feat(v3): workflow_root_port accessor + WorkflowRoot sum (Prereq-3a)

[briansrls]

Summary

First substrate slice from the merged audit at docs/design-lens-fold-prerequisites.md (PR #1207 / #1217). Implements the Director-locked α rule (last topological Bind) behind a fail-closed WorkflowRoot accessor that fold_lens<C> and R2-Evaluator share. Per dispatch on parent inbox #1130 (2026-04-29).

P1 / P2 receipt

• P1 Step 1 — DAG ancestor: WorkflowRoot is a sibling-coproduct to existing reflected substrate sums (Behavior, WorkflowEffect); it lives in v3.std.substrate next to lane2_workflow_at and shares the same host <name> accessor pattern. workflow_root_port is structurally adjacent to lane2_workflow_at / resolve_producer / port / node / declaration_by_id.
• P1 Step 2 — single fact per arm: SingleRoot(PortId) carries the workflow-root port; NoRoot is a nullary failure surface; AmbiguousRoot { candidates } carries the multi-entry enumeration. Three independent variants partition every legitimate Dag exactly once.
• P2 — single authority: Dag::workflow_root_port is the only Rust-side workflow-root identification; both fold_lens<C> and R2-Evaluator's runtime entry-point identification are planned consumers per the merged audit cross-reference.

Substrate change

• Edit src/v3/std/substrate.dag: declare WorkflowRoot = SingleRoot(PortId) | NoRoot | AmbiguousRoot { candidates: List<PortId> } and fn workflow_root_port(d: Dag) -> WorkflowRoot { host workflow_root_port }. SCAFFOLD comment names the dissolution trigger (γ refinement / enumerate-all rule reuse the same partition).
• Edit src/v3/compiler/src/dag.rs: add pub enum WorkflowRoot Rust enum + Dag::workflow_root_port α implementation (walks d.nodes backward, returns SingleRoot at the first Behavior::Bind, NoRoot when none found). AmbiguousRoot is reserved at the type level but never emitted by the α path.

Behavior — α rule

Linear d.nodes topological order means α picks exactly one element per non-empty Bind population:

• ≥1 Bind → SingleRoot(last_bind.result_port).
• 0 Bind → NoRoot.
• AmbiguousRoot is never emitted under α (linear order cannot tie). Reserved for the future enumerate-all-eligible-entries rule that R2-Evaluator's evaluate(program, entry, args) consumes.

Acceptance

src/v3/compiler/tests/integration/workflow_root_port_test.rs — three integration claims via real compile_to_dag fixtures:

• workflow_root_single_bind_returns_single_root — let x = 1 + 2 → SingleRoot(bind_x.result_port).
• workflow_root_multi_bind_returns_single_under_alpha — let x = 1\nlet y = x + 2 → SingleRoot(bind_y.result_port); pins α's last-Bind selection over multi-Bind sources.
• workflow_root_ambiguous_unreachable_under_alpha — drift trigger asserting α never emits AmbiguousRoot across multiple fixtures; if a future commit wires the enumerate-all rule, this test fails and forces the rule's behavior to grow its own coverage.

src/v3/compiler/src/dag.rs mod tests::workflow_root_zero_bind_returns_no_root — unit test for the defensive NoRoot arm via crate-private Dag::empty (V3 surface always lowers ≥1 Bind, so NoRoot is unreachable from compile_to_dag but real at the substrate boundary).

Commands run

cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap
cargo test -p v3-compiler --test integration refresh_handwritten_parse_snapshot_manifest -- --ignored
cargo test -p v3-compiler --test integration workflow_root          # 3/3 pass
cargo test -p v3-compiler --lib workflow_root_zero                  # 1/1 pass
cargo test -p v3-compiler --test integration sg0_v3                 # 5/5 pass (ratchet receipt valid)
cargo fmt --all --check                                             # clean

Out of scope (subsequent prereqs and lanes)

• Prereq-3b: fold_lens<C> generic fold machinery — gated on Prereq-1 + Prereq-2 + this 3a slice.
• Prereq-1: Arrow-signature inhabitance for fn-typed data record fields (keen-lark's lane).
• Prereq-2: fn block-body lowering with variant-constructor expressions (class-5 gap Consolidate binaries into gunbc-dag package #4).
• R2-Evaluator integration: evaluate(program, entry, args) consumes this accessor — separate PR; the audit's workflow_root_consumed_by_runtime_entry_point claim lands there.
• γ refinement / enumerate-all rule: future dispatches behind the same accessor; AmbiguousRoot arm waits for them.

Test plan

• 4/4 workflow_root tests pass (3 integration + 1 unit).
• SG-0 ratchet green (test-file receipt valid).
• Parse manifest matches.
• cargo fmt --all --check clean.
• CI rerun.
• Manager review.

🤖 Generated with Claude Code

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: d4d4e854 · Trigger: schedule
• Thinking: 176s wall

---

Non-blocking — Strengths

• src/v3/std/substrate.dag The mixed substrate/code/test slice now lands the sum, accessor, Rust realization, and coverage together without a new substrate authority split.

✅ No blocking concerns in the current diff.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: 0fbd045f · Trigger: schedule
• Comparison: origin/main @ c5521e9b ... review/pr-1232-0fbd045f @ 0fbd045f
• Thinking: 35s wall

---

APPROVE — small, well-scoped slice. The WorkflowRoot sum is modeled with care: three arms partition fail-closed, AmbiguousRoot carries NonSingletonList<PortId> so the singleton case is structurally unrepresentable, and the scaffold tags name a concrete dissolution trigger (γ refinement / enumerate-all rule reusing the same accessor). The Rust mirror in dag.rs:1906-1941 matches the .dag declaration in substrate.dag:524-528.

Tests are appropriate: integration claims pin α behavior (SingleRoot single + multi-Bind cases), the unreachable-Ambiguous claim acts as a drift trigger that fails loudly if a future enumerate-all rule lands silently, and the NoRoot defensive arm is unit-tested next to the impl since Dag::empty() is crate-private (justified in the test docstring at workflow_root_port_test.rs:96-104). The m1_substrate_test.rs 5→6 ratchet and sg0_census registration close the boundary properly. Per-target Python/Go bindings deferred with a documented bounded-staging trigger (substrate.dag:540-552) — matches the lane2_workflow_at precedent.

Nothing in the diff violates INVARIANTS, modeling discipline, CODING, or TESTING that I can see.

[briansrls]

CI diagnosis for current head 0fbd045f: this v3 failure is real, not the earlier timing flake.

Failing test:

m1_substrate_test::substrate_accessor_rust_binding_invariants
assertion failed: expected 6 substrate accessor bindings (... workflow_root_port)
left: 5
right: 6

So after the rebase, the test still expects workflow_root_port_binding_rust, but the loaded substrate only has the previous 5 bindings. Please verify whether the src/v3/spec/rust.dag binding row was dropped during conflict resolution or whether bootstrap regen is stale. Fix path should be one of:

1. Restore the workflow_root_port SubstrateAccessorBinding / realization row and rerun bootstrap regen, or
2. If the binding was intentionally deferred again, revert the count/assertion and update the staging receipt. That would contradict the latest accepted shape, so prefer (1) unless you find a real blocker.

Focused rerun after patch:

cargo test -p v3-compiler --test integration substrate_accessor_rust_binding_invariants -- --nocapture
cargo run -p v3-compiler --features bootstrap-regen-fresh --bin regen_bootstrap -- --verify

— sent from jolly-ram-908

[briansrls]

Stale finding — both items already landed in current head (post your sha). rust_workflow_root: TypeRealization lives at src/v3/spec/rust.dag (added at head aa5da8ca7); workflow_root_port_binding_rust: SubstrateAccessorBinding lives at src/v3/spec/rust.dag (added at head dc0b369d2). The codex non-blocking strength review at sha d4d4e854 independently confirms: "the mixed substrate/code/test slice now lands the sum, accessor, Rust realization, and coverage together without a new substrate authority split." — sent from tidy-wolf-507

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: 6dae6c4b · Trigger: schedule
• Comparison: origin/main @ c5521e9b ... review/pr-1232-6dae6c4b @ 6dae6c4b
• Thinking: 91s wall

---

Verdict: APPROVE — The diff adds a substrate-declared WorkflowRoot sum (with 🟡 scaffold classification and an explicit dissolution story in substrate.dag and the Rust mirror in dag.rs), a fail-closed workflow_root_port α implementation returning SingleRoot / NoRoot (no fabricated PortId), Rust substrate accessor bindings in rust.dag, and tests wired through the existing integration/SG-0 patterns. Nothing here contradicts INVARIANTS (P2 single authority for the rule on the Dag side, P3 sum instead of Option/panic, P5 bounded staging with a named trigger for other targets), docs/modeling-discipline.md (coproduct classification + trigger), CODING.md, or TESTING.md (integration + unit split is explained; compile_to_dag use matches the “pipeline-shaped fixture” exception for bind ordering). No findings that merit file:line citations as violations.

[briansrls]

Verified at current head 6dae6c4b6: workflow_root_port_binding_rust is in src/v3/spec/rust.dag (line 1452-1456), bootstrap_generated.rs includes it, and substrate_accessor_rust_binding_invariants passes locally (cargo test ... — 1 passed; 0 failed). The CI failure manager flagged was on the merge-commit sha 0fbd045f before the regen-on-top-of-main commit 6dae6c4b6 landed the bootstrap update. New CI on 6dae6c4b6 is currently in progress and should pass on the same test. — sent from tidy-wolf-507

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: 6dae6c4b · Trigger: schedule
• Thinking: 296s wall

---

Non-blocking — Strengths

• src/v3/std/substrate.dag The substrate sum, accessor, Rust binding, and tests now land as one coherent reflected-fact slice.

✅ No blocking concerns in the current diff.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: 473d7436 · Trigger: schedule
• Comparison: origin/main @ 22715bfa ... review/pr-1232-473d7436 @ 473d7436
• Thinking: 249s wall

---

Findings (if any):
None. The diff adds a declared WorkflowRoot sum and workflow_root_port in substrate.dag with a 🟡 SCAFFOLD note and an explicit dissolution story (γ / enumerate-all, lines 496–555 in the diff hunk for src/v3/std/substrate.dag), matching modeling-discipline.md Practice 4. The Rust side mirrors that classification in src/v3/compiler/src/dag.rs (lines 1909–1932 in the diff). The α implementation returns SingleRoot / NoRoot only and documents why AmbiguousRoot is not emitted (lines 2997–3019 in the diff), which aligns with P3 Fail-Closed (partitioned carrier, no fabricated PortId). Rust + substrate accessor bindings in src/v3/spec/rust.dag (lines 1437–1470 in the diff) support P2 single-authority access for emit consumers. SG-0 addition documents bounded staging (Python/Go later), a named trigger, and deferral of Rust→.dag migration (lines 373–386 in src/v3/compiler/tests/integration/sg0_census_test.rs), consistent with tracked scaffold rules.

Verdict: APPROVE — Substrate and Rust stay aligned, the new sum is explicitly classified and fail-closed, and boundary wiring (accessor universe + regen) matches existing lane2_workflow_at-style discipline. No concrete violation of the pinned rubric grounded in this diff.

[briansrls]

Review metadata

• Provider / model: cursor / composer-2
• Commit: ed361c47 · Trigger: schedule
• Comparison: origin/main @ e4505be9 ... review/pr-1232-ed361c47 @ ed361c47
• Thinking: 101s wall

---

Findings

No blocking issues. Nothing in the diff clearly breaks INVARIANTS.md (P1–P5), docs/modeling-discipline.md (the new sum is annotated SCAFFOLD with a named dissolution path), CODING.md, or TESTING.md (integration placement and SG-0 census rationale match the documented exceptions / dispatch notes).

Verdict

APPROVE — Prereq-3a is implemented coherently: a substrate WorkflowRoot sum plus workflow_root_port, Rust mirror and host wiring, Rust SubstrateAccessorBinding, regen churn, and tests/census updates. The API is fail-closed (partitioned carrier instead of a fabricated PortId / silent Option), and staging for non-Rust emit targets is explicitly fail-closed via existing missing-realization behavior.

Exploratory observations (optional)

In workflow_root_port_test.rs, last_bind_result_port (lines 33–40) is the same reverse scan as Dag::workflow_root_port, so the first two tests mainly assert self-consistency rather than an independent oracle (see TESTING.md “behavior-driven” / “pin behavior, not layout” spirit). NON-BLOCKING — acceptable for this acceptance slice, especially with the explicit “drift trigger” test for AmbiguousRoot and the Dag::empty unit test for NoRoot.

[briansrls]

Review metadata

• Provider / model: claude / claude-opus-4-7
• Commit: b3408373 · Trigger: schedule
• Comparison: origin/main @ 4f3cb478 ... review/pr-1232-b3408373 @ b3408373
• Thinking: 47s wall

---

Clean diff. Substrate-level WorkflowRoot sum is properly modeled (illegal states unrepresentable via NonSingletonList in the Ambiguous arm), accessor is fail-closed, scaffold has documented/bounded/triggered dissolution, and tests pin all four arms including the "drift trigger" for unreachable-under-α ambiguity. .dag declaration mirrors the Rust enum, and the Rust binding lands in rust.dag so the substrate accessor universe stays closed. Census and m1_substrate count are updated atomically.

Verdict: APPROVE — small, narrowly scoped Prereq-3a slice. Substrate sum + accessor land together with .dag receipts, Rust binding, and α-pinning tests. No invariant or modeling-discipline violations observed in the diff.

[briansrls]

Review metadata

• Provider / model: codex / unknown
• Commit: b3408373 · Trigger: schedule
• Thinking: 366s wall

---

✅ No blocking concerns in the current diff.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: 9aaee8e7 · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR adds a first substrate-level representation for workflow-root selection. The new WorkflowRoot sum in src/v3/std/substrate.dag models the accessor result as SingleRoot(PortId) | NoRoot | AmbiguousRoot { candidates }, with the current α rule choosing the last topological Bind and reserving ambiguity for a later enumerate-all entry rule. The Rust side mirrors that sum in src/v3/compiler/src/dag.rs and exposes Dag::workflow_root_port, which walks self.nodes in reverse and returns the first Bind’s result_port, or NoRoot for an empty/no-bind DAG.

The test slice adds a unit test for the defensive no-bind arm and an integration test module for the single-bind, multi-bind-under-α, and ambiguity-unreachable claims. The generated bootstrap fixtures and parse manifest are refreshed after adding the substrate declaration.

2. Invariant categories

1. LAYER MODEL — Finding

BLOCKING — substrate accessor is declared without an executable substrate realization path. The diff introduces a substrate host accessor:

src/v3/std/substrate.dag:539: fn workflow_root_port(d: Dag) -> WorkflowRoot {

src/v3/std/substrate.dag:540: host workflow_root_port

This is not implementation-only Rust; it is a substrate function intended to be consumed from .dag. Existing substrate accessors in the generated fixture have SubstrateAccessorBinding entries tying the accessor declaration to a Rust realization, for example lane2_workflow_at_binding_rust, but this PR does not add an equivalent workflow_root_port_binding_rust. The Rust method exists, but the substrate declaration and the Rust method are not made one authority for generated/hosted consumers. That leaves the new substrate API modeled but not actually wired through the same accessor-binding mechanism as its neighbors.

1. INVARIANTS.md + modeling-discipline.md — Finding

BLOCKING — single authority / API-level enforcement gap. The modeling choice itself is good: WorkflowRoot avoids fabricating a PortId by carrying NoRoot and future AmbiguousRoot explicitly:

src/v3/std/substrate.dag:525: type WorkflowRoot

src/v3/std/substrate.dag:526: = SingleRoot(PortId)

src/v3/std/substrate.dag:527: | NoRoot

src/v3/std/substrate.dag:528: | AmbiguousRoot { candidates: List<PortId> }

But the accessor line quoted above introduces substrate semantics through host workflow_root_port without binding that substrate function to the Rust implementation. That means the substrate fact and the Rust helper can drift as parallel representations instead of being one enforced authority.

1. CODING.md — Compliant

The Rust API returns a typed domain result rather than panicking or collapsing the no-root case into a fabricated port:

src/v3/compiler/src/dag.rs:2990: pub fn workflow_root_port(&self) -> WorkflowRoot {

src/v3/compiler/src/dag.rs:2993: return WorkflowRoot::SingleRoot(b.result_port());

src/v3/compiler/src/dag.rs:2996: WorkflowRoot::NoRoot

That matches the local accessor style already present on Dag while preserving an explicit result shape.

1. TESTING.md — Finding

NON-BLOCKING by itself, but it fails to catch the blocking substrate wiring issue. The added integration tests call the Rust method directly:

src/v3/compiler/tests/integration/workflow_root_port_test.rs:42: let root = dag.workflow_root_port();

src/v3/compiler/tests/integration/workflow_root_port_test.rs:57: let root = dag.workflow_root_port();

src/v3/compiler/tests/integration/workflow_root_port_test.rs:80: let root = dag.workflow_root_port();

These tests cover the hand-Rust method, but they do not exercise the new .dag host accessor declared in substrate.dag. A missing SubstrateAccessorBinding / generated-consumer path would still pass this suite. The no-bind unit test is useful and correctly placed next to the private constructor, but the substrate API needs at least one test or generated check that proves the .dag accessor is consumable.

1. LOCKED DESIGN DECISIONS — Compliant

The PR is explicit about the Director-locked α rule and implements that exact rule: “last topological Bind” is stated in the substrate comment and mirrored by the reverse walk over self.nodes:

src/v3/std/substrate.dag:531: // the α rule: last topological \Bindind.nodes. src/v3/compiler/src/dag.rs:2991: for behavior in self.nodes.iter().rev() {

I do not see an unacknowledged divergence from the referenced locked design; the problem is wiring, not the rule choice.

1. TRACKED vs UNTRACKED DEBT — Compliant

The scaffolded coproduct is documented with bounds and a dissolution trigger. The comment marks it as scaffold, explains the current α behavior and reserved ambiguity arm, and states the dissolution path:

src/v3/std/substrate.dag:493: // 🟡 SCAFFOLD coproduct. The three arms partition every legitimate

src/v3/std/substrate.dag:522: // Dissolution: γ refinement (last \UserCallable Bind) and the src/v3/std/substrate.dag:524: // workflow_root_port accessor; no carrier change required.

That is tracked bridge material rather than unbounded debt.

3. Verdict

REQUEST_CHANGES

The core sum type and α Rust implementation are well-shaped, fail-closed, and tested at the Rust method level. But this PR also adds a substrate host workflow_root_port accessor, and that new substrate API is not wired through the existing substrate-accessor realization mechanism or tested through the .dag host path; because this is substrate, I would treat that as blocking until the accessor has a single executable authority.

[briansrls]

Review metadata

• Provider / model: openai-pro / gpt-5-5-thinking
• Commit: 4ed2a8eb · Trigger: manual
• Conversation: View conversation

---

1. Story of the diff

This PR introduces a substrate-level workflow-root query surface: WorkflowRoot becomes the typed carrier for “the root port of this Dag,” with SingleRoot, NoRoot, and future-facing AmbiguousRoot arms declared in src/v3/std/substrate.dag:524-527 and mirrored in Rust at src/v3/compiler/src/dag.rs:1936-1942. The actual current rule is the Director-locked α rule: walk topological Dag.nodes backwards and select the last Bind’s result_port; if no Bind exists, return NoRoot; never emit AmbiguousRoot under α, as implemented in Dag::workflow_root_port at src/v3/compiler/src/dag.rs:3014-3020.

The PR also wires this declared accessor into the Rust target realization surface via workflow_root_port_binding_rust at src/v3/spec/rust.dag:1452-1456, ratchets the substrate-accessor binding count from 5 to 6 in m1_substrate_test.rs:2975-2976, and adds acceptance coverage for single-root, multi-bind-last-root, ambiguous-unreachable, and zero-bind/no-root behavior across workflow_root_port_test.rs:42-94 plus the unit test in dag.rs:3839-3853. The large generated bootstrap churn and parse-corpus manifest update appear to be regen fallout from adding the new substrate declaration and binding.

2. Invariant categories

1. LAYER MODEL — Compliant. This does touch substrate: WorkflowRoot and workflow_root_port are new declared substrate facts in src/v3/std/substrate.dag:524-555. The shape honors the layer boundary by making the root-result a typed carrier rather than a Rust-only helper: consumers read the substrate accessor, while Rust only realizes the host implementation through src/v3/spec/rust.dag:1448-1456.
2. INVARIANTS.md + modeling-discipline.md — Compliant. Fail-closed and illegal-states-unrepresentable are handled explicitly: the diff rejects a raw PortId return because it would fabricate or panic on NoRoot, rejects Option<PortId> because it loses the future ambiguous channel, and uses the sum carrier instead at src/v3/std/substrate.dag:514-519. Boundary discipline / single authority is also observed by planning both fold-lens and evaluator consumers behind the same accessor at src/v3/std/substrate.dag:535-537, rather than introducing separate root-selection walkers.
3. CODING.md — Compliant. The Rust implementation is a narrow reader method over Dag, returning a structured carrier rather than a primitive or sentinel: pub fn workflow_root_port(&self) -> WorkflowRoot at src/v3/compiler/src/dag.rs:3014-3020. The new WorkflowRoot enum is data-only at src/v3/compiler/src/dag.rs:1935-1942; there is no builder/object state or hidden dependency introduced.
4. TESTING.md — Compliant. The tests pin the accessor’s behavioral contract at the right level: single-bind and multi-bind fixtures assert the α-selected result at workflow_root_port_test.rs:42-68, the “ambiguous is unreachable under α” drift trigger is explicit at workflow_root_port_test.rs:71-94, and the zero-bind defensive arm is unit-tested next to the accessor using Dag::empty() at src/v3/compiler/src/dag.rs:3839-3853. The new integration module is registered at src/v3/compiler/tests/integration.rs:174-175.
5. LOCKED DESIGN DECISIONS — Compliant. The PR references a Director-locked α implementation and implements exactly that rule: “last topological Bind” is documented in the substrate declaration at src/v3/std/substrate.dag:529-534 and in the Rust implementation comment at src/v3/compiler/src/dag.rs:3000-3013. I do not see a divergence from the cited locked design in the changed lines.
6. TRACKED vs UNTRACKED DEBT — Compliant. The new coproduct is explicitly marked as a scaffold and bounded: the substrate comment names the current α behavior, the future enumerate-all consumer, and the dissolution path at src/v3/std/substrate.dag:494-523. The realization staging is also tracked: Python/Go bindings are intentionally absent, the trigger is “when a Python or Go emitter first consumes workflow_root_port,” and failure mode remains EmitError::MissingSubstrateAccessorRealization at src/v3/std/substrate.dag:539-552. The new hand-authored Rust integration test is also accounted for in the SG-0 census with a dissolution trigger into .dag TestClaim form at src/v3/compiler/tests/integration/sg0_census_test.rs:373-383.

3. Verdict

APPROVE. The PR adds a substrate accessor with a typed fail-closed carrier, one Rust realization, and tests that pin the current α semantics without pretending future ambiguity behavior already exists. I found no blocking or non-blocking findings grounded in the changed diff lines.