I read this as an independent adversarial verification of Todo 3 only - I’ll reconstruct the contract and provenance, audit the implementation and tests, run isolated failure probes and quality gates, then write only the required verification evidence and cleanup receipt.


I’ve reconstructed the Todo 3 contract and found the critical audit seams: durable-row semantic validation, global canonical ordering, filesystem substitution resistance, torn-tail repair, and whether the claimed RED can be reproduced without importing code that did not yet exist. I’m moving from static inspection to independent provenance and runtime probes now.


The focused suite and 49 regressions pass, and the happy/replay/restart/torn-tail/interior-flip paths behave as reported. Adversarial boundary probes found release-blocking fail-closed violations: a symlinked `nutrition-plans` parent allows the append outside the customer root before raising an untyped `NotADirectoryError`, hard-linked sidecar data is accepted, decreasing canonical sequence pins are accepted across days, and a rehashed arbitrary logical key is accepted. I’m sealing a `needs-fix` verification with exact repros and cleanup evidence.


schema: AdversarialVerify

verdict: needs-fix

scope: Todo 3 only: append-only day-status sidecar

focused_tests: 14 passed

existing_regressions: 49 passed

quality_gates: LSP, ruff, ty, basedpyright, compileall, no-excuse passed

persistence: 0600, replay, restart, fsync, hash chain, explicit torn-tail repair, interior corruption rejection passed

canonical_stream: bytes and legacy reader unchanged

scope_control: no Todo 4+ behavior

issue: Symlinked parent mutates outside the customer root

repro: Symlink <customer>/nutrition-plans to <outside>, then append a valid operation.

actual: outside/weekly-operations.jsonl is created before untyped NotADirectoryError.

expected: Typed rejection before any mutation.

issue: Hard-linked sidecar accepted

repro: Hard-link a valid 0600 sidecar into the expected path and reopen it.

actual: Read succeeds with st_nlink=2.

expected: Typed fail-closed rejection.

issue: Canonical sequence reversal accepted

repro: Append distinct days pinned to canonical sequences 5 and then 4.

actual: Second append succeeds.

expected: Conflict before mutation.

issue: Logical key is not integrity-validated

repro: Replace logical_key, recompute row_digest, then reopen.

actual: Row is accepted.

expected: WeeklyOperationsCorruption.

needed_fix: Validate all root, parent, lock, and data paths through stable no-follow descriptors before mutation; reject symlinks, hard links, non-regular files, ownership drift, and path replacement with typed errors.

needed_fix: Enforce globally nondecreasing canonical sequence pins and same-sequence digest equality.

needed_fix: Recompute durable logical keys from deterministic row/history identity.

needed_fix: Add RED-first filesystem tests for all four repros and retain a manifest-bound self-contained RED harness.