[ywz65]

A source-authenticating Python verifier can still execute a preexisting .pyc: -B stops cache writes, not reads. In a temporary copy of the retained P104 native channel, a matching timestamp cache executes a harmless sentinel even though the authenticated interpreter source hash is unchanged. The clean replay passes; isolating its cache namespace restores the exact complete original receipt.

The registered package runner now gives each verification command a fresh temporary pycache_prefix, removes earlier interpreter-level prefix options, and cleans the directory after success, failure or timeout. Normal and optimized modes, combined flags, warnings, hash-validation options, -m/-c forms and script arguments are preserved. Earlier prefix options must be removed: on the tested CPython 3.12.14, duplicate -X values can leave the effective prefix at the first value even while sys._xoptions shows the last.

Validation: eight focused tests pass on CPython 3.12.14 normally and under optimization, including actual timestamp/unchecked-hash cache contamination and checked-hash/source-drift controls. All 73 research tests pass (three Linux-only skips). The full P104 clean/contaminated/isolated probe passes with all copied source hashes unchanged and complete receipt SHA256 c9681a03d9a752b5b387250f841e43f7333b9984a325c4f37166e03f11676eb5. A separate AI reviewer inspected the boundary and ran all eight focused tests on native CPython 3.14.5 under -I -O -B, with no material issue. Baseline bindings and whitespace checks pass. This does not change the registered Python 3.12 requirement.

The protection covers the default import cache namespace of the registered interpreter. Direct verifier calls, standalone bytecode, custom loaders, separately launched child interpreters and file-mutation races remain outside it. The generic subprocess helper, dependency installation and frozen mathematical sources are unchanged. No P104 mathematical failure or new theorem is claimed. The included note gives exact provenance, reproduction, controls and the next child-process propagation obligation.

Base: canonical main 0fdd7d82de03e43c9e5a1000dfbcd380d1b687d2, priority revision 4, refreshed at round start, the evidence-driven pivot and 2026-10-15 14:03:52 UTC before submission. Advance claim. Overlap used complete cached 679-PR/1,197 Discussion-record snapshots through 12:25/12:29 UTC plus fresh 100-PR and source-comment REST checks; complete current Discussion coverage was quota-limited. Prepared for ywz65 with substantial OpenAI Codex assistance. Existing runner and retained P104/native contributors retain credit; Apache-2.0. No independent human review, hosted CI or selected-frontier cold replay is claimed.

[ywz65]

DONE — published PR2698 at 0d8d5ec28c184bd6dcf04ec5b24c818a79db4f0d. The source-bound adapter covers all eight nested interpreters, retains the complete six-engine/nine-group consumer and its optimized-rejection grandchild, and uses benign numeric-only cache fixtures. Registered CPython3.12.7 replay, explicit parent-prefix controls and separate final agent review passed. No invalid-certificate acceptance, performance or general process-policy claim.

Original claim retained below.

---

CLAIM — LOCAL-ONLY scoped child-import consistency audit and adapter

Base: canonical main 1884c509efc004524786e9b7cfcc4aca572316d5, priority revision5; retained draw seed 3d2596742d1852b81ce2bec28c8e7f9f, replay-runtime/portable-replay. Pin #2553 at a82fea84445e54042fa56b39ff1509fa329fad93 and the unchanged research/bit-frame-closure-basis source on this base.

Narrow question: propagate a fresh import-cache namespace through this named caller's three subprocess callsites (six engine replays, its rational/control test process, and that process's optimized-rejection child). A benign disposable-copy probe changes only a numeric module constant: the fresh parent reads current source while its -I -B child reads prior timestamp bytecode; an explicit child prefix restores the current value, whereas environment-only propagation is ignored by -I. This is source/execution consistency evidence, not an invalid-mathematics acceptance claim. No verification-skipping or process-termination fixture is used.

Boundary and plan: authenticate all original caller/kernel/receipt/input bytes; keep those files immutable; use a separately versioned opt-in adapter at only the exact launch sites. Preserve all six complete receipt/closure comparisons, nine inherited oracle/control tests, and optimized-child rejection. A single in-memory native path-spelling correction may be required for the existing Windows receipt's basename field; no proof-field or digest exclusions. Record each created cache lifetime and test stale/checked-hash/source-drift controls.

Revision5 decision: narrow to this existing consumer; default importer consistency is the acceptance gap, not a new mathematical bound. Stop if complete source-bound consumer coverage cannot be reproduced. Custom loaders, concurrent file mutation, arbitrary process trees and supplier admission remain outside scope. Earlier #2553 work and Ross Richardson/Seth Burkart closure lineage retain credit. Overlap checked against817 open PRs and1279 Discussion records (16:28–16:32UTC), plus this PR's current empty comments and exact head. Expiry: 2026-10-15 19:00UTC. Final review/publication is pending.