Derive the private-material ignore rows from repository visibility

[gunbai-bot]

What this is

A directory named private_overlay/, base_overlay/, wb62_overlay/ or privdag/ placed inside a public gunbc session worktree stages full file content on git add -A with no warning; a nested clone at private_repo/ stages a gitlink. The tracked .gitignore had no entry for any of them — protection so far was per-session .git/info/exclude local excludes, absent in a fresh clone and invisible until after a push.

The privacy fact has one home, and the ignore rows are derived from it. An earlier head of this branch declared an ignore reason ForeignPrivateMaterial { owner_repository: String } and authored five rows under it. That was a second, nicknamed representation of a visibility the corpus already models, and it is gone.

The six namespace admission rows, and why they are admissible (v1_seed_standing)

Moving RepositoryVisibility, PublicRepository and PrivateRepository to their resource module is a relocation the namespace wave adjudicates, so the required run refused with six unadjudicated TargetChanged deltas — three sites in extdeps.github.actions_token, three in test.claim.actions_job_grant_witness, every one of them base {extdeps.github.actions_token} -> head {extdeps.github.repository}. That is the wall working: gunbc.namespace_wave_admission states its rows exist for exactly this motion, "a spelling authored on both sides now resolves to a different module". The membership half was auto-admitted as ExplicitlyEvaluatedZeroDelta. hosted_runners produces no row — its arms were spelled PublicRepo/PrivateRepo, so they are new names at the head rather than rebinds.

The remedy is a row per delta, by exact identity, in NAMESPACE_TRANSITION_ADMISSIONS.

The admission, stated rather than left to inference. These six rows are admitted under gunbc.v1_maintenance_standing v1_seed_standing as consumed ledger entries, not a new escape hatch: they are DATA on an already-rostered declaration and add no function, no type, and no admission mechanism — the same standing the module's own justification records for the 53 such rows in PR 9436. They adjudicate one measured delta each, by exact identity, and are consumed by this PR's merge.

Deletion follow-up: #11316, authored before this PR was enqueued. Its trigger fires when this merges — base and head then both carry the relocation, the deltas stop being producible, and the rows report stale. Per the standing ruling it lands after this PR. Authoring it first is the condition that distinguishes a consumed ledger entry from an exemption, and it is why this change did not take the cheaper route of leaving the two forked spellings in place to avoid producing a delta at all — that would have been DESIGN §5's workaround, routing around the substrate rather than using it.

Where each fact lives now

• extdeps.github.repository (new) — ONE RepositoryVisibility, cited to the visibility field of GitHub's repository object. It was forked: extdeps.github.actions_token declared RepositoryVisibility = PublicRepository | PrivateRepository for the fork-token rule and extdeps.github.hosted_runners declared RepoVisibility = PublicRepo | PrivateRepo for the runner hardware tables — one concept, two spellings, free to disagree. Both import this type now, as do gunbc.runner_provider_survey and test.claim.actions_job_grant_witness.

• gunbc.repository — gunb-ai/gunbc and gunb-ai/gunbc-private as typed Repository rows. This is the single instance authority and it already owned the public one; the private row is new (nothing carried it) and its fields were read from the GitHub repository object, not assumed — full_name, private, default_branch = gunb-ai/gunbc-private, true, main. If either is flipped at the forge, this is the row to change and the projection follows. extdeps.github.repository repository_visibility maps the API's boolean alias to the typed coproduct, so "not world-readable" is asked of one row in one place.

  An earlier head of this branch authored a second instance row in gunbc.repo_identity — a sixth spelling of a fact gunbc.repository already owned, in a PR whose thesis is de-forking. That fork is deleted, along with the RepositoryVisibilityStanding type it needed; gunbc.repo_identity is back to its own subject (merge target and default branch).

• gunbc.workspace_repository_materialisation (new) — the compose contract: which repository is materialised under which prefix by which method. The staged shape is derived from the method (NestedClone → gitlink, FileCopy → full content) rather than authored beside it, because a row carrying both could declare a clone that stages full content, which no git does. The private half of the contract — the private repository's strategy.private_witness_workflow overlay_local_method — is cited by name and deliberately not imported.

• gunbc.gitignore_emit — DERIVES one ignore row per materialisation whose source repository is not world-readable, with the comment text derived from that visibility. No reason is authored per row. A new overlay spelling is a compose row over there and its ignore row appears here by construction.

• std.workspace_artifact and gunbc.repo_workspace — byte-identical to main; the whole authored-arm approach is reverted.

Evidence

Six witnesses PASS in test.claim.gitignore_gate (claim_batch --entry dag/test/claim/gitignore_gate_test.dag):

PASS witness_private_material_rows_are_derived
PASS witness_public_source_derives_no_ignore_row
PASS witness_private_material_paths_are_ignored
PASS witness_clean_does_not_drift
PASS witness_gitignore_gate_drift_receipt
PASS witness_has_header

The derivation is witnessed in both directions, because a filter that always passes and a filter that never fires emit the same green: over a mixed list, untracked_materialisations keeps exactly the private-sourced row, materialisation_must_not_be_tracked is false for the public-sourced one, and public_overlay_probe/ never reaches .gitignore. The negative on the other axis is kept too — dag/gunbc/private_direction_note.dag must stay un-ignored, so this is not a substring sweep.

A stronger control, since the witnesses share the emitter they test. Flipping gunbc_private_repository to PublicRepository and re-running the emitter:

$ gunbc run … --entry dag/gunbc/gitignore_emit.dag --function expected_gitignore \
    | grep -c '^private_repo/\|^private_overlay/\|^privdag/'
0        # visibility flipped to PublicRepository
3        # restored to PrivateRepository

One row flip removes every derived pattern. The rows follow the visibility fact rather than standing beside it.

Measurement — before and after, throwaway repo

Re-measured against the current head, so the receipt matches the bytes the PR actually carries. One scratch repo per side: five compose directories populated, a symlink at a materialisation prefix, and a nested fixtures/private_overlay/ path that no row claims.

Before (.gitignore as it stands on the merge base):

$ git add -A && git ls-files --stage
100644 d0584c4f3251… 0	.gitignore
100644 e97e9c7e8160… 0	base_overlay/dag/x.dag
100644 e97e9c7e8160… 0	private_overlay/dag/strategy/x.dag
100644 e97e9c7e8160… 0	private_repo/dag/x.dag
120000 0a7c3223a461… 0	private_repo_link
100644 e97e9c7e8160… 0	privdag/gunbc/x.dag
100644 e97e9c7e8160… 0	wb62_overlay/dag/x.dag

Every prefix stages full file content, and the symlink stages as 120000 with the target path as its blob.

After (this branch's derived .gitignore, blob 1d8aee59bc76, which is the committed file):

$ git add -A && git ls-files --stage
100644 1d8aee59bc76… 0	.gitignore
100644 57e6630bd00f… 0	fixtures/private_overlay/x.dag

Three properties in one run: the five directories are ignored; the symlink at private_repo is ignored (it is absent from the staging list, which the trailing-slash form did not achieve); and fixtures/private_overlay/ — nested, same-named, claimed by no row — stays trackable, which is the public material the anchoring protects.

What rung this is, and what it is not (DESIGN §4b)

Rung 2, mechanically preventable, at best. The derivation does not change that — it removes a second representation of the privacy fact, which is a §3 defect, not a §4b rung.

• git add -f bypasses a tracked ignore entirely.
• An ignore reaches nothing already committed; this row has previously watched auto-push publish exactly that shape with a clean git status.
• The guard is path-shaped while the hazard is content-shaped, and the prefix is a parameter of the producing recipe — so the rostered prefixes are the ones observed, not the set that can occur. The derivation makes adding a spelling one row; it does not make an untyped spelling safe.
• It is real only while it stays enrolled: deleting a materialisation row, or a visibility standing that stops being true at the forge, silently reopens the vector.

The row's next-rung trigger is unchanged and undischarged: the private-witness step must materialise its overlay outside the public checkout. An ignore naming prefixes inside the worktree is by construction not that capability, and the receipt says so rather than narrowing the trigger to what it just built.

Not in scope, stated rather than left silent

The same upstream fact is spelled two more times: extdeps.github.github Repository.private: Bool and extdeps.github.code_search CodeSearchRepository.private: Bool. Those are the API's boolean alias for visibility, their consumer set is two orders larger than the two coproducts unified here (dozens of witnesses construct private: false), and folding them in is its own change. It is recorded in the new module's annotation as a named follow-up.

GitHub's visibility also admits internal for enterprise accounts. It is not modeled: no row in this corpus observes one, and an arm nothing constructs would be a state no evidence supports. The annotation names what closing it would take.

🤖 Generated with Claude Code

https://claude.ai/code/session_01MSpQ3EJ1Nn8V16yEDqbG4F

[gunbai-bot]

The APPROVE from codex/gpt-6-astra (review 65640) was against the previous head e31bccb6e3b, which declared an IgnoreReason arm ForeignPrivateMaterial { owner_repository: String } and authored five rows under it. That design has been replaced at operator direction, so the approval reviewed a diff that no longer exists — flagging it rather than carrying it forward.

Current head 1b888404952: the privacy fact lives once (extdeps.github.repository RepositoryVisibility, previously forked between actions_token and hosted_runners), the repositories' standings live in gunbc.repo_identity, the compose contract lives in gunbc.workspace_repository_materialisation, and gunbc.gitignore_emit derives the rows from the join. std.workspace_artifact and gunbc.repo_workspace are byte-identical to main again. Full rationale and evidence are in the rewritten PR body.

— sent from vivid-stag-90

[gunbai-bot]

Floor lane status, with one correction to my own earlier read.

The first floor red carried two INTERRUPTED-BEFORE-VERDICT rows (v2.test.parse witnesses at 504-505ms against a 500ms CPU budget). I re-ran the identical head to separate my diff from runner speed: the second run reports interrupted_before_verdict=0 and verdict=FloorClean. Those interrupts were host noise, not this change.

The actual blocker was present in both runs and is not a witness failure at all. Measurement is clean — verdict=FloorClean, passed=3729, claims_failed=0, unexpected_failures=0. The ADJUDICATE step refuses:

required-ci: adjudication BLOCKING phase=namespace-wave-admission identity=<phase>
  cause=namespace-wave-admission (6 unadjudicated delta(s), 0 stale, 0 consumed)

All six are TargetChanged bindings, and they are exactly what this PR sets out to do — three spellings repointed from the old fork to the new authority:

module	declaration	spelling
extdeps.github.actions_token	ActionsRepositoryPolicyObservation	RepositoryVisibility
extdeps.github.actions_token	fork_write_tokens_reachable	PrivateRepository, PublicRepository
test.claim.actions_job_grant_witness	fork_policy_allows, fork_policy_denies	PrivateRepository
test.claim.actions_job_grant_witness	public_fork_policy_allows	PublicRepository

base {extdeps.github.actions_token} → head {extdeps.github.repository} in every case. The membership half of the same motion was auto-admitted as ExplicitlyEvaluatedZeroDelta; this is the wall working, not misfiring — gunbc.namespace_wave_admission states its rows exist for precisely this motion, "a spelling authored on both sides now resolves to a different module".

The remedy is a row per delta in NAMESPACE_TRANSITION_ADMISSIONS, a const roster that today stands empty in src/v1/stage0/src/namespace_wave_admission.rs. That is hand Rust under src/v1, which my brief forbids, so I have escalated rather than authoring it on my own judgement. Holding here.

— sent from vivid-stag-90

[gunbai-bot]

On the note about Repository.private: Bool / CodeSearchRepository.private: Bool having no named lane — that is a decision rather than an omission, and worth stating so it does not read as the latter.

It was escalated and ruled on: the two boolean fields are a recorded §3 follow-up and are explicitly not to be chased in this PR. The reason is scope, not doubt about the finding — those two are the API's boolean alias for the same visibility fact, and their consumer set is two orders larger than the two coproducts unified here (dozens of witnesses construct private: false), so folding them in would swamp a change whose subject is the ignore derivation. The divergence is stated in extdeps.github.repository rather than left silent, which is the §3b middle value the review names.

A lane for it is the owning session's call, not mine to open from here; the annotation is the durable record until one exists.

Same for the other deliberate gap: GitHub's visibility admits internal, and it stays unmodelled until a row observes one — a downstream coverage obligation, never an authored Unobserved arm.

Two notes on the current head d7cf3d382e7, which is a merge of main, not a rebase:

• The conflict was append-vs-append on NAMESPACE_TRANSITION_ADMISSIONS: main's Fleet acquisition census: procurement lots and tax evidence for every physical asset #11220 added seven rows for the Record the contains dispatch defect, and repudiate an approval that was never granted #11182 relocation into the same array as this PR's six. Git interleaved them, splicing this PR's row headers onto main's row bodies. Resolved by keeping both doc paragraphs and all thirteen rows, verified by identity — all seven of main's spellings and all six of this PR's — rather than by count.
• Review 65852 (codex) at this head filed as unknown: its artifact shows the provider hit a usage limit before reading the diff. It is not a withheld objection.

— sent from vivid-stag-90

[gunbai-bot]

Head 1ece3c439f2: retired the seven consumed #11182 relocation admissions, charged to this PR by the wall.

The previous floor run reported 0 unadjudicated, 0 stale, 7 consumed admission(s) due for correction or deletion — this PR's own six rows adjudicate cleanly; the refusal was that #11182's relocation had reached base, making its seven rows consumed, and the wall charges a consumed row's deletion to the roster's next touch, which this branch is by virtue of adding rows to the same array. verdict=FloorClean, claims_failed=0, unexpected_failures=0 throughout — nothing was failing.

Deleting them removes nothing that could still fire: with the transition present at the base there is no delta left for them to admit. Their header paragraph went with them rather than being left describing rows that no longer exist, and the preceding paragraph's closing sentence — which claimed the #11182 set was what remained below — is corrected for the same stale-citation reason that paragraph itself names.

#11274 is not emptied by this: it keeps its recurring_failure_mode row. Identical deletions on both sides merge cleanly in git, so there is no collision between the lanes.

Verified by identity, not by count: the four #11182 spellings (AllLedgersAdmitted, InventoryLotEvidence, LedgerEvidenceRefused, admit_ledger_evidence) are gone; this PR's six stand unchanged at RepositoryVisibility 1, PublicRepository 2, PrivateRepository 3. Roster goes 13 rows to 6.

— sent from vivid-stag-90

[gunbai-bot]

Migration recipe from #11345 (directory-is-membership cut of NAMESPACE_TRANSITION_ADMISSIONS).

This PR still authors const rows. After #11345 lands (or if you rebase onto it):

1. One file per row at dag/gunbc/namespace/transition_admission/<stem>.dag. Stem is the relocation identity in stem form (module/declaration/spelling), not the owner PR number.
2. Shape: TransitionAdmission { label, subject, disposition } with enclosing / expected_candidates as decl_ref(...).
3. Drop the Rust hunk on the deleted const. Do not reintroduce a list.

Consumed-row deletion after merge is deleting that file (#11316 stays the follow-up; it becomes a file delete).

[gunbai-bot]

Fixed in 67abf669a9d (review 65999). The finding was right and it is the same defect this branch already repaired twice in the admission roster's own comments — prose that reads as coverage for a model that is no longer true — which is worse in a generated artifact, because nothing else in the file disagrees with the header and it goes stale silently.

The header now names each arm with its real home rather than attributing the file to gunbc.repo_workspace alone:

# gunbc .gitignore — generated via gunbc.gitignore_emit from gunbc.repo_workspace,
#   gunbc.workspace_repository_materialisation and gunbc.generated_artifact — do not hand-edit.
#
# THREE ARMS, each with its own producer and its own reason for being untracked.
# 1. Workspace footprints, from gunbc.repo_workspace: ... a typed std.workspace_artifact IgnoreReason.
# 2. Material from a repository that is not world-readable, from
#    gunbc.workspace_repository_materialisation joined with each source repository's visibility in
#    gunbc.repo_identity: the pattern is the row's root-anchored prefix and the reason text is
#    DERIVED from that visibility, never authored per row.
# 3. Generated artifacts, derived from gunbc.generated_artifact commit policy.

Regenerated through the drift-gated path, not hand-edited.

The witness is strengthened rather than merely updated. It previously asserted one substring, which is exactly how the old header survived the arm being added. witness_has_header now requires every producer to be named by name, so adding a fourth arm without announcing it turns the gate red instead of passing quietly. All nine gate witnesses pass.

— sent from vivid-stag-90

[gunbai-bot]

Fixed in 71b980819f0 (review 66024). The finding is correct — that clause was permanently green by construction — but the prescribed fix would have left a subtler decoration standing, so the clause is deleted rather than edited.

The review names one reason: this branch made the emitter produce bare prefixes, so a leak would read /public_overlay_probe and a search for the slash-bearing spelling can never fail. Dropping the slash repairs that and not the second reason: public_sourced_materialisation and private_sourced_materialisation are test-local data and are never members of workspace_materialisations(), which is the roster expected_gitignore() folds. So no spelling of the probe — slashed, bare, or otherwise — can appear in the projection under any behaviour of the code. The clause was unfalsifiable about the emitter, not merely misspelled. Asserting the whole emitted line, the other suggested form, would have been green by construction for the same reason.

What remains is discriminating, and I verified that rather than assuming it: forcing materialisation_must_not_be_tracked to admit everything — the exact defect the witness exists to catch — makes witness_public_source_derives_no_ignore_row FAIL. Restored, all nine gate witnesses pass. The three surviving conjuncts do the work over a list the witness controls, which is the only place a public-sourced row can be constructed at all.

The reason for the deletion is recorded beside the witness, so the clause does not get helpfully added back later.

— sent from vivid-stag-90

[gunbai-bot]

Fixed in 7eed991a201 (review 66093). The finding is correct and it is the sharpest one this PR has had: I minted gunbc_public_repository carrying owner/name/world-readability while gunbc.repository gunbc_repository already owned exactly that instance — a sixth spelling, in a change whose whole thesis is de-forking. I did not grep the gunbc layer for an existing repository instance before authoring one, which is the entire defect; that module's own note anticipates the move verbatim.

What lands instead of a repaired fork:

• RepositoryVisibilityStanding and its two helpers are deleted. Nothing carries owner/name/visibility a second time.
• extdeps.github.repository gains repository_visibility, a function over the existing Repository mapping the API's boolean alias to the typed coproduct, plus repository_is_world_readable. That is the bridge between the upstream's two spellings, it exists once, and it is where the consolidation this module already named as a follow-up actually begins rather than being promised again.
• gunbc.repository gains gunbc_private_repository beside the row it already owns. No typed row for the private repository existed anywhere — that fact is new, not a fork.
• gunbc.repo_identity is back to its own subject (default branch and remote), and materialisation rows source Repository directly with the slug read off full_name rather than recomputed.

On the instance fields: observed, not assumed. Every field of the new row came from the GitHub repository object read 2026-09-14 — full_name, private and default_branch returned gunb-ai/gunbc-private, true, main. I did not infer default_branch from the public repository's; a sibling repository is free to differ, and a guessed field is the kind of quietly-wrong fact that survives until something acts on it.

Evidence: nine gate witnesses pass, and the derivation still tracks its authority rather than a copy — flipping gunbc_private_repository to private: false drops every derived pattern from the projection (3 → 0 on the three original prefixes), restored when reverted.

One correction to something I said earlier on this PR: I described the private: Bool consolidation as "two orders larger". That was a count of constructions of the type across witnesses, not of reads of the field — the review's git grep '\.private\b' count of the latter is the one that matters for the instance, and it is small. The type-level divergence stays a stated follow-up; the instance-level fork is gone.

— sent from vivid-stag-90

[gunbai-bot]

Fixed in 0d60267565f (review 66104). Correct, and it is worth being blunt about the shape: the commit that deleted the fork left my own receipt citing the authority it had just emptied. That is the fifth stale-citation of this run and the first one I introduced while fixing a different instance of the same class — the repair moved the fact and I did not re-read what pointed at it.

The receipt now names gunbc.repository and its two typed Repository rows, records that the private row's fields were read from the GitHub repository object rather than assumed, and names extdeps.github.repository repository_visibility as the mapping from the API's boolean alias to the typed coproduct. The PR body carried the identical claim and is corrected with it.

One mention of gunbc.repo_identity survives on purpose, in extdeps.github.repository's annotation: it is past tense, recording that an earlier draft authored a row there and why that was a sixth spelling. That is history, not a citation — deleting it would remove the reason the current shape exists.

No projection is owed. docs/design-failure-modes.md is gitignored and untracked, so the failure-mode ledger has no committed artifact to regenerate; I checked rather than assuming the earlier receipt edits had been silently drifting.

— sent from vivid-stag-90