fix(v1.7.2): close JACKAL checker request contracts + package inventory tuple

[AnubisQuantumCipher]

Discharges the eight Gate-0 semantic-premise blockers documented in
docs/superpowers/plans/2026-08-17-jackal-gate0-checker-contract.md.
Ships a coherent v1.7.2 Apple-Silicon macOS package with the archival
inventory tuple explicitly pinned across code, docs, and gates.

Summary of load-bearing changes

• Blocker A — receipt-context-unsupported added to REASON_CLASSES in
  tools/claim_bundle_verify.py. Before: Refusal("receipt-context-unsupported", …)
  hit the assert cls in REASON_CLASSES, so normal Python silently downgraded to
  verifier-internal while -O accepted the raw class — a two-Python taxonomy
  divergence. tests/claim_receipt_context_unsupported_v172_test.py locks the
  invariant with unit + CLI cases for v1.7.0 int_cert, arbitrary int/range epochs,
  unknown/non-string variants, under both plain Python and -O, plus a cross-context
  substitution control (9/9 PASS).
• Blocker B — tests/fail_closed_sweep.py migrated to coherent v1.7.2 tuple
  (current checker + current inventory + range_proof_identity_v172.json + epoch
  v1.7.2). 21/21 rows refuse cleanly; no formal-* leak.
• Blocker C — tests/seal_audit_receipts_v150.py migrated to genuine archival
  tuple (archival checker 05c3518…de8a, archival inventory 18ff7b1d…ba6,
  archival proof identity, epoch v1.5.0). 5/5 archival probes PASS.
• Blocker D — NON-CLAIMS.txt states archival replay needs both historical
  checker AND historical coverage inventory; PROVENANCE-RECEIPT.txt records the
  archival inventory path/digest; release/claim/SPEC.md §10 enumerates all four
  context tuples' CLI arguments; release/compat/v172_floor.json and the
  code-authoritative formal_receipt.proof_compatibility_policy_document() gain
  inventory_file / inventory_file_sha256 on every archival_v1 entry.
• Blocker E — run_gates_v172.py preflight now require_digests the installed
  v1.7.0 coverage inventory (not only the checker); the fresh extract gate directly
  pins the packaged archival checker AND archival inventory bytes and refuses a
  current/archive inventory collision. New contract assertions in
  tests/release_wiring_v172_contract_test.py and tests/package_contract_v172_test.py.
• Blocker F — final publication check adds ! -L to ! -e on $FINAL_PKG
  and $FINAL_TARBALL so a dangling symlink race cannot smuggle a target through mv.
  Regression tests: test_final_publication_refuses_dangling_symlink +
  test_final_publication_dangling_symlink_regression.
• Blocker G — tests/plugin_context_matrix_v172_test.py runs the plugin CLI
  end-to-end for the closed context matrix — current range receipt accepted,
  current int-cert accepted, archival v1.5.0 receipt accepted via
  jackal_verify_receipt, cross-context epoch swap refused, v1.7.0 int_cert refused
  with stable proof-compatibility, jackal_verify_bundle actually invoked with
  report transcript, plus stable refusal when the JACKAL_V170_RUNTIME env points at
  an empty tree. 9/9 PASS.
• Blocker H — repin_v172.py --write on frozen bytes; rebuilt package. Two
  superseded pre-fix package snapshots preserved under release/dist/.superseded-*
  and release/dist/.prebuild-preserve-*, not deleted.

Evidence — full aggregate driver green

python3.11 release/tools/run_gates_v172.py → GATES: PASS (68 gates) (about 44
minutes wall). Every gate: preflight, lake-build, proof-identity contracts
(range/int-cert/gaussian), current + optimized suites, Lean int-premise contract,
engine self-test (104/104), positive corpus, negative controls, aba-mutations,
mutations-11 (11/11), formal-status-gate, seven rational-variant releases,
rational-receipt output (current + -O), gaussian emitter/checker/mutations/receipt,
receipt-semantic-mutations (42/42), plugin-smoke, output-path-safety, fail-closed-sweep
(21/21), seal-audit (83/83), seal-audit-receipts (5/5), exact-verify (34 + 91),
branch-discontinuity (19/19), evidence-verify (GAUSSIAN_EVIDENCE_PASS), compat-floor,
evidence-determinism, claim-router-output (current + -O), claim-hostile (108/108),
claim-dogfood (18/18), claim-aba (7 layers), int-cert matrix (31/31) / aba /
differential (5/5) / release, package-contract, package-build,
package-fresh-extract-parity, archival-range-replay, archival-int-cert-revocation, and
manifest-v172-final.

python3 release/tools/repin_v172.py --check → REPIN_V172_CHECK_PASS rows=40
before and after the build.

Final v1.7.2 package

Apple-Silicon macOS only, 79 files:

• tarball_sha256 = 6b5f09eb82aa4257dda3e4dca09eed1b6f8b8834b19a4d852e50dd8250f04518
• SHA256SUMS root = 328121533382ed9b9d3e58315bb90e867ea4c24e0520b18c3268f7f8e27b9300
• MANIFEST.sha256 = b8927e72606ca103f1b5eb39b2da2a0a7306047d8365b55001bb15fdb252c149

Non-claims (unchanged)

• Apple-Silicon macOS only; unsigned, not notarized.
• No universal correctness, source-to-native refinement, input-truth,
  operating-system, or authenticated-builder claim.
• Archived v1 range identity replay requires the exact historical checker AND
  historical coverage inventory bytes; reversed intervals refuse.
• Archived v1 composed-integral identity is historical revocation evidence only;
  request-unbound checker is not shipped or admitted; every v1.7.0 int-certificate
  receipt refuses formal replay.

Reproduce

git checkout fix/range-checker-ordering
python3 release/tools/repin_v172.py --check
python3.11 release/tools/run_gates_v172.py

Base: 7a834efbd6fff816a781a7bc3ac4d255f103574d (feat: add fail-closed JACKAL Codex plugin (#8)).

[coderabbitai]

Important

Review available on request

• 🔍 Trigger review

Reviews should be triggered manually for repositories with fewer than 10 stars. Select Trigger review above or comment @coderabbitai review to review the latest changes. For a full review, comment @coderabbitai full review.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 1572688d-3eae-4ac9-8f8c-dd4f50930ae9

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}