Build bounded SDK runtime fixtures for Flutter, Android, and Qt

[rldyourmnd]

Parent: #126.

Add minimal dependency-controlled projects and live consumer calls for dart-flutter-ci.yml, kotlin-android-ci.yml, and qt-ci.yml. Exercise the documented default contract on standard hosted runners, record setup/toolchain versions and exact successful jobs, and do not fail merely because provisioning takes longer than a target duration. Split further if platform/toolchain ownership diverges.

[rldyourmnd]

Attempt 1 ORIENT / bounded design receipt

Base is clean main at 00546f1c601a106d560d92e316f332891ac6f840; no open PR exists. Parent #126 already identifies this exact heavy-SDK child and remains closed. #130 is independent and untouched.

Already present

• Three GA reusable workflows with top-level deny-all and job-only contents: read.
• Estate-neutral Linux routing and explicit ubuntu-latest public examples. Standard hosted Ubuntu is free/unlimited for this public repository.
• Pinned outer actions, default format/analyze/test (Flutter), default Gradle build, and default CMake configure/build/ctest commands.
• Honest unverified ledger rows pointing here; no prior runtime proof is inferred.

Gaps

• No real Flutter, Android/Kotlin, or Qt source fixture and no caller in runtime-fixtures-languages.yml.
• No machine-observable toolchain/lock/test receipt or guard binding receipt success to the reusable caller result.
• Current examples override meaningful defaults: Flutter changes the test command, Kotlin references absent lint tasks and does not select Android, Qt uses a wildcard plus an unnecessary module.
• Gradle setup currently defaults to proprietary enhanced caching; upstream documents basic caching as MIT/free for every repository, so the cross-tier lane needs the explicit basic provider.
• Mutable SDK selectors are acceptable consumer API but ineligible proof inputs; evidence must use exact published versions.

Official/upstream facts frozen for this batch (2026-08-13)

• Flutter stable 3.47.0, Dart 3.13.0, framework revision 4cf24164269a5ebf0c16a028a00727d0e77bbb05, Linux archive SHA-256 26cd99d3d94b1367e6b50535a18aeef0282c10a535bbe3ec493534dcdab75296 from the official release manifest.
• Android AGP 9.3.1; official compatibility requires Gradle 9.5.0+, SDK Build Tools 36.0.0, JDK 17+, and supports API 37. AGP’s official POM binds built-in Kotlin to 2.2.10; the fixture will use that supported built-in Kotlin path instead of a duplicate Kotlin plugin.
• Gradle wrapper 9.5.0: distribution SHA-256 553c78f50dafcd54d65b9a444649057857469edf836431389695608536d6b746; wrapper JAR SHA-256 497c8c2a7e5031f6aa847f88104aa80a93532ec32ee17bdb8d1d2f67a194a9c7. setup-gradle v6 validates wrapper JARs automatically.
• ubuntu-latest inventory is Ubuntu 24.04 x64 and currently contains JDK 21, API 37, Build Tools 36.0.0, CMake and Ninja.
• Qt 6.8.4 is published in the official 6.8 archive. Qt documents CMake find_package(Qt6 REQUIRED ...), C++17+, and Qt Test/CTest. Pinned aqtinstall 3.3.0 verifies repository metadata/archive hashes unless explicitly disabled; no such bypass will be allowed.

Sources: https://storage.googleapis.com/flutter_infra_release/releases/releases_linux.json, https://docs.flutter.dev/testing/overview, https://developer.android.com/build/releases/gradle-plugin, https://developer.android.com/build/migrate-to-built-in-kotlin, https://docs.gradle.org/current/userguide/gradle_wrapper.html, https://github.com/gradle/actions/blob/v6.3.0/docs/setup-gradle.md, https://download.qt.io/archive/qt/6.8/, https://doc.qt.io/qt-6/cmake-get-started.html, https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md, https://docs.github.com/en/actions/reference/runners/github-hosted-runners

Chosen fixture boundaries

1. Flutter: dependency-controlled minimal real app/package, one real test, checked lockfile; caller selects only exact public SDK identity and fixture directory while leaving resolve/format/analyze/test commands at their documented defaults.
2. Android/Kotlin: minimal AGP app using built-in Kotlin, checked Gradle wrapper + distribution checksum + dependency verification/locking, one real JVM unit test and APK assembly. Caller selects the documented Android mode/exact packages only if provisioning is required; build command remains the default.
3. Qt: minimal Qt Core + Qt Test CMake target, exact Qt 6.8.4, default configure/build/ctest. No GUI/display dependency.
4. Each reusable emits an additive redacted structured receipt; independent always() observer jobs reject caller failure/skipping, wrong OS/arch/tool versions, absent lock/checksum identity, zero tests, missing build output, command drift, or cache contract drift. The existing evidence summary names each caller plus observer guard.
5. No time threshold, continue-on-error, conditional-false proof, test-only bypass input, prebuilt artifact, external secret, self-hosted/larger runner, or path-based skipping. Logs/summary carry versions, commands, counts and hashes; no secret-bearing build output is uploaded.

All three share one read-only Linux/x64 hosted trust boundary and one fixture estate, so no child split is justified. Easy-to-forget audit items explicitly owned: wrapper JAR and distribution hashes, Flutter lock/cache identity, aqt/Qt exact identity, Gradle cache provider, reusable-output parity, observer needs/guard completeness, generated ledger parity, and current-digest re-proof after any workflow edit.

[rldyourmnd]

Attempt 1 — PRODUCT/TEST FAILURE, mutations stopped

Per the owner attempt protocol, no repair was made after the first confirmed deterministic failure.

• base: 00546f1c601a106d560d92e316f332891ac6f840
• branch: fixtures/sdk-runtime-evidence
• state: uncommitted diagnostic draft only; no push or PR
• check: printf %s ci-workflows | shasum -a 256
• actual: 98c071e8c9b963bbbd7bfdeb08ee4247b0708b0f680924acd93ca6d2f4de26bb
• draft Qt assertion: ef8f3844879358b5d1c39e84d6e267028e9f23fb9fc684c0297b926f83af9c53
• classification: product/test fixture defect, not infrastructure/provider/network
• proven root cause: the expected digest was transcribed without deriving it from the exact fixture input
• scope reached before stop: initial minimal Flutter/Android/Qt source skeletons only; workflows/catalog/validators/docs were not yet edited

No fourth-party state, repository settings, external repo, credentials, runner, cache, commit, branch push, or PR was created. Attempt 2 must first reconcile every hand-authored expected identity against a generated/official source before accepting the preserved draft.

[rldyourmnd]

Recovery cycle - Attempt 2 pre-mutation provenance audit

Attempt 1 receipt 5275894027 and its deterministic failure remain immutable. Branch fixtures/sdk-runtime-evidence is still at clean tracked base 00546f1c601a106d560d92e316f332891ac6f840; the preserved draft consists only of 17 untracked source skeleton files. There is still no commit, push, PR, workflow/catalog/docs change, or external mutation.

Exact literal inventory and ownership audit

• Flutter draft: project version 1.0.0+1 and Dart constraint >=3.13.0 <4.0.0; no digest, lockfile, generated identity, or selected exact Flutter release exists yet.
• Android draft: AGP 9.3.1, built-in Kotlin 2.2.10, compile/target SDK 37, Build Tools 36.0.0, JUnit 4.13.2, min SDK 23; no wrapper files, Gradle 9.5.0 distribution checksum, wrapper-JAR checksum, dependency locks, verification metadata, or generated identity exists yet.
• Qt draft: CMake floor 3.21, project 1.0, C++ 17, Qt6 Core/Test. Its sole digest literal is the invalid hand-copied ef8f... assertion. It is not derived from the input bytes, upstream metadata, or any generator.
• Every draft file is a regular ASCII/UTF-8-compatible file, LF-only, with exactly one terminal LF; no symlink exists.
• Existing reusable defaults remain untouched: Flutter channel stable, Kotlin JDK 21 and default ./gradlew build, Qt 6.8.* and default CMake/build/CTest. The runtime ledger remains honestly unverified for all three.

Root cause

The draft mixed two semantic concerns: a Qt behavior test invented a cryptographic oracle, while fixture-source provenance had no machine-owned source/generator/independent verifier. The expected value was manually transcribed, was never derived from the exact byte sequence, and therefore escaped review until independently recomputed. Replacing ef8f... with 98c... would preserve that broken ownership model and is explicitly rejected.

Attempt 2 canonical provenance boundary

1. An authored, strict SDK fixture specification owns exact upstream/toolchain identities and the complete ordered source inventory for Flutter, Android and Qt.
2. A reviewed generator derives a canonical generated manifest from the exact checked-in bytes. It enforces POSIX-relative paths, lexical ordering, regular-file/no-symlink scope, UTF-8 without BOM, LF-only encoding and exactly one final LF. The manifest never hashes itself.
3. A separate validator independently walks and hashes the fixture tree; it does not import/reuse the generator hashing, ordering or normalization implementation. It rejects stale generated bytes, modified source, missing/extra/duplicate/unused paths or digest records, ordering/path drift, BOM/CRLF/missing-or-extra-final-newline drift, wrong SDK/tool version and cache-key mismatch.
4. Negative fixtures mutate each invariant independently. Generation must be reproducible and the validation path must leave a clean tree.
5. The Qt project will test meaningful Qt Core/Test behavior rather than embedding a second hand-owned digest oracle. Cryptographic source identity belongs only to the generated provenance contract.
6. Exact upstream checksums remain bound to their artifact/version identity: Flutter archive 26cd99d3..., Gradle distribution 553c78f5..., Gradle wrapper JAR 497c8c2a.... They will be validated against official metadata and actual checked wrapper/config bytes, not inferred from filenames.

Already correct vs remaining

Already correct: bounded real Flutter widget/app source and test, strict analyzer rules, bounded real Android Activity/JVM test structure using built-in Kotlin, bounded Qt6 Core/Test CMake structure, standard text encoding, no skipped/no-op lane, no permissions or tier drift.

Remaining before any runtime claim: replace the invalid Qt semantic test; add wrapper/locks/verification metadata and Flutter lock; add exact-version callers and reusable structured receipts; enforce basic Gradle caching and exact cache identities; implement generator/independent validator plus negative probes; synchronize examples/catalog/docs/generated ledger; then run focused and full local gates followed by fresh non-skipped hosted evidence. Duration remains telemetry only, never a failure threshold.

[rldyourmnd]

Attempt 2 — PRODUCT/TEST FAILURE, mutations stopped

Per the owner protocol, no repair was made after the first confirmed product/test failure in this attempt.

• base/HEAD: 00546f1c601a106d560d92e316f332891ac6f840
• branch: fixtures/sdk-runtime-evidence
• state: preserved uncommitted WIP; no commit, push, or PR
• focused provenance gates before project execution:
  • python3 scripts/generate_sdk_runtime_manifest.py --check — PASS
  • python3 scripts/check_sdk_runtime_fixtures.py — PASS
• exact failing command: tests/fixtures/android/gradlew -p tests/fixtures/android build
• exact deterministic failure: Gradle dependency verification rejected org.junit:junit-bom:5.10.2:junit-bom-5.10.2.module in configuration classpath because its checksum is absent from gradle/verification-metadata.xml
• classification: PRODUCT/TEST fixture provenance defect, not network/provider/infrastructure
• root cause: Attempt 2 generated locks/verification metadata using the narrower task set :app:testDebugUnitTest :app:assembleDebug, while the reusable workflow's documented default is ./gradlew build. The generated provenance closure therefore did not cover the exact default task graph.
• integrity consequence: fail-closed dependency verification worked correctly; the fixture is not eligible runtime evidence and no digest/ledger claim was changed
• parallel Qt result before stop: real local CMake configure/build/CTest passed 1/1
• parallel Flutter run was interrupted immediately after Android failure during SDK provisioning; it made no proof claim
• cleanup: ignored Android/Qt build state and the temporary Flutter SDK clone were removed; checked WIP remains preserved

The repair boundary for an authorized Attempt 3 must regenerate dependency verification metadata from the exact ./gradlew build default graph, independently verify no extra/missing artifacts, and repeat the full project run. A blind checksum insertion is not acceptable.

[rldyourmnd]

Final Attempt 3 — pre-mutation systemic Gradle audit

Attempt 2 receipt 5280177998 is immutable. No repair, commit, push or PR has occurred since it. Tracked base remains 00546f1c601a106d560d92e316f332891ac6f840; the full uncommitted WIP is preserved.

Exact contradiction resolved

The existing XML already contains the checksum for junit-bom-5.10.2.pom, but not for junit-bom-5.10.2.module. The narrower generation invocation resolved the POM while exact ./gradlew build later resolved the Gradle Module Metadata file too. Strict dependency verification correctly rejected that newly reached artifact.

Official Gradle 9.5 contract

• Dependency verification is global to the build and covers artifact files plus POM/Ivy/Gradle Module Metadata, plugins and advanced resolution APIs. Strict is the default and fails on a missing or modified checksum.
• --write-verification-metadata sha256 bootstraps all artifacts Gradle discovers, but generation is incremental: existing entries are preserved and Gradle explicitly cannot determine/remove unused entries automatically.
• Some dependencies are resolved only during task execution, so dry-run is not a closure proof.
• --write-locks persists only locked configurations actually resolved by the invoked tasks. Strict lock mode additionally fails when a resolved locked configuration has no lock state; the resolution may not contain missing or extra modules relative to that lock state.
• Gradle 9.5 --task-graph disables actions, so it is useful topology telemetry but cannot replace execution of the exact default build.

Primary sources (read 2026-08-13):

• https://docs.gradle.org/9.5.0/userguide/dependency_verification.html
• https://docs.gradle.org/9.5.0/userguide/dependency_locking.html
• https://docs.gradle.org/9.5.0/userguide/command_line_interface.html
• https://github.com/gradle/actions/blob/v6.3.0/docs/setup-gradle.md

Chosen closure contract

1. A dedicated reviewed generator copies only the Android fixture to a temporary workspace, validates wrapper JAR and distribution SHA-256, removes generated verification metadata/locks from that copy, and uses a newly created isolated GRADLE_USER_HOME.
2. It invokes the exact reusable default task ./gradlew build with only provenance-generation controls: --write-verification-metadata sha256 --write-locks --dependency-verification strict --no-build-cache --no-configuration-cache. It never substitutes narrower tasks.
3. Starting from absent metadata is load-bearing: because Gradle generation is incremental and cannot identify stale entries, only fresh generation makes every resulting artifact entry explainable by this build/configuration closure.
4. The generator emits canonical metadata, every generated lockfile, and a deterministic Android resolution receipt containing the exact command/task, wrapper/distribution identities, task execution graph, every GAV/artifact/checksum tuple, lock identities and aggregate digests.
5. A separate validator independently parses XML/locks/project/toolchain/workflow bytes and recomputes the receipt. It rejects missing/modified entries, stale extras, malformed/duplicate artifacts, unchecked checksum variants, non-strict modes, wrong wrapper/tool versions, cache/provider drift, or any generation task other than exact build.
6. A task-specific --check performs a second fresh-from-empty isolated regeneration and byte-compares all generated artifacts. This is the reproducibility/no-stale proof; the core tree gate remains network-independent and validates checked bytes plus adversarial mutations.
7. Negative selftests independently remove an artifact, modify its checksum, add an unexplained artifact, reorder/duplicate it, mutate a lock, and substitute a narrower generation task. Each must fail. The real strict default build remains the end-to-end negative for incomplete metadata.
8. After this repair, the entire three-ecosystem chain restarts from clean state. No Qt/Flutter result from before the Android failure is reused.

WIP reconciliation / omitted details found before mutation

Already sound: exact wrapper/distribution hashes; real Flutter widget test and lock; real Android Activity/JVM test/APK target; real Qt Core/Test target; LF/UTF-8 byte manifest; default-contract callers; read-only permissions; observer guards; tier-neutral basic Gradle cache.

Still required: strict dependency lock mode (the draft currently uses default mode), fresh exact-build Android generator/receipt/parity check, strict-console evidence, complete negative metadata tests, generated docs/ledger synchronization, clean three-SDK rerun, full gates and hosted evidence. The generator must not confuse Gradle bootstrap integrity with independent publisher authenticity: receipts will state SHA-256 integrity provenance and the reviewed repository coordinates without claiming signatures that are not verified.

[rldyourmnd]

Final Attempt 3 — accepted pre-gate Java identity correction

The interrupted pre-gate process was found still running only inside its temporary copy. It was terminated, its temporary tree deleted, and source metadata/locks were confirmed unchanged (original timestamps; no provenance manifest written). Per owner correction, no Attempt 3 gate was consumed.

Canonical vocabulary now enforced

Both the generator receipt and reusable runtime receipt use the same fields:

• requested: java_version_input
• observed executable: java_version_resolved, java_runtime_version_resolved, java_vendor_resolved, java_vm_name_resolved
• Gradle launcher: raw gradle_launcher_jvm_resolved plus independently parsed version/runtime/vendor/VM fields
• Gradle daemon: raw gradle_daemon_jvm_resolved plus identities queried from the exact daemon home reported by ./gradlew --version

The generator no longer returns a literal desired major as observation. It reads java -XshowSettings:properties -version, parses the actual full properties, parses the exact Gradle launcher line, locates the daemon Java from the exact Gradle daemon line, queries that executable, and fails if requested major, observed Java, launcher or daemon diverge.

The reusable keeps compatibility with non-major setup-java selectors: an exact numeric major is compared directly, while setup-java remains authoritative for its supported semver selectors. In every case launcher/daemon/current Java identities must be complete and equal.

Added negatives / omission audit

• desired "21" substituted for observed 21.x.y is rejected;
• launcher version drift is rejected;
• daemon vendor drift and missing raw daemon identity are rejected;
• raw launcher identity must equal the observed version/vendor/runtime tuple, so vendor data cannot be copied from desired input;
• spec, generator, independent validator, reusable receipt and docs share one ordered field vocabulary;
• embedded workflow Python and both validator/generator Python files passed a pre-gate AST syntax audit;
• no stale java_version receipt field remains (only the public workflow input name remains intentionally).

The previously authorized single canonical regeneration can now begin. Its first actual product/test/runtime/provenance failure remains terminal.

[rldyourmnd]

Final Attempt 3 — TERMINAL PRODUCT/PROVENANCE FAILURE

Per the final-attempt protocol, mutations and execution stopped immediately. No repair, retry, commit, push, PR, or Attempt 4 was made.

Immutable receipt

• base/HEAD: 00546f1c601a106d560d92e316f332891ac6f840
• branch: fixtures/sdk-runtime-evidence
• exact command:
  JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home PATH=/opt/homebrew/opt/openjdk@21/bin:$PATH python3 scripts/generate_android_fixture_provenance.py
• final output / exit: android-provenance: lockfile entries are not deterministic: app/gradle.lockfile, exit 1
• classification: PRODUCT/PROVENANCE validator defect, not infrastructure/provider/network
• exact default build status: the first fresh isolated ./gradlew build returned success; execution reached receipt construction, which occurs only after the Gradle subprocess succeeds
• second strict fresh-home replay: not reached
• source generated outputs: not written; gradle/provenance-manifest.json remains absent and source metadata/locks retain their pre-run bytes
• processes/temp state: generator, wrapper and daemon processes exited; temporary regeneration tree was removed

Root cause and falsified invariant

The custom generator required all non-comment lockfile lines to satisfy Python's ordinary sorted(entries). Gradle's canonical lock format sorts dependency rows but intentionally writes the special empty=configuration,... aggregate last. The preserved app lock demonstrates the same shape: 188 data rows, dependency coordinates in lexical order, then empty=... as the final row. Ordinary sorting would place empty before org.*, so the validator rejected a canonical Gradle-generated file.

This is exactly the class of false provenance assertion the attempt rules prohibit repairing in place. The missing-module issue was not re-observed: the exact build itself succeeded under fresh generation, but no closure claim is eligible because the generator failed before canonical receipt and strict replay.

Current evidence state

• Flutter: NOT_PROVEN in this attempt (not restarted after regeneration failure)
• Android: exact generation build executed successfully, but provenance closure/strict replay/runtime receipt remain NOT_PROVEN
• Qt: prior local 1/1 result is preserved only as diagnostic history and is not reused
• hosted callers, observers, PR checks, merge and post-main evidence: NOT_RUN
• runtime ledger remains unchanged and honest

A future explicitly authorized recovery cycle must model Gradle's documented lockfile grammar (dependency rows lexical; one terminal empty= row) and independently negative-test that grammar before any build. It must not be called Attempt 4 or rewrite this receipt.

[rldyourmnd]

Canonical terminal handoff — #129 Final Attempt 3

This is the single canonical terminal handoff for immutable Final Attempt 3 receipt 5280423642. Final Attempt 3 is classified TERMINAL PRODUCT/PROVENANCE FAILED. There is no Attempt 4. No work may continue without a separately authorized new recovery cycle after a systemic audit against the current official Gradle dependency-locking grammar and ordering behavior.

Exact regeneration invocation and execution boundary

Repository: NDDev-it-com/ci-workflows

Branch: fixtures/sdk-runtime-evidence

Base and HEAD at failure and at this handoff:

00546f1c601a106d560d92e316f332891ac6f840

Exact canonical command:

JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home PATH=/opt/homebrew/opt/openjdk@21/bin:$PATH python3 scripts/generate_android_fixture_provenance.py

The generator used its fresh copied Android fixture and isolated Gradle home to invoke the exact reusable default task through:

./gradlew build --write-verification-metadata sha256 --write-locks --dependency-verification strict --no-build-cache --no-configuration-cache --console plain

The fresh exact ./gradlew build subprocess succeeded and execution reached receipt construction. The second strict fresh-home replay was not reached.

Exact closure-checker failure and exit:

android-provenance: lockfile entries are not deterministic: app/gradle.lockfile

Exit status: 1.

Authoritative observed lock ordering and falsified invariant

The preserved Gradle-generated app/gradle.lockfile has 188 non-comment rows:

• 187 dependency rows;
• those 187 dependency rows are in lexical order;
• exactly one special aggregate empty=... row;
• the empty=... row is the final row;
• applying ordinary Python sorted() to all 188 rows would move empty=... ahead of later dependency groups, so rows == sorted(rows) is false.

The exact observed terminal row is:

empty=androidApis,androidJdkImage,androidTestUtil,coreLibraryDesugaring,debugAndroidTestAnnotationProcessorClasspath,debugAndroidTestApiDependenciesMetadata,debugAndroidTestCompileOnlyDependenciesMetadata,debugAndroidTestImplementationDependenciesMetadata,debugAndroidTestIntransitiveDependenciesMetadata,debugAndroidTestRuntimeClasspath,debugAnnotationProcessorClasspath,debugApiDependenciesMetadata,debugCompileOnlyDependenciesMetadata,debugImplementationDependenciesMetadata,debugIntransitiveDependenciesMetadata,debugReverseMetadataValues,debugUnitTestAnnotationProcessorClasspath,debugUnitTestApiDependenciesMetadata,debugUnitTestCompileOnlyDependenciesMetadata,debugUnitTestImplementationDependenciesMetadata,debugUnitTestIntransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinCompilerPluginClasspathDebug,kotlinCompilerPluginClasspathDebugAndroidTest,kotlinCompilerPluginClasspathDebugUnitTest,kotlinCompilerPluginClasspathRelease,lintChecks,lintPublish,releaseAnnotationProcessorClasspath,releaseApiDependenciesMetadata,releaseCompileOnlyDependenciesMetadata,releaseImplementationDependenciesMetadata,releaseIntransitiveDependenciesMetadata,releaseReverseMetadataValues

This matches Gradle's documented structure: dependency and configuration names are alphabetical, while the format separately defines the last line as the list of empty configurations. Primary contract: https://docs.gradle.org/9.5.0/userguide/dependency_locking.html#sec:dependency-locking-lockfile

The failed custom invariant incorrectly required ordinary lexical ordering across dependency records and the structurally special terminal empty= record. This is a product/provenance validator defect, not infrastructure, provider, network, Gradle, JDK, Android SDK, or repository-cache failure.

Frozen worktree and generated-output state

Tracked base remains 00546f1c601a106d560d92e316f332891ac6f840; no commit was created. The dirty branch contains the preserved WIP only. Its tracked modifications remain:

• .github/workflows/dart-flutter-ci.yml
• .github/workflows/kotlin-android-ci.yml
• .github/workflows/qt-ci.yml
• .github/workflows/runtime-fixtures-languages.yml
• CHANGELOG.md
• catalog/capabilities.yml
• docs/15-language-and-quality-packs.md
• examples/languages/dart-flutter.yml
• examples/languages/kotlin-android.yml
• examples/languages/qt.yml
• scripts/validate_all.py

Preserved untracked WIP remains under the three fixture trees, the SDK spec/manifest, and the three new scripts. The Android generated provenance receipt was never written:

tests/fixtures/android/gradle/provenance-manifest.json: absent.

The pre-existing WIP SDK byte manifest remains present:

tests/fixtures/sdk-runtime-manifest.json: SHA-256 7e093a9e8befef3475250c7246a58772e80d9f9daff5af76bf2f791f6a469a4c.

Preserved pre-run Android generated-input hashes:

• tests/fixtures/android/gradle/verification-metadata.xml: 6319daaa11be13fb52c925075986480d5357b2dc67b7c161091a15d21db6a397
• tests/fixtures/android/app/gradle.lockfile: 246e9a0afc17309692d18f2fe7d093c6b80b6aaf3471e45984ce9fcd87d0261f
• tests/fixtures/android/settings-gradle.lockfile: e58bb2ed80db9f829601a658d7c33b9802eb7d2191c31e79c28e01f14c225926

At handoff time there is no running provenance generator, fixture Gradle wrapper, or Gradle daemon. Its temporary regeneration tree was removed.

Proof of no post-failure repair or rerun

After the failure, only read-only state inspection and this required handoff were performed:

• the generator, validator, workflows, fixtures, lockfiles, metadata and tests were not edited after the terminal failure;
• regeneration, validation, formatting and fixture commands were not rerun;
• no commit, push, PR, merge, release, settings, credentials, sibling repository, or runtime-ledger mutation occurred;
• the Android provenance manifest remains absent, the preserved source hashes above remain unchanged, and no relevant process remains;
• immutable failure receipt 5280423642 remains prior history and is not rewritten by this handoff.

Evidence status and required future boundary

• Flutter: NOT_PROVEN in Final Attempt 3.
• Android: the first exact generation build succeeded, but closure receipt, strict replay and hosted runtime evidence are NOT_PROVEN.
• Qt: prior local 1/1 diagnostic result is not reused; Final Attempt 3 proof remains NOT_PROVEN.
• hosted callers/observers, exact-head PR checks, merge and post-main evidence: NOT_RUN.
• runtime ledger: unchanged and honest.

A future authorized new recovery cycle must first model and independently test Gradle's current lockfile grammar: lexical dependency rows plus exactly one terminal empty= aggregate, with negatives for misplaced, duplicated, missing and non-lexical records. It must preserve this handoff and receipt 5280423642, must not be called Attempt 4, and must restart the full three-ecosystem evidence chain rather than infer proof from the successful generation subprocess.

[rldyourmnd]

New distinct recovery cycle — Attempt 1: pre-mutation Gradle 9.5.0 grammar audit

This recovery cycle is separately authorized after canonical terminal receipt 5280447488; it is not Attempt 4. All prior receipts and the uncommitted diagnostic WIP remain preserved. No repository mutation, regeneration, build, validation rerun, commit, push, or PR occurred before this audit receipt.

Pinned authority

The Android fixture pins Gradle 9.5.0. The corresponding upstream tag resolves to commit 3fe117d68f3907790f3809f121aa36303a9151f8.

Primary sources reviewed as of 2026-08-13:

• Gradle 9.5 dependency-locking format documentation: https://docs.gradle.org/9.5.0/userguide/dependency_locking.html#lock_state_location_and_format
• Documentation source at the pinned tag: https://github.com/gradle/gradle/blob/v9.5.0/platforms/documentation/docs/src/docs/userguide/reference/dependency-management/dependency-management/dependency_locking.adoc#L197-L207
• Canonical writer/reader implementation at the pinned tag: https://github.com/gradle/gradle/blob/v9.5.0/platforms/software/dependency-management/src/main/java/org/gradle/internal/locking/LockFileReaderWriter.java
• Upstream writer/reader tests at the pinned tag: https://github.com/gradle/gradle/blob/v9.5.0/platforms/software/dependency-management/src/test/groovy/org/gradle/internal/locking/LockFileReaderWriterTest.groovy
• Authoritative generated example: https://github.com/gradle/gradle/blob/v9.5.0/platforms/documentation/docs/src/snippets/dependencyManagement/dependencyLocking-lockingSingleFilePerProject/common/gradle.lockfile

Derived canonical grammar and ordering

The public documentation says each dependency record is group:artifact:version=configurations, dependency/configuration lists are alphabetical, and the last line lists empty configurations. The pinned writer makes the byte contract exact:

1. UTF-8, LF line endings, and a terminal LF.
2. Exactly these three leading comment lines, in order:
   • # This is a Gradle generated file for dependency locking.
   • # Manual edits can break the build and are not advised.
   • # This file is expected to be part of source control.
3. Zero or more dependency records module=configuration[,configuration...].
   • the module key is the complete Gradle dependency notation emitted by the resolved state (normally group:name:version);
   • module keys are unique and strictly lexically increasing because the writer uses a TreeMap;
   • each record has exactly one =;
   • its configuration list is non-empty, contains no empty member, is unique, and is strictly lexically increasing because the writer sorts before joining.
4. Exactly one empty=configuration[,configuration...] aggregate follows every dependency record and is the final record.
   • its configurations are unique and strictly lexically increasing;
   • the list may be empty, yielding the canonical literal empty=.
5. Canonical writer output has no blank lines, no extra comments, no whitespace padding, no duplicate module/configuration entries, and no records after empty=.

The pinned reader is intentionally more permissive: it ignores blank lines and lines beginning with #, recognizes any line starting with empty=, and otherwise splits records on =. That describes readable legacy/input tolerance, not canonical generated output. Our provenance contract will validate the pinned writer's canonical form, not silently accept every form the reader tolerates. Unknown/malformed records fail closed. It will parse semantics and compare independently; it will not sort or rewrite Gradle output.

Preserved generated-state observation

At base/HEAD 00546f1c601a106d560d92e316f332891ac6f840, branch fixtures/sdk-runtime-evidence:

• tests/fixtures/android/app/gradle.lockfile: 3 canonical header lines, 187 dependency rows in strict lexical order, one terminal empty= aggregate at line 191, no blanks.
• tests/fixtures/android/settings-gradle.lockfile: 3 canonical header lines, zero dependency rows, one terminal empty= aggregate at line 4, no blanks.
• The prior checker compared all records to sorted(records), which necessarily rejects the official terminal aggregate whenever dependency rows sort after the literal prefix empty=. That was a checker grammar defect; the Gradle output was canonical.
• Current branch/base/dirty/generated-output state and prior exact generation/failure signatures remain those recorded in immutable receipt 5280447488. No prior diagnostic generation is accepted as proof.

Attempt 1 implementation boundary

One grammar-aware semantic parser will own canonical validation for generator and independent validator while retaining independent recomputation of receipt bytes and closure facts. Coverage will reject missing, duplicate, misplaced/nonterminal/malformed empty=; nonlexical dependency rows; duplicate modules/configurations; unexpected records; truncation; and stale/partial output. Android JVM/toolchain vocabulary, exact default ./gradlew build closure, and Flutter/Qt bounded evidence contracts remain synchronized.

Only after that reconciliation will this cycle start a fresh isolated canonical generation and restart the full three-ecosystem evidence chain. The first confirmed product/test/build/provenance failure in this recovery Attempt 1 stops mutation before repair or rerun and requires explicit Attempt 2 authorization.

[rldyourmnd]

Recovery cycle Attempt 1 — PRODUCT/TEST FAILED (canonical terminal receipt)

Recovery Attempt 1 is frozen. This receipt preserves the prior-cycle history and the separately authorized recovery-cycle lineage in comment 5280550655; it is not an Attempt 4 or a rewrite of any earlier receipt.

Exact successful provenance gate

The first real product/provenance gate was invoked once from repository root on branch fixtures/sdk-runtime-evidence, base/HEAD and origin/main all at 00546f1c601a106d560d92e316f332891ac6f840:

JAVA_HOME=/opt/homebrew/opt/openjdk@21/libexec/openjdk.jdk/Contents/Home PATH=/opt/homebrew/opt/openjdk@21/bin:$PATH python3 scripts/generate_android_fixture_provenance.py

The generator used a fresh isolated Gradle home and the exact reusable default command/task graph:

./gradlew build --write-verification-metadata sha256 --write-locks --dependency-verification strict --no-build-cache --no-configuration-cache --console plain

Observed generation evidence:

• Gradle 9.5.0 under observed/requested JDK 21 identity.
• 90 actionable tasks: 90 executed.
• Meaningful required tasks executed: :app:assembleDebug, :app:testDebugUnitTest, :app:lintDebug, and terminal :app:build.
• BUILD SUCCESSFUL in 4m 36s.
• Gradle persisted dependency lock state for settings/buildscript/project scopes.
• After receipt construction, the generator copied only the generated metadata/locks/receipt into a second pristine fixture with a separate fresh Gradle home and ran the exact strict default build without write flags. That second strict build succeeded; the generator writes source outputs only after this check.
• Terminal generator output: android-provenance: wrote exact-build metadata, locks, and receipt.

Generated diagnostic WIP preserved exactly:

Path	Bytes	SHA-256	mtime (Asia/Almaty)
tests/fixtures/android/gradle/provenance-manifest.json	187141	2e0dc4e72ce078202eb7d1e86f0be4f9884fe0935d82e8c79d099ed504e351cc	2026-08-13T17:57:10+0500
tests/fixtures/android/gradle/verification-metadata.xml	145765	da808164fe8e0c846dbb54ef072e9d712c44d4ae640cd6cdf7d5bbd3b2688fd7	2026-08-13T17:57:10+0500
tests/fixtures/android/app/gradle.lockfile	37430	246e9a0afc17309692d18f2fe7d093c6b80b6aaf3471e45984ce9fcd87d0261f	2026-08-13T17:57:10+0500
tests/fixtures/android/settings-gradle.lockfile	198	e58bb2ed80db9f829601a658d7c33b9802eb7d2191c31e79c28e01f14c225926	2026-08-13T17:57:10+0500
tests/fixtures/sdk-runtime-manifest.json	6887	c324cd25ad3fe5c4536aede0ab26cde8b199ee916f4e3804bc264b6d2e29b7db	2026-08-13T17:57:21+0500

First focused command and deterministic failure

After the successful generation and one byte-manifest generation, the first focused validator was invoked exactly once:

python3 scripts/check_sdk_runtime_fixtures.py

It crashed before contract assertions:

Traceback (most recent call last):
  File ".../scripts/check_sdk_runtime_fixtures.py", line 266, in _android_provenance_problems
    xml = ET.fromstring(metadata_raw)
          ^^
NameError: name 'ET' is not defined

During handling of the above exception, another exception occurred:

  File ".../scripts/check_sdk_runtime_fixtures.py", line 267, in _android_provenance_problems
    except (OSError, ET.ParseError) as exc:
                     ^^
NameError: name 'ET' is not defined

Root classification: deterministic PRODUCT/TEST FAILURE. The checker references xml.etree.ElementTree as ET in both execution and exception paths but has no corresponding import. This is not Gradle, SDK, network, provider, runner, cache, or remote-infrastructure failure.

Frozen state and NOT_RUN boundary

• No import fix, repair, formatter, generator rerun, validator rerun, commit, push, PR, merge, hosted dispatch, or external repository mutation occurred after the failure.
• Process inspection found no generator, validator, Gradle build, or Gradle daemon remaining; only the inspection command itself matched its search pattern.
• Flutter exact 3.47.0/Dart 3.13.0 local chain: NOT_RUN in Recovery Attempt 1.
• Qt 6.8.4 configure/build/CTest chain: NOT_RUN in Recovery Attempt 1.
• Android post-generation independent assertions/negative suite: NOT_RUN because the validator crashed before assertions.
• Core/full validation, actionlint, tokenized pinned zizmor, security/docs/generated/self-review/omission gates: NOT_RUN.
• Hosted exact-head Flutter/Android/Qt runs: NOT_RUN.
• No commit, push, or PR exists for this WIP.

The dirty tree remains the complete preserved #129 diagnostic WIP: workflow/caller/catalog/docs/examples/validator changes plus untracked grammar/parser, generators and all three fixture trees. HEAD remains 00546f1c601a106d560d92e316f332891ac6f840.

Recovery Attempt 1 is terminal. No further mutation or rerun is authorized in this cycle. A separate explicit Attempt 2 ACK is required. Attempt 2 must audit the validator's complete dependency/import/static-execution contract and add machine coverage for cold-process execution; merely adding the missing ET import is insufficient.

[rldyourmnd]

Recovery cycle Attempt 2 — PRODUCT/TEST FAILED (canonical terminal handoff)

Recovery Attempt 2 is frozen under handoff-only authority. Canonical Attempt 1 receipt 5280742737 remains immutable (5229 bytes, API byte-equal, SHA-256 c3ca61eacb29ea1f8ad472dd9cfa4878a40752bbe6dbc8fc2fd3af8c3390d246). This is a new Attempt 2 receipt, not a rewrite of prior history.

Prior accepted evidence (diagnostic only)

• Durable Gradle 9.5 grammar/source audit: comment 5280550655, independently proven 5443 bytes and SHA-256 60d7bfc480458c49cbc56b45308825c44328981b1f0e0da807d72bc25141c5c3.
• Recovery Attempt 1 fresh Android exact ./gradlew build generation succeeded under Gradle 9.5/JDK 21: 90 tasks executed, including assembleDebug, testDebugUnitTest, lintDebug, and build; BUILD SUCCESSFUL in 4m 36s.
• The generator then successfully ran its second pristine/fresh-home strict default-build replay before writing source outputs.
• Those Android outputs remain diagnostic WIP only and are not final-cycle runtime proof.
• Attempt 1 then failed before assertions on the missing xml.etree.ElementTree as ET dependency, recorded in 5280742737.

Attempt 2 pre-mutation dependency audit

The read-only audit inventoried 45 Python files under scripts/ on the repository's CI Python 3.13 contract. It found:

• repository-external imports are limited to pinned PyYAML 6.0.3; other imports are stdlib or sibling modules;
• the only statically identified undefined global was ET in check_sdk_runtime_fixtures.py;
• deferred imports were intentional function-local imports rather than optional mutable dependency fallbacks;
• top-level calls were limited to constants/path/regex construction and existing path setup; no existing validator performed filesystem/network/process writes on import;
• repository resource paths are derived from Path(__file__), supporting unrelated-cwd execution;
• CLI modes differ: direct self-check validators, advisory/calendar validators, argument-required tools, read-only generator --check modes, and mutating generators that may only be cold-import/help-tested.

Attempt 2 added diagnostic WIP for a stdlib-only cold-process contract, the proven ElementTree import, aggregate-gate wiring and documentation. None of this WIP is accepted or committed.

Exact first Attempt 2 product/test gate

The first product/test command was run exactly once from repository root:

python3 -I scripts/check_python_execution_contract.py

It exited 1. The terminal signature required by this handoff was:

check_python_execution_contract: FAIL
  - _workflow_yaml.py: cold import failed: ... ModuleNotFoundError: No module named 'yaml'
  - _strict_yaml.py []: exit 1, expected [0]; ... ModuleNotFoundError: No module named 'yaml'
  - check_actionlint_contract.py []: exit 1, expected [0]; ... ModuleNotFoundError: No module named '_workflow_yaml'
  ...
  - generate_android_fixture_provenance.py ['--help']: exit 1, expected [0]; ... ModuleNotFoundError: No module named '_gradle_lockfile'

The exact requested canonical failure signature is:

ModuleNotFoundError: No module named '_gradle_lockfile'

The existing transcript also contains the complete emitted failure list. It is not re-created here beyond the exact retained excerpts: the command emitted many equivalent missing-sibling-module failures (_workflow_yaml, _strict_yaml, _runners, _gradle_lockfile) plus missing yaml; render_runtime_evidence.py was invoked in production mode without --check and exited 2 for absent RESULTS.

Systemic classification

This is a deterministic PRODUCT/TEST CONTRACT FAILURE, not Android/Flutter/Qt, Gradle, network, runner, provider, or remote infrastructure:

1. The gate launched absolute script paths as python3 -I <script>. Isolated mode removes the script directory/user site from import resolution, so sibling modules were unavailable.
2. -I also hid the locally installed pinned PyYAML environment; an isolated bootstrap/dependency strategy had not been designed correctly.
3. The per-CLI scenario manifest incorrectly treated render_runtime_evidence.py's no-argument production mode as its self-check rather than selecting --check.
4. Therefore the cold-process gate tested a broken launcher/scenario contract rather than reliably testing validator cold execution.

No repair, import/path adjustment, launcher bootstrap, scenario correction, edit, format, cleanup, revert, rerun, commit, push, PR, merge, release, or hosted dispatch occurred after this failure.

Frozen branch/tree inventory

• branch: fixtures/sdk-runtime-evidence
• HEAD: 00546f1c601a106d560d92e316f332891ac6f840
• origin/main: 00546f1c601a106d560d92e316f332891ac6f840
• tracked dirty files (11):
  • .github/workflows/dart-flutter-ci.yml
  • .github/workflows/kotlin-android-ci.yml
  • .github/workflows/qt-ci.yml
  • .github/workflows/runtime-fixtures-languages.yml
  • CHANGELOG.md
  • catalog/capabilities.yml
  • docs/15-language-and-quality-packs.md
  • examples/languages/dart-flutter.yml
  • examples/languages/kotlin-android.yml
  • examples/languages/qt.yml
  • scripts/validate_all.py
• untracked inventory: 36 files across the new parser/cold-gate/fixture validators and generators, plus Android/Flutter/Qt fixture trees, SDK byte manifest and SDK spec. The top-level untracked paths are:
  • scripts/_gradle_lockfile.py
  • scripts/check_python_execution_contract.py
  • scripts/check_sdk_runtime_fixtures.py
  • scripts/generate_android_fixture_provenance.py
  • scripts/generate_sdk_runtime_manifest.py
  • tests/fixtures/android/
  • tests/fixtures/flutter/
  • tests/fixtures/qt/
  • tests/fixtures/sdk-runtime-manifest.json
  • tests/fixtures/sdk-runtime-spec.yml
• tracked diff stat: 11 files changed, 433 insertions, 18 deletions.
• No relevant generator/validator/Gradle process remained; the read-only process search matched only its own command.

The attempted read-only combined diff hash snapshot is explicitly INVALID / NOT_PROVEN. Its zsh loop used the variable name path, which overwrote zsh's special PATH; each inner shasum then failed with command not found. The pipeline printed 9289ab92097ceceeb59fc769d2696ae0a8474d9c5dbfec38a8d4c9012fb3307a, but that value does not hash the intended tracked+untracked bytes and must not be used as evidence. Per freeze authority it was not rerun or reconstructed.

Preserved diagnostic generated-file identities from the successful Attempt 1 generation remain:

• tests/fixtures/android/gradle/provenance-manifest.json: 187141 bytes, SHA-256 2e0dc4e72ce078202eb7d1e86f0be4f9884fe0935d82e8c79d099ed504e351cc
• tests/fixtures/android/gradle/verification-metadata.xml: 145765 bytes, SHA-256 da808164fe8e0c846dbb54ef072e9d712c44d4ae640cd6cdf7d5bbd3b2688fd7
• tests/fixtures/android/app/gradle.lockfile: 37430 bytes, SHA-256 246e9a0afc17309692d18f2fe7d093c6b80b6aaf3471e45984ce9fcd87d0261f
• tests/fixtures/android/settings-gradle.lockfile: 198 bytes, SHA-256 e58bb2ed80db9f829601a658d7c33b9802eb7d2191c31e79c28e01f14c225926
• tests/fixtures/sdk-runtime-manifest.json: 6887 bytes, SHA-256 c324cd25ad3fe5c4536aede0ab26cde8b199ee916f4e3804bc264b6d2e29b7db

NOT_PROVEN / remaining chain

• Attempt 2 fresh Android regeneration and strict replay: NOT_RUN.
• Flutter 3.47.0 / Dart 3.13 local default resolve/format/analyze/test: NOT_RUN.
• Qt 6.8.4 clean configure/build/CTest: NOT_RUN.
• Grammar/provenance/receipt adversarial suite after the cold gate: NOT_RUN.
• Core/full validation, actionlint, pinned tokenized zizmor, security/docs/generated/self-review/omission gates: NOT_RUN.
• Exact-head hosted non-skipped Flutter/Android/Qt evidence: NOT_RUN.
• Signed PR, merge, post-main evidence and closure of Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129/Close runtime evidence debt across every reusable workflow #126: NOT_DONE.

Recovery Attempt 2 is terminal and no further work is authorized. A separately authorized Final Recovery Attempt 3 is required. It must systemically audit and implement an explicit isolated bootstrap (python3 -I -c or equivalent) that intentionally exposes only the reviewed absolute scripts directory and the pinned dependency environment, and must map each CLI to its exact selftest/help/minimal-valid/adversarial mode. It must not reduce this to a one-line path insertion or ignore PyYAML isolation.

[rldyourmnd]

Final Recovery Attempt 3 — pre-mutation Python execution/import audit and design

Canonical Attempt 2 receipt 5280859312 remains immutable (8419 bytes, API byte-equal, SHA-256 815468797ffac924e8ff9f0c597792522cb5686be7679531c40caa3bfa285dd7). The prior combined diff hash remains explicitly INVALID / NOT_PROVEN and has not been reconstructed as historical evidence. Current diagnostic WIP is preserved.

This is the read-only design receipt required before Final Recovery Attempt 3 mutation. No repair, rerun or product mutation occurred before this audit.

Official Python contracts reviewed (2026-08-13)

• Python 3.13 command-line/environment contract: https://docs.python.org/3.13/using/cmdline.html
• Python 3.14 command-line/environment contract: https://docs.python.org/3.14/using/cmdline.html
• Python 3.13 runpy: https://docs.python.org/3.13/library/runpy.html
• Python 3.14 runpy: https://docs.python.org/3.14/library/runpy.html
• Python 3.14 importlib direct-source guidance: https://docs.python.org/3.14/library/importlib.html#importing-a-source-file-directly
• Python 3.13 import/package/resource index: https://docs.python.org/3.13/library/modules.html
• Python 3.13 importlib.resources: https://docs.python.org/3.13/library/importlib.resources.html
• Python 3.14 subprocess environment/cwd contract: https://docs.python.org/3.14/library/subprocess.html#subprocess.run
• Python 3.13 system isolation flags: https://docs.python.org/3.13/library/sys.html#sys.flags

Derived invariants:

1. -I implies -E, -P and -s: it ignores all PYTHON* variables and excludes cwd, script directory and user site from sys.path.
2. Direct python -I path/to/tool.py executes the file but intentionally does not make its directory importable. This exactly explains Attempt 2's sibling import failures.
3. python -I -m module cannot locate an unpackaged repository module because isolated mode also omits cwd. -m alone is therefore not a repository bootstrap.
4. runpy is not a sandbox and imported state/side effects remain in its process. It is safe for this use only because every tool/scenario gets a fresh, single-thread subprocess; alter_sys=False avoids the documented unsafe temporary sys manipulation.
5. importlib.util.spec_from_file_location is an approximation for one source file and does not establish the repository's sibling-module graph. Using it per tool would duplicate launch semantics and still require a separately managed dependency path.
6. subprocess.run(..., env=mapping, cwd=...) replaces inherited environment and establishes an explicit unrelated cwd. It is the authoritative hostile-environment boundary.
7. Package resources are appropriate when installed/zip-packaged. This repository's validators intentionally read the checked-out catalog/workflow/docs tree via Path(__file__); converting all resources and consumers to an installed package would be a broad semantic migration, not a necessary fix.

Actual repository topology

The audited subject inventory contains 45 Python surfaces under scripts/ before the new cold-process meta-gate is counted. The WIP meta-gate is a separate 46th surface and must self-cover rather than silently alter the historical count.

Sibling dependency graph roots found by AST inventory:

• _strict_yaml is the canonical YAML loader and depends only on pinned yaml (PyYAML).
• _workflow_yaml depends on _strict_yaml.
• _runners and _gradle_lockfile are stdlib-only leaves.
• workflow validators depend principally on _workflow_yaml; catalog validators depend on _strict_yaml; routing/scorecard/release validators add named validator siblings.
• generate_android_fixture_provenance depends on _gradle_lockfile.
• check_sdk_runtime_fixtures depends on _gradle_lockfile, _strict_yaml, _workflow_yaml and the proven missing xml.etree.ElementTree as ET stdlib import.
• validate_all is the single in-process aggregate and imports the complete blocking/advisory validator set.

Repository-external imports are exactly pinned PyYAML 6.0.3; everything else is stdlib or an exact sibling file. Deferred imports are intentional function-local imports, not optional dependency fallbacks. Existing module-level calls are pure constant/path/regex construction or known path setup; no accepted existing validator performs file/network/process mutation at import time.

Callers are split by contract:

• .github/workflows/ci.yml, maintenance.yml, release.yml, repository docs and skills call validate_all.py or individual validators using checked-out script paths.
• runtime fixture workflows directly call render_runtime_evidence.py and the new check_sdk_runtime_fixtures.py with explicit modes.
• negative gate jobs call negative_gate_probe.py with explicit workflow/job/fixture arguments.
• authored docs/AGENTS reference generator/check commands; mutating generators remain deliberate contributor commands.
• validate_all invokes validator functions in-process, while the new gate independently proves fresh-process startup and behavior.

Chosen single execution/import boundary

Do not package-migrate the product and do not add per-script sys.path.insert calls. Both would create more semantic paths and consumer churn.

check_python_execution_contract.py will own one stdlib-only bootstrap mode. Each child is invoked as:

python3 -I -B /absolute/repo/scripts/check_python_execution_contract.py --bootstrap TOOL [ARGS...]

The bootstrap must:

1. require CPython/Python 3.13 and prove sys.flags.isolated, ignore_environment, no_user_site and safe_path;
2. resolve its own non-symlinked repository scripts/ root and require the parent-supplied registered tool to map to exactly one regular .py file in the exact inventory;
3. reject unknown tools, traversal, duplicate/missing inventory, shadow modules, unexpected sibling imports and wrong interpreter/version;
4. replace the import search path with only reviewed interpreter stdlib/dynload roots plus the exact scripts root and a separately validated pinned PyYAML distribution root;
5. receive all roots as literal argv, never via cwd/PYTHONPATH/PYTHONHOME;
6. verify PyYAML distribution version 6.0.3, module origin under the supplied dependency root, and absence of cwd/shadow resolution;
7. set the tool argv and execute the registered module through runpy.run_module(..., run_name="__main__", alter_sys=False) in this fresh single-thread child;
8. never write on bootstrap/import; mutating generators are import/help-only in cold checks.

The parent gate will syntax/bytecode-check all inventory, AST-check undefined globals/import ownership/top-level side effects, and run bounded exact scenarios from an unrelated cwd with a sanitized replacement environment:

• direct validators: native positive/adversarial selftest mode;
• calendar validators: cold execution may return semantic 1 but never traceback;
• read-only generators: --help and --check;
• argument tools: --help, minimal-valid where bounded, and explicit fail-closed invalid input;
• render_runtime_evidence: --check, not no-argument production mode;
• mutating generators/sync: import/help only, never execute mutation;
• libraries: cold import only.

Machine negatives cover unknown/unregistered sibling imports, cwd/PYTHONPATH/PYTHONHOME shadow modules, missing repository resources, top-level file/process/network effects, wrong interpreter/version, malformed/traversing tool names, missing/duplicate inventory and incomplete caller scenario registration.

Final-attempt boundary

Only after this receipt may the launcher/gate and proven ElementTree dependency be reconciled. The complete three-ecosystem chain must then restart from fresh outputs. The next confirmed product/test/build/runtime/provenance failure is terminal: no repair, rerun or Attempt 4.

[rldyourmnd]

#129 Final Recovery Attempt3 — terminal handoff

Status: TERMINAL PRODUCT/TEST/EXECUTION-CONTRACT FAILURE. Final Recovery Attempt3 is exhausted. No Attempt4 exists. The Goal is blocked. This receipt preserves the exact first-gate evidence and the frozen diagnostic worktree; it does not claim runtime proof.

Attempt and command

The first and only Final Recovery Attempt3 product/test gate was invoked once from the ci-workflows repository root:

python3 scripts/check_python_execution_contract.py

It exited 1. Exact captured output:

check_python_execution_contract: FAIL
  - check_release_supply_chain.py []: exit 1, expected [0]; output="check_release_supply_chain: FAIL |   - release.yml:90: embedded Python must use isolated mode (-I) |   - Syft ARM64 pinned-binary fixture failed: Fatal Python error: Failed to import encodings module | Python runtime state: core initialized | ModuleNotFoundError: No module named 'encodings' |  | Current thread 0x00000001f35d2040 (most recent call first): |   <no Python frame> |   - Syft X64 pinned-binary fixture failed: Fatal Python error: Failed to import encodings module | Python runtime state: core initialized | ModuleNotFoundError: No module named 'encodings' |  | Current thread 0x00000001f35d2040 (most recent call first): |   <no Python frame> |   - publish shell rejected exact five-asset fixture: Fatal Python error: Failed to import encodings module | Python runtime state: core initialized | ModuleNotFoundError: No module named 'encodings' |  | Current thread 0x00000001f35d2040 (most recent call first): |   <no Python frame> | "

No gate, validator, generator, formatter, build, or product test was run after this failure.

Systemic classification

This is a product/test/execution-contract failure, not infrastructure.

Primary cause 1: the proposed repository-owned launcher invocation in .github/workflows/release.yml conflicts with an existing enforced release contract. check_release_supply_chain.py still requires repository/embedded Python in release.yml to use the literal isolated-mode -I form, and rejected line 90 with embedded Python must use isolated mode (-I). The launcher architecture and the authoritative release validator were therefore not reconciled before the gate.

Primary cause 2: the cold-process harness deliberately supplied a hostile PYTHONHOME/PYTHONPATH to its isolated launcher child. The launcher child itself ignored/sanitized that state, but the executed validator inherited the hostile variables and passed them to its own nested Python subprocess fixtures. Those nested interpreters failed during runtime initialization with ModuleNotFoundError: No module named 'encodings'. The isolation boundary therefore did not define or enforce transitive subprocess environment semantics.

Derivative messages preserved exactly above:

• Syft ARM64 pinned-binary fixture failed before its intended assertion.
• Syft X64 pinned-binary fixture failed before its intended assertion.
• The exact five-asset publish shell fixture was rejected for the same interpreter-startup reason.

These derivative failures are not evidence about Syft architecture support or release asset correctness; they are consequences of the leaked hostile Python environment.

Immutable lineage

Prior evidence remains unchanged:

• Prior-cycle Final Attempt3 authorization/history receipt: issue comment 5280177998.
• Prior-cycle terminal receipt: Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 (comment) — 7006 bytes, API byte-equal, recorded SHA-256 in its own receipt.
• Recovery-cycle Gradle grammar/source lineage: Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 (comment) — 5443 bytes, SHA-256 60d7bfc480458c49cbc56b45308825c44328981b1f0e0da807d72bc25141c5c3, API byte-equal.
• Recovery Attempt1 terminal receipt: Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 (comment) — 5229 bytes, SHA-256 c3ca61eacb29ea1f8ad472dd9cfa4878a40752bbe6dbc8fc2fd3af8c3390d246, API byte-equal.
• Recovery Attempt2 terminal receipt: Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 (comment) — 8419 bytes, SHA-256 815468797ffac924e8ff9f0c597792522cb5686be7679531c40caa3bfa285dd7, API byte-equal.
• Final Recovery Attempt3 pre-mutation Python execution design: Build bounded SDK runtime fixtures for Flutter, Android, and Qt #129 (comment) — 7903 bytes, SHA-256 11c0e656ec90b0a25afae8a90d3811426bbf822f87dcae8c8bc88a78a4dc4096, API byte-equal.

The earlier combined-diff hash from prior recovery history remains explicitly INVALID/NOT_PROVEN and was not reconstructed as historical evidence.

Frozen repository state

• Repository: NDDev-it-com/ci-workflows
• Branch: fixtures/sdk-runtime-evidence
• HEAD: 00546f1c601a106d560d92e316f332891ac6f840
• origin/main: 00546f1c601a106d560d92e316f332891ac6f840
• Deterministic current snapshot hash: SHA-256 355f635558a0662856daa2b7561011e8612e6bafb44eb446f2c82791f74801e7 over git diff --binary --no-ext-diff followed by lexically ordered untracked path names and each file's git hash-object value.
• A preceding read-only hash probe produced a6186534dac4c9086bf821ac0c05c2ac9cdffd4dd760ee77e7839689049ac61d, but that value is INVALID/NOT_PROVEN because a zsh loop variable named path clobbered PATH and prevented every untracked git hash-object invocation. It is retained only as process evidence and is not the snapshot identity.

Tracked modifications:

.github/workflows/ci.yml
.github/workflows/dart-flutter-ci.yml
.github/workflows/kotlin-android-ci.yml
.github/workflows/qt-ci.yml
.github/workflows/release.yml
.github/workflows/runtime-fixtures-event-write.yml
.github/workflows/runtime-fixtures-languages.yml
.github/workflows/runtime-fixtures.yml
CHANGELOG.md
catalog/capabilities.yml
catalog/tools.yml
docs/15-language-and-quality-packs.md
examples/languages/dart-flutter.yml
examples/languages/kotlin-android.yml
examples/languages/qt.yml
scripts/_strict_yaml.py
scripts/check_gate_contract.py
scripts/check_public_docs.py
scripts/check_release_graph.py
scripts/check_runner_routing.py
scripts/check_runtime_requirements.py
scripts/check_tool_registry.py
scripts/negative_gate_probe.py
scripts/validate_all.py
scripts/verify_scorecard_runtime.py

Untracked inventory:

scripts/_gradle_lockfile.py
scripts/check_python_execution_contract.py
scripts/check_sdk_runtime_fixtures.py
scripts/generate_android_fixture_provenance.py
scripts/generate_sdk_runtime_manifest.py
tests/fixtures/android/
tests/fixtures/flutter/
tests/fixtures/qt/
tests/fixtures/sdk-runtime-manifest.json
tests/fixtures/sdk-runtime-spec.yml

This worktree is diagnostic WIP. The snapshot hash proves only the frozen byte state at handoff; it does not make the changes correct, reproducible, committed, reviewed, or runtime-proven.

NOT_RUN / NOT_PROVEN

After the terminal failure, the following Final Recovery Attempt3 chain was not run:

• fresh Android canonical provenance generation;
• fresh isolated strict ./gradlew build replay;
• Flutter 3.47.0 / Dart 3.13 resolve, format, analyze, and test chain;
• clean Qt 6.8.4 configure, compile, and CTest chain;
• SDK manifest regeneration/parity chain;
• full/core validation sweep;
• actionlint;
• tokenized pinned zizmor and security gates;
• catalog/docs/examples/generated/runtime-ledger reconciliation;
• PR exact-head checks;
• hosted non-skipped Flutter, Android, and Qt runtime evidence;
• merge and post-main evidence.

No runtime-coverage status or digest from this WIP is proven. Prior successful Android diagnostic generation/strict replay from earlier attempts remains diagnostic only and cannot close this cycle.

Risks and required future boundary

• Changing the launcher alone would leave the release policy contradictory; changing the release validator alone could weaken an intentional isolation control. A future recovery cycle must derive one authoritative invariant and test both the allowed launcher form and forbidden bypasses.
• Sanitizing only the first child is insufficient. A future design must explicitly distinguish hostile-input testing from the environment supplied to nested subject-owned subprocesses, without hiding genuine ambient-environment dependencies.
• The cold gate currently couples a meta execution check to the full behavior of validators with nested external fixtures. That topology needs a reviewed boundary between startup/import proof and bounded semantic selftests.
• Current Android/Flutter/Qt generated outputs and workflow changes remain unreviewed diagnostic WIP and may contain independent defects not reached by the first failure.
• Supply-chain consumers pin full SHAs; none of this WIP may be published or represented as supported evidence.

Final Recovery Attempt3 is exhausted. No repair, rerun, commit, push, PR, merge, release, or Attempt4 is authorized. Continuation requires a separately authorized new recovery cycle with a systemic audit of the release isolation contract and transitive subprocess environment model.

[rldyourmnd]

#129 new recovery cycle Attempt1 — Python invocation/process-edge audit

This is the pre-mutation design lineage for the separately authorized recovery cycle after terminal receipt #129 (comment). It is not Attempt4. All earlier receipts and diagnostic WIP remain immutable evidence; no prior runtime claim is upgraded here.

Authoritative Python semantics (reviewed 2026-08-13)

Primary sources:

• Python 3.13 command-line/environment contract: https://docs.python.org/3.13/using/cmdline.html
• Python 3.14 command-line/environment contract: https://docs.python.org/3.14/using/cmdline.html
• Python 3.13 subprocess contract: https://docs.python.org/3.13/library/subprocess.html
• Python 3.14 subprocess contract: https://docs.python.org/3.14/library/subprocess.html
• Python 3.13 runpy contract: https://docs.python.org/3.13/library/runpy.html
• Python 3.13 os process/environment contract: https://docs.python.org/3.13/library/os.html#process-parameters

Derived invariants:

1. -I implies -E, -P, and -s: interpreter initialization ignores every PYTHON* variable, excludes the script/current directory and user site from sys.path, and prevents those ambient locations from supplying the launcher itself or a subject dependency.
2. -B prevents import-time bytecode writes. It is part of the repository launcher vocabulary in addition to -I.
3. -I does not delete PYTHON* keys from os.environ; it only prevents the current interpreter from using them. A child process receives the parent environment unless env is supplied, so nested interpreters can still consume leaked PYTHONHOME, PYTHONPATH, PYTHONWARNINGS, PYTHONBREAKPOINT, encoding, locale, or other controls.
4. subprocess documents that an explicit env mapping replaces inheritance. Therefore every repository process edge must construct an explicit environment; env=None, os.environ.copy(), {**os.environ, ...}, and equivalent ambient merges are forbidden.
5. An explicit environment must retain platform bootstrap values required by the executable (notably SystemRoot on Windows). This requires a small cross-platform base allowlist rather than an empty mapping.
6. runpy.run_module(..., alter_sys=False) executes in a fresh module namespace without the thread-unsafe temporary sys.argv/sys.modules mutation caused by alter_sys=True. The launcher uses a fresh process for every subject, so no subject shares an import cache or mutable global state with another.

Current policy contradiction

The terminal gate proved two defects in the same architecture:

• check_release_supply_chain.py scans every line containing python3 in release-supply-chain.yml, release-supply-chain-free.yml, and release.yml and independently requires the old literal python3 -I ... shape. It therefore rejects the repository launcher call in release.yml, even though that launcher is the intended isolation boundary.
• Its _run begins with os.environ.copy() and several direct subprocess.run calls omit env. The cold harness supplied hostile PYTHONHOME/PYTHONPATH to test the launcher. Those keys remained visible in the subject's os.environ, were forwarded into shell/Python stubs, and nested interpreters failed before loading encodings.

The Syft ARM64, Syft X64, and five-asset publish derivative errors from the terminal gate are consequences of this leak. They are not evidence that those release contracts are defective.

Other independently owned literal-shape validators exist for embedded workflow heredocs (check_actionlint_contract.py, check_gate_contract.py, check_monorepo_routing.py, check_release_promotion_gate.py, check_scorecard_evidence_contract.py, check_secret_scan_contract.py). Embedded standalone programs remain python3 -I; repository subject files must instead use the canonical launcher. These two classes must be explicit in one policy rather than conflated by a global regex.

Audited process-edge inventory

Python-owned process creation currently occurs in:

• check_actionlint_contract.py
• check_gate_contract.py
• check_monorepo_routing.py
• check_pr_hygiene_contract.py
• check_privileged_ref_guard.py
• check_python_execution_contract.py
• check_release_promotion_gate.py
• check_release_supply_chain.py
• check_scorecard_evidence_contract.py
• check_secret_scan_contract.py
• check_side_effect_fixture_contract.py
• generate_android_fixture_provenance.py
• negative_gate_probe.py
• validate_all.py
• verify_scorecard_runtime.py

Observed unsafe patterns include ambient copies/merges in actionlint, monorepo routing, PR hygiene, release promotion, release supply-chain, secret-scan, Android generation, and negative-gate fixtures; implicit env=None in GNU tar/gzip/listing discovery, validate-all Git calls, and Scorecard API calls; and a hostile environment deliberately supplied to the launcher without a distinct clean subject edge.

Shell-launched Python stubs in release fixtures form additional nested edges even though their process creation appears in embedded shell rather than as a Python AST call. They must be registered and tested as child-generation edges.

Canonical machine-readable policy

catalog/python-execution.yml will be the sole policy source and will be validated as strict YAML. It will own:

• schema/version and exact supported CPython 3.13 contract;
• exact launcher path and token sequence: python3 -I -B scripts/check_python_execution_contract.py --launch <registered-tool.py> -- <args>;
• the exact 45 subject surfaces plus the meta-launcher, their mode (library, read-only-validator, read-only-generator-check, mutating-generator-import-help-only, aggregate), sibling imports, external dependency ownership, and explicit resource roots;
• PyYAML==6.0.3 ownership only for transitive graphs that reach yaml;
• environment profiles and the exact registered process-edge inventory;
• the distinction between standalone embedded heredocs (python3 -I) and repository subject tools (launcher only).

The validator and docs generator will consume this file. Workflow/tests/docs commands will be machine-compared with its token vocabulary. No validator may independently demand a stale literal subject shape.

Environment-taint model

Every normal process edge receives an environment constructed by one repository helper from:

1. a closed cross-platform bootstrap allowlist (PATH, platform system-root/comspec values, temporary-directory values, and only documented base values);
2. explicitly named inherited keys for that edge;
3. explicit non-secret overrides owned by the caller.

All keys whose uppercase spelling starts with PYTHON are removed before the process starts, regardless of platform/key casing. Locale is set deterministically by policy. Values are never logged. The child receives a typed JSON diagnostic containing only the sorted names of stripped interpreter-control keys. Secret-bearing values are explicit per edge and never included in diagnostics.

An intentional hostile-python-probe profile may inject interpreter controls only at its owned edge and only into an exact isolated Python command. It may not forward them to another subprocess. The ordinary profile rejects such overrides.

Nested subject-owned subprocesses use the same helper. The meta-gate statically rejects subprocess.run, Popen, check_call, check_output, os.exec*, os.spawn*, os.system, and os.popen edges absent from the policy; it also rejects missing env=, ambient copies/merges, unregistered launch shapes, and Python children that bypass the launcher/embedded-isolated class.

Evidence-layer separation

The cold execution contract will prove only:

• exact inventory/dependency graph and Python 3.13 syntax/bytecode;
• launcher isolation, resource/dependency origins, shadow resistance, and no import-time writes;
• import/help startup in fresh unrelated-cwd processes;
• process-edge registration and environment construction;
• deterministic multi-generation launcher diagnostics/taint stripping.

It will not execute every validator's business check() function. Read-only validator semantics remain dedicated entries in validate_all.py; release, shell-gate, security, and SDK negative/positive fixtures remain their dedicated end-to-end gates. Mutating generators are import/help-only in the cold layer and run only in their explicit generation phase.

Required deterministic negatives

Before the first product gate, implementation must cover:

• hostile outer PYTHONHOME, PYTHONPATH, PYTHONWARNINGS, PYTHONBREAKPOINT, PYTHONIOENCODING, PYTHONUTF8, PYTHONCOERCECLOCALE, mixed-case variants, and hostile locale/encoding values;
• at least three process generations with exact stripped-name diagnostics and no value disclosure;
• shadow sibling, dependency, stdlib, and sitecustomize modules;
• missing/wrong PyYAML dependency origin/version and missing resource root;
• wrong interpreter/version/isolation flags;
• unknown/traversing/unregistered subject and incomplete inventory/import/process graph;
• implicit/ambient process environment and unregistered nested Python bypass;
• release-policy parity: embedded heredoc accepted only in isolated form, repository subject accepted only through the exact isolated launcher, stale direct subject invocation rejected, and negative release fixture variants unable to weaken either class;
• child failure diagnostics preserved through launcher and parent without being confused with bootstrap failure.

Attempt boundary

No repository mutation or gate preceded this receipt in the new cycle. After implementation/reconciliation, the execution contract will run once. The first new product/test/build/runtime/provenance failure terminates Recovery Attempt1 immediately with no repair or rerun pending explicit Attempt2 authorization. Android/Flutter/Qt/full/security/hosted evidence remains NOT_PROVEN until the complete new chain succeeds.