Independent SYN-338 rejection verification

Source reviewed: 7c9801e7166afd743c91fc6ecd31f7eb0167b9e9. Production behavior comes from d2724478e5a250a9702abce441da78a5da3b50d2; the RED baseline is 0722253e00e6dea4c1914de092009879b2844d2c. See ADR-071.

The reviewer used an isolated worktree and an APFS clone of the completed build cache. All production mutants were compiled with --no-default-features --features mcp, debug information disabled, incremental compilation disabled and two build jobs. Each binary fixture uses private HOME/XDG directories, an absent profile and disabled enrichment. The author worktree and the immutable Soma integration binary were left untouched.

Executed challenge

Each round freezes its test files. Mutations are real production changes, not mocks. The original round runs all six existing acceptance cases. The strengthened round runs all 15 rejection acceptance cases, including a compiled direct-core probe. Typed unittest results are captured with the test-first skill adapter.

Original outcomes: {'survivor-acceptance-suite': 8, 'assertion-killed': 3, 'invalid-runtime': 2}. Strengthened outcomes: {'assertion-killed': 13}.

The two original digest attempts raised AttributeError when an unexpected success returned error: null. They are invalid runtime attempts, not assertion kills. The existing negative assertions now tolerate a null error object while retaining the same required error codes. The strengthened digest challenges reach typed assertions.

The six-case survivors are scoped to that acceptance suite. Existing Rust tests already cover the direct core lease and terminal states, and the existing MCP smoke covers the agent decision boundary. No repository-wide survivor claim is made.

Independent assertions

• Call actual pending::reject while a native WriterLease remains held, after workspace discovery.
• Deny legacy decisions on accepted, auto-accepted, undone and rejected rows; retain exact rejected retries.
• Preserve an old decision timestamp, every retained row field and audit bytes on exact retry.
• Deny query/review/rejection with another root or workspace GUID.
• Filter actual lexical reads to the selected fact identities.
• Deny local reads and rejection when a valid shared-source policy requires current authority.
• Deny actual stdio MCP rejection with local_operator_rejection_required and no state/audit change.
• Record exactly one matching audit entry for the first live rejection.
• Roll back the SQLite transition when audit append fails.

No defect was reproduced on the intended production implementation during this review. The added tests close acceptance evidence gaps and make wrong behavior fail by assertions.

Reproduction and evidence

CARGO_TARGET_DIR=/tmp/synapse-rejection-adversary-target-20261017 \
CARGO_PROFILE_DEV_DEBUG=0 CARGO_PROFILE_TEST_DEBUG=0 \
CARGO_INCREMENTAL=0 CARGO_BUILD_JOBS=2 \
cargo build --no-default-features --features mcp --bin syn --example guarded_pending_review_probe
SYN_REJECTION_BINARY=/tmp/synapse-rejection-adversary-target-20261017/debug/syn \
SYN_REJECTION_CORE_PROBE=/tmp/synapse-rejection-adversary-target-20261017/debug/examples/guarded_pending_review_probe \
python3 -m unittest discover -s tests -p "test_guarded_pending*.py"

Local review artifacts are retained under /tmp/synapse-rejection-adversary-evidence-20261017: original-results.json, strengthened-results.json, per-mutation production.patch, build.log, typed reports and gate/evidence.json. The manifests record binary/source SHA-256, source revision, build exit and before/after test hashes.

Final frozen SHA-256 values:

• tests/test_guarded_pending_rejection.py: ab2c8805c96cb8c4c678a1532ec019456ae8f8d255fecbc585675679a595dac5.
• tests/test_guarded_pending_independent.py: a63038fdb734f36acd4e9b4562f6539ccbaf16a389fa17d8493eb4115296c507.
• examples/guarded_pending_review_probe.rs: 6bf588fd8cb4f35b70338f43020d664a250dd34ae1dd04a10cfabd031f02d53f.

Intended implementation and review checks

After every mutant was restored, the intended source was rebuilt and the complete 15-case rejection acceptance gate passed: 15 passed, zero failures, errors or skips. The typed capture is final-restored-green/evidence.json under the evidence directory. Formatting, Python syntax and diff whitespace checks passed. The native core probe also passed a focused Clippy check with warnings denied; its log is retained as final-clippy-probe.log. The parent owns the broader repository quality gate.

Toolchain: Rust 1.95.0, Cargo 1.95.0 and Python 3.14.6. Both mutation replay scripts and exact toolchain outputs are retained in the same local evidence directory.

Limits

The Python gate proves the complete reviewed rejection acceptance suite, not the entire Rust repository. The parent collects the native full-suite and quality gates separately. Rust panic output has no supported typed test-first adapter here. Existing ignored Rust worker/performance cases must remain visible in the parent report.

Audit and SQLite remain separate durability domains. Live writer exclusion, committed exact retry and audit-failure rollback do not prove crash-safe exactly-once audit delivery. A crash after append and before SQLite commit may retain an audit with a pending row.