# CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V023

- plan_id: `CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V023`
- role_instance_id: `dev.developer.ana.cai`
- created_at: `2026-07-26T20:08:00+08:00`
- predecessor: `CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V022` / `21283/3d025596e9c01dad2bc4158e12c1768453fce7890772a1ca8cd7be4b1266fe51`
- predecessor_review: `AUDIT-DEV-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-PYTHON-STAGE-P-REPAIR-PLAN-V022=HOLD/4/4` / `226303/3f6da21701b882516f091bdfd7ffc517ff8ea58811010e9f4a489381dbcbf91d` / line `1789`
- status: `PENDING_INDEPENDENT_PYTHON_ARCHITECTURE_REPAIR_PLAN_REREVIEW`
- implementation_authorization: `NOT_ISSUED`
- database_execution_authorization: `NOT_ISSUED`

V023 选择 reviewer 要求的第一条路径：**对外完全继承 V020 schema，不申请专业设计 amendment**。V022 新增的 Python wire schema 全部 supersede；Python 只作为内部实现，不能改变 V020 消费者看到的字段、schema identity、case totals、state、stop 或 exit。

## 1. 精确兼容边界（关闭 BLOCK-V021-01）

### 1.1 允许变化与禁止变化

允许变化仅有：

1. implementation runtime：Windows PowerShell 5.1 → CPython 3.12；
2. source/test physical paths：旧 P01-P04 → 新 Y01-Y04；
3. manifest artifact_id/path/media/source-schema metadata：P01-P08 → Y01-Y08 的当前链值；
4. 每条新授权本来就动态变化的 run_id/authorization_id/attempt_id/timestamps/bytes/hash。

禁止变化：

- 四 API 的 schema_id、field names/order/rules/status/stop；
- Y03/P03 的 schema、case IDs、group totals、native state IDs；
- Y05/P05、Y06/P06、Y07/P07、Y08/P08 的 wire schema 和列；
- native final 的 schema、10 个 top-level keys、C00-C40、closure/status/stop/exit、八行 tuple；
- root never readonly、zero database、native-only delivery、no-retry 与 BATCH-001 HELD。

任何未列入允许变化的差异为 `STOP_COMPATIBILITY_DRIFT/27`。因此无需修改 case-analysis V007。

### 1.2 exact external schemas

| new target | inherited logical contract | schema id |
|---|---|---|
| Y03 | P03 | `ANA-SEMI-PRECONSUMPTION-VECTORS-JCS-V005` |
| Y05 | P05 | `ANA-SEMI-PRECONSUMPTION-STATIC-RESULT-JCS-V002` |
| Y06 | P06 | `ANA-SEMI-PRECONSUMPTION-CONTRACT-RESULT-JCS-V006` |
| Y07 | P07 | `ANA-SEMI-PRECONSUMPTION-RECEIPT-MD-V005` |
| Y08 | P08 | `ANA-SEMI-PRECONSUMPTION-MANIFEST-CSV-V002` |
| native final | V020 | `ANA.SEMI.PRECONSUMPTION.NATIVE.FINAL.V004` |

Y05 ordered keys 保持：`check_results,schema_id,status,summary`；summary=`fail_count,pass_count,total_count`。

Y06 ordered keys 保持：`api_negative_results,api_results,preflight_results,process_selector_results,provider_precedence_results,schema_id,status,summary,time_results`；summary 保持 `api_fail_count,api_negative_fail_count,api_negative_pass_count,api_negative_total_count,case_fail_count,case_pass_count,case_total_count,precedence_fail_count,precedence_pass_count,precedence_total_count,status`。

native final ordered keys 保持：`artifact_rows,closure_state,final_exit_code,final_status,final_stop_code,manifest_external_bytes,manifest_external_sha256,prepackage_variant,schema_id,state_id`。V022 的 Python-specific native keys 全部无效。

### 1.3 exact Y03

Y03 唯一 preimage 是 immutable old P03 `4038/6b404e64d902ced1398664b2df50cb2f021512c6587b6bd5e513790db03377e1` 的字节级 transform：只把唯一一次

`RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-PRECONSUMPTION-REPAIR-IMPLEMENTATION-20260726-001`

替换为

`RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-PYTHON-STAGE-P-20260726-001`

其余每个 byte 不变。结果固定为 `4016/86f563b43d934cb0828e395f557ded328ad2abcfb2c1ef7bdbc8a4c32c12cbca`，final byte=`0x7D`，old/new occurrence=`0/1`。

因此 case/group 完全固定：success API=`4`，api negative IDs=`8`，preflight IDs=`8`，selector IDs=`15`，provider precedence IDs=`4`，time IDs=`7`，functional=`30`，timeout-known prefix=`18`，native state IDs=`C00-C40` 共 `41`。不得新增 V022 的 9 个 Python regression rows 到 Y03；Python regression 只属于 Y02 static check_results，不改变 Y03 consumer contract。

## 2. corrected bootstrap 与调用边界（关闭 BLOCK-V021-02）

### 2.1 V023 bootstrap 的唯一构造

V023 bootstrap 由 V022 marker 内 exact bootstrap `5236/db8c6ac8160e7d438d8b7690b476b64c141130f1cea0513ecbf2976ec4b8e6a6` 依序执行以下四个 ordinal source transforms，除此之外无差异：

1. `ANA-SEMI-PYTHON-SOURCE-BUNDLE-JCS-V002` → `ANA-SEMI-PYTHON-SOURCE-BUNDLE-JCS-V003`（一次）。
2. 在 `BUNDLE_CANONICAL_DRIFT` gate 后插入以下 exact LF block：

```python
EXPECTED_RUN="RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-PYTHON-STAGE-P-20260726-001"
EXPECTED_PLAN="CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V023"
EXPECTED_OUTPUT="dev/ana-dev/tmp/RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-PYTHON-STAGE-P-20260726-001"
TOP_KEYS=["authorization_id","attempt_id","output_relative_path","plan_id","run_id","schema_id","targets"]
ITEM_KEYS=["artifact_id","bytes","content_base64","media_type","relative_path","sha256"]
if list(bundle.keys())!=TOP_KEYS: die(11,"BUNDLE_TOP_KEY_DRIFT")
if bundle.get("run_id")!=EXPECTED_RUN or bundle.get("plan_id")!=EXPECTED_PLAN or bundle.get("output_relative_path")!=EXPECTED_OUTPUT: die(11,"BUNDLE_IDENTITY_DRIFT")
if not isinstance(bundle.get("authorization_id"),str) or not bundle["authorization_id"].startswith("AUTH-"): die(11,"BUNDLE_AUTH_ID_INVALID")
if not isinstance(bundle.get("attempt_id"),str) or not bundle["attempt_id"].endswith("-A001"): die(11,"BUNDLE_ATTEMPT_ID_INVALID")
```

3. 每个 target row 在读取 artifact_id 前插入 `if list(x.keys())!=ITEM_KEYS: die(11,"BUNDLE_ITEM_KEY_DRIFT")`。
4. 用以下 exact block 替换旧的单行 `rc=main(...)`：

```python
out_rel=pathlib.Path(bundle["output_relative_path"])
if out_rel.is_absolute() or ".." in out_rel.parts or out_rel!=pathlib.Path(EXPECTED_OUTPUT): die(11,"OUTPUT_PATH_DRIFT")
out_path=(ROOT/out_rel).resolve()
if ROOT not in out_path.parents: die(11,"OUTPUT_PATH_ESCAPE")
rc=main(str(ROOT),bundle["run_id"],str(out_path))
```

上述 deterministic transform 的固定向量：

- bootstrap=`6461/996a79a55972fde5258f012daada29b73bf00432e56a2cdf1a130a5cff629f96`
- RFC4648 base64=`8616/6d4d7aa133fbf0b126f3c110ad4cf51cb9aa340a7859354205d046e486dd7c9c`
- wrapper token=`8695/d7feabf575864965c28db21b63cac3c45cd17394947bbb7820eeb39f22aabb89`
- argv token preimage=`5/8792/c3eb35042a562d4664d638f4ce303b9bdc4ff7d8d90d766e1cee1d574d293a09`
- Arguments=`8706/09f7a191610cdf7995563642115d6a8bb4a0bb645cbe3dbbf20b5bfb2655bb7c`
- Win32 CommandLine=`8796/04e9b102c51f31cff1d2fbbc2607715960e8412e60b3ea261d0bf3d0ba2ae028`

### 2.2 bundle、paths 与 loader

bundle top-level 和 item keys 已由 bootstrap 固定；authorization_id/attempt_id 是管理新链动态值，但必须分别匹配 `^AUTH-[A-Z0-9-]+$` 与 `^[A-Z0-9-]+-A001$`，并由 parent terminal 与实际授权逐字相等。管理只能提供值，不能改变 schema/校验。

Y01-Y04 absolute path 由 ROOT + hardcoded ALLOW 构造；output path 由 fixed EXPECTED_OUTPUT 构造。Y04 只能以 `main(project_root,run_id,output_root)->int` 调用一次。Y04 内只允许 exact `spec_from_file_location` 各加载 Y01/Y02 一次，module keys 固定；Y03 只读 bytes/JSON。任何 module pre-existence、loader/path/hash/type/call count 漂移为 27。

Y04 负责用 V022 已冻结的 Win32 exclusive writer 创建 run root、`test/receipt/manifest` 子目录与 Y05-Y08。目录 API 固定 `CreateDirectoryW`；run root pre-exists、unexpected ERROR_ALREADY_EXISTS 或 reparse point 为 STOP。

bootstrap/Y04 不发送 native handoff。parent source 只在 child terminal 后读取 process result 与 actual Y01-Y08 evidence，按 V020 C00-C40 构造一个 Codex exact-thread native terminal；不得写第九个文件或调用 legacy route。process exit 0/11/21..27 与 native final_exit_code 必须按 V020 overlay 相等；timeout/unobserved child exit 使用 V020 parent-result 规则，不伪造 child exit。

## 3. actual command-line provider（关闭 BLOCK-V021-03）

provider 仍以 `CreateToolhelp32Snapshot/Process32FirstW/Process32NextW` 冻结 PID、parent PID、exe name，再对每个 relevant non-source PID 执行：

1. `OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION|PROCESS_VM_READ,false,pid)`；
2. `QueryFullProcessImageNameW` 获取 exact image path；
3. `NtQueryInformationProcess(ProcessCommandLineInformation=60)` 两步：首次 null buffer 获得 required length，按长度分配，第二次读取 `UNICODE_STRING` 与 UTF-16 command_line；
4. `CommandLineToArgvW` 解析 token vector，`LocalFree`；
5. `CloseHandle`。

snapshot row ordered keys 固定为：

`command_line,command_line_base64,command_line_sha256,command_line_status,exe_name,exe_path,exe_path_status,parent_pid,pid,token_count,token_preimage_sha256`

types/rules：command_line/string-or-null；base64/SHA/lowercase64-or-null；status=`KNOWN|ACCESS_DENIED|EXITED_DURING_QUERY|ERROR|MALFORMED`；pid/parent uint32；token_count int32-or-null。token preimage 是 parsed argv tokens 单 LF 连接、无尾 LF。

selector 必须逐字比较 V023 expected executable path、expected command_line SHA/Base64、5-token argv count/hash；substring/name-only/path-only 不得 exact。任一 relevant candidate command_line 非 KNOWN、两步 length drift、odd UTF-16 length、NUL/trailing garbage、CommandLineToArgvW 失败、close failure 均 unknown/27，不能 confirmed_zero。

provider 调用恰好一次；snapshot JCS、bytes/hash 与 as_of/freshness≤1000ms 写入 parent process result 的 reviewed snapshot evidence，不新增 Y06 wire fields。Y06 的 15 个 `process_selector_results` 行按 V020 schema 保存每个 case 的 actual/expected/match evidence。

## 4. exact Y05-Y08 与 native closure（关闭 BLOCK-V021-04）

### 4.1 Y05/Y06 rows

Y05 exact 12 static checks：

`PY-AST-Y01,PY-AST-Y02,PY-AST-Y04,PY-BYTES-EQUALITY,PY-OLD-GENERIC-SYNTAX-ABSENT,PY-Y03-JCS,PY-DENIED-IMPORTS,PY-DENIED-CALLS,PY-LOADER-GRAPH,PY-BUNDLE-IDENTITY,PY-WIN32-WRITER,PY-NATIVE-ONLY`

每个 check row ordered keys=`case_id,actual,expected,status,stop_code`；status=`MATCH|MISMATCH`。Y05 summary total=12；PASS=`12/0/TEST_PASS`。

Y06 继续使用 V020 exact groups/rows：api_results=4；api_negative_results=8；preflight_results=8；process_selector_results=15；provider_precedence_results=4；time_results=7。每个 ordinary case row ordered keys=`case_id,status,stop_code`；API_RESULT/API_NEGATIVE_RESULT 的完整 actual object/type/property evidence、property rules 和 hashes 逐项继承 V019/V020，不删除。Python runtime type 只映射到 V020 rule enum，不进入新字段。

### 4.2 Y07 exact literals

字段名保持 `P05_status/P06_status` 与 `as_of_artifact_id=P06`，这些是 V020 logical-stage names，不改为 Y。完整 UTF-8 preimage 均恰好一个 final LF：

- PASS=`449/51f12385835588e257859e36073da90290cb2a5465426b73174568c86960490c`
- STATIC=`480/9ee2ce5e1fb04b6e43572d1f634343654b6a54abed8063ab0dd20dcf0d783a80`
- CONTRACT=`470/1caa6eee696e12af70af766fec88a34b001490e883b2b2397f2f2b4ff1621724`

PASS preimage：

```text
receipt_schema_id: ANA-SEMI-PRECONSUMPTION-RECEIPT-MD-V005
run_id: RUN-DEV-ANA-SEMI-ROOT-PREFLIGHT-PYTHON-STAGE-P-20260726-001
plan_id: CODE-DESIGN-ANA-SEMI-ROOT-PREFLIGHT-ORCHESTRATION-V007-V023
as_of_artifact_id: P06
prepackage_status: PASS
prepackage_stop_code: null
P05_status: TEST_PASS
P06_status: TEST_PASS
outer_process_count: 1
prohibited_process_count: 0
network_access: false
credential_access: false
database_connection_performed: false
```

STATIC/CONTRACT 只按 V020 既有三字段差异替换：STATIC=`TEST_FAIL/STATIC_TEST_FAILED/P05 TEST_FAIL/P06 NOT_RUN_UPSTREAM_STOP`；CONTRACT=`TEST_FAIL/CONTRACT_TEST_FAILED/P05 TEST_PASS/P06 TEST_FAIL`。除此之外 byte 差异为 STOP。

### 4.3 Y08 exact columns/rows

继续 V020 13 columns：

`artifact_id,run_id,role,schema_id,relative_path,media_type,expected_presence,materialized,exists,status,upstream_stop_code,bytes,sha256`

Y01-Y04 只允许 source metadata 变化：

| id | role | schema | media | expected_presence |
|---|---|---|---|---|
| Y01 | SOURCE | ANA-SEMI-PRECONSUMPTION-MODULE-PY-V001 | text/x-python; charset=utf-8 | REQUIRED_BEFORE_OUTER |
| Y02 | TEST_SOURCE | ANA-SEMI-PRECONSUMPTION-STATIC-TEST-PY-V001 | text/x-python; charset=utf-8 | REQUIRED_BEFORE_OUTER |
| Y03 | TEST_VECTOR | ANA-SEMI-PRECONSUMPTION-VECTORS-JCS-V005 | application/jcs+json | REQUIRED_BEFORE_OUTER |
| Y04 | VALIDATION_SOURCE | ANA-SEMI-PRECONSUMPTION-VALIDATION-PY-V001 | text/x-python; charset=utf-8 | REQUIRED_BEFORE_OUTER |
| Y05 | TEST_RESULT | ANA-SEMI-PRECONSUMPTION-STATIC-RESULT-JCS-V002 | application/jcs+json | REQUIRED_ON_STATIC_STAGE |
| Y06 | TEST_RESULT | ANA-SEMI-PRECONSUMPTION-CONTRACT-RESULT-JCS-V006 | application/jcs+json | REQUIRED_ON_CONTRACT_STAGE |
| Y07 | RECEIPT | ANA-SEMI-PRECONSUMPTION-RECEIPT-MD-V005 | text/markdown; charset=utf-8 | REQUIRED_ON_CLOSURE_STAGE |
| Y08 | MANIFEST | ANA-SEMI-PRECONSUMPTION-MANIFEST-CSV-V002 | text/csv; charset=utf-8 | SELF |

CSV 必须 RFC4180 CRLF+final CRLF。Y08 self row materialized/exists true 时 bytes/hash blank；external bytes/hash 只在 native final/audit。

### 4.4 C00-C40 total mapping

以下 immutable predecessor tables 组成唯一权威，无重叠：

- V018 `23056/1a9b8debc04ca1f29240d55af947e147857ffc28aa9295d95e401cbeeb671744` lines 181-227：C00-C19 top-level 与八行 tuple；
- V019 `16404/b49de51253d4c740e3c0e664ebf3135dfcd75693dc1adb50cf5ff82c3073359d` lines 155-203：native V003、C20-C39 source-I/timeout-known overlays；
- V020 `11173/235aaa1ef3ead63f0b729239de95e89ab54cffe0f2b80a4a7eac2e563120fc93` lines 60-82：native V004、C40 与 timeout-known 18。

V023 transform 只做 `P01..P08 -> Y01..Y08`、run/auth/attempt/timestamp/actual bytes/hash 的当前值替换；schema/status/stop/exit/closure/tuple/null/upstream 绝不变化。C03-C06 每个 source writer 同时接受 A 或 I 分支；C09/C24-C40 恰好 18 个 timeout-known prefix；C10 是唯一 U；C18 external hash 等于 actual invalid Y08；C00 是唯一 PASS/0。

## 5. 零执行与门禁

Y01-Y08 与 future run 继续 absent；旧 P01-P04 hashes 不变，旧 P05-P08 absent。V023 只允许独立计划复审。PASS 后也只允许向 management 申请新的 single-use Python implementation authorization。禁止当前物化/执行 Python/PowerShell/csc/node/mysql/SQL/database/network/credential、R3、formal target、BATCH-001、旧包/Git/配置/角色修改。