PHASE 5b — COMPARATOR TOOLCHAIN IDENTITY
Captured: 2026-08-06

================================================================
COMPONENTS PINNED BY THE REPOSITORY (lake-manifest.json)
================================================================
Component     Revision (observed = manifest pin)          Binary SHA-256
Comparator    07bc4ea40f2266dcb861820a2ec1fa3244ed307f    4ffd95f2708428ad712c24d8afcb9804d91b8cc4d49edbd5d61c3d0ecb93be42
lean4export   4e7915201d3f9f04470d9eae002fa695f7cdc589    e57369980b0b81228580ce08066fb9bd738e717e002673a143f4956d217266b0
Lean4Checker  b7398199245524275543dec6113229c9bb4902e5    (Lean library, no standalone binary)

All three observed revisions MATCH the manifest pins exactly. Verified by
`git rev-parse HEAD` in each .lake/packages/<pkg> directory.

Binaries built with:
    lake build @Comparator/comparator @lean4export/lean4export
    exit 0, 25 jobs, "Build completed successfully"

================================================================
COMPONENTS *NOT* PINNED BY THE REPOSITORY (external, floating)
================================================================
landrun       v0.1.18  (go install github.com/zouuup/landrun/cmd/landrun@main)
              SHA-256: c6104a646c996a3b78bcb9f71341e47d8ad814728ca8fcd2618222b14bd443a1
              Go toolchain: go1.26.0 linux/amd64

nanoda_bin    git 418320295890faed83a96fd97907b12a3b6728c2
              (github.com/ammkrn/nanoda_lib, cargo build --release)
              SHA-256: 47cad31a87aa8e56e3e57fa890b911305a3049da06637136fef5b42d4c35b6f0
              Rust: cargo 1.93.1 (083ac5135 2025-12-15)

THIS IS AN AUDIT-RELEVANT ASYMMETRY, recorded deliberately:

The repository pins Comparator, lean4export, and Lean4Checker to exact
commit SHAs in lake-manifest.json. It does NOT and CANNOT pin landrun or
nanoda_bin — those are external binaries the checker README instructs the
user to install themselves, and it names a MOVING TARGET for one of them:

    "landrun, compiled from the `main` branch's source, present in PATH"

`main` is a branch, not a tag or SHA. Anyone following these instructions on
a different day gets a different landrun. The build recorded here is
whatever `main` resolved to on 2026-08-06, namely v0.1.18. Reproducing this
audit exactly requires pinning landrun to the SHA behind that build; the
repository's instructions do not permit that.

The lean4export dependency is pinned by SHA in the manifest, but its
manifest `inputRev` is likewise `master` rather than a version tag — so a
`lake update` (never run here) would move it.

================================================================
NOTE ON A CASE-SENSITIVITY TRAP IN THE DOCUMENTED INSTALL
================================================================
The Comparator README links landrun as `github.com/Zouuup/landrun`
(capital Z). The Go module itself declares its path as
`github.com/zouuup/landrun` (lowercase). Following the README's casing:

    go install github.com/Zouuup/landrun/cmd/landrun@latest
    -> go: version constraints conflict:
       module declares its path as: github.com/zouuup/landrun
       but was required as: github.com/Zouuup/landrun

Recorded because it is a real, reproducible obstacle for anyone following
the documented procedure. Resolved by using the lowercase module path.

================================================================
KERNEL / SANDBOX SUBSTRATE
================================================================
WSL2 kernel        : 6.18.33.2-microsoft-standard-WSL2
Landlock LSM       : PRESENT AND ACTIVE
                     dmesg: "LSM: initializing lsm=capability,landlock,
                             yama,safesetid,selinux,ima"
                     dmesg: "landlock: Up and running."

So the host substrate DOES support landrun's sandboxing mechanism. Any
failure of the sandboxed path in this audit is not attributable to a
missing Landlock implementation.

================================================================
LEAN SIDE
================================================================
Lean       : 4.32.0 (commit 8c9756b28d64dab099da31a4c09229a9e6a2ef35, Release)
Lake       : 5.0.0-src+8c9756b
elan       : 4.2.3 (b6cec7e10 2026-06-08)
lean4export: reports exporter/format version 3.1.0, and embeds
             lean githash 8c9756b28d64dab099da31a4c09229a9e6a2ef35 / 4.32.0
             in its output metadata — confirming the exporter and the
             audited build agree on the toolchain.
