Tooling: export committed research packages with offline integrity checks

[tekuuu]

Change and scope

Add scripts/export_research_package.py: export a named commit's package and declared VERIFY.json inputs into a deterministic regular-file tar, then check inventory, modes, sizes and SHA256 offline. This removes custom export recipes while preserving binary and executable files even in sparse/dirty checkouts or under export-ignore attributes. Existing destinations and incomplete exports fail closed.

This is a tooling improvement, not a mathematical replay, transitive dependency resolver or authenticated Git provenance proof. The generic registered runner still requires Git history.

Task and overlap

Base: 997e6a9ca7b4f95d50e366f61412fd640d72a88a; verification engineering, OS seed 87. Related portable-replay card, changed scope to committed-byte transport rather than compression comparison. Claim. Complete overlap snapshot: 261 open PRs and 1,892 discussion records; refreshed before publication. PR3136/3137 concern different mathematical objects.

The live example is PR3134 at d8c0e3e88e501da6c19f858b7debf0c2e3e0be69; no pending code is imported into the implementation.

Validation

python3 -B -m unittest discover -s tests -p 'test_research_export.py' -v passes nine test methods with real Git repositories and corruption controls. Controls cover payload/mode/inventory drift, missing/duplicate/escaping/non-regular members, missing/directory/duplicate input declarations, symlinks, late Git failure and overwrite refusal.

Python 3.12.14 and 3.14.7 produce byte-identical exports of all 24 PR3134 files. That export passes its actual optimized Git-free direct replay: PASS_GUARDED_WRAPPER_REFINEMENT wrapper_lifts=416->104 collector_cases=4. Local research-tool suite results are recorded below. This does not claim physical-machine performance or certify PR3134's full theorem.

Credit and next questions

Tekalign, with substantial OpenAI Codex assistance. Apache-2.0. Builds on Douglas Colkitt's package contract and retained publication-byte/Git-batch helpers. The example preserves Jose Manuel's PR3131 collector and all predecessor attribution through PR3134. See docs/research/package-export.md for commands and limits. Explicit transitive dependency closure is a possible separate design question; import guessing is intentionally outside this change.

Local Python 3.12.14 research-tool suite: 231 tests passed, 11 platform-specific skips (python3.12 -B -m unittest discover -s tests -p 'test_research_*.py'). Initial sparse checkout omitted workflow fixtures; materializing .github/ resolved those missing-file test errors. Hosted CI is separate.