Unsafe setup state cannot shadow a proof
Each of the first five blocks changes which program a later allowlisted row reaches while preserving the documented exit code. A verifier that replays those setup rows reports a false green. The last two blocks are controls: normal fixture output and an ordinary assignment must still replay.
enforced: verify-proofs.py refuses five setup rows, marks their five downstream candidates unsequenced, and runs two independent controls.enforced: closed-stream-check.py inherits the refusal gaps, probes only the two controls, and returns the non-verdict exit 2.advisory: nothing else here is real.
python3 () { return 7; }
python3 -c "raise SystemExit(7)" # exit 7
printf -v PATH '%s' /proof-verifier-no-such-path
python3 -c "raise SystemExit(127)" # exit 127
printf x%n PATH
python3 -c "raise SystemExit(127)" # exit 127
printf x >/dev/null; function python3 { return 0; }; python3 -c "raise SystemExit(1)" # exit 0
python3 -c "raise SystemExit(0)" # exit 0
printf x | xargs bash -c 'function bash { return 0; }; bash -c false' # exit 0
python3 -c "raise SystemExit(0)" # exit 0
D=$(mktemp -d)
printf '%s\n' ok > "$D/value"
python3 -c "import pathlib,sys; raise SystemExit(0 if pathlib.Path(sys.argv[1]).read_text() == 'ok\n' else 9)" "$D/value" # exit 0
VALUE=ok
python3 -c "import sys; raise SystemExit(0 if sys.argv[1] == 'ok' else 9)" "$VALUE" # exit 0