This folder preserves the project’s reviews of commit
9e95c989c0ea85cbe08dbcf63865e17cec71095f, before the iam-core 1.1 rewrite.
The current normative specification is IAM.md, and its current
conformance artifacts are outside this historical folder. Our own work is
identified as review; the supplied critique is preserved under its original
title and filename, first-audit.md. Our review and tooling were prepared with
Codex agents under maintainer direction. See authorship and provenance
for the distinction between project work, supplied texts and an independent audit.
IAM-1.0.snapshot.md contains the original IAM.md from
that commit, using the CRLF line endings of the reviewed working copy. Its
SHA-256 is:
6632647fbaba445e4667a17a5aca3dcb5acda6f5e777ac6efa1453a4b507a06d
The historical findings, computed results and source snapshot are preserved.
Repository paths and our review terminology were updated when this folder was
renamed to reviews/; this includes replay-command metadata in the graph JSON.
The IAM.md source-path metadata and REVIEW.cs.md line references
identify this baseline, not the current root specification. The default source
paths in text_checks.py and crypto_checks.mjs point to the local snapshot;
their checks were not rewritten for 1.1. A fresh text-check result
will name IAM-1.0.snapshot.md in spec_file; that metadata difference does
not change the checked source bytes or historical findings.
first-audit.md is the original supplied audit.
proposal-review.md is the later review of the proposals,
copied byte-for-byte from the supplied attachment. Its SHA-256 is
6ac4d8e48a290b6a375c7f13b1e3a81ca00bbb21544cc608e473fbdbe2d407dc.
review-resolution.md records the disposition of that
review in 1.1. The historical proposals remain under
proposals/ with historical-status notices.
text_checks.py checks wordlist membership, the ten claimed homophone pairs,
epoch/header conversions and the 32-bit birthday calculation. It is not a
complete phonetic survey.crypto_checks.mjs exercises the reviewed source with public synthetic
fixtures and the local Node/OpenSSL provider. Environment metadata and
provider-dependent results may differ on another runtime. Argon2 coverage
requires a Node runtime providing crypto.argon2Sync.graph_counterexamples.py preserves the symbolic model of the original
pseudocode. It does not verify real signatures or establish 1.1 conformance.The scripts normally write JSON next to themselves. To preserve the checked-in historical results, run copies in a temporary directory. From the repository root, this PowerShell example uses Python and Node available on PATH:
$reviewReplayDirectory = Join-Path ([IO.Path]::GetTempPath()) ('iam-review-replay-' + [guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $reviewReplayDirectory | Out-Null
Copy-Item -LiteralPath 'reviews/2026-09-14/IAM-1.0.snapshot.md', 'reviews/2026-09-14/text_checks.py', 'reviews/2026-09-14/crypto_checks.mjs', 'reviews/2026-09-14/graph_counterexamples.py' -Destination $reviewReplayDirectory
python (Join-Path $reviewReplayDirectory 'text_checks.py')
node (Join-Path $reviewReplayDirectory 'crypto_checks.mjs')
python (Join-Path $reviewReplayDirectory 'graph_counterexamples.py')
For iam-core 1.1 verification instead, use the commands and references in the repository README. Historical review fixtures are not the normative vector suite for the new version.