diff --git a/dag/gunbc/fabric/fabric_witness_run.dag b/dag/gunbc/fabric/fabric_witness_run.dag index 7d75ec6e013..a1e86890c60 100644 --- a/dag/gunbc/fabric/fabric_witness_run.dag +++ b/dag/gunbc/fabric/fabric_witness_run.dag @@ -10,7 +10,7 @@ import product.fabric.identity { FabricIdentity, WorkKey, ExecutionAttemptKey, OfferKey, GrantKey, fabric_identity_eq, } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ResumabilityTier, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, CapacityClass, ControlPlaneCapacity, CapabilityManifestRef, TrustDomainRef, @@ -178,15 +178,13 @@ fn required_build_contract_from_materials( terminal_result_manifest: List, ) -> WorkContract { WorkContract { - program: concat("gunbc.required-witnesses-build.program:", framed_string(value: command)), + execution: MaterializedProgram { program: concat("gunbc.required-witnesses-build.program:", framed_string(value: command)), source: concat("gunbc.required-witnesses-build.source:", concat(framed_string(value: source), framed_string(value: checkout))), runtime_closure: concat("gunbc.required-witnesses-build.runtime:", concat(framed_string(value: toolchain), framed_string(value: executable))) }, steps: [ WorkStep { step_id: "checkout-materialize", resumability: ReceiptSatisfiable }, WorkStep { step_id: "toolchain-and-executable-materialize", resumability: ReceiptSatisfiable }, WorkStep { step_id: "required-witnesses-build", resumability: ReceiptSatisfiable }, ], - source: concat("gunbc.required-witnesses-build.source:", concat(framed_string(value: source), framed_string(value: checkout))), inputs: concat("gunbc.required-witnesses-build.inputs:", concat(framed_string(value: environment), concat(framed_string(value: cache), framed_string(value: credentials)))), - runtime_closure: concat("gunbc.required-witnesses-build.runtime:", concat(framed_string(value: toolchain), framed_string(value: executable))), effect_contract: "gunbc.required-witnesses-build.effects.checkout-read-cache-and-permitted-credentials-only", output_contract: "gunbc.required-witnesses-build.outputs", output_obligations: declared_output_obligations_from_manifests( @@ -402,13 +400,11 @@ fn required_witnesses_build_frozen_identity_wire( // resumability that would restore it belongs with the cost basis, not here. fn floor_work_contract(source: SourceManifestRef) -> WorkContract { WorkContract { - program: "gunbc.claim_executor", + execution: MaterializedProgram { program: "gunbc.claim_executor", source: source, runtime_closure: "gunbc.toolchain.rust-1.93.0+clippy+rustfmt" }, steps: [ WorkStep { step_id: "required-ci", resumability: ReceiptSatisfiable }, ], - source: source, inputs: floor_inputs_manifest_ref(), - runtime_closure: "gunbc.toolchain.rust-1.93.0+clippy+rustfmt", effect_contract: "gunbc.floor.effects.read-only-corpus", output_contract: "gunbc.floor.outputs.required-floor-summary", output_obligations: declared_terminal_obligations(ids: ["required-floor-summary"]), diff --git a/dag/gunbc/harness/harness_seat.dag b/dag/gunbc/harness/harness_seat.dag index 28a92090b71..b1febe28161 100644 --- a/dag/gunbc/harness/harness_seat.dag +++ b/dag/gunbc/harness/harness_seat.dag @@ -325,11 +325,11 @@ fn harness_seat_standing(route: ServingRoute, layout: EventLogLayout, now: Epoch // ── WHAT THIS BOUNDARY IS, AND WHAT IT IS NOT ──────────────────────────────────────────────── // -// IT IS AN ADMISSION BROKER OVER FABRIC OFFERS, AND IT DOES NOT BIND SERVING INTO FABRIC Work. -// gunbc.serving.turn_demand can construct exact inference Work and its Demand, and this path does -// not call it, because it cannot: no observation in this repository establishes the exact model, -// tokenizer and runtime closure a launch loaded, so every Work it could build here would be the -// typed refusal that module returns. +// IT IS AN ADMISSION BROKER OVER FABRIC OFFERS, AND IT DOES NOT YET BIND SERVING INTO FABRIC Work. +// gunbc.serving.turn_demand constructs a turn's Work as an OfferedService from the request alone, so +// the identity no longer waits on any observation of the selected engine. This path still does not +// call it, because it receives no normalized turn request: the prompt reaches harness_run_turn after +// placement, and nothing here carries the interface, inputs or output contract a Work is made of. // // AN EARLIER SHAPE OF THIS FILE CARRIED THAT REFUSAL ON THE GRANTED SEAT, which reads as enforcement // and is not: the refusal travelled beside a successful placement and prevented nothing @@ -338,10 +338,9 @@ fn harness_seat_standing(route: ServingRoute, layout: EventLogLayout, now: Epoch // (whether this group may take a fresh cold-risk turn now) and claims nothing about work identity. // // THE FRONTIER, NAMED SO IT IS NOT MISTAKEN FOR AN OMISSION. gunbc.serving.turn_demand's consumer is -// this function, and it lands when a launch receipt reads the served model, tokenizer and runtime -// closure off the running engine. At that point placement takes the Demand's own key rather than the -// caller's actor string, and a request whose source closure is unestablished refuses BEFORE -// acquisition rather than after it. +// this function, and it lands when harness_bind_seat takes a normalized ServingTurnRequest: one Work +// and one Demand are then constructed before candidates are enumerated, and placement takes the +// Demand's own key rather than the caller's actor string. // ── WHAT THE TURN REQUIRES OF A MODEL, WHICH IS NOW A QUESTION RATHER THAN A CONSTANT ──────── // // THE DEMAND USED TO NAME ONE MODEL AND THAT WAS THE WHOLE PROBLEM. The capability a serving offer @@ -456,14 +455,11 @@ fn harness_no_candidate(acc: HarnessCandidates, note: String, retryable: Bool) - // when evidence identifies the deployment that answered as the offered launch. // // A CandidateOffer is sole_constructor through product.fabric.selection bind_candidate, which takes -// a DEMAND IDENTITY and a WORK IDENTITY and compares the permit against both. A WorkKey comes from -// exactly one place -- product.fabric.work derive_work_key, through work_for -- which needs a -// WorkContract, which needs a SourceManifestRef; and gunbc.serving.turn_demand refuses to produce -// one until its weights, tokenizer and runtime components are each observed. Nothing observes the -// first two (serving_turn_weights_obligation, serving_turn_tokenizer_obligation), and the runtime is -// read only through an incarnation observation this path does not have. Minting a key beside derive_work_key would -// fabricate the identity the fabric's deduplication and receipts are keyed on, so this arm reports -// what is missing and seats nobody rather than inventing it. +// a DEMAND IDENTITY and a WORK IDENTITY and compares the permit against both. The Work is +// constructible -- gunbc.serving.turn_demand serving_turn_work builds an OfferedService from the +// request alone, and no realization fact of the offer participates -- but it must be constructed once +// at the request boundary and carried down, never minted here per candidate, and this path receives +// no normalized request to construct it from. // // THE CAPABILITY IS THE REQUIREMENT'S, NOT THE OBSERVED MODEL'S, and the two are reconciled before // this is reached rather than here: the observed unit has already been checked against the @@ -479,10 +475,9 @@ fn harness_no_candidate(acc: HarnessCandidates, note: String, retryable: Bool) - // of this arm, so the wording carries it: admission cannot yet be evaluated, and the producer exists // and has not run (operator-routed review of #11083). // -// Restoration trigger: observers of the loaded weight and tokenizer bytes and of the answering -// incarnation, SUFFICIENT FOR gunbc.serving.turn_demand serving_turn_work to return TurnWorkBound -// for a harness turn -- at which point the demand and work identities exist, the admission producer -// is called with them, and bind_candidate has everything it compares. +// Restoration trigger: harness_bind_seat carries a normalized ServingTurnRequest, SUFFICIENT FOR one +// Work and one Demand constructed before candidate enumeration -- at which point the admission +// producer is called with them, and bind_candidate has everything it compares. // // THE REALIZATION THE HARNESS OFFERS IS BUILT IN ONE PLACE, so a witness can drive the route standing // through exactly what production passes. It states two absences, and both are real on this path: @@ -526,7 +521,7 @@ fn harness_bind_candidate(acc: HarnessCandidates, group: FabricGroup, endpoint: acc: acc, note: seat_bind_detail( group: group, - text: "The serving offer bound. Provider-use admission cannot yet be evaluated for this turn because its exact Work identity is unestablished: nothing observes the weight or tokenizer bytes a launch loaded, so gunbc.serving.turn_demand cannot bind a source manifest, and product.fabric.selection bind_candidate has no work to compare a permit against. gunbc.spark.first_party_serving spark_first_party_admission EXISTS and has NOT RUN for this turn", + text: "The serving offer bound. Provider-use admission cannot yet be evaluated for this turn because placement receives no normalized turn request: gunbc.serving.turn_demand serving_turn_work can construct the turn's Work from one, but harness_bind_seat is given no interface, inputs or output contract, so no Work or Demand exists for product.fabric.selection bind_candidate to compare a permit against. gunbc.spark.first_party_serving spark_first_party_admission EXISTS and has NOT RUN for this turn", ), retryable: false, ) diff --git a/dag/gunbc/instruments/fabric_m0_origin_object_probe.dag b/dag/gunbc/instruments/fabric_m0_origin_object_probe.dag index cbcd9d0d535..2f571cd5a0b 100644 --- a/dag/gunbc/instruments/fabric_m0_origin_object_probe.dag +++ b/dag/gunbc/instruments/fabric_m0_origin_object_probe.dag @@ -20,7 +20,7 @@ import std.measure { hardware_thread_count } import std.scoped_authorization { AttemptIdentity } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, work_for, OutputObligation, OutputArtifactObligation, DeclaredOutputObligations, @@ -229,9 +229,9 @@ fn canary_work() -> Work { work_for( principal: "gunbc" as NonEmptyStr, contract: WorkContract { - program: "gunbc.fabric-m0.canary:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.canary:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0-canary", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", runtime_closure: "runtime:1", + inputs: "inputs:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [canary_object()] }, }, diff --git a/dag/gunbc/instruments/fabric_m0_origin_readback_probe.dag b/dag/gunbc/instruments/fabric_m0_origin_readback_probe.dag index bb62013b4da..aa88c70ba6d 100644 --- a/dag/gunbc/instruments/fabric_m0_origin_readback_probe.dag +++ b/dag/gunbc/instruments/fabric_m0_origin_readback_probe.dag @@ -8,7 +8,7 @@ import std.scoped_authorization { AttemptIdentity } import product.fabric.identity { WorkKey } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, derive_work_key, OutputObligation, OutputArtifactObligation, @@ -183,11 +183,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn the_contract() -> WorkContract { WorkContract { - program: "gunbc.fabric-m0.program:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [the_object()] }, diff --git a/dag/gunbc/product/fabric/work.dag b/dag/gunbc/product/fabric/work.dag index 1bf789ceb66..3c265e1ba44 100644 --- a/dag/gunbc/product/fabric/work.dag +++ b/dag/gunbc/product/fabric/work.dag @@ -6,7 +6,8 @@ import product.fabric.envelope { ResourceEnvelope, CpuRequirement, MemoryRequirement, } -import std.types { NonEmptyStr, List } +import std.types { NonEmptyStr, List, String } +import std.nat { Nat } import std.content_hash { ContentHash, content_hash_of_value, serialize_content_hash } import std.measure { HardwareThreadCount, hardware_thread_count_value, byte_size_count } import product.fabric.identity { FabricIdentity, WorkKey } @@ -223,12 +224,35 @@ type WorkStep { // the obligation roster. output_obligations is the structured roster the work // owes; identity material includes it, so changing what is owed changes the // work key without stuffing the roster into the contract name. +// WHAT EXECUTES THE WORK IS ONE OF TWO THINGS, AND THE CONTRACT USED TO ADMIT ONLY THE FIRST. +// +// A materialized program is identified by what it consumes: the program, the source manifest and the +// runtime closure are the answer-changing facts, so they are identity. An offered service is a +// different request: the caller asks an interface for a result and does not name, and cannot know +// before selection, the implementation that will answer. Forcing a service request through the +// program shape made the requester's identity depend on the SUPPLIER's realization -- a serving turn +// could not construct Work until the selected engine's loaded weights, tokenizer and runtime were +// observed, which put identity beneath supplier enumeration and refused every turn (DESIGN 3: +// interface, realization and policy are three facts). Realization facts of an offered service are +// offer provenance and admission policy; a demand that genuinely requires one states it as a +// requirement rather than every service request inheriting it. +// +// The arm is part of identity material, so a program and a service sharing every other field are +// never the same Work. +type ServiceInterfaceRef = NonEmptyStr where brand("ServiceInterfaceRef") + +type WorkExecution + = MaterializedProgram { + program: ProgramRef, + source: SourceManifestRef, + runtime_closure: ArtifactManifestRef, + } + | OfferedService { interface: ServiceInterfaceRef } + type WorkContract { - program: ProgramRef + execution: WorkExecution steps: List - source: SourceManifestRef inputs: ArtifactManifestRef - runtime_closure: ArtifactManifestRef effect_contract: EffectContractRef output_contract: OutputContractRef output_obligations: DeclaredOutputObligations @@ -423,21 +447,76 @@ fn resolve_output_obligations( } } +// ── THE IDENTITY PREIMAGE IS LENGTH-FRAMED, AND IT CARRIES ITS SCHEMA ────────────────────────── +// +// Every field that feeds the key is authored text refining NonEmptyStr, and a brand does not +// forbid a separator byte. A preimage that joined fields with U+001F therefore let two contracts +// differing only in WHERE a separator fell -- program "a", source "bc" against program +// "ab", source "c" -- derive one key: two works deduplicated onto each other with no +// refusal anywhere. Framing each field as label:length:bytes makes the concatenation injective +// in the field tuple whatever bytes the fields carry; nothing is escaped and nothing is +// forbidden, the length says where each field ends. +// +// SCHEMA 2 IS A DIFFERENT KEY SPACE FROM SCHEMA 1, AND SAYS SO IN ITS FIRST BYTES. Every +// materialized-program contract derives a different key under this framing than it did under the +// joined preimage, even with every field unchanged. That is declared as work_identity_schema +// below rather than left for a consumer to discover, and it is safe for the reason the census +// there gives: no production site rehydrates a WorkKey from stored text (`as WorkKey` has no +// production occurrence), so a key persisted under schema 1 -- in a publication, an event, a +// grant, a receipt -- is a write-only record and is never compared with a key derived under +// schema 2. Every comparison of keys in the corpus is between keys derived in one process from +// the contracts in hand, and a foreign key on any of those joins is a typed refusal +// (WorkKeyDoesNotMatchContract, AttemptWorkOutsideSubject, the grant_issue permit and attempt +// mismatches), never a silent match. +data work_identity_schema: WorkIdentitySchema = WorkIdentitySchema { + version: 2, + tag: "product.fabric.work/identity/2" as NonEmptyStr, + supersedes: "a U+001F-joined preimage of the same fields, program first, which was not injective and carried no schema tag" as NonEmptyStr, + transition: "keys derived under the joined preimage are not comparable with keys derived here. Census of WorkKey carriers at the transition: derive_work_key is the only mint; work_for the only constructor; no production `as WorkKey` rehydration exists, so no persisted key re-enters a comparison; publications (gunbc.fabric.fabric_m0_publication), attempt graphs (product.training.attempt_graph), grants (product.fabric.grant_issue) and completion (gunbc.fabric.fabric_m0_completion) compare keys derived in the same process and refuse a foreign one with a typed cause" as NonEmptyStr, +} + +type WorkIdentitySchema { + version: Nat + tag: NonEmptyStr + supersedes: NonEmptyStr + transition: NonEmptyStr +} + +fn identity_frame(label: NonEmptyStr, value: String) -> NonEmptyStr { + concat(label, ":", to_string(value.length()), ":", value) +} + +fn work_execution_material(execution: WorkExecution) -> NonEmptyStr { + match execution { + MaterializedProgram { program, source, runtime_closure } => + concat( + identity_frame(label: "execution", value: "materialized-program"), + identity_frame(label: "program", value: program as String), + identity_frame(label: "source", value: source as String), + identity_frame(label: "runtime-closure", value: runtime_closure as String), + ) + OfferedService { interface } => + concat( + identity_frame(label: "execution", value: "offered-service"), + identity_frame(label: "interface", value: interface as String), + ) + } +} + fn work_identity_material(contract: WorkContract, requirements: ExecutionRequirements) -> NonEmptyStr { concat( - contract.program, "\u{1f}", - work_steps_material(steps: contract.steps), "\u{1f}", - contract.source, "\u{1f}", - contract.inputs, "\u{1f}", - contract.runtime_closure, "\u{1f}", - contract.effect_contract, "\u{1f}", - contract.output_contract, "\u{1f}", - output_obligations_material(declared: contract.output_obligations), "\u{1f}", - capacity_class_wire(c: requirements.capacity_class), "\u{1f}", - requirements.capabilities, "\u{1f}", - requirements.trust_domain, "\u{1f}", - isolation_material(profile: requirements.isolation), "\u{1f}", - shape_material(shape: requirements.shape) + identity_frame(label: "schema", value: work_identity_schema.tag as String), + work_execution_material(execution: contract.execution), + work_steps_material(steps: contract.steps), + identity_frame(label: "inputs", value: contract.inputs as String), + identity_frame(label: "effect-contract", value: contract.effect_contract as String), + identity_frame(label: "output-contract", value: contract.output_contract as String), + identity_frame(label: "output-obligations", value: output_obligations_material(declared: contract.output_obligations) as String), + identity_frame(label: "capacity-class", value: capacity_class_wire(c: requirements.capacity_class) as String), + identity_frame(label: "capabilities", value: requirements.capabilities as String), + identity_frame(label: "trust-domain", value: requirements.trust_domain as String), + identity_frame(label: "isolation", value: isolation_material(profile: requirements.isolation) as String), + identity_frame(label: "shape", value: shape_material(shape: requirements.shape) as String), ) } @@ -541,7 +620,10 @@ fn envelope_material(envelope: ResourceEnvelope) -> NonEmptyStr { } fn work_step_material(step: WorkStep) -> NonEmptyStr { - concat(step.step_id, "\u{1e}", resumability_material(tier: step.resumability)) + concat( + identity_frame(label: "step", value: step.step_id as String), + identity_frame(label: "resumability", value: resumability_material(tier: step.resumability) as String), + ) } fn resumability_material(tier: ResumabilityTier) -> NonEmptyStr { @@ -556,11 +638,22 @@ fn resumability_material(tier: ResumabilityTier) -> NonEmptyStr { fn work_steps_material(steps: List) -> NonEmptyStr { fold( steps, - init: "steps", - f: (acc, step) => concat(acc, "\u{1d}", work_step_material(step: step)) + init: identity_frame(label: "steps", value: to_string(steps.count())), + f: (acc, step) => concat(acc, work_step_material(step: step)) ) } +// The work key is derived from the semantic contract alone. Excluded, each for +// the same reason - it changes how work is scheduled or attempted, never what +// answer the work promises: priority, queue position, chosen host, cache +// presence, attempt number, resource prediction, monetary quote, budget +// account, reservation price. Including any of them forks one computation into +// many identities and destroys the deduplication the key exists to provide. +// Conversely a property that can change the ANSWER - toolchain, architecture, +// available effects - belongs in the runtime closure or effect contract and +// therefore DOES participate. The test is not whether a fact is important; it +// is whether two runs differing only in that fact could legitimately produce +// different output. fn derive_work_key(contract: WorkContract, requirements: ExecutionRequirements) -> WorkKey { serialize_content_hash( hash: content_hash_of_value( @@ -582,19 +675,3 @@ fn work_for

(principal: P, contract: WorkContract, requirements: ExecutionRequ requirements: requirements, } } - -// The work key is derived from the semantic contract alone. Excluded, each for -// the same reason - it changes how work is scheduled or attempted, never what -// answer the work promises: priority, queue position, chosen host, cache -// presence, attempt number, resource prediction, monetary quote, budget -// account, reservation price. Including any of them forks one computation into -// many identities and destroys the deduplication the key exists to provide. -// Conversely a property that can change the ANSWER - toolchain, architecture, -// available effects - belongs in the runtime closure or effect contract and -// therefore DOES participate. The test is not whether a fact is important; it -// is whether two runs differing only in that fact could legitimately produce -// different output. -fn work_contract_source(contract: WorkContract) -> SourceManifestRef { - contract.source -} - diff --git a/dag/gunbc/product/training/resolution.dag b/dag/gunbc/product/training/resolution.dag index 063e6565208..52d3046630e 100644 --- a/dag/gunbc/product/training/resolution.dag +++ b/dag/gunbc/product/training/resolution.dag @@ -1,6 +1,6 @@ module product.training.resolution -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, ExecutionRequirements, WorkStep, ReceiptSatisfiable, work_for, declared_artifact_obligations, } @@ -478,11 +478,9 @@ fn training_work_contract(evidence: TrainingResolutionEvidence) -> WorkContract let m = training_resolved_manifest(evidence: evidence) let contract_id = serialize_content_hash(hash: m.output_contract) WorkContract { - program: "gunbc-training-run-low-rank-adaptation", + execution: MaterializedProgram { program: "gunbc-training-run-low-rank-adaptation", source: serialize_content_hash(hash: m.dataset_manifest), runtime_closure: serialize_content_hash(hash: m.trainer_closure) }, steps: [WorkStep { step_id: "train", resumability: ReceiptSatisfiable }], - source: serialize_content_hash(hash: m.dataset_manifest), inputs: training_manifest_reference(m: m), - runtime_closure: serialize_content_hash(hash: m.trainer_closure), effect_contract: "training-write-checkpoints-and-adapter", output_contract: contract_id, output_obligations: declared_artifact_obligations(ids: ["training-low-rank-adapter"]), diff --git a/dag/gunbc/serving/turn_demand.dag b/dag/gunbc/serving/turn_demand.dag index 9c7a3cc429c..fd6548850f3 100644 --- a/dag/gunbc/serving/turn_demand.dag +++ b/dag/gunbc/serving/turn_demand.dag @@ -1,15 +1,13 @@ module gunbc.serving.turn_demand -import std.types { String, NonEmptyStr, List } -import v2.std.optional { Present, Absent } -import std.content_hash { ContentHash, serialize_content_hash } +import std.types { NonEmptyStr, List } import product.fabric.work { - Work, WorkContract, WorkStep, OpaqueEffects, ProgramRef, SourceManifestRef, ArtifactManifestRef, + Work, WorkContract, WorkStep, OpaqueEffects, OfferedService, ServiceInterfaceRef, ArtifactManifestRef, EffectContractRef, OutputContractRef, DeclaredOutputObligations, declared_terminal_obligations, ExecutionRequirements, CapacityClass, Shape, CapabilityManifestRef, TrustDomainRef, work_for, } import product.fabric.isolation { IsolationProfile } -import product.fabric.demand { SatisfactionRequirement, ObservationReceiptRef } +import product.fabric.demand { SatisfactionRequirement } // ── A SERVING TURN IS PROVIDER-NEUTRAL WORK ─────────────────────────────────────────────────── // @@ -34,103 +32,30 @@ import product.fabric.demand { SatisfactionRequirement, ObservationReceiptRef } // with it: the owned-hardware buy terms were zero against gunbc.spark.serving_offer's zero quote, and // that pairing is stated where the quote is. -// ── THE SOURCE MANIFEST IS THE ONE FIELD THAT CANNOT BE FILLED IN TODAY ─────────────────────── +// ── A TURN IS AN OFFERED-SERVICE REQUEST, AND ITS IDENTITY EXISTS BEFORE ANY SUPPLIER IS CONSIDERED ── // -// WHAT WAS DONE BEFORE AND WHY IT WAS WRONG. The served model ALIAS was cast straight into -// SourceManifestRef. An alias is a route name -- what the OpenAI-shaped endpoint answers to -- and -// work.dag is explicit that source identity is a canonical MANIFEST covering content digests of what -// is actually consumed. Two engines answering the same alias can be serving different weights, a -// different tokenizer, a different quantization or a different runtime, and the cast made all of -// them one Work. That is not a missing field; it is a wrong answer about identity, and the fabric's -// whole reuse and receipt story is keyed on it. +// WHAT WAS DONE BEFORE AND WHY IT WAS WRONG, TWICE. First the served model ALIAS was cast into +// SourceManifestRef, which made two engines answering one alias with different bytes the same Work. +// The repair made the source a manifest of the SELECTED ENGINE's loaded weights, tokenizer and +// runtime, observed or absent -- which fixed the cast and reversed the dependency: the requester's +// identity then depended on the supplier's realization, nothing observes loaded weight or tokenizer +// bytes (a boundary obligation outside the modeled guarantee, DESIGN 4b), and so no turn could ever +// construct Work. Both spellings forced a service request through the materialized-program shape. // -// SO THE MANIFEST IS OBSERVED OR IT IS ABSENT, AND ABSENT IS TYPED. Until every component below is -// observed, a serving turn has no exact Work, and this module says so rather than manufacturing one. -// -// WHAT THE MANIFEST IS MADE OF: three components, each observed or not on its own. A turn's source is -// the weights the engine loaded, the tokenizer it loaded, and the runtime it runs in. One boolean over -// all three would hide which is missing, and the three have different producers: an incarnation -// observation can supply the runtime image digest (gunbc.spark.serving_offer spark_serving_turn_runtime), -// and nothing in this repository reads the weight or tokenizer bytes a running engine loaded. -type ServingTurnComponent = TurnWeights | TurnTokenizer | TurnRuntime - -fn serving_turn_component_wire(component: ServingTurnComponent) -> NonEmptyStr { - match component { - TurnWeights => "weights" as NonEmptyStr - TurnTokenizer => "tokenizer" as NonEmptyStr - TurnRuntime => "runtime" as NonEmptyStr - } -} - -type TurnComponentStanding - = TurnComponentObserved { digest: ContentHash, receipt: ObservationReceiptRef } - | TurnComponentUnobserved { obligation: NonEmptyStr } - -type ServingTurnSource { - weights: TurnComponentStanding - tokenizer: TurnComponentStanding - runtime: TurnComponentStanding -} - -// THE WEIGHTS AND TOKENIZER OBLIGATIONS NAME THE ONLY THING THAT DISCHARGES THEM. The snapshot pinned in -// gunbc.spark.pair_serving_desired is what we DECLARED the engine should load. Reading it as what the -// engine DID load is the declaration standing in for the realization, so it never fills these. -data serving_turn_weights_obligation: NonEmptyStr = "no observation in this repository establishes the weight bytes a serving engine loaded; the pinned snapshot revision is a declaration, not a reading. TRIGGER: an observer of the loaded weight bytes, bound to the answering launch, SUFFICIENT FOR TurnComponentObserved on the weights component. FEASIBILITY, stated so the trigger is not read as scheduled work: this is a boundary obligation outside the modeled guarantee (DESIGN 4b), not a producer that can be built. Even with root on the host, the process table shows which files the engine opened or mapped, and the engine copies, shards and may quantize what it reads into GB10 unified memory, so no host reading establishes that the bytes now serving equal any file. The attainable ceiling is the digest of the files opened at launch, bound to the answering launch; that is weaker than this trigger and does not satisfy it. Discharging the component from that ceiling would be a change to what the Work identity means, decided at that identity, never a reading minted as loaded-bytes identity" as NonEmptyStr - -data serving_turn_tokenizer_obligation: NonEmptyStr = "no observation in this repository establishes the tokenizer bytes a serving engine loaded; the pinned snapshot revision is a declaration, not a reading. TRIGGER: an observer of the loaded tokenizer bytes, bound to the answering launch, SUFFICIENT FOR TurnComponentObserved on the tokenizer component. FEASIBILITY, stated so the trigger is not read as scheduled work: this is a boundary obligation outside the modeled guarantee (DESIGN 4b), not a producer that can be built. Even with root on the host, the process table shows which files the engine opened or mapped, and the engine copies, shards and may quantize what it reads into GB10 unified memory, so no host reading establishes that the bytes now serving equal any file. The attainable ceiling is the digest of the files opened at launch, bound to the answering launch; that is weaker than this trigger and does not satisfy it. Discharging the component from that ceiling would be a change to what the Work identity means, decided at that identity, never a reading minted as loaded-bytes identity" as NonEmptyStr - -type TurnComponentReading { - component: ServingTurnComponent - standing: TurnComponentStanding -} - -fn serving_turn_component_readings(source: ServingTurnSource) -> List { - [ - TurnComponentReading { component: TurnWeights, standing: source.weights }, - TurnComponentReading { component: TurnTokenizer, standing: source.tokenizer }, - TurnComponentReading { component: TurnRuntime, standing: source.runtime }, - ] -} - -fn turn_component_obligation(reading: TurnComponentReading) -> List { - match reading.standing { - TurnComponentObserved { digest: _, receipt: _ } => [] as List - TurnComponentUnobserved { obligation: o } => - [join([serving_turn_component_wire(component: reading.component) as String, ": ", o as String], "") as NonEmptyStr] - } -} - -fn turn_component_digest_wire(reading: TurnComponentReading) -> List { - match reading.standing { - TurnComponentUnobserved { obligation: _ } => [] as List - TurnComponentObserved { digest: d, receipt: _ } => - [join([serving_turn_component_wire(component: reading.component) as String, "=", serialize_content_hash(hash: d) as String], "")] - } -} - -// THE MANIFEST IS THE CANONICAL RENDERING OF THE THREE DIGESTS, in a fixed component order, so two -// turns whose engines loaded different bytes in any component have different manifests and therefore -// different Work. It exists only when every component was observed. -fn serving_turn_manifest(source: ServingTurnSource) -> SourceManifestRef? { - let readings = serving_turn_component_readings(source: source) - let obligations = flat_map(readings, r => turn_component_obligation(reading: r)) - if length(obligations) > 0 { - none - } else { - Present { value: join(flat_map(readings, r => turn_component_digest_wire(reading: r)), ";") as SourceManifestRef } - } -} - +// SO A TURN IS product.fabric.work OfferedService. Its identity is what the caller asks for: the +// interface it speaks, the normalized inputs, the effect and output contracts, and -- through +// ExecutionRequirements.capabilities -- the model requirement (AnyAdmittedModel or an exact serving +// unit). The selected endpoint, launch, weights, tokenizer, runtime image, unit and container +// environment are realization evidence about an OFFER: they feed offer provenance and provider-use +// admission, never this identity. A demand that genuinely requires one of them states it as a +// requirement when such a demand exists; no current caller does, so no such arm is declared here. type ServingTurnRequest { - source: ServingTurnSource - runtime_closure: ArtifactManifestRef + interface: ServiceInterfaceRef inputs: ArtifactManifestRef effect_contract: EffectContractRef output_contract: OutputContractRef } -data serving_turn_program: ProgramRef = "gunbc.serving.inference-turn" as ProgramRef - // A TURN IS ONE STEP WITH OPAQUE EFFECTS, and that arm is the honest one rather than the tidy one. A // stream that dies partway has already delivered tokens the caller may have consumed and acted on, // so the effects are outside what a receipt can describe and a retry is not free. ReceiptSatisfiable @@ -151,36 +76,14 @@ fn serving_turn_output_obligations() -> DeclaredOutputObligations { declared_terminal_obligations(ids: ["inference-turn-completion" as NonEmptyStr]) } -type ServingTurnContract - = TurnContractBound { contract: WorkContract } - | TurnContractUnestablished { missing: List, obligation: NonEmptyStr } - -// THE REFUSAL NAMES EVERY MISSING COMPONENT, not the first. A turn missing weights and runtime needs two -// producers, and reporting one of them would send a reader to build it and meet the second refusal. -fn serving_turn_contract(request: ServingTurnRequest) -> ServingTurnContract { - let readings = serving_turn_component_readings(source: request.source) - match serving_turn_manifest(source: request.source) { - Absent => - TurnContractUnestablished { - missing: flat_map(readings, r => match r.standing { - TurnComponentObserved { digest: _, receipt: _ } => [] as List - TurnComponentUnobserved { obligation: _ } => [r.component] - }), - obligation: join(map(flat_map(readings, r => turn_component_obligation(reading: r)), o => o as String), " | ") as NonEmptyStr, - } - Present { value: m } => - TurnContractBound { - contract: WorkContract { - program: serving_turn_program, - steps: serving_turn_steps(), - source: m, - inputs: request.inputs, - runtime_closure: request.runtime_closure, - effect_contract: request.effect_contract, - output_contract: request.output_contract, - output_obligations: serving_turn_output_obligations(), - }, - } +fn serving_turn_contract(request: ServingTurnRequest) -> WorkContract { + WorkContract { + execution: OfferedService { interface: request.interface }, + steps: serving_turn_steps(), + inputs: request.inputs, + effect_contract: request.effect_contract, + output_contract: request.output_contract, + output_obligations: serving_turn_output_obligations(), } } @@ -208,17 +111,10 @@ fn serving_turn_requirements( // THE KEY IS NOT DERIVED HERE. work_for is the fabric's public constructor and the only place a work // key comes from; an earlier spelling called derive_work_key and built the record itself, which is a -// second construction path for one identity and would survive a change to how keys are made. -type ServingTurnWork

- = TurnWorkBound { work: Work

} - | TurnWorkUnestablished { missing: List, obligation: NonEmptyStr } - -fn serving_turn_work

(principal: P, request: ServingTurnRequest, requirements: ExecutionRequirements) -> ServingTurnWork

{ - match serving_turn_contract(request: request) { - TurnContractUnestablished { missing: m, obligation: o } => TurnWorkUnestablished { missing: m, obligation: o } - TurnContractBound { contract: c } => - TurnWorkBound { work: work_for(principal: principal, contract: c, requirements: requirements) } - } +// second construction path for one identity and would survive a change to how keys are made. The +// function takes no offer, launch or endpoint argument, so no realization fact can reach the key. +fn serving_turn_work

(principal: P, request: ServingTurnRequest, requirements: ExecutionRequirements) -> Work

{ + work_for(principal: principal, contract: serving_turn_contract(request: request), requirements: requirements) } // ── STEP REUSE IS NOT THE WARM PREFIX, AND READING IT THAT WAY WAS A CATEGORY ERROR ─────────── diff --git a/dag/gunbc/spark/first_party_serving.dag b/dag/gunbc/spark/first_party_serving.dag index 144ef37da91..ab2e6246c17 100644 --- a/dag/gunbc/spark/first_party_serving.dag +++ b/dag/gunbc/spark/first_party_serving.dag @@ -765,13 +765,15 @@ fn spark_first_party_use_scope

( // a state only a fixture could construct. // // DECLARED FRONTIER (DESIGN section 3c). The production consumer of this function is -// gunbc.harness.harness_seat, which cannot call it yet: product.fabric.selection bind_candidate -// needs a demand identity and a work identity, a WorkKey comes only from product.fabric.work -// derive_work_key, and gunbc.serving.turn_demand serving_turn_contract refuses to produce the source -// manifest that would feed it until the weights, tokenizer and runtime components are each observed. -// TRIGGER: observers of the loaded weight and tokenizer bytes and of the answering incarnation, SUFFICIENT FOR gunbc.serving.turn_demand -// serving_turn_work to return TurnWorkBound for a harness turn. Until then this producer is executed -// by test.claim.spark.spark_first_party_serving_witness_test, which exercises both arms. +// gunbc.harness.harness_seat, which does not call it yet. Work identity is no longer the obstacle: +// gunbc.serving.turn_demand serving_turn_work constructs an OfferedService Work from the request +// alone. The obstacle is that harness_bind_seat receives no normalized turn request -- no interface, +// inputs or output contract -- so it cannot construct that Work and its Demand once at the request +// boundary, and constructing them per offer would put request identity beneath supplier +// enumeration. TRIGGER: harness_bind_seat carries a normalized ServingTurnRequest, SUFFICIENT FOR +// constructing one Work and one Demand before candidate enumeration and passing both, with this +// admission, to product.fabric.selection bind_candidate. Until then this producer is executed by +// test.claim.spark.spark_first_party_serving_witness_test, which exercises both arms. fn spark_first_party_admission

( realization: SparkServingRealization, scope: ProviderUseScope

, diff --git a/dag/gunbc/spark/serving_offer.dag b/dag/gunbc/spark/serving_offer.dag index ca121137ef7..2fa844fc61b 100644 --- a/dag/gunbc/spark/serving_offer.dag +++ b/dag/gunbc/spark/serving_offer.dag @@ -24,7 +24,7 @@ import gunbc.spark.vllm_endpoint_process_launch { VllmEndpointProcessLaunch, vllm_endpoint_process_launch_key, vllm_endpoint_process_launch_is, } import gunbc.spark.vllm_serving_launch { - EndpointIncarnationObservation, EndpointIncarnationStanding, + EndpointIncarnationObservation, EndpointIncarnationObserved, EndpointIncarnationUnobserved, LaunchUnitProvenance, LaunchedFromDeclaredUnit, LaunchedFromDifferentUnit, LaunchUnitDigestsIncomparable, launch_unit_provenance, launch_wire, @@ -32,7 +32,6 @@ import gunbc.spark.vllm_serving_launch { import gunbc.spark.pair_serving_realization { spark_pair_head_unit_name } import std.content_hash { ContentHash, serialize_content_hash } import product.placement_supply { host_identity_eq } -import gunbc.serving.turn_demand { TurnComponentStanding, TurnComponentObserved, TurnComponentUnobserved } import gunbc.serving.serving_availability { ServingAvailability, ServingFrontDoorAvailabilityVerdict, ServingAvailable, ServingUnavailable, ServingAvailabilityUnread, serving_availability_text, } @@ -438,21 +437,6 @@ fn spark_serving_route_standing(realization: SparkServingRealization, declared_u } } -// ── THE RUNTIME COMPONENT OF A SERVING TURN'S SOURCE ─────────────────────────────────────────── -// -// The runtime is the container image the answering incarnation was created from, and it is read ONLY -// through the endpoint-to-incarnation observation. An image digest from the probe with no binding to -// the answering endpoint would be a fact about some launch on those hosts, not about the one serving -// this turn. Weights and tokenizer have no counterpart here: VllmServingLaunch carries no digest of -// the bytes an engine loaded, so gunbc.serving.turn_demand keeps them unobserved. -fn spark_serving_turn_runtime(incarnation: EndpointIncarnationStanding) -> TurnComponentStanding { - match incarnation { - EndpointIncarnationUnobserved { obligation: o } => TurnComponentUnobserved { obligation: o } - EndpointIncarnationObserved { observation: obs } => - TurnComponentObserved { digest: obs.launch.executable_digest, receipt: obs.receipt } - } -} - type SparkOfferBinding

= SparkOfferBound { bound: SparkOfferProjection

} | SparkOfferBindingRefused { group_wire: NonEmptyStr, cause: NonEmptyStr } diff --git a/dag/test/claim/fabric/fabric_capacity_class_witness_test.dag b/dag/test/claim/fabric/fabric_capacity_class_witness_test.dag index 93edd1fca76..f3b5c290b97 100644 --- a/dag/test/claim/fabric/fabric_capacity_class_witness_test.dag +++ b/dag/test/claim/fabric/fabric_capacity_class_witness_test.dag @@ -4,7 +4,7 @@ import std.logic { Bool } import std.types { List, NonEmptyStr, String } import v2.std.live_tree { LiveTreeDisposition, SubstrateInputsOnly } import std.measure { hardware_thread_count } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, CapacityClass, ControlPlaneCapacity, CustomerExecutableCapacity, ExecutionRequirements, Shape, HardRequirements, capacity_class_eq, capacity_class_wire, work_identity_material, WorkContract, WorkStep, @@ -40,11 +40,9 @@ fn cc_slot() -> RunnerSlotIdentity { fn cc_contract() -> WorkContract { WorkContract { - program: "gunbc.program.floor", + execution: MaterializedProgram { program: "gunbc.program.floor", source: "gunbc.source.manifest-1", runtime_closure: "gunbc.runtime.closure-1" }, steps: [], - source: "gunbc.source.manifest-1", inputs: "gunbc.artifact.manifest-1", - runtime_closure: "gunbc.runtime.closure-1", effect_contract: "gunbc.effect.contract-1", output_contract: "gunbc.output.contract-1", output_obligations: declared_artifact_obligations(ids: ["gunbc.output.artifact-1"]), diff --git a/dag/test/claim/fabric/fabric_grant_issuance_witness_test.dag b/dag/test/claim/fabric/fabric_grant_issuance_witness_test.dag index 6f54b8fe54a..73afe4b6383 100644 --- a/dag/test/claim/fabric/fabric_grant_issuance_witness_test.dag +++ b/dag/test/claim/fabric/fabric_grant_issuance_witness_test.dag @@ -17,7 +17,7 @@ import extdeps.accounting.encumbrance { EncumbranceLedger } import product.fabric.identity { FabricIdentity, GrantKey, DemandKey, WorkKey } import product.fabric.isolation { shared_kernel_sandbox_profile } import product.fabric.envelope { unstated_envelope } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, CapacityClass, ControlPlaneCapacity, work_for, declared_artifact_obligations, @@ -66,11 +66,9 @@ data fixture_requirements: ExecutionRequirements = ExecutionRequirements { } data fixture_contract: WorkContract = WorkContract { - program: "gunbc.required-witnesses-build.program:1", + execution: MaterializedProgram { program: "gunbc.required-witnesses-build.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "required-witnesses-build", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: declared_artifact_obligations(ids: ["outputs:1"]), @@ -83,11 +81,9 @@ data foreign_principal: NonEmptyStr = "other-tenant" data subject_work: Work = work_for(principal: owning_principal, contract: fixture_contract, requirements: fixture_requirements) data other_contract: WorkContract = WorkContract { - program: "gunbc.required-witnesses-build.program:2", + execution: MaterializedProgram { program: "gunbc.required-witnesses-build.program:2", source: "source:2", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "required-witnesses-build", resumability: ReceiptSatisfiable }], - source: "source:2", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: declared_artifact_obligations(ids: ["outputs:1"]), diff --git a/dag/test/claim/fabric/fabric_output_contract_resolution_witness_test.dag b/dag/test/claim/fabric/fabric_output_contract_resolution_witness_test.dag index 11fc65b9139..cc7458c911a 100644 --- a/dag/test/claim/fabric/fabric_output_contract_resolution_witness_test.dag +++ b/dag/test/claim/fabric/fabric_output_contract_resolution_witness_test.dag @@ -7,7 +7,7 @@ import gunbc.compile_diagnostic_census { CompileDiagnosticCensus, CensusObserved, CensusNotRunnable, census_rows_of_class, census_total_count, } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, derive_work_key, declared_artifact_obligations, empty_output_obligations, @@ -55,11 +55,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn contract_with(obligations_ids: List) -> WorkContract { WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: declared_artifact_obligations(ids: obligations_ids), @@ -77,11 +75,9 @@ fn resolve_at_start(contract: WorkContract, work_key: WorkKey) -> OutputObligati test fn empty_declared_roster_resolves_as_resolved_empty_not_unreadable() -> Bool { let contract = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: empty_output_obligations(), @@ -106,11 +102,9 @@ test fn resolved_roster_carries_declared_obligations() -> Bool { terminals: ["terminal-b"], ) let contract = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: declared, @@ -136,11 +130,9 @@ test fn changing_obligations_changes_work_key_without_renaming_the_contract() -> // the OutputContractRef cut) made ["a"]+["b"] and ["a","b"]+[] the same WorkKey. test fn artifact_versus_terminal_kind_is_work_key_identity() -> Bool { let shared = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: declared_output_obligations_from_manifests( @@ -149,11 +141,9 @@ test fn artifact_versus_terminal_kind_is_work_key_identity() -> Bool { ), } let collapsed = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: declared_output_obligations_from_manifests( @@ -178,21 +168,17 @@ test fn same_id_artifact_and_terminal_remain_distinct_after_resolve() -> Bool { terminals: [], ) let mixed_contract = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: mixed, } let doubled_contract = WorkContract { - program: "gunbc.probe.output-contract", + execution: MaterializedProgram { program: "gunbc.probe.output-contract", source: "source-1", runtime_closure: "runtime-1" }, steps: [WorkStep { step_id: "probe", resumability: ReceiptSatisfiable }], - source: "source-1", inputs: "inputs-1", - runtime_closure: "runtime-1", effect_contract: "effects-1", output_contract: "gunbc.probe.outputs", output_obligations: doubled_artifact, diff --git a/dag/test/claim/fabric/fabric_terminal_contract_witness_test.dag b/dag/test/claim/fabric/fabric_terminal_contract_witness_test.dag index 15a6a1fbf29..64a71e071ea 100644 --- a/dag/test/claim/fabric/fabric_terminal_contract_witness_test.dag +++ b/dag/test/claim/fabric/fabric_terminal_contract_witness_test.dag @@ -6,7 +6,7 @@ import std.measure { money_amount_micro, money_amount_micro_count, hardware_thre import std.content_hash { content_hash_of_value } import extdeps.currency.currency { Usd } import product.fabric.identity { FabricIdentity, fabric_identity_key, DemandKey, WorkKey, OfferKey } -import product.fabric.work { CapacityClass, ControlPlaneCapacity, Shape, HardRequirements, Work, WorkContract, ExecutionRequirements, WorkStep, derive_work_key, work_for, ReceiptSatisfiable, IdempotentUnderKey, OpaqueEffects, declared_terminal_obligations } +import product.fabric.work { MaterializedProgram, CapacityClass, ControlPlaneCapacity, Shape, HardRequirements, Work, WorkContract, ExecutionRequirements, WorkStep, derive_work_key, work_for, ReceiptSatisfiable, IdempotentUnderKey, OpaqueEffects, declared_terminal_obligations } import product.fabric.demand { Demand, AdmissionTerms, BuyTerms, SatisfactionRequirement, demand_work, demand_reservation_price, demand_maximum_buy_order } import product.fabric.supply { SupplierOffer, QuotedPerSecond, offer_quote_amount, offer_quote_currency, ObservedSupply, QuotedSupply } import product.fabric.execution { Attempt, InitialAttempt, InfrastructureRetry, CapabilityEscalation, LeaseIdentity, Receipt, ExecutionReceipt, ExecutionGrant, FabricGrantObject, FabricGrantContext, FabricGrantEvidence, ReceiptAdmissible, ReceiptFromDifferentLease, ReceiptFromDifferentAttempt, ReceiptFingerprintIncomparable, ReceiptGenerationStale, admit_receipt_for_grant } @@ -39,11 +39,9 @@ data fixture_requirements: ExecutionRequirements = ExecutionRequirements { } data fixture_contract: WorkContract = WorkContract { - program: "gunbc-required-floor", + execution: MaterializedProgram { program: "gunbc-required-floor", source: "sha256:tree-abc", runtime_closure: "toolchain-rust-1.89" }, steps: [WorkStep { step_id: "floor", resumability: ReceiptSatisfiable }], - source: "sha256:tree-abc", inputs: "manifest-inputs-1", - runtime_closure: "toolchain-rust-1.89", effect_contract: "effects-read-only", output_contract: "outputs-verdict", output_obligations: declared_terminal_obligations(ids: ["outputs-verdict"]), @@ -68,11 +66,9 @@ fn work_for_principal(p: NonEmptyStr) -> Work { // derivation has to separate. data other_source_contract: WorkContract = WorkContract { - program: "gunbc-required-floor", + execution: MaterializedProgram { program: "gunbc-required-floor", source: "sha256:tree-DIFFERENT", runtime_closure: "toolchain-rust-1.89" }, steps: [WorkStep { step_id: "floor", resumability: ReceiptSatisfiable }], - source: "sha256:tree-DIFFERENT", inputs: "manifest-inputs-1", - runtime_closure: "toolchain-rust-1.89", effect_contract: "effects-read-only", output_contract: "outputs-verdict", output_obligations: declared_terminal_obligations(ids: ["outputs-verdict"]), @@ -184,11 +180,9 @@ test fn identical_contracts_derive_one_key_regardless_of_who_asked() -> Bool { derive_work_key(contract: fixture_contract, requirements: fixture_requirements) == derive_work_key( contract: WorkContract { - program: "gunbc-required-floor", + execution: MaterializedProgram { program: "gunbc-required-floor", source: "sha256:tree-abc", runtime_closure: "toolchain-rust-1.89" }, steps: [WorkStep { step_id: "floor", resumability: ReceiptSatisfiable }], - source: "sha256:tree-abc", inputs: "manifest-inputs-1", - runtime_closure: "toolchain-rust-1.89", effect_contract: "effects-read-only", output_contract: "outputs-verdict", output_obligations: declared_terminal_obligations(ids: ["outputs-verdict"]), diff --git a/dag/test/claim/fabric_m0_commit_witness_test.dag b/dag/test/claim/fabric_m0_commit_witness_test.dag index 1cb19b233ff..3edc0919d21 100644 --- a/dag/test/claim/fabric_m0_commit_witness_test.dag +++ b/dag/test/claim/fabric_m0_commit_witness_test.dag @@ -7,7 +7,7 @@ import std.measure { hardware_thread_count } import product.fabric.identity { WorkKey } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, derive_work_key, OutputObligation, OutputArtifactObligation, TerminalResultObligation, @@ -158,11 +158,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn the_contract() -> WorkContract { WorkContract { - program: "gunbc.fabric-m0.program:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [build_output(), execution_receipt()] }, diff --git a/dag/test/claim/fabric_m0_completion_witness_test.dag b/dag/test/claim/fabric_m0_completion_witness_test.dag index e1d6641cff5..2b46c191ca8 100644 --- a/dag/test/claim/fabric_m0_completion_witness_test.dag +++ b/dag/test/claim/fabric_m0_completion_witness_test.dag @@ -8,7 +8,7 @@ import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree } import product.fabric.identity { WorkKey } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, derive_work_key, OutputObligation, OutputArtifactObligation, TerminalResultObligation, @@ -88,11 +88,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn contract_owing(required: List) -> WorkContract { WorkContract { - program: "gunbc.fabric-m0.program:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: required }, diff --git a/dag/test/claim/fabric_m0_job_ending_seal_test.dag b/dag/test/claim/fabric_m0_job_ending_seal_test.dag index 779cb0e7474..83622235736 100644 --- a/dag/test/claim/fabric_m0_job_ending_seal_test.dag +++ b/dag/test/claim/fabric_m0_job_ending_seal_test.dag @@ -62,7 +62,7 @@ fn job_ending_probe_source(body: String) -> String { + "import product.fabric.envelope { unstated_envelope }\n" + "import product.fabric.isolation { shared_kernel_sandbox_profile }\n" + "import product.fabric.work {\n" - + " Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements,\n" + + " Work, WorkContract, MaterializedProgram, WorkStep, ReceiptSatisfiable, ExecutionRequirements,\n" + " Shape, HardRequirements, ControlPlaneCapacity, work_for,\n" + " OutputObligation, OutputArtifactObligation, DeclaredOutputObligations,\n" + "}\n" @@ -80,9 +80,9 @@ fn job_ending_probe_source(body: String) -> String { + " work_for(\n" + " principal: \"gunbc\" as NonEmptyStr,\n" + " contract: WorkContract {\n" - + " program: \"gunbc.fabric-m0.program:1\",\n" + + " execution: MaterializedProgram { program: \"gunbc.fabric-m0.program:1\", source: \"source:1\", runtime_closure: \"runtime:1\" },\n" + " steps: [WorkStep { step_id: \"fabric-m0\", resumability: ReceiptSatisfiable }],\n" - + " source: \"source:1\", inputs: \"inputs:1\", runtime_closure: \"runtime:1\",\n" + + " inputs: \"inputs:1\",\n" + " effect_contract: \"effects:1\", output_contract: \"outputs:1\",\n" + " output_obligations: DeclaredOutputObligations { required: [] },\n" + " },\n" diff --git a/dag/test/claim/fabric_m0_job_ending_witness_test.dag b/dag/test/claim/fabric_m0_job_ending_witness_test.dag index 4b4d997b5fe..ec688a8c679 100644 --- a/dag/test/claim/fabric_m0_job_ending_witness_test.dag +++ b/dag/test/claim/fabric_m0_job_ending_witness_test.dag @@ -7,7 +7,7 @@ import std.scoped_authorization { AttemptIdentity } import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, work_for, OutputObligation, OutputArtifactObligation, TerminalResultObligation, @@ -120,11 +120,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn the_contract() -> WorkContract { WorkContract { - program: "gunbc.fabric-m0.program:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [build_output(), execution_receipt()] }, diff --git a/dag/test/claim/fabric_m0_origin_commit_witness_test.dag b/dag/test/claim/fabric_m0_origin_commit_witness_test.dag index 6f0d86a9c4a..c648ff00a73 100644 --- a/dag/test/claim/fabric_m0_origin_commit_witness_test.dag +++ b/dag/test/claim/fabric_m0_origin_commit_witness_test.dag @@ -38,7 +38,7 @@ import std.measure { hardware_thread_count } import std.scoped_authorization { AttemptIdentity } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, work_for, DeclaredOutputObligations, } @@ -189,9 +189,9 @@ fn a_successful_ending(r: OriginReading) -> JobEnding { work: work_for( principal: "gunbc" as NonEmptyStr, contract: WorkContract { - program: "gunbc.fabric-m0.custody-witness:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.custody-witness:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "custody", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", runtime_closure: "runtime:1", + inputs: "inputs:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [] }, }, diff --git a/dag/test/claim/fabric_m0_publication_witness_test.dag b/dag/test/claim/fabric_m0_publication_witness_test.dag index d80227a638c..a6b8cbe6765 100644 --- a/dag/test/claim/fabric_m0_publication_witness_test.dag +++ b/dag/test/claim/fabric_m0_publication_witness_test.dag @@ -7,7 +7,7 @@ import std.scoped_authorization { AttemptIdentity } import v2.std.live_tree { LiveTreeDisposition, ReadsLiveTree } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { shared_kernel_sandbox_profile } -import product.fabric.work { +import product.fabric.work { MaterializedProgram, Work, WorkContract, WorkStep, ReceiptSatisfiable, ExecutionRequirements, Shape, HardRequirements, ControlPlaneCapacity, work_for, OutputObligation, OutputArtifactObligation, TerminalResultObligation, @@ -127,11 +127,9 @@ fn fixture_requirements() -> ExecutionRequirements { fn the_contract() -> WorkContract { WorkContract { - program: "gunbc.fabric-m0.program:1", + execution: MaterializedProgram { program: "gunbc.fabric-m0.program:1", source: "source:1", runtime_closure: "runtime:1" }, steps: [WorkStep { step_id: "fabric-m0", resumability: ReceiptSatisfiable }], - source: "source:1", inputs: "inputs:1", - runtime_closure: "runtime:1", effect_contract: "effects:1", output_contract: "outputs:1", output_obligations: DeclaredOutputObligations { required: [build_output(), execution_receipt()] }, diff --git a/dag/test/claim/serving/turn_demand_witness_test.dag b/dag/test/claim/serving/turn_demand_witness_test.dag index 0d61ccbc3d3..0428ec0000c 100644 --- a/dag/test/claim/serving/turn_demand_witness_test.dag +++ b/dag/test/claim/serving/turn_demand_witness_test.dag @@ -3,165 +3,141 @@ module test.claim.serving.turn_demand_witness import std.types { Bool, String, NonEmptyStr, List } import v2.std.optional { Present, Absent } import product.fabric.work { - ArtifactManifestRef, EffectContractRef, OutputContractRef, ExecutionRequirements, + ArtifactManifestRef, EffectContractRef, OutputContractRef, ExecutionRequirements, ServiceInterfaceRef, ControlPlaneCapacity, Shape, HardRequirements, CapabilityManifestRef, TrustDomainRef, OpaqueEffects, - OutputArtifactObligation, TerminalResultObligation, + OutputArtifactObligation, TerminalResultObligation, Work, WorkContract, MaterializedProgram, OfferedService, + work_for, } import product.fabric.envelope { unstated_envelope } import product.fabric.isolation { IsolationProfile } -import product.fabric.demand { ObservationReceiptRef } import std.measure { hardware_thread_count } import gunbc.serving.turn_demand { - ServingTurnRequest, ServingTurnSource, TurnComponentStanding, TurnComponentObserved, TurnComponentUnobserved, - ServingTurnComponent, TurnWeights, TurnTokenizer, TurnRuntime, - serving_turn_weights_obligation, serving_turn_tokenizer_obligation, - serving_turn_steps, serving_turn_output_obligations, TurnWorkBound, TurnWorkUnestablished, + ServingTurnRequest, serving_turn_contract, serving_turn_steps, serving_turn_output_obligations, serving_turn_work, serving_turn_requirements, serving_turn_satisfaction, } -import std.content_hash { ContentHash, Sha256Hash, Sha256Digest, Sha256DigestHex, compare_content_hash, ContentHashEqual } -import gunbc.spark.serving_offer { spark_serving_turn_runtime, spark_serving_incarnation_unobserved_obligation } -import gunbc.spark.vllm_serving_launch { - vllm_serving_launch, endpoint_incarnation_observation, EndpointIncarnationObserved, EndpointIncarnationUnobserved, +import gunbc.harness.harness_seat { + ServingModelRequirement, AnyAdmittedModel, ExactServingUnit, harness_required_capability, harness_requirement_admits, } -import gunbc.spark.vllm_endpoint_process_launch { vllm_endpoint_process_launch } -import gunbc.spark.fabric_switch_observed { FabricGroupA } -import gunbc.fleet_intent_network { operator_host_srv5 } +import gunbc.harness.harness_reasoning_wire { DeepseekV4FlashOnVllm, Glm53FlashOnVllm } -fn probe_requirements() -> ExecutionRequirements { +// ── A TURN'S WORK IS WHAT THE CALLER ASKED FOR, NOT WHAT A SUPPLIER LOADED ───────────────────── +// +// The previous witness asserted that a turn refused until the selected engine's weights, tokenizer +// and runtime were each observed. That was the wrong boundary: it made request identity depend on +// the supplier's realization, and since nothing can observe loaded weight bytes it refused every +// turn. These controls pin the replacement. The model requirement reaches identity through the +// requirements' capability, exactly as the harness supplies it; nothing about an offer can reach it, +// which is a property of serving_turn_work's signature (it takes no offer, launch or endpoint). + +fn t_requirements(requirement: ServingModelRequirement) -> ExecutionRequirements { serving_turn_requirements( capacity_class: ControlPlaneCapacity, - capabilities: "gunbc.capabilities.spark-serving.probe" as CapabilityManifestRef, + capabilities: harness_required_capability(requirement: requirement) as CapabilityManifestRef, trust_domain: "gunbc.trust.spark-fleet" as TrustDomainRef, isolation: IsolationProfile { guarantees: [] }, shape: Shape { hard: HardRequirements { threads: hardware_thread_count(count: 0) }, envelope: unstated_envelope() }, ) } -fn request_with(source: ServingTurnSource) -> ServingTurnRequest { +fn t_request(inputs: String) -> ServingTurnRequest { ServingTurnRequest { - source: source, - runtime_closure: "probe.runtime" as ArtifactManifestRef, - inputs: "probe.inputs" as ArtifactManifestRef, + interface: "openai.chat-completions" as ServiceInterfaceRef, + inputs: inputs as ArtifactManifestRef, effect_contract: "probe.effects" as EffectContractRef, output_contract: "probe.outputs" as OutputContractRef, } } -// ── A SOURCE IS THREE COMPONENTS, EACH REFUSABLE ON ITS OWN ─────────────────────────────────── -// -// What shipped before cast the served model alias straight into SourceManifestRef, and after that the -// source was one unestablished-or-not value. Now weights, tokenizer and runtime are separate standings, -// and the refusal names every one that is missing. The observed digests below are FIXTURE EVIDENCE: -// nothing in this repository observes loaded weight or tokenizer bytes. - -fn t_sha256(hex: String) -> ContentHash { - Sha256Hash(Sha256Digest { hex: hex as Sha256DigestHex }) -} - -fn t_observed(hex: String) -> TurnComponentStanding { - TurnComponentObserved { digest: t_sha256(hex: hex), receipt: "test.claim.serving.turn_demand_witness fixture" as ObservationReceiptRef } -} - -fn t_source(weights: TurnComponentStanding, tokenizer: TurnComponentStanding, runtime: TurnComponentStanding) -> ServingTurnSource { - ServingTurnSource { weights: weights, tokenizer: tokenizer, runtime: runtime } -} - -data t_w1: String = "1111111111111111111111111111111111111111111111111111111111111111" -data t_w2: String = "2222222222222222222222222222222222222222222222222222222222222222" -data t_tok: String = "3333333333333333333333333333333333333333333333333333333333333333" -data t_rt: String = "4444444444444444444444444444444444444444444444444444444444444444" - -fn t_all_observed(weights_hex: String) -> ServingTurnSource { - t_source(weights: t_observed(hex: weights_hex), tokenizer: t_observed(hex: t_tok), runtime: t_observed(hex: t_rt)) -} - -fn t_component_is(c: ServingTurnComponent, want: ServingTurnComponent) -> Bool { - match c { - TurnWeights => match want { TurnWeights => true _ => false } - TurnTokenizer => match want { TurnTokenizer => true _ => false } - TurnRuntime => match want { TurnRuntime => true _ => false } +fn t_key(requirement: ServingModelRequirement, inputs: String) -> String { + serving_turn_work(principal: "gunbc" as NonEmptyStr, request: t_request(inputs: inputs), requirements: t_requirements(requirement: requirement)).id.key as String +} + +// POSITIVE CONTROL. An AnyAdmittedModel turn constructs Work with no observation of any engine, and +// the Work is an offered service rather than a materialized program. +test fn any_admitted_model_work_constructs_as_an_offered_service() -> Bool { + let w = serving_turn_work(principal: "gunbc" as NonEmptyStr, request: t_request(inputs: "probe.inputs"), requirements: t_requirements(requirement: AnyAdmittedModel)) + length(w.contract.steps) == 1 + && length(w.id.key as String) > 0 + && (match w.contract.execution { + OfferedService { interface: i } => (i as String) == "openai.chat-completions" + MaterializedProgram { program: _, source: _, runtime_closure: _ } => false + }) +} + +// THE MODEL SCREEN ADMITS EITHER UNIT UNDER AnyAdmittedModel. This row proves exactly that and no +// more: it drives harness_requirement_admits over the two unit values. It does not construct two +// supplier offers and does not run fabric fungibility, so it is not evidence that one Work binds +// on either supplier -- that control belongs beside a stable pair of SupplierOffers, which the +// harness admission change owes (gunbc#11411). +test fn the_model_screen_admits_either_unit_under_any_admitted_model() -> Bool { + harness_requirement_admits(requirement: AnyAdmittedModel, observed: DeepseekV4FlashOnVllm) + && harness_requirement_admits(requirement: AnyAdmittedModel, observed: Glm53FlashOnVllm) +} + +// RED: THE IDENTITY PREIMAGE IS INJECTIVE IN THE FIELD TUPLE. Two materialized programs that differ +// only in which side of a field boundary a separator byte falls are different Work; a joined +// preimage folded them onto one key. The same holds across the execution/steps boundary and inside +// the step list. +test fn a_separator_moved_across_a_field_boundary_is_different_work() -> Bool { + let service = serving_turn_contract(request: t_request(inputs: "probe.inputs")) + let req = t_requirements(requirement: AnyAdmittedModel) + let left = WorkContract { + execution: MaterializedProgram { program: "a", source: "b\u{1d}c", runtime_closure: "d" }, + steps: service.steps, inputs: service.inputs, effect_contract: service.effect_contract, + output_contract: service.output_contract, output_obligations: service.output_obligations, } -} - -fn t_missing_exactly(source: ServingTurnSource, want: List) -> Bool { - match serving_turn_work(principal: "gunbc" as NonEmptyStr, request: request_with(source: source), requirements: probe_requirements()) { - TurnWorkBound { work: _ } => false - TurnWorkUnestablished { missing: m, obligation: _ } => - length(m) == length(want) - && fold(want, init: true, f: (acc, w) => acc && any(m, x => t_component_is(c: x, want: w))) + let right = WorkContract { + execution: MaterializedProgram { program: "a\u{1d}b", source: "c", runtime_closure: "d" }, + steps: service.steps, inputs: service.inputs, effect_contract: service.effect_contract, + output_contract: service.output_contract, output_obligations: service.output_obligations, } -} - -// POSITIVE CONTROL. Every component observed mints Work through the fabric's own constructor. -test fn three_observed_components_mint_work_through_the_fabric_constructor() -> Bool { - match serving_turn_work(principal: "gunbc" as NonEmptyStr, request: request_with(source: t_all_observed(weights_hex: t_w1)), requirements: probe_requirements()) { - TurnWorkBound { work: work } => length(work.contract.steps) == 1 && length(work.id.key as String) > 0 - TurnWorkUnestablished { missing: _, obligation: _ } => false + let unit_left = WorkContract { + execution: MaterializedProgram { program: "a", source: "b", runtime_closure: "d\u{1f}" }, + steps: service.steps, inputs: service.inputs, effect_contract: service.effect_contract, + output_contract: service.output_contract, output_obligations: service.output_obligations, } -} - -// RED, ONE PER COMPONENT. Each drops exactly one observation and must name exactly that component. -test fn unobserved_weights_refuse_and_name_only_weights() -> Bool { - t_missing_exactly( - source: t_source(weights: TurnComponentUnobserved { obligation: serving_turn_weights_obligation }, tokenizer: t_observed(hex: t_tok), runtime: t_observed(hex: t_rt)), - want: [TurnWeights], - ) -} - -test fn unobserved_tokenizer_refuses_and_names_only_tokenizer() -> Bool { - t_missing_exactly( - source: t_source(weights: t_observed(hex: t_w1), tokenizer: TurnComponentUnobserved { obligation: serving_turn_tokenizer_obligation }, runtime: t_observed(hex: t_rt)), - want: [TurnTokenizer], - ) -} - -test fn unobserved_runtime_refuses_and_names_only_runtime() -> Bool { - t_missing_exactly( - source: t_source(weights: t_observed(hex: t_w1), tokenizer: t_observed(hex: t_tok), runtime: TurnComponentUnobserved { obligation: spark_serving_incarnation_unobserved_obligation }), - want: [TurnRuntime], - ) -} - -// RED -- THE PRODUCTION STANDING OF TODAY: weights and tokenizer have no observer, and the runtime is -// read through spark_serving_turn_runtime from the incarnation standing production carries, which is -// unobserved. All three are named. -test fn todays_standing_refuses_naming_all_three_components() -> Bool { - t_missing_exactly( - source: t_source( - weights: TurnComponentUnobserved { obligation: serving_turn_weights_obligation }, - tokenizer: TurnComponentUnobserved { obligation: serving_turn_tokenizer_obligation }, - runtime: spark_serving_turn_runtime(incarnation: EndpointIncarnationUnobserved { obligation: spark_serving_incarnation_unobserved_obligation }), - ), - want: [TurnWeights, TurnTokenizer, TurnRuntime], - ) -} - -// THE RUNTIME READS THE IMAGE DIGEST OF THE OBSERVED INCARNATION, and nothing else. Fixture evidence: -// no production producer constructs the observation. -test fn the_runtime_component_is_the_observed_incarnations_image_digest() -> Bool { - let launch = vllm_serving_launch( - group: FabricGroupA, head: operator_host_srv5, - systemd_invocation: "fixture-invocation-1" as NonEmptyStr, container_id: "fixture-container-1" as NonEmptyStr, - executable_digest: t_sha256(hex: t_rt), unit_digest: t_sha256(hex: t_tok), started_at: 1788907506, - ) - let endpoint = vllm_endpoint_process_launch(group: FabricGroupA, endpoint: "http://10.0.0.1:8000" as NonEmptyStr, process_start_field: "1" as NonEmptyStr) - match spark_serving_turn_runtime(incarnation: EndpointIncarnationObserved { observation: endpoint_incarnation_observation(endpoint: endpoint, launch: launch, receipt: "fixture" as ObservationReceiptRef) }) { - TurnComponentObserved { digest: d, receipt: _ } => match compare_content_hash(left: d, right: t_sha256(hex: t_rt)) { ContentHashEqual => true _ => false } - TurnComponentUnobserved { obligation: _ } => false + let unit_right = WorkContract { + execution: MaterializedProgram { program: "a", source: "b", runtime_closure: "d" }, + steps: service.steps, inputs: service.inputs, effect_contract: service.effect_contract, + output_contract: service.output_contract, output_obligations: service.output_obligations, } -} - -// TWO WEIGHT DIGESTS ARE TWO WORKS. A manifest bound to content makes different loaded bytes a -// different key without anyone deciding it should be. -test fn different_weight_bytes_are_different_works() -> Bool { - match serving_turn_work(principal: "gunbc" as NonEmptyStr, request: request_with(source: t_all_observed(weights_hex: t_w1)), requirements: probe_requirements()) { - TurnWorkUnestablished { missing: _, obligation: _ } => false - TurnWorkBound { work: a } => - match serving_turn_work(principal: "gunbc" as NonEmptyStr, request: request_with(source: t_all_observed(weights_hex: t_w2)), requirements: probe_requirements()) { - TurnWorkUnestablished { missing: _, obligation: _ } => false - TurnWorkBound { work: b } => (a.id.key as String) != (b.id.key as String) - } + (work_for(principal: "gunbc" as NonEmptyStr, contract: left, requirements: req).id.key as String) + != (work_for(principal: "gunbc" as NonEmptyStr, contract: right, requirements: req).id.key as String) + && (work_for(principal: "gunbc" as NonEmptyStr, contract: unit_left, requirements: req).id.key as String) + != (work_for(principal: "gunbc" as NonEmptyStr, contract: unit_right, requirements: req).id.key as String) +} + +// RED: AN EXACT REQUIREMENT IS NOT WEAKENED. Exact DeepSeek and exact GLM are different Work, and each +// differs from AnyAdmittedModel, so removing supplier realization from identity did not collapse a +// requirement the caller actually stated. +test fn exact_model_requirements_are_different_works() -> Bool { + let ds = t_key(requirement: ExactServingUnit { unit: DeepseekV4FlashOnVllm }, inputs: "probe.inputs") + let glm = t_key(requirement: ExactServingUnit { unit: Glm53FlashOnVllm }, inputs: "probe.inputs") + let any = t_key(requirement: AnyAdmittedModel, inputs: "probe.inputs") + ds != glm && ds != any && glm != any + && !harness_requirement_admits(requirement: ExactServingUnit { unit: DeepseekV4FlashOnVllm }, observed: Glm53FlashOnVllm) +} + +// RED: DIFFERENT NORMALIZED INPUTS ARE DIFFERENT WORK. +test fn different_inputs_are_different_works() -> Bool { + t_key(requirement: AnyAdmittedModel, inputs: "probe.inputs.a") != t_key(requirement: AnyAdmittedModel, inputs: "probe.inputs.b") +} + +// RED: THE EXECUTION ARM IS IDENTITY. A materialized program whose spellings coincide with a service's +// is never the same Work, so the new arm cannot alias an existing program key. +test fn a_program_and_a_service_sharing_every_other_field_are_different_works() -> Bool { + let service = serving_turn_contract(request: t_request(inputs: "probe.inputs")) + let program = WorkContract { + execution: MaterializedProgram { program: "openai.chat-completions", source: "openai.chat-completions", runtime_closure: "openai.chat-completions" }, + steps: service.steps, + inputs: service.inputs, + effect_contract: service.effect_contract, + output_contract: service.output_contract, + output_obligations: service.output_obligations, } + let req = t_requirements(requirement: AnyAdmittedModel) + (work_for(principal: "gunbc" as NonEmptyStr, contract: service, requirements: req).id.key as String) + != (work_for(principal: "gunbc" as NonEmptyStr, contract: program, requirements: req).id.key as String) } // ── A STREAMED TURN IS NOT RESUMABLE AND ITS STEP IS NOT REUSABLE ─────────────────────────────