# Automated authoring and QC evidence

This record describes the frozen technical candidate. It does not replace the
contributor's personal workflow run, rights review, reference inspection, or
signoff in `SUBMISSION.md`. ALE's team determines acceptance and the official
difficulty label.

## Status and freeze bindings

- Submission target: Last-exam candidate, pending ALE classification.
- Frozen generated root: `generated_full_4`.
- PostgreSQL: 17.11, Linux x86_64, 8-KiB blocks, 16-MiB WAL segments,
  data checksums enabled.
- Target runtime: 4 vCPU, 16 GiB, 10,800 seconds, offline.
- Builder SHA-256:
  `ded97428ff81f35f696d1f51b86c7f9a6a074f8b5c35fe1789f1eea9a48a12fe`.
- Scorer SHA-256:
  `2d713076657b69898804537e4ee169e829ef225df8c470189ac3226b300a8072`.
- Task-card SHA-256:
  `050649eccc15fbda64c9363df52ef458985435b287df5ec127ad85ce0f50e3dc`.
- Input-manifest SHA-256:
  `510c92e7c0485ada35cf0c3d5c4f7f286d0b80fd2b24a6af4f0de762da82b046`.
- Hidden-truth SHA-256:
  `1836389e84d7c1692913c933cef9e68cb81951d75dfb453e609139f2c2c61edb`.
- Encrypted reference SHA-256:
  `7e242b229311f326486086d0112f4f029db3897935138fffb65db37eabc450cb`.
- Ten-file reference-manifest SHA-256:
  `38486bc52a94d9cccbddda4d401e61938d4307b037e0d085a56014f418045c54`.

The earlier single-cluster PITR prototype and its model results are not used as
evidence for this task.

## Authoring evidence

- `[PASS]` The builder pins the official PostgreSQL 17.11 OCI index
  `sha256:051f7b7b3abdd564d5d1bd1e8c4b9c1b6e77087d1dd22020ede611c096a272e0`
  and Linux AMD64 manifest
  `sha256:7bade6d532592ca8ce7ee32def7399dad2607c4ea5583839fc4352a095a11ea6`.
  Runtime checks reported `x86_64` and PostgreSQL 17.11.
- `[PASS]` `pg_verifybackup` reported `backup successfully verified` for
  coordinator, shard A, and shard B.
- `[PASS]` Every cluster has contiguous timeline-1 segments 1 through 18,
  contiguous timeline-2 segments 3 through 10, one real `.history` file, and
  one backup marker. Each published WAL archive contains 26 full segments and
  28 total records.
- `[PASS]` Canonical targets for all three clusters and the obsolete
  coordinator branch were recovered from published inputs. The clean full
  build took 339.775 seconds.
- `[PASS]` Two independent clean gold workflows produced identical semantic
  digests: coordinator
  `46e21c4393384b9557d39e18bd7dc9e74ab80c98432bc5af3a7f67c34aaa8981`,
  shard A
  `5c1974db63e68ac033e5409aad557ad49998e6b69af7734aca7e47f47beda546`,
  and shard B
  `6f6b8e12697814b3547ded87aede018af258eab005aa64d1a6cb52813f417aa9`.
  Physical dump and WAL bytes are not claimed to be identical across runs.
- `[PASS]` Hidden truth, trusted schemas, physical-archive hashes, reference
  hashes, CSV rows, JSON shapes, and all gold invariants passed scorer
  infrastructure preflight.
- `[PASS]` Both physical tar trees use safe relative paths, contain no links,
  special entries, duplicates, or traversal, and normalize directories to
  `0700` and files to `0600`.
- `[PASS]` Two expanded scans covered 4,125 objects and, independently, 4,090
  objects totaling about 1.47 GB. No private key, AWS, GitHub, Slack, JWT,
  email, SSN, credential assignment, PII, PHI, or real financial record was
  found. The second scan's only broad numeric match was a PostgreSQL system
  identifier, reviewed as a false positive.
- `[PASS]` All three gold outputs are PostgreSQL 17.11 custom archives.
  Allowlisted TOC sizes are 45 entries for coordinator and 62 for each shard;
  no executable or external database object is present.
- `[PASS]` `input/SHA256SUMS` exactly covers the other 42 input files and all
  hashes round-trip. Portal bundle assembly independently rechecks input,
  reference, task-card inventory, source bytes, modes, and its own manifest.
- `[PASS]` Targeted tests: 103 passed, 1 opt-in integration test skipped.
  Ruff check and Ruff format check pass.

## Evaluator evidence

The frozen integration matrix contains 28 cases and 35 machine assertions;
all assertions pass. It runs as an ordinary user on Linux AMD64 with no
network, 2 CPUs, 4 GiB, PostgreSQL 17.11, the frozen scorer, and the frozen
reference. Exact components, caps, timings, construction notes, candidate
hashes, and three explicitly unrun physical variants are retained in the
private QC matrix.

Key results:

- `[PASS]` Gold/reference as candidate: `1.0`, all eight components `1.0`, no
  cap.
- `[PASS]` A valid post-target surrogate-ID remap: `1.0`, all components
  `1.0`.
- `[PASS]` Wrong-timeline claim and inclusive emergency boundary: `0.20`,
  `wrong_timeline_or_emergency_damage`.
- `[PASS]` Retained opaque emergency damage: `0.20`; retained V052 damage:
  `0.25`.
- `[PASS]` A committed transfer missing one leg: `0.45`; forcing all transfers
  to commit or all to abort: `0.45`.
- `[PASS]` Required branch import omitted and import-all shortcut: `0.50`.
- `[PASS]` Correct boundary claims with salvage and replay omitted: `0.50`.
- `[PASS]` One shard's required events removed: `0.55`; global broker ordering:
  `0.55`; ignoring schema-v1 normalization: `0.55`.
- `[PASS]` Processor-only acknowledgements omitted: `0.988432794861`, proving
  a measurable database and event-graph penalty without an unrelated cap.
- `[PASS]` Unbalanced posting, duplicate global event, and unsafe sequence:
  `0.60` each with `global_integrity_failure`.
- `[PASS]` Stale or false sidecars score `0.95` and `0.955`; database loss with
  plausible sidecars scores `0.55`.
- `[PASS]` Missing, extra, corrupt, symlinked, oversized, and unsafe-FUNCTION
  outputs score `0.0` as candidate failures.
- `[PASS]` A missing hidden `truth.json` exits 2 as evaluator infrastructure
  failure instead of producing an agent score.

The following expensive variants were not mislabeled as completed integration
runs: a real physical timeline-1 recovery through branch end, a physical
wall-clock-selected recovery, and a fresh physical target-only recovery. Their
observable claims and logical omissions are covered above, while the private
`not_run.json` records the precise limitation.

## ALE lifecycle evidence

- `[PASS]` Encrypted `reference.7z` contains exactly ten flat, header-encrypted
  7zAES members. Correct-password test and byte-exact extraction pass; a wrong
  password fails.
- `[PASS]` In a real `baked_in_sandbox` gold lifecycle, solve-time plaintext
  reference was absent. ALE gathered exactly seven files totaling 6,879,856
  bytes before reference staging. Score was `1.0`, all components were `1.0`,
  total duration was 26.91 seconds, and evaluator duration was 25.5427 seconds.
- `[PASS]` In a real negative lifecycle, ALE gathered seven files before
  reference staging, then scored shard-A event loss at `0.55`. Execution took
  23.43 seconds and evaluation 22.7885 seconds. The task container was deleted.
- `[PASS]` Lifecycle, negative matrix, and blind pilots execute PostgreSQL as
  ordinary user `user`; candidate code and DDL are never executed by the
  evaluator.
- `[NOT RUN]` Provider-hosted 4-vCPU/16-GiB GCE smoke. No GCP project,
  credential, or `gcloud` installation was available. Local functional
  lifecycles and pilots used 4 CPUs and 6 GiB because Docker Desktop had about
  7.65 GiB total. This is disclosed as a resource-shape limitation, not a task
  failure or target-equivalent benchmark.

## Last-exam calibration evidence

All four observed attempts used GPT-5.5, a fresh `fork_turns=none` task turn,
the frozen public tree, no solve-container network, no mounts, 4 CPUs, 6 GiB,
and no reference, scorer, private builder, or seed. Raw model rollouts remain in
the private Codex session store; a metadata manifest binds session IDs, hashes,
model settings, timings, token usage, and tool-isolation counts. Independent
evaluator reports bind every output to the scorer hash above.

| Attempt | Model effort | Model duration | Score | Result |
| --- | --- | ---: | ---: | --- |
| 1 | GPT-5.5 low | 630.728 s | `0.55` | required-event cap |
| 2 | GPT-5.5 low | 546.286 s | `0.0` | three required dumps absent |
| 3 | GPT-5.5 medium | 944.576 s | `0.972191932834` | no cap, imperfect state |
| 4 | GPT-5.5 medium | 767.556 s | `0.507854304311` | required-event cap |

- `[PASS]` Two independent GPT-5.5 low attempts completed.
- `[PASS]` Two independent GPT-5.5 medium attempts completed.
- `[PASS]` Four observed reference-class attempts produced zero perfect scores.
- `[NOT APPLICABLE]` No perfect score triggered shortcut revision. Earlier
  fairness and shortcut audits were completed before this frozen matrix.
- `[NOT RUN]` No Sonnet or Gemini run was launched for this candidate. A prior
  Sonnet 4.6 launch on the earlier single-cluster prototype showed that usable
  Anthropic credit was unavailable; this is only an account-availability
  preflight and is not counted as a result for the regional task. No Gemini
  credential was available.

Exact billed API or subscription cost and the plaintext cross-agent spawn
message were not exposed. Model, effort, CLI version, session duration, token
usage, container isolation, outputs, and scores are retained. Four attempts are
useful contributor-side evidence but do not statistically prove a pass rate
below one percent. Official Last-exam classification remains ALE's decision.

## Portal bundle freeze

- `[PASS]` The final review ZIP is built twice from the same frozen source and
  generated assets; byte equality, ZIP CRC, member inventory, file modes,
  per-member `MANIFEST.sha256`, source equality, and private-file exclusion are
  checked by the assembler and an external freeze audit.
- The ZIP's own SHA-256 is recorded beside the final bundle rather than inside
  it, because embedding a file's own hash would be self-referential.
- The portal review ZIP contains plain hidden reference files for reviewer
  inspection. ALE incorporation uses the separately verified encrypted flat
  `reference.7z`; plaintext reference must never be staged during solve.

## Checks requiring the contributor or external access

- Personally execute and inspect the complete reference workflow, all three
  databases, and all four sidecars.
- Complete the provenance, rights, AI-assistance, dry-run, and signature fields
  in `SUBMISSION.md`.
- Confirm synthetic-data authorship and all employment, confidentiality, and
  licensing duties.
- Optionally run a provider-hosted 4-vCPU/16-GiB smoke and a valid cross-vendor
  reference-class pilot when credentials permit.
- Log in to the portal, run the optional fit check, and upload only the frozen
  ZIP identified by the external freeze record.