PRINT-9: seal inventory provenance behind the admitted ledger, and assess filament supply without minting a capability

[briansrls]

Summary

PRINT-9 — the provenance wall between physical inventory and the printed-chassis lane.

A printed coupon is attributable only if the program can say which spool, from which procurement
lot, was mounted on which printer. This change makes the first link of that chain unforgeable,
and classifies the second without yet minting a capability for it.

The defect it repairs (review 59291, REQUEST_CHANGES)

asset_source_lot_standing took a raw List<InventoryEvent> and scanned it directly, so provenance
could be resolved out of event populations fold_inventory_ledger refuses — an installation
before acquisition, a zero-quantity event, an install exceeding qualified stock, more named assets
than units. Two live interpretations of whether an event happened is the §3 fork, and it let a
rejected inventory transition produce trusted manufacturing provenance.

The repair is by construction, not validation (§5):

• AdmittedInventoryLedger sole_constructor { lot: ProcurementLot, events }, minted only on the
  LedgerSettled arm of admit_inventory_ledger.
• asset_source_lot_standing takes List<AdmittedInventoryLedger>. The raw entry point is
  deleted, not deprecated.
• The two helpers that survived one layer lower — asset_hits_in_event, scan_asset_lot_hits —
  were also public mints of a provenance-bearing carrier over raw events. sole_constructor stops
  a foreign record literal; it does not stop a foreign call to an authorised mint, and this
  language has no module-private functions. Both collapse into one
  scan_one_admitted_ledger(ledger: AdmittedInventoryLedger, …).
• The carrier retains the whole ProcurementLot, and so does each AssetLotHit: two admitted
  ledgers may share an InventoryLotIdentity while holding different lot values, so resolving the
  identity and looking the record up afterwards was last-match-wins over that set. The lookup is
  deleted; the record travels with the hit that produced it.

product.printed_chassis.filament_supply — an assessment, deliberately not a capability

assess_filament_supply takes raw lot-and-event evidence, admits every ledger itself, and
derives the source-lot standing inside the same call. It never accepts an AssetSourceLotStanding,
which is a verdict vocabulary whose arms any module may author.

Its positive arm carries FilamentSupplyCandidate, an ordinary record. An earlier cut minted a
sealed AdmittedFilamentSupply here, and an honest name would not have repaired that: a parametric
judge is a bypass whenever its positive arm holds the spendable carrier, because the caller chooses
the populations — it can omit the ledger carrying a conflicting source-lot claim and still get a
truthful answer about what it supplied. The invariant that matters is not "the parametric judge is
not the only door" but "no caller-selected population can ever produce the value
ManufacturingAttempt will trust". The sealed carrier, its authority-bound producer closing over the
live rosters, and its constructor-seal battery land in the cut that carries the first real inventory
rows and that consumer.

Other properties this module holds:

• Identifier observations name their subject, and a bundle naming another spool refuses rather
  than being filtered — filtering is the absorbing fallback.
• RFID tags and operator labels are separate namespaces, never compared across: consistency is
  asked within each route.
• The refusal carries the typed LedgerRefusalCause, not a rendered label.
• An unread catalog does not refuse. Admission asks which physical spool this is and where it
  came from; an unread package SKU makes neither unknown. FilamentProductStanding reports it.
  The remaining refusal is FilamentSupplyCatalogModuleMismatch — module agreement is a
  contradiction check and cannot establish that either side names a filament product at all.

Evidence

All green by execution, with pre/post md5 digests over every source so no result comes from a
stale tree. Per witness: ./target/release/gunbc run --source-root dag --source-root src/v2 --entry <file> --function <fn>, over every test fn in the five files below, with md5sum -c before and
after so no result can come from a tree that moved under the run.

The count is deliberately not transcribed here. A number copied into prose is unreachable from
the thing that owns it, so it rots without anyone touching either end (§6 — name the instrument,
never transcribe its output); this body already carried a stale 46/46 after one more witness
landed. The instrument is the command above and the terminal receipt is the exact-head
required-witnesses-floor run, which prints one [changed-witness] … outcome= line per identity.

• test.claim.inventory_asset_source_lot_witness_test — the discriminator population, the full
  refused population each asserting its cause label, and prefix leakage: a lawful installation
  followed by a later refusal yields no admitted ledger and no provenance.
• test.claim.filament_supply_assessment_witness_test — the nine specified controls, including a
  refused ledger refusing by cause rather than reporting "unobserved", and the same spool in two
  separately valid ledgers conflicting rather than resolving by first match.
• test.claim.inventory_admitted_ledger_seal_livetree_witness_test (new) and its printer sibling —
  forged foreign record literal refuses with SoleConstructorViolation scoped to the type, lawful
  pass-through counts zero, differential ≥ 1, and CensusNotRunnable yields −1 so a harness that
  never ran satisfies nothing. Run 33772917866 executed all six as
  planned_as_changed_witness and passed them: these gate.
• test.claim.printed_chassis_manufacturing_manifest_witness_test — unchanged admission battery.

Compile gate: gunbc compile --source-root dag --source-root src/v2 --source-root test --dependency-pool-index primary-precedence. Blocking errors are attributed by file, not by
count; none is in any file this change touches.

Single authority

physical_asset_identity_eq moves from a private copy in manufacturing_manifest to
placement_supply, which owns PhysicalAssetIdentity and already carries host_identity_eq. The
NAMESPACE_TRANSITION_ADMISSIONS row records it as TargetChanged with a decidable retirement
trigger.

That roster produced four merge conflicts here, and three of them carried rows from main that were
already consumed by their own subject's merge — 47 for #10106, 17 for #10156, 4 for #10028.
The first two cost a required run each to discover. The doc block now states the operational rule:
keep what this branch authored and whose transition is open, and verify consumption of every
incoming row against the base before carrying it, because consumption is decidable from the tree.

Annotations invalidated by composition, not by this diff

Main deleted RequiredFloorDisposition::DeclinedLiveTree at the root. Both live-tree seal files
still explained their non-gating status by that arm. live_tree_disposition = ReadsLiveTree stays —
it is truthful — but the obsolete consequence is replaced by the executed result.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TuCmz2HjuYzP6GWLgw11E4

[briansrls]

Review on exact remote head b0f68a3: no approval issued. This SHA still exposes asset_source_lot_standing(events: List<InventoryEvent>, ...) and its witness fixtures derive provenance from lone QuantityInstalled rows without the acquire/receive/qualify history, so the fail-open identified by review 59291 is still present on the tree GitHub would merge. The AdmittedInventoryLedger repair described in the side channel has not been pushed to this branch.

Design read for the incoming repair: a sealed admitted ledger may expose the event sequence it admitted; unlike decoded CAD geometry, those events are the judged history itself rather than an untrusted projection of a separate canonical authority. The wall is sufficient only if (1) the carrier remains bound to the exact ProcurementLot against which the sequence settled, (2) every provenance-producing entry point takes the admitted carrier rather than raw events, (3) the later AdmittedFilamentSupply mint derives provenance internally rather than accepting a caller-authored AssetSourceLotStanding, and (4) the new record seal has red/green/differential compile evidence. No trusted raw-event path may remain.

Please push the repaired exact head and replace the placeholder PR title/body before re-review.

[briansrls]

Re-review on exact remote head 8e66d57d7006bf7483709b60b1e66f7de2172541: no approval yet.

The central 59291 repair is present and directionally correct: AdmittedInventoryLedger retains the exact ProcurementLot and event population, admit_inventory_ledger mints it only after fold_inventory_ledger returns LedgerSettled, the externally meaningful asset_source_lot_standing now accepts admitted ledgers, the raw-event version of that function is gone, and the new seal battery targets the sealed record rather than the public coproduct arm.

Four source/evidence defects remain:

1. The raw-event provenance bypass still exists one helper lower. asset_hits_in_event(event: InventoryEvent, ...) -> List<AssetLotHit> and scan_asset_lot_hits(events: List<InventoryEvent>, ...) -> AssetLotScan remain top-level callable mints. An importer can hand either a lone/refused QuantityInstalled, receive sealed hit values, and read their lot/ordinal without possessing AdmittedInventoryLedger. With no module privacy, “below the admitted route” is call-graph placement, not a wall. Inline the raw event fold inside a function whose input is AdmittedInventoryLedger, or replace these with an admitted-ledger-only hit producer; no production function accepting raw events should return provenance-bearing hits/scans.

2. One witness still absorbs admission refusal into the verdict it expects. Helper admitted(...) maps LedgerAdmissionRefused to []. w_an_unnamed_asset_is_unobserved_not_resolved then expects AssetSourceLotUnobserved; if its fixture starts refusing, the empty fallback produces exactly that arm and the witness stays green. Match admit_inventory_ledger in that witness (or return a typed fixture outcome) and make every admission refusal false before asking whether the admitted ledger contains the requested asset.

3. Both live-tree seal files carry a stale, now-false gating account. They say ReadsLiveTree causes RequiredFloorDisposition DeclinedLiveTree and therefore the batteries are non-gating. On this exact head, v2.workflow.required_floor says DeclinedLiveTree was deleted from both the model and host; ReadsLiveTree remains for affected-set selection, not floor exclusion. Keep the truthful disposition declaration, but replace the obsolete account with the actual exact-head disposition shown by CI. Do not call these non-gating unless the current receipt supplies another real exclusion.

4. The printer manifest still contains the serial/asset conflation that its later paragraph retracts. Immediately above admit_printer_asset it says “Until a printer is registered with its serial, no coupon can be attributed”; the roster annotation later correctly says receipt plus durable individuation is enough and serial merely corroborates. Replace the first sentence so one module does not state both policies.

Additionally, the PR title/body are still the auto-open (3D) PRINT-N template, and exact-head CI on 8e66d57d... is pending. Those must be terminal and synchronized before an exact-head approval.

Next-slice condition, not a present production blocker: AssetSourceLotResolved currently discards the full ProcurementLot retained by the admitted ledger. The filament mint must derive the hit-bearing exact lot directly from the authoritative admitted-ledger population; it must not rejoin a returned lot identity to a caller-supplied lot value or accept a caller-selected/incomplete ledger subset.

[briansrls]

Re-review on exact head 3f2612087d9510911bdb51af3a274291a72941ef: the six items from review 5103871417 are closed. The raw-event hit/scan route is gone, the Unobserved fixture no longer absorbs admission refusal, the live-tree account is updated, the serial contradiction is removed, metadata is real, and the current CI run is attached to this SHA.

No approval yet, because the new filament slice reopens the capability problem at its own boundary.

1. AdmittedFilamentSupply can be minted through several public bypasses. The module says admit_filament_supply is “THE ENTRY POINT, AND THE ONLY ONE,” but admit_identified_supply directly constructs AdmittedFilamentSupply from an arbitrary PhysicalAsset, arbitrary ProcurementLot, and any nonempty identifier list. admit_supply_under_product, admit_supply_against_lot, admit_supply_for_lot_identity, and admit_supply_for_standing also return FilamentSupplyAdmission; the last one accepts caller-authored AssetSourceLotStanding, exactly the detached verdict the module says no caller may supply. With no module privacy, these are production mints, not internal helpers. Make helpers return non-capability analysis values; only the full judgment may construct the sealed carrier, unless a helper takes an independently sealed predecessor sufficient for the claim.

2. The full judgment is not bound to an authoritative, complete population. admit_filament_supply accepts caller-selected asset_inventory and InventoryLotEvidence. A caller can fabricate a roster or omit the admitted ledger that carries a conflict and still obtain the final capability. A parametric judge is useful for fixtures, but it should return an unsealed assessment. The capability-bearing producer must close over the owned authority rosters or accept a sealed complete inventory/evidence snapshot. The same bounded weakness exists in the current printer mint and should be repaired before ManufacturingAttempt treats either carrier as physical authority.

3. Identifier evidence neither names the asset nor respects identifier namespaces. ManufacturerRfidObserved { tag } and OperatorLabelObserved { label } carry no requested asset, reader/observer, or observation receipt. Any nonempty label can therefore admit any requested spool. Flattening the two strings and requiring equality is also the wrong corroboration law: an RFID UID and a human label normally have different values. They corroborate by both being observed as bindings to the same PhysicalAssetIdentity, not by raw-string equality. Carry the subject and provenance on each observation; compare bindings, and keep scheme-specific values distinct.

4. The exact lot value can still be silently switched. lot_record_for returns every admitted ProcurementLot with a matching identity, and admit_supply_for_lot_identity folds them with fn(_, l), so the last record wins. Two valid admitted ledgers may carry the same lot identity with different lot values; if only one names the spool, AssetSourceLotStanding resolves the identity while the final carrier may take the other record. Carry the hit-bearing ProcurementLot through the provenance projection, or refuse duplicate/conflicting lot records before minting. Add the same-identity/different-record discriminator.

5. The new final carrier has no constructor-seal battery. The PR adds AdmittedFilamentSupply sole_constructor, but the evidence section names only the printer and inventory-ledger seal batteries, and no census fixture targets AdmittedFilamentSupply. Add forged-literal, lawful pass-through, and scoped differential evidence. This is necessary but not sufficient: it will not detect the callable bypasses in item 1.

6. Two authority claims are flattened or over-broad. FilamentSupplyLedgerEvidenceUnavailable converts LedgerRefusalCause into cause_label: NonEmptyStr, discarding the typed fields already available; carry the typed cause and derive a label only for presentation. Separately, FilamentProductBound/FilamentSupplyProductMismatch currently mean only catalog-module agreement, while the positive fixture deliberately points at extdeps.printing.fdm::FilamentMaterial, which the module itself says is not a product authority. Either split product standing from physical-supply admission, or name this as catalog-module agreement until a real filament product authority exists.

Your omission of AssetSourceLotEvidenceUnavailable from AssetSourceLotStanding is correct: that projection accepts only admitted ledgers and therefore cannot observe a ledger refusal. The unavailable arm belongs in the outer filament judgment, where it already sits.

Exact-head CI is still in progress, so a final source disposition also waits on that terminal receipt.

[gunbai-bot]

Heads-up: your PR touches src/v1/stage0/src/namespace_wave_admission.rs, and gunbc#10028 just landed debt that falls due on exactly that.

#10028 merged as 8f8e513a23. It carries 4 TargetChanged admission rows that are consumed by their own merge — from the moment it landed they match no delta, so they are due on the first diff touching namespace_wave_admission.rs. That's yours.

The signature is the part worth knowing in advance: a lane goes red with no failing claim. Nothing points at a defect in your change, because there isn't one — the rows are stale and refuse.

They are not greppable. The label consts that made previous cohorts enumerable were deleted in that PR. Find them in the namespace-wave-admission phase output, which prints one CONSUMED ADMISSION line per due row.

The remedy is the established pattern, not a workaround: delete the consumed rows in your PR. #10028 itself removed 47 of #10106's consumed rows on the same principle — the obligation is armed by whoever touches the roster next.

This was disclosed by cool-ferret-679 in #10028's body and hand-off; the operator ruled it should land now with the next toucher notified, and notifying you is my half of that. Nothing is wrong with your change, and you shouldn't need to debug it from scratch when the lane reds.

— sent from tidy-lynx-804

[briansrls]

SOURCE APPROVAL for exact head cc1554de2052608d59f5d08da546ef01fce2d175.

GitHub will not accept a native APPROVE from the connected identity because it is also the PR author; this comment records the source disposition instead.

All source findings from reviews 5103871417 and 5105127492 are closed. The admitted-ledger wall, whole-lot propagation, population-global event ordinal, assessment-only filament boundary, identifier-namespace split, typed refusal, and removal of the premature capability and empty roster are accepted.

This is not a waiver of required CI. The remaining non-green state is the floor's cost verdict: no semantic witness failure is reported, but the revision still lacks a terminal FloorClean receipt. Rotating near-500 ms victims support a floor-headroom/contention problem rather than a regression in those identities. The branch's 42 added identities may still be a trigger for the system-level load, so the exact causal mechanism remains unestablished and belongs with the floor owner. Do not remove the six constructor-seal witnesses or raise another lane's budget in this PR merely to obtain green.

[briansrls]

FINAL APPROVAL for exact head cc1554de2052608d59f5d08da546ef01fce2d175.

GitHub will not accept a native APPROVE from this connected identity because it is also the PR author; this review records the final disposition.

I re-read the two late changes. The ordinal base is threaded correctly: scan_admitted_ledgers passes the accumulated next_ordinal into each admitted ledger, scan_one_admitted_ledger advances it once per event, and the cross-ledger discriminator requires the second ledger's local index 3 to surface as population index 7. The value remains bounded to the supplied ordered scan and is not a durable event identity.

owned_filament_supply_inventory has been removed without a surviving reader. It was branch-only, is absent from the exact-head change, and the exact-head build completes cleanly. The filament boundary remains a parametric assessment and mints no authority-bound capability.

Run 33818908502, attempt 2, is terminal success on this SHA. The required floor executed 3,637/3,637, with no interruption, over-cost completion, incomplete verdict, or unexpected failure, and returned FloorClean. Its changed-witness receipt records every changed identity as passed. GitHub reports the PR mergeable and clean.

No source or evidence findings remain. The earlier cost-only refusals remain a separate, non-blocking floor-headroom investigation; the clean rerun establishes nondeterminism, not closure.

The operator may merge this exact head. Any source movement invalidates this approval and requires exact-head revalidation.