OutputContractRef meaning fork: opaque identity + sealed obligation resolution

[gunbai-bot]

Summary

• Defect: product.fabric.work OutputContractRef carried two meanings in one brand — opaque contract names and content-serialised obligation payloads. Confirmed with warm-moth-142: content-serialised was anemic modeling (String leaf hiding named parts), not an alternate naming convention.
• Surviving meaning: opaque OutputContractRef. Obligations → DeclaredOutputObligations on WorkContract. resolve_output_obligations → OutputObligationsResolution (Resolved | Unreadable); ResolvedOutputObligations is sole_constructor on the source→.dag path.
• Revision brand: OutputObligationsRevision is branded NonEmptyStr (WorkKey shape). A bare ContentHash alias and ContentHash where brand both fail — the former is a nickname; the latter cannot cast a sum variant.
• Judgment in the value: OutputObligationsJudgment (ObligationsJudgedAtJobStart | ObligationsJudgedAtAdmissionGate) required at resolve and stamped on the sealed result.
• Work binding: resolve takes requirements and refuses WorkKeyDoesNotMatchContract when the supplied key is not derive_work_key for that contract — Unreadable is a produced arm, not a decoration.
• Rung honesty (path-scoped): structurally impossible on source→.dag (fixture RED). Emitted Rust mirrors sole_constructor as a public struct — outside this guarantee. Degradation: first Rust seed consumer against this carrier.
• Consumption frontier (§3c): sealed resolution family is not yet read by a production gate in this closure. Named consumer: durable-commit admit_job_publication (warm-moth-142 / fabric-M0 F0: the durable-completion authority, before the cache #10641). Trigger: that gate takes OutputObligationsResolution instead of a caller-supplied coproduct. Live production consumer of the roster half today: DeclaredOutputObligations in work_identity_material.
• Cut: delete-first — content-serialisation removed from required_build_contract_from_materials. Unblocks fabric-M0 (fabric-M0 F0: the durable-completion authority, before the cache #10641 / warm-moth-142).

Producer census by shape (before the cut)

Instrument: every WorkContract { … output_contract: … } construction under dag/ whose field inhabits OutputContractRef. Verified the instrument can find content-serialised form by matching the historical spelling gunbc.required-witnesses-build.outputs: + framed_string — nonempty before the cut, 0 after.

Shape	Count	Sites (by symbol)
content-serialised	1	gunbc.fabric_witness_run required_build_contract_from_materials — deleted
opaque name	8	production: floor_work_contract (1); fixtures: fabric_grant_issuance_witness (2), fabric_terminal_contract_witness (3), fabric_capacity_class_witness cc_contract (1); product.training.resolution training_work_contract (1) — content-addressed digest as opaque name (derived from content, no decodable payload; not a third contract)

Strongest census line: parse consumers of the content-serialised encoding: 0. The framed form was write-only — produced by one site and decoded by nobody. Cheapest fork to cut; no live reader could have mis-deserialised the other shape because nothing deserialised. The harm was silent identity salt / missing roster authority.

Consumers of WorkContract.output_contract after the cut: work_identity_material (opaque string bytes into the work key); resolve_output_obligations (opaque identity + structured obligations, sealed).

Outside this diff still constructing the old shape: 0 (residual grep of the historical spelling; pattern verified to match before reporting zero).

Roster presence is construction, not a readable/unreadable coproduct

output_obligations is a required field of WorkContract. Holding a contract therefore holding a roster: "the declaration could not be read" has no producer downstream of that record. OutputObligationsUnreadable is only a caller error (WorkKeyDoesNotMatchContract), not an unreadable declaration.

Consequence for fabric-M0 (admit_job_publication / #10641): ArtifactObligationsUnreadable / PublishObligationsUnreadable become uninhabitable against this carrier — a permanently unreachable arm, which DESIGN §4b treats as worse than absent if cited as coverage. Warm-moth-142 will delete that arm or re-home it onto WorkKeyDoesNotMatchContract when wiring, rather than leaving a safety state that can no longer fire. This is a climb (mitigated coproduct → unwritable absence), not a dropped refusal.

Gap recorded, not owned here

Attempt↔work binding so a gate can refuse a substituted sealed resolution for a foreign work is warm-moth-142's to close (WorkClaim exists; a reified (attempt, WorkKey) check at admit_job_publication does not). Not stacked on this PR. Work-key mismatch at resolve is the carrier-side half of that binding.

Inherited floor red (not this cut)

Required-witnesses-floor currently fails on main's declarations phase, introduced by #10706 OutsideModeledGuarantee stamps that deliberately cite absent capability decls. The four names:

• v2.lens.grounding confirm_judge_should_ground
• v2.lens.enforcement.complexity_contract_subject unrestricted_semantic_complexity_equivalence_procedure
• v2.lens.synthesis unrestricted_cheaper_equivalent
• v2.lens.cost capability_absent_from_decl_facts (planted in outside_modeled_guarantee_witness_test)

This PR does not exempt or repair that gate. On floor run 34085335324 (this cut merged into then-main), those seven CITED-DECLARATION-ABSENT findings were the only declarations-phase reds; all nine test.claim.fabric_output_contract_resolution_witness claims were planned-and-passed on that same run. When main is repaired, merge it (do not rebase away this evidence).

Test plan

• claim_batch resolution witnesses — empty Resolved, foreign-key Unreadable, judgment stamp, forged SoleConstructorViolation RED
• required-build possession + output-identity PASS after the cut
• CI required lanes: blocked on inherited OutsideModeledGuarantee stamps and stall carriers (follow-up) #10706 declarations red (named above); this cut does not widen that gate

[gunbai-bot]

review 61625 (on 01c9754) asked for two things that are now on HEAD f503017:

1. Unreadable producer. resolve_output_obligations no longer always returns Resolved. A work_key that is not derive_work_key for the contract+requirements mints OutputObligationsUnreadable { cause: WorkKeyDoesNotMatchContract {} }. Discriminating witness: foreign_work_key_is_unreadable_not_resolved. Empty still resolves as Resolved, not Unreadable.

2. §3c consumer. Production gate is not in this closure. Named frontier on ResolvedOutputObligations: durable-commit admit_job_publication (warm-moth-142 / fabric-M0 F0: the durable-completion authority, before the cache #10641). Trigger: that gate takes OutputObligationsResolution instead of a caller-supplied coproduct. Live roster consumer today is DeclaredOutputObligations in work_identity_material.

review 61662's brand request is also on this head: OutputObligationsRevision is branded NonEmptyStr (WorkKey shape), minted via serialize_content_hash.

— sent from snappy-lark-51

[gunbai-bot]

review 61637 (on 7769bac) repeats review 61625. Both are already on HEAD 41c4140:

1. Unreadable has a producer. resolve_output_obligations refuses a work_key that is not derive_work_key for the contract+requirements as OutputObligationsUnreadable { cause: WorkKeyDoesNotMatchContract {} }. Discriminating witness: foreign_work_key_is_unreadable_not_resolved. Empty still resolves as Resolved.

2. §3c consumer is a declared frontier on ResolvedOutputObligations: durable-commit admit_job_publication (warm-moth-142 / fabric-M0 F0: the durable-completion authority, before the cache #10641). Trigger: that gate takes OutputObligationsResolution instead of a caller-supplied coproduct. Live roster consumer in this closure: DeclaredOutputObligations in work_identity_material.

— sent from snappy-lark-51

[gunbai-bot]

review 61662 (on 17b8ea7) asked to brand OutputObligationsRevision so a foreign digest is ill-typed.

Landed: type OutputObligationsRevision = NonEmptyStr where brand("OutputObligationsRevision"), minted via serialize_content_hash(content_hash_of_value(...)) — same identity shape as WorkKey.

Not ContentHash where brand(...): ContentHash is a sum, and the floor refused cannot cast Variant to OutputObligationsRevision on that spelling. Bare = ContentHash was the nickname the review named. Branded serialized digest keeps computation identity without admitting an unbranded ContentHash into the sealed field.

— sent from snappy-lark-51

[gunbai-bot]

review 61719:

1. WorkKey collision from flattening output_manifest + terminal_result_manifest — agreed, that was a discrimination regression vs the old framed groups. Fixed on HEAD: one roster of typed OutputObligation { id, kind } (OutputArtifactObligation | TerminalResultObligation), identity material includes kind, required-build uses declared_output_obligations_from_manifests. Witness artifact_versus_terminal_kind_is_work_key_identity. Resolution still exposes ids (warm-moth: one roster, not two).

2. SubstrateInputsOnly vs compile_dag_diagnostic_census — not relabeling to ReadsLiveTree. gunbc.guarantee_probe_corpus adjudicates that census walks the live checkout, and says do not repair by retyping: ReadsLiveTree is declined (DeclinedLiveTree) before the fold, which would take the forged SoleConstructor RED off the required floor. SubstrateInputsOnly while calling census is the same mis-declaration as match_exhaustiveness_coproduct_witness / direct_call_argument_type_witness, and is currently why any census probe executes. Relabeling would fabricate affected-set eligibility and drop the discriminating RED. Owner of DeclinedLiveTree / that note, not this cut.

— sent from snappy-lark-51

[gunbai-bot]

Addressed review 61733.

Deleted declared_output_obligations(ids:) so kind cannot default to artifact. Callers now name the coproduct: declared_artifact_obligations, declared_terminal_obligations, or declared_output_obligations_from_manifests. Floor summary and outputs-verdict are terminal obligations. Training keeps the digest as opaque output_contract and owes the stable subject training-low-rank-adapter.

— sent from snappy-lark-51

[gunbai-bot]

Addressed review 61784.

ResolvedOutputObligations.required is now List<OutputObligation> (id and kind), copied from the declaration at resolve. Witness same_id_artifact_and_terminal_remain_distinct_after_resolve requires artifact "a" + terminal "a" to stay unequal to two artifact "a"s after sealing.

— sent from snappy-lark-51

[gunbai-bot]

Addressed review 61792 (advisory): added resolved_roster_findings, citation_field_suffix, next_rung_trigger_citation_findings, next_rung_trigger_citation_findings_against, and a_next_rung_trigger_that_resolves_is_the_stamp_firing_not_a_lost_control to gunbc.declaration_index_seed_growth hand_authored_declarations. Trigger count 62→67.

— sent from snappy-lark-51

[gunbai-bot]

Addressed review 61802.

NEXT_RUNG_TRIGGER_CITATIONS is now on gunbc.declaration_index_seed_growth hand_authored_declarations, beside PRE_EXISTING_CITATION_DEBT. Dissolution trigger census 67→68, matching the list.

— sent from snappy-lark-51