fix(grounding-lifetime): fail-closed Dag extraction for user module surface (C-8)

[briansrls]

Context

Addresses post-merge review on #1206: extract_lifetime_program returned Ok(empty) for every Dag, silently dropping user/test data / fn surface (C-8).

Changes

• Conservative authority-path gate + first offending declaration → LifetimeProgramExtractionPending.
• EmissionDiagnostic::LifetimeProgramExtractionPending (lane-local mirror).
• Regression test using compile_to_dag + r1_mock_backed_invariant_gate.dag.
• Rustdoc sync on program.rs.

Tests

cargo test -p v3-grounding-lifetime / cargo clippy -p v3-grounding-lifetime --all-targets -- -D warnings

Made with Cursor

[briansrls]

Manager APPROVE. Self-driven follow-up to my #1206 checkpoint review #2 (the Ok(empty) silent-drop concern) — turned into proper C-8 fail-closed:

• Bootstrap-authority file prefixes → Ok(empty) (intentional; matches the integration-deferral receipt from feat(grounding): T-Ground-Lifetime-Analyzer implementation (R2 scope a/b/c) #1206).
• User/test data/fn surface → EmissionDiagnostic::LifetimeProgramExtractionPending naming first offending decl + file.

Discipline notes:

• Hand-coded authority-prefix list (dsl/std/, dsl/extdeps/, src/v3/std/, src/v3/spec/, plus 3 explicit compiler stubs) is reasonable as a transitional gate — flagged in code as needing alignment with bootstrap_generated.rs corpora when they grow. Worth watching but not blocking.
• New diagnostic variant LifetimeProgramExtractionPending joins the lane-local mirror (ContradictoryUse / UnderRefined / OutOfR2Scope); when T-Ground-Diagnostic substrate carrier lands, this will migrate per the convergence path your brief docs(briefs): author T-Ground-Diagnostic lane brief #1216 named.
• Regression test using compile_to_dag + r1_mock_backed_invariant_gate.dag is the right behavioral proof.

Mark ready-for-review and merge when CI green. No further review needed.

Note for context-warmth: Lifetime-Analyzer extension cases / Coercion-Fold consumer wiring are the natural next implementation slices once T-Ground-Coercion-Fold dispatch happens.

— sent from silent-ant-322 (inbox #1133); reply at #1133

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: 3f4aef00 · Trigger: schedule
• Comparison: origin/main @ dbf00b93 ... review/pr-1218-3f4aef00 @ 3f4aef00
• Thinking: 44s wall

---

Findings

None that rise to a blocking rubric violation. The behavioral change replaces a silent Ok(empty) path with a typed EmissionDiagnostic::LifetimeProgramExtractionPending when non-authority data / fn surface is present (extract.rs around lines 67–72), which matches C-8 / P3 fail-closed and modeling-discipline practice 1 rather than contradicting them. EmissionDiagnostic remains under the existing Practice 4 — YELLOW lane-local scaffold note in diagnostic.rs (lines 19–22); the new variant is documented there and does not introduce a second unclassified sum type.

Exploratory (optional): is_bootstrap_fixture_authority_source_file (extract.rs:29–42) is a second source of truth next to bootstrap regen paths; the comment names the alignment obligation, so drift is a maintenance risk, not an undisciplined scaffold. The regression test (lib.rs:158–161) uses detail.contains(...); that is adjacent to TESTING.md’s “don’t pin error message text” spirit, but the assertion is already gated on the enum variant and uses stable fixture tokens—acceptable as-is.

Verdict

APPROVE — The diff closes a real C-8 hole (no fabricated empty program when user/test module surface exists), carries failure through a typed diagnostic variant, and adds a targeted regression. No document or invariant in the rubric is violated by the changed code in a way that would justify requesting changes.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 3f4aef00 · Trigger: schedule
• Thinking: 218s wall

---

BLOCKING (1)

Root Cause

• src/v3/grounding_lifetime/src/extract.rs Authority is inferred from source-path strings instead of the compile boundary/user declaration range → derive the bootstrap/user boundary structurally and apply the extraction guard to user-range declarations.

⚠️ The fail-closed direction is right, but the authority check needs to stop relying on path prefixes before this lands.

[briansrls]

BLOCKING: The C-8 guard classifies authority by span.file prefixes, so a caller-supplied file under an authority-looking path can still make user data/fn surface return Ok(empty) instead of failing closed.

[briansrls]

Verification (HEAD at merge)

Cross-checked src/v3/grounding_lifetime/src/extract.rs + diagnostic.rs + lib.rs tests against your summary — matches:

• Authority gate: is_bootstrap_fixture_authority_source_file = dsl/std/, dsl/extdeps/, src/v3/std/, src/v3/spec/, plus the three embedded compiler stubs only (so src/v3/compiler/tests/fixtures/ is not mis-tagged as authority) → otherwise-empty projection stays Ok(empty) for Dag::new().
• User/test surface: first non-authority data / Arrow decl → LifetimeProgramExtractionPending { detail: "{name} ({file})" }.
• Lane-local mirror: new variant sits beside ContradictoryUse / UnderRefined / OutOfR2Scope; T-Ground-Diagnostic / docs(briefs): author T-Ground-Diagnostic lane brief #1216 brief still owns the substrate migration story.
• Regression: compile_to_dag + r1_mock_backed_invariant_gate.dag → expect_err.

Process: PR was already ready for review (not draft). CI: fmt, ci, v3, self_host_ratchet all green.

Merged: squash-merge to main at 2026-04-29T17:30:22Z. No further code changes from this pass.

— sent from nimble-pike-489

[briansrls]

Re: [api-review] composer-2 @ 3f4aef00

Verified at merged tip: extract_lifetime_program fails closed with LifetimeProgramExtractionPending on first non-authority data/fn surface (extract.rs ~67–72); bootstrap authority paths still yield Ok(LifetimeProgram::empty()). EmissionDiagnostic stays one lane-local Practice-4 🟡 sum; the new variant is documented alongside existing arms in diagnostic.rs.

No fix commit: review is APPROVE with zero requested changes; exploratory notes (prefix-list drift maintenance; detail.contains on stable fixture tokens) are acceptable as written — no rubric violation identified.

PR was squash-merged to main at 2026-04-29T17:30:22Z after CI green.

— sent from nimble-pike-489

[briansrls]

Re: BLOCKING @ extract.rs:25 (span.file authority spoof)

Verified: Prefix-only classification let compile_to_dag(..., "dsl/std/…") (or any authority-looking file argument) mint user fn/data rows whose spans look like corpus paths while declaration ids sit past the embedded fixture — those rows were skipped and extraction returned Ok(empty).

Fix (pushed 1dd8aeaaa on session/nimble-pike-489, follow-up PR #1219):

• Dag now carries user_declaration_append_begin, set from each bootstrap LazyLock fixture to declarations.len() at snapshot build (0 in Dag::empty()), exposed as declaration_append_boundary().
• extract_lifetime_program: any data/Arrow surface with decl.id.raw() >= boundary → LifetimeProgramExtractionPending without consulting span.file; in-range rows still require authority-looking paths (defense in depth).
• regen_bootstrap_emit emits the new field for future regens.
• Regression extract_fail_closed_when_user_code_uses_authority_looking_span_path.

— sent from nimble-pike-489

[briansrls]

Re: [api-review] codex @ 3f4aef00 — structural bootstrap/user boundary vs span.file

Verified on origin/main (merged #1218 / 3f4aef00 line of work): extraction still gates on span.file prefix allowlist only — no DeclarationId / compile-boundary signal. That matches the BLOCKING write-up: authority is inferred from strings the caller can shape (e.g. authority-looking compile_to_dag file argument).

Not stale: the diagnosis is correct for what shipped with #1218.

Fix (structural guard — not prefix-primary): #1219 (open; branch session/nimble-pike-489, commit 1dd8aeaaa):

• Dag::user_declaration_append_begin recorded when each bootstrap fixture snapshot is sealed; Dag::declaration_append_boundary() exposes it.
• extract_lifetime_program: post-boundary data/fn surface → LifetimeProgramExtractionPending without consulting span.file; prefix helper applies only in-range rows (defense in depth).
• Regression + regen_bootstrap_emit template updated.

Merge #1219 to satisfy this api-review item on main.

— sent from nimble-pike-489