CompleteDotTech · Oct 8, 2026 · Oct 8, 2026 · Oct 8, 2026
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -15,6 +15,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - run: python -m pip install -r requirements.txt
       - run: python -m pip install Pillow==12.2.0 PyMuPDF==1.28.0
+      - name: Provision the declared build backend that the generated-sdist test imports
+        run: python -m pip install "setuptools>=68" wheel
       - run: python tools/run_validation.py
       - run: python -m pip install --no-deps .
       - run: trace-gc --version
@@ -70,7 +72,121 @@ jobs:
           python -m unittest discover -s tests -p "test_windows_fence_diagnostics.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
           grep -Eq '^Ran 18 tests in ' "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
           grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-fence-diagnostics-tests.log"
+      - name: Run the 155 native-descriptor, installation-component, restoration, token, privilege-isolation, launcher-containment, privilege-restoration, child-evidence, standalone-script, runtime-main-section, child-stop-before-restoration, launcher-consumer fixture-retention, per-fixture installation-restoration and access-denied directory-creation probe cases (one hundred thirty-nine portable, sixteen native)
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_windows_native_acl.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-native-acl-tests.log"
+          grep -Eq '^Ran 155 tests in ' "$RUNNER_TEMP/windows-native-acl-tests.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-native-acl-tests.log"
+      - name: Positive gate, supported context required - the strict v1 producer cases in a child whose own primary token has every privilege removed
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest tests.test_paper_pilot_phase_trustees_v1_v4.V1FenceTrusteeTests.test_the_strict_positive_producer_path_runs_in_a_restricted_primary_token_child -v 2>&1 | tee "$RUNNER_TEMP/windows-required-positive.log"
+          grep -Eq '^Ran 1 test in ' "$RUNNER_TEMP/windows-required-positive.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-required-positive.log"
+      - name: Run the forty-five native v1/v4 fence, receipt-validator and phase-ownership trustee cases as the original runner token (context-aware, the branch each case took is printed)
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          export JRAPHYTE_BRANCH_LOG="$RUNNER_TEMP/windows-branches.jsonl"
+          python -m unittest discover -s tests -p "test_paper_pilot_phase_trustees_v1_v4.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-phase-trustees.log"
+          grep -Eq '^Ran 45 tests in ' "$RUNNER_TEMP/windows-phase-trustees.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-phase-trustees.log"
+          echo "original-token branches (supported_positive = positive qualification; unsupported_refusal = negative evidence only):"
+          cat "$RUNNER_TEMP/windows-branches.jsonl"
+      - name: Run the existing three v1 and eight v4 native fence cases as the runner identity
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_paper_pilot_phase_fence.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-phase-v1.log"
+          grep -Eq '^Ran 3 tests in ' "$RUNNER_TEMP/windows-phase-v1.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-phase-v1.log"
+          python -m unittest discover -s tests -p "test_paper_pilot_phase_cutover_guarded_v4.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-phase-v4.log"
+          grep -Eq '^Ran 8 tests in ' "$RUNNER_TEMP/windows-phase-v4.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-phase-v4.log"
+      - name: Run the six converter worker parent-process cases (four portable, genuine Windows venv redirector chain and exit-259 liveness native; refs #94)
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_paper_converter_worker_parent.py" -v 2>&1 | tee "$RUNNER_TEMP/windows-converter-worker-parent.log"
+          grep -Eq '^Ran 6 tests in ' "$RUNNER_TEMP/windows-converter-worker-parent.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/windows-converter-worker-parent.log"
+      - name: Run the eighteen sdist/wheel discovery cases (both build-backend spellings, missing and ambiguous artifacts)
+        if: always()
+        shell: bash
+        run: |
+          set -o pipefail
+          python -m unittest discover -s tests -p "test_sdist_discovery.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-discovery-tests.log"
+          grep -Eq '^Ran 18 tests in ' "$RUNNER_TEMP/sdist-discovery-tests.log"
+          grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-discovery-tests.log"
+      - name: Build the sdist and the wheel from it, run the shipped affected tests from the extracted sdist, then check the installed wheel outside the checkout
+        if: always()
+        shell: bash
+        run: |
+          set -euo pipefail
+          python -m pip install build "setuptools>=68" wheel
+          python -m build --outdir "$RUNNER_TEMP/dist" .
+          SDIST="$(python tools/sdist_discovery.py extract --project trace-gc --dist "$RUNNER_TEMP/dist" --into "$RUNNER_TEMP/sdist")"
+          WHEEL="$(python tools/sdist_discovery.py wheel --project trace-gc --dist "$RUNNER_TEMP/dist")"
+          (
+            cd "$SDIST"
+            python -m unittest discover -s tests -p "test_sdist_phase_distribution.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-distribution.log"
+            grep -Eq '^Ran 3 tests in ' "$RUNNER_TEMP/sdist-distribution.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-distribution.log"
+            python -m unittest discover -s tests -p "test_sdist_discovery.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-discovery.log"
+            grep -Eq '^Ran 18 tests in ' "$RUNNER_TEMP/sdist-discovery.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-discovery.log"
+            python -m unittest discover -s tests -p "test_windows_native_acl.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-native-acl.log"
+            grep -Eq '^Ran 155 tests in ' "$RUNNER_TEMP/sdist-native-acl.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-native-acl.log"
+            python -m unittest tests.test_paper_pilot_phase_trustees_v1_v4.V1FenceTrusteeTests.test_the_strict_positive_producer_path_runs_in_a_restricted_primary_token_child -v 2>&1 | tee "$RUNNER_TEMP/sdist-required-positive.log"
+            grep -Eq '^Ran 1 test in ' "$RUNNER_TEMP/sdist-required-positive.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-required-positive.log"
+            export JRAPHYTE_BRANCH_LOG="$RUNNER_TEMP/sdist-branches.jsonl"
+            python -m unittest discover -s tests -p "test_paper_pilot_phase_trustees_v1_v4.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-phase-trustees.log"
+            grep -Eq '^Ran 45 tests in ' "$RUNNER_TEMP/sdist-phase-trustees.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-phase-trustees.log"
+            cat "$RUNNER_TEMP/sdist-branches.jsonl"
+            unset JRAPHYTE_BRANCH_LOG
+            python -m unittest discover -s tests -p "test_paper_pilot_phase_fence.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-phase-v1.log"
+            grep -Eq '^Ran 3 tests in ' "$RUNNER_TEMP/sdist-phase-v1.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-phase-v1.log"
+            python -m unittest discover -s tests -p "test_paper_pilot_phase_cutover_guarded_v4.py" -v 2>&1 | tee "$RUNNER_TEMP/sdist-phase-v4.log"
+            grep -Eq '^Ran 8 tests in ' "$RUNNER_TEMP/sdist-phase-v4.log"
+            grep -Eq '^OK[[:space:]]*$' "$RUNNER_TEMP/sdist-phase-v4.log"
+          )
+          python -m venv "$RUNNER_TEMP/installed-venv"
+          INSTALLED="$RUNNER_TEMP/installed-venv/Scripts/python.exe"
+          "$INSTALLED" -m pip install -r requirements.txt
+          "$INSTALLED" -m pip install --no-deps "$WHEEL"
+          DECLARED=()
+          for NAME in phase_authority.py budget.py canonical.py trust.py; do
+            DECLARED+=(--declared-source "$NAME=$(python -c "import hashlib,sys;print(hashlib.sha256(open(sys.argv[1]+'/trace_gc/'+sys.argv[2],'rb').read()).hexdigest())" "$SDIST" "$NAME")")
+          done
+          mkdir "$RUNNER_TEMP/outside-checkout"
+          cd "$RUNNER_TEMP/outside-checkout"
+          "$INSTALLED" -I "$SDIST/tools/installed_phase_authority_check.py" --require-windows "${DECLARED[@]}" | tee "$RUNNER_TEMP/installed-phase-check.json"
+          python -c "import hashlib,json,os,sys;d=json.load(open(os.environ['RUNNER_TEMP']+'/installed-phase-check.json'));assert d['native_windows']=='RUN' and len(d['portable_checks'])==13 and len(d['windows_checks'])==35 and d['fixture_utility_sha256']==hashlib.sha256(open(sys.argv[1]+'/tools/windows_native_acl.py','rb').read()).hexdigest() and d['fixture_acl_sha256']==hashlib.sha256(open(sys.argv[1]+'/tools/windows_fixture_acl.py','rb').read()).hexdigest() and all(d['portable_checks'].values()) and all(d['windows_checks'].values()),d" "$SDIST"
       - name: Sanitized Windows trustee serialization diagnostics
         if: always()
         continue-on-error: true
         run: python tools/windows_fence_diagnostics.py
+      - name: Sanitized native directory-creation denial probe, candidate-shape matrix, privilege isolation and installation observation
+        if: always()
+        continue-on-error: true
+        shell: bash
+        run: |
+          set -o pipefail
+          python tools/windows_native_acl.py | tee "$RUNNER_TEMP/native-probe.json"
+      - name: Assert the standalone diagnostics script ran past its bootstrap and checkout imports on the runner
+        if: always()
+        shell: bash
+        run: |
+          python -c "import json,os;d=json.load(open(os.environ['RUNNER_TEMP']+'/native-probe.json'));assert d['os_name']=='nt' and d['completed_stages'][:4]==['bootstrap','checkout_imports','native_api','identity'] and 'error' not in d,d"
diff --git a/MANIFEST.in b/MANIFEST.in
@@ -1,2 +1,18 @@
+# The phase-fence and Windows tests, and the helpers they import or load by path, are listed
+# explicitly so the sdist does not depend on the build backend's default tests/test*.py rule.
+# The wheel installs only trace_gc; src/ and tools/ are not installed packages.
 include src/paper_pilot_phase_cutover.py
 include src/paper_pilot_phase_cutover_guarded_v2.py
+include src/paper_pilot_phase_cutover_guarded_v4.py
+include src/paper_pilot_phase_export.py
+include tools/installed_phase_authority_check.py
+include tools/sdist_discovery.py
+include tools/windows_native_acl.py
+include tools/windows_fence_diagnostics.py
+include tools/windows_fixture_acl.py
+include tests/phase_trustee_harness.py
+include tests/test_paper_pilot_phase_*.py
+include tests/test_windows_*.py
+include tests/test_sdist_phase_distribution.py
+include tests/test_sdist_discovery.py
+include .github/workflows/test.yml
diff --git a/MANIFEST.json b/MANIFEST.json
@@ -3,12 +3,12 @@
   "hash_algorithm": "SHA-256",
   "manifest_self_excluded": true,
   "source_only": true,
-  "file_count": 709,
+  "file_count": 718,
   "files": [
     {
       "path": ".github/workflows/test.yml",
-      "bytes": 3589,
-      "sha256": "9c147d3ff67e4bc298c4376bcef076390c1a86d25ee9333ddf1d01ff861f4b23"
+      "bytes": 12883,
+      "sha256": "1b148dbe243b919564f06d96d66c4a2698e45a9b9b7772f4331abdc33824a2fd"
     },
     {
       "path": ".gitignore",
@@ -32,8 +32,8 @@
     },
     {
       "path": "MANIFEST.in",
-      "bytes": 93,
-      "sha256": "b4b637c3d710c1082dcdb508c73914885376c79acfef9288b070cdb0e5ddfeaf"
+      "bytes": 883,
+      "sha256": "0b3f3ec6266018a68361d3e811c8532509efa70cef8aa5f9e320adf2928b9ba0"
     },
     {
       "path": "NEXT_AGENT_PROMPT.md",
@@ -737,8 +737,8 @@
     },
     {
       "path": "docs/paper_pilot_phase_transition.md",
-      "bytes": 10022,
-      "sha256": "c067ae79613ece775ddea7664932a8b9bf93c75d89a7a5ab68e82fbfe534522c"
+      "bytes": 24745,
+      "sha256": "ad69ebbe19ad4d7a6f87bc7e3b3818ee091f6a606c80d6ae496f417a81414ad1"
     },
     {
       "path": "docs/paper_pilot_workflow.md",
@@ -2292,8 +2292,8 @@
     },
     {
       "path": "src/paper_pilot_phase_cutover.py",
-      "bytes": 5969,
-      "sha256": "e12545acd4e62d8e80179e356e1b2140424a048188e4b12a0285f34b9143cfd1"
+      "bytes": 9460,
+      "sha256": "1bca8c2c85e3b7cf871da6af26076274f1dde925d424e28ac026a7d6b2f5f458"
     },
     {
       "path": "src/paper_pilot_phase_cutover_guarded_v2.py",
@@ -2302,8 +2302,8 @@
     },
     {
       "path": "src/paper_pilot_phase_cutover_guarded_v4.py",
-      "bytes": 29079,
-      "sha256": "a9547fbaa0e76fbbd649366475262041f61d738f2dba1f0c8702a4a4c056abf1"
+      "bytes": 29146,
+      "sha256": "9b0e7b05c95d67015314a8b53a0f3182c66e0c0f5717c59d888440b077e1cabe"
     },
     {
       "path": "src/paper_pilot_phase_export.py",
@@ -2485,6 +2485,11 @@
       "bytes": 14733,
       "sha256": "d87bcd1bac62d772a134ef4057d9c311b1cf7b30f599975ac01bbef4ef753451"
     },
+    {
+      "path": "tests/phase_trustee_harness.py",
+      "bytes": 28549,
+      "sha256": "77a5c4ab973e8a6d3e99128ad92f06311fc9102c43ec04844c694a44b6f373d0"
+    },
     {
       "path": "tests/test_abstract_validation.py",
       "bytes": 2304,
@@ -2652,13 +2657,13 @@
     },
     {
       "path": "tests/test_paper_pilot_phase_cutover_guarded_v4.py",
-      "bytes": 14007,
-      "sha256": "8ce50d09266407ccff5f2ace0b1cde7d4e4b00e81939426c58b459456f801237"
+      "bytes": 14399,
+      "sha256": "7a5cbd61d2e4472f8790dbb40888b60cd616c0b5a972c23025465569710f09db"
     },
     {
       "path": "tests/test_paper_pilot_phase_fence.py",
-      "bytes": 5050,
-      "sha256": "ce53724a2a31c5fe385be5f3010dae14da5babfa168e02ad936e92c54743f65f"
+      "bytes": 6030,
+      "sha256": "9b48c17fce8ea4c2e915c238cf3fcc7eb4ae8f282992519a71cfb2dadc7fe5f7"
     },
     {
       "path": "tests/test_paper_pilot_phase_import_lock.py",
@@ -2670,6 +2675,16 @@
       "bytes": 12908,
       "sha256": "520c40c81f511a5134dec2acdc2eb81417848160e6def470d73b6b15ee06c872"
     },
+    {
+      "path": "tests/test_paper_pilot_phase_trustees_model.py",
+      "bytes": 48198,
+      "sha256": "061fa1f60e1b7335ba878fe3616083688349758a93fe79dff1269e2de02c5373"
+    },
+    {
+      "path": "tests/test_paper_pilot_phase_trustees_v1_v4.py",
+      "bytes": 43328,
+      "sha256": "f83e09133ca97d3e57e40d17621c18939835f9ed0dfae04a0b003071af44eee1"
+    },
     {
       "path": "tests/test_paper_qualification_v1.py",
       "bytes": 80357,
@@ -2935,6 +2950,16 @@
       "bytes": 30226,
       "sha256": "85f176c3e186e20b14d623f31d57a685ab2312fab3439904dcbb74437cb0bde5"
     },
+    {
+      "path": "tests/test_sdist_discovery.py",
+      "bytes": 12012,
+      "sha256": "8f1a1b5f9517c6336fb89a1d0760446135fdef266611e6b34348fe10333cf178"
+    },
+    {
+      "path": "tests/test_sdist_phase_distribution.py",
+      "bytes": 6981,
+      "sha256": "7c8d4a1fbe8441c342b914d218d24e5b20b53ae8d4cf65517b524990d53aaded"
+    },
     {
       "path": "tests/test_selected_reviewed_replay.py",
       "bytes": 12418,
@@ -2965,6 +2990,11 @@
       "bytes": 11977,
       "sha256": "438d68653cd88d60f4376f1bda7cb33e443d32059e0b86ef0f32b788ba5b4563"
     },
+    {
+      "path": "tests/test_windows_native_acl.py",
+      "bytes": 131065,
+      "sha256": "a466bf28608b379ca8e4745e3f953e7354d7ed5f8a0326ef5821517b96acf5c4"
+    },
     {
       "path": "tools/build_schemas.py",
       "bytes": 12978,
@@ -2990,6 +3020,11 @@
       "bytes": 3921,
       "sha256": "dc393fea23327063506b772157fa7ddbaecc18fee058aab9f2489959767017fc"
     },
+    {
+      "path": "tools/installed_phase_authority_check.py",
+      "bytes": 24082,
+      "sha256": "de288c30423b0decc6777f4246d911943700c592988bad1b87b8a7d7fb9c0cdf"
+    },
     {
       "path": "tools/legacy_hardening.py",
       "bytes": 8616,
@@ -3030,6 +3065,11 @@
       "bytes": 7493,
       "sha256": "aea3f70fc525b1308d2254689a43c50a7ae8708bd0599a6d9c5ed880d0775df3"
     },
+    {
+      "path": "tools/sdist_discovery.py",
+      "bytes": 4681,
+      "sha256": "80f6d9f540de5a7b2fd0612044fb57af65d58f9e28f2a59f993cb327816b1835"
+    },
     {
       "path": "tools/selected_reviewed_replay.py",
       "bytes": 18994,
@@ -3055,6 +3095,11 @@
       "bytes": 5451,
       "sha256": "de645b1b260d8e1e3cf5b37a8e5ebc10f3e925c72179e3cc1f2088ce64ce9e47"
     },
+    {
+      "path": "tools/windows_native_acl.py",
+      "bytes": 71797,
+      "sha256": "36cff50790ac00d76e1fdf0425da8a25062f193cd0a28103a638135d3124c58b"
+    },
     {
       "path": "trace_gc/__init__.py",
       "bytes": 103,
@@ -3387,8 +3432,8 @@
     },
     {
       "path": "trace_gc/phase_authority.py",
-      "bytes": 10610,
-      "sha256": "b2ffc2e12be3c927f167a456acb1f95a7d2c615756131b2f889ddc97610dfee9"
+      "bytes": 14745,
+      "sha256": "0a97d6668a3860570342d3122ffeadb77e2eabf186c3361aab52db5ea614ceac"
     },
     {
       "path": "trace_gc/phase_transition.py",