Repository navigation
T2a: keying relations for the T1 families -- evaluation vs result-content identity; request_key store migration - #11533
Closed
gunbai-bot[bot] wants to merge 43 commits into
Closed
gunbai-bot[bot] wants to merge 43 commits into
gunbai-bot[bot] wants to merge 43 commits into
Conversation
…lity. request_key now reads JudgmentContract.identity_derivation; FNV stays a bucket with a typed preimage-verified exception until an in-memory cryptographic HashFamily member exists in .dag. Co-authored-by: Cursor <cursoragent@cursor.com>
A foreign object at this key is evaluation_preimage_mismatch; the contract arms still discriminate when the stored preimage matches the lookup and kind or recorded request_key is forged, including the wet wrong-kind inhabitance. Co-authored-by: Cursor <cursoragent@cursor.com>
…-address producer. Length-prefix the demand codec with a round-trip decoder, name objects by generation v2, and bind results on canonical preimages rather than FNV digest equality so the six HOLD findings cannot recur as silent forks. Co-authored-by: Cursor <cursoragent@cursor.com>
…mage at the provider door. FamilyRefused stays terminal, typecheck FNV inhabits the preimage-verified bucket, ResultContentIdentity is minted as a unit, and the consumer census joins an independent observed roster rather than aliasing request_key. Co-authored-by: Cursor <cursoragent@cursor.com>
…string filter. Dropping any line that contained the diagnostics id also deleted result_preimage, so lookup refused malformed instead of contract_incomplete and required-witnesses-floor went red. Co-authored-by: Cursor <cursoragent@cursor.com>
…robes at the provider door. request_key is the evaluation bucket; FamilyRefused is no longer mapped to a dummy key, none, malformed, or uninterpretable. PersistedProbe carries a decoder-minted observed preimage; the resolved-graph disk route refuses unqualified format; commit verify preserves result-identity outcomes; the object codec round-trips sha256/sha512 wire keys. Co-authored-by: Cursor <cursoragent@cursor.com>
…ist position. The typecheck arm now consumes typed_module_key from the fold's coproduct arguments, so an empty or tag-matched list cannot mint a non-authority key. Co-authored-by: Cursor <cursoragent@cursor.com>
…ring. Observed callers come from decl_facts over the accepted production graph; persist derives identity and digest together as EvaluationBucket; InProcessProbe compares EvaluationIdentity before binding lookup. Co-authored-by: Cursor <cursoragent@cursor.com>
…mmit-conflict arm. Parse admits a wire string only when serialize(parse(t)) equals t, so a valid digest with a repeated prefix cannot mint a key. StoreCommitConflict had no producer beside the three result-identity refusals. Co-authored-by: Cursor <cursoragent@cursor.com>
EvaluationBucket now holds identity, digest, and preimage from one mint. provider_serve, persist, and store lookup/commit consume that carrier instead of re-encoding at every probe. Co-authored-by: Cursor <cursoragent@cursor.com>
…ocess observation. Observed callers now come from the complete production import graph with module-scoped DeclarationRef resolution, and InProcessMaterialization is minted with the request's EvaluationBucket rather than a caller-asserted identity. Co-authored-by: Cursor <cursoragent@cursor.com>
…ormat wall. The stored-graph route now refuses UnqualifiedPersistedFormat instead of synthesizing a preimage; map that tag to a typed consumer outcome and retarget the enrolled hit/wrong-key/wrong-content assertions so they still execute the real door. Co-authored-by: Cursor <cursoragent@cursor.com>
Stop walking the production import graph in the interpreter (the 2M-step floor reds). Observe alias vs same-leaf vs qualified from compile_dag_resolved_call_edges. Mint the stale typecheck probe on the serve request so WrongArtifact still fires after the in-process preimage wall. Drop the unused StoreLookupObjectMalformed import. Co-authored-by: Cursor <cursoragent@cursor.com>
Derive the affected set from the import graph, emit only ResolvedCallee edges, and load the alias fixture from the committed checkout so the join cannot stay green against a stale population. Co-authored-by: Cursor <cursoragent@cursor.com>
A builtin refusal is no longer mapped to an empty caller list, so a join or alias check cannot treat an unobserved graph as zero call sites. Co-authored-by: Cursor <cursoragent@cursor.com>
…imports. The import graph stays as a cheaper candidate source; production census now also admits modules that mention a home qualification with no import, and the join no longer runs a duplicate check on a uniqued caller list. Co-authored-by: Cursor <cursoragent@cursor.com>
…te substrings. Candidate walk is fail-closed; the production probe is gone; the fixture qualified call is the import-miss discriminator. Co-authored-by: Cursor <cursoragent@cursor.com>
The __WORKSPACE_CHECKOUT__ sentinel forked compile_dag_resolved_call_edges and the reference-occurrence census; mutation now uses the fixture callsite walk, and the unused workspace wrappers are gone. Co-authored-by: Cursor <cursoragent@cursor.com>
Name the cache map so type_complexity does not red the build lane, select call-form leaves instead of every importer, and home the join witnesses under test.claim.long — they compile a live-tree census. Co-authored-by: Cursor <cursoragent@cursor.com>
Namespace-alias resolution is still follow-on work; the projection specimen does not establish a ResolvedCallee, so this census keeps import/call-form discovery and records the requalification trigger instead of a reverse-alias walk with no RED. Co-authored-by: Cursor <cursoragent@cursor.com>
FalsifierSubstrateLongLane has no scheduled route, so a long-home file without exact admission is silence. Call-form discovery skips files that cannot contain the target leaves so the join stays a host resolve of real callers. Co-authored-by: Cursor <cursoragent@cursor.com>
… memo. Review 66921: consumer/provider_declaration had no DAG readers, import-only and joined folds had no call sites, and IMPORTER_RESOLVED_CALL_EDGE_CACHE keyed a live-tree walk without a tree digest. Co-authored-by: Cursor <cursoragent@cursor.com>
…all control. Review 66936: Hit/wrong-key/wrong-content on serve_resolved_graph_stored_disk_probe are indistinguishable under UnqualifiedPersistedFormat. Do not restore FNV hits; roster the §4b(3) drop and collapse the four constant tests to that drop's control. Co-authored-by: Cursor <cursoragent@cursor.com>
… import. EvaluationStoreAddressAdmission is Admitted or FamilyRefused; standing stays on the sole_constructor address. local_store_lookup no longer imports store_lookup_decide. Co-authored-by: Cursor <cursoragent@cursor.com>
…witness tree. DiscoverySelection floor run 35136231290 interrupted the production store-address join at the 8s wall because each census indexed dag+src/v2 even when the scan already named a smaller pool. Fixture import-miss paid the same index and crossed the enrolment margin. Co-authored-by: Cursor <cursoragent@cursor.com>
… fail-closed src/v2 call-form guard. Keep scoped resolve for declared pools. Production remains dag ∪ src/v2: exact ResolvedCallee join runs on dag, and a token-scan guard over src/v2 refuses any call-form candidate for the three leaves until option A restores one exact join. Co-authored-by: Cursor <cursoragent@cursor.com>
… not the caller horizon. Scan still selects candidates from dag. Each selected entry now resolves through witness_layer_roots (dag ∪ src/v2) so v2.compiler.self_host.generation is in the dependency pool, and a graph with blocking diagnostics is refused before ResolvedCallee projection. Co-authored-by: Cursor <cursoragent@cursor.com>
…lly returns. interpreter_blocking_diagnostic_messages yields Rc<im::Vector<String>>, which has no join; CI on 25a45f8 failed to build before any floor census. Co-authored-by: Cursor <cursoragent@cursor.com>
…cation row. Review 67025: unenumerated hand Rust in emit_host is a v1 freeze stop-line. The row names the three census builtins, states PURPOSE (no substrate compile/tokenize), and dissolves on option A. Co-authored-by: Cursor <cursoragent@cursor.com>
The floor typechecks dag fixtures. Calling the real digest with Int failed inhabitance; a local leaf-call still trips the token guard and stays outside the production denominator. Co-authored-by: Cursor <cursoragent@cursor.com>
…ned root. The dummy digest lives in an unscanned home fixture; the scanned caller only invokes it. An absent sibling root with no invocation must qualify, so deleting the call-form cannot keep the control green on the declaration. Co-authored-by: Cursor <cursoragent@cursor.com>
…e leaf. The floor interrupted the production join and timed the fixture import-miss over the enrolment margin because both host paths tokenized or resolved far beyond the files that actually call. Skip tokenize unless a leaf sits at an identifier boundary before `(`, and resolve fixture pools against themselves instead of rebuilding the live-tree universe. Co-authored-by: Cursor <cursoragent@cursor.com>
A '//' annotation between the leaf and '(' is a call form after tokenize (newline trivia) and a miss at the byte layer. The prefilter now only requires the target leaf at an identifier boundary; first_call_form_leaf stays the sole call-form authority.
Co-authored-by: Cursor <cursoragent@cursor.com>
lookup_is_refused_store_family had no caller. The two used Bool wrappers restated lookup_fold in std. Witnesses now fold those two arms locally; the pre-existing lookup_is_refused_* family is untouched. Co-authored-by: Cursor <cursoragent@cursor.com>
The prior roster listed seven public builtins and claimed the scan helpers already existed; they do not exist on origin/main. The row now names the carriers, the three builtins, and every private helper this change added, and ExistingSeedItemModified is restricted to resolve_entry_graph_shared plus generated dispatch. Co-authored-by: Cursor <cursoragent@cursor.com>
…etimes. Five added v1-tests items were outside the census option-A row. Four format-wall controls retire with persisted-format restoration; the provider-ctx reuse test is a separate property and a separate trigger. Co-authored-by: Cursor <cursoragent@cursor.com>
The exact-head production join is no longer a floor test fn; re-derive it via gunbc run on that function. Fixture import-miss and same-leaf keep real resolve inhabitance without occupying the process-shared whole-corpus slot. Co-authored-by: Cursor <cursoragent@cursor.com>
Whole-corpus census and the src/v2 scan now have a named refusing producer (not a floor witness and not a CI job). Drop the pass-through exact_resolved_roots conjunct from qualification. Co-authored-by: Cursor <cursoragent@cursor.com>
The gunbc test producer no longer remints roster or census parameters in Rust; it resolves gunbc.evaluation_store_address_census and runs the join that already reads those rows. Co-authored-by: Cursor <cursoragent@cursor.com>
The required-witnesses-build clippy lane treats that lint as an error. Co-authored-by: Cursor <cursoragent@cursor.com>
…to Bool false. The enrolled join now returns a three-arm standing so the host can distinguish Held, roster/join miss, and typed census/coverage refusal. Co-authored-by: Cursor <cursoragent@cursor.com>
…nt_name. review 67249: the helper was unrostered seed growth, and Display-string starts_with flattened the typed ExactHeadStanding arms. Co-authored-by: Cursor <cursoragent@cursor.com>
Ledger-Repair-Judged: docs/design-rung-drops.md Ledger-Rows-Repaired: docs/design-rung-drops.md persisted_resolved_graph_disk_probe_unqualified_format
briansrls
marked this pull request as ready for review
September 17, 2026 20:40
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
Author
|
Duplicate of #11458 (same branch session/witty-pike-426), which merged the T2a keying work into main. This PR only re-applies already-merged content; closing as a duplicate per the lane handoff. — sent from fierce-seal-607 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0b3bbd7905
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| payloads: List<ArtifactPayload>, | ||
| address: EvaluationStoreAddress | ||
| ) -> StoreCommitPreparation { | ||
| let key = evaluation_store_address_digest(address: address) |
There was a problem hiding this comment.
When two same-kind requests have different canonical preimages but collide in the admitted FNV bucket, an imported caller can pass request B with address A to this unrestricted helper. request_artifact_binding sees only the shared digest and accepts the manifest, while the object is named and stamped with A's preimage but contains B's payload; a normal lookup for A then accepts and serves B's result, defeating the preimage collision protection introduced here. Derive the address from req inside this function or explicitly verify that its identity and canonical preimage match the request before preparing the object.
Useful? React with 👍 / 👎.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
witty-pike-426.Pushing to
session/witty-pike-426advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan