Skip to content

Derived-node identity step 2, shape 2: unify_generics reads a container slot through child_type_node - #13330

Closed
gunbai-bot[bot] wants to merge 16 commits into
mainfrom
session/jolly-pike-330-unify-slot-contract
Closed

gunbai-bot[bot] wants to merge 16 commits into
mainfrom
session/jolly-pike-330-unify-slot-contract

Conversation

@gunbai-bot

@gunbai-bot gunbai-bot Bot commented Oct 5, 2026

Copy link
Copy Markdown
Contributor

Derived-node identity step 2, shape 2 of gunbc.recurring_failure_mode generic_identity_decided_by_spelling: wrong code accepted. take_s(s: head_of(xs: [1], d: 2)), with take_s(s: String), is Accepted on main and returns Int 1 where a String is declared. Stacked on #13329.

Derivation (DESIGN §6b)

  1. v1.compiler.types make_container_type builds a list literal's type as List with one slot child. The slot is named after List's own parameter (T) and holds the element in inferred = Resolved { element }. The slot is read through v1.compiler.types child_type_node, which already owns that contract.

  2. v1.compiler.infer unify_generics descends one level and binds the formal leaf T to the actual slot node itself, a node spelled T, instead of to child_type_node of it. This is the earliest unjustified boundary.

  3. substitute_generics_apply's self-binding guard sees T == T and keeps T unsubstituted. That guard is correct about a real self-binding; here it is fed the wrong input. As a result:

    • the call's result stays an unresolved T, which conformance does not judge (shape 2);
    • srv3's labels has no method surface (shape 1: function 'join' not found in scope).

    With xs: ints() the actual child is a plain Int leaf, so the call refuses Int at String. That is the row's discriminating pair.

Repair: unify_generics(formal: fc, actual: child_type_node(ch: ac), ...). One line, no new carrier, and the guard at step 3 is not touched. The row's earlier repair (a) keyed the guard on identity instead, and that broke 00_compile.

Predictions, recorded before the run

The predictions were sent to the program owner at 2026-10-05T00:53:56Z, before the measurement started. Outcomes are filled in beside them, misses included.

# prediction outcome
1 take_s(s: head_of(xs: [1], d: 2)) refuses Int at String; the String-argument control stays accepted pending
2 srv3 the_readback_never_runs_after_a_failed_step resolves and returns true pending
3 00_compile still resolves; the regen round converges pending
4 census: caller_literal's collision reading leaves the unsubstituted arm; no conformance row regresses pending

Extra checks the program owner asked for, also pending:

  • (i) the census's foreign-parameter counts on the v2 compile closure, before and after. Only the 'unsubstituted' readings should move.
  • (ii) the self-host emitted-artifact diff.

If (2) holds but (1) does not, unify_generics is not the only boundary.

🤖 Generated with Claude Code

gunbc-ci-auto-heal and others added 16 commits October 4, 2026 13:58
…ment (output grain)

v1.tests.claim.generic_identity_census reads the typed graph and records, per
stored type node, which generic-identity marks it carries. Its blind spot is a
typed UNOBSERVED population in every receipt.

Not ready to push: the mirror and lib.rs line were emitted by a local compiler
that is not main's emitter and must be regenerated; the gunbc test label and the
callee-argument column are not written yet.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
claim_executor --regen-round-cost in a standalone clone, looped to
rebuild_packages=0. The census mirror and lib.rs line were already a fixed point.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…-identity census label

gi_supplied_node_readings calls substitute_generics_apply and unify_generics
over nodes the real producer emitted for the fixture. Not ready: the mirror
here may be stale against the .dag (a rebuild is in flight) and has not been
regenerated with --regen-round-cost. Stacks on #13290.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1. gi_foreign_reading is three-valued. "No marked occurrence in the owner's
   value arguments" no longer reads as "no occurrence": a leaf spelled as the
   parameter and carrying no mark is ForeignParameterValueArgumentUndecided.
2. The bound-call control and the collision reading rest on
   ResultCarrierObservation, which says whether the carrier was seen at all.
3. gi_sig_rows reads every signature, not only those declaring a type parameter.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…cuted control

owner_argument_arms_discriminate asks about one marked parameter under three
supplied owners built from head_of's real signature and requires three
different answers. missing_carriers_are_unobserved requires Unobserved for a
name with no item and for an item with no body.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…D conformance_keeps_the_parameter_mark (mirrors pending regen round)
…rebuild_packages=0)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
…pt the branch's superset)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
… (shape 2 repair; mirrors pending regen round)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

@gunbai-bot

gunbai-bot Bot commented Oct 6, 2026

Copy link
Copy Markdown
Contributor Author

Review 76999's blocker is valid. declaration_ref_is_type_parameter in dag/std/decl_ref.dag is a Bool projection over DeclField that drops the variant's payload. The DeclField constructors are already the one authority, so the fix is to inline the match at the single caller, node_is_type_parameter_reference in v1.compiler.resolve, and delete the helper. This draft is now owned by the identity step-2 remainder lane. That lane lands it after the fold_list accumulator-placeholder root it unmasks, rebased onto main, and the inlining goes into that rework. No push from me in the meantime.

— sent from gentle-dove-36

gunbai-bot Bot pushed a commit that referenced this pull request Oct 9, 2026
…olded, #13108 and #13330 dispositions

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
@gunbai-bot

gunbai-bot Bot commented Oct 9, 2026

Copy link
Copy Markdown
Contributor Author

Closed without folding in the v1 closeout bankruptcy (#13641). REQUEST_CHANGES (review 76999): a new std Bool predicate over DeclField. Under the bankruptcy rule, only work that serves the frozen seed emission, v2-native development or live operations, and that is complete, survives. The branch is kept for archaeology; no follow-up obligation is created. — sent from neat-wolf-604

@gunbai-bot gunbai-bot Bot closed this Oct 9, 2026
@gunbai-bot gunbai-bot Bot mentioned this pull request Oct 10, 2026
briansrls added a commit that referenced this pull request Oct 10, 2026
* dispatch-actuator witness: import the lineage, alignment and ticket names #13622's specimen uses

Review 78285 on #13622: the supplied-specimen claims call lineage_walk, lineage_is_rooted and alignment_chain and build TicketLine/TicketFields/NodeParent/AdmittedRoot/RoadmapNodeIdentity without importing them. They resolved only through the flat bare-name tier DESIGN schedules for removal, so they would go red when it is cut. Import each from its declaring module.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Revert "Merge #13548 (session/sharp-deer-755-unimported-type-import-migrate) into integration/sharp-raven-357"

This reverts commit 1a22abd, reversing
changes made to a04255a.

* native_emission_controls: repair integration union (close variant_literal_application_cases, one roster, one composition over all 17 case groups)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Exclude #13604 from integration/eager-gull-22: WIP, open REQUEST_CHANGES (review 78326)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* docs/design-rung-drops.md: regenerate through tools.docs_projection_gate regen after the #13569 merge

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* grammar: import int_to_decimal_string from std.integer (#13436 moved it; #13379's binding-power row still named v2.std.integer integer_int_to_decimal_string)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* WIP: mtcollins1 runner: boot leg, runner image medium + runner-host-up termin

* Realize reviewed kernel dependencies through guarded host maintenance

* Rewrite the cross-module record-field pin to the refusal it named as its trigger.

Infer now refuses `n: true` against `RcfFar` declared in another module; keeping the counted-Undecidable pin would be a meaning fork of the same claim name.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Close the post-main census: drop the Map interpolation hole, concat the spatial cast.

Merging main reintroduced one implicit stringify (Map Display in the canonical-order witness) and left the spatial_dimension `{o as String}` template as a v1 span mismatch. Named Int/Nat/Symbol routes stay; the Map hole is deleted rather than given a fourth renderer.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Regenerate fleet-converge.yml via generated_artifact_gate main_wet

Replaces the provisional #13359 copy taken at merge, which dropped main's printer mode, WIF provider rename and r2_cache options. Diff vs main is now only the two new custody credential options (cursor_worker_turn_api_key, codex_worker_turn_auth). Regenerated remotely (BuildBuddy invocation 3107c1bf-7c17-4bd4-92ec-53bb6b0be1fe) under a cgroup memory.max, regen exit 0.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Remove scratch witness scripts committed by the close-out flush (review 78354)

The wind-down flush committed untracked local files (.runwit*.sh, .probe2.sh, .wit/)
as 32dcf74. They are local receipt scaffolding, not part of the boot leg.
This restores the tree to 80c24b3.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* cax onboard: enumerate the closed-coproduct arms the floor's non-fold residue check refused

approved_grant_policy, plan_against_policy and provider_controlled_host matched closed coproducts
with a wildcard arm; each arm is now explicit, so a new variant refuses at compile rather than being
absorbed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* v1 closeout: open PR accounting

Every open PR, with its owning lane and its disposition in the mega branch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: add the side-chat dispositions and wave 2

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Regenerate stage0 emit_rust mirror for the integrated authorities (first_generation_equal=true, 0 installs on pass 2)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: bold-bee and qwen dispositions

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: outstanding work, closed PRs, and a re-sweep of all 162 open PRs

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: #13607, swift-bat-828 branches

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* integration/silent-lark-156: regenerate generated artifacts after merging #13472 and #13610

Produced by main_wet + claim_executor --required-regen on BuildBuddy at fd4421d;
second regen round installed nothing (fixed point).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: silent-lark, gentle-dove, royal-moth, neat-boar, nimble-heron, valiant-crab handoffs

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Second-type OpenRouter Retry-After and quota term (review 78356)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* v1 closeout accounting: lively-ram and silent-lark handoffs, #13460 folded, #13108 and #13330 dispositions

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Regenerate docs/design-rung-drops.md and the v1_compiler_emit_rust stage0 mirror for the integrated tree

Generated through docs_projection_gate regen and claim_executor --required-regen
on srv1; round 2 reports first_generation_equal=true (a fixed point).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: #13488, #13574, #13475, #13634 reviews; #13648 closed; archive-flush residue

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* provisional: gentle-dove-36 mirrors for conflicted generated files (seed bootstrap; regen replaces)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Revert "Merge #13574 into integration/gentle-dove-36"

This reverts commit 32720e2, reversing
changes made to eee50a4.

* provisional: v1_rt.rs from silent-lark-156 (carries host_budget_darwin_physical; seed bootstrap, regen replaces)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* provisional: v1_rt.rs = v1-closeout + silent-lark-156 delta (seed bootstrap; regen replaces)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* v1 closeout accounting: sharp-raven report, #13265, #13574 revert decision

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* provisional: append rt_host_budget (HostBudgetJoin*) to v1_rt.rs (seed bootstrap; regen replaces)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Exclude #13595/#13574 from integration/eager-gull-22 (operator decision msg_c695ffcc)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Exclude #13595/#13574 from integration/eager-gull-22 (operator decision msg_c695ffcc)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Fix stderr-capture tests so they hit real routes, not decoys.

Delete the rustc program that returned Err before spawn without compiling
emit_shell_stderr_policy_binding; absent policy is already refused at the
emit diagnostic wall. Drive Complete limits from the live host-budget join
and keep drain specimens on the emit_rust authority strings.

Co-authored-by: Cursor <cursoragent@cursor.com>

* fabric_quota: re-attach the window-start comment to quota_window_start (review 78371)

checked_second had been inserted between the comment and the function it documents.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Required CI: withdraw the four v1-judged lanes; the gate is emit-build alone (operator ruling 2026-10-09)

The operator's v1 withdrawal: v1 is no longer a validation authority, and
the one use left to the seed is emitting v2. gunbc.compiler_gate_workflow
drops `floor`, `generated`, `rust-unit-tests` and `seed`; the `witnesses`
aggregate reads the one remaining lane, `emit-build`, through the same
folded roster (one row). The GateArmSkippedOnPullRequest arm leaves with
its only inhabitant.

The loss is one declared drop, gunbc.rung_drop v1_required_lanes_withdrawn,
stated member by member (witnesses, stage0 mirrors and every generated
artifact, lint, v1 unit tests, module resolution outside the two emitted
closures, the downstream consumers), with a trigger that names the
capability: a binary built from an emission of v2 judging that population
on the required path. rust_unit_tests_off_pull_requests is Superseded (its
lane runs nowhere; trigger did not fire; the new row holds the loss).

gunbc.required_ci_contract_epoch moves to 2026-10-09.1: the name `witnesses`
now carries a materially different contract.

Consumers repaired rather than left dangling: the lane-resolution census
roster (the census now does not hold by design and is the instrument that
re-derives the drop's module population), DESIGN section 3's typed
required-gate reference (gunbc.documentary_refs, now
emitted_subject_build_rows), the Building & checks rows, the onboarding
path's run-witnesses step, five recurring_failure_mode evidence rows that
cited deleted declarations, and the two gate witness files (the blocking
set is asserted as exactly emit-build; a new RED asserts the four
withdrawn variables reach neither gate surface).

Projections regenerated by tools.generated_artifact_gate main_wet (the run
peaked at 15.8 GB RSS, against the 7.55 GiB that module's own note cites
for 2026-08-31): witnesses.yml, DESIGN.md, docs/design-rung-drops.md,
docs/onboarding.md; every other rostered artifact came out byte-identical.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Drop process-global budget env from stderr-capture tests.

review 78373: planting Complete limits through GUNBC_MEMORY_BUDGET_BYTES
leaked into parallel tests and did not inhabit the emit bind. Claim the
drain strings only; leave the host-budget join uncovered.

Co-authored-by: Cursor <cursoragent@cursor.com>

* regen round 0: stage0 mirrors from claim_executor --required-regen (supersedes provisional splices)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* provisional: re-append rt_host_budget to v1_rt.rs (round-0 regen emitted v1_rt.rs without it; seed bootstrap)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* regen round 2: stage0 mirrors (v1_rt.rs now emitted with rt_host_budget; hand-appended lines gone)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Regenerate generated artifacts for integration/eager-gull-22

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* required_ci_phase_roster: import std.optional (v2.std.optional moved by #13388; stale import from #13225)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* v1 closeout accounting: all lanes reported; remaining merge plan; closed auto-opened PRs

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Revert #13123 (admit_callers enforcement: mega's AdmitCallersEdge is the one enforcer)

* v1 closeout accounting: #13516 folded, #13212 dispositioned; every lane reported

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop #13545 transcribed-count red chunk (counts derive from ci_runner_sudo_binaries); retarget caller-admission real-route evidence to exact counts

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* v1 closeout accounting: eager-gull review outcomes, #13608 newer head, updated plan

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Drop the seed-growth citation of the deleted absent-policy decoy.

review 78381: hand_authored_declarations still named
emitted_absent_policy_refuses_before_spawn after that test was removed.
Absent policy stays cited as
capture_channels_without_stderr_capture_input_refuse_the_union.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Revert #13586 (receipt-only, excluded by operator review)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Revert #13453 (base-compiler/floor protocol; excluded by operator review): seed Rust, workflow steps and the script-row refusal API go with it

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* WIP: one required job, fresh products, memory envelope, heal-publish deletion (pre-merge, projections not yet regenerated)

* stage0 mirrors: restore generated mirrors to the mega branch's coherent set pending one regen round

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* floor_route_gap: give the belt exit-drain expectations their own chunk_43

Two folded PRs (#13442's seeded_filler rows and #13125's belt exit-drain rows) each
added floor_route_gap_expectation_chunk_42. The second silently replaced the first and
the native emitter refused (duplicate declaration). The exit-drain chunk becomes
chunk_43 and joins the roster, so both expectation sets are read.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* live_deploy: reconcile #13599 with #13583's directory authority

#13583 made owned directories the single directory authority (directory demands; host_directories)
and removed the directory kinds from the ensured steps and the instance parameter from
deployment_ensured_steps. #13599, folded alongside it, still called deployment_ensured_steps(instance:, target:)
and its witness matched on the deleted step kinds. The call passes target only, and the
lab-vs-production fabric-store claim now counts fabric_storage_store_directories demands in
deployment_directory_demands. Same claim, read through the surviving authority.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* roadmap_task_record: JSON codec for a runtime RoadmapNode (piece 1, uncompiled draft)

* roadmap_task_record witness

* roadmap_task_store: chain-partition roster over the fabric state binding, with wet witness (draft)

* roadmap_task_record: parent and centering required on the wire; drop nested optionals

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* managed_host: a superseded rung drop is not a standing citation

drop_is_standing_citation matched RungDropStanding with Retired and Standing only. Superseded has
existed since the 2026-10-06 supersession, and the closeout's seed refuses the non-exhaustive match,
which reaches every closure through managed_host (generated_artifact_gate included). A superseded
drop no longer stands, so it is not a citation, the same as Retired. (Found by smart-gull-336.)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* WIP: federation retired-path row below imports; floor_demand pinned envelope rows; managed_host Superseded arm (pre-regen)

* Headless Claude dispatch: print argv, systemd unit, stream-json projection.

When the harness has no spark, ExecutorDefault can admit Claude if custody is present; events stay in the belt's Codex envelope. Credential converge on srv1 remains an operator decision.

Co-authored-by: Cursor <cursoragent@cursor.com>

* closeout: complete the #13453 revert -- gunbc.fleet_desired_admission_workflow no longer imports the deleted script-row refusal API

6ee1d21 (integration/v1-closeout) removed fleet_desired_candidate_fetch_script_row and candidate_scripts_refusal from gunbc.fleet_desired_candidate but left their consumer, so every entry whose closure reaches the generated-artifact registry refused to resolve (regen, verify, five gate witnesses). This is origin/main's shape of the file: the admission workflow emits its YAML directly again.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* closeout: complete the #13453 revert -- gunbc.fleet_desired_admission_workflow no longer imports the deleted script-row refusal API

6ee1d21 (integration/v1-closeout) removed fleet_desired_candidate_fetch_script_row and candidate_scripts_refusal from gunbc.fleet_desired_candidate but left their consumer, so every entry whose closure reaches the generated-artifact registry refused to resolve (regen, verify, five gate witnesses). This is origin/main's shape of the file: the admission workflow emits its YAML directly again.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
(cherry picked from commit 94464b1)

* roadmap_task_record: balance ticket decode braces

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Address review 78387: one Claude event mapping, explicit executor, transmit effort.

parse_codex_jsonl now classifies bounded Claude stream-json via claude_code_line_codex_kind; jq only bounds those lines. ExecutorDefault stays a harness refusal. Print argv carries --effort.

Co-authored-by: Cursor <cursoragent@cursor.com>

* v2 compiler: reconcile #13438's precedence climbing with #13582 and #12942

Two merge-born references to deleted code, found by emit-build on #13641:
- 02_parse: #13438's infix stamp still wrote ParseProvenanceState.frame / FrameMinted, which
  #13582 deleted with the packrat memo. The write goes; the sibling stamps already carry none.
- body_lowering_fold: #12942's sealed body_lower_fold_raw kept the pre-#13438 pipe-tower test
  (body_lower_is_pipe_tower_root / body_lower_tower_pipes_into_fold), which #13438 deleted. It now
  uses #13438's replacement predicate, body_lower_application_pipes_into_fold, and keeps
  #12942's sealed outcome.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fleet_converge_workflow: drop MtCollins1UiBundleObserve from the mode list

#13503 removed the UI-bundle-observe mode (AMI-bundle-derived MegaRAC content) from
FleetConvergeWorkflowMode but left it in fleet_converge_workflow_modes. Every name in the list
now resolves to a declared variant. (Found by smart-gull-336.)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* WIP: trip is a ByteSize derived from the slot envelope (review 78388 item 3); witness claim the_trip_sits_inside_the_slot_envelope

* Address review 78389: emit tmux event pipe only for tmux containers.

Claude and harness systemd spawn no longer derive readiness from tee/pipe emission or refuse as tmux-event-pipe-emit.

Co-authored-by: Cursor <cursoragent@cursor.com>

* closeout: two stale references from folded deletions

- first_element_of_a_list_has_three_spellings cited v2.std.optional Optional; the module is
  std.optional (#13388's move).
- authorization_pattern_selection_witness imported PastedOperatorToken, which #13568 removed
  with the pasted-token refusal; the import was unused.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Regenerated projections for the one-job gate, on the merged closeout tree

One main_wet of tools.generated_artifact_gate over this branch merged with
integration/v1-closeout a925452 (regen 632 s, verify 693 s, both exit 0,
on srv1 under capped MemorySwapMax=0 scopes), nine artifacts:

- witnesses.yml: both subject steps carry GUNBC_BIND_MEMORY_CGROUP_BYTES
  (the derived trip, 20 GiB) and the failure notice carries the envelope
  lines (what 137 means, no larger runner and no retry, the MEMORY RECEIPT).
- DESIGN.md, docs/design-rung-drops.md: the CI row and the drop roster.
- .gitattributes: the deleted heal-publish.yml leaves the generated-artifact
  merge list.
- fleet-converge.yml: the closeout's authority fix projected.
- tools/fabric_ci_fci1_bounded_execution_context.env: the fci1 context
  follows the slot (22/21 GiB).
- provisioning/srv{1,3,4}/gunbc-ghrunner.sudoers: a 22 GiB slot fits more
  slots per host than a 26 GiB one, so the derived rosters grow (srv1 gains
  srv1-10 and srv1-11). Desired state; applying it is the converge effect.

The witness batch on the same tree: 16 files, green except the two latent
reds already recorded in the PR (fci1_bounded_execution_context: a stale
envelope-basis expectation; heal_publication_boundary: 23/34).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* Enrol roadmap_task_store wet witness on the local-repo wet lane, as the allocation seam witness is

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Land the v2 cutover program as designed roadmap entries: 11 nodes, native_obligation_population plan, edges, RED acceptance witnesses

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* chore: regenerate drifted generated artifacts (ci auto-heal)


Ledger-Repair-Judged: docs/design-rung-drops.md
Ledger-Rows-Repaired: docs/design-rung-drops.md belt_liveness_publication_answers_unconsumed
Ledger-Rows-Repaired: docs/design-rung-drops.md bmc_secure_apply_converge_new_witness_eval_step_cost
Ledger-Rows-Repaired: docs/design-rung-drops.md edited_bin_witness_wet_rows_not_executed_by_ci
Ledger-Rows-Repaired: docs/design-rung-drops.md fixture_closure_union_unmodeled_stderr_capture
Ledger-Rows-Repaired: docs/design-rung-drops.md handoff_observer_is_sol_not_kvm_viewer
Ledger-Rows-Repaired: docs/design-rung-drops.md kvm_observer_protocol_wet_witnesses_deleted_with_the_observer
Ledger-Rows-Repaired: docs/design-rung-drops.md mtcollins1_boot_matrix_enrolment_dead_band_observed_only
Ledger-Rows-Repaired: docs/design-rung-drops.md mtcollins1_boot_matrix_new_witness_eval_step_cost
Heal-Candidate-Run: 38000315997

* closeout: regenerate stage0 mirrors and workflows from the folded tree

One emission round (operator ruling 2026-10-04) on srv1 at a925452:
claim_executor --required-regen, then generated_artifact_gate main_wet. Then on the
regenerated tree: seed build OK, gunbc test //gunbc/instruments:v2-native-cli exit 0,
//gunbc/instruments:self-host exit 0. Settles the files the folds left provisional
(fleet-converge.yml, the std_* and v1_compiler_* mirrors). docs/design-rung-drops.md was
already regenerated by CI auto-heal (17a309c).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* WIP: option B -- subject steps require the slot envelope; per-step trip withheld by the declared drop native_step_trip_awaits_fleet_job_cgroup; slot-grain receipt in gunbc test; seed-growth receipt (pre-regen)

* Enrol roadmap_task_store wet witness in floor_route_gap and the local-repo wet terminal, as the allocation seam witness is

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Regenerate ROADMAP.md, docs/plans and .gitattributes for the cutover rows; repair updated(...) wrapping

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Describe the envelope as slot-grain (option B) in witnesses-one-required-job; regenerate projections on the merged head

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Type the cutover receipt readings (closed kinds, ByteSize) and make the peak-above-trip control compare against the slot trip

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Subject steps require the slot envelope; the per-step trip waits on a fleet fact; the envelope decision is a .dag fold the seed mirrors

The first required run that passed GUNBC_BIND_MEMORY_CGROUP_BYTES
(38002497388 on a4b8f78) refused in four seconds: MemoryCgroupBindRefused,
the cgroup2 tree is not writable. memory_governor apply_memory_cgroup_bind
creates its leaf at the cgroup ROOT (a container-root design; the bind had
never been requested on the fleet) and a fleet job runs as the setpriv'd
job user under a root unit, so no job process can create the bound. The
operator approved the slot-grain arm (escalation 2026-10-09).

gunbc.memory_envelope (new) owns the decision and the verdict as folds over
supplied inputs -- the sibling of gunbc.memory_cgroup_binding -- and
test.claim.memory_envelope_witness_test reaches every arm by supplied value,
including the RED an inline decision could not: a slot requirement over a
process no numeric memory.max binds REFUSES (MemoryEnvelopeAbsent) rather
than running as bounded. The seed mirrors it arm for arm with unit tests;
the shells resolve the bounding cgroup through binding_cap_cgroup_dir (never
the peak locator), read memory.swap.max/.current/.peak (modeled in
extdeps.linux.cgroup_v2_memory) before and after the producer, print a
slot-grain MEMORY RECEIPT with event deltas and the peak labelled by whether
it rose, and refuse the run on any OOM kill or swap.

gunbc.emitted_subject_build_gate carries two envelope inputs and ONE
decision over them, native_step_memory_inputs(ownership): every subject step
REQUIRES the slot envelope (GUNBC_MEMORY_ENVELOPE_REQUIRED=slot, the
projection of EnvelopeSlotRequired) and the bind input at the derived trip
is withheld while gunbc.runner_slot_desired gunbc_runner_slot_job_cgroup_ownership
is JobOwnsNoBoundedCgroup. That is a fleet fact, not a rung drop -- nothing
on the required path ever held the trip -- so the climb is rostered as
gunbc.guarantee_stall native_step_trip_awaits_fleet_job_cgroup_stall
(grounding: unit delegation with DelegateSubgroup=, a per-job cgroup staged
by the root JIT wrapper, the governor's already-bound arm). The workflow and
the failure notice consume the fact; the witness exercises both arms by
supplied value, reads the live row, and asserts the bind KEY is absent.

The slot wall follows the ruling too: gunbc.runner_slot_allocation
gunbc_runner_slot_allocation_wall_holds drops its three floor conjuncts (a
slot sized to a tenant that no longer runs in it) and requires
MemorySwapMax == 0 instead of a swap above the maximum; the floor-fit drop
slot_row_pinned_below_demonstrated_demand_unrefused is Superseded with
v1_required_lanes_withdrawn as its loss holder; the slot witness re-pins the
row to 22/21/0 and its width alarms to the smaller slot's derivation
(srv1 12, srv3/srv4 21). The slot's demand oracle from here is the first
cold required run's MEMORY RECEIPT, a declared frontier.

The trip stays a ByteSize derived from the slot (review 78388 item 3). The
seed growth is receipted as gunbc.memory_envelope_receipt_seed_growth
(review 78391). The design document's CI row and the slot row's note say
the same.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* emit_rust: locate module via ModuleIndex.by_name; is_known_variant reads carried variant_to_enum (port of #13608 23f2d08, 8ff94ca; mirrors pending regen)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* decimal_digit_of_units: construct the units digit via the successor table; no D9 default for out-of-range Int

* closeout: bind variant_to_enum correctly at three #13665 call sites

import_variant_parent_for_name has no emit_info parameter; emit_specific_import_use_lines has no variant_to_enum binding.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Regenerate ROADMAP.md on the merged head; re-cite the envelope fact and stall

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Take sold Group B (srv9-srv12) out of everything that reaches hardware; declare fixture residue as a rung drop

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Supply sold Group B (srv9-srv12) as in-witness fixture population; production rosters stay empty

Chain: the scoped cut emptied dgx_spark_reserved_identities and the router bindings, so witnesses that
discriminated on the Group B population (commitment standings, admissibility, rail rows, topology
membership, reach labels) read nothing. spark_host_commitment_witness now folds the production
placement, claim and reservation rows over a local four-host fixture, with one inhabitance claim that
the production roster is empty; the topology, reach and site-locale witnesses are re-derived to the
emptied rosters. Under rung drop serving_fixtures_name_sold_group_b_hosts.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* Regenerate std_integer stage0 mirror (remote required-regen candidate)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* closeout: revert #13662's fold (operator decision 2026-10-10)

#13662 (headless Claude worker) stays outside the closeout. A child re-lands it into main after #13641, with its review findings resolved.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Recut to five durable outcomes: cold-run envelope receipt rename, acceptance-receipt framing, derived-universe denominator, stable frontier subject; six chores moved to runtime tasks; no red witnesses

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* roadmap: split the event carrier's directory demand into a leaf module

gunbc.roadmap.dashboard_instance_directories imported gunbc.roadmap.roadmap_event_carrier for one
directory function, and through it the dispatch actuator. With #13625's host_standup -> host_effect
import (c390a49), that closed a 13-module cycle (materialized_secret -> host_phase_status ->
host_standup -> host_effect -> live_deploy.spec -> dashboard_instance_directories ->
roadmap_event_carrier -> roadmap_dispatch_actuator -> cursor_harness_credential -> ...), and main_wet
refused to resolve. The demand moves unchanged to gunbc.roadmap.roadmap_event_carrier_directory;
the carrier, the directory list and the owned-directory witness import it from there.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Address review 78405: delete the never-red frontier-count decoration; eligibility and disjointness controls run over supplied members

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

* closeout: five merge-born refusals that main_wet found

- managed_host: HostnameAllocation no longer carries canonical_hostname; read it through
  allocated_canonical_hostname (hostname_allocation's name scheme, #13625).
- host_control_route: handle ManagedHostFoundUnderDeclaredDrop the way managed_host's own
  account lookup does: the standing still decides the BMC route.
- mtjade1_arrival_federation_provision: DedicatedFederation's principal_set became
  impersonation: FederationImpersonation; the arrival pool is a standing-pool impersonation.
- fleet_workflow_steps: ci_fleet_wif_auth_step_when passed if_condition twice (a merge of
  #13607 and #13625).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Make fleet-converge branch-agnostic and parseable.

GitHub refused the workflow on every push after the mode input description crossed ~10k characters. Shorten that description to an authority citation, pin WIF to the workflow file on any heads ref plus workflow_dispatch (not pull_request), and admit a deploy from the current branch when --candidate-branch is empty. expected_revision stays a check when supplied and otherwise is the dispatched sha.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Name the branch-dispatch ruling; type malformed expected_revision.

Comments no longer claim reviewed-main file trust. Absent vs malformed expected_revision are separate arms so admit_optional cannot parse prose.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Declare the named-revision and deploy-branch drop.

Those two refusals are a different subject from the WIF main pin; §4b(3) needs its own population and trigger.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Recut #13660: restore privileged WIF to reviewed-main equality.

A rung drop does not substitute for the trust boundary. Privileged fleet-converge federations pin workflow_ref and ref at main again; session-branch admission lives only on the development pin list, which is not bound to fleet-cloud-convergence.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Drop leftover census conflict markers and project the named-revision drop.

The recut commit had kept rebase markers in gcp_iam_approval_enforced_in_reviewed_code; the projection now carries fleet_converge_named_revision_and_branch against closeout.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Fix OidcClaimPin inhabitance and the privileged-pin wording fork.

branch_dispatch_claim_pins now constructs event_name via oidc_equals. Privileged jobs are described as reviewed-main equality; the development pin list is named as a frontier, not a live federation.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Split presented OIDC claims from pins; printer session-branch is a red.

Privileged printer pins equal reviewed main, so a concatenated session-branch workflow_ref must refuse. Admission now takes OidcPresentedClaim (name and value only); relation lives only on the pin.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Regenerate fleet-converge.yml (21 inputs) and pin dashboard-deploy to main.

GitHub refused the hand-edited 30-input file; emission from fleet_converge_dispatch_inputs is the repair. dashboard-deploy now requires refs/heads/main and environment srv1-production so a branch dispatch cannot wet-deploy production.

Co-authored-by: Cursor <cursoragent@cursor.com>

* closeout: revert #13663's fold (operator ruling: #13662 and #13663 stay outside the closeout)

deep-cat-540 recuts it onto main after #13641.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Omit Spark dispatch when the administrator roster is empty.

Review 78408: regeneration had folded a sold-out Spark roster into target options: [] while spark_* modes stayed selectable. Restoring srv5-srv12 would invent enrolled hosts. Emission now drops the target input and spark_* mode options, and refuses any remaining empty InputChoice.

Co-authored-by: Cursor <cursoragent@cursor.com>

* Treat srv1-production environment protection as the root-mutation boundary.

A branch dispatch runs that branch's YAML, so a github.ref if is not a trust boundary. dashboard-deploy, approval-broker-dark-install and microvm-controller-install now name srv1-production; the required GitHub setting (main-only deployment branches, required reviewers) is modeled with an unobserved readback. Checkout is the event sha.

Co-authored-by: Cursor <cursoragent@cursor.com>

* closeout: stage0 mirrors and projections regenerated at a fixed point on 5c0d9d5

The composed closeout tip (the #13663 revert and #13664's fixed head folded) could not regenerate itself: claim_executor --required-regen refused with Stage0EmittedEdgesNotCovered (62 emitted edge endpoints with no stage0 crate) and the committed mirrors did not build a seed. Two generation-1 facts explain both, and both are repaired in this set rather than worked around.

First, the regen's coverage check reads the host-shell roster from the TREE's src/v1/stage0/src/lib.rs (required_regen_host: closure_modules(lib.rs)), not from the seed. The integration-side regen from the d9368e8 seed, an emitter predating the crate planner (#13597), rewrote lib.rs without the three pub mod lines #13597's head 3674580 carried for gunbc_crate_partition, gunbc_emitted_crate_workspace and v1_compiler_emitted_workspace, while their mirrors and .dag sources stayed. Restoring the three declarations lets the regen run; the regenerated lib.rs then lists them canonically, which is the only change this set makes to lib.rs.

Second, --required-regen renders v1_rt.rs from the SEED's compiled-in runtime rows, so a boot seed older than the tree's runtime_rust.dag emits a candidate without the host-budget join that the tree's memory_governor mirror consumes, and generation 1 does not build (the closeout history records the same provisional step at 42954d2). The committed v1_rt.rs is kept for generation 1; generation 2, whose seed carries the tip's rows, emits it identically, so v1_rt.rs is unchanged here.

Recipe, on a shallow clone of 5c0d9d5 on srv1, each step under systemd-run --user --scope -p MemoryMax=80G -p MemorySwapMax=0: boot seed built from 3674580; main_wet; lib.rs roster repair; required-regen with the boot seed (first_generation_equal=false, 244-file candidate); install; v1_rt.rs restored; then the tip's own seed: build, main_wet, required-regen (generation 1: divergent, candidate installed; generation 2: first_generation_equal=true). No .dag file changes. The projections are main_wet's output over the composed tree: fleet-converge.yml regenerated from its 21-row authority (the committed 30-input file was drift), ROADMAP.md and docs/plans/native-obligation-population.md for #13664's recut, docs/design-rung-drops.md for the supersession, .gitattributes for the plan projection's merge driver.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* fleet-converge: omit the Spark target input and spark_* modes while the administrator roster is empty; refuse an empty choice at emission (port of ffe8a90)

The fixed-point regeneration on 5c0d9d5 faithfully emitted .github/workflows/fleet-converge.yml with `target: type: choice, options: []`, because gunbc.spark.credential_workflow spark_administrator_credential_roster has been empty since 2026-10-10 (every Spark sold) and gunbc.fleet_converge_workflow had no wall for an empty closed choice. GitHub rejects a choice input without options, so the regenerated workflow would have been undispatchable in every mode, not only the seven spark_* modes that read inputs.target; the previously committed file was drift the other way (hand-kept srv5..srv12 options for hosts no longer enrolled). Review 78408 on gunbc#13660 found this, and snappy-stag-26 fixed the authority there at ffe8a90; that PR is ruled outside the closeout at its WIF scope, so this commit ports exactly the empty-roster hunk and nothing of the WIF or environment changes.

What changes in the authority: fleet_converge_spark_target_modes names the seven modes that consume the target; fleet_converge_dispatchable_modes() drops them while fleet_converge_spark_target_options is empty, and fleet_converge_mode_options is derived from it; the dispatch inputs are now fleet_converge_dispatch_input_rows filtered by fleet_converge_dispatch_inputs, which omits `target` while the roster is empty; fleet_converge_empty_choice_input_names() enumerates every InputChoice with no options over the four DispatchInputType variants, and expected_fleet_converge_yml() refuses emission with those names before the input-count check (DESIGN section 5: refuse, do not emit options: []). The witness every_dispatch_option_is_a_wire_value_of_the_vocabulary joins the options to the dispatchable modes, and empty_spark_roster_does_not_emit_an_empty_choice_or_spark_dispatch_modes pins the current roster state. The fleet_workflow_steps.dag hunk of ffe8a90 is not needed here: the closeout's ci_fleet_wif_auth_step_when already passes if_condition by name.

The regenerated fleet-converge.yml is main_wet's output over this authority with the fixed-point seed; the stage0 mirrors are unchanged (the module is not in the emitted population) and required-regen stays at first_generation_equal=true.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* closeout: delete the accounting doc; the terminal ledger lives in #13641's body (review 5474794145)

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* closeout: revert the #13664 fold (5c0d9d5) per the operator's review 5477471759: close #13664 without folding, branch preserved; projections regenerated next

* deployment environments: model the branch policy as GitHub returns it (name + branch-or-tag rules), so the srv1-production standing can be discharged by a faithful GET (review 78420)

Review 78420 on gunbc#13660 (folded here at 60c9457) found that extdeps.github.deployment_environments modeled the deployment-branch policy as SelectedRefs { refs: ["refs/heads/main"] }, while the API carries no refs: the environment object's deployment_branch_policy is null or { protected_branches, custom_branch_policies }, and the custom rules live at GET /repos/{owner}/{repo}/environments/{name}/deployment-branch-policies as branch_policies rows { name, type } with type "branch" or "tag". A reading of the real API can therefore never match the modeled refs, so gunbc.auth.github_deployment_environment's standing could never move from Unobserved to Holds (DESIGN section 3: model what the API actually returns; section 5: a check that cannot be discharged is not a boundary).

The model now carries DeploymentBranchPolicyRule { name, ref_type: PolicyRefBranch | PolicyRefTag } under SelectedBranchesAndTags { rules }, the srv1-production requirement is the single branch rule named main with required reviewers, the restriction predicate requires exactly one rule that is a branch named main, and the read obligation names both GETs and the shapes they return. The witness gains a supplied-value control: a tag rule named main and a two-rule policy are not the main-branch boundary, the single branch rule is. Standing stays Unobserved until the operator applies the setting and its readback lands; that flip is the first follow-up on main.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

* closeout: regenerate at the fixed point on composition A (revert of #13664, fold of #13660)

Same recipe as f8c3fa4, on a shallow clone of dbdc9d2 with the previous fixed-point seed as the boot seed (srv1, logs8): main_wet exit 0; required-regen generation 0 drifted gunbc_cli_dispatch_surface.rs (gunbc.cli_dispatch_surface is touched by #13660), generation 1 drifted gunbc_cli_dispatch_generated.rs, generation 2 first_generation_equal=true planned=169 executed=169 adjudicated=169 declared_divergent=1 [main.rs]; verify (dry main) exit 0; rebuild; gunbc test //gunbc/instruments:v2-native-cli exit 0 (emit and build exit_status=0 warning_count=0 wall_s=611, discriminating red on v2_cli_compile_cli) and //gunbc/instruments:self-host exit 0 (wall_s=716, red on v2_compiler_compile). The projections resolved toward #13660's side in the merge (ROADMAP.md, fleet-converge.yml, docs/design-rung-drops.md) were byte-identical to main_wet's output, so only .gitattributes and the two cli_dispatch mirrors change here.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Brian Searls <briansearls1@gmail.com>
Co-authored-by: gunbc-ci-auto-heal <briansrls@gmail.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: gunbc-ci-auto-heal <gunbc-ci-auto-heal@users.noreply.github.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: x <x@x>
Co-authored-by: gunbai-bot[bot] <289086189+gunbai-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants