefore need to specify both the execution primitive and the metadata-edge resolution semantics across which identity preservation is claimed. Otherwise the strength of the guarantee would silently depend on a favorable representation of metadata whose resolution behavior is itself part of the Authority chain being qualified.

So I am keeping the current implementation and documentation unchanged here. Profile A remains point-in-time and pathname-based; relative and absolute commondir remain supported and explicitly qualified under that contract.

If a descriptor-bound local mode ever becomes justified, I think canonical relative commondir would belong there as an explicit admission condition, together with the platform and consumer-binding requirements — not as a new restriction on Profile A.

Your absolute-vs-relative witness is useful precisely because it shows why that separation matters.

That measurement changes my implementation-cost estimate, but not the Profile A boundary.

First, to answer your last question: yes, there is one other subprocess shape in Profile A. Besides the final git ls-files, _qualify_git_directory_binding() passes an already-qualified git-dir pathname to the git config --local subprocesses used to inspect core.worktree and core.bare. That applies to an ordinary .git directory and to the common/main git-dir requalified during linked-worktree validation. I did not find another subprocess consumer in repo_integrity.py.

--work-tree=<root> is also a pathname, but I treat that differently here because the caller-supplied root is Profile A's explicit trust anchor rather than a Git-metadata-derived locator.

Your timing result is useful for another reason: in your fixture, it confirms that moving another pathname revalidation closer to exec would buy very little. The dominant measured window is the process boundary, not the checks being performed while the private-gitdir pathname is retained. So the earlier categorical point — another lstat() can reduce a window without changing the guarantee class — now has a concrete measurement behind it.

And the /proc/self/fd/N witness is a good correction to my implementation-cost intuition. For the private-gitdir handoff specifically, on Linux, descriptor anchoring across the Git exec boundary is substantially more local than I had assumed.

I still would not make that stronger guarantee part of standard Profile A, though.

The reason is portability of the assurance contract rather than whether the Linux mechanism works. If descriptor-anchored handoff became something Profile A itself claimed, then equivalent temporal-binding machinery would be needed across the platforms on which Profile A is meant to retain the same meaning. The Linux shape depends on facilities and execution details such as /proc availability, fd inheritance across exec, no-follow descriptor traversal, and the surrounding container/sandbox environment. Other platforms would need different machinery, and future Git/OS combinations would become another compatibility surface to qualify.

Otherwise we would create a new ambiguity:

same Profile A result
!=
same claimed temporal assurance semantics

I would rather keep the profile label invariant than make its temporal guarantee conditional on which host happened to run it.

Also, as you noted, anchoring the private gitdir closes that particular pathname-substitution boundary; it does not by itself anchor every object Git subsequently resolves from that directory. The git config --local subprocesses expose the same distinction from another angle: anchoring the git-dir handed to Git is not automatically the same as retaining descriptor-bound identity for every config/index/object Git later opens beneath or beyond it.

So my current stopping point is:

• keep standard Profile A portable and pathname-based;
• keep concurrent hostile namespace mutation as an explicit non-claim;
• treat descriptor-anchored handoff as a possible platform-specific strengthening, or as a separate stronger profile/layer if a concrete use case eventually justifies the additional compatibility surface.

Your witness definitely makes that strengthening look cheaper on Linux than I originally expected. It just does not make the cross-platform assurance contract equally cheap.

Yes, I traced the actual consumption topology, and the answer is mixed.

Some metadata files are consumed almost immediately after qualification: commondir and the private gitdir back-binding are qualified and then read directly.

But the private-gitdir locator itself is reused. A qualified linked-worktree private gitdir is retained while the checker performs the commondir, common/main-root, config, and back-binding checks, and that same pathname is later passed to the final git ls-files subprocess. The qualified index is likewise qualified by pathname, but Git later reopens it through the gitdir rather than consuming a descriptor-bound object retained from that qualification.

So this is not a design where every qualification-to-consumption gap is adjacent or uniformly tiny. Your gap experiment therefore applies to Profile A in a concrete way, not just as a theoretical caveat.

At the same time, I think it confirms rather than contradicts the boundary we had already reached:

point-in-time pathname qualification
!=
race-free temporal binding

I considered adding another pathname revalidation near the final consumer, but that would only reduce the window without changing the guarantee class. A proper stronger claim would require qualification and final consumption to remain attached to the same descriptor-anchored object identity — including across the Git consumer boundary — which is a different design layer rather than another lstat() hardening pass.

So I am leaving the implementation unchanged and making the temporal boundary explicit in the tooling documentation, including the fact that some qualified locators are retained and reused later in the run.

I think that is the right stopping point for Profile A: the lexical walk turns a persistent plant-and-wait path substitution into a race, which is a meaningful mitigation, while concurrent hostile namespace mutation remains an explicit non-claim rather than something the profile quietly implies it solved.

And yes, the rare-event result is a useful warning in its own right. A single zero-hit run would have been very easy to mistake for evidence of impossibility.

I reproduced this one too, and this was the point where I stopped adding position-specific checks and moved the implementation up one abstraction level.

Your alias case is real: lstat() on

alias/.git/worktrees/victim

only protects the final component. The kernel has already followed alias while resolving the pathname.

So the actual invariant is:

final component non-symlink != locator non-redirected

I replaced the position-specific path-redirection checks with a reusable lexical Authority-locator qualifier. Every Git-metadata-derived Authority locator is now walked component-by-component with os.lstat() before that locator is trusted:

• directory -> continue
• symlink / unexpected required object -> RepositoryAuthorityBindingError
• non-absence observation failure -> RepositoryAuthorityProbeError

The existing semantic binding checks are still separate: ordinary .git binding, standard linked-worktree location, commondir, back-binding, and index qualification still establish what each object is expected to be and how the objects bind together. The new path walk establishes that the locator used to reach those objects was not redirected on the way there.

The same rule now covers the commondir, private gitdir back-binding, and index metadata files themselves before they are read or consumed.

I also fixed the related symlink + .. case. A relative commondir relationship is joined onto the already-qualified private gitdir without normalizing it first; the still-unnormalized lexical path is qualified component-by-component, and only then is it normalized for the comparisons that follow. Otherwise normpath() can erase the symlink component before it is ever observed.

The tests were generalized too: the exact alias witness remains, but there is now a lexical-prefix symlink matrix plus probe-failure and unexpected-object matrices, along with explicit symlink + .. witnesses. The focused Git Authority suite is 48/48.

I kept the previous assurance boundary:

Authority object qualified != Authority locator qualified != external/historical Authority provenance

Profile A now qualifies the first two. It still does not claim to reconstruct which repository the operator historically intended, or to attest host/container/bind-mount provenance.

There is one further non-claim worth making explicit: this is point-in-time pathname qualification, not race-free descriptor-anchored traversal. The qualifier performs lstat() observations and later consumers still reopen the locator by pathname. Closing concurrent namespace mutation between those steps would require a different layer based on fd-relative traversal / openat() / O_NOFOLLOW, which Profile A does not claim.

So I think this witness identified the right abstraction: the thing that needed qualification was the locator, not the latest metadata object we happened to notice.

Yes, I ended up taking both branches of your last question, but at different layers.

For hf_integrity_job.py, I removed the direct-run fallback entirely. The Job wrapper now requires the revision-bound webhook trigger context; without it, it fails explicitly and never executes the mounted checker. Local/manual working-tree validation still exists, but its entrypoint is repo_integrity.py directly. So the deployed Job no longer has a weaker Git-discovered Authority ingress sitting beside the manifest path.

For local Profile A, I kept Git-backed Authority and hardened it rather than pretending the problem disappeared with the Job branch.

The first change was the one your .git experiment pointed at directly: .git is no longer a Boolean existence predicate. The local provider now distinguishes positive absence, observation failure, and observed-but-unbound metadata before any tracked path set is trusted.

The supported shapes are deliberately narrow:

• an ordinary .git directory is qualified against Git's own core.bare and core.worktree semantics;
• a standard linked-worktree gitfile is accepted only when its private gitdir has the Git back-binding to that exact gitfile;
• a .git symlink is rejected as unbound Authority rather than followed;
• a foreign or malformed gitfile is rejected before path loading;
• the real submodule gitfile layout is not claimed as supported by this pass.

That exposed the same trust-boundary problem twice more upstream.

First, the git config calls used to establish Authority were themselves capable of being redirected by the ambient Git environment. In particular, a foreign GIT_COMMON_DIR could make a command naming the correct --git-dir read another repository's config, and Git's config-injection environment could alter a plain config query.

So qualification and consumption now share the same sanitized subprocess environment. The qualification-time git config --local calls and the final git ls-files invocation strip the repository-selection variables, GIT_INDEX_FILE, object-directory overrides, and the indexed GIT_CONFIG_COUNT / GIT_CONFIG_KEY_* / GIT_CONFIG_VALUE_* surface.

Second, qualifying the git-dir did not qualify the object inside it that actually supplies ls-files with its path set. A clean victim/.git with:

victim/.git/index -> other/.git/index

still made the fully explicit:

git --git-dir=victim/.git --work-tree=victim ls-files

return the other repository's paths.

So the local chain is now:

working-tree root -> git-dir binding -> index binding -> git ls-files

The qualified git-dir's index is inspected with lstat() before Git is invoked:

• absent -> allowed, because a fresh repository may not have an index yet;
• regular file -> accepted as the local Profile-A Authority object;
• symlink or other filesystem object -> Authority binding failure;
• non-absence observation failure -> Authority probe failure.

Only after that does the tool call Git, with the already-qualified --git-dir, explicit --work-tree, and sanitized environment.

The focused Authority regression suite now includes real Git witnesses for the foreign .git symlink, foreign gitfile, linked worktree, core.worktree, Git boolean spellings for core.bare, environment substitution, and the symlinked-index substitution. The current focused run is 32/32.

I stopped the hardening boundary there deliberately. Profile A still treats the regular local Git index as its Authority; it does not claim external revision binding or independent content provenance for the index bytes. Those stronger claims belong to the manifest/revision-bound profiles.

So the abstraction I ended up with is slightly stronger than the four-state .git classification alone:

some Git metadata observed != Authority bound to this root

and then, recursively,

Authority source qualified != Authority object qualified != the qualified Authority is what the subprocess actually consumed.

Your “one function up” observation turned out to be the right direction: the weakness was not just in the next predicate, but in the process that establishes the universe the rest of the checker is allowed to validate.

Yes, I kept the ordering and gave reject_symlink_traversal() its own probe-failure state.

I think your last sentence identified the real design choice. Moving namespace validation first would make the immediate traceback disappear, but it would weaken the boundary the current ordering is enforcing: before I let namespace resolution inspect a deeper component, I want the existing lexical prefixes qualified as non-redirecting. With a symlinked parent, a deeper lookup can otherwise cross that redirection before the namespace check has any reason to complain.

So the write-side order remains:

reject_symlink_traversal -> validate_observation_namespace -> write

but the first guard is no longer Boolean in the relevant sense.

I split the symlink side into a small typed hierarchy:

• SymlinkTraversalError: a symlink was positively observed;
• SymlinkTraversalProbeError: the checker could not establish the no-symlink precondition;
• both share SymlinkValidationError for call sites that only need “this guard failed”.

I also replaced Path.is_symlink() in that guard with explicit os.lstat() + stat.S_ISLNK() classification. That lets the checker own the distinction it actually needs:

• ENOENT / ENOTDIR -> positive non-materialization; stop the lexical walk cleanly;
• successful lstat, non-symlink -> continue;
• successful lstat, symlink -> traversal error;
• any other observation failure -> symlink probe failure.

That avoids depending on Path.is_symlink()'s own version-dependent error policy, where some lookup failures are normalized to False and others may propagate as raw exceptions.

The read path now turns that probe failure into its existing structured unreadable ... diagnostic, and the generate/write path reports it through the normal checker failure channel. The inaccessible-parent case therefore remains fail-closed, but it is now a declared verdict rather than an implementation traceback.

I pinned the ordering too, not just the exception type: the regression witness makes the symlink guard fail and makes namespace validation a sentinel that must never be reached. So “non-redirection before namespace materialization” is now a tested contract rather than incidental source order.

The self-loop case still behaves the way you observed. The lexical walk sees the loop component itself, positively identifies the symlink there, and raises the actual traversal error before any deeper loop/a.md lookup can turn into an ELOOP-shaped observation problem.

The current symlink suite is 11/11 passing on a case-sensitive test host.

So the state-space correction has now propagated one function further:

not observed as a symlink was never equivalent to observed non-symlink.

The useful states are SYMLINK, NON_SYMLINK, ABSENT, and UNKNOWN, and UNKNOWN now stays inside the checker as a first-class failure instead of escaping as a traceback.

And I agree with your scope note: this closes the contributor/CI generate path you exercised. I am not treating it as evidence that the deployed Hugging Face check path has exhibited the same failure.

Yes. I think the distinction you drew is the right one.

I do not have a receipt showing the exact stat succeeds -> scandir fails sequence on the deployed Hugging Face mount, so I cannot answer that part with “yes, the Job has done this.” What I have observed from that substrate is the truncated-read behavior we discussed earlier. I also do not have evidence that every mount-layer directory-enumeration failure necessarily kills the container before the checker can see it.

Given that uncertainty, I changed the checker rather than guessing which behavior the mount guarantees.

You were right about the asymmetry: the old code treated multiple candidates as unknown, but an unavailable candidate set could collapse to None and therefore look like absence.

_resolve_directory_entry() now distinguishes the states explicitly:

• None is reserved for a lookup that positively reports absence (ENOENT / ENOTDIR);
• other failures of the initial stat() are repository observation namespace probe failure;
• a scandir() failure after a successful target lookup is the same explicit probe failure, never absence;
• if non-exact resolution requires inspecting directory-entry identities and one of those observations fails, that is also a probe failure rather than silently skipping the entry;
• if the initial lookup succeeds and a complete directory enumeration succeeds but contains no entry with the identity the lookup returned, that is treated as a self-contradictory observation and fails closed too, rather than being reinterpreted as “missing”;
• multiple possible entries remain the separate repository observation namespace ambiguity case.

The exact-name fast path is unchanged, so ordinary exact-spelling hardlinks do not become errors merely because another directory entry shares the inode.

The same namespace preflight still runs before repository content is read and before generated outputs are written, so a probe failure blocks both paths.

I also moved the new failure shapes into host-neutral regression witnesses. The current namespace suite is 12/12 passing on a case-sensitive test host, with only the two real-filesystem case-alias integration cases skipped because that substrate cannot construct them.

So I would phrase the answer to your closing question as:

I do not yet know whether the deployed mount can produce that exact transient scandir() failure without killing the Job first. The checker no longer needs that assumption to be true. If namespace observation cannot be completed, or completes with mutually inconsistent results, silence is no longer interpreted as clean.

And yes, “two candidates and you refuse to guess; zero candidates and you guess missing” was the useful reduction. What looked like one “missing” state was actually two different states: ABSENT and UNKNOWN, and the old implementation had collapsed them.

Yes, at the point you asked, it only rejected symlink traversal. You found a real sibling gap.

I generalized the fix from a symlink policy into an observation-namespace preservation check.

The repository authority still keeps the exact locator strings supplied by git ls-files or the revision manifest. Before any content is read, repo_integrity.py now asks the host filesystem what directory entry each authoritative path prefix resolves to.

It deliberately does not casefold() or Unicode-normalize paths itself. I did not want to replace the filesystem's semantics with a guessed model of them.

The rule is instead:

• a single unusual spelling is allowed;
• if two distinct authoritative prefixes resolve to the same real directory entry, the run fails closed with repository observation namespace collision;
• the check is performed at every prefix, so Dir/a.md vs. dir/b.md is caught at the parent-directory level as well as Foo.md vs. foo.md at the final filename;
• the same namespace check runs before generated outputs are written, not only before reads.

So it is not quite “the index spelling must equal the filesystem spelling.” A single NFC authority path opening an NFD on-disk entry is not rejected merely for that. The invariant is that distinctions made by Authority must not silently collapse when materialized by the Observation filesystem.

There is one hardlink wrinkle I handled separately. Two exact directory entries that share an inode are permitted, because this inventory counts locators, not inode identities. But if a non-exact lookup lands on an inode represented by multiple directory entries, the checker cannot determine which entry the filesystem selected. That fails closed as repository observation namespace ambiguity rather than guessing and potentially reporting a false collision.

The regression evidence is split accordingly: the collision judgment itself has host-neutral tests using explicit authoritative-prefix → observed-entry mappings, while actual case-insensitive filesystem behavior is covered by host-dependent integration tests and skips on hosts where that failure shape cannot be constructed.

So the short answer to your last question is:

before your comment, only symlinks;
now the fail-closed boundary checks both redirection and namespace collapse against the filesystem's actual resolution behavior.

I also think your “same failure mode running the other direction” framing was the right abstraction. The symlink case was one Authority locator being redirected to a different filesystem object; this case was two Authority locators collapsing onto one Observation entry. Treating both as namespace-preservation failures made the fix much cleaner.

Yes, I kept the named-class tier as a genuine antichain.

I made one more pass over the evidence boundary before closing this, and there were a couple of useful corrections.

First, I removed the wording that made it sound as though the committed suite itself exhaustively enumerated all 120 guard orders. It does not. The in-repo tests pin the distinguishing precedence edges and the multi-named consumer behavior. Your 120-order run is now recorded explicitly as an external exhaustive audit of that suite's acceptance surface.

I also do not count that audit as a second independent acceptance oracle, since it used the same regression suite to decide PASS/FAIL for each permutation. It is corroborating evidence that the individual witnesses compose to exactly the six expected linear extensions, not an independent evidence root.

Second, MRK < ASC is now witnessed for every currently selected marker, not just the regional 4-byte marker. That still does not impose any ordering among the four markers themselves; each one is tested only against ASC.

So the intended contract remains:

{CR, LF, MRK} < ASC < ENV

with CR/LF/MRK unordered relative to one another, and MRK treated as one guard block at that contract level.

While reviewing the same Authority/Observation boundary, I also found and closed a separate local-Git edge case: a tracked symlink could let git ls-files name a symlink blob while the filesystem read followed it and observed the target's bytes instead. Reads and generated-output writes now fail closed on symlink traversal, including symlinked parent directories.

I tightened two other evidence descriptions at the same time: the live-domain sentinel now claims only the qualified surfaces independently enumerated by the test harness, and the three content-identity implementations are described as independently maintained consumers of one pinned oracle, not as three independent oracle roots.

I left gateway deployment provenance and webhook retry/liveness as separate operational questions rather than folding them into this patch.

So I think the ordering thread is closed at the right boundary now: forbidden variance is pinned, permitted variance remains permitted, and the evidence descriptions no longer claim stronger provenance than the tests actually provide.

Yes, 6 of 120 is the right target.

And I would keep ASC < ENV as part of the contract.

They are both residual in a broad sense, but not at the same residual layer. isascii() owns non-ASCII contamination that did not match one of the selected named markers; the lowercase-hex envelope owns what remains after that, such as TAB/NUL/space/uppercase-style ASCII drift. If ENV moves above ASC, that distinction collapses and unknown non-ASCII gets attributed to the lowercase-hex construction envelope instead.

So the intended partial order is:

{CR, LF, MRK} < ASC < ENV

with no promised relative order among CR, LF, and MRK.

You're also right about why the suite was still at 12. The single-violation CR and LF witnesses established reachability, but not the CR < ASC or LF < ASC precedence edges.

I've added the two mixed witnesses through the actual shared _check_dynamic_probe_filler() path:

• CR + non-selected non-ASCII → CR diagnostic
• LF + non-selected non-ASCII → LF diagnostic

I deliberately did not add CR + marker or similar witnesses, because that would start constraining the relative order inside the named-class tier and turn the partial-order contract into an arbitrary total order.

I also tightened the wording to state the contract explicitly as a partial order, and to be precise that the 120 permutations are over five guard blocks, treating the selected-marker loop as one block.

The exhaustive-permutation framing is a better way to state what “pinned” means here than my earlier wording was: the useful target is not that every source-code position is fixed, but that the suite accepts exactly the linear extensions of the declared diagnostic partial order.

Thanks — this was a very clean way to expose the remaining gap.

Thanks, it was not deliberate. It was the one missing witness class in this precedence test.

Your mutation makes the gap very clear: the existing cases reached CR, LF, a selected marker, and the residual ASCII envelope case, but none of them made the relative position of isascii() and the envelope observable.

I added a U+00FC (ü) case for exactly that reason.

It is:

• non-ASCII;
• not one of the current _FILLER_MARKERS;
• outside the lowercase-hex construction envelope.

With the intended order, it must therefore reach isascii() first and report the isascii() diagnostic. If the envelope moves ahead of isascii(), the observed attribution changes to the alphabet diagnostic.

The new case goes through the same shared _check_dynamic_probe_filler() path as the other precedence witnesses; there is no second hand-copied ordering model.

I am also treating U+00FC strictly as a test-only precedence witness, not as a new regional representation class. The matrix claim surface is unchanged.

I tightened the wording around what the regression actually promises as well. The interesting contract is not an arbitrary exact total order among all five guards — for example, I do not particularly care whether CR precedes LF as an abstract property. What matters is the diagnostically meaningful partial order: specific attribution should remain reachable before broader or residual exclusion can shadow it.

So I think the reusable rule becomes slightly sharper:

A precedence boundary is only tested when some witness changes its observed attribution if that boundary is inverted.

Or, shorter:

No distinguishing witness, no precedence evidence.

Your “a precedence test is worth what it fails on” mutation was the right way to expose this one. Thanks for pushing the rule back onto the test itself.