Authenticate V5 review evidence through aggregation

[joshlf]

Replace the caller-supplied semantic overlay with an immutable lifecycle of
three source reviews and eight snapshot reviews. Require disjoint reviewer
identities and bind exact source trees, report materials, authority evidence,
work products, receipts, captures, external commitment, and static lock.

Carry the same descriptor-captured evidence through aggregation instead of
reopening paths or consuming legacy summaries. Correct DRAFT/READY status
versions and excluded authority kinds, derive aggregate and gate inputs from
the authenticated receipt inventory, and execute only captured trusted
word-count bytes.

Close receipt, candidate-path, word-counter, and lock-reopen races with
no-follow captures, stable inode checks, immutable publication, and exact
commitment joins. Document uninterrupted private custody as a TCB premise and
exercise the complete mechanical 3+8 review lifecycle plus adversarial
replacement, identity, provenance, and aggregation mutations.

This remains diagnostic infrastructure. It records no genuine semantic
reports or evaluation result, and reviewer honesty, custody, trusted runtime
semantics, and collision resistance remain explicit premises.

Agent-Authored-By: AI agent acting on Josh Liebow-Feeser's behalf

---

This PR is on branch codex/unsafe-rust-stack.

• 　  Harden V5 staged runtime and recovery #3607
• 👉 Authenticate V5 review evidence through aggregation #3604
• 　  Make the V5 diagnostic harness executable and fail closed #3603
• 　  Draft and validate the V5 diagnostic-prequalification harness #3601
• 　  Harden V5 evaluation and terminal confirmation #3537
• 　  Require evidence-bearing proof kernels in unsafe Rust V5 #3536
• 　  Analyze why the V4 focused gate failed #3535
• 　  Blind-score and aggregate the V4 focused evaluation #3534
• 　  Collect all V4 focused audit reports #3533
• 　  Freeze the V4 focused confirmation protocol #3532

Latest Update: v17 — Compare vs v16

📚 Full Patch History

Links show the diff between the row version and the column version.

Version	v16	v15	v14	v13	v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v17	v16	v15	v14	v13	v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v16		v15	v14	v13	v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v15			v14	v13	v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v14				v13	v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v13					v12	v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v12						v11	v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v11							v10	v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v10								v9	v8	v7	v6	v5	v4	v3	v2	v1	Base
v9									v8	v7	v6	v5	v4	v3	v2	v1	Base
v8										v7	v6	v5	v4	v3	v2	v1	Base
v7											v6	v5	v4	v3	v2	v1	Base
v6												v5	v4	v3	v2	v1	Base
v5													v4	v3	v2	v1	Base
v4														v3	v2	v1	Base
v3															v2	v1	Base
v2																v1	Base
v1																	Base

⬇️ Download this PR

Branch

git fetch origin refs/heads/Gwmskgf6pp5ufbufusyjegs357wjllvtq && git checkout -b pr-Gwmskgf6pp5ufbufusyjegs357wjllvtq FETCH_HEAD

Checkout

git fetch origin refs/heads/Gwmskgf6pp5ufbufusyjegs357wjllvtq && git checkout FETCH_HEAD

Cherry Pick

git fetch origin refs/heads/Gwmskgf6pp5ufbufusyjegs357wjllvtq && git cherry-pick FETCH_HEAD

Pull

git pull origin refs/heads/Gwmskgf6pp5ufbufusyjegs357wjllvtq

Stacked PRs enabled by GHerrit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-29T10:48:39.601645Z	b1e88b3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (Ghchu3g3fkri2ofhgm5addjto4rfkyvyi@471908d). Learn more about missing BASE report.

Additional details and impacted files

@@                         Coverage Diff                          @@
##             Ghchu3g3fkri2ofhgm5addjto4rfkyvyi    #3604   +/-   ##
====================================================================
  Coverage                                     ?   91.85%           
====================================================================
  Files                                        ?       20           
  Lines                                        ?     6093           
  Branches                                     ?        0           
====================================================================
  Hits                                         ?     5597           
  Misses                                       ?      496           
  Partials                                     ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.