Cassette Build Report 053 — The Green Fixture Knew Too Little

Scope note: This report covers the S24 review, proof repair, and measured closeout. It is about whether Cassette’s export and revision-delta refusals are proved; it does not claim that Cassette has entered its real-world hardware phase.

An export test can be green for a simple reason. Every package it receives is acceptable. That is useful evidence. It is not the whole question when the contract says a system must refuse a package that loses part of the model’s graph, precision, tokenizer, operator set, or ordered history.

Cassette is a drive-resident model system. S24 was its interoperability step. It asked whether an eligible model revision could be exported, carried elsewhere, and reconstructed without changing the records that make the revision what it is. The first fixture showed that SafeTensors, GGUF, adapter, and merged exports could succeed. It showed that adapters swept through the declared protocol table. It was real work. It had not yet made the refusal side of that promise necessary.

Opus 5 Max found the gap by removing guards before writing the review. Five refusal checks in store.py implemented the rejection half of Cassette’s Q26 export contract, yet all five could disappear while the fixture remained green. The same thing happened to three named conditions in Q54, the revision-delta contract. The fixture could detect a wrong root or corrupted bytes, but it never built a delta with a wrong base identity under a newly computed digest, a stale declared delta digest, or a target identity that the replacement pages could not reconstruct.

That review mattered because it did not confuse a green export with a proved refusal. It also kept its own claims under pressure. Opus initially called a current-revision removal guard dead, then installed a probe and found that four tests did reach it. The guard overlapped with another valid boundary; it was redundant in that case, not absent. Before reporting, Opus discarded four other suspicions. A dynamic adapter loop only looked like a two-adapter list, and a teacher-corpus self-digest looked like a mismatch. A re-sealed tampered corpus was in fact refused, while a reachability-loop mutation was too weak to establish anything on a small acyclic graph.

That distinction is the human part of a technical review. A reviewer does not earn trust by producing the longest defect list. A reviewer earns it by showing which apparent defects died when the code was read and which remained after the mechanism was attacked.

I asked GPT-5.6 Sol Ultra to remediate what was required. I did not ask for an interesting exchange of opinions, and I did not ask whether S26 might someday supply evidence for S24. Sol read the dependency in the queue correctly. S25 depended on S24, and S24 already named Q26 and Q54. A later integration step could not supply evidence retroactively for an earlier completed step. Sol preserved S24’s original closeout as historical evidence, returned the live row to IN_PROGRESS, and added AGENTS.md to the step’s recorded scope because S24 had changed it.

Sol did not accept every review observation. The two current-root removal checks both ran and both protected valid parts of Q6, even though a mutation could not isolate one as the sole cause of a refusal. Keeping them was not a failure to simplify. The important distinction was narrower. A finding warranted a repair only when Cassette’s stated authority and a discriminating observation described the same missing proof.

For the accepted Q54 findings, Sol built the exact hostile records that the old fixture had omitted, required the typed code and detail from each refusal, and compared a complete cartridge snapshot before and after every attempt. Then Sol removed the matching production guard one at a time. Each mutation made the fixture fail. The test no longer treated a neighboring rejection as evidence for the predicate that had not been reached.

Q26 required a different kind of hostile record. Editing an exported manifest in place would only prove that Cassette notices a broken outer checksum. The test needed a package that remained internally coherent long enough to reach the semantic refusal under test. The S24 fixture therefore contains its own resealing helper.

def _reseal_export_manifest(manifest: dict, *, bind_source_history: bool = True) -> str:
    """Recompute an attacked portable package without borrowing store.py's manifest builder."""

    semantic = manifest["semantic_manifest"]
    source = manifest["source_revision"]["identity_material"]
    if bind_source_history and manifest["source_revision"]["revision_kind"] == "tuned":
        source["transform_manifest_digest"] = digest_bytes(
            canonical_bytes(semantic["ordered_deltas"])
        )
    source_identity = digest_bytes(canonical_bytes(source))
    semantic["source_identity"] = source_identity

This S24 test helper at commit 53d7e8b establishes that the test can recompute attacked package identity without calling the private store.py manifest builder whose decisions it is testing. It does not, by itself, prove every export rule or prove behavior on a physical drive. That evidence came from the independently authored attacks, the matching guard removals, and the pinned arm64 macOS test gate.

The new packages detached an adapter plan from its selected delta, broke a tuned revision’s binding to its ordered history, made export mode disagree with that history, duplicated a selected delta, and changed adapter bytes before resealing the package. Sol also added two target-specific controls. A valid U8 SafeTensors revision could still export as SafeTensors while GGUF had to refuse its unsupported precision; a revision carrying a foreign operator faced the same target-specific GGUF refusal. The source was valid in both cases. The declared target was the incompatible object.

Together, the five portable-export checks, the three revision-delta checks, and the two target checks made ten separate predicates load-bearing. No product code changed. compiler.py and store.py remained byte-identical after each temporary mutation. The proof changed because the fixture stopped asking only whether Cassette could perform a successful export and began asking whether it could refuse a coherent package for the exact reason the contract assigned.

The final gate ran 172 repository tests on the pinned arm64 macOS environment in 136.76 seconds, with no ledger violations. Commit 53d7e8b contains the proof repair; aed438e records the measured closeout and returns S24 to DONE. Those results establish the checked S24 fixture and repository state at those commits. They do not establish a live model download, a physical-drive campaign, or a general guarantee about every future export format.

I care about this episode because it keeps the burden where it belongs. Opus found a serious gap and also showed its own rejected hypotheses. Sol reproduced the mechanism, declined the non-defect, and carried the accepted repair through the queue and the evidence without handing me a menu of unresolved choices. Cassette left S24 with the same export code, but with a fixture that would no longer stay quiet when one of its named refusals disappeared.