PatchProof 将非确定性补丁提案放入确定性、可拒绝、可复现的工程协议。核心设计原则是权限分离：提出补丁、批准补丁、执行补丁和发布结果是四个不同动作。
PatchProof places nondeterministic patch proposals inside a deterministic, rejectable, reproducible engineering protocol. Its core principle is authority separation: proposing, approving, executing, and publishing are four distinct actions.
ReadOnlyRepository
├── bounded UTF-8 inventory / 有界 UTF-8 清单
├── symlink-aware reads / 符号链接感知读取
└── content snapshot / 内容快照
PatchProposal
├── normalized Unified Diff / 规范化补丁
├── path policy / 路径策略
├── base snapshot / 基础快照
└── domain-separated proposal hash / 哈希域隔离的提案哈希
PatchApproval
├── exact proposal hash / 精确提案哈希
├── run and snapshot binding / Run 与快照绑定
└── declared actor and time / 声明行为人与时间
Validator
├── disposable baseline / 一次性基线副本
├── disposable patched copy / 一次性补丁副本
├── Runner protocol / Runner 协议
└── four phase evidence / 四阶段证据
ValidationReceipt
├── runner fingerprint / Runner 指纹
├── phase outcomes / 阶段结果
├── content address / 内容地址
└── bilingual report / 双语报告
Runner 只需要提供 isolated、fingerprint 和 run(workspace, TestSpec)。因此 Fake Runner、可信本地 Runner 和 Docker Runner 可以共享验证判定，而隔离声明仍保留在回执中。
Runner only provides isolated, fingerprint, and run(workspace, TestSpec). Fake, trusted-local, and Docker runners therefore share verdict logic while preserving the isolation claim in the receipt.
Proposal 和 Approval 的哈希域使用 patchproof.*.v1 前缀，避免不同对象的相同 JSON 被误解释为同类凭据。
Proposal and approval hash domains use patchproof.*.v1 prefixes so identical JSON from different object types cannot be confused as the same credential.
| Zone / 区域 | Trust / 信任 | Authority / 权限 |
|---|---|---|
| Candidate Diff / 候选补丁 | Untrusted / 不可信 | Parsed and applied only to a temporary copy / 仅解析并应用到临时副本 |
| Real repository / 真实仓库 | Protected / 受保护 | Read and snapshot only / 仅读取和快照 |
| Approval metadata / 审批元数据 | Declared / 声明式 | Authorizes one exact proposal and snapshot / 只授权准确提案与快照 |
| Reproduction tests / 复现测试 | Independent trusted input / 独立可信输入 | Defines fail-before/pass-after / 定义补丁前失败与补丁后通过 |
| Hidden tests / 隐藏测试 | Independent trusted input / 独立可信输入 | Grades behavior not exposed through patchable namespace / 在不可补丁命名空间评分 |
| Docker workspace / Docker 工作区 | Constrained / 受限 | Fixed unittest commands, no network or host write mount / 固定 unittest、无网络和宿主写挂载 |
| Receipt / 回执 | Integrity-protected / 完整性保护 | Evidence record only; no execution authority / 仅记录证据，不授予执行权限 |
- Baseline reproduction must execute at least one test and fail for the target behavior. 基线复现必须实际执行至少一个测试，并因目标行为失败。
- Patched reproduction must execute and pass. 补丁后复现必须执行并通过。
- Full regression must execute and pass. 完整回归必须执行并通过。
- External hidden tests must execute and pass. 外置隐藏测试必须执行并通过。
任一阶段出现 ImportError、零测试、超时、输出截断、基础设施失败或错误退出码，整体结果关闭失败。隔离 Runner 通过时 proof_grade=true；本地可信 Runner 即使通过也保持 proof_grade=false。
Any ImportError, zero-test run, timeout, truncated output, infrastructure failure, or incorrect exit status fails closed. An isolated runner may produce proof_grade=true; a trusted-local runner remains proof_grade=false even when tests pass.
- Proposal Hash 同时绑定规范化 Diff 和仓库快照。 Proposal Hash binds both the normalized diff and repository snapshot.
- Approval 必须匹配 Run、Proposal 和当前快照。 Approval must match the run, proposal, and current snapshot.
- 外置测试复制到
.patchproof-tests保留命名空间，补丁不能修改该区域。 External tests are copied into the reserved.patchproof-testsnamespace, which candidate patches cannot modify. - 验证前后真实仓库快照相同。 The real repository snapshot is identical before and after validation.
- 回执文件名由回执内容哈希决定，并采用不覆盖发布。 Receipt filenames derive from their content hash and use no-clobber publication.