Cassette Build Report 019 — S05 Had to Prove the Stored Bytes

Scope note: This report covers the final S05 repair and its declared storage proof. It explains how imported bytes, logical tensor spans, and physical placement remain distinct; it does not claim that later inference or training operations are complete.

I gave GPT-5.6 Sol Ultra a deliberately unglamorous instruction: “Take what it said about S05 that is correct and fix it and ignore the rest.” I was not asking for another grand design. I wanted the review’s real findings to become working proof.

S05 is where Cassette takes a SafeTensors model file, stores its bytes on the cartridge, and finds a named tensor again after the physical pages have moved. That sounds like file handling until the identity record disagrees with the bytes on disk. Then the question becomes harder: what exactly did we store, and how do we know it is the thing we meant to store?

The importer had accepted a plausible identity tuple and then thrown away the artifact sizes and digests. The root wrote one flat integrity value where the contract required a domain-separated structure over the manifest, page identities, and semantic records. A later read could find bytes. It could not prove their origin.

The repair moved the check to the boundary where it belonged. The importer now hashes each artifact, compares its path, size, and digest with the declared identity, and refuses to publish a root when those facts disagree. The negative case is intentionally plain:

false_material = replace(
    material,
    artifacts=(replace(material.artifacts[0], digest=digest_bytes(b"wrong")), *material.artifacts[1:]),
)
with pytest.raises(CassetteError) as rejected:
    import_safetensors(sources, tmp_path / "rejected-cartridge", false_material)
assert rejected.value.code == "IDENTITY_MISMATCH"

The full fixture is in tests/test_s05_store.py. Only the declared digest changes. The source file does not. Cassette must reject the import before it creates a root.

The second half of the repair kept logical and physical records apart. SafeTensors gives Cassette a tensor’s logical byte span. The page index gives Cassette its current physical location. GPT-5.6 Sol Ultra imported a tensor that crossed a page boundary, repacked the pages in a different order, loaded the new root, and resolved the tensor again. The bytes and logical root stayed the same even though the physical index changed. An independent SafeTensors writer produced another file and the importer recovered that one byte for byte too.

This is where the two agents helped in different ways. Opus 5 Extra identified the missing proof and named later operations that did not belong in S05. GPT-5.6 Sol had to decide what information the store needed to retain so the finding could be checked later. The repair kept the observation and rebuilt the evidence. It did not pretend that a correct review automatically tells you how to implement the fix.

The last issue was almost embarrassingly small: my closeout commit used friendly labels where the repository ledger required the exact fields Failed before and Reused instead of authored. The intent was clear. The machine contract was not satisfied. We corrected the message, reran the suite from a committed checkout, and let the ledger say zero violations.

S05 closed with a useful separation. The importer proves that the supplied files match the identity. The root keeps the material needed to check that claim later. Relocation changes placement, not the logical model. I had asked for the correct findings only. The result was better than a summary because the stored bytes could now answer back.