Provenance and standalone adaptation

Upstream evidence

The POC was developed in the local studies repository as benchmarks/experiments/EXP-P2-FUSION-V4.

Item	Identity
Reproducible POC implementation	7eedcbf7d7d85ff47895d0f810274c12618351e1
Accepted compact evidence	a48bd9bf7620e7322d7bfc37e6775bb7ba1c7271
Original input inventory	18 files, SHA-256 e76e7c5de2296bb5791dfa4eb7efbc83678f3cb5b60e05f74cf03ac7544ef286
Original reproduction package	RPK-DB057-0001

The historical narrative and compact receipt are retained under evidence. Disposable raw runs remain outside Git.

Historical identifier translation

The upstream repository used project-management identifiers that are not part of the standalone POC's current interface. They remain here and in archived evidence only so that a reviewer can trace the extracted implementation back to its source.

Upstream identifier	Historical meaning	Standalone terminology
EXP-P2-FUSION-V4	Upstream experiment identity	aquila-fusion-poc
DB-057	Backlog task that produced the accepted reproducible POC	No current task identifier; the POC is identified by its descriptive experiment ID
MODEL-01/B	Finding represented as a versioned assessment object rather than a fact	assessment representation
MODEL-01/C	Finding represented as a newly produced aggregate fact	aggregate_fact representation
OQ-10	Upstream decision about accepting, reworking, or re-scoping the dual evaluation	architectural_decision_claimed: false; this POC supplies evidence but makes no architectural decision
DB-028 / DB-052	Earlier provenance-contract and prevalidation lineage	Standalone provenance and fixture-scoped implementation terminology

Renaming these identifiers changes the derived standalone artifact identities. It does not rewrite the archived receipt or claim byte identity with the upstream artifacts; semantic equivalence continues to be checked by the standalone oracles.

Imported unchanged before adaptation

• five Java fixture sources and designations;
• static, runtime, and fusion oracles;
• the query definition;
• semantic harness, exact verifier, process controller, inventory, runner, and analyzer; and
• focused inventory and runner tests.

Git object transfer was used so the initial imported blobs were byte-identical to the upstream commits. Four trailing blank lines were then normalized; no fixture or oracle semantics changed.

Standalone changes

• removed the machine-specific and DB-056-heavy manifest.json;
• flattened the standalone implementation under poc/ and named its entry contract definition.json;
• separated semantic source inventory from the launcher/build boundary and per-run executable/JDK identity;
• made semantic directories exact so undeclared executable or data inputs are rejected before a run;
• restricted the Docker build context to an explicit file allowlist and bound poc.sh, Dockerfile, Compose, and .dockerignore bytes into source identity;
• replaced Git-only cleanliness with content-addressed identity inside immutable containers while preserving clean-Git mode for host engineering development;
• records a Git-observed revision separately from launcher worktree dirtiness and labels non-Git caller revisions as unverified assertions;
• moved mutable output to a configurable runs root;
• added a stable container CLI and compact public output;
• pinned Docker Official Images and restricted runtime privileges/network/filesystem;
• observes effective IDs, groups, capabilities, no-new-privileges, network interfaces, and root-filesystem writability before accepting a public run;
• retains process-group containment until resistant descendants are terminated and reaped, even after the original group leader exits;
• added retained-artifact tampering probes and deeper test-only semantic mutants without changing the four official negative cases;
• emits phase progress as JSON Lines on standard error without changing public JSON output or evidence schemas;
• executes javap through its authenticated open descriptor and rechecks the digest after use; and
• added Docker-facing behavioral contracts and CI.

These changes create a derived containerized reproduction. They do not claim that new result bytes are the historical same_artifact_rerun; semantic equivalence is re-established by the exact oracles and negative cases on every run.