@ccoalm/ccl-skills 0.11.0 → 0.13.0

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/review_ledger_binding.py

@@ -44,6 +44,32 @@ commit; the alternative costs a review round nobody can reproduce. The workflow
 directory stays bound, as it was before: with only `skills/` bound, deleting the CI
 step that runs this gate would not move the candidate the evidence has to match.
 
+The candidate's Git identity and the reviewer's input are two different sizes.
+A landing candidate is base..HEAD and has no natural byte limit; a review packet
+is what one reviewer can read whole, and the controller caps it at
+`MAX_PACKET_BYTES`. Binding the landing candidate to ONE packet hash therefore
+made the reviewer's ceiling the pull request's ceiling: a candidate larger than
+one packet could not be frozen, no ledger could ever bind it, and authors split
+the pull request instead of the review -- eight merges for one release. The
+review side already allowed splitting a large candidate by path into partitions
+(the `code-review` skill's packet rule); what was missing was the merge side
+consuming them. A committed landing partition manifest closes that: it names
+path partitions whose changed files together equal the candidate's changed files
+exactly once, and each partition's `candidate_sha256`, which is what
+`--print-candidate --paths <partition>` already answers. This gate recomputes
+every partition with the same `freeze_packet`, requires a validator-accepted
+ledger per partition, and refuses any manifest whose parts do not add up to the
+whole: an uncovered file, an overlapping file, a partition that no longer
+reproduces, a base other than the fork point, or an aggregate hash that does not
+reproduce its own partitions. The manifest carries a top-level 64-hex
+`candidate_sha256` -- the aggregate identity -- so it satisfies the existing
+receipt predicate and committing it moves no partition; that is the load-bearing
+reason for the field, and the exclusion predicate itself is unchanged. What the
+manifest proves is the same narrow thing the single ledger proves, taken per
+part: every byte that lands is a byte some external round froze and inspected.
+Merge-queue aggregation of several pull requests into one HEAD is a different
+aggregate and remains unsolved here.
+
 Boundaries this gate does NOT close, stated because a gate that lives inside the
 candidate cannot authenticate itself: it cannot prove the caller retained every
 earlier chain; it runs the candidate's own validator, so a candidate that also
@@ -92,6 +118,21 @@ EVIDENCE_MEMBER = re.compile(r"^specs/[^/]+/evidence/")
 # A receipt is small; anything larger is not one, and reading it is not free.
 MAX_RECEIPT_BYTES = 4_000_000
 DEFAULT_PATHS = (".",)
+# A landing partition manifest splits one candidate by path into packets a
+# reviewer can read whole. Its shape is closed: exactly these keys, this kind,
+# and a bounded partition count, so a manifest cannot double as a ledger or
+# smuggle fields the gate does not read.
+MANIFEST_KIND = "landing_partition_manifest"
+MANIFEST_SCHEMA_VERSION = 1
+MANIFEST_KEYS = {"schema_version", "kind", "base", "partitions", "candidate_sha256"}
+PARTITION_KEYS = {"paths", "candidate_sha256"}
+MAX_PARTITIONS = 64
+HEX40 = re.compile(r"^[0-9a-f]{40}$")
+HEX64 = re.compile(r"^[0-9a-f]{64}$")
+
+
+class ManifestError(Exception):
+    """A manifest that does not describe this candidate; the message is the reason."""
 
 
 def emit(message: str) -> None:
@@ -312,6 +353,233 @@ def candidate_hash(module: types.ModuleType, repo_root: Path, base: str, paths:
     return packet_sha256
 
 
+def canonical_digest(value: object) -> str:
+    canonical = json.dumps(
+        value, sort_keys=True, separators=(",", ":"), ensure_ascii=False
+    ).encode("utf-8")
+    return hashlib.sha256(canonical).hexdigest()
+
+
+def manifest_aggregate(base: str, partitions: list[dict]) -> str:
+    """The aggregate identity a manifest carries as its own `candidate_sha256`.
+
+    Computed here and nowhere else: the renderer writes it and the gate rechecks
+    it, so two implementations of one hash cannot drift into a forged manifest.
+    """
+    return canonical_digest(
+        {
+            "schema_version": MANIFEST_SCHEMA_VERSION,
+            "kind": MANIFEST_KIND,
+            "base": base,
+            "partitions": partitions,
+        }
+    )
+
+
+def validate_partition_path(value: object) -> str:
+    """A partition path is a plain relative path, never a pathspec.
+
+    The gate appends its own exclusions; a manifest that could name `:(exclude)`
+    or a glob would choose what its partition does not cover, and a leading `-`
+    would reach git as an option. Reject the shape here rather than trust git to
+    interpret it the way the manifest author hoped.
+    """
+    if not isinstance(value, str) or not value:
+        raise ManifestError("partition path must be a non-empty string")
+    if value.startswith((":", "-", "/")) or any(ord(ch) < 32 for ch in value):
+        raise ManifestError(f"partition path is not a plain relative path: {value!r}")
+    # Git reads `*`, `?`, `[` and `\` inside a pathspec as glob/escape syntax even
+    # without magic; a wildcard partition would let the manifest choose its own
+    # coverage, so it is refused as a path rather than handed to git.
+    if any(ch in value for ch in "*?[]\\"):
+        raise ManifestError(f"partition path contains a pathspec wildcard: {value!r}")
+    if ".." in value.split("/"):
+        raise ManifestError(f"partition path escapes the repository: {value!r}")
+    return value
+
+
+def parse_manifest(payload: dict, fork: str) -> tuple[list[list[str]], list[str]]:
+    """Return (partition path lists, partition hashes) or raise ManifestError.
+
+    Order of checks is cheapest first and each failure names one reason, so an
+    author reads which part failed to add up rather than a generic refusal.
+    """
+    if set(payload) != MANIFEST_KEYS:
+        raise ManifestError("manifest does not carry exactly the manifest keys")
+    if payload["schema_version"] != MANIFEST_SCHEMA_VERSION or type(payload["schema_version"]) is not int:
+        raise ManifestError(f"manifest schema_version must be {MANIFEST_SCHEMA_VERSION}")
+    base = payload["base"]
+    if not isinstance(base, str) or not HEX40.match(base):
+        raise ManifestError("manifest base must be a 40-hex commit id")
+    if base != fork:
+        raise ManifestError(
+            f"manifest base {base[:12]} is not this candidate's fork point {fork[:12]}"
+        )
+    partitions = payload["partitions"]
+    if not isinstance(partitions, list) or not 1 <= len(partitions) <= MAX_PARTITIONS:
+        raise ManifestError(f"manifest must list between 1 and {MAX_PARTITIONS} partitions")
+    path_lists: list[list[str]] = []
+    digests: list[str] = []
+    seen: set[str] = set()
+    for index, partition in enumerate(partitions, start=1):
+        if not isinstance(partition, dict) or set(partition) != PARTITION_KEYS:
+            raise ManifestError(f"partition {index} does not carry exactly paths and candidate_sha256")
+        paths = partition["paths"]
+        if not isinstance(paths, list) or not paths:
+            raise ManifestError(f"partition {index} names no paths")
+        validated = [validate_partition_path(value) for value in paths]
+        for value in validated:
+            if value in seen:
+                raise ManifestError(f"partition path is listed twice: {value}")
+            seen.add(value)
+        digest = partition["candidate_sha256"]
+        if not isinstance(digest, str) or not HEX64.match(digest):
+            raise ManifestError(f"partition {index} candidate_sha256 must be 64-hex")
+        path_lists.append(validated)
+        digests.append(digest)
+    aggregate = payload["candidate_sha256"]
+    if aggregate != manifest_aggregate(base, partitions):
+        raise ManifestError("manifest aggregate candidate_sha256 does not reproduce its partitions")
+    return path_lists, digests
+
+
+def partition_coverage(
+    repo_root: Path,
+    base: str,
+    path_lists: list[list[str]],
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+) -> list[list[str]]:
+    """Each partition's changed files; refuse unless they tile the candidate.
+
+    Name-only diffs are cheap, so every way the parts can fail to add up is found
+    before any packet is frozen: an empty partition, a changed file in no
+    partition, or a changed file in two. Overlap is refused rather than tolerated
+    because two verdicts over one file leave undefined which one covers it.
+    """
+    per_partition: list[list[str]] = []
+    owner: dict[str, int] = {}
+    overlaps: list[str] = []
+    for index, paths in enumerate(path_lists, start=1):
+        changed = changed_skill_paths(repo_root, base, tuple(paths) + excludes)
+        if not changed:
+            raise ManifestError(f"partition {index} ({' '.join(paths)}) covers no changed path")
+        for value in changed:
+            if value in owner:
+                overlaps.append(value)
+            owner[value] = index
+        per_partition.append(changed)
+    if overlaps:
+        raise ManifestError(
+            "partitions overlap on changed paths: " + ", ".join(sorted(set(overlaps))[:5])
+        )
+    uncovered = sorted(set(changed_all) - set(owner))
+    if uncovered:
+        raise ManifestError(
+            "changed paths uncovered by every partition: " + ", ".join(uncovered[:5])
+        )
+    # Equality, not containment: under a narrowed --paths scope a partition can
+    # reach changed files outside the reviewed set, and a union larger than the
+    # candidate is as wrong as one smaller than it.
+    outside = sorted(set(owner) - set(changed_all))
+    if outside:
+        raise ManifestError(
+            "partitions cover changed paths outside the reviewed scope: " + ", ".join(outside[:5])
+        )
+    return per_partition
+
+
+def render_manifest(
+    module: types.ModuleType,
+    repo_root: Path,
+    base: str,
+    path_lists: list[list[str]],
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+) -> dict:
+    """Build the manifest an author commits, with every hash computed by this gate."""
+    validated = [[validate_partition_path(value) for value in paths] for paths in path_lists]
+    seen: set[str] = set()
+    for paths in validated:
+        for value in paths:
+            if value in seen:
+                raise ManifestError(f"partition path is listed twice: {value}")
+            seen.add(value)
+    partition_coverage(repo_root, base, validated, excludes, changed_all)
+    partitions = [
+        {
+            "paths": paths,
+            "candidate_sha256": candidate_hash(module, repo_root, base, tuple(paths) + excludes),
+        }
+        for paths in validated
+    ]
+    return {
+        "schema_version": MANIFEST_SCHEMA_VERSION,
+        "kind": MANIFEST_KIND,
+        "base": base,
+        "partitions": partitions,
+        "candidate_sha256": manifest_aggregate(base, partitions),
+    }
+
+
+def accepted_ledger_for(
+    evidence: list[tuple[Path, dict]],
+    repo_root: Path,
+    validator: Path,
+    digest: str,
+    rejected: list[str],
+) -> str | None:
+    """The first validator-accepted closeout ledger bound to `digest`, if any.
+
+    The same criterion the single-candidate path uses: a receipt-shaped file is
+    not evidence, only a ledger the validator accepts, because this gate cannot
+    authenticate that a controller minted what it reads.
+    """
+    for path, payload in evidence:
+        if payload.get("candidate_sha256") != digest:
+            continue
+        if "closeout_state" not in payload or "controller_receipts" not in payload:
+            continue
+        relative = str(path.relative_to(repo_root))
+        accepted, output = validator_accepts(validator, path)
+        if accepted:
+            return f"{relative} -- {output}"
+        rejected.append(f"{relative}: {output}")
+    return None
+
+
+def bind_manifest(
+    module: types.ModuleType,
+    repo_root: Path,
+    base: str,
+    payload: dict,
+    excludes: tuple[str, ...],
+    changed_all: list[str],
+    evidence: list[tuple[Path, dict]],
+    validator: Path,
+    rejected_ledgers: list[str],
+) -> list[str]:
+    """Bind the candidate through one manifest; return per-partition proof lines.
+
+    Raises ManifestError naming the first part that does not add up.
+    """
+    path_lists, digests = parse_manifest(payload, base)
+    partition_coverage(repo_root, base, path_lists, excludes, changed_all)
+    proofs: list[str] = []
+    for index, (paths, recorded) in enumerate(zip(path_lists, digests), start=1):
+        label = f"partition {index} ({' '.join(paths)})"
+        actual = candidate_hash(module, repo_root, base, tuple(paths) + excludes)
+        if actual != recorded:
+            raise ManifestError(
+                f"{label} recorded {recorded[:12]}... but does not reproduce: the candidate now hashes to {actual[:12]}..."
+            )
+        proof = accepted_ledger_for(evidence, repo_root, validator, actual, rejected_ledgers)
+        if proof is None:
+            raise ManifestError(f"no accepted ledger binds {label} {actual}")
+        proofs.append(f"  {label} {actual[:12]}... <- {proof}")
+    return proofs
+
+
 def validator_accepts(validator: Path, ledger_path: Path) -> tuple[bool, str]:
     result = subprocess.run(
         [sys.executable, str(validator), str(ledger_path)],
@@ -382,7 +650,27 @@ def main() -> int:
         action="store_true",
         help="print the candidate hash the evidence must bind, then exit",
     )
+    parser.add_argument(
+        "--print-manifest",
+        action="store_true",
+        help=(
+            "render a landing partition manifest for the --partition groups given, "
+            "with every hash computed by this gate, then exit"
+        ),
+    )
+    parser.add_argument(
+        "--partition",
+        action="append",
+        nargs="+",
+        metavar="PATH",
+        default=[],
+        help="one partition's paths; repeat per partition (only with --print-manifest)",
+    )
     args = parser.parse_args()
+    if args.print_manifest and not args.partition:
+        parser.error("--print-manifest needs at least one --partition")
+    if args.partition and not args.print_manifest:
+        parser.error("--partition is only meaningful with --print-manifest")
 
     repo_root = Path(args.repo_root).resolve()
     base = args.base or os.environ.get("CCL_SKILL_BASE_REF", "")
@@ -410,61 +698,114 @@ def main() -> int:
     # confirmed, and no test asserts a bypass this gate does not have. `literal`
     # stays because interpreting these names as patterns is a capability the gate
     # never needed, and removing it costs nothing.
-    paths = tuple(args.paths) + tuple(
+    excludes = tuple(
         f":(exclude,literal){path}" for path in added_evidence_paths(repo_root, base)
     )
+    paths = tuple(args.paths) + excludes
     require_committed_tree(repo_root, paths)
     changed = changed_skill_paths(repo_root, base, paths)
     if not changed:
         # No reviewed path moved, so there is no candidate to freeze and nothing to
         # bind. Say which it is rather than letting an empty packet surface as a
         # freeze error, which reads like a broken gate.
-        if args.print_candidate:
+        if args.print_candidate or args.print_manifest:
             emit(f"review_ledger_binding_no_change: no reviewed-path change against {base}")
         else:
             print(f"review_ledger_binding_ok: no reviewed-path change against {base}")
         return 0
 
     module = load_controller(repo_root)
+
+    if args.print_manifest:
+        try:
+            manifest = render_manifest(module, repo_root, base, args.partition, excludes, changed)
+        except ManifestError as exc:
+            emit(f"review_ledger_binding_error: cannot render a landing partition manifest: {exc}")
+            return 1
+        except Exception as exc:  # noqa: BLE001 - surface the controller's own message
+            emit(f"review_ledger_binding_error: cannot freeze a partition packet: {exc}")
+            return 1
+        print(json.dumps(manifest, indent=2, ensure_ascii=False))
+        return 0
+
+    # The whole candidate may be larger than one packet. That is no longer a
+    # terminal error: record why the single freeze failed and let a committed
+    # partition manifest bind the candidate part by part.
+    expected: str | None = None
+    whole_error: str | None = None
     try:
         expected = candidate_hash(module, repo_root, base, paths)
     except Exception as exc:  # noqa: BLE001 - surface the controller's own message
-        emit(f"review_ledger_binding_error: cannot freeze the candidate packet: {exc}")
-        return 1
+        whole_error = str(exc)
 
     if args.print_candidate:
+        if expected is None:
+            emit(f"review_ledger_binding_error: cannot freeze the candidate packet: {whole_error}")
+            return 1
         print(expected)
         return 0
 
     validator = repo_root / "skills" / "skill-extraction-workflow" / "scripts" / VALIDATOR
+    evidence = scan(repo_root, args.evidence_root)
     ledgers: list[str] = []
-    for path, payload in scan(repo_root, args.evidence_root):
-        if payload.get("candidate_sha256") != expected:
-            continue
-        relative = str(path.relative_to(repo_root))
+    if expected is not None:
         # Only a validator-accepted ledger counts. A receipt-shaped file proves
         # nothing on its own: this gate cannot authenticate that a controller
         # minted it, so any branch keyed on a self-declared field is a bypass a
         # contributor can hand-write.
-        if "closeout_state" in payload and "controller_receipts" in payload:
-            accepted, output = validator_accepts(validator, path)
-            if accepted:
-                print(
-                    f"review_ledger_binding_ok: {relative} binds the landing candidate "
-                    f"({expected[:12]}...) -- {output}"
-                )
-                return 0
-            ledgers.append(f"{relative}: {output}")
-
-    emit(
-        "review_ledger_binding_failed: no accepted review evidence binds the landing "
-        f"candidate {expected}"
-    )
+        proof = accepted_ledger_for(evidence, repo_root, validator, expected, ledgers)
+        if proof is not None:
+            print(
+                f"review_ledger_binding_ok: {proof.split(' -- ', 1)[0]} binds the landing "
+                f"candidate ({expected[:12]}...) -- {proof.split(' -- ', 1)[1]}"
+            )
+            return 0
+
+    manifests: list[str] = []
+    for path, payload in evidence:
+        if payload.get("kind") != MANIFEST_KIND:
+            continue
+        relative = str(path.relative_to(repo_root))
+        try:
+            proofs = bind_manifest(
+                module, repo_root, base, payload, excludes, changed, evidence, validator, ledgers
+            )
+        except ManifestError as exc:
+            manifests.append(f"{relative}: {exc}")
+            continue
+        except Exception as exc:  # noqa: BLE001 - surface the controller's own message
+            manifests.append(f"{relative}: cannot freeze a partition packet: {exc}")
+            continue
+        print(
+            f"review_ledger_binding_ok: {relative} binds the landing candidate as "
+            f"{len(proofs)} partitions (aggregate {payload['candidate_sha256'][:12]}...)"
+        )
+        for line in proofs:
+            print(line)
+        return 0
+
+    if expected is None:
+        emit(
+            "review_ledger_binding_failed: the whole candidate cannot be frozen as one "
+            f"packet ({whole_error}) and no committed landing partition manifest binds it"
+        )
+        emit(
+            "  split the candidate by path: --print-manifest --partition <paths> "
+            "[--partition <paths> ...] renders the manifest; commit it with one "
+            "validated ledger per partition"
+        )
+    else:
+        emit(
+            "review_ledger_binding_failed: no accepted review evidence binds the landing "
+            f"candidate {expected}"
+        )
     emit(f"  reviewed paths: {' '.join(paths)} against {base}")
     emit(f"  changed files: {len(changed)}")
     for row in ledgers:
         emit(f"  rejected ledger -> {row}")
-    if not ledgers:
+    for row in manifests:
+        emit(f"  rejected manifest -> {row}")
+    if not ledgers and not manifests:
         emit(
             "  no committed ledger records this candidate; run the extraction review "
             "lane against the final, committed tree"

package/dist/assets/marketplace/plugins/ccl-skills/skills/skill-extraction-workflow/scripts/test_review_ledger_binding.sh

@@ -307,6 +307,191 @@ out="$(run_scope --base "$SCOPE_BASE" --print-candidate)"; rc=$?
 check "the same clean checkout still reaches its normal verdict" \
   '[ "$rc" = 0 ] && case "$out" in *"no reviewed-path change"*) true;; *) false;; esac'
 
+# Partition: the candidate's Git identity is base..HEAD, but the packet a reviewer
+# can read is capped at the controller's byte ceiling. A landing candidate larger
+# than one packet used to be unlandable as one pull request -- the whole-candidate
+# freeze failed and no ledger could ever bind it -- so authors split the pull
+# request instead of the review. A committed landing partition manifest names
+# path partitions that together cover every changed file exactly once, each bound
+# by its own validated ledger; the gate recomputes every partition and refuses any
+# manifest whose parts do not add up to the whole.
+PART="$WORK/partition-repo"
+mkdir -p "$PART/skills/code-review/scripts" "$PART/skills/skill-extraction-workflow/scripts" "$PART/specs/round/evidence" "$PART/lane-a" "$PART/lane-b"
+cp "$CONTROLLER" "$PART/skills/code-review/scripts/review_gate.py"
+cat >"$PART/skills/skill-extraction-workflow/scripts/validate_extraction_review_state.py" <<'PY'
+import sys
+print("extraction_review_state_ok: stub accepted")
+sys.exit(0)
+PY
+git -C "$PART" init -q .
+git -C "$PART" config user.email t@example.invalid
+git -C "$PART" config user.name tester
+printf 'baseline\n' >"$PART/skills/skill-extraction-workflow/SKILL.md"
+printf 'baseline\n' >"$PART/lane-a/big.txt"
+printf 'baseline\n' >"$PART/lane-b/big.txt"
+git -C "$PART" add -A && git -C "$PART" commit -qm baseline
+PART_BASE="$(git -C "$PART" rev-parse HEAD)"
+
+run_part() { python3 "$GATE" --repo-root "$PART" "$@" 2>&1; }
+
+# The manifest oracle mirrors the documented canonical form (sorted keys, compact
+# separators, UTF-8) independently of the gate, so a drift in either side reds.
+cat >"$WORK/write-manifest.py" <<'PY'
+import hashlib, json, sys
+out, base, aggregate = sys.argv[1], sys.argv[2], sys.argv[3]
+partitions = []
+for spec in sys.argv[4:]:
+    paths, digest = spec.rsplit("=", 1)
+    partitions.append({"paths": paths.split(), "candidate_sha256": digest})
+body = {"schema_version": 1, "kind": "landing_partition_manifest", "base": base, "partitions": partitions}
+if aggregate == "AUTO":
+    canonical = json.dumps(body, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+    aggregate = hashlib.sha256(canonical).hexdigest()
+body["candidate_sha256"] = aggregate
+with open(out, "w", encoding="utf-8") as handle:
+    json.dump(body, handle, indent=2)
+    handle.write("\n")
+PY
+write_closeout() { python3 - "$1" "$2" <<'PY'
+import json, sys
+from pathlib import Path
+Path(sys.argv[1]).write_text(json.dumps({"schema_version": 3, "closeout_state": "ready_for_human_decision", "controller_receipts": [], "candidate_sha256": sys.argv[2]}))
+PY
+}
+
+# Two lanes each change ~130 KB: either fits one packet, the pair does not.
+python3 - "$PART" <<'PY'
+import sys
+from pathlib import Path
+root = Path(sys.argv[1])
+for lane in ("lane-a", "lane-b"):
+    lines = [f"{lane} line {index:06d} " + "x" * 40 for index in range(2200)]
+    (root / lane / "big.txt").write_text("\n".join(lines) + "\n")
+PY
+git -C "$PART" add -A && git -C "$PART" commit -qm "oversized landing"
+
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a candidate too large for one packet is refused with the partition recipe, not a bare freeze error" \
+  '[ "$rc" = 1 ] && case "$out" in *"exceeds 200000 bytes"*"landing partition manifest"*) true;; *) false;; esac'
+
+MANIFEST_JSON="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-b)"; rc=$?
+check "the gate renders a manifest for a partition that covers the whole candidate" \
+  '[ "$rc" = 0 ] && python3 -c "import json,sys; m=json.loads(sys.argv[1]); assert m[\"kind\"]==\"landing_partition_manifest\" and len(m[\"partitions\"])==2 and m[\"base\"]==sys.argv[2]" "$MANIFEST_JSON" "$PART_BASE"'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a)"; rc=$?
+check "rendering refuses a partition that leaves a changed path uncovered" \
+  '[ "$rc" != 0 ] && case "$out" in *"uncovered"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-a/big.txt lane-b)"; rc=$?
+check "rendering refuses partitions that overlap on a changed path" \
+  '[ "$rc" != 0 ] && case "$out" in *"overlap"*"lane-a/big.txt"*) true;; *) false;; esac'
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition lane-a --partition lane-a lane-b)"; rc=$?
+check "rendering refuses the same path listed in two partitions before touching git" \
+  '[ "$rc" != 0 ] && case "$out" in *"listed twice"*"lane-a"*) true;; *) false;; esac'
+
+HASH_A="$(run_part --base "$PART_BASE" --print-candidate --paths lane-a)"
+HASH_B="$(run_part --base "$PART_BASE" --print-candidate --paths lane-b)"
+check "a partition's hash is exactly what --print-candidate --paths already answers" \
+  '[ ${#HASH_A} = 64 ] && python3 -c "import json,sys; m=json.loads(sys.argv[1]); assert [p[\"candidate_sha256\"] for p in m[\"partitions\"]]==[sys.argv[2], sys.argv[3]]" "$MANIFEST_JSON" "$HASH_A" "$HASH_B"'
+
+printf '%s\n' "$MANIFEST_JSON" >"$PART/specs/round/evidence/landing-partitions.json"
+git -C "$PART" add -A && git -C "$PART" commit -qm "partition manifest"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose partitions carry no validated ledger is refused, naming the partition" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted ledger"*"lane-a"*) true;; *) false;; esac'
+HASH_A_AFTER="$(run_part --base "$PART_BASE" --print-candidate --paths lane-a)"
+check "committing the manifest does not move the partition it describes" \
+  '[ "$HASH_A_AFTER" = "$HASH_A" ]'
+
+write_closeout "$PART/specs/round/evidence/closeout-a.json" "$HASH_A"
+write_closeout "$PART/specs/round/evidence/closeout-b.json" "$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "partition ledgers"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a complete manifest with a validated ledger per partition binds a candidate no single packet could" \
+  '[ "$rc" = 0 ] && case "$out" in *"binds the landing candidate"*"2 partitions"*) true;; *) false;; esac'
+PART_GOOD="$(git -C "$PART" rev-parse HEAD)"
+
+# Every way the parts can fail to add up to the whole is refused for its own
+# reason. Each probe branches from the passing state so the cases stay independent.
+MANIFEST="$PART/specs/round/evidence/landing-partitions.json"
+probe_part() {
+  git -C "$PART" checkout -q -B "probe" "$PART_GOOD"
+}
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest drops a lane"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest that leaves a changed path in no partition is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"uncovered"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A" "lane-a/big.txt lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest overlaps"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose partitions overlap is refused before any packet is frozen" \
+  '[ "$rc" = 1 ] && case "$out" in *"overlap"*"lane-a/big.txt"*) true;; *) false;; esac'
+
+probe_part
+printf 'moved after the manifest was written\n' >>"$PART/lane-a/big.txt"
+git -C "$PART" add -A && git -C "$PART" commit -qm "candidate moves after manifest"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a partition whose recorded hash no longer reproduces is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"lane-a"*"does not reproduce"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "0000000000000000000000000000000000000000" AUTO "lane-a=$HASH_A" "lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest names another base"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest written against another base is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"base"*"fork point"*) true;; *) false;; esac'
+
+probe_part
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" "$(printf 'f%.0s' $(seq 64))" "lane-a=$HASH_A" "lane-b=$HASH_B"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest aggregate forged"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest whose aggregate hash does not reproduce its partitions is refused" \
+  '[ "$rc" = 1 ] && case "$out" in *"aggregate"*) true;; *) false;; esac'
+
+for bad_path in ":(exclude)lane-b" "-lane-b" "../lane-b" "/lane-b" "lane-*" "lane-?" "lane-[ab]" "lane-\\b"; do
+  probe_part
+  python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO "lane-a=$HASH_A" "$bad_path=$HASH_B"
+  git -C "$PART" add -A && git -C "$PART" commit -qm "manifest smuggles a pathspec"
+  out="$(run_part --base "$PART_BASE")"; rc=$?
+  check "a manifest partition path shaped like $bad_path is refused as a path, not handed to git" \
+    '[ "$rc" = 1 ] && case "$out" in *"partition path"*) true;; *) false;; esac'
+done
+
+out="$(run_part --base "$PART_BASE" --print-manifest --partition 'lane-*')"; rc=$?
+check "rendering refuses a wildcard partition instead of letting git expand it" \
+  '[ "$rc" != 0 ] && case "$out" in *"partition path"*"wildcard"*) true;; *) false;; esac'
+
+# Under a narrowed --paths scope the partition union must equal the reviewed
+# changed set, not merely contain it: a partition naming `.` reaches lane-b even
+# though only lane-a is under review, and that surplus is refused before any
+# packet is frozen. The ledgers are removed so the single-ledger path cannot
+# satisfy the narrowed scope first.
+probe_part
+git -C "$PART" rm -q "$PART/specs/round/evidence/closeout-a.json" "$PART/specs/round/evidence/closeout-b.json"
+python3 "$WORK/write-manifest.py" "$MANIFEST" "$PART_BASE" AUTO ".=$(printf '0%.0s' $(seq 64))"
+git -C "$PART" add -A && git -C "$PART" commit -qm "manifest reaches outside the reviewed scope"
+out="$(run_part --base "$PART_BASE" --paths lane-a)"; rc=$?
+check "a partition reaching changed paths outside a narrowed --paths scope is refused, not accepted as covering" \
+  '[ "$rc" = 1 ] && case "$out" in *"outside the reviewed scope"*"lane-b/big.txt"*) true;; *) false;; esac'
+
+probe_part
+git -C "$PART" rm -q "$PART/specs/round/evidence/closeout-b.json"
+git -C "$PART" commit -qm "one ledger missing"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "a manifest with one partition unbound is refused, naming that partition" \
+  '[ "$rc" = 1 ] && case "$out" in *"no accepted ledger"*"lane-b"*) true;; *) false;; esac'
+
+git -C "$PART" checkout -q -B "landing" "$PART_GOOD"
+out="$(run_part --base "$PART_BASE")"; rc=$?
+check "the passing partition state still passes after the probes" \
+  '[ "$rc" = 0 ]'
+
 # The suite above exercises a synthetic repository. The gate must also run against
 # the real checkout it ships in, or a break in that path passes every test here.
 REAL_ROOT="$(cd "$DIR/../../.." && pwd -P)"