Decode and prove bounded Git OFS deltas

.github/workflows/ci.yml

@@ -68,6 +68,10 @@ jobs:
           cmp docs/demo/git-pack-index-v1/verify.txt "$RUNNER_TEMP/pack-verify.txt"
           env -u PYTHONHOME -u PYTHONPATH python -B -m git_dag_lab pack-inspect --compact > "$RUNNER_TEMP/pack-inspect.json"
           cmp evidence/git-pack-index-v1.json "$RUNNER_TEMP/pack-inspect.json"
+          env -u PYTHONHOME -u PYTHONPATH python -B -m git_dag_lab pack-ofs-verify > "$RUNNER_TEMP/pack-ofs-verify.txt"
+          cmp docs/demo/git-pack-ofs-delta-v1/verify.txt "$RUNNER_TEMP/pack-ofs-verify.txt"
+          env -u PYTHONHOME -u PYTHONPATH python -B -m git_dag_lab pack-ofs-inspect --compact > "$RUNNER_TEMP/pack-ofs-inspect.json"
+          cmp evidence/git-pack-ofs-delta-v1.json "$RUNNER_TEMP/pack-ofs-inspect.json"
 
       - name: Check tests, evidence freshness, and shell boundary
         shell: bash
@@ -76,10 +80,12 @@ jobs:
           env -u PYTHONHOME -u PYTHONPATH python -W error -m unittest discover -s tests -v
           env -u PYTHONHOME -u PYTHONPATH python -B tools/generate_evidence.py --check
           env -u PYTHONHOME -u PYTHONPATH python -B tools/generate_pack_evidence.py --check
+          env -u PYTHONHOME -u PYTHONPATH python -B tools/generate_ofs_evidence.py --check
           bash -n tools/capture_report.sh
           bash -n tools/capture_pack_report.sh
+          bash -n tools/capture_ofs_report.sh
           test "$(shellcheck --version | awk '$1 == "version:" {print $2}')" = "0.9.0"
-          shellcheck tools/capture_report.sh tools/capture_pack_report.sh
+          shellcheck tools/capture_report.sh tools/capture_pack_report.sh tools/capture_ofs_report.sh
           test "$(git status --porcelain=v1 --untracked-files=normal --ignore-submodules=none)" = ""
 
   distribution:
@@ -130,6 +136,11 @@ jobs:
             env -u PYTHONHOME -u PYTHONPATH "$runtime/bin/python" -B -m git_dag_lab pack-verify
           ) > "$RUNNER_TEMP/wheel-pack-verify.txt"
           cmp docs/demo/git-pack-index-v1/verify.txt "$RUNNER_TEMP/wheel-pack-verify.txt"
+          (
+            cd "$RUNNER_TEMP"
+            env -u PYTHONHOME -u PYTHONPATH "$runtime/bin/python" -B -m git_dag_lab pack-ofs-verify
+          ) > "$RUNNER_TEMP/wheel-pack-ofs-verify.txt"
+          cmp docs/demo/git-pack-ofs-delta-v1/verify.txt "$RUNNER_TEMP/wheel-pack-ofs-verify.txt"
           test "$(git status --porcelain=v1 --untracked-files=normal --ignore-submodules=none)" = ""
 
       - name: Upload verified distributions

.github/workflows/codeql.yml

@@ -35,12 +35,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
 
       - name: Analyze
-        uses: github/codeql-action/analyze@c4dd10e44af883a891fe31ced449bcb4a6728b9b # v3.37.6
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: /language:${{ matrix.language }}

README.md

@@ -19,6 +19,8 @@ python3 -m git_dag_lab verify
 python3 -m git_dag_lab inspect
 python3 -m git_dag_lab pack-verify
 python3 -m git_dag_lab pack-inspect
+python3 -m git_dag_lab pack-ofs-verify
+python3 -m git_dag_lab pack-ofs-inspect
 python3 -m unittest discover -s tests -v
 ```
 
@@ -59,7 +61,21 @@ The verifier does not trust the pack filename or Git's index. It parses the vari
 
 ![Receipt-derived integrity chain from pack header through index checksum](docs/assets/git-pack-integrity.svg)
 
-This is deliberately a closed subset: pack v2 and index v2, at most 64 objects, 1 MiB files, 256 KiB expanded objects, and non-delta entries only. Delta entries (OFS/REF), other object formats, arbitrary repositories, reachability, and pack optimization are not claimed. SHA-1 and CRC32 model Git storage integrity here; neither is presented as authentication, a signature, or collision-resistant security.
+The checked-in production pack evidence remains a deliberately closed non-delta baseline: pack v2 and index v2, at most 64 objects, 1 MiB files, and 256 KiB expanded objects. The parser accepts bounded OFS_DELTA entries with exact earlier-entry bases, depth 4, 4,096 instructions, three-byte offset/size ceilings, and a 16 MiB aggregate expansion budget. REF_DELTA, thin packs, other object formats, arbitrary repositories, reachability, and caller-selected pack optimization remain explicitly unsupported. SHA-1 and CRC32 model Git storage integrity here; neither is presented as authentication, a signature, or collision-resistant security.
+
+### Delta runtime: real OFS bytes
+
+The separate `pack-ofs-*` path stores two fixed 77,824-byte synthetic blobs, changes exactly one numbered record, and asks real `git pack-objects --delta-base-offset` for a depth-one pack. It fails closed unless Git emits exactly one full blob plus one OFS_DELTA, then independently reconstructs both logical objects and cross-checks their physical offsets and CRC32 rows against index v2. Its normalized argv and exact stdin digest are receipt-bound; byte identity is claimed only for repeated runs with the same recorded Git build.
+
+![Actual pinned-Chromium screenshot of the real OFS_DELTA report, physical entries, checks, command provenance, and CLI receipt](docs/assets/git-pack-ofs-report.png)
+
+<p align="center"><sub>Attested 1440×1500 Chromium capture. Provenance: OFS report receipt `8c2b8b07…540b0`; screenshot SHA-256 `2e3a4e81…a3041`. Git 2.54.0 generated one full blob and one OFS_DELTA from two fixed synthetic blobs; zero REF_DELTA, thin-pack, arbitrary-repository, authentication, network, secret, or host-data claims.</sub></p>
+
+![Actual physical OFS base offset, biased distance bytes, independent reconstruction, logical OIDs, index offsets, and CRC32 rows](docs/assets/git-pack-ofs-reconstruction.svg)
+
+![Source-bound workflow from fixed inputs and exact Git argv through independent replay, index binding, and receipt](docs/assets/git-pack-ofs-workflow.svg)
+
+![Exact real pack-ofs-verify stdout with actual pack and receipt digests](docs/assets/git-pack-ofs-cli.svg)
 
 ## The hard part: verify Git without trusting Git
 
@@ -88,26 +104,28 @@ See [SECURITY.md](SECURITY.md) for the threat model and trusted-input boundary.
 
 ## Evidence pipeline
 
-Every README visual begins with a canonical production CLI document. The DAG and pack generators each run fresh experiments twice, require byte-identical outputs, derive their SVGs and offline HTML, and bind every artifact into a hash manifest. Digest-pinned Chromium captures both reports in read-only containers with `--network none`. Separate attestations bind each exact report, rendered DOM, PNG, browser binary/version, container digest, isolation policy, viewport, and capture-script hash; without the matching attestation, a generator refuses to call its screenshot verified.
+Every README visual begins with a canonical production CLI document. The DAG, non-delta pack, and OFS generators each run fresh experiments twice, require byte-identical outputs under their recorded runtime, derive their SVGs and offline HTML, and bind every artifact into a hash manifest. Digest-pinned Chromium captures all three reports in read-only containers with `--network none`. Separate attestations bind each exact report, rendered DOM, PNG, browser binary/version, container digest, isolation policy, viewport, and capture-script hash; without the matching attestation, a generator refuses to call its screenshot verified.
 
 ![Architecture of the fixed scenario, real Git plumbing, independent verification, and evidence publication pipeline](docs/assets/evidence-pipeline.svg)
 
 ### Reproduce the checked-in evidence
 
 ```bash
-# Verify both JSON/transcript/visual/report/manifest packages and PNG attestations.
+# Verify all JSON/transcript/visual/report/manifest packages and PNG attestations.
 python3 -B tools/generate_evidence.py --check
 python3 -B tools/generate_pack_evidence.py --check
+python3 -B tools/generate_ofs_evidence.py --check
 
-# Rebuild and recapture either offline report with pinned Chromium.
+# Rebuild and recapture any offline report with pinned Chromium.
 tools/capture_report.sh
 tools/capture_pack_report.sh
+tools/capture_ofs_report.sh
 
 # Run all parser, boundary, CLI, evidence, and provenance tests.
 python3 -W error -m unittest discover -s tests -v
 ```
 
-Current verified baseline: **90 tests**, **9/9 graph invariants**, **7/7 pack/index checks**, **57 isolated Git invocations** in the DAG evidence run, two independently replayed evidence packages, and two attested offline browser captures.
+Current verified baseline: **113 tests**, **9/9 graph invariants**, **7/7 baseline pack checks**, **12/12 OFS checks**, **57 isolated Git invocations** in the DAG evidence run, three independently replayed evidence packages, and three attested offline browser captures.
 
 | Artifact | What it proves |
 |---|---|
@@ -126,13 +144,19 @@ Current verified baseline: **90 tests**, **9/9 graph invariants**, **7/7 pack/in
 | [`git-pack-integrity.svg`](docs/assets/git-pack-integrity.svg) | Receipt-derived pack/index checksum and row-binding workflow |
 | [`git-pack-report.png`](docs/assets/git-pack-report.png) | Actual Chromium rendering of the pack/index report at 1440×1500 |
 | [`git-pack-index-v1/manifest.json`](docs/demo/git-pack-index-v1/manifest.json) | Hash/size/source/command/capture inventory for every pack visual and output |
+| [`evidence/git-pack-ofs-delta-v1.json`](evidence/git-pack-ofs-delta-v1.json) | Canonical real OFS_DELTA receipt, fixed mutation, physical representation, reconstructed logical objects, and non-claims |
+| [`git-pack-ofs-cli.svg`](docs/assets/git-pack-ofs-cli.svg) | Exact production `pack-ofs-verify` stdout rendered as an accessible terminal panel |
+| [`git-pack-ofs-reconstruction.svg`](docs/assets/git-pack-ofs-reconstruction.svg) | Actual OFS distance bytes, base edge, independent reconstruction, OIDs, index offsets, and CRC32 |
+| [`git-pack-ofs-workflow.svg`](docs/assets/git-pack-ofs-workflow.svg) | Fixed inputs, normalized Git argv, recorded Git build, parser, index binding, and receipt |
+| [`git-pack-ofs-report.png`](docs/assets/git-pack-ofs-report.png) | Actual Chromium rendering of the OFS_DELTA report at 1440×1500 |
+| [`git-pack-ofs-delta-v1/manifest.json`](docs/demo/git-pack-ofs-delta-v1/manifest.json) | Hash/size/source/Git-build/command/capture inventory for every OFS visual and output |
 
 ## Test coverage by risk
 
 The standard-library suite exercises more than happy-path graph construction:
 
 - independent blob, tree, and commit envelope hashes;
-- pack v2 headers, bounded zlib streams, logical OIDs, trailer checksum, and explicit delta rejection;
+- pack v2 headers, bounded zlib streams, logical OIDs, trailer checksum, bounded OFS_DELTA replay, and explicit REF_DELTA rejection;
 - index v2 fanout, sorted OIDs, CRC32 rows, small/large offsets, pack binding, and checksum mutations;
 - exact object/ref inventories, parent ordering, reachability, and ancestry;
 - Git's special `directory/` tree ordering, truncated binary objects, and malformed headers;

SECURITY.md

@@ -19,9 +19,9 @@ Evidence refreshes reject symlinked targets and multi-link files, stage each gen
 
 ## Pack/index closed subset
 
-The pack experiment passes only three fixed synthetic blob IDs to `git pack-objects`; it does not accept a repository path, revision, ref, or caller-provided object list. Generated `.pack` and `.idx` files must be regular, single-link files no larger than 1 MiB and must remain the same inode and size across the bounded read.
+The baseline pack experiment passes only three fixed synthetic blob IDs to `git pack-objects`. The separate OFS experiment passes two fixed 77,824-byte synthetic blob IDs and fixed single-threaded delta options. Neither accepts a repository path, revision, ref, caller-provided object list, or caller-selected optimizer settings. Generated `.pack` and `.idx` files must be regular, single-link files no larger than 1 MiB and must remain the same inode and size across the bounded read.
 
-The independent parser accepts pack v2 and index v2 only. It rejects OFS/REF deltas, more than 64 objects, objects expanding beyond 256 KiB, invalid or unterminated zlib streams, duplicate logical objects, non-canonical fanout/large-offset tables, and any mismatch among logical object IDs, CRC32 rows, offsets, pack trailer, index pack binding, or index checksum. These checks establish the fixed fixture's storage integrity; they do not establish provenance, authenticity, repository reachability, or safety of arbitrary Git data.
+The independent parser accepts pack v2 and index v2 with logical commit, tree, and blob entries only; tag entries are outside this closed subset. Its bounded OFS_DELTA subset requires an exact earlier pack-entry base, canonical biased offsets and size headers, no more than depth 4 or 4,096 instructions, at most three bytes for bounded offsets and sizes, at most 256 KiB per object or delta program, and at most 16 MiB of aggregate expanded output. It rejects REF_DELTA and thin packs, more than 64 objects, invalid or unterminated zlib streams, duplicate logical objects, non-canonical fanout/large-offset tables, and any mismatch among logical object IDs, CRC32 rows, offsets, pack trailer, index pack binding, or index checksum. The OFS runtime additionally requires exactly one full blob, one depth-one OFS entry, an exact re-encoding of the observed biased distance, and a complete fixed logical inventory. Its report records normalized pack arguments and an exact stdin digest; output bytes are only expected to repeat under the same Git build. These checks establish bounded fixture storage integrity; they do not establish provenance, authenticity, repository reachability, collision resistance, or safety of arbitrary Git data.
 
 ## SHA-1 scope