External real-defect replay of the subject-bound evidence composition rule: frozen protocol, codebook and oracle (version 2.0)

Frozen protocol, version 2.0, of an external real-defect replay that tests the subject-bound evidence composition rule (Allow = B∧P∧E∧S∧A∧M and its extended form) against authorization and verification defects that maintainers of open-source projects fixed, published as GitHub Security Advisories. The deposit holds every frozen file: the protocol, the codebook, the screening prompt, the advisory search script and its keyword table, the embargo filter, the screening merge script, the oracle (the vendored published rule and corpus, the decoders, the pairing table, the identity-test log and the tests), the case-file schema and checker, and the analysis script, together with FREEZE-SHA256SUMS, its OpenTimestamps receipt FREEZE-SHA256SUMS.ots and FREEZE-RECORD.md, which names the freeze commit that seeds the frozen order of the screening list. The kill rule, the hypotheses and the analysis were fixed before any screening, replay or oracle output existed. Not included: EMBARGO-EXCLUSION-LIST.txt, the sealed list of packages under a coordinated disclosure embargo that ends on 2 November 2026. Its SHA-256 is in FREEZE-SHA256SUMS; the list is added as a new version of this record after the embargo ends. Until then sha256sum -c FREEZE-SHA256SUMS reports that 1 file is missing and every other file as OK. Verify: unzip the archive, then run sha256sum -c FREEZE-SHA256SUMS and ots verify FREEZE-SHA256SUMS.ots.