Daily review: 2026-09-25. Current inspected source: 49d8e51ec4b71104dc03728c84c60cae3e2857d3. Full rendered parity remains unverified with open nondefault parity failures. No release approval or new closure follows from this review. Reviewed worker audit: audit-20260925-090206 at source 912e6a9aac32c668a5242b8d52aa4415ca3a848e, published in commit 4ff7b03247b59cead0b63a7ee3a7b5697f7bf58e. Post-worker commit 49d8e51ec4b71104dc03728c84c60cae3e2857d3 updated sibling source lock assertions in tests/test_parity.py for upstream 240740dd2d30cbd0984b179834ab24abe71c8fb2. Python runtime bundle and engine sources remain at the earlier snapshot with 205 effects versus 210 in published 1.0.180. Current upstream discovery SHA: 240740dd2d30cbd0984b179834ab24abe71c8fb2. Local and remote main match at 49d8e51ec4b71104dc03728c84c60cae3e2857d3. Served kit 0.1.7 identifies 1901b267a8b8ef29efc702cc3976b70f8aae0404.

Worker audit: 2026-09-25. Reviewed source: 912e6a9aac32c668a5242b8d52aa4415ca3a848e. Local and remote main matched before execution. Tests used regular-file snapshots with recorded source hashes. CPU oracle: fcb576f39a2632a6d50e79ca9f6a1bfb0daa7221, with upstream pin 4891b9953f9fd8a61cf9ae0dda2fe747a9be82df. Current upstream and published 1.0.180: 240740dd2d30cbd0984b179834ab24abe71c8fb2. The current manifest contains 210 effects. The Python catalog contains 205 effects. Full parity is failed for tested nondefault cases and unverified for complete coverage. Release readiness remains blocked. Source hashes (audit evidence evidence-audit-20260925-090206/source-hashes.json). Authority metadata (audit evidence evidence-audit-20260925-090206/published-authority.json).

Served kit 0.1.7 identifies 1901b267a8b8ef29efc702cc3976b70f8aae0404. All 329 served files match their inventory hashes. All 324 engine files match the reviewed source. The existing builder reproduces all 329 inventoried files. Later source changes affect only tests and audit documents. Served verification (audit evidence evidence-audit-20260925-090206/served-verification.json). Reproduction (audit evidence evidence-audit-20260925-090206/kit-reproduction.json). Source comparison (audit evidence evidence-audit-20260925-090206/kit-source-diff.json).

The candidate wheel and source archive omit all bundle JSON files. Installation succeeds, but the first render fails with missing bundle/metadata.json. No PyPI project exists at the checked project endpoint. The GitHub API returned no releases. Wheel failure (audit evidence evidence-audit-20260925-090206/wheel-first-output.json). Archive inventory (audit evidence evidence-audit-20260925-090206/sdist-inventory.json). Endpoint observations (audit evidence evidence-audit-20260925-090206/endpoint-results.json).

Audit publication covers only these two reports. Their paths match no existing workflow. No implementation, release, or parity checkpoint changes belong to this audit.

Daily review: 2026-09-25. Current inspected source: 93b8b141d21a7c853a89131166147c8337109144. Full rendered parity remains unverified. No release approval or new closure follows from this review. Current upstream discovery: bbdeb56c4b75cf33379766c3e87b0f5a18bcbba8. Published Noisemaker authority: 1.0.179, source fca611fd8f91424661d4e531d39313d24ea21134, 210 effect IDs. The observations below retain their original source and authority identities. They do not qualify later updates. Current served kit: 0.1.7, source 1901b267a8b8ef29efc702cc3976b70f8aae0404. Retrieved inventory and hashes (audit evidence review-20260925-053200/current-served-inventories.json). Artifact identity does not establish host qualification. The served kit's local artifact paths are macOS-local and are not reproducible from the repository tree; see the evidence-availability note in §6.

Report date: 2026-09-24. Source inspected: 70c03da6944be1319ccc249fd9646dd9df05e86c. Full rendered parity at this SHA: unverified. This is not a release approval. A later documentation-only commit does not change this tested source identity. Any runtime, package, or authority update requires fresh evidence before this report can qualify it.

Python CPU shader rendering with NumPy and Click. Python 3.11 is the declared floor. This is separate from classic Composer. Source contract.

Bundle metadata records CDN version 1.0. Shader hashes exist in the bundle lock. No CPU oracle commit was identified in this pass. Current upstream discovery SHA: c9ee8a049b2b63cd300da67c01ee40baf29dc288. Published authority: 1.0.176, source c9ee8a049b2b63cd300da67c01ee40baf29dc288. Immutable published manifest contains 210 effect IDs. Its SHA-256 is 05c4d7b7744837ae90a3bb4c89e5403ff09448a74d9d7e824abb3d719ad3314e. These IDs do not define complete parameter, state, input, or platform coverage.

Served kit 0.1.6 records d42872842cd6aa14aa585103df35267a46156ec7. Source metadata. Historical measurements remain bound to their original revisions in completion gaps.

Installed evidence (audit evidence evidence-audit-20260925-090206/bounded-developer-workflows.json). Parity evidence (audit evidence evidence-audit-20260925-090206/independent-comparisons.json). Artifact evidence (audit evidence evidence-audit-20260925-090206/served-verification.json).

Current tests and qualification limits are in section 3. The matrix below retains the earlier measured scope. A historical verified row is not a current-source or full-platform certification.

Range audit of the sibling noisemaker-for-cpu b0e6c4130ac2815145695114a475132282b266a9..390071fa078fbc3bb3ba4836a3cbb63320e61df5 against a fresh clone (checkout 390071fa078f, tree 011fe34425768dae75085aca478ab6c5a38cd075; git merge-base --is-ancestor b0e6c4130ac2 b664e7676f7e exits 0 and the parent chain is linear b0e6c41 → 7fbf6a3 → 66fab0a → b664e76 → ea4abf3 → 0c4e4f0 → 390071f, so the force-push-flagged delivery is contiguous over the whole job range). Six commits: three records-only sibling GAP-003 reconciliation commits (7fbf6a3, 66fab0a, b664e76 — sibling-side register/docs wording, no port surface) and three code commits: ea4abf3 ("align iterated pass-repeat semantics with upstream; graduate synth3d/reactionDiffusion3d to byte-exact"), 0c4e4f0 ("graduate ten skip cases to byte-exact on re-captured M4/Metal authority" — sibling-side goldens/provenance/capture records only), and 390071f ("graduate eleven skip cases to byte-exact; fix GLSL kernel vec-aliasing"). The sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 / c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d (no source-lock change in the range), so the audited source-lock set needs no addition.

Port, per the sibling's own GAP-003 design:

• Pass-repeat semantics (ea4abf3 → src/noisemaker_cpu/renderer.py): upstream pipeline.js render() executes each pass exactly resolveRepeatCount(pass) times per frame with no group-level multiplier, so when any pass of the owner definition carries a repeat the iteration loop is inert above 0 (min(requested, 1)) and the pass's repeat uniform is the per-frame multiplier; the documented iterationCount:0 bypass is unchanged and every other iterated effect keeps the established group loop (filter/temporalAberration requires N=60). Applied at both Python iteration sites — the single-effect loop in render_effect and the DSL chain loop in _run_iterated_group — mirroring the sibling's runIteratedGroupSync/runIteratedGroupAsync pair. Against the new oracle, the unfixed port rendered synth/navierStokes (max-diff 6) and synth/reactionDiffusion (max-diff 47) divergent; after the fix both are byte-exact.
• GLSL vec-aliasing codegen (390071f → transpiler/codegen.py): GLSL vecN v = u; copies, but a bare alias plus a later component write destroys the source (mandelbulb's z[0] recurrence in synth3d/fractal3d collapsed to 2 * z^8, rendering NaN volumes). The decl emitter now mirrors the sibling's copyAliasedVectorDeclarations exactly: a declaration whose initializer is a bare identifier (excluding the self-reference vecN v = v;, which reads the outer binding) or a dotted struct-field chain (data.repeatSpacing, hit.dist) and whose declared type is a float vector emits rt.copy(init, "float"); call results and swizzle reads are already fresh values and pass through, and int/uint/bool storage stays a live reference because the JS check is instanceof Float32Array. The committed bundle was regenerated from the pinned CDN 1.0.183 (NM_SHADER_VERSION=1.0.183 python -m transpiler.build --all): 94 declaration copies across 48 kernel files; metadata.json and bundle-lock.json are byte-unchanged (provenance, program inventory and per-program hashes identical).
• scripts/test's whole-catalog gate pin advances from b0e6c4130ac2/31ceb86a to 390071fa078f/011fe344 — the authority the port now byte-matches. The node-free receipt contract is unchanged (no committed artifact format changed).
• Tests: three new tests/test_renderer_iteration.py cases pin the rule (the iteration loop is inert above 0 for repeat-carrying definitions with the zero bypass intact; the iterations uniform is the observable per-frame multiplier; the DSL iterated group path does not multiply the repeat). Red behavior verified by removing the renderer clamp: exactly those three cases fail, then pass again after restore.

Verified against the fresh sibling at 390071fa078f (NOISEMAKER_CPU_DIR set):

• scripts/parity-summary (whole-catalog gate): PARITY-SUMMARY {"expected":210,"executed":210,"exact":210,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding cpuHead 390071fa078f..., cpuTree 011fe3442576..., upstreamPin e24c844f8da..., sourceDigest c2e0c264...; with case-id arguments, scripts/parity-summary synth/reactionDiffusion synth/navierStokes synth3d/reactionDiffusion3d synth3d/fractal3d → 4/4 exact.
• Full pytest suite against the mounted oracle: 351 passed, 1 skipped (node-free), 0 failures. The five reactive/mesh committed oracle references captured at b0e6c4130ac2 still reproduce byte-exactly from the live sibling at 390071fa078f (the aliasing copies are behavior-neutral where no alias is mutated, as the sibling's own graduated-golden gates recorded).
• scripts/test end to end exits 0 with its whole-catalog parity gate at the newly pinned authority 390071fa078f — 210/210 exact.

Oracle-aware keying (fix-forward over the sync candidate, required by the exact-source CI gate): the CI tests.yml oracle tarball remains pinned at the pre-fix b61b658399f1 (no workflow authority to advance it), and the sync candidate published both new behaviors unconditionally — against the exact tarball extraction (b61b658399f18b5a93abd0020c02fff3be9630f5, extracted per the workflow's own load step), pytest failed 11 cases: test_iterated_effect_byte_parity[synth/navierStokes]/[synth/reactionDiffusion] and test_simulation_effect_non_divisible_byte_parity[navierStokes]/[reactionDiffusion] (the pass-repeat clamp against the pre-ea4abf3 multiplying oracle), test_volume_and_loop_dsl_byte_parity[synth3d/flythrough3d]/[synth3d/fractal3d]/[synth3d/reactionDiffusion3d:iter2]/[render/renderLandscape3d] and test_run_dsl_warp_parity[parallax]/[patchwork] (the unconditional aliased-declaration copies against the pre-390071f aliasing oracle — parallax/patchwork surfaced as AttributeError rather than a byte diff), and test_parity_receipt.py::test_python_renders_match_the_recorded_oracle_hashes (the receipt's recorded pre-fix hashes vs copied-kernel renders); 344 passed in the same run. Repair, per the established oracle-version probe pattern (trunc64, js_uvec_numbers): src/noisemaker_cpu/runtime.py gains _oracle_pass_repeat_clamp() (probes the mounted oracle's src/runtime/renderer.js for the ea4abf3 Math.min(requested ?? 1, 1) clamp; defaults True with no mounted oracle) and _oracle_aliased_declaration_copy()/Runtime.copy_decl() (probes scripts/upstream/compile-glsl.js for the 390071f copyAliasedVectorDeclarations pass; defaults True; a pre-fix oracle keeps its published live-alias semantics by binding the initializer object itself); renderer.py applies the pass-repeat clamp through the probe at both iteration sites, the regenerated bundle emits rt.copy_decl(init, "float") at the same 94 aliased-declaration sites (48 kernel files, metadata.json/bundle-lock.json still byte-unchanged), and the three renderer-iteration tests pin the probe so they assert the published post-fix semantics against any mounted oracle. No committed reference bytes change. Verified after the repair: pytest against the exact tarball extraction — 355 passed, 0 failed, 0 skipped; pytest against the fresh sibling at 390071fa078f — 354 passed, 1 skipped (node-free), 0 failures; scripts/parity-summary against the fresh sibling — PARITY-SUMMARY {"expected":210,"executed":210,"exact":210,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0; scripts/test end to end — exit 0 with its gate at the pinned 390071fa078f authority, 210/210 exact.

No gap closed. Raw evidence archived with the job as cpu-sync-b0e6c41-390071f-range.diff (SHA-256 3186531f9c03e2be5b0c6fe0192af2274d89fa3751e23e5066cb6fb0e405070e), cpu-sync-b0e6c41-390071f-range.log, nmpy-pytest-390071f.log, and nmpy-parity-gate-390071f.log in /workspace/evidence; the fix-forward adds nmpy-ci-tarball-failures-candidate.txt (the 11-case pre-repair enumeration), nmpy-ci-tarball-pytest-keyed.txt (355 passed against the tarball), nmpy-pytest-keyed-390071f.log, nmpy-parity-gate-keyed-390071f.log, and nmpy-scripts-test-keyed-390071f.txt.

Environment: Linux x86_64 container, Python 3.11.2, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at 390071fa078fbc3bb3ba4836a3cbb63320e61df5.

Range audit of the sibling noisemaker-for-cpu b93980b512a24ef71ab61a959ed2ce35c1f09666..b0e6c4130ac2815145695114a475132282b266a9 against a fresh clone (checkout b0e6c4130ac2, tree 31ceb86a4c030d12ef60ab9ec664bd1d436df527; git merge-base --is-ancestor b93980b512a2 b0e6c4130ac2 exits 0, so the force-push-flagged delivery is contiguous over the whole job range; the range start b93980b512a2 was audited by the previous sync). Exactly two commits: 796ec92f7ab8 ("GAP-003: import the reactive and mesh effect trees; CPU external-input support") and b0e6c4130ac2 (records-only provenance introducedIn regeneration for the five new goldens against the published introducing commit 796ec92). 796ec92 un-excludes the five formerly excluded upstream effects (synth/roll, synth/scope, synth/spectrum, render/meshLoader, render/meshRender) so the sibling's whole-port parity contract counts all 210 manifest effects: scripts/upstream/inventory.js imports the reactive and mesh trees (no exclusions); upstream-snapshot, glsl-coverage, and canonical-kernels regenerated (308 programs, 298 generated, 10 scatter adapters); src/runtime/external-input.js ports the rendering-relevant upstream MidiState/AudioState (24-PPQ clock counter, packed 128x16 note-grid texture) and the OBJ pipeline (parseOBJ fan triangulation with reversed winding, smooth-vertex-normal fallback, packMeshDataForTextures RGBA packing); src/runtime/external-textures.js flips RGBA rows for GPU data-texture semantics; src/effects/cpu/mesh-render.js is a hand-written CPU rasterizer for drawMode: 'triangles' (render/meshRender: GLSL-f32 vertex transform, depth-tested LESS with CCW back-face culling, Blinn-Phong/rim fragment stage, wireframe discard via analytic screen-space normal derivatives, gamma 1/2.2); the renderer binds reactive uniforms (midiClockCount, audioWaveform, audioSpectrum, zero-initialized like WebGL uniform arrays) and mesh/note-grid data textures via renderOptions.externalInputs, and initializes consumed internal scratch textures (synth/roll's _rollFb) like the upstream pre-created feedback attachment; scripts/parity/reactive-fixtures.js holds the deterministic fixtures its gate feeds via externalInputsForCase; the CLI --effect random pools exclude the five (the CLI binds no MIDI/audio/mesh fixture). The sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 / c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d — the imported kernels come from the same pinned upstream source — so the audited source-lock set needs no addition.

Port, per the sibling's own GAP-003 design: transpiler/cdn.py drops the three reactive id exclusions and adds render/meshLoader/render/meshRender to the render allowlist, and the committed bundle was regenerated from the pinned CDN sources (python -m transpiler.build --all) — the catalog grows 205 → 210 effects (331 locked programs, six new kernel files; render/meshRender:render is the drawMode: 'triangles' pass with no fragment kernel, dispatched to the hand adapter like the scatter draw ops). src/noisemaker_cpu/external_input.py ports MidiState/AudioState/parseOBJ/packMeshDataForTextures (float64 math, float32 stores at the JS Float32Array boundaries); src/noisemaker_cpu/external_textures.py ports the RGBA row-flip data-texture surface; src/noisemaker_cpu/mesh_render.py ports the triangles rasterizer with the JS source's exact fround-per-op emulation (the JS-observable barycentric edge-function divisions stay unrounded float64, as in the oracle); src/noisemaker_cpu/renderer.py gains _bind_external_inputs (reactive uniform defaults, note-grid and global_mesh0_* data-texture bindings, render/meshRender requires external_inputs["meshData"]), threads external_inputs through render_effect/render_dsl, and dispatches drawMode: 'triangles' passes to the mesh adapter (the cleared pre-created _rollFb scratch already matches the oracle's initializeCanonicalResources change on this side). scripts/parity-js-driver.mjs renders the oracle side of an external-input case through CpuRenderer.render with the sibling checkout's own reactive-fixtures.js (the CLI binds no fixture); scripts/parity.py mirrors those fixture constants and routes the five cases through the DSL fixture path on both sides; scripts/parity-summary maps the five to those cases; src/noisemaker_cpu/cli.py random pools exclude the five (EXTERNAL_INPUT_EFFECT_IDS). The node-free receipt contract is unchanged (the five are receipt-excluded like the iterated effects: the pinned 296e0138 tarball oracle predates them and binds no fixture) and the node-free receipt stays pinned at parity-receipt-296e0138.json because the exact-source tests.yml oracle tarball remains pinned at b61b658399f1 (this job holds no workflow authority to advance it). scripts/test's whole-catalog gate pin advances from the pre-import authority d2965d0b7880/69d2ffc4 to b0e6c4130ac2/31ceb86a, since the 210-effect catalog now includes the five external-input cases the old authority cannot serve. Verified against the fresh sibling at b0e6c4130ac2 (NOISEMAKER_CPU_DIR set):

• scripts/parity-summary (whole-catalog gate): PARITY-SUMMARY {"expected":210,"executed":210,"exact":210,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding cpuHead b0e6c4130ac2..., cpuTree 31ceb86a4c03..., upstreamPin e24c844f8da..., sourceDigest c2e0c264...; with case-id arguments, scripts/parity-summary synth/roll synth/scope synth/spectrum render/meshLoader render/meshRender → 5/5 exact.
• The five external-input DSL cases are byte-exact zero-tolerance pytest cases (test_external_input_dsl_byte_parity); red behavior is verified by corrupting each fixture class and the rasterizer gamma (each corruption fails exactly its case, then restored from backup). The exact-source CI oracle tarball (.github/workflows/tests.yml, pinned at b61b658399f1, no workflow authority to advance it) predates the reactive/mesh import — its catalog has none of the five effects and binds no MIDI/audio/mesh fixture — so the five pytest cases compare against committed oracle reference bytes captured at b0e6c4130ac2 (tests/data/reactive-mesh-oracle/, rendered by scripts/parity-js-driver.mjs); whenever a current oracle is mounted, its live render must reproduce those committed bytes (provenance cross-check) and the live render is the oracle side. MIDI parsing mirrors the oracle's JS semantics exactly: two-byte channel messages (0xC0 program change, 0xD0 channel pressure) read the absent velocity byte as undefined instead of raising, and a bare status byte is unhandled (tests/test_external_input.py).
• The oracle's own gate at b0e6c4130ac2 renders each new case byte-exact against its retained authority goldens (node scripts/parity/run.js --suite defaults --only render__meshRender / synth__roll: 1/1 byte-exact, provenance recorded).

No gap closed. Raw evidence archived with the job as cpu-sync-b93980b-b0e6c41-range.diff (SHA-256 8c59acb37336f856fd13bffa9ec068ab745f24947795624bdb5b366b4e04832d), cpu-sync-b93980b-b0e6c41-range.log, and nmpy-scripts-test.txt in /workspace/evidence.

Environment: Linux x86_64 container, Python 3.11.2, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at b0e6c4130ac2815145695114a475132282b266a9.

Range audit of the sibling noisemaker-for-cpu ef26f1c88a4496234d285fa476b8d09d6f05009c..b93980b512a24ef71ab61a959ed2ce35c1f09666 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout b93980b512a2 = published main HEAD, tree e632c2f0bb74e2e22a320716a14349e1522a1c4c; git merge-base --is-ancestor ef26f1c88a44 b93980b512a2 and git merge-base --is-ancestor fd9d56c74ce7500b7eaeea90a93d3bf49375d28e b93980b512a2 both exit 0, so the force-push-flagged delivery is contiguous over the whole job range; the range start ef26f1c88a44 was audited by the previous sync). The job's declared range end d13b0a2100fb is mid-history, not the delivered tip: upstream ancestry is ef26f1c88a44 → a146f22839dc → d13b0a2100fb → d02aaabbee0f → 9e202113c4fa → b93980b512a2, so this sync audits and covers all five commits beyond the audited ef26f1c88a44 rather than assuming the flagged range is exact. Exactly one of the five is an engine-source change: a146f22839dc ("GAP-003: fix GLSL integer-division truncation in transpiled volume kernels") — scripts/upstream/compile-glsl.js +20 lines (new restoreIntegerDivision lowering: GLSL int/int division truncates toward zero, e.g. int z = pixelCoord.y / volSize; in the volume atlas mapping, but the transpiler lost the int typing on the component-indexed dividend and emitted a float64 division; the lowering rewrites ONLY scalar declarations whose initializer is exactly VEC[<decimal>] / IDENT; with IDENT a provably int-typed scalar) and the regenerated src/effects/generated/canonical-kernels.js (exactly six Math.trunc sites). d13b0a2100fb records that a broader expression-level truncation rewrite was generated and REJECTED by measured authority behavior (it broke filter/spookyTicker against its retained Metal golden; the authority's observable int-division semantics are untruncated at non-statement-form sites like cellX/rowIdx), so the retained narrow statement-level form is the oracle's actual behavior — the port must mirror it equally narrowly. d02aaabbee0f (divergence-class inventory record), 9e202113c4fa (14 further skip cases graduated to goldens with recorded M4/Metal capture provenance; the sibling's skip policy moves to a curated ITERATED_SKIP_IDS in scripts/parity/lib.js), and b93980b512a2 (provenance introducedIn regeneration) touch only the sibling's own records, goldens, and parity tooling — its scripts/parity-summary hardening does not affect this port's harness, which invokes the sibling only through bin/noisemaker-cpu.js. The sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 / c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d (the change is transpiler-side), so the audited source-lock set needs no addition. This is the second oracle-output-changing -cpu delta: post-fix -cpu truncates component-indexed int divisions toward zero at the six rewritten sites; pre-fix -cpu emits a fractional float64 division there (volume atlases sampled at z = 63.984 where the authority samples z = 63).

Measured against the delivered endpoint before the port change, scripts/parity-summary at cpuHead b93980b512a2 / cpuTree e632c2f0bb74 returned 9 FAILs — filter3d/flow3d 138, render/render3d 138, render/renderCubemap3d 147, render/renderCubemapSurface 20, render/renderLandscape3d 121, render/renderLit3d 212, synth3d/cellularAutomata3d 138, synth3d/noise3d 138, synth3d/reactionDiffusion3d 138 ({"expected":205,"executed":196,"exact":196,"strict":0,"near":0,"defer":0,"skip":0,"fail":9,"missing":0}) — exactly the volume-atlas cases. Port change, mirroring the narrow lowering faithfully: transpiler/codegen.py gains _restore_integer_division, which marks a scalar declaration's initializer only when it matches the -cpu rewrite shape (VEC[<decimal-literal>] / IDENT; or a single-component member access, IDENT provably int-typed in scope at that point — larger expressions, non-literal indices, multi-component swizzles, and assignment statements do not match and stay fractional); the marked sites emit rt.trunc64(...). src/noisemaker_cpu/runtime.py gains trunc64 (JS Math.trunc over the unrounded float64 result) keyed on a once-per-process probe of the mounted oracle's scripts/upstream/compile-glsl.js for the restoreIntegerDivision marker: the PUBLISHED default (including standalone/deployed renders with no mounted oracle) carries the CURRENT post-a146f22839dc semantics and truncates, while a mounted pre-fix oracle (the CI oracle tarball b61b658399f1 and the pinned gate authority d2965d0b7880) keeps its published fractional behavior for version-mismatched comparisons. The ef26f1c88a44 uint-semantics adapter default was corrected the same way (src/noisemaker_cpu/adapters/noise3d.py: no mounted oracle now renders through the exact uint path instead of the pre-fix JS-number emulation). The committed bundle was regenerated from the pinned CDN sources (NM_SHADER_VERSION=1.0.183 python -m transpiler.build --all); bundle-lock.json/metadata.json are unchanged (sources byte-identical) and the kernel diff is exactly the six marked sites gaining rt.trunc64 (synth3d__cell3d__precompute, synth3d__cellularAutomata3d__simulate, synth3d__flythrough3d__precompute, synth3d__fractal3d__precompute at scaledVolSize, synth3d__noise3d__precompute, synth3d__reactionDiffusion3d__simulate). Verified against the fresh sibling at b93980b512a2 (NOISEMAKER_CPU_DIR set):

• scripts/parity-summary (whole-catalog gate): PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding cpuHead b93980b512a2..., cpuTree e632c2f0bb74....
• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; every non-provenance receipt field is identical to the committed tests/data/parity-receipt-296e0138.json — only the cpu provenance block moved (cpuHead b93980b512a2..., cpuTree e632c2f0bb74...).
• Standalone/deployed default: with NOISEMAKER_CPU_DIR unset (no mounted oracle), _oracle_integer_division_trunc() is True and the noise3d adapter renders the exact uint path; the standalone render_dsl volume cases (render3d and renderCubemapSurface over noise3d(volumeSize: 4), width 2) are byte-identical (sha256 4a56ec92fa874248e9296cbd7ad0cfacba8629f09c4a546e3674e14e5bf82910 and e67567d79bb3aa67a31d6b356994cc8e12575ac8559f4d065015cdf0b75450bd) to the sibling-mounted renders of the same programs. The built wheel (uv build) installed into a fresh venv renders the standalone render3d case byte-identically (4a56ec92...) from site-packages with no repo tree and no sibling — the deployed artifact carries the current semantics.

This commit records the audit in docs/COMPATIBILITY.md and docs/COMPLETION_GAPS.md and ports the oracle-semantics change. The node-free parity receipt and the exact-source tests.yml oracle tarball stay pinned at 296e0138/b61b658399f1 (this job holds no workflow authority to advance it); the truncation probe keeps those pre-fix oracles on their published fractional semantics, so the gate's expectations remain valid until a workflow edit advances the tarball pin, while the published default with no mounted oracle truncates. No gap closed. Raw evidence archived with the job as cpu-sync-ef26f1c-b93980b-range.txt (SHA-256 40164195721e3fecc22ca94da49666babf87e56ef323f524f37c23f17702cab5), cpu-sync-ef26f1c-b93980b-audit.json, parity-receipt-b93980b.json, parity-stdout.txt, parity-before.txt (pre-port at the parent source), and, at this commit's exact source (the archived parity-gate-final.txt provenance line binds its own portHead): parity-gate-final.txt, parity-stdout-final.txt, parity-receipt-final.json, nodefree-final.txt, and test-final.txt in /workspace/evidence.

Environment: Linux x86_64 container, Python 3.11.2, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at b93980b512a24ef71ab61a959ed2ce35c1f09666.

Range audit of the sibling noisemaker-for-cpu 5f12866e919f76fc19e4d3e6f0670d61d10dc672..50c1cbe3319158be9d2965ebd4934b2852d96789 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout 50c1cbe3319158be9d2965ebd4934b2852d96789, tree 5cf74ba49626f7ad5f2deb401dded67e1c9cfa6a; git merge-base --is-ancestor fd9d56c74ce7 50c1cbe33191 exits 0 against the fresh clone, so the force-push-flagged delivery is contiguous, and both range endpoints were already audited by the 2026-09-30 sync): exactly one commit beyond the previously audited 5f12866e919f, 50c1cbe ("GAP-003 first leg: add the executable scripts/parity-summary whole-port parity summary entrypoint"), touching only the sibling's own parity tooling (scripts/parity-summary, scripts/parity/lib.js, scripts/parity/run.js, scripts/parity/summary.js, test/parity-summary.test.js). No engine source, effect catalog, or oracle-output file changes; the sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 with digest c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d, so the audited source-lock set needs no addition and no -python source or bundle change applies. The sibling's new entrypoint is upstream catching up to this port's own whole-catalog parity gate, which this repo has published since the 2026-09-29 sync (scripts/parity-summary, whole-catalog, byte-exact zero tolerance); this port's harness invokes the sibling only through bin/noisemaker-cpu.js, so the scripts/parity refactor does not affect it. No gap closed.

Reproduction: git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout 50c1cbe3319158be9d2965ebd4934b2852d96789 && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 5cf74ba49626f7ad5f2deb401dded67e1c9cfa6a); git -C noisemaker-for-cpu diff --name-only 5f12866e919f76fc19e4d3e6f0670d61d10dc672..50c1cbe3319158be9d2965ebd4934b2852d96789 (expect exactly the five tooling files above). Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare with the committed receipt.

Environment: Linux x86_64 container, Python 3.11.2, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at 50c1cbe3319158be9d2965ebd4934b2852d96789, upstream pin e24c844f8dada85551ab084f41db8944fbc176c8, tree 5cf74ba49626f7ad5f2deb401dded67e1c9cfa6a.

• scripts/parity.py --json — exit 0 against the fresh sibling at 50c1cbe33191: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; every non-provenance receipt field is identical to the committed tests/data/parity-receipt-296e0138.json — only the cpu provenance block moved.
• scripts/parity-summary (whole-catalog gate) against the fresh sibling at 50c1cbe33191: PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding cpuHead 50c1cbe33191..., cpuTree 5cf74ba4....
• Full suite with the fresh sibling at 50c1cbe33191 (NOISEMAKER_CPU_DIR set): 342 passed, 1 skipped, 0 failed.
• scripts/test end to end (its own venv, node available): 262 passed, 81 skipped, exit 0, plus its whole-catalog parity gate against the pinned authority d2965d0b7880: 205/205 exact.

Range audit of the sibling noisemaker-for-cpu 116dae317a07a96d9f8ef3b0320f873871ff6b57..ef26f1c88a4496234d285fa476b8d09d6f05009c against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout ef26f1c88a4496234d285fa476b8d09d6f05009c, tree a0fc510ab9775f23ee5b842a67fe43cd332926ee; git merge-base --is-ancestor 116dae317a07 ef26f1c88a44 exits 0 and git merge-base --is-ancestor fd9d56c74ce7500b7eaeea90a93d3bf49375d28e ef26f1c88a44 exits 0, so the force-push-flagged delivery is contiguous over the whole job range; the range start 116dae317a07 was audited by the previous sync and the range end ef26f1c88a44 is first audited by this sync): exactly one commit beyond the audited 116dae317a07, ef26f1c88a44 ("GAP-003: restore exact GLSL uint semantics in transpiled hash kernels"), touching scripts/upstream/compile-glsl.js (+41 lines: a new restoreUnsignedIntegerArithmetic lowering that rewrites the hash3/hash4 LCG statements to exact mod-2^32 uint arithmetic via cpu_umul ($runtime.stdlib.umul, Math.imul(...) >>> 0) and >>> 0 logical shifts, applied when the source GLSL uses u-suffixed literals), the regenerated src/effects/generated/canonical-kernels.js (the hash3 and hash4 factory kernels now carry the restored statements), and the sibling's own docs/COMPLETION_GAPS.md (+1 record row). This is the first oracle-output-changing -cpu delta since the port's syncs began: pre-fix -cpu rendered these hash kernels with JS-number arithmetic (plain-number uvec arrays with raw operators, IEEE-754 double products rounded before each bitwise ToUint32 coercion); post-fix -cpu renders them with exact uint32 arithmetic. The sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 / c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d (the change is transpiler-side), so the audited source-lock set needs no addition. Measured against the delivered endpoint before the port change, scripts/parity-summary at cpuHead ef26f1c88a44 / cpuTree a0fc510ab977 returned 9 FAILs — filter3d/flow3d 57, render/render3d 57, render/renderCubemap3d 96, render/renderCubemapSurface 27, render/renderLandscape3d 148, render/renderLit3d 187, synth3d/cellularAutomata3d 57, synth3d/noise3d 57, synth3d/reactionDiffusion3d 57 ({"expected":205,"executed":196,"exact":196,"strict":0,"near":0,"defer":0,"skip":0,"fail":9,"missing":0}) — every case whose DSL chain routes through the hash3/hash4 kernels. Port change: src/noisemaker_cpu/adapters/noise3d.py no longer unconditionally forces the runtime's JS-number uvec emulation (runtime.js_uvec_numbers) for synth3d/noise3d:precompute; it now mirrors the oracle's per-revision behavior — when the mounted sibling oracle's scripts/upstream/compile-glsl.js contains the restoreUnsignedIntegerArithmetic lowering (post-fix oracles, first ef26f1c88a44), the kernel renders through the runtime's exact uint path; pre-fix oracles (including the CI oracle tarball b61b658399f1 and the pinned gate authority d2965d0b7880) keep the JS-number emulation unchanged; when no oracle checkout is mounted, the pre-fix behavior is preserved. No bundle kernel text changes: the affected kernels already carry exact-uint rt.binary forms, and the flag alone selects the semantics. Verified against the fresh sibling at ef26f1c88a44 (NOISEMAKER_CPU_DIR set):

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; every non-provenance receipt field is identical to the committed tests/data/parity-receipt-296e0138.json — only the cpu provenance block moved (cpuHead ef26f1c88a44..., cpuTree a0fc510ab977...).
• scripts/parity-summary (whole-catalog gate): PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding portHead 59e3faffce3d..., cpuHead ef26f1c88a44..., cpuTree a0fc510ab977..., upstreamPin e24c844f8da..., sourceDigest c2e0c264....
• Full suite with the fresh sibling (NOISEMAKER_CPU_DIR set): 342 passed, 1 skipped, 0 failed.
• scripts/test end to end (its own venv, node available): 262 passed, 81 skipped, exit 0, plus its whole-catalog parity gate against the pinned authority d2965d0b7880 (tree verified 69d2ffc4...): 205/205 exact — pre-fix gate behavior is unchanged.

This commit records the audit in docs/COMPATIBILITY.md and docs/COMPLETION_GAPS.md, corrects the over-broad endpoint-audit claim in the previous d6664f8a494a..116dae317a07 record, and ports the oracle-semantics change. The node-free parity receipt and the exact-source tests.yml oracle tarball stay pinned at 296e0138/b61b658399f1 (this job holds no workflow authority to advance it); the adapter keeps those pre-fix oracles on their published JS-number semantics, so the gate's expectations remain valid until a workflow edit advances the tarball pin. No gap closed. Raw evidence archived with the job as cpu-sync-116dae3-ef26f1c-range.diff (SHA-256 841b16ab083bd56c8fdd604b909b1d878b78a9ba05ea24150113a01822590159), cpu-sync-116dae3-ef26f1c-parity.json (2a81abfe3ae9737a964ac55ac154fa0fc3e03711ef467bc4a99d563a5911abc4), cpu-sync-116dae3-ef26f1c-parity.stdout (39cf8b6b95d8bc3bcee416a73d3c84c8f5f6226f3c52420d76974337f318433c), cpu-sync-116dae3-ef26f1c-summary.txt (69bc142e58a181e4a3c14572fa1dda862bf71a241c3da4e994b8a0a55bc69e47), cpu-sync-116dae3-ef26f1c-pytest.txt (9e7dfe9bfa94dc2c0edae8d5ea92a41638f6dab9cde826716d61c2fa1bd9b6f1), cpu-sync-116dae3-ef26f1c-test.txt (e518fa9844f2e80f048eb799da4837a6f026ce708e3cebb51365866cb0f46645), and cpu-sync-116dae3-ef26f1c-audit.json in /workspace/evidence.

Environment: Linux x86_64 container, Python 3.13.13, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at ef26f1c88a4496234d285fa476b8d09d6f05009c.

Range audit of the sibling noisemaker-for-cpu d6664f8a494aec3bd10bce200d63d42ec833d61a..116dae317a07a96d9f8ef3b0320f873871ff6b57 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout 116dae317a07a96d9f8ef3b0320f873871ff6b57, tree 1f7942c552ca3c5e75f4838dc2de12e28215f360; git merge-base --is-ancestor fd9d56c74ce7500b7eaeea90a93d3bf49375d28e 116dae317a07 exits 0, so the force-push-flagged delivery is contiguous over the job range; the range start d6664f8a494a was audited by the earlier 2026-10-01 syncs and the range end 116dae317a07 was first audited by this sync): exactly two commits beyond the audited d6664f8a494a, both GAP-003 sibling-record updates — 704645a45df9 records the sibling's 2026-10-01 M4/Metal GPU-worker authority-capture campaign for its 41 skip fixtures (touching only -cpu docs/COMPLETION_GAPS.md) and 116dae317a07 corrects the sibling's parity/upstream-defaults/synth3d__reactionDiffusion3d.dsl fixture to the authority-valid starter usage (reactionDiffusion3d(seed: 1, volumeSize: x32) as the starter chain head instead of the authority-rejected noise3d(...).reactionDiffusion3d(...) chain) and updates the sibling record (touching only -cpu docs/COMPLETION_GAPS.md and that sibling parity fixture). No engine source, effect catalog, or oracle-output change; the sibling's committed upstream pin is unchanged at e24c844f8dada85551ab084f41db8944fbc176c8 / c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d, so the audited source-lock set needs no addition and no -python source or bundle change applies. The sibling's corrected fixture belongs to the sibling's own GPU-authority capture lane; this port's CPU-oracle parity cases (including tests/test_parity.py's synth3d/reactionDiffusion3d DSL chains) are independent of the sibling's parity/upstream-defaults fixtures and were not changed. Verified against the fresh sibling at 116dae317a07 (NOISEMAKER_CPU_DIR set):

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped.
• scripts/parity-summary (whole-catalog gate): PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding portHead 73fddce0..., cpuHead 116dae317a07..., cpuTree 1f7942c5..., upstreamPin e24c844f8da..., sourceDigest c2e0c264....
• Full suite with the fresh sibling: 342 passed, 1 skipped, 0 failed.
• scripts/test end to end: exit 0 plus its whole-catalog parity gate at the pinned authority d2965d0b7880: 205/205 exact.

This commit records the audit in docs/COMPATIBILITY.md and docs/COMPLETION_GAPS.md. The node-free parity receipt and the exact-source tests.yml oracle tarball stay pinned at 296e0138/b61b658399f1 (this job holds no workflow authority to advance it). No gap closed. Raw evidence archived with the job as cpu-sync-d6664f8-116dae3-range.diff (SHA-256 ff06d3b39dcaf0664d06d5e4334e8f3c42c21d30f052ce302a1fd815a83585e6), cpu-sync-d6664f8-116dae3-parity.json, cpu-sync-d6664f8-116dae3-summary.txt, cpu-sync-d6664f8-116dae3-pytest.txt, cpu-sync-d6664f8-116dae3-test.txt, and cpu-sync-d6664f8-116dae3-audit.json in /workspace/evidence.

Environment: Linux x86_64 container, Python 3.13.13, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at 116dae317a07a96d9f8ef3b0320f873871ff6b57.

Range audit of noisemaker-for-cpu 50c1cbe3319158be9d2965ebd4934b2852d96789..d6664f8a494aec3bd10bce200d63d42ec833d61a against a fresh clone (tree 761293b250439245f9aa065a8756d51d0d0227d7; git merge-base --is-ancestor 50c1cbe33191 d6664f8a494a exits 0, so the force-push-flagged delivery is contiguous; both endpoints were already audited by the 2026-10-01 syncs). Exactly one commit beyond the audited 50c1cbe33191 — d6664f8a494a, "GAP-003 first leg: publish the parity-summary record update on the verified entrypoint commit", touching only the sibling's own record (docs/COMPLETION_GAPS.md) and sibling parity tooling (scripts/parity/summary.js, test/parity-summary.test.js): the sibling's parity-summary now locks --tolerance to its published ±2 contract and emits per-comparison reference provenance with a GAP-008 referenceProvenance aggregation. No engine source, effect catalog, or oracle-output change; the sibling's committed upstream pin is unchanged at e24c844/c2e0c264, so the audited source-lock set needs no addition and no -python source or bundle change applies. This port's own gate (scripts/parity-summary) already enforces its published byte-exact zero-tolerance contract and binds the sibling oracle provenance in its own parity-summary provenance line, so no equivalent hardening is missing. Verified against the fresh sibling at d6664f8a494a:

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; every non-cpu receipt field is identical to the committed tests/data/parity-receipt-296e0138.json — only the cpu provenance block moved.
• scripts/parity-summary (whole-catalog gate) against the fresh sibling at d6664f8a494a: PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding cpuHead d6664f8a494a..., cpuTree 761293b2....
• Full suite with the fresh sibling at d6664f8a494a (NOISEMAKER_CPU_DIR set): 342 passed, 1 skipped, 0 failed.

This commit records the audit in docs/COMPATIBILITY.md and docs/COMPLETION_GAPS.md. The node-free parity receipt and the exact-source tests.yml oracle tarball stay pinned at 296e0138/b61b658399f1 (this job holds no workflow authority to advance it). No gap closed. Raw evidence archived with the job as cpu-sync-50c1cbe-d6664f8-range.diff, cpu-sync-50c1cbe-d6664f8-parity.json, cpu-sync-50c1cbe-d6664f8-summary.txt, cpu-sync-50c1cbe-d6664f8-pytest.txt, cpu-sync-50c1cbe-d6664f8-test.txt, and cpu-sync-50c1cbe-d6664f8-audit.json in /workspace/evidence.

Range audit of the sibling noisemaker-for-cpu fd9d56c74ce7500b7eaeea90a93d3bf49375d28e..5f12866e919f76fc19e4d3e6f0670d61d10dc672 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout 5f12866e919f76fc19e4d3e6f0670d61d10dc672, tree 7ce22d24a842f381bebe019404bfa6453bfc7d00; git merge-base --is-ancestor fd9d56c74ce7 5f12866e919f exits 0, so the force-push-flagged delivery is contiguous over this range): seven commits beyond the previously audited d2965d0b7880. Six are -cpu docs commits touching only docs/COMPLETION_GAPS.md, docs/CRT-PARITY.md, and docs/COMPATIBILITY.md (36872dd accepted CRT approximation and compatibility constraints; c58bada records a supervisor publication 403 blocker in the GAP register pass history; 52219d9 replaces local machine paths with portable references; 65a52cb/7e50900/ce3926d record GAP-002 bounded external-input qualifications and tie GAP-002 required checks to the exact record candidate 7e50900); 5f12866 is the source-lock sync, bumping the upstream pin from noisemaker@f24b52540af6a88d12daa05feba1a04ad61b22a2 to e24c844f8dada85551ab084f41db8944fbc176c8 with a recomputed PINNED_SOURCE_DIGEST (c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d) and PINNED_SOURCE_MANIFEST_DIGEST (2516724e7d886253883107b60feff6b1da6ca8bc48186b05357c8443c56f1bff). The manifest-digest change comes from exactly four upstream shaders/src/runtime entries in the pinned-source manifest (backends/diagnostics.js 7128→8059 bytes, backends/webgl2.js 78150→81111, backends/webgpu.js 164220→164648, pipeline.js 123038→124928 — upstream GAP-007 backend-diagnostics and WebGL2/WebGPU validator 'input'/'resolution' dimension-keyword machinery, GPU-host files neither the -cpu CPU runtime nor this port consumes; no diagnostics/webgl2/webgpu/pipeline import exists in the -cpu src or bin tree, and shaders/effects is untouched, so the effect catalog is byte-identical); git diff d2965d0..5f12866 -- shaders src/runtime src/effects catalog.js bin is empty except src/effects/generated/upstream-snapshot.js, whose only change is the UPSTREAM_REVISION field, so the -cpu oracle's rendered output is byte-identical to the prior pin and no -python source or bundle change applies. The committed PINNED_SOURCE_MANIFEST_DIGEST was recomputed from the sibling's committed manifest entries with the sibling's own sourceManifestDigest() and matches byte-for-byte; PINNED_SOURCE_DIGEST is read from the sibling's committed source lock at 5f12866e919f. Port per repo convention: tests/test_parity.py audited source-lock set gains the e24c844f8da.../c2e0c264... entry (added only by this audited sync whose oracle output was proven byte-identical and whose committed digest was verified as above); the node-free parity receipt and the exact-source gate's immutable oracle tarball stay pinned at 296e0138/b61b658399f1, and this job holds no workflow authority to advance the tests.yml oracle pin. No gap closed. Raw run evidence (kept out of the repository per the current no-committed-logs policy), archived with the job in /workspace/evidence: cpu-sync-fd9d56c-5f12866-range.diff (verbatim git log --stat over the range, the ancestry check, the three tree SHAs, and the full git diff d2965d0..5f12866) and cpu-sync-fd9d56c-5f12866-audit.json.

Reproduction (requires network, node, and the sibling clone): git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout 5f12866e919f76fc19e4d3e6f0670d61d10dc672 && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 7ce22d24a842f381bebe019404bfa6453bfc7d00); git -C noisemaker-for-cpu diff --name-only d2965d0b7880cee678de11ec797155c8a65c7b66..5f12866e919f76fc19e4d3e6f0670d61d10dc672 -- shaders src/runtime src/effects catalog.js bin (expect only src/effects/generated/upstream-snapshot.js); the sibling's committed source lock at that revision reads PINNED_UPSTREAM_REVISION = 'e24c844f8dada85551ab084f41db8944fbc176c8' / PINNED_SOURCE_DIGEST = 'c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d' / PINNED_SOURCE_MANIFEST_DIGEST = '2516724e7d886253883107b60feff6b1da6ca8bc48186b05357c8443c56f1bff'. Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare byteExact with the committed receipt (only the cpu provenance block may differ).

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.4.6, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at 5f12866e919f76fc19e4d3e6f0670d61d10dc672, upstream pin e24c844f8dada85551ab084f41db8944fbc176c8, source digest c2e0c264dc20338b19a144ee0888bd2ca39edcf325315a7d7ae1f5ced920804d, tree 7ce22d24a842f381bebe019404bfa6453bfc7d00.

• scripts/parity.py --json — exit 0 against the fresh sibling at 5f12866e919f: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; every non-provenance receipt field (byteExact, counts, diffs, errors, oracleErrors, settings, skipped, per-case SHA-256 entries) is identical to the committed tests/data/parity-receipt-296e0138.json — only the cpu provenance block moved.
• scripts/parity-summary (whole-catalog gate) against the fresh sibling at 5f12866e919f: PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0, provenance line binding portHead, cpuHead 5f12866e919f..., cpuTree, upstreamPin e24c844f8da..., sourceDigest c2e0c264....
• Full suite with the fresh sibling at 5f12866e919f (NOISEMAKER_CPU_DIR set): 342 passed, 1 skipped, 0 failed (the skip is the gate-pinned receipt regeneration check, which requires the gate-pinned oracle checkout 296e0138). Before the audited-entry addition the only failure was test_cpu_upstream_source_lock_and_catalog_parity rejecting the then-unaudited pin — red behavior of the audited-set guard verified, then fixed forward by adding the entry.
• scripts/test end to end (its own venv, node available): 262 passed, 81 skipped, exit 0, then the whole-catalog parity gate against the pinned authority d2965d0b7880 (tree verified 69d2ffc4...): PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}.

Range audit of the sibling noisemaker-for-cpu fd9d56c74ce7500b7eaeea90a93d3bf49375d28e..d2965d0b7880cee678de11ec797155c8a65c7b66 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout d2965d0b7880cee678de11ec797155c8a65c7b66, tree 69d2ffc4731b23fddd472b830d3458915ede2bc4; git merge-base --is-ancestor fd9d56c74ce7 7863f096061b exits 0, so the force-push-flagged delivery is contiguous over this range): ten commits. Nine are -cpu docs/audit-review commits touching only docs/COMPLETION_GAPS.md, docs/CRT-PARITY.md, and docs/COMPATIBILITY.md (64539bc..7863f096); d2965d0 is the source-lock sync, bumping the upstream pin from noisemaker@73c15be00d6888f4b5d2835d8e242ee9e840df45 to f24b52540af6a88d12daa05feba1a04ad61b22a2 with a recomputed PINNED_SOURCE_DIGEST (f11af18a15ec0220c5d41a17c70da637fa05f86597a4c1984838bd0e77246723) and PINNED_SOURCE_MANIFEST_DIGEST (143497d9db7c06955057c925c1b1f2fdb29dd8120ce9f5b2d9fa0be6fbc786a6). The digest change comes from exactly one pinned-source manifest entry (shaders/src/runtime/external-input.js, 54120→67725 bytes, sha256 824dbf38...→c29887aa272c02e2e695bede7a273e9010188793598ab82b1daad883071c3763: upstream GAP-032 WebAudio multi-capture audio-input machinery in shaders/src/runtime plus shaders/tests — no AudioInputManager/external-input consumer exists in the -cpu CPU runtime or in this port); git diff fd9d56c..d2965d0 -- shaders src/runtime src/effects catalog.js bin is empty except src/effects/generated/upstream-snapshot.js, whose only change is the UPSTREAM_REVISION field, so the effect catalog and the -cpu oracle's rendered output are byte-identical to the prior pin and no -python source or bundle change applies. Verification of this port against the fresh sibling at d2965d0b7880: scripts/parity.py --json — 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped, with per-case SHA-256 entries identical to the committed parity-receipt-296e0138.json (only the CPU provenance fields differ); the sibling's committed source lock at d2965d0b7880 reads f24b5254.../f11af18a.../manifest digest 143497d9..., verified byte-for-byte. The port's source-lock assertion (tests/test_parity.py) now verifies the sibling's lock against the audited source-lock set (296e0138/e371a165 — the gate-pinned oracle — and f24b5254/f11af18a — the current -cpu pin), each entry added only by an audited sync whose oracle output was proven byte-identical and whose digest was verified byte-for-byte; the node-free parity receipt stays pinned at parity-receipt-296e0138.json because the exact-source tests.yml gate's immutable oracle tarball is still pinned at b61b658399f1 and this job holds no workflow authority to advance it. This commit also adds scripts/parity-summary, the machine-checkable whole-catalog parity gate against the current authority: every bundled effect id must execute and match the oracle byte-exactly — plain effects through the effect CLI path, and the iterated/points/simulation/volume/loop effects through the DSL programs shared with tests/test_parity.py (now exported as the VOLUME_DSL_CASES table, consolidating the former volume-renderer/landscape3d/palette3d/flow3d/stateful-volume/loop test functions one-to-one into test_volume_and_loop_dsl_byte_parity with identical programs, sizes, and assertion; 23 rows replace 21 former parameterizations). An effect with no executable case counts as missing, and the entrypoint exits 0 only when executed == expected, exact + strict == expected, and near, defer, skip, fail, and missing are all zero — incomplete coverage fails. No gap closed.

Reproduction (requires network, node, and the sibling clone): git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout d2965d0b7880cee678de11ec797155c8a65c7b66 && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 69d2ffc4731b23fddd472b830d3458915ede2bc4); git -C noisemaker-for-cpu diff --name-only fd9d56c74ce7500b7eaeea90a93d3bf49375d28e..d2965d0b7880cee678de11ec797155c8a65c7b66 -- shaders src/runtime src/effects catalog.js bin (expect only src/effects/generated/upstream-snapshot.js); the sibling's committed source lock at that revision reads PINNED_UPSTREAM_REVISION = 'f24b52540af6a88d12daa05feba1a04ad61b22a2' / PINNED_SOURCE_DIGEST = 'f11af18a15ec0220c5d41a17c70da637fa05f86597a4c1984838bd0e77246723' / PINNED_SOURCE_MANIFEST_DIGEST = '143497d9db7c06955057c925c1b1f2fdb29dd8120ce9f5b2d9fa0be6fbc786a6'. Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare byteExact with the committed receipt (only the cpu provenance block may differ).

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at d2965d0b7880cee678de11ec797155c8a65c7b66, upstream pin f24b52540af6a88d12daa05feba1a04ad61b22a2, source digest f11af18a15ec0220c5d41a17c70da637fa05f86597a4c1984838bd0e77246723, tree 69d2ffc4731b23fddd472b830d3458915ede2bc4. Raw run evidence (kept out of the repository per the current no-committed-logs policy), archived with the job in /workspace/evidence: cpu-sync-fd9d56c-d2965d0-range.diff — the verbatim range evidence (git log --stat fd9d56c74ce7..d2965d0b7880, the full git diff fd9d56c74ce7..d2965d0b7880, the merge-base --is-ancestor ancestry check, and the three tree SHAs); cpu-sync-fd9d56c-d2965d0-audit.json; and the parity run output below.

• scripts/parity-summary (whole catalog, machine-checkable gate) against the fresh sibling at d2965d0b7880: PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0 — every one of the 205 bundled effect ids executed once and byte-identical to the oracle. With case-id arguments it renders and counts only those effects; an unknown or uncovered id counts as missing and makes the exit nonzero (verified: scripts/parity-summary synth/solid render/loopEnd synth3d/noise3d points/life not/an-effect → missing:1, exit 1). Each run prints a provenance line binding both revisions (portHead, cpuHead, cpuTree, upstreamPin, sourceDigest) before the PARITY-SUMMARY line. The repository test entrypoint scripts/test executes this gate itself when node is available: it clones the sibling at the pinned authority revision d2965d0b7880cee678de11ec797155c8a65c7b66, verifies its tree (69d2ffc4731b23fddd472b830d3458915ede2bc4), and requires exit 0 — so any supervisor run of the repository's tests records a supervisor-computed whole-catalog parity check bound to both revisions (at this candidate: 205/205 exact, exit 0).
• Full suite with the fresh sibling at d2965d0b7880: 342 passed, 1 skipped, 0 failed (the skip is tests/test_parity_receipt.py:77, which requires the gate-pinned oracle checkout 296e0138). The source-lock assertion also passes at the gate-pinned oracle checkout b61b658399f1, and corrupting an audited digest in the assertion makes it fail (red behavior verified, then restored from backup). scripts/test end to end (pytest plus the parity gate): 262 passed, 81 skipped, then PARITY-SUMMARY {"expected":205,"executed":205,"exact":205,"strict":0,"near":0,"defer":0,"skip":0,"fail":0,"missing":0}, exit 0.

Range audit of the sibling noisemaker-for-cpu b61b658399f18b5a93abd0020c02fff3be9630f5..fd9d56c74ce7500b7eaeea90a93d3bf49375d28e against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout fd9d56c74ce7500b7eaeea90a93d3bf49375d28e, tree 406bea7cdf50f6080784bfd58ce78902697ccba1): four commits. f0ccebe (GAP-007) gives the -cpu browser demo controls distinct accessible names — examples/browser/ and its tests, machinery this port does not contain; f290040 (GAP-008) adds golden-reference provenance reporting to the -cpu parity harness (parity/goldens/provenance.json, scripts/parity/) — no golden, tolerance, or engine change; 21d211e is -cpu docs plus a landscape-authority comparison JSON; fd9d56c is the source-lock sync, bumping the upstream pin from noisemaker@296e0138c4744ed485b2e95de3eeb466c17629ee to 73c15be00d6888f4b5d2835d8e242ee9e840df45 with a recomputed PINNED_SOURCE_DIGEST (b78f27e21703a5ae3f976273e946f71b435193eeee4006c98caba229e3eedcaa) and PINNED_SOURCE_MANIFEST_DIGEST (1cb5f2447819f6b253ea70673e03bd3dbb04486272d111f844da44e4d3ff5edb). The digest change comes from three upstream shaders/src entries in the pinned-source manifest (webgl2.js, compiler.js, pipeline.js — upstream GPU-host machinery neither the -cpu CPU runtime nor this port consumes); git diff b61b658..fd9d56c -- shaders src/runtime src/effects catalog.js bin is empty except src/effects/generated/upstream-snapshot.js, whose only change is the UPSTREAM_REVISION field, so the effect catalog and the -cpu oracle's rendered output are byte-identical to the prior pin and no -python source or bundle change applies. Verification of this port against the fresh sibling at fd9d56c74ce: scripts/parity.py --json — 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped, with per-case SHA-256 entries identical to the committed parity-receipt-296e0138.json (only the CPU provenance fields differ); the sibling's committed source lock at fd9d56c74ce reads 73c15be0.../b78f27e2.../manifest digest 1cb5f244..., verified byte-for-byte. The port's pinned assertions and receipt were briefly advanced to fd9d56c74ce/73c15be0 in commit 324f92c, which broke the exact-source gate (run 36386480341: all four host jobs failed) because the gate's immutable oracle tarball is pinned at b61b658399f1 and this job holds no workflow authority to advance it. This commit restores the gate-consistent pins (tests/test_parity.py source-lock assertions at 296e0138.../e371a165...; tests/test_parity_receipt.py re-pinned to parity-receipt-296e0138.json; the superseded parity-receipt-73c15be0.json removed) while keeping the sync verification evidence above. Authority limit recorded: no workflow change exists in this job; the next action is an actor with workflow authority advancing the tests.yml oracle pin from b61b658399f1 to fd9d56c74ce7500b7eaeea90a93d3bf49375d28e, after which the port's pinned assertions and receipt re-advance to 73c15be0/b78f27e2 (the receipt bytes are already archived with the job). No gap closed.

Reproduction (requires network, node, and the sibling clone): git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout fd9d56c74ce7500b7eaeea90a93d3bf49375d28e && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 406bea7cdf50f6080784bfd58ce78902697ccba1); git -C noisemaker-for-cpu diff --name-only b61b658399f18b5a93abd0020c02fff3be9630f5..fd9d56c74ce7500b7eaeea90a93d3bf49375d28e -- shaders src/runtime src/effects catalog.js bin (expect only src/effects/generated/upstream-snapshot.js); the sibling's committed source lock at that revision reads PINNED_UPSTREAM_REVISION = '73c15be00d6888f4b5d2835d8e242ee9e840df45' / PINNED_SOURCE_DIGEST = 'b78f27e21703a5ae3f976273e946f71b435193eeee4006c98caba229e3eedcaa' / PINNED_SOURCE_MANIFEST_DIGEST = '1cb5f2447819f6b253ea70673e03bd3dbb04486272d111f844da44e4d3ff5edb'. Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare byteExact with the committed receipt (only the cpu provenance block may differ).

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at fd9d56c74ce7500b7eaeea90a93d3bf49375d28e, upstream pin 73c15be00d6888f4b5d2835d8e242ee9e840df45, source digest b78f27e21703a5ae3f976273e946f71b435193eeee4006c98caba229e3eedcaa, tree 406bea7cdf50f6080784bfd58ce78902697ccba1. Raw run evidence (range audit and port verification logs, kept out of the repository per the current no-committed-logs policy): archived with the job as cpu-sync-b61b658-fd9d56c-audit.json in /workspace/evidence (SHA-256 678c7214c23e3c45e7c189487a09d0dd13a58c1b23a8e62e5c959c98f8d05a78).

• scripts/parity.py --json — exit 0 against both the fresh sibling at fd9d56c74ce (167/167 byte-exact) and the gate-pinned oracle at b61b658399f1; per-case SHA-256 entries are identical across the two oracle revisions (only the cpu provenance fields differ).
• tests/test_parity.py + tests/test_parity_receipt.py against the gate-pinned oracle at b61b658399f1 (tarball extraction, the workflow's exact loading procedure): 82 passed, 0 failed, including the regeneration check running against the pinned sibling.

Range audit of the sibling noisemaker-for-cpu dedfd07c24f80d9b0adddf912a4224ce6c1d795f..b61b658399f18b5a93abd0020c02fff3be9630f5 against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout b61b658399f18b5a93abd0020c02fff3be9630f5): two commits (34a0325, b61b658), each a source-lock sync. The first bumps the upstream source lock from noisemaker@12b4d74fb4f28d5f00bb1dde107fa8673814d8b9 to 93229933b102ba82e713402be19db57207698850 and the second to 296e0138c4744ed485b2e95de3eeb466c17629ee. The committed pinned-source manifest diff across the whole range changes only the revision field; git diff dedfd07c24f8..b61b658399f1 -- shaders is empty, so shaders/effects and shaders/src are byte-identical to the prior pin (the intervening upstream commits touch only shaders/tests/ harness tooling and docs — machinery the -cpu port and this port do not consume), the effect catalog is byte-identical, and no -python source or bundle change applies. Port per repo convention: tests/test_parity.py source-lock assertions advanced to 296e0138.../e371a165... (digest and manifest digest unchanged and correct); parity receipt (the node-free replay fixture) regenerated with the node oracle CLI against the sibling checkout at b61b658399f1 (tree 41988bc079140eccf082dd08f2ec5c8a4555e787) as tests/data/parity-receipt-296e0138.json, replacing parity-receipt-12b4d74f.json; its byteExact (167/167 effects, zero tolerance), settings, and counts are identical to the superseded receipt — only the CPU provenance fields moved. No gap closed.

Reproduction (requires network, node, and the sibling clone): git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout b61b658399f18b5a93abd0020c02fff3be9630f5 && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 41988bc079140eccf082dd08f2ec5c8a4555e787); git -C noisemaker-for-cpu diff --name-only dedfd07c24f80d9b0adddf912a4224ce6c1d795f..b61b658399f18b5a93abd0020c02fff3be9630f5 -- shaders (expect no output); the sibling's committed source lock at that revision reads PINNED_UPSTREAM_REVISION = '296e0138c4744ed485b2e95de3eeb466c17629ee' / PINNED_SOURCE_DIGEST = 'e371a1650d1ace9462a20ecf4e4f0902e5135b4772e8a9abbc8d2c037beebf59' / PINNED_SOURCE_MANIFEST_DIGEST = '8bb68100f40db4955c4544507eb6049b1e31a0887828196b48e67d5cd8c5f218'. Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare byteExact with the committed receipt (only the cpu provenance block may differ).

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.4.6, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at b61b658399f18b5a93abd0020c02fff3be9630f5, upstream pin 296e0138c4744ed485b2e95de3eeb466c17629ee, source digest e371a1650d1ace9462a20ecf4e4f0902e5135b4772e8a9abbc8d2c037beebf59, tree 41988bc079140eccf082dd08f2ec5c8a4555e787. Committed verbatim evidence (range audit and port verification logs, for review runtimes without a sibling checkout or network): docs/evidence/cpu-sync-dedfd07c-b61b658-audit.json (SHA-256 c75740fd9cf4632f0902c073627d498df4e5c7574d5fb3a61a578a517305d617).

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; per-case SHA-256 entries identical to the superseded parity-receipt-12b4d74f.json, only the CPU provenance fields moved.
• tests/test_parity_receipt.py at the new pin: passed, including the regeneration check test_receipt_is_current_when_the_oracle_is_available, which runs against the live sibling at b61b658399f1.

Range audit of the sibling noisemaker-for-cpu 7a824744cb563f2280811f04e5a49f6792ed319d..dedfd07c24f80d9b0adddf912a4224ce6c1d795f against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout dedfd07c24f80d9b0adddf912a4224ce6c1d795f): a single commit that bumps the upstream source lock to noisemaker@12b4d74fb4f28d5f00bb1dde107fa8673814d8b9 (digest e371a1650d1ace9462a20ecf4e4f0902e5135b4772e8a9abbc8d2c037beebf59, manifest digest 8bb68100f40db4955c4544507eb6049b1e31a0887828196b48e67d5cd8c5f218). The committed pinned-source manifest diff shows the only changed upstream files are shaders/src/runtime/pipeline.js and a new shaders/src/runtime/preflight.js (static WebGL2/WebGPU authorability and device-limit prediction, plus a delegating mrtFormatBytes/read-only preflight() refactor — GPU-host machinery the -cpu port and this port do not contain); shaders/effects is byte-identical to the prior pin, so the ported effect catalog is byte-identical and no -python source or bundle change applies. Port per repo convention: tests/test_parity.py source-lock assertions advanced to 12b4d74f.../e371a165...; parity receipt (the node-free replay fixture) regenerated with the node oracle CLI against the sibling checkout at dedfd07c24f8 (tree 32960595cacf42bd89f108ffeab0580c91b96c4f) as tests/data/parity-receipt-12b4d74f.json, replacing parity-receipt-7443f6e6.json; its byteExact (167/167 effects, zero tolerance), settings, and counts are identical to the superseded receipt — only the CPU provenance fields moved. No gap closed.

Reproduction (requires network, node, and the sibling clone): git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git && git -C noisemaker-for-cpu checkout dedfd07c24f80d9b0adddf912a4224ce6c1d795f && git -C noisemaker-for-cpu rev-parse 'HEAD^{tree}' (expect 32960595cacf42bd89f108ffeab0580c91b96c4f); git -C noisemaker-for-cpu diff --name-only 7a824744cb563f2280811f04e5a49f6792ed319d..dedfd07c24f80d9b0adddf912a4224ce6c1d795f -- shaders/effects (expect no output); the sibling's committed source lock at that revision reads PINNED_UPSTREAM_REVISION = '12b4d74fb4f28d5f00bb1dde107fa8673814d8b9' / PINNED_SOURCE_DIGEST = 'e371a1650d1ace9462a20ecf4e4f0902e5135b4772e8a9abbc8d2c037beebf59'. Then NOISEMAKER_CPU_DIR=<sibling> scripts/parity.py --json /tmp/receipt.json and compare byteExact with the committed receipt (only the cpu provenance block may differ).

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at dedfd07c24f80d9b0adddf912a4224ce6c1d795f, upstream pin 12b4d74fb4f28d5f00bb1dde107fa8673814d8b9, source digest e371a1650d1ace9462a20ecf4e4f0902e5135b4772e8a9abbc8d2c037beebf59, tree 32960595cacf42bd89f108ffeab0580c91b96c4f.

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; per-case SHA-256 entries identical to the superseded parity-receipt-7443f6e6.json, only the CPU provenance fields moved.
• tests/test_parity_receipt.py at the new pin: 4 passed (including the regeneration check test_receipt_is_current_when_the_oracle_is_available, which now runs against the live sibling at dedfd07c24f8 instead of skipping).

Range audit of the sibling noisemaker-for-cpu 4b590d2f7f607a2788a5bc7675288ec166d0b633..7a824744cb563f2280811f04e5a49f6792ed319d against a fresh clone (git clone https://github.com/noisefactorllc/noisemaker-for-cpu.git, checkout 7a824744cb563f2280811f04e5a49f6792ed319d): 6 commits — 7145223/12db707/901bbd9/64d7ea4 are audit/docs records and CPU-side test characterization; 9683091 bumps the upstream source lock to noisemaker@7443f6e6180300a45c5b97608459e5094504659d (digest e1ffce78499ae9a3994f3035e0f0e1fd8ca1098a9511e013fa444a5177eb523b) with shaders/effects byte-identical to the prior pin (the committed pinned-source manifest diff in that repo shows the only changed upstream files are shaders/src/lang/* — a predictReplacement/preflight layer on upstream replaceEffect mutation APIs that neither the -cpu port nor this port contains); 7a82474 (GAP-006) is docs/packaging only (package.json files, README, audit records). No shaders/effects entry changed, so the ported effect catalog is byte-identical and no -python source or bundle change applies. Port per repo convention: tests/test_parity.py source-lock assertions advanced to 7443f6e6.../e1ffce78...; node-free parity receipt regenerated against the sibling checkout at 7a824744cb56 (tree 7c68f12928719dc4e841971ac28d3f3db7e28e73) as tests/data/parity-receipt-7443f6e6.json, replacing parity-receipt-6a0af04d.json; its byteExact (167/167 effects, zero tolerance), settings, and counts are identical to the superseded receipt — only the CPU provenance fields moved. No gap closed.

Environment: Linux x86_64 container, Python 3.11.2, NumPy 2.5.3, node 26.5.1; sibling oracle NOISEMAKER_CPU_DIR at 7a824744cb563f2280811f04e5a49f6792ed319d, upstream pin 7443f6e6180300a45c5b97608459e5094504659d, source digest e1ffce78499ae9a3994f3035e0f0e1fd8ca1098a9511e013fa444a5177eb523b, tree 7c68f12928719dc4e841971ac28d3f3db7e28e73.

• scripts/parity.py --json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped; per-case SHA-256 entries identical to the superseded parity-receipt-6a0af04d.json, only the CPU provenance fields moved.
• tests/test_parity_receipt.py at the new pin: 4 passed (including the regeneration check test_receipt_is_current_when_the_oracle_is_available, which now runs against the live sibling at 7a824744cb56 instead of skipping).

The default sweep uses zero byte tolerance at 8×8, seed 1, and time 0.25. DSL tests retain their original mixture of exact and ±2-byte contracts. A tolerance pass does not establish exact equality. Independent comparisons use 48×32, seed 17, and time 0.375. Alpha differs by 179, and feedback differs by one byte. The one-byte result remains a strict failure. No threshold or golden changed. Full sweep results (audit evidence evidence-audit-20260925-090206/parity-results.json). Independent programs and channel counts (audit evidence evidence-audit-20260925-090206/independent-comparisons.json).

Skipped image-gate IDs:

• filter/convolutionFeedback
• filter/feedback
• filter/motionBlur
• filter/temporalAberration
• filter3d/flow3d
• filter3d/palette3d
• points/attractor
• points/buddhabrot
• points/dla
• points/flock
• points/flow
• points/hydraulic
• points/lenia
• points/life
• points/physarum
• points/physical
• render/loopBegin
• render/loopEnd
• render/pointsBillboardRender
• render/pointsEmit
• render/pointsRender
• render/render3d
• render/renderCubemap3d
• render/renderCubemapSurface
• render/renderLandscape3d
• render/renderLit3d
• synth/cellularAutomata
• synth/mnca
• synth/navierStokes
• synth/reactionDiffusion
• synth3d/cell3d
• synth3d/cellularAutomata3d
• synth3d/flythrough3d
• synth3d/fractal3d
• synth3d/heightmap3d
• synth3d/noise3d
• synth3d/reactionDiffusion3d
• synth3d/shape3d

Missing current IDs: render/meshLoader, render/meshRender, synth/roll, synth/scope, synth/spectrum. Separate DSL cases cover selected iterated and typed behavior. They do not resolve image-gate exclusions or establish the complete parameter matrix. Current filtering: isosurface and filtering: voxel succeed in CPU and fail in Python. Shader hashes differ for classicNoisedeck/glitch:glitch, classicNoisedeck/noise:noise, and render/renderLandscape3d:landscape. Current parameter manifests and shader hashes (audit evidence evidence-audit-20260925-090206/authority-comparison-retry.json). Filtering cases (audit evidence evidence-audit-20260925-090206/landscape-valid-choices.json).

Environment: Linux x86_64 container, Python 3.13.13, NumPy 2.5.3, node 26.5.1. Port candidate at the publication commit carrying this row (base 77d47c583663b4b6e8f6e9297d6e906e4f3ca9cb). Sibling oracle: noisemaker-for-cpu at 4b590d2f7f607a2788a5bc7675288ec166d0b633 (tree 3cc6f65be52ac09cc868eb1656c188f0693952f8), upstream pin 6a0af04d3c4f345ffab5e9f8e54e532216b4cdaa, source digest 6315004fe71950c4d687906ed81243bd85b3c3d2c2d171cd06675ac23ac2820a.

Commands and results:

• NOISEMAKER_CPU_DIR=<sibling checkout> PYTHONPATH=src .venv/bin/python scripts/parity.py --json parity-current.json — exit 0: 167/167 byte-exact (zero tolerance), 0 diffs, 0 runtime errors, 0 oracle errors, 38 skipped. The regenerated JSON is equal to the committed node-free receipt tests/data/parity-receipt-6a0af04d.json (same counts, same per-case oracle and port SHA-256 entries).
• NOISEMAKER_CPU_DIR=<sibling checkout> .venv/bin/python -m pytest -q -p no:cacheprovider — exit 0: 340 passed, 0 skipped in 16m20s (prior full-suite baseline 337 passed at the 2026-09-26 sync; the delta is the three added cases: two renderLandscape3d filtering choices and one heightmap3d volume-generator case, all node-oracle byte-parity).
• Landscape probes (both engines, 8×8, seed 1, time 0.25): noise3d(volumeSize: 4, seed: 0).renderLandscape3d(volumeSize: 4, filtering: 0 | 1).write(o0)\nrender(o0) — Python renders both choices and each matches the oracle's PNG at maximum absolute RGBA8 difference 0. These probes are committed as test_landscape3d_filtering_byte_parity; synth3d/heightmap3d was added to test_volume_generator_render3d_byte_parity (maxdiff 0).
• Authority reconciliation, immutable inputs: manifest for exact CDN build 1.0.190 has SHA-256 05c4d7b7744837ae90a3bb4c89e5403ff09448a74d9d7e824abb3d719ad3314e and is byte-identical to the rolling 1.0 manifest. With NM_SHADER_VERSION=1.0.190, fetching all 205 targeted effects from the CDN and hashing each program's GLSL (sha256(glsl.strip()), the same function transpiler/build.py records in bundle-lock.json) matches all 294 lock entries, finds zero lock entries without an authority program, and finds zero parameter-manifest differences (post shared_enums normalization, same as the builder). The formerly differing programs classicNoisedeck/glitch:glitch, classicNoisedeck/noise:noise, and render/renderLandscape3d:landscape now match authority.
• Denominator: 167 (image sweep) + 38 (exclusion-class DSL cases, all _max_diff == 0) = 205 targeted effects, each with at least one zero-tolerance oracle-matched, source-bound comparison. The 5 remaining authority IDs (render/meshLoader, render/meshRender, synth/roll, synth/scope, synth/spectrum) are documented non-targets in transpiler/cdn.py. 167 + 38 + 5 = 210 = the authority manifest inventory.
• Standing limits: the tested contexts are fixed (image sweep 8×8 at defaults; DSL chains at 2×2/8×8/16×16, volumeSize 4); the complete parameter matrix, external-input shapes, and host versions are not re-measured here; node-gated tests execute only when the sibling oracle checkout is present.

The daily review inspected worker audit audit-20260925-090206 and post-worker commit 49d8e51ec4b71104dc03728c84c60cae3e2857d3. All 64 CLI, DSL, and output-runtime tests pass at current source 49d8e51ec4b71104dc03728c84c60cae3e2857d3. The sibling source lock test passes against /workspace/repos/noisemaker-for-cpu. The review independently reproduced GAP-004: the built wheel contains 328 files and zero JSON files, omitting bundle/metadata.json. The review checked GAP-005: four-component solid color produces alpha difference 179 against the CPU oracle, and feedback diverges by one byte. Exact reviewed-source CI contains zero runs and zero checks. Full installed-host and platform qualification remains incomplete. GAP-001 remains open, and the suite leaves current full rendered parity unverified. Earlier raw evidence (audit evidence review-20260925-053200/python-current-tests.json).

The current full case denominator remains incomplete. Missing parameters, hosts, external inputs, and stateful sequences remain qualification gaps. No skip or tolerated difference counts as exact parity.

Full parity requires complete applicable coverage with no skips or missing cases. Historical NEAR, CHAOS, and tolerated differences do not count as strict equality. The existing numerical contracts remain separate from exact comparison. This report does not change tolerances or goldens. Unknown values mean not measured, never zero.

Earlier served compatibility inventory declares 205 effect IDs. Declaration does not establish execution or parity. IDs absent from the served declaration: render/meshLoader, render/meshRender, synth/roll, synth/scope, synth/spectrum. Missing effects remain visible toward the full-parity goal. Contract exclusions do not become successful tests.

Current served declaration: 205 effect IDs. This inventory is not evidence of execution. The declaration column below reflects kit 0.1.7.

The environment is Python 3.14.5 on macOS arm64. NumPy supplies the actual CPU renderer. Runtime versions (audit evidence evidence-audit-20260925-090206/runtime.json) records Python, NumPy, Node, and operating-system versions.

The unchanged image suite returns exit 0: 167/167 exact comparisons, zero mismatches, zero runtime errors, and zero oracle errors. It skips 38 iterated or typed effects. These exclusions remain qualification gaps in this gate. The README's 169/36 counts do not match this source's 167/38 inventory. The suite uses 8×8 images, seed 1, time 0.25, and default parameters. Its numerical threshold is zero byte difference. A wrapper redirects temporary PNG paths and captures local result variables. It does not change comparisons or exclusions. Literal command and source identities (audit evidence evidence-audit-20260925-090206/parity-command.json). Every executed and skipped ID (audit evidence evidence-audit-20260925-090206/parity-results.json).

Independent public DSL probes use 48×32 images, seed 17, and time 0.375. The noise/invert chain matches exactly across 6,144 channels. Four-component solid color produces alpha 76 instead of CPU alpha 255 across 1,536 pixels. Maximum difference: 179. A three-iteration feedback chain differs by one byte in five of 6,144 channels. It fails strict equality. RGB and explicit-alpha controls match. These controls isolate the solid discrepancy to four-component color interpretation. Both valid landscape filtering choices succeed in CPU and fail in Python with an unknown-parameter diagnostic. Nondefault comparisons (audit evidence evidence-audit-20260925-090206/independent-comparisons.json). Alpha controls (audit evidence evidence-audit-20260925-090206/alpha-controls.json). Valid landscape choices (audit evidence evidence-audit-20260925-090206/landscape-valid-choices.json).

Current immutable shader comparison finds 291 matching program hashes and three differences among 294 compared programs. Differences: classicNoisedeck/glitch:glitch, classicNoisedeck/noise:noise, and render/renderLandscape3d:landscape. The landscape parameter manifest adds filtering. Palette metadata differences reflect the build-time insertion of enum choices. These differences do not establish equivalent behavior. The upstream language implementation also changed after the CPU pin. Shader and parameter inventories (audit evidence evidence-audit-20260925-090206/authority-comparison-retry.json). Upstream source difference (audit evidence evidence-audit-20260925-090206/upstream-diff.json).

The complete test run collected 274 cases: 267 passed, two failed, and five skipped because Python HTTPS certificate validation failed. The 74 CPU parity tests passed: 50 exact-byte cases, 22 tolerance cases, one float32 equality case, and one source-lock check. A targeted immutable-cache retry passed all 15 CDN and affected transpiler tests. All 274 distinct cases passed across these runs. The initial run returned exit 1. The targeted retry returned exit 0. This is not a single clean full-suite result. Full command (audit evidence evidence-audit-20260925-090206/pytest-command.json). Raw output (audit evidence evidence-audit-20260925-090206/pytest.log). Retry command and output (audit evidence evidence-audit-20260925-090206/network-retry.json). Per-case parity contracts (audit evidence evidence-audit-20260925-090206/dsl-parity-contracts.json). Verified HTTPS downloads through curl supplied immutable 1.0.180 bytes to the unchanged parser. All 13 CDN tests then passed. The earlier malformed landscape probe used linear. Both renderers rejected it. It does not establish a supported-case defect. Initial authority probe (audit evidence evidence-audit-20260925-090206/authority-comparison.json). Pinned CDN retry (audit evidence evidence-audit-20260925-090206/cdn-cached-tests.json).

The editable source installation produces a 32×24 curl image, a changed 48×32 image, filtered input, and three H.264 frames. The public library entry point also produces a 32×24 PNG. PNG decoding and ffprobe check the outputs. Invalid effect input returns exit 2. Corrected input returns exit 0. SIGINT returns Aborted! and preserves the existing output file. Invalid input also preserves that file. The literal README 512×512 example exceeded 180 seconds under concurrent test load. This is a bounded observation, not a performance benchmark. The audit removed both private installation targets. Upgrade behavior, Python 3.11, other operating systems, and sustained resource use remain unverified. Installed commands (audit evidence evidence-audit-20260925-090206/bounded-developer-workflows.json). Output measurements (audit evidence evidence-audit-20260925-090206/output-verification.json). Animation (audit evidence evidence-audit-20260925-090206/animation-verification.json). Cancellation (audit evidence evidence-audit-20260925-090206/cancellation.json). README timeout (audit evidence evidence-audit-20260925-090206/readme-512-timeout.json). Private removal (audit evidence evidence-audit-20260925-090206/private-removal.json).

The served kit produces a 48×32 solid image. Invalid DSL fails, and corrected noise/invert DSL produces another image. The failed wheel remains a distinct distribution defect despite successful editable and served-kit workflows. Headless rendering has no editor controls. The audit checked CLI diagnostics and cancellation through public entry points. Served entry point (audit evidence evidence-audit-20260925-090206/served-workflows.json). Wheel build (audit evidence evidence-audit-20260925-090206/build-command.json). Wheel inventory (audit evidence evidence-audit-20260925-090206/wheel-inventory.json).

Exact reviewed-source CI contains zero runs and zero checks. No existing workflow enforces source-update parity. The served source's export dispatch 35963990201 passed. Downstream release 35963999103 passed 83 checks without skips and identifies that served source. Its checks include an actual staged-kit PNG render. Release packaging checks do not establish full port parity or current wheel correctness. Exact-source runs (audit evidence evidence-audit-20260925-090206/source-ci.json). Exact-source checks (audit evidence evidence-audit-20260925-090206/source-checks.json). Release log (audit evidence evidence-audit-20260925-090206/kit-release.log).

Official references, accessed 2026-09-25: Python packaging guide and Python version status. The packaging guide distinguishes source archives from installable wheels. This audit checked both formats and retained the declared Python 3.11 minimum.

Review CI boundary: No workflow run exists at the inspected source SHA. A passing export dispatch does not qualify rendered parity. Current complete-render enforcement remains an open verification requirement. Exact-source responses and workflows (audit evidence review-20260925-053200/noisemaker-for-python-remote-evidence.json).

Bounded test evidence (audit evidence evidence-20260924-remaining-gap-documents/python-tests-retry.json). Exact-source Actions. This run evidence (audit evidence evidence-20260924-remaining-gap-documents) retains commands, exit codes, source identities, and distribution metadata. Official ecosystem reference: Current Python Packaging User Guide, accessed 2026-09-24. Source CI, export dispatch, artifact delivery, and rendered parity are separate evidence dimensions. A successful dispatch or unit-test summary does not establish a full rendered gate.

Current order: GAP-001 closed 2026-09-27 (authority reconciled against immutable CDN 1.0.190; 167/167 default image comparisons and all 38 exclusion-class DSL chains byte-exact against the pinned oracle; both landscape filtering choices match). Next: GAP-003 exact-source CI requires workflow authority this implementation job does not hold. Require wheel-only output, exact recorded comparisons, and complete denominators.

Next bounded check: Add the exact-source CI gate that runs the suite — including the node-free parity receipt — and wheel/sdist artifact verification (workflow authority required). Retain skips and missing effects toward the 210-ID inventory. See the stable entries in completion gaps.

See GAP-001 and the complete gap register for evidence, dependencies, and acceptance criteria.

1. Reconcile the current authority and complete case inventory, including parameters, inputs, stateful frames, and host versions.
2. Run the existing actual-renderer suite without skip options. Record every missing, failed, refused, or timed-out case.
3. Verify installation, useful output, errors, recovery, upgrades, and removal with the actual distribution.
4. Inspect exact-source CI and retain artifact hashes. Keep unresolved qualification failed or unverified.

All eligible ports have equal priority. Full parity and zero skipped cases remain the goal. Implementation corrections remain with the separate job. This report does not advance the parity checkpoint.

2026-09-27 parity and authority reconciliation at the candidate commit carrying this entry (base 77d47c583663b4b6e8f6e9297d6e906e4f3ca9cb): GAP-001 closed — 167/167 default image comparisons byte-exact against the pinned oracle 4b590d2f7f607a2788a5bc7675288ec166d0b633; all 38 image-harness exclusions each covered by a committed zero-byte DSL chain case (added renderLandscape3d filtering isosurface/voxel and synth3d/heightmap3d); authority reconciliation vs immutable CDN 1.0.190 shows 294/294 program GLSL hashes and 0 parameter-manifest differences; both landscape filtering choices match the oracle exactly (§3, "Parity and authority reconciliation, 2026-09-27").

2026-09-25 daily review at 49d8e51ec4b71104dc03728c84c60cae3e2857d3: reviewed worker audit audit-20260925-090206 (published in 4ff7b03247b59cead0b63a7ee3a7b5697f7bf58e). Verified post-audit commit 49d8e51ec4b71104dc03728c84c60cae3e2857d3 in tests/test_parity.py. Independently reproduced GAP-004 missing metadata in built wheel. Checked GAP-005 nondefault numerical parity differences. Five open gaps remain. Zero closures. Full parity and release readiness remain unqualified.

2026-09-25 worker at 912e6a9aac32c668a5242b8d52aa4415ca3a848e: 167 exact default comparisons, 38 image-gate exclusions, two independent numerical failures, and two landscape rejections. Served kit hashes and reproduction pass. Candidate wheel first render fails. No full-parity or release approval follows.

2026-09-25 daily review at 93b8b141d21a7c853a89131166147c8337109144: source freshness and bounded evidence reviewed. Open qualification limits retained. Retained review evidence (audit evidence review-20260925-053200/python-current-tests.json). No new closure claimed.

Run: 20260924-remaining-gap-documents. Later audits and reviews update this report with source-bound results.