From bf0b4e0aafa2648b66efe626432ac702b7ad6261 Mon Sep 17 00:00:00 2001 From: PhysShell <45852143+PhysShell@users.noreply.github.com> Date: Wed, 21 Oct 2026 06:24:13 +0500 Subject: [PATCH] =?UTF-8?q?docs(evidence):=20P-014=20=E2=80=94=20record=20?= =?UTF-8?q?owner=20ruling=20(GO-P014-BOUNDED-DESIGN=20/=20NO-PRODUCTION)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit K4 accepted as PASS-COMPILATION-CONFLICT with the limit SITE-LEVEL-CONFLICT-NOT-REPRESENTED; HOLD-FORMAL-GO lifted; GO allows a bounded design only. NuGet hash wording: the file hash vs content hash difference has a documented cause (content hash excludes signature data); no independent byte-level recomputation of the normalized content hash was done. Report text only. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01TFkNAFFQz9KoTzpPws8vYG --- .../p014-reference-coverage-2026-10/REPORT.md | 38 +++++++++++++++---- 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/docs/evidence/p014-reference-coverage-2026-10/REPORT.md b/docs/evidence/p014-reference-coverage-2026-10/REPORT.md index b5d4c49a..8468b07d 100644 --- a/docs/evidence/p014-reference-coverage-2026-10/REPORT.md +++ b/docs/evidence/p014-reference-coverage-2026-10/REPORT.md @@ -3,9 +3,13 @@ **Pre-registered result: `GO-P014-BOUNDED-DESIGN`.** The GO has narrow content: the measured gain in Own.NET diagnostics is small (§5). -**Owner decision on review: `ACCEPT-REFERENCE-COVERAGE-FINDING / HOLD-FORMAL-GO / NO-PRODUCTION`.** The formal GO is -held pending the verification in §8, which was done without a new experiment and without changing rules or -thresholds. §8 corrects one claim of this report, about package identity. +**Final owner ruling: `GO-P014-BOUNDED-DESIGN / NO-PRODUCTION`** (§8.7). +- K4 is accepted as `PASS-COMPILATION-CONFLICT`, with the limit `SITE-LEVEL-CONFLICT-NOT-REPRESENTED`. +- The earlier `HOLD-FORMAL-GO` is lifted. +- The GO allows a bounded design only. No production change and no scope extension. + +§8 holds the post-review verification, done without a new experiment and without changing rules or thresholds. It +corrects one claim of this report, about package identity. Rules: [`00-preregistration.md`](00-preregistration.md), commit `2e73767b` (04:43 +05; the "04:45" in its header is my clock reading, and the commit time is the authoritative one). Own.NET `main` `c6e8a3c1`; extractor built offline @@ -228,7 +232,8 @@ Against the pre-registered K4 ("recorded as ambiguous/conflict, never `RECOVERED - **Never `RECOVERED_CORRECT`:** yes, because A == B and no recovery is claimed. - **Not recorded at site level:** the per-site binding silently picks the first definition. -Whether compilation-level registration satisfies K4 is the owner's call. The facts above do not change with it. +The owner ruled on this as `PASS-COMPILATION-CONFLICT`, with the limit `SITE-LEVEL-CONFLICT-NOT-REPRESENTED` +(§8.7). All seven control summaries are now in `data/controls/K*.summary.json`. ### 8.2 NuGet SHA-512 comparison @@ -248,7 +253,11 @@ computed SHA-512 (base64) of the `.nupkg` file myself: - The assets' `sha512` is NuGet's package content hash, the same value NuGet records in `.nupkg.metadata`. It is not the hash of the `.nupkg` file, so my original comparison was wrong. All 231 present packages match their assets entry, and **package identity is confirmed**, not approximate. -- **Not checked by me:** why the content hash and the file hash differ. Package signatures are the likely reason. +- **Why the two hashes differ** has a documented cause in NuGet's package-signing design: the file hash covers + the whole `.nupkg`, while the content hash is computed over the package content without the signature data. +- **Not done:** an independent byte-level recomputation of that normalized content hash. The evidence is the + agreement of the assets' values with the content hashes NuGet itself recorded in the cache (231/231). That + confirms the content hashes are consistent; it is not a recomputation. - **Package sources** (`.nupkg.metadata` `source`): P4 and P5 are all, or all but one, from nuget.org. For P1–P3, 46, 2 and 2 packages came from another source. The source addresses are not published here (D13). Identical content hashes make the content the same whatever the source. @@ -297,8 +306,23 @@ reference set than R2's binding numbers, and the two sets of numbers are not one - Criteria 1, 3 and 4 hold. Criterion 1 holds on the exact projects alone (P4, P5), and criterion 4 now holds without the identity caveat. - Criterion 2's controls hold, with K4's conflict recorded at compilation level only (§8.1). -- The pre-registered result stays `GO-P014-BOUNDED-DESIGN`. The owner's `HOLD-FORMAL-GO` applies until the K4 - reading is decided. +- The pre-registered result stays `GO-P014-BOUNDED-DESIGN`. The owner's ruling on K4 is in §8.7. + +### 8.7 Owner ruling (recorded after the merge of #419, `ad17d7b2`) + +`GO-P014-BOUNDED-DESIGN / NO-PRODUCTION`. +- **K4 = `PASS-COMPILATION-CONFLICT`.** CS0101 satisfies the pre-registered conflict registration, and no false + `RECOVERED_CORRECT` was claimed. +- **Limit kept: `SITE-LEVEL-CONFLICT-NOT-REPRESENTED`.** The shared `CSharpCompilation` still binds `Dup.T` to its + first definition. This is not evidence of correct project isolation. +- **Scope of the GO.** It allows a bounded design only, given the limited diagnostic effect: 1 actionable TP, 2 minor + TPs, 6 FPs. No production changes and no automatic scope extension. +- **First design must cover:** + - an honest `binding coverage` metric; + - the bounded applicability of `project.assets.json`; + - mandatory control of false OWN001/event findings. + + NuGet references go into the extractor only after that design. ## 9. Files